CAPE_Latrodectus_AES

rule CAPE_Latrodectus_AES
{
	meta:
		description = "Latrodectus Payload"
		author = "enzok"
		id = "16c295f5-cea0-57b5-b826-e1126e50c8cc"
		date = "2024-01-18"
		modified = "2025-05-10"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/Latrodectus.yar#L18-L34"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		hash = "5cecb26a3f33c24b92a0c8f6f5175da0664b21d7c4216a41694e4a4cad233ca8"
		logic_hash = "058d278c16527969066d1b4ea7f0e3ab2809d5480cdab06ec476b465e0c4795a"
		score = 75
		quality = 70
		tags = ""
		cape_type = "Latrodectus Payload"

	strings:
		$fnvhash1 = {C7 04 24 C5 9D 1C 81 48 8B 44 24 20 48 89 44 24 08}
		$fnvhash2 = {8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01}
		$key = {C6 44 2? ?? ?? [150] C6 44 2? ?? ?? B8 02}
		$aes_ctr_1 = {8B 44 24 ?? FF C8 89 44 24 ?? 83 7C 24 ?? 00 7C ?? 4? 63 44 24 ?? 4? 8B 4C 24 ?? 0F B6 84 01 F0 00 00 00 3D FF 00 00 00}
		$aes_ctr_2 = {48 03 C8 48 8B C1 0F B6 ?? 48 63 4C 24 ?? 0F B6 4C 0C ?? 33 C1 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 03 D1 48 8B CA 88 01}
		$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}

	condition:
		all of them
}