Suspicious String Obfuscation Concat

yara/gen_suspicious_strings.yar

@@ -174,3 +174,16 @@ rule SUSP_LNK_File_PathTraversal {
          all of them
       )
 }
+
+rule SUSP_Script_Obfuscation_Char_Concat {
+   meta:
+      description = "Detects strings found in sample from CN group repo leak in October 2018"
+      author = "Florian Roth"
+      reference = "https://twitter.com/JaromirHorejsi/status/1047084277920411648"
+      date = "2018-10-04"
+      hash1 = "b30cc10e915a23c7273f0838297e0d2c9f4fc0ac1f56100eef6479c9d036c12b"
+   strings:
+      $s1 = "\"c\" & \"r\" & \"i\" & \"p\" & \"t\"" fullword ascii
+   condition:
+      1 of them
+}