YARA · CAPE Sandbox (CAPEv2)
CAPE_Aurastealer
AuraStealer Payload
- Author
- enzok
- Date
- 2025-09-02
- Score / Quality
- 75 / 70
What this rule detects
AuraStealer Payload
Associated malware family: Aurastealer.
It defines 6 patterns (0 text, 6 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
aurastealer.yarGNU General Public License v3.0
rule CAPE_Aurastealer
{
meta:
= "AuraStealer Payload"
= "enzok"
= "1fe058a8-1e87-51bb-8b5c-914442bca2e5"
= "2025-09-02"
= "2025-09-02"
= "https://github.com/kevoreilly/CAPEv2"
= "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/AuraStealer.yar#L1-L18"
= "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
= "960b83639a898509dc272f3235822401a8f861fa6607991993285b618b882d8b"
= 75
= 70
= ""
= "AuraStealer Payload"
= "a9c47f10d5eb77d7d6b356be00b4814a7c1e5bb75739b464beb6ea03fc36cc85"
= "bac52ffc8072893ff26cdbf1df1ecbcbb1762ded80249d3c9d420f62ed0dc202"
strings:
$conf = {8D BE ?? 00 00 00 68 00 40 00 00 5? 5? FF D1 83 C4 ?? 8B 07 8B 57 04 29 C2}
$key1 = {FF D2 8B 2B 8D 75 ?? 8B 5D ?? 33 5D ?? 8D 45}
$key2 = {89 0B 89 F9 5? 5? 5? E8 [4] 8B 3F 8D 6F 38 8B 77 30 33 77 34 8D 47 20 8D 4C 24 ?? 89 FA 5? E8}
$keyexpansion = {31 C0 8A 1C 82 88 1C 81 8A 5C 82 01 88 5C 81 01 8A 5C 82 02 88 5C 81 02 8A 5C 82 03 88 5C 81 03 4? 83 F8 08 75 ?? B? 08 00 00 00}
$antivm2 = {8B 43 04 8B 0D [4] 3B 81 [4] B? [2] 00 00 B? [2] 00 00 0F 44 D1 85 C0 0F 44 D1 8B 8A [4] 03 8A [4] FF E1 31 FF EB ?? 8B 78 0C 33 78 10 B? [4] 03 05 [4] FF D0}
$antivm1 = {39 04 11 0f 94 C3 8B 44 ?? ?? 85 C0}
condition:
3 of them
}
Strings (6 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $conf | hex | {8D BE ?? 00 00 00 68 00 40 00 00 5? 5? FF D1 83 C4 ?? 8B 07 8B 57 04 29 C2} | |
| $key1 | hex | {FF D2 8B 2B 8D 75 ?? 8B 5D ?? 33 5D ?? 8D 45} | |
| $key2 | hex | {89 0B 89 F9 5? 5? 5? E8 [4] 8B 3F 8D 6F 38 8B 77 30 33 77 34 8D 47 20 8D 4C 24 ?? 89 FA 5? E8} | |
| $keyexpansion | hex | {31 C0 8A 1C 82 88 1C 81 8A 5C 82 01 88 5C 81 01 8A 5C 82 02 88 5C 81 02 8A 5C 82 03 88 5C 81 03 4? 83 F8 08 75 ?? B? 08 00 00 00} | |
| $antivm2 | hex | {8B 43 04 8B 0D [4] 3B 81 [4] B? [2] 00 00 B? [2] 00 00 0F 44 D1 85 C0 0F 44 D1 8B 8A [4] 03 8A [4] FF E1 31 FF EB ?? 8B 78 0C 33 78 10 B? [4] 03 05 [4] FF D0} | |
| $antivm1 | hex | {39 04 11 0f 94 C3 8B 44 ?? ?? 85 C0} |
Condition
3 of themIn plain words (Heuristic)
- At least 3 patterns in the rule must match.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.
References
Licence & attribution
Author: enzok
Source repository: CAPE Sandbox (CAPEv2) @ 6b15e76f28
Licence: GNU General Public License v3.0 (repository licence)
Copyright notice: Cuckoo Sandbox is copyrighted by the Cuckoo Foundation.
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 1fe058a8-1e87-51bb-8b5c-914442bca2e5
Metadata
| cape_type | AuraStealer Payload |
|---|---|
| unpacked | a9c47f10d5eb77d7d6b356be00b4814a7c1e5bb75739b464beb6ea03fc36cc85 |
| packed | bac52ffc8072893ff26cdbf1df1ecbcbb1762ded80249d3c9d420f62ed0dc202 |
Related rules
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2025-09-02
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2024-01-18
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2024-01-18
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2024-10-29
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2023-11-30
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2022-04-21
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2024-10-29