YARA · CAPE Sandbox (CAPEv2)

CAPE_Cobaltstrikestager

Cobalt Strike Stager Payload

Hack toolCAPE Sandbox (CAPEv2)GNU General Public License v3.0Compiles with YARA-X

Author: @dan__mayer <daniel@stairwell.com>
Date: 2023-01-18
Score / Quality: 75 / 70

What this rule detects

Cobalt Strike Stager Payload

It defines 4 patterns (0 text, 4 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

cobaltstrikestager.yarGNU General Public License v3.0

rule CAPE_Cobaltstrikestager
{
	meta:
		description = "Cobalt Strike Stager Payload"
		author = "@dan__mayer <daniel@stairwell.com>"
		id = "eedf71b1-9f27-5a6f-afe8-3ddae47f9a06"
		date = "2023-01-18"
		modified = "2023-01-18"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/CobaltStrikeStager.yar#L1-L15"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		logic_hash = "6a55b0c3ab5f557dfb7a3f8bd616ede1bd9b93198590fc9d52aa19c1154388c5"
		score = 75
		quality = 70
		tags = ""
		cape_type = "CobaltStrikeStager Payload"

	strings:
		$smb = { 68 00 B0 04 00 68 00 B0 04 00 6A 01 6A 06 6A 03 52 68 45 70 DF D4 }
		$http_x86 = { 68 6E 65 74 00 68 77 69 6E 69 54 68 4C 77 26 07 }
		$http_x64 = { 49 BE 77 69 6E 69 6E 65 74 00 41 56 49 89 E6 4C 89 F1 41 BA 4C 77 26 07 }
		$dns = { 68 00 10 00 00 68 FF FF 07 00 6A 00 68 58 A4 53 E5 }

	condition:
		any of them
}

Strings (4 patterns)

Identifier	Type	Value
$smb	hex	{ 68 00 B0 04 00 68 00 B0 04 00 6A 01 6A 06 6A 03 52 68 45 70 DF D4 }
$http_x86	hex	{ 68 6E 65 74 00 68 77 69 6E 69 54 68 4C 77 26 07 }
$http_x64	hex	{ 49 BE 77 69 6E 69 6E 65 74 00 41 56 49 89 E6 4C 89 F1 41 BA 4C 77 26 07 }
$dns	hex	{ 68 00 10 00 00 68 FF FF 07 00 6A 00 68 58 A4 53 E5 }

Condition

any of them

In plain words (Heuristic)

At least one pattern in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/kevoreilly/CAPEv2

Licence & attribution

Author: @dan__mayer <daniel@stairwell.com>

Source repository: CAPE Sandbox (CAPEv2) @ 6b15e76f28

Licence: GNU General Public License v3.0 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: eedf71b1-9f27-5a6f-afe8-3ddae47f9a06

Metadata

cape_type	CobaltStrikeStager Payload