YARA · CAPE Sandbox (CAPEv2)
CAPE_Icedsleep
IcedID sleep bypass
- Author
- kevoreilly
- Date
- 2021-03-30
- Modified
- 2023-11-28
- Score / Quality
- 75 / 70
What this rule detects
IcedID sleep bypass
Associated malware family: Icedid.
Targets: Windows PE.
It defines 1 patterns (0 text, 1 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
icedsleep.yarGNU General Public License v3.0
rule CAPE_Icedsleep : FILE
{
meta:
= "IcedID sleep bypass"
= "kevoreilly"
= "d6bd708b-47bc-5620-b40e-8fe5f1a67ba4"
= "2021-03-30"
= "2023-11-28"
= "https://github.com/kevoreilly/CAPEv2"
= "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/analyzer/windows/data/yara/IcedID.yar#L88-L99"
= "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
= "0b1a8be95b1b8a3b066837f9e47561ee8202d741b39d64e626c0461c2fbf7c70"
= 75
= 70
= "FILE"
= "force-sleepskip=1"
= "e99f3517a36a9f7a55335699cfb4d84d08b042d47146119156f7f3bab580b4d7"
strings:
$sleep = {89 4C 24 08 48 83 EC 38 8B 44 24 40 48 69 C0 10 27 00 00 48 F7 D8 48 89 44 24 20 48 8D 54 24 20 33 C9 FF 15 [4] 48 83 C4 38 C3}
condition:
uint16( 0 ) == 0x5A4D and all of them
}
Strings (1 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $sleep | hex | {89 4C 24 08 48 83 EC 38 8B 44 24 40 48 69 C0 10 27 00 00 48 F7 D8 48 89 44 24 20 48 8D 54 24 20 33 C9 FF 15 [4] 48 83 C4 38 C3} |
Condition
uint16( 0 ) == 0x5A4D and all of themIn plain words (Heuristic)
- The file must start with “MZ” — a Windows executable (PE).
- All patterns in the rule must match.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.
References
Licence & attribution
Author: kevoreilly
Source repository: CAPE Sandbox (CAPEv2) @ 6b15e76f28
Licence: GNU General Public License v3.0 (repository licence)
Copyright notice: Cuckoo Sandbox is copyrighted by the Cuckoo Foundation.
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: d6bd708b-47bc-5620-b40e-8fe5f1a67ba4
Metadata
| cape_options | force-sleepskip=1 |
|---|---|
| packed | e99f3517a36a9f7a55335699cfb4d84d08b042d47146119156f7f3bab580b4d7 |
Tags:FILE
Related rules
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2021-03-30
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2021-03-30
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2021-03-30
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2021-03-30
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2021-03-30
- Suspicious / huntingCAPE Sandbox (CAPEv2)· kevoreilly· 2021-03-30
- MalwareSignature Base (Florian Roth / Nextron)· Thomas Barabosch, Telekom Security· 2021-04-12
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04