CAPE_Mykings

rule CAPE_Mykings : FILE
{
	meta:
		description = "No description has been set in the source file - CAPE"
		author = "YungBinary"
		id = "c9d7b061-b76c-595c-a362-6c89c96093d9"
		date = "2025-10-24"
		modified = "2025-10-26"
		reference = "https://x.com/YungBinary/status/1981108948498333900"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/MyKings.yar#L1-L23"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		logic_hash = "82647dd23c0247faa045893ec1cf111da2a30528a1b737b59ce1b71172a64473"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "MyKings Payload"

	strings:
		$s1 = "login.php?uid=0" wide
		$s2 = "download.txt?rnd=" wide
		$s3 = "AcceptOK" ascii
		$s4 = "winsta0\\default" wide
		$s5 = "base64_ip.txt" wide
		$s6 = { 70 00 6F 00 77 00 65 00 72 00 74 00 6F 00 6F 00 6C 00 00 00 6B 00 61 00 73 00 70 00 65 00 72 00 73 00 6B 00 79 }
		$s7 = { 53 00 61 00 66 00 65 00 00 00 00 00 45 00 73 00 65 00 74 }
		$s8 = { 4E 00 6F 00 64 00 33 00 32 00 00 00 4D 00 61 00 6C 00 77 00 61 00 72 00 65 }
		$s9 = "Custom C++ HTTP Client/1.0" wide
		$s10 = "/ru \"SYSTEM\" /f" ascii
		$s11 = "cmd.exe /C timeout /t 1 & del " wide
		$s12 = "/login.aspx?uid=0" wide
		$s13 = "cmd-230812.ru" base64

	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) )
}