D 44 39 01 77 ?? 41 8D 48 01 E8 [4] 31 C9} condition: all of them } rule CAPE_Pikabotloader : FILE { meta: description = "Pikabot Loader" author = "kevoreilly" id = "e2c89cdd-0cdb-5367-8aae-2fe685eff972" date = "2023-02-13" modified = "2024-03-13" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/data/yara/CAPE/PikaBot.yar#L1-L13" license_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/LICENSE" logic_hash = "7e5f1f2911545ee6bd36b54f2627fbdec1b957f4b91df901dd1c6cbd4dff0231" score = 75 quality = 70 tags = "FILE" cape_type = "PikaBot Loader" strings: $indirect = {31 C0 64 8B 0D C0 00 00 00 85 C9 74 01 40 50 8D 54 24 ?? E8 [4] A3 [4] 8B 25 [4] A1} $sysenter1 = {89 44 24 08 8D 85 ?? FC FF FF C7 44 24 04 FF FF 1F 00 89 04 24 E8} $sysenter2 = {C7 44 24 0C 00 00 00 02 C7 44 24 08 00 00 00 02 8B 45 0C 89 44 24 04 8B 45 08 89 04 24 E8} condition: uint16( 0 ) == 0x5A4D and 2 of them } rule CAPE_Pikabot : FILE { meta: description = "Pikabot Payload" author = "kevoreilly" id = "140a3e20-9837-5f66-85dc-af278d75e074" date = "2023-02-13" modified = "2024-03-13" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/data/yara/CAPE/PikaBot.yar#L15-L28" license_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/LICENSE" logic_hash = "ed07217c373831a9a67d914854154988696e6fcea70dedabf333385f0e7bb8b7" score = 75 quality = 70 tags = "FILE" cape_type = "PikaBot Payload" packed = "89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9" strings: $decode = {29 D1 01 4B ?? 8D 0C 10 89 4B ?? 85 F6 74 02 89 16} $indirect = {31 C0 64 8B 0D C0 00 00 00 85 C9 74 01 40 50 8D 54 24 ?? E8 [4] A3 [4] 8B 25 [4] A1} $config = {C7 44 24 [3] 00 00 C7 44 24 [4] 00 89 [1-4] ?? E8 [4] 31 C0 C7 44 24 [3] 00 00 89 44 24 ?? C7 04 24 [4] E8} condition: uint16( 0 ) == 0x5A4D and 2 of them } rule CAPE_Pik23 : FILE { meta: description = "PikaBot Payload February 2023" author = "kevoreilly" id = "fc804c63-fc6c-5b26-92b1-aa5d2fbc4917" date = "2023-02-13" modified = "2024-03-13" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/data/yara/CAPE/PikaBot.yar#L30-L44" license_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/LICENSE" hash = "59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1" logic_hash = "71a71df2f2a075294941c54eed06cafaaa4d3294e45b3a0098c1cffddd0438bc" score = 75 quality = 70 tags = "FILE" cape_type = "PikaBot Payload" strings: $rdtsc = {89 55 FC 89 45 F8 0F 31 89 55 F4 89 45 FC 33 C0 B8 05 00 00 00 C1 E8 02 2B C3 3B C1 0F 31 89 55 F0 89 45 F8 8B 44 8D} $int2d = {B8 00 00 00 00 CD 2D 90 C3 CC CC CC CC CC CC CC} $subsys = {64 A1 30 00 00 00 8B 40 18 C3} $rijndael = {EB 0F 0F B6 04 3? FE C? 8A 80 [4] 88 04 3? 0F B6 [3] 7C EA 5? 5? C9 C3} condition: uint16( 0 ) == 0x5A4D and 3 of them } rule CAPE_Agent_Tesla { meta: description = "Detecting HTML strings used by Agent Tesla malware" author = "Stormshield" id = "5383994b-357d-539b-89b1-53be238f759d" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/data/yara/CAPE/AgentTesla.yar#L1-L17" license_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/LICENSE" logic_hash = "3945754129dcc58e0abfd7485f5ff0c0afdd1078ae2cf164ca8f59a6f79db1be" score = 75 quality = 70 tags = "" version = "1.0" strings: $html_username = "<br>UserName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: " wide ascii $html_pc_name = "<br>PC&nbsp;Name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: " wide ascii $html_os_name = "<br>OS&nbsp;Full&nbsp;Name&nbsp;&nbsp;: " wide ascii $html_os_platform = "<br>OS&nbsp;Platform&nbsp;&nbsp;&nbsp;: " wide ascii $html_clipboard = "<br><span style=font-style:normal;text-decoration:none;text-transform:none;color:#FF0000;><strong>[clipboard]</strong></span>" wide ascii condition: 3 of them } rule CAPE_Agenttesla : FILE { meta: description = "AgentTesla Payload" author = "kevoreilly" id = "f7b930f1-cecb-5d80-809b-9503f282247a" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/data/yara/CAPE/AgentTesla.yar#L19-L41" license_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/LICENSE" logic_hash = "1bf9b26c4cf87e674ddffabe40aba5a45499c6a04d4ff3e43c3cda4cbcb4d188" score = 75 quality = 70 tags = "FILE" cape_type = "AgentTesla Payload" strings: $string1 = "smtp" wide $string2 = "appdata" wide $string3 = "76487-337-8429955-22614" wide $string4 = "yyyy-MM-dd HH:mm:ss" wide $string6 = "webpanel" wide $string7 = "<br>UserName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:" wide $string8 = "<br>IP Address&nbsp;&nbsp;:" wide $agt1 = "IELibrary.dll" ascii $agt2 = "C:\\Users\\Admin\\Desktop\\IELibrary\\IELibrary\\obj\\Debug\\IELibrary.pdb" ascii $agt3 = "GetSavedPasswords" ascii $agt4 = "GetSavedCookies" ascii condition: uint16( 0 ) == 0x5A4D and ( all of ( $string* ) or 3 of ( $agt* ) ) } rule CAPE_Agentteslav2 : FILE { meta: description = "AgenetTesla Type 2 Keylogger payload" author = "ditekshen" id = "e60ecee4-0a97-56a1-b21e-47190f8cd1f8" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/data/yara/CAPE/AgentTesla.yar#L43-L67" license_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/LICENSE" logic_hash = "b45296b3b94fa1ff32de48c94329a17402461fb6696e9390565c4dba9738ed78" score = 75 quality = 70 tags = "FILE" cape_type = "AgentTesla Payload" strings: $s1 = "get_kbHook" ascii $s2 = "GetPrivateProfileString" ascii $s3 = "get_OSFullName" ascii $s4 = "get_PasswordHash" ascii $s5 = "remove_Key" ascii $s6 = "FtpWebRequest" ascii $s7 = "logins" fullword wide $s8 = "keylog" fullword wide $s9 = "1.85 (Hash, version 2, native byte-order)" wide $cl1 = "Postbox" fullword ascii $cl2 = "BlackHawk" fullword ascii $cl3 = "WaterFox" fullword ascii $cl4 = "CyberFox" fullword ascii $cl5 = "IceDragon" fullword ascii $cl6 = "Thunderbird" fullword ascii condition: ( uint16( 0 ) == 0x5a4d and 6 of ( $s* ) ) or ( 6 of ( $s* ) and 2 of ( $cl* ) ) } rule CAPE_Agentteslav3 : FILE { meta: description = "AgentTeslaV3 infostealer payload" author = "ditekshen" id = "c8ddd838-6ad4-56f3-a0cd-b890f809018c" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/data/yara/CAPE/AgentTesla.yar#L69-L115" license_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/LICENSE" logic_hash = "cc9bbbcf3608b49a76b098acf846ff03eae5e9cb107697627d62661fa1be36c2" score = 75 quality = 70 tags = "FILE" cape_type = "AgentTesla payload" strings: $s_specific1 = "get_kbok" fullword ascii $s_specific2 = "get_CHoo" fullword ascii $s_specific3 = "KillTorProcess" fullword ascii $s_specific4 = "GetMozilla" ascii $s_specific5 = "torbrowser" wide $s_specific6 = "bot%telegramapi%" wide $s_specific7 = "%chatid%" wide $s_typo = "set_Lenght" fullword ascii $m1 = "yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time" ascii $m2 = "%image/jpg:Zone.Identifier\\tmpG.tmp%urlkey%-f \\Data\\Tor\\torrcp=%PostURL%127.0.0.1POST+%2B" ascii $m3 = ">{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\\WScript.ShellRegReadg401" ascii $m4 = "%startupfolder%\\%insfolder%\\%insname%/\\%insfolder%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%insregname%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\RunTruehttp" ascii $m5 = "\\WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera" ascii $s_generic1 = "set_UseShellExecute" fullword ascii $s_generic2 = "set_IsBodyHtml" fullword ascii $s_generic3 = "set_AllowAutoRedirect" fullword ascii $s_generic4 = "set_RedirectStandardOutput" fullword ascii condition: (2 of ( $m* ) ) or ( uint16( 0 ) == 0x5a4d and ( 5 of ( $s_specific* ) or ( $s_typo and 4 of ( $s_generic* ) ) ) ) } rule CAPE_Agentteslav4 : FILE { meta: description = "AgentTesla Payload" author = "kevoreilly" id = "a39109ca-84cb-527d-b9c2-d8763fa6e496" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/data/yara/CAPE/AgentTesla.yar#L117-L130" license_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/LICENSE" logic_hash = "0a39036f408728ab312a54ff3354453d171424f57f9a8f3b42af867be3037ca9" score = 75 quality = 70 tags = "FILE" cape_type = "AgentTesla Payload" packed = "7f8a95173e17256698324886bb138b7936b9e8c5b9ab8fffbfe01080f02f286c" strings: $decode1 = {(07|FE 0C 01 00) (07|FE 0C 01 00) 8E 69 (17|20 01 00 00 00) 63 8F ?? 00 00 01 25 47 (06|FE 0C 00 00) (1A|20 04 00 00 00) 58 4A D2 61 D2 52} $decode2 = {(07|FE 0C 01 00) (08|FE 0C 02 00) 8F ?? 00 00 01 25 47 (07|FE 0C 01 00) (11 07|FE 0C 07 00) 91 (06|FE 0C 00 00) (1A|20 04 00 00 00) 58 4A 61 D2 61 D2 52} $decode3 = {(07|FE 0C 01 00) (11 07|FE 0C 07 00) 8F ?? 00 00 01 25 47 (07|FE 0C 01 00) (08|FE 0C 02 00) 91 61 D2 52} condition: uint16( 0 ) == 0x5A4D and all of them } rule CAPE_Koiloader { meta: description = "KoiLoader" author = "YungBinary" id = "258e8857-7ea6-5098-9949-06d9d83853d4" date = "2024-10-25" modified = "2024-10-25" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/data/yara/CAPE/KoiLoader.yar#L1-L35" license_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/LICENSE" hash = "b462e3235c7578450b2b56a8aff875a3d99d22f6970a01db3ba98f7ecb6b01a0" logic_hash = "264a536632f8f11c904b00c9d2e505b3263c733ad8fbc2ef19c25a5ad58cef90" score = 75 quality = 70 tags = "" cape_type = "KoiLoader Payload" strings: $chunk_1 = { 68 27 11 68 05 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 08 89 45 ?? 68 15 B1 B3 09 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 08 89 45 ?? 68 B5 96 AA 0D 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 08 89 45 ?? 6A 00 FF 15 ?? ?? ?? ?? } condition: $chunk_1 } rule CAPE_Adaptixbeacon { meta: description = "AdaptixBeacon Payload" author = "enzok" id = "ae0bc10c-cfcd-59d4-8c24-34a03debe370" date = "2025-06-16" modified = "2025-10-28" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/data/yara/CAPE/AdaptixBeacon.yar#L1-L18" license_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/LICENSE" hash = "f78f5803be5704420cbb2e0ac3c57fcb3d9cdf443fbf1233c069760bee115b5d" logic_hash = "2c1d09cd5e19e5a09dde65411691afd5922959d4a7b5232b28ebf56f26d2f07d" score = 75 quality = 70 tags = "" cape_type = "AdaptixBeacon Payload" strings: $conf_1 = {8D ?? ?? E8 [3] 00 4? 89 [1-2] 4? 8B 4C 24 ?? E8 [3] 00 4? 8B 53 48 66 [0-1] 89 04 ?? E8} $conf_2 = {E8 [3] 00 48 8B 4C 24 ?? 48 89 43 78 E8 [3] 00 48 8B 4C 24 ?? 89 83 80 00 00 00 E8 [3] 00 03 83 80 00 00 00 48 8B 4C 24} $conf_3 = {E8 [3] 00 4? 8B 4C 24 ?? 4? 89 ?? 4? 89 43 58 E8 [3] 00 4? 8B 4C 24 ?? 4? 89 ?? 4? 89 43 60 E8 [3] 00 4? 8B 4C 24 ?? 4? 89 ?? 4? 89 43 68} $conf_4 = {8D ?? ?? 4? 89 ?? FF ?? 4? 89 ?? 4? 89 ?? 4? 8B ?? FF ?? ?? 4? 8B ?? 48 66 ?? 89 ?? ?? EB} $conf_5 = {48 89 ?? 4? 89 ?? FF ?? 4? 89 ?? 4? 89 D9 4? 89 ?? ?? 4? 8B 03 FF ?? ?? 4? 89 ?? 4? 89 ?? 4? 89 ?? ?? 4? 8B 03 FF ?? ?? 4? 89} $wininet_1 = {B9 77 00 00 00 [0-4] E8 [4] B9 69 00 00 00 88 ?4 24 [0-4] E8 [4] B9 6E 00 00 00 88 ?4 24} $wininet_2 = {B9 69 00 00 00 88 ?4 24 [0-4] E8 [4] B9 6E 00 00 00 88 ?4 24 [0-4] E8 [4] B9 65 00 00 00 88 ?4 24} condition: 1 of ( $conf_* ) and 1 of ( $wininet_* ) } rule CAPE_Rhadamanthys_1 { meta: description = "Rhadamanthys Payload" author = "kevoreilly, YungBinary" id = "cd34b971-3603-5237-b47f-aea78ca38cac" date = "2023-01-25" modified = "2025-12-19" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/data/yara/CAPE/Rhadamanthys.yar#L1-L19" license_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/LICENSE" logic_hash = "3ccfc97202690dd996ffd2b4f09d31e6ee322bf9f0b7759f9b8c455164995f84" score = 75 quality = 70 tags = "" cape_type = "Rhadamanthys Payload" strings: $rc4 = {88 4C 01 08 41 81 F9 00 01 00 00 7C F3 89 75 08 33 FF 8B 4D 08 3B 4D 10 72 04 83 65 08 00} $code = {8B 4D FC 3B CF 8B C1 74 0D 83 78 04 02 74 1C 8B 40 1C 3B C7 75 F3 3B CF 8B C1 74 57 83 78 04 17 74 09 8B 40 1C 3B C7 75 F3 EB} $conf_1 = {46 BB FF 00 00 00 23 F3 0F B6 44 31 08 03 F8 23 FB 0F B6 5C 39 08 88 5C 31 08 88 44 39 08 02 C3 8B 5D 08 0F B6 C0 8A 44 08 08} $conf_2 = {0F B6 4F 2A 8D 77 2A 33 C0 6A 03 89 45 F8 89 45 FC 89 45 08 8B C1} $beef = {57 8D 44 33 FC 53 83 C6 FC 50 56 E8 [4] 83 C4 10 66 81 3F EF BE 0F 85} $anti = {50 68 [4] 68 [4] E8 [4] 83 C4 0C A3 [4] 85 C0 74} $dnr = {99 52 50 8D 45 ?? 99 52 50 8B C7 99 52 50 8B C3 99 52 50} $sys = {83 E4 F0 6A 33 E8 00 00 00 00 83 04 24 05 CB} $cape_string = "cape_options" condition: 2 of them and not $cape_string } rule CAPE_Rhadamanthysloader { meta: description = "Rhadamanthys Loader" author = "kevoreilly" id = "0d9955e8-c6e5-50f0-8006-8f6157038d40" date = "2023-01-25" modified = "2025-12-19" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/data/yara/CAPE/Rhadamanthys.yar#L21-L33" license_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/LICENSE" logic_hash = "5505c9ba1f0c6cb9aa9c212bf8bc2c49ad544e99996a1f4c1fa79a27a14d4c7f" score = 75 quality = 70 tags = "" cape_type = "Rhadamanthys Loader" strings: $ref = {33 D2 B9 0B 00 00 00 F7 F1 B8 01 00 00 00 6B C8 00 8D 84 0D [4] 0F BE 0C 10 8B 95 [4] 03 95 [4] 0F B6 02 33 C1 8B 8D [4] 03 8D [4] 88 01} $ntdll = {B9 6E 00 00 00 66 89 8D [4] BA 74 00 00 00 66 89 95 [4] B8 64 00 00 00 66 89 85 [4] B9 6C 00 00 00 66 89 8D [4] BA 6C 00 00 00 66 89 95} $exit = {6A 00 6A 00 6A 00 6A 00 6A 00 6A 00 8B 95 [4] 52 8B 85 [4] 50 6A 00 68 FF FF 1F 00} condition: 2 of them } rule CAPE_Petya : FILE { meta: description = "Petya Payload" author = "kevoreilly" id = "e581747c-c40f-5689-84b4-d55134b532f7" date = "2019-10-30" modified = "2019-10-30" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/data/yara/CAPE/Petya.yar#L1-L13" license_url = "https://github.com/kevoreilly/CAPEv2/blob/7bf99177e9cc19a510ac25b0993fde7e9094e6c2/LICENSE" logic_hash = "f819261bb34f3b2eb7dc2f843b56be25105570fe902a77940a632a54fbe0d014" score = 75 quality = 70 tags = "FILE" cape_type = "Petya Payload" strings: $a1 = "CHKDSK is repairing sector" $a2 = "wowsmith123456@posteo