rule osx_manuscrypt_w0 {

    meta:
        author = "AT&T Alien Labs"
        sha256 = "ccb5dc3a0e55e640fab5d6b6ac823328700836bcbe6423632428a0ead7436caf"
        tlp = "WHITE"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/osx.manuscrypt"
        malpedia_rule_date = "20201203"
        malpedia_hash = ""
        malpedia_version = "20201203"
        malpedia_sharing = "TLP:WHITE"
        malpedia_license = ""

   	strings:   
     		$s = { 436f6f6b69653a205f67613d25732530326425642564253032642573 }   
       condition:   
           all of them   
   }