Skip to content
yararules.org
Menu

YARA · CAPE Sandbox (CAPEv2)

CAPE_Nighthawk

NightHawk C2

Hack toolNighthawkCAPE Sandbox (CAPEv2)GNU General Public License v3.0Compiles with YARA-X
Author
Nikhil Ashok Hegde <@ka1do9>
Date
2022-12-03
Modified
2022-12-05
Score / Quality
75 / 70

What this rule detects

NightHawk C2

Associated malware family: Nighthawk.

Targets: Windows PE.

It defines 3 patterns (0 text, 3 hex, 0 regex). YARA modules used: pe.

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

Includes the imports needed to compile it on its own.

nighthawk.yarGNU General Public License v3.0
import "pe"

rule CAPE_Nighthawk
{
	meta:
		description = "NightHawk C2"
		author = "Nikhil Ashok Hegde <@ka1do9>"
		id = "096b9d13-6aa7-5b6e-aaeb-e25aa7c8c53f"
		date = "2022-12-03"
		modified = "2022-12-05"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/Nighthawk.yar#L3-L24"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		logic_hash = "2d77912678e06503ffef0e8ed84aa4f9ac74357480d57742fbae619acebfb5f2"
		score = 75
		quality = 70
		tags = ""
		cape_type = "Nighthawk Payload"

	strings:
		$keying_methods = { 85 C9 74 43 83 E9 01 74 1C 83 F9 01 0F 85 }
		$aes_sbox = { 63 7C 77 7B F2 6B 6F C5 30 }
		$aes_inv_sbox = { 52 09 6A D5 30 36 A5 38 BF }

	condition:
		pe.is_pe and for any s in pe.sections : ( s.name == ".profile" ) and all of them
}

Strings (3 patterns)

IdentifierTypeValueModifiers
$keying_methodshex{ 85 C9 74 43 83 E9 01 74 1C 83 F9 01 0F 85 }
$aes_sboxhex{ 63 7C 77 7B F2 6B 6F C5 30 }
$aes_inv_sboxhex{ 52 09 6A D5 30 36 A5 38 BF }

Condition

pe.is_pe and for any s in pe.sections : ( s.name == ".profile" ) and all of them

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • All patterns in the rule must match.
  • A for-loop checks a property over several matches or items.
  • Uses the pe module.
  • Uses the s module.
  • Checks PE sections (names, count or properties).

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: Nikhil Ashok Hegde <@ka1do9>

Source repository: CAPE Sandbox (CAPEv2) @ 6b15e76f28

Licence: GNU General Public License v3.0 (repository licence)

Copyright notice: Cuckoo Sandbox is copyrighted by the Cuckoo Foundation.

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 096b9d13-6aa7-5b6e-aaeb-e25aa7c8c53f

Metadata

cape_typeNighthawk Payload

Related rules

More Nighthawk rules