add yara rules BruteRatel

YARA/BruteRatel_badger.yar

@@ -0,0 +1,19 @@
+rule BruteRatel_badger
+{
+  strings:
+       //mov eax, 0x00
+       // push eax
+       //mov eax, 0x00
+       // push eax
+       //mov eax, 0x00
+       // push eax
+       //mov eax, 0x00
+       // push eax
+       //mov eax, 0x00
+       // push eax
+       //mov eax, 0x00
+       // push eax
+       $code = { B8 00 00 00 00 50 B8 00 00 00 00 50 B8 00 00 00 00 50 B8 00 00 00 00 50 B8 00 00 00 00 50 B8 00 00 00 00 50}
+  condition:
+      all of them
+}

YARA/brc4_badger.yar

@@ -0,0 +1,10 @@
+rule brc4_badger
+{
+meta:
+    description = "Identifies strings from Brute Ratel v1.1"
+strings:
+    $a = "\"chkin\":"
+    $b = "\"kimche\":"
+condition:
+    $a or $b
+}