OSX_backdoor_Bella [yara]

uint32(0) == 0x752f2123
        and $h1 at 0
        and filesize < 120KB
        and @s0[1] < 100
        and @s1[1] < 100
        and @s2[1] < 100
        and
            1 of ($p*)
            or all of ($subpart1_*)
            or all of ($subpart2_*)