YARA · CAPE Sandbox (CAPEv2)
CAPE_Latrodectus_AES
Latrodectus Payload
- Author
- enzok
- Date
- 2024-01-18
- Modified
- 2025-05-10
- Score / Quality
- 75 / 70
What this rule detects
Latrodectus Payload
Associated malware family: Latrodectus.
It defines 6 patterns (0 text, 6 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
rule CAPE_Latrodectus_AES
{
meta:
= "Latrodectus Payload"
= "enzok"
= "16c295f5-cea0-57b5-b826-e1126e50c8cc"
= "2024-01-18"
= "2025-05-10"
= "https://github.com/kevoreilly/CAPEv2"
= "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/Latrodectus.yar#L18-L34"
= "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
= "5cecb26a3f33c24b92a0c8f6f5175da0664b21d7c4216a41694e4a4cad233ca8"
= "058d278c16527969066d1b4ea7f0e3ab2809d5480cdab06ec476b465e0c4795a"
= 75
= 70
= ""
= "Latrodectus Payload"
strings:
$fnvhash1 = {C7 04 24 C5 9D 1C 81 48 8B 44 24 20 48 89 44 24 08}
$fnvhash2 = {8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01}
$key = {C6 44 2? ?? ?? [150] C6 44 2? ?? ?? B8 02}
$aes_ctr_1 = {8B 44 24 ?? FF C8 89 44 24 ?? 83 7C 24 ?? 00 7C ?? 4? 63 44 24 ?? 4? 8B 4C 24 ?? 0F B6 84 01 F0 00 00 00 3D FF 00 00 00}
$aes_ctr_2 = {48 03 C8 48 8B C1 0F B6 ?? 48 63 4C 24 ?? 0F B6 4C 0C ?? 33 C1 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 03 D1 48 8B CA 88 01}
$version = {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89}
condition:
all of them
}
Strings (6 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $fnvhash1 | hex | {C7 04 24 C5 9D 1C 81 48 8B 44 24 20 48 89 44 24 08} | |
| $fnvhash2 | hex | {8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01} | |
| $key | hex | {C6 44 2? ?? ?? [150] C6 44 2? ?? ?? B8 02} | |
| $aes_ctr_1 | hex | {8B 44 24 ?? FF C8 89 44 24 ?? 83 7C 24 ?? 00 7C ?? 4? 63 44 24 ?? 4? 8B 4C 24 ?? 0F B6 84 01 F0 00 00 00 3D FF 00 00 00} | |
| $aes_ctr_2 | hex | {48 03 C8 48 8B C1 0F B6 ?? 48 63 4C 24 ?? 0F B6 4C 0C ?? 33 C1 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 03 D1 48 8B CA 88 01} | |
| $version | hex | {C7 44 2? ?? ?? 00 00 00 C7 44 2? ?? ?? 00 00 00 8B 05 [4] 89} |
Condition
all of themIn plain words (Heuristic)
- All patterns in the rule must match.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
References
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- 5cecb26a3f33c24b92a0c8f6f5175da0664b21d7c4216a41694e4a4cad233ca8
Licence & attribution
Author: enzok
Source repository: CAPE Sandbox (CAPEv2) @ 6b15e76f28
Licence: GNU General Public License v3.0 (repository licence)
Copyright notice: Cuckoo Sandbox is copyrighted by the Cuckoo Foundation.
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 16c295f5-cea0-57b5-b826-e1126e50c8cc
Metadata
| cape_type | Latrodectus Payload |
|---|
Related rules
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2024-01-18
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2024-02-26
- MalwareSEKOIA.IO Community· Sekoia.io· 2024-06-25
- MalwareSEKOIA.IO Community· Sekoia.io· 2024-07-03
- MalwareSEKOIA.IO Community· Sekoia.io· 2023-12-08
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2025-09-02
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2025-09-02