Skip to content
yararules.org
Menu

YARA · CAPE Sandbox (CAPEv2)

CAPE_Gettickcountantivm

GetTickCountAntiVM bypass

GenericCAPE Sandbox (CAPEv2)GNU General Public License v3.0Compiles with YARA-X
Author
kevoreilly
Date
2021-12-14
Modified
2022-02-25
Score / Quality
75 / 70

What this rule detects

GetTickCountAntiVM bypass

It defines 6 patterns (0 text, 6 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
gettickcountantivm.yarGNU General Public License v3.0
rule CAPE_Gettickcountantivm
{
	meta:
		description = "GetTickCountAntiVM bypass"
		author = "kevoreilly"
		id = "d90b9768-0525-5963-9817-e3a53b1d4cf3"
		date = "2021-12-14"
		modified = "2022-02-25"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/analyzer/windows/data/yara/GetTickCountAntiVM.yar#L1-L20"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		hash = "662bc7839ed7ddd82d5fdafa29fafd9a9ec299c28820fe4104fbba9be1a09c42"
		hash = "00f1537b13933762e1146e41f3bac668123fac7eacd0aa1f7be0aa37a91ef3ce"
		hash = "549bca48d0bac94b6a1e6eb36647cd007fed5c0e75a0e4aa315ceabdafe46541"
		hash = "90c29a66209be554dfbd2740f6a54d12616da35d0e5e4af97eb2376b9d053457"
		logic_hash = "9cdb0b2d2e058e1858c2f2baad67005a2019fbbdcb7ca54571c8d20dfbf33471"
		score = 75
		quality = 70
		tags = ""
		cape_options = "bp0=$antivm1-13,bp0=$antivm5-40,bp0=$antivm6,action0=wret,hc0=1,bp1=$antivm2-6,action1=wret,hc1=1,count=1,bp2=$antivm3+42,action2=jmp:96,bp3=$antivm4-9,action3=wret,hc3=1"

	strings:
		$antivm1 = {57 FF D6 FF D6 BF 01 00 00 00 FF D6 F2 0F 10 0D [4] 47 66 0F 6E C7 F3 0F E6 C0 66 0F 2F C8 73}
		$antivm2 = {F2 0F 11 45 ?? FF 15 [4] 6A 00 68 10 27 00 00 52 50 E8 [4] 8B C8 E8 [4] F2 0F 59 45}
		$antivm3 = {0F 57 C0 E8 [4] 8B 35 [4] BF 01 00 00 00 FF D6 F2 0F 10 0D [4] 47 66 0F 6E C7 F3 0F E6 C0 66 0F 2F C8 73}
		$antivm4 = {F2 0F 11 45 EC FF 15 [4] 8B DA 8B C8 BA [4] 89 5D FC F7 E2 BF [4] 89 45 F4 8B F2 8B C1 B9}
		$antivm5 = {BB 01 00 00 00 8B FB 90 FF 15 [4] FF C7 66 0F 6E C7 F3 0F E6 C0 66 0F 2F F8 73 EA}
		$antivm6 = {48 81 EC 88 00 00 00 0F 57 C0 F2 0F 11 44 [2] F2 0F 10 05 [4] F2 0F 11 44 [2] F2 0F 10 05 [4] F2 0F 11}

	condition:
		any of them
}

Strings (6 patterns)

IdentifierTypeValueModifiers
$antivm1hex{57 FF D6 FF D6 BF 01 00 00 00 FF D6 F2 0F 10 0D [4] 47 66 0F 6E C7 F3 0F E6 C0 66 0F 2F C8 73}
$antivm2hex{F2 0F 11 45 ?? FF 15 [4] 6A 00 68 10 27 00 00 52 50 E8 [4] 8B C8 E8 [4] F2 0F 59 45}
$antivm3hex{0F 57 C0 E8 [4] 8B 35 [4] BF 01 00 00 00 FF D6 F2 0F 10 0D [4] 47 66 0F 6E C7 F3 0F E6 C0 66 0F 2F C8 73}
$antivm4hex{F2 0F 11 45 EC FF 15 [4] 8B DA 8B C8 BA [4] 89 5D FC F7 E2 BF [4] 89 45 F4 8B F2 8B C1 B9}
$antivm5hex{BB 01 00 00 00 8B FB 90 FF 15 [4] FF C7 66 0F 6E C7 F3 0F E6 C0 66 0F 2F F8 73 EA}
$antivm6hex{48 81 EC 88 00 00 00 0F 57 C0 F2 0F 11 44 [2] F2 0F 10 05 [4] F2 0F 11 44 [2] F2 0F 10 05 [4] F2 0F 11}

Condition

any of them

In plain words (Heuristic)

  • At least one pattern in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 662bc7839ed7ddd82d5fdafa29fafd9a9ec299c28820fe4104fbba9be1a09c42
  • 00f1537b13933762e1146e41f3bac668123fac7eacd0aa1f7be0aa37a91ef3ce
  • 549bca48d0bac94b6a1e6eb36647cd007fed5c0e75a0e4aa315ceabdafe46541
  • 90c29a66209be554dfbd2740f6a54d12616da35d0e5e4af97eb2376b9d053457

Licence & attribution

Author: kevoreilly

Source repository: CAPE Sandbox (CAPEv2) @ 6b15e76f28

Licence: GNU General Public License v3.0 (repository licence)

Copyright notice: Cuckoo Sandbox is copyrighted by the Cuckoo Foundation.

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: d90b9768-0525-5963-9817-e3a53b1d4cf3

Metadata

cape_optionsbp0=$antivm1-13,bp0=$antivm5-40,bp0=$antivm6,action0=wret,hc0=1,bp1=$antivm2-6,action1=wret,hc1=1,count=1,bp2=$antivm3+42,action2=jmp:96,bp3=$antivm4-9,action3=wret,hc3=1

Related rules