CAPE_Quasarrat_Kingrat

rule CAPE_Quasarrat_Kingrat
{
	meta:
		description = "No description has been set in the source file - CAPE"
		author = "jeFF0Falltrades"
		id = "dc0139e1-9f69-51da-b28f-212358b2f68b"
		date = "2024-10-09"
		modified = "2025-02-03"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/AsyncRAT.yar#L268-L287"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		logic_hash = "1f4296a592134edbe52e256dc353143af02e897ff1afad98f3dac0c5ab13f3f7"
		score = 75
		quality = 70
		tags = ""
		cape_type = "QuasarRAT Payload"

	strings:
		$str_quasar = "Quasar." wide ascii
		$str_hidden = "set_Hidden" wide ascii
		$str_shell = "DoShellExecuteResponse" wide ascii
		$str_close = "echo DONT CLOSE THIS WINDOW!" wide ascii
		$str_pause = "ping -n 10 localhost > nul" wide ascii
		$str_aes_exc = "masterKey can not be null or empty" wide ascii
		$byte_aes_key_base = { 7E [3] 04 73 [3] 06 25 }
		$byte_aes_salt_base = { BF EB 1E 56 FB CD 97 3B B2 19 }
		$byte_special_folder = { 7e 73 [4] 28 [4] 80 }
		$patt_config = { 72 [3] 70 80 [3] 04 }
		$patt_verify_hash = { 7e [3] 04 6f [3] 0a 6f [3] 0a 74 [3] 01 }

	condition:
		6 of them and #patt_config >= 10
}