rule jar_ratty_w0 {

    meta:
        author = "[redacted]"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/jar.ratty"
        malpedia_version = "20181105"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $main1 = "TheClient.classPK"
        $main2 = "RattyClient.classPK"
        $main3 = "Ratty.classPK"
        $s1 = "ActiveConnection.classPK"
        $s2 = "XorCipher.classPK"

    condition:
       all of ($s*) and 1 of ($main*)
}