CAPE_Nitrobunnydownloader

rule CAPE_Nitrobunnydownloader : FILE
{
	meta:
		description = "NitroBunnyDownloader"
		author = "enzok"
		id = "64faa91a-4847-57bd-ab71-27029f6074ac"
		date = "2025-10-28"
		modified = "2025-11-05"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/NitroBunnyDownloader.yar#L1-L18"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		hash = "960e59200ec0a4b5fb3b44e6da763f5fec4092997975140797d4eec491de411b"
		logic_hash = "dcc1348c1d1af0c854376cf6331538951362b43d8d76c0ad73bbbdeb1ab4c135"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "NitroBunnyDownloader Payload"

	strings:
		$config1 = {E8 [3] 00 41 B8 ?? ?? 00 00 48 8D 15 [3] 00 48 89 C1 48 89 ?? E8 [3] 00}
		$config2 = {E8 [3] 00 48 8D 15 [3] 00 41 B8 ?? ?? 00 00 48 89 C1 48 89 ?? E8 [3] 00}
		$string1 = "X-Amz-User-Agent:" wide
		$string2 = "Amz-Security-Flag:" wide
		$string3 = "/cart" wide
		$string4 = "Cookie: " wide
		$string5 = "wishlist" wide

	condition:
		uint16( 0 ) == 0x5A4D and 1 of ( $config* ) and 2 of ( $string* )
}