YARA · CAPE Sandbox (CAPEv2)

CAPE_Monsterv2

MonsterV2 Payload

GenericCAPE Sandbox (CAPEv2)GNU General Public License v3.0Compiles with YARA-X

Author: doomedraven,YungBinary
Date: 2025-09-06
Modified: 2025-09-12
Score / Quality: 75 / 70

What this rule detects

MonsterV2 Payload

Targets: Windows PE.

It defines 1 patterns (0 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

monsterv2.yarGNU General Public License v3.0

rule CAPE_Monsterv2 : FILE
{
	meta:
		description = "MonsterV2 Payload"
		author = "doomedraven,YungBinary"
		id = "4bc3546f-34ad-579e-9822-272a2b3c74e2"
		date = "2025-09-06"
		modified = "2025-09-12"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/MonsterV2.yar#L1-L21"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		logic_hash = "d4e65f860e69b2eee8a818a4146d91b84ce6da30c8fa27593587932e4f0847a8"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "MonsterV2 Payload"
		packed = "fe69e8db634319815270aa0e55fe4b9c62ce8e62484609c3a42904fbe5bb2ab3"

	strings:
		$decrypt_config = {
            41 B8 0E 04 00 00
            48 8D 15 ?? ?? ?? 00
            48 8B C?
            E8 ?? ?? ?? ?? [3-17]
            4C 8B C?
            48 8D 54 24 28
            48 8B CE
            E8 ?? ?? ?? ??
        }

	condition:
		uint16( 0 ) == 0x5A4D and $decrypt_config
}

Strings (1 patterns)

Identifier	Type	Value	Modifiers
$decrypt_config	hex	{ 41 B8 0E 04 00 00 48 8D 15 ?? ?? ?? 00 48 8B C? E8 ?? ?? ?? ?? [3-17] 4C 8B C? 48 8D 5 …

Condition

uint16( 0 ) == 0x5A4D and $decrypt_config

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
Pattern $decrypt_config must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/kevoreilly/CAPEv2

Licence & attribution

Author: doomedraven,YungBinary

Source repository: CAPE Sandbox (CAPEv2) @ 6b15e76f28

Licence: GNU General Public License v3.0 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 4bc3546f-34ad-579e-9822-272a2b3c74e2

Metadata

cape_type	MonsterV2 Payload
packed	fe69e8db634319815270aa0e55fe4b9c62ce8e62484609c3a42904fbe5bb2ab3

Tags:FILE