MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ" condition: uint16( 0 ) == 0x5A4D and ( all of ( $a* ) ) } rule CAPE_Masslogger : FILE { meta: description = "MassLogger" author = "kevoreilly" id = "0743421a-36f7-5b7c-859f-b461511151cb" date = "2020-10-20" modified = "2020-11-24" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/data/yara/CAPE/MassLogger.yar#L1-L12" license_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/LICENSE" logic_hash = "c8d82694810aafbdc6a35a661e7431e9536035e2f7fef90b9359064c4209b66c" score = 75 quality = 70 tags = "FILE" cape_type = "MassLogger Payload" strings: $name = "MassLogger" $fody = "Costura" condition: uint16( 0 ) == 0x5A4D and 2 of them } rule CAPE_Mykings : FILE { meta: description = "No description has been set in the source file - CAPE" author = "YungBinary" id = "c9d7b061-b76c-595c-a362-6c89c96093d9" date = "2025-10-24" modified = "2025-10-26" reference = "https://x.com/YungBinary/status/1981108948498333900" source_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/data/yara/CAPE/MyKings.yar#L1-L23" license_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/LICENSE" logic_hash = "82647dd23c0247faa045893ec1cf111da2a30528a1b737b59ce1b71172a64473" score = 75 quality = 70 tags = "FILE" cape_type = "MyKings Payload" strings: $s1 = "login.php?uid=0" wide $s2 = "download.txt?rnd=" wide $s3 = "AcceptOK" ascii $s4 = "winsta0\\default" wide $s5 = "base64_ip.txt" wide $s6 = { 70 00 6F 00 77 00 65 00 72 00 74 00 6F 00 6F 00 6C 00 00 00 6B 00 61 00 73 00 70 00 65 00 72 00 73 00 6B 00 79 } $s7 = { 53 00 61 00 66 00 65 00 00 00 00 00 45 00 73 00 65 00 74 } $s8 = { 4E 00 6F 00 64 00 33 00 32 00 00 00 4D 00 61 00 6C 00 77 00 61 00 72 00 65 } $s9 = "Custom C++ HTTP Client/1.0" wide $s10 = "/ru \"SYSTEM\" /f" ascii $s11 = "cmd.exe /C timeout /t 1 & del " wide $s12 = "/login.aspx?uid=0" wide $s13 = "cmd-230812.ru" base64 condition: uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) ) } rule CAPE_Ramnit : FILE { meta: description = "Ramnit Payload" author = "kevoreilly" id = "6df92055-05f6-5985-9268-b9c85e143567" date = "2019-10-30" modified = "2019-10-30" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/data/yara/CAPE/Ramnit.yar#L1-L13" license_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/LICENSE" logic_hash = "6f661f47bdf8377b0fb96f190fcb964c0ed2b43ce7ae7880f9dfce9e43837efd" score = 75 quality = 70 tags = "FILE" cape_type = "Ramnit Payload" strings: $DGA = {33 D2 B9 1D F3 01 00 F7 F1 8B C8 B8 A7 41 00 00 F7 E2 8B D1 8B C8 B8 14 0B 00 00 F7 E2 2B C8 33 D2 8B C1 8B} $xor_loop = {83 7D 0C 00 74 27 83 7D 14 00 74 21 8B 4D 0C 8B 7D 08 8B 75 10 BA 00 00 00 00 0B D2 75 04 8B 55 14 4A 8A 1C 32 32 1F 88 1F 47 4A E2 ED} $id_string = "{%08X-%04X-%04X-%04X-%08X%04X}" condition: uint16( 0 ) == 0x5A4D and all of ( $* ) } rule CAPE_Agent_Tesla { meta: description = "Detecting HTML strings used by Agent Tesla malware" author = "Stormshield" id = "5383994b-357d-539b-89b1-53be238f759d" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/data/yara/CAPE/AgentTesla.yar#L1-L17" license_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/LICENSE" logic_hash = "3945754129dcc58e0abfd7485f5ff0c0afdd1078ae2cf164ca8f59a6f79db1be" score = 75 quality = 70 tags = "" version = "1.0" strings: $html_username = "<br>UserName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: " wide ascii $html_pc_name = "<br>PC&nbsp;Name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: " wide ascii $html_os_name = "<br>OS&nbsp;Full&nbsp;Name&nbsp;&nbsp;: " wide ascii $html_os_platform = "<br>OS&nbsp;Platform&nbsp;&nbsp;&nbsp;: " wide ascii $html_clipboard = "<br><span style=font-style:normal;text-decoration:none;text-transform:none;color:#FF0000;><strong>[clipboard]</strong></span>" wide ascii condition: 3 of them } rule CAPE_Agenttesla : FILE { meta: description = "AgentTesla Payload" author = "kevoreilly" id = "f7b930f1-cecb-5d80-809b-9503f282247a" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/data/yara/CAPE/AgentTesla.yar#L19-L41" license_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/LICENSE" logic_hash = "1bf9b26c4cf87e674ddffabe40aba5a45499c6a04d4ff3e43c3cda4cbcb4d188" score = 75 quality = 70 tags = "FILE" cape_type = "AgentTesla Payload" strings: $string1 = "smtp" wide $string2 = "appdata" wide $string3 = "76487-337-8429955-22614" wide $string4 = "yyyy-MM-dd HH:mm:ss" wide $string6 = "webpanel" wide $string7 = "<br>UserName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:" wide $string8 = "<br>IP Address&nbsp;&nbsp;:" wide $agt1 = "IELibrary.dll" ascii $agt2 = "C:\\Users\\Admin\\Desktop\\IELibrary\\IELibrary\\obj\\Debug\\IELibrary.pdb" ascii $agt3 = "GetSavedPasswords" ascii $agt4 = "GetSavedCookies" ascii condition: uint16( 0 ) == 0x5A4D and ( all of ( $string* ) or 3 of ( $agt* ) ) } rule CAPE_Agentteslav2 : FILE { meta: description = "AgenetTesla Type 2 Keylogger payload" author = "ditekshen" id = "e60ecee4-0a97-56a1-b21e-47190f8cd1f8" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/data/yara/CAPE/AgentTesla.yar#L43-L67" license_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/LICENSE" logic_hash = "b45296b3b94fa1ff32de48c94329a17402461fb6696e9390565c4dba9738ed78" score = 75 quality = 70 tags = "FILE" cape_type = "AgentTesla Payload" strings: $s1 = "get_kbHook" ascii $s2 = "GetPrivateProfileString" ascii $s3 = "get_OSFullName" ascii $s4 = "get_PasswordHash" ascii $s5 = "remove_Key" ascii $s6 = "FtpWebRequest" ascii $s7 = "logins" fullword wide $s8 = "keylog" fullword wide $s9 = "1.85 (Hash, version 2, native byte-order)" wide $cl1 = "Postbox" fullword ascii $cl2 = "BlackHawk" fullword ascii $cl3 = "WaterFox" fullword ascii $cl4 = "CyberFox" fullword ascii $cl5 = "IceDragon" fullword ascii $cl6 = "Thunderbird" fullword ascii condition: ( uint16( 0 ) == 0x5a4d and 6 of ( $s* ) ) or ( 6 of ( $s* ) and 2 of ( $cl* ) ) } rule CAPE_Agentteslav3 : FILE { meta: description = "AgentTeslaV3 infostealer payload" author = "ditekshen" id = "c8ddd838-6ad4-56f3-a0cd-b890f809018c" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/data/yara/CAPE/AgentTesla.yar#L69-L115" license_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/LICENSE" logic_hash = "cc9bbbcf3608b49a76b098acf846ff03eae5e9cb107697627d62661fa1be36c2" score = 75 quality = 70 tags = "FILE" cape_type = "AgentTesla payload" strings: $s_specific1 = "get_kbok" fullword ascii $s_specific2 = "get_CHoo" fullword ascii $s_specific3 = "KillTorProcess" fullword ascii $s_specific4 = "GetMozilla" ascii $s_specific5 = "torbrowser" wide $s_specific6 = "bot%telegramapi%" wide $s_specific7 = "%chatid%" wide $s_typo = "set_Lenght" fullword ascii $m1 = "yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time" ascii $m2 = "%image/jpg:Zone.Identifier\\tmpG.tmp%urlkey%-f \\Data\\Tor\\torrcp=%PostURL%127.0.0.1POST+%2B" ascii $m3 = ">{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\\WScript.ShellRegReadg401" ascii $m4 = "%startupfolder%\\%insfolder%\\%insname%/\\%insfolder%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%insregname%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\RunTruehttp" ascii $m5 = "\\WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera" ascii $s_generic1 = "set_UseShellExecute" fullword ascii $s_generic2 = "set_IsBodyHtml" fullword ascii $s_generic3 = "set_AllowAutoRedirect" fullword ascii $s_generic4 = "set_RedirectStandardOutput" fullword ascii condition: (2 of ( $m* ) ) or ( uint16( 0 ) == 0x5a4d and ( 5 of ( $s_specific* ) or ( $s_typo and 4 of ( $s_generic* ) ) ) ) } rule CAPE_Agentteslav4 : FILE { meta: description = "AgentTesla Payload" author = "kevoreilly" id = "a39109ca-84cb-527d-b9c2-d8763fa6e496" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/data/yara/CAPE/AgentTesla.yar#L117-L130" license_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/LICENSE" logic_hash = "0a39036f408728ab312a54ff3354453d171424f57f9a8f3b42af867be3037ca9" score = 75 quality = 70 tags = "FILE" cape_type = "AgentTesla Payload" packed = "7f8a95173e17256698324886bb138b7936b9e8c5b9ab8fffbfe01080f02f286c" strings: $decode1 = {(07|FE 0C 01 00) (07|FE 0C 01 00) 8E 69 (17|20 01 00 00 00) 63 8F ?? 00 00 01 25 47 (06|FE 0C 00 00) (1A|20 04 00 00 00) 58 4A D2 61 D2 52} $decode2 = {(07|FE 0C 01 00) (08|FE 0C 02 00) 8F ?? 00 00 01 25 47 (07|FE 0C 01 00) (11 07|FE 0C 07 00) 91 (06|FE 0C 00 00) (1A|20 04 00 00 00) 58 4A 61 D2 61 D2 52} $decode3 = {(07|FE 0C 01 00) (11 07|FE 0C 07 00) 8F ?? 00 00 01 25 47 (07|FE 0C 01 00) (08|FE 0C 02 00) 91 61 D2 52} condition: uint16( 0 ) == 0x5A4D and all of them } rule CAPE_Agentteslav4Jit { meta: description = "AgentTesla JIT-compiled native code" author = "kevoreilly" id = "a87dca44-4974-543c-9565-487ed99be2a6" date = "2019-10-30" modified = "2026-01-14" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/data/yara/CAPE/AgentTesla.yar#L132-L145" license_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/LICENSE" logic_hash = "8f7144d2a989ce8d291af926b292f5f0f7772e707b0e49797eba13ecf91b90bc" score = 75 quality = 70 tags = "" cape_type = "AgentTesla Payload" packed = "7f8a95173e17256698324886bb138b7936b9e8c5b9ab8fffbfe01080f02f286c" strings: $decode1 = {8B 01 8B 40 3C FF 50 10 8B C8 E8 [4] 89 45 CC B8 1A 00 00 00} $decode2 = {83 F8 18 75 2? 8B [2-5] D1 F8} $decode3 = {8D 4C 0? 08 0F B6 01 [0-3] 0F B6 5? 04 33 C2 88 01 B8 19 00 00 00} condition: 2 of them } rule CAPE_Gandcrab : FILE { meta: description = "Gandcrab Payload" author = "kevoreilly" id = "0082e8c9-952e-508c-a438-4e17b8031864" date = "2019-10-30" modified = "2022-06-09" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/data/yara/CAPE/Gandcrab.yar#L1-L14" license_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/LICENSE" logic_hash = "354ed566dbafbe8e9531bb771d9846952eb8c0e70ee94c26d09368159ce4142c" score = 75 quality = 70 tags = "FILE" cape_type = "Gandcrab Payload" strings: $string1 = "GDCB-DECRYPT.txt" wide $string2 = "GandCrabGandCrabnomoreransom.coinomoreransom.bit" $string3 = "action=result&e_files=%d&e_size=%I64u&e_time=%d&" wide $string4 = "KRAB-DECRYPT.txt" wide condition: uint16( 0 ) == 0x5A4D and any of ( $string* ) } rule CAPE_Asyncrat_Kingrat { meta: description = "No description has been set in the source file - CAPE" author = "jeFF0Falltrades" id = "45efdcdf-b255-5913-97eb-f296d2c4eb1f" date = "2024-10-09" modified = "2025-02-03" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/data/yara/CAPE/AsyncRAT.yar#L1-L30" license_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/LICENSE" logic_hash = "1400d2029dfb66d8f2dc34db8643d6301f3af9bd356639f883d2c10bcc0c3947" score = 75 quality = 58 tags = "" cape_type = "AsyncRAT Payload" strings: $str_async = "AsyncClient" wide ascii nocase $str_aes_exc = "masterKey can not be null or empty" wide ascii $str_schtasks = "schtasks /create /f /sc onlogon /rl highest" wide ascii $byte_aes_key_base = { 7E [3] 04 73 [3] 06 80 } $byte_aes_salt_base = { BF EB 1E 56 FB CD 97 3B B2 19 } $patt_verify_hash = { 7e [3] 04 6f [3] 0a 6f [3] 0a 74 [3] 01 } $patt_config = { 72 [3] 70 80 [3] 04 } $dcrat_1 = "dcrat" wide ascii nocase $dcrat_2 = "qwqdan" wide ascii $dcrat_3 = "YW1zaS5kbGw=" wide ascii $dcrat_4 = "VmlydHVhbFByb3RlY3Q=" wide ascii $dcrat_5 = "save_Plugin" wide ascii $ww2 = "WorldWindClient" wide fullword nocase $ww3 = "WorldWindStealer" wide fullword nocase $ww4 = "*WorldWind Pro - Results:*" wide fullword nocase $ww5 = /WorldWind(\s)?Stealer/ ascii wide $prynt = /Prynt(\s)?Stealer/ ascii wide condition: ( not any of ( $dcrat* ) and not any of ( $ww* ) and not $prynt ) and 6 of them and #patt_config >= 10 } rule CAPE_Stormkitty : FILE { meta: description = "StormKitty infostealer payload" author = "ditekSHen" id = "71239da9-064f-58c4-a6fa-eb4983a3f55e" date = "2024-10-09" modified = "2025-02-03" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/data/yara/CAPE/AsyncRAT.yar#L32-L57" license_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/LICENSE" logic_hash = "258f5d9da80ff912459194b1139f062491df21a44456942951e2bd98e4b86c9b" score = 75 quality = 66 tags = "FILE" cape_type = "StormKitty Payload" strings: $x1 = "\\ARTIKA\\Videos\\Chrome-Password-Recovery" ascii $x2 = "https://github.com/LimerBoy/StormKitty" fullword ascii $x3 = "StormKitty" fullword ascii $s1 = "GetBSSID" fullword ascii $s2 = "GetAntivirus" fullword ascii $s3 = "C:\\Users\\Public\\credentials.txt" fullword wide $s4 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" fullword wide $s5 = "BCrypt.BCryptGetProperty() (get size) failed with status code:{0}" fullword wide $s6 = "\"encrypted_key\":\"(.*?)\"" fullword wide $ww2 = "WorldWindClient" wide fullword nocase $ww3 = "WorldWindStealer" wide fullword nocase $ww4 = "*WorldWind Pro - Results:*" wide fullword nocase $ww5 = /WorldWind(\s)?Stealer/ ascii wide $prynt = /Prynt(\s)?Stealer/ ascii wide condition: uint16( 0 ) == 0x5a4d and ( not any of ( $ww* ) and not $prynt ) and ( 2 of ( $x* ) or 5 of ( $s* ) or ( 3 of ( $s* ) and 1 of ( $x* ) ) ) } rule CAPE_Worldwind : FILE { meta: description = "Detects WorldWind infostealer" author = "ditekSHen" id = "226f591a-dc06-54f5-96ae-d142f624ff71" date = "2024-10-09" modified = "2025-02-03" reference = "https://github.com/kevoreilly/CAPEv2" source_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/data/yara/CAPE/AsyncRAT.yar#L60-L82" license_url = "https://github.com/kevoreilly/CAPEv2/blob/9a0783a08aa2f82bd30fb523be0c9444718dba82/LICENSE" logic_hash = "9bb04fad460193cd877ea7f2de9337f69aadda01aee6c79f0a23cdf564b1e6c8" score = 75 quality = 70 tags = "FILE" cape_type = "WorldWind Payload" strings: $c1 = /WorldWind(\s)?Stealer/ ascii wide $x2 = "@FlatLineStealer" ascii wide $x3 = "@CashOutGangTalk" ascii wide $m1 = ".Passwords.Targets." ascii $m2 = ".Modules.Keylogger" ascii $m3 = ".Modules.Clipper" ascii $m4 = ".Modules.Implant" ascii $s1 = "--- Clipper" wide $s2 = "Downloading file