YARA · CAPE Sandbox (CAPEv2)

CAPE_Formconfa

Formbook Config Extraction

MalwareFormbookCAPE Sandbox (CAPEv2)GNU General Public License v3.0Compiles with YARA-X

Author: kevoreilly
Date: 2021-03-07
Modified: 2026-05-15
Score / Quality: 75 / 70

What this rule detects

Formbook Config Extraction

Associated malware family: Formbook.

It defines 2 patterns (0 text, 2 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

formconfa.yarGNU General Public License v3.0

rule CAPE_Formconfa
{
	meta:
		description = "Formbook Config Extraction"
		author = "kevoreilly"
		id = "f9c3fc92-e2c8-5968-b0f4-80bd8199b7ca"
		date = "2021-03-07"
		modified = "2026-05-15"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/analyzer/windows/data/yara/Formbook.yar#L32-L44"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		logic_hash = "b0aa4cec55a21245d8104380c531dd6cc0fdef64fbefd79616eadfb4e95b2d75"
		score = 75
		quality = 70
		tags = ""
		cape_options = "clear,bp0=$c2,action0=string:rcx+1,bp1=$decoy+67,action1=string:rcx+1,count=0,typestring=Formbook Config"
		packed = "b8e44f4a0d92297c5bb5b217c121f0d032850b38749044face2b0014e789adfb"

	strings:
		$c2 = {44 8B C6 48 8B D3 49 8B CE E8 [4] 44 88 23 41 8B DD 48 8D [2] 66 66 66 0F 1F 84 00 00 00 00 00 BA 8D 00 00 00 41 FF C4}
		$decoy = {8B D7 0F 1F 44 00 00 0F B6 03 FF C0 48 98 48 03 D8 48 FF CA 75 ?? 44 0F B6 03 48 8D 53 01 48 8D 4C [2] E8}

	condition:
		all of them
}

Strings (2 patterns)

Identifier	Type	Value	Modifiers
$c2	hex	{44 8B C6 48 8B D3 49 8B CE E8 [4] 44 88 23 41 8B DD 48 8D [2] 66 66 66 0F 1F 84 00 00 00 00 00 BA 8D 00 00 00 41 FF C4}
$decoy	hex	{8B D7 0F 1F 44 00 00 0F B6 03 FF C0 48 98 48 03 D8 48 FF CA 75 ?? 44 0F B6 03 48 8D 53 01 48 8D 4C [2] E8}

Condition

all of them

In plain words (Heuristic)

All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/kevoreilly/CAPEv2

Licence & attribution

Author: kevoreilly

Source repository: CAPE Sandbox (CAPEv2) @ 6b15e76f28

Licence: GNU General Public License v3.0 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: f9c3fc92-e2c8-5968-b0f4-80bd8199b7ca

Metadata

cape_options	clear,bp0=$c2,action0=string:rcx+1,bp1=$decoy+67,action1=string:rcx+1,count=0,typestring=Formbook Config
packed	b8e44f4a0d92297c5bb5b217c121f0d032850b38749044face2b0014e789adfb

CAPE_Formconfb
MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2021-03-07
CAPE_Formhelper
MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2021-03-07
CAPE_Formhooka
MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2021-03-07
MALPEDIA_Win_Formbook_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
SECUINFRA_MALWARE_Formbook_Filename_Stage_2Metadata only
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19
CAPE_Remus
MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2026-07-31
CAPE_Latrodectus_1
MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2024-02-26
CAPE_Lumma
MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2024-01-05

More Formbook rules