YARA · CAPE Sandbox (CAPEv2)

CAPE_Netsupport

Detects NetSupport Manager RAT on disk or in memory

MalwareCAPE Sandbox (CAPEv2)GNU General Public License v3.0Compiles with YARA-X

Author: YungBinary
Date: 2025-10-17
Score / Quality: 75 / 70

What this rule detects

Detects NetSupport Manager RAT on disk or in memory

Targets: Windows PE.

It defines 4 patterns (4 text, 0 hex, 0 regex). YARA modules used: pe.

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

Includes the imports needed to compile it on its own.

netsupport.yarGNU General Public License v3.0

import "pe"

rule CAPE_Netsupport : FILE
{
	meta:
		description = "Detects NetSupport Manager RAT on disk or in memory"
		author = "YungBinary"
		id = "c517193e-bee3-59c4-9fbf-aad01ee13379"
		date = "2025-10-17"
		modified = "2025-10-17"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/NetSupport.yar#L3-L16"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		logic_hash = "d12e46d74ae0ba9f599d27dc2f55ff92a6648accbcd1a43cc3f1a9a2755e5fc7"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "NetSupport Payload"

	strings:
		$a1 = "NetSupport Manager" wide
		$b1 = "NetSupport Remote Control" wide
		$s1 = "Client Application" wide
		$s2 = "NetSupport Ltd" wide

	condition:
		uint16( 0 ) == 0x5a4d and ( ( pe.imports ( "PCICL32.dll" , "_NSMClient32@8" ) ) or ( ( $a1 and $b1 ) or ( $s1 and $s2 ) ) )
}

Strings (4 patterns)

Identifier	Type	Value	Modifiers
$a1	text	"NetSupport Manager"	wide
$b1	text	"NetSupport Remote Control"	wide
$s1	text	"Client Application"	wide
$s2	text	"NetSupport Ltd"	wide

Condition

uint16( 0 ) == 0x5a4d and ( ( pe.imports ( "PCICL32.dll" , "_NSMClient32@8" ) ) or ( ( $a1 and $b1 ) or ( $s1 and $s2 ) ) )

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
Uses the pe module.
Pattern $a1 must be present.
Pattern $b1 must be present.
Pattern $s1 must be present.
Pattern $s2 must be present.
Checks imported functions or libraries.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/kevoreilly/CAPEv2

Licence & attribution

Author: YungBinary

Source repository: CAPE Sandbox (CAPEv2) @ 6b15e76f28

Licence: GNU General Public License v3.0 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: c517193e-bee3-59c4-9fbf-aad01ee13379

Metadata

cape_type	NetSupport Payload

Tags:FILE

CAPE_Nightshadec2
MalwareCAPE Sandbox (CAPEv2)· YungBinary· 2025-09-04
CAPE_Koiloader
MalwareCAPE Sandbox (CAPEv2)· YungBinary· 2024-10-25
CAPE_Stxrat
GenericCAPE Sandbox (CAPEv2)· YungBinary· 2026-04-11
CAPE_Mykings
GenericCAPE Sandbox (CAPEv2)· YungBinary· 2025-10-24