"2024-01-18" modified = "2025-05-10" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/Latrodectus.yar#L1-L16" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" hash = "a547cff9991a713535e5c128a0711ca68acf9298cc2220c4ea0685d580f36811" logic_hash = "a8430299930f4c8de0a88c6836d4821871f7183cc5ff44ea9be84fbea47bbb13" score = 75 quality = 70 tags = "" cape_type = "Latrodectus Payload" strings: $fnvhash1 = {C7 04 24 C5 9D 1C 81 48 8B 44 24 20 48 89 44 24 08} $fnvhash2 = {8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01} $procchk1 = {E8 [3] FF 85 C0 74 [2] FF FF FF FF E9 [4] E8 [4] 89 44 24 ?? E8 [4] 83 F8 4B 73 ?? 83 [3] 06} $procchk2 = {72 [2] FF FF FF FF E9 [4] E8 [4] 83 F8 32 73 ?? 83 [3] 06} $version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89} condition: all of them } rule CAPE_Latrodectus_AES { meta: description = "Latrodectus Payload" author = "enzok" id = "16c295f5-cea0-57b5-b826-e1126e50c8cc" date = "2024-01-18" modified = "2025-05-10" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/Latrodectus.yar#L18-L34" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" hash = "5cecb26a3f33c24b92a0c8f6f5175da0664b21d7c4216a41694e4a4cad233ca8" logic_hash = "058d278c16527969066d1b4ea7f0e3ab2809d5480cdab06ec476b465e0c4795a" score = 75 quality = 70 tags = "" cape_type = "Latrodectus Payload" strings: $fnvhash1 = {C7 04 24 C5 9D 1C 81 48 8B 44 24 20 48 89 44 24 08} $fnvhash2 = {8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01} $key = {C6 44 2? ?? ?? [150] C6 44 2? ?? ?? B8 02} $aes_ctr_1 = {8B 44 24 ?? FF C8 89 44 24 ?? 83 7C 24 ?? 00 7C ?? 4? 63 44 24 ?? 4? 8B 4C 24 ?? 0F B6 84 01 F0 00 00 00 3D FF 00 00 00} $aes_ctr_2 = {48 03 C8 48 8B C1 0F B6 ?? 48 63 4C 24 ?? 0F B6 4C 0C ?? 33 C1 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 03 D1 48 8B CA 88 01} $version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89} condition: all of them } rule CAPE_Rokrat : FILE { meta: description = "RokRat Payload" author = "kevoreilly" id = "12e05b90-9771-5901-ae82-9fd2ea6263e7" date = "2019-10-30" modified = "2022-06-09" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/RokRat.yar#L1-L12" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "2aaa7de7ccd59e0da690f4bc0c7deaacf61314d61f8d2aa3ce6f6892f50612ec" score = 75 quality = 70 tags = "FILE" cape_type = "RokRat Payload" strings: $code1 = {8B 57 04 8D 7F 04 33 57 FC 81 E2 FF FF FF 7F 33 57 FC 8B C2 24 01 0F B6 C0 F7 D8 1B C0 D1 EA 25 DF B0 08 99 33 87 30 06 00 00 33 C2 89 87 3C F6 FF FF 83 E9 01 75 C9} $string1 = "/pho_%s_%d.jpg" wide condition: uint16( 0 ) == 0x5A4D and ( any of ( $code* ) ) and ( any of ( $string* ) ) } rule CAPE_Agent_Tesla { meta: description = "Detecting HTML strings used by Agent Tesla malware" author = "Stormshield" id = "5383994b-357d-539b-89b1-53be238f759d" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/AgentTesla.yar#L1-L17" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "3945754129dcc58e0abfd7485f5ff0c0afdd1078ae2cf164ca8f59a6f79db1be" score = 75 quality = 70 tags = "" version = "1.0" strings: $html_username = "<br>UserName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: " wide ascii $html_pc_name = "<br>PC&nbsp;Name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: " wide ascii $html_os_name = "<br>OS&nbsp;Full&nbsp;Name&nbsp;&nbsp;: " wide ascii $html_os_platform = "<br>OS&nbsp;Platform&nbsp;&nbsp;&nbsp;: " wide ascii $html_clipboard = "<br><span style=font-style:normal;text-decoration:none;text-transform:none;color:#FF0000;><strong>[clipboard]</strong></span>" wide ascii condition: 3 of them } rule CAPE_Agenttesla : FILE { meta: description = "AgentTesla Payload" author = "kevoreilly" id = "f7b930f1-cecb-5d80-809b-9503f282247a" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/AgentTesla.yar#L19-L41" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "1bf9b26c4cf87e674ddffabe40aba5a45499c6a04d4ff3e43c3cda4cbcb4d188" score = 75 quality = 70 tags = "FILE" cape_type = "AgentTesla Payload" strings: $string1 = "smtp" wide $string2 = "appdata" wide $string3 = "76487-337-8429955-22614" wide $string4 = "yyyy-MM-dd HH:mm:ss" wide $string6 = "webpanel" wide $string7 = "<br>UserName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:" wide $string8 = "<br>IP Address&nbsp;&nbsp;:" wide $agt1 = "IELibrary.dll" ascii $agt2 = "C:\\Users\\Admin\\Desktop\\IELibrary\\IELibrary\\obj\\Debug\\IELibrary.pdb" ascii $agt3 = "GetSavedPasswords" ascii $agt4 = "GetSavedCookies" ascii condition: uint16( 0 ) == 0x5A4D and ( all of ( $string* ) or 3 of ( $agt* ) ) } rule CAPE_Agentteslav2 : FILE { meta: description = "AgenetTesla Type 2 Keylogger payload" author = "ditekshen" id = "e60ecee4-0a97-56a1-b21e-47190f8cd1f8" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/AgentTesla.yar#L43-L67" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "b45296b3b94fa1ff32de48c94329a17402461fb6696e9390565c4dba9738ed78" score = 75 quality = 70 tags = "FILE" cape_type = "AgentTesla Payload" strings: $s1 = "get_kbHook" ascii $s2 = "GetPrivateProfileString" ascii $s3 = "get_OSFullName" ascii $s4 = "get_PasswordHash" ascii $s5 = "remove_Key" ascii $s6 = "FtpWebRequest" ascii $s7 = "logins" fullword wide $s8 = "keylog" fullword wide $s9 = "1.85 (Hash, version 2, native byte-order)" wide $cl1 = "Postbox" fullword ascii $cl2 = "BlackHawk" fullword ascii $cl3 = "WaterFox" fullword ascii $cl4 = "CyberFox" fullword ascii $cl5 = "IceDragon" fullword ascii $cl6 = "Thunderbird" fullword ascii condition: ( uint16( 0 ) == 0x5a4d and 6 of ( $s* ) ) or ( 6 of ( $s* ) and 2 of ( $cl* ) ) } rule CAPE_Agentteslav3 : FILE { meta: description = "AgentTeslaV3 infostealer payload" author = "ditekshen" id = "c8ddd838-6ad4-56f3-a0cd-b890f809018c" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/AgentTesla.yar#L69-L115" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "cc9bbbcf3608b49a76b098acf846ff03eae5e9cb107697627d62661fa1be36c2" score = 75 quality = 70 tags = "FILE" cape_type = "AgentTesla payload" strings: $s_specific1 = "get_kbok" fullword ascii $s_specific2 = "get_CHoo" fullword ascii $s_specific3 = "KillTorProcess" fullword ascii $s_specific4 = "GetMozilla" ascii $s_specific5 = "torbrowser" wide $s_specific6 = "bot%telegramapi%" wide $s_specific7 = "%chatid%" wide $s_typo = "set_Lenght" fullword ascii $m1 = "yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time" ascii $m2 = "%image/jpg:Zone.Identifier\\tmpG.tmp%urlkey%-f \\Data\\Tor\\torrcp=%PostURL%127.0.0.1POST+%2B" ascii $m3 = ">{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\\WScript.ShellRegReadg401" ascii $m4 = "%startupfolder%\\%insfolder%\\%insname%/\\%insfolder%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%insregname%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\RunTruehttp" ascii $m5 = "\\WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera" ascii $s_generic1 = "set_UseShellExecute" fullword ascii $s_generic2 = "set_IsBodyHtml" fullword ascii $s_generic3 = "set_AllowAutoRedirect" fullword ascii $s_generic4 = "set_RedirectStandardOutput" fullword ascii condition: (2 of ( $m* ) ) or ( uint16( 0 ) == 0x5a4d and ( 5 of ( $s_specific* ) or ( $s_typo and 4 of ( $s_generic* ) ) ) ) } rule CAPE_Agentteslav4 : FILE { meta: description = "AgentTesla Payload" author = "kevoreilly" id = "a39109ca-84cb-527d-b9c2-d8763fa6e496" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/AgentTesla.yar#L117-L130" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "0a39036f408728ab312a54ff3354453d171424f57f9a8f3b42af867be3037ca9" score = 75 quality = 70 tags = "FILE" cape_type = "AgentTesla Payload" packed = "7f8a95173e17256698324886bb138b7936b9e8c5b9ab8fffbfe01080f02f286c" strings: $decode1 = {(07|FE 0C 01 00) (07|FE 0C 01 00) 8E 69 (17|20 01 00 00 00) 63 8F ?? 00 00 01 25 47 (06|FE 0C 00 00) (1A|20 04 00 00 00) 58 4A D2 61 D2 52} $decode2 = {(07|FE 0C 01 00) (08|FE 0C 02 00) 8F ?? 00 00 01 25 47 (07|FE 0C 01 00) (11 07|FE 0C 07 00) 91 (06|FE 0C 00 00) (1A|20 04 00 00 00) 58 4A 61 D2 61 D2 52} $decode3 = {(07|FE 0C 01 00) (11 07|FE 0C 07 00) 8F ?? 00 00 01 25 47 (07|FE 0C 01 00) (08|FE 0C 02 00) 91 61 D2 52} condition: uint16( 0 ) == 0x5A4D and all of them } rule CAPE_Stxrat : FILE { meta: description = "No description has been set in the source file - CAPE" author = "YungBinary" id = "9ce51412-52ce-5682-802d-fad96c053c30" date = "2026-04-11" modified = "2026-04-14" reference = "https://www.esentire.com/blog/stx-rat-a-new-rat-in-2026-with-infostealer-capabilities" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/STXRat.yar#L49-L120" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "f82b832e6bf936ff936332c059b1d3b981ce387bf82964ecf64a9cb12cda955d" score = 75 quality = 70 tags = "FILE" cape_type = "STXRat Payload" strings: $s1 = { 8D 51 BF 83 FA 19 8D 41 20 0F 47 C1 C2 } $s2 = { 48 8D 05 ?? ?? ?? ?? 66 C7 45 ?? 48 B8 [0-6] 48 89 45 ?? 48 8D 55 ?? 66 C7 45 ?? FF E0 } $s3 = { 65 48 8B 04 25 60 00 00 00 80 78 02 01 } $s4 = "Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)" ascii $s5 = { B9 10 66 00 00 [0-3] 0F 44 C1 B9 0F 66 00 00 41 81 ?? C0 00 00 00 0F 44 C1 B9 0E 66 00 00 } $s6 = { 48 83 FB 5A 73 ?? 88 84 1C ?? ?? ?? ?? 48 FF C3 48 FF C1 8A 01 84 C0 75 } $s7 = { 83 61 18 00 83 61 14 00 C7 01 01 23 45 67 C7 41 04 89 AB CD EF C7 41 08 FE DC BA 98 C7 41 0C 76 54 32 10 C7 41 10 F0 E1 D2 C3 C3 } $s8 = { 80 61 1F 3F 80 49 1F 40 80 21 F8 } condition: uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) ) } rule CAPE_Arkei : FILE { meta: description = "Arkei Payload" author = "kevoreilly, YungBinary" id = "18363a5b-46f3-5d11-9bc6-a91f81b49706" date = "2019-10-30" modified = "2025-01-10" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/Arkei.yar#L1-L50" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "296e420880d8d2f24424d0411e7ef4939e18147689557512f410da48498a44c9" score = 75 quality = 70 tags = "FILE" cape_type = "Arkei Payload" strings: $string1 = "Windows_Antimalware_Host_System_Worker" $string2 = "Arkei" $string3 = "Bitcoin\\wallet.dat" $string4 = "Ethereum\\keystore" $v1 = "C:\\Windows\\System32\\cmd.exe" fullword ascii wide $v2 = "/c taskkill /im " fullword ascii $v3 = "card_number_encrypted FROM credit_cards" ascii $v4 = "\\wallet.dat" ascii $v5 = "Arkei/" wide $v6 = "files\\passwords." ascii wide $v7 = "files\\cc_" ascii wide $v8 = "files\\autofill_" ascii wide $v9 = "files\\cookies_" ascii wide $loaded_modules = { 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 8B 00 8B 40 18 89 45 FC 8B 45 FC 8B E5 5D C3 } $language_check = { FF 15 ?? ?? ?? ?? 0F B7 C0 89 45 ?? 81 7D ?? 3F 04 ?? ?? 7F } $ext1 = ".zoo" ascii $ext2 = ".arc" ascii condition: uint16( 0 ) == 0x5A4D and ( ( $loaded_modules and $language_check and $ext1 and $ext2 ) or ( all of ( $string* ) or 7 of ( $v* ) ) ) } rule CAPE_Gandcrab : FILE { meta: description = "Gandcrab Payload" author = "kevoreilly" id = "0082e8c9-952e-508c-a438-4e17b8031864" date = "2019-10-30" modified = "2022-06-09" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/Gandcrab.yar#L1-L14" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "354ed566dbafbe8e9531bb771d9846952eb8c0e70ee94c26d09368159ce4142c" score = 75 quality = 70 tags = "FILE" cape_type = "Gandcrab Payload" strings: $string1 = "GDCB-DECRYPT.txt" wide $string2 = "GandCrabGandCrabnomoreransom.coinomoreransom.bit" $string3 = "action=result&e_files=%d&e_size=%I64u&e_time=%d&" wide $string4 = "KRAB-DECRYPT.txt" wide condition: uint16( 0 ) == 0x5A4D and any of ( $string* ) } rule CAPE_Jaff : FILE { meta: description = "Jaff Payload" author = "kevoreilly" id = "6681c1fe-6c88-5a49-bdfa-54ce08ea6707" date = "2019-10-30" modified = "2019-10-30" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/Jaff.yar#L1-L14" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "6806a5eeee04b7436ff694addc334bfc0f1ee611116904d57be9506acfd47418" score = 75 quality = 70 tags = "FILE" cape_type = "Jaff Payload" strings: $a1 = "CryptGenKey" $a2 = "353260540318613681395633061841341670181307185694827316660016508" $b1 = "jaff" $b2 = "2~1c0q4t7" condition: uint16( 0 ) == 0x5A4D and ( any of ( $a* ) ) and ( 1 of ( $b* ) ) } rule CAPE_Rozena { meta: description = "No description has been set in the source file - CAPE" author = "Kevin O'Reilly" id = "38ca9da3-2a0e-500f-8eb8-9de69a7f2da5" date = "2024-03-13" modified = "2024-03-15" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/Rozena.yar#L1-L10" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "c415a8108b58a125a604031bb8d73b58a8aae5429b5b765e35fa8a4add9cd135" score = 75 quality = 70 tags = "" cape_typ

"2024-01-18" modified = "2025-05-10" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/Latrodectus.yar#L1-L16" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" hash = "a547cff9991a713535e5c128a0711ca68acf9298cc2220c4ea0685d580f36811" logic_hash = "a8430299930f4c8de0a88c6836d4821871f7183cc5ff44ea9be84fbea47bbb13" score = 75 quality = 70 tags = "" cape_type = "Latrodectus Payload" strings: $fnvhash1 = {C7 04 24 C5 9D 1C 81 48 8B 44 24 20 48 89 44 24 08} $fnvhash2 = {8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01} $procchk1 = {E8 [3] FF 85 C0 74 [2] FF FF FF FF E9 [4] E8 [4] 89 44 24 ?? E8 [4] 83 F8 4B 73 ?? 83 [3] 06} $procchk2 = {72 [2] FF FF FF FF E9 [4] E8 [4] 83 F8 32 73 ?? 83 [3] 06} $version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89} condition: all of them } rule CAPE_Latrodectus_AES { meta: description = "Latrodectus Payload" author = "enzok" id = "16c295f5-cea0-57b5-b826-e1126e50c8cc" date = "2024-01-18" modified = "2025-05-10" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/Latrodectus.yar#L18-L34" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" hash = "5cecb26a3f33c24b92a0c8f6f5175da0664b21d7c4216a41694e4a4cad233ca8" logic_hash = "058d278c16527969066d1b4ea7f0e3ab2809d5480cdab06ec476b465e0c4795a" score = 75 quality = 70 tags = "" cape_type = "Latrodectus Payload" strings: $fnvhash1 = {C7 04 24 C5 9D 1C 81 48 8B 44 24 20 48 89 44 24 08} $fnvhash2 = {8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01} $key = {C6 44 2? ?? ?? [150] C6 44 2? ?? ?? B8 02} $aes_ctr_1 = {8B 44 24 ?? FF C8 89 44 24 ?? 83 7C 24 ?? 00 7C ?? 4? 63 44 24 ?? 4? 8B 4C 24 ?? 0F B6 84 01 F0 00 00 00 3D FF 00 00 00} $aes_ctr_2 = {48 03 C8 48 8B C1 0F B6 ?? 48 63 4C 24 ?? 0F B6 4C 0C ?? 33 C1 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 03 D1 48 8B CA 88 01} $version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89} condition: all of them } rule CAPE_Rokrat : FILE { meta: description = "RokRat Payload" author = "kevoreilly" id = "12e05b90-9771-5901-ae82-9fd2ea6263e7" date = "2019-10-30" modified = "2022-06-09" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/RokRat.yar#L1-L12" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "2aaa7de7ccd59e0da690f4bc0c7deaacf61314d61f8d2aa3ce6f6892f50612ec" score = 75 quality = 70 tags = "FILE" cape_type = "RokRat Payload" strings: $code1 = {8B 57 04 8D 7F 04 33 57 FC 81 E2 FF FF FF 7F 33 57 FC 8B C2 24 01 0F B6 C0 F7 D8 1B C0 D1 EA 25 DF B0 08 99 33 87 30 06 00 00 33 C2 89 87 3C F6 FF FF 83 E9 01 75 C9} $string1 = "/pho_%s_%d.jpg" wide condition: uint16( 0 ) == 0x5A4D and ( any of ( $code* ) ) and ( any of ( $string* ) ) } rule CAPE_Agent_Tesla { meta: description = "Detecting HTML strings used by Agent Tesla malware" author = "Stormshield" id = "5383994b-357d-539b-89b1-53be238f759d" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/AgentTesla.yar#L1-L17" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "3945754129dcc58e0abfd7485f5ff0c0afdd1078ae2cf164ca8f59a6f79db1be" score = 75 quality = 70 tags = "" version = "1.0" strings: $html_username = "<br>UserName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: " wide ascii $html_pc_name = "<br>PC&nbsp;Name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: " wide ascii $html_os_name = "<br>OS&nbsp;Full&nbsp;Name&nbsp;&nbsp;: " wide ascii $html_os_platform = "<br>OS&nbsp;Platform&nbsp;&nbsp;&nbsp;: " wide ascii $html_clipboard = "<br><span style=font-style:normal;text-decoration:none;text-transform:none;color:#FF0000;><strong>[clipboard]</strong></span>" wide ascii condition: 3 of them } rule CAPE_Agenttesla : FILE { meta: description = "AgentTesla Payload" author = "kevoreilly" id = "f7b930f1-cecb-5d80-809b-9503f282247a" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/AgentTesla.yar#L19-L41" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "1bf9b26c4cf87e674ddffabe40aba5a45499c6a04d4ff3e43c3cda4cbcb4d188" score = 75 quality = 70 tags = "FILE" cape_type = "AgentTesla Payload" strings: $string1 = "smtp" wide $string2 = "appdata" wide $string3 = "76487-337-8429955-22614" wide $string4 = "yyyy-MM-dd HH:mm:ss" wide $string6 = "webpanel" wide $string7 = "<br>UserName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:" wide $string8 = "<br>IP Address&nbsp;&nbsp;:" wide $agt1 = "IELibrary.dll" ascii $agt2 = "C:\\Users\\Admin\\Desktop\\IELibrary\\IELibrary\\obj\\Debug\\IELibrary.pdb" ascii $agt3 = "GetSavedPasswords" ascii $agt4 = "GetSavedCookies" ascii condition: uint16( 0 ) == 0x5A4D and ( all of ( $string* ) or 3 of ( $agt* ) ) } rule CAPE_Agentteslav2 : FILE { meta: description = "AgenetTesla Type 2 Keylogger payload" author = "ditekshen" id = "e60ecee4-0a97-56a1-b21e-47190f8cd1f8" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/AgentTesla.yar#L43-L67" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "b45296b3b94fa1ff32de48c94329a17402461fb6696e9390565c4dba9738ed78" score = 75 quality = 70 tags = "FILE" cape_type = "AgentTesla Payload" strings: $s1 = "get_kbHook" ascii $s2 = "GetPrivateProfileString" ascii $s3 = "get_OSFullName" ascii $s4 = "get_PasswordHash" ascii $s5 = "remove_Key" ascii $s6 = "FtpWebRequest" ascii $s7 = "logins" fullword wide $s8 = "keylog" fullword wide $s9 = "1.85 (Hash, version 2, native byte-order)" wide $cl1 = "Postbox" fullword ascii $cl2 = "BlackHawk" fullword ascii $cl3 = "WaterFox" fullword ascii $cl4 = "CyberFox" fullword ascii $cl5 = "IceDragon" fullword ascii $cl6 = "Thunderbird" fullword ascii condition: ( uint16( 0 ) == 0x5a4d and 6 of ( $s* ) ) or ( 6 of ( $s* ) and 2 of ( $cl* ) ) } rule CAPE_Agentteslav3 : FILE { meta: description = "AgentTeslaV3 infostealer payload" author = "ditekshen" id = "c8ddd838-6ad4-56f3-a0cd-b890f809018c" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/AgentTesla.yar#L69-L115" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "cc9bbbcf3608b49a76b098acf846ff03eae5e9cb107697627d62661fa1be36c2" score = 75 quality = 70 tags = "FILE" cape_type = "AgentTesla payload" strings: $s_specific1 = "get_kbok" fullword ascii $s_specific2 = "get_CHoo" fullword ascii $s_specific3 = "KillTorProcess" fullword ascii $s_specific4 = "GetMozilla" ascii $s_specific5 = "torbrowser" wide $s_specific6 = "bot%telegramapi%" wide $s_specific7 = "%chatid%" wide $s_typo = "set_Lenght" fullword ascii $m1 = "yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time" ascii $m2 = "%image/jpg:Zone.Identifier\\tmpG.tmp%urlkey%-f \\Data\\Tor\\torrcp=%PostURL%127.0.0.1POST+%2B" ascii $m3 = ">{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\\WScript.ShellRegReadg401" ascii $m4 = "%startupfolder%\\%insfolder%\\%insname%/\\%insfolder%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%insregname%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\RunTruehttp" ascii $m5 = "\\WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera" ascii $s_generic1 = "set_UseShellExecute" fullword ascii $s_generic2 = "set_IsBodyHtml" fullword ascii $s_generic3 = "set_AllowAutoRedirect" fullword ascii $s_generic4 = "set_RedirectStandardOutput" fullword ascii condition: (2 of ( $m* ) ) or ( uint16( 0 ) == 0x5a4d and ( 5 of ( $s_specific* ) or ( $s_typo and 4 of ( $s_generic* ) ) ) ) } rule CAPE_Agentteslav4 : FILE { meta: description = "AgentTesla Payload" author = "kevoreilly" id = "a39109ca-84cb-527d-b9c2-d8763fa6e496" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/AgentTesla.yar#L117-L130" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "0a39036f408728ab312a54ff3354453d171424f57f9a8f3b42af867be3037ca9" score = 75 quality = 70 tags = "FILE" cape_type = "AgentTesla Payload" packed = "7f8a95173e17256698324886bb138b7936b9e8c5b9ab8fffbfe01080f02f286c" strings: $decode1 = {(07|FE 0C 01 00) (07|FE 0C 01 00) 8E 69 (17|20 01 00 00 00) 63 8F ?? 00 00 01 25 47 (06|FE 0C 00 00) (1A|20 04 00 00 00) 58 4A D2 61 D2 52} $decode2 = {(07|FE 0C 01 00) (08|FE 0C 02 00) 8F ?? 00 00 01 25 47 (07|FE 0C 01 00) (11 07|FE 0C 07 00) 91 (06|FE 0C 00 00) (1A|20 04 00 00 00) 58 4A 61 D2 61 D2 52} $decode3 = {(07|FE 0C 01 00) (11 07|FE 0C 07 00) 8F ?? 00 00 01 25 47 (07|FE 0C 01 00) (08|FE 0C 02 00) 91 61 D2 52} condition: uint16( 0 ) == 0x5A4D and all of them } rule CAPE_Stxrat : FILE { meta: description = "No description has been set in the source file - CAPE" author = "YungBinary" id = "9ce51412-52ce-5682-802d-fad96c053c30" date = "2026-04-11" modified = "2026-04-14" reference = "https://www.esentire.com/blog/stx-rat-a-new-rat-in-2026-with-infostealer-capabilities" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/STXRat.yar#L49-L120" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "f82b832e6bf936ff936332c059b1d3b981ce387bf82964ecf64a9cb12cda955d" score = 75 quality = 70 tags = "FILE" cape_type = "STXRat Payload" strings: $s1 = { 8D 51 BF 83 FA 19 8D 41 20 0F 47 C1 C2 } $s2 = { 48 8D 05 ?? ?? ?? ?? 66 C7 45 ?? 48 B8 [0-6] 48 89 45 ?? 48 8D 55 ?? 66 C7 45 ?? FF E0 } $s3 = { 65 48 8B 04 25 60 00 00 00 80 78 02 01 } $s4 = "Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)" ascii $s5 = { B9 10 66 00 00 [0-3] 0F 44 C1 B9 0F 66 00 00 41 81 ?? C0 00 00 00 0F 44 C1 B9 0E 66 00 00 } $s6 = { 48 83 FB 5A 73 ?? 88 84 1C ?? ?? ?? ?? 48 FF C3 48 FF C1 8A 01 84 C0 75 } $s7 = { 83 61 18 00 83 61 14 00 C7 01 01 23 45 67 C7 41 04 89 AB CD EF C7 41 08 FE DC BA 98 C7 41 0C 76 54 32 10 C7 41 10 F0 E1 D2 C3 C3 } $s8 = { 80 61 1F 3F 80 49 1F 40 80 21 F8 } condition: uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) ) } rule CAPE_Arkei : FILE { meta: description = "Arkei Payload" author = "kevoreilly, YungBinary" id = "18363a5b-46f3-5d11-9bc6-a91f81b49706" date = "2019-10-30" modified = "2025-01-10" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/Arkei.yar#L1-L50" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "296e420880d8d2f24424d0411e7ef4939e18147689557512f410da48498a44c9" score = 75 quality = 70 tags = "FILE" cape_type = "Arkei Payload" strings: $string1 = "Windows_Antimalware_Host_System_Worker" $string2 = "Arkei" $string3 = "Bitcoin\\wallet.dat" $string4 = "Ethereum\\keystore" $v1 = "C:\\Windows\\System32\\cmd.exe" fullword ascii wide $v2 = "/c taskkill /im " fullword ascii $v3 = "card_number_encrypted FROM credit_cards" ascii $v4 = "\\wallet.dat" ascii $v5 = "Arkei/" wide $v6 = "files\\passwords." ascii wide $v7 = "files\\cc_" ascii wide $v8 = "files\\autofill_" ascii wide $v9 = "files\\cookies_" ascii wide $loaded_modules = { 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 8B 00 8B 40 18 89 45 FC 8B 45 FC 8B E5 5D C3 } $language_check = { FF 15 ?? ?? ?? ?? 0F B7 C0 89 45 ?? 81 7D ?? 3F 04 ?? ?? 7F } $ext1 = ".zoo" ascii $ext2 = ".arc" ascii condition: uint16( 0 ) == 0x5A4D and ( ( $loaded_modules and $language_check and $ext1 and $ext2 ) or ( all of ( $string* ) or 7 of ( $v* ) ) ) } rule CAPE_Gandcrab : FILE { meta: description = "Gandcrab Payload" author = "kevoreilly" id = "0082e8c9-952e-508c-a438-4e17b8031864" date = "2019-10-30" modified = "2022-06-09" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/Gandcrab.yar#L1-L14" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "354ed566dbafbe8e9531bb771d9846952eb8c0e70ee94c26d09368159ce4142c" score = 75 quality = 70 tags = "FILE" cape_type = "Gandcrab Payload" strings: $string1 = "GDCB-DECRYPT.txt" wide $string2 = "GandCrabGandCrabnomoreransom.coinomoreransom.bit" $string3 = "action=result&e_files=%d&e_size=%I64u&e_time=%d&" wide $string4 = "KRAB-DECRYPT.txt" wide condition: uint16( 0 ) == 0x5A4D and any of ( $string* ) } rule CAPE_Jaff : FILE { meta: description = "Jaff Payload" author = "kevoreilly" id = "6681c1fe-6c88-5a49-bdfa-54ce08ea6707" date = "2019-10-30" modified = "2019-10-30" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/Jaff.yar#L1-L14" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "6806a5eeee04b7436ff694addc334bfc0f1ee611116904d57be9506acfd47418" score = 75 quality = 70 tags = "FILE" cape_type = "Jaff Payload" strings: $a1 = "CryptGenKey" $a2 = "353260540318613681395633061841341670181307185694827316660016508" $b1 = "jaff" $b2 = "2~1c0q4t7" condition: uint16( 0 ) == 0x5A4D and ( any of ( $a* ) ) and ( 1 of ( $b* ) ) } rule CAPE_Rozena { meta: description = "No description has been set in the source file - CAPE" author = "Kevin O'Reilly" id = "38ca9da3-2a0e-500f-8eb8-9de69a7f2da5" date = "2024-03-13" modified = "2024-03-15" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/data/yara/CAPE/Rozena.yar#L1-L10" license_url = "https://github.com/kevoreilly/CAPEv2/blob/e451de454137e0d44ab1ce1f72eae2e2bccfa78a/LICENSE" logic_hash = "c415a8108b58a125a604031bb8d73b58a8aae5429b5b765e35fa8a4add9cd135" score = 75 quality = 70 tags = "" cape_typ