CAPE_Nightshadec2

rule CAPE_Nightshadec2 : FILE
{
	meta:
		description = "NightshadeC2 AKA CastleRAT - https://x.com/YungBinary/status/1963751038340534482"
		author = "YungBinary"
		id = "d70f9051-c7ab-537a-ab80-03ae7ef80b81"
		date = "2025-09-04"
		modified = "2025-09-12"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/NightshadeC2.yar#L1-L20"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		hash = "963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d"
		logic_hash = "f9fabc391e21180a1c92abea0a5ded6d7669e8d8f2330b69d6c1227c9b4237a0"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "NightshadeC2 Payload"

	strings:
		$s1 = "keylog.txt" fullword wide
		$s2 = "\"%ws\" --mute-audio --do-not-de-elevate" fullword wide
		$s3 = "\"%ws\" -no-deelevate" fullword wide
		$s4 = "MachineGuid" fullword wide
		$s5 = "www.ip-api.com" fullword wide
		$s6 = "rundll32 \"C:\\Windows\\System32\\shell32.dll\" #61" fullword wide
		$s7 = "IsabellaWine" fullword wide
		$s8 = "Shell_TrayWnd" fullword wide

	condition:
		uint16( 0 ) == 0x5A4D and 3 of them
}