YARA · CAPE Sandbox (CAPEv2)
CAPE_Pikabot
Pikabot Payload
- Author
- kevoreilly
- Date
- 2023-02-13
- Modified
- 2024-03-13
- Score / Quality
- 75 / 70
What this rule detects
Pikabot Payload
Associated malware family: Pikabot.
Targets: Windows PE.
It defines 3 patterns (0 text, 3 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
pikabot.yarGNU General Public License v3.0
rule CAPE_Pikabot : FILE
{
meta:
= "Pikabot Payload"
= "kevoreilly"
= "140a3e20-9837-5f66-85dc-af278d75e074"
= "2023-02-13"
= "2024-03-13"
= "https://github.com/kevoreilly/CAPEv2"
= "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/PikaBot.yar#L15-L28"
= "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
= "ed07217c373831a9a67d914854154988696e6fcea70dedabf333385f0e7bb8b7"
= 75
= 70
= "FILE"
= "PikaBot Payload"
= "89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9"
strings:
$decode = {29 D1 01 4B ?? 8D 0C 10 89 4B ?? 85 F6 74 02 89 16}
$indirect = {31 C0 64 8B 0D C0 00 00 00 85 C9 74 01 40 50 8D 54 24 ?? E8 [4] A3 [4] 8B 25 [4] A1}
$config = {C7 44 24 [3] 00 00 C7 44 24 [4] 00 89 [1-4] ?? E8 [4] 31 C0 C7 44 24 [3] 00 00 89 44 24 ?? C7 04 24 [4] E8}
condition:
uint16( 0 ) == 0x5A4D and 2 of them
}
Strings (3 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $decode | hex | {29 D1 01 4B ?? 8D 0C 10 89 4B ?? 85 F6 74 02 89 16} | |
| $indirect | hex | {31 C0 64 8B 0D C0 00 00 00 85 C9 74 01 40 50 8D 54 24 ?? E8 [4] A3 [4] 8B 25 [4] A1} | |
| $config | hex | {C7 44 24 [3] 00 00 C7 44 24 [4] 00 89 [1-4] ?? E8 [4] 31 C0 C7 44 24 [3] 00 00 89 44 24 ?? C7 04 24 [4] E8} |
Condition
uint16( 0 ) == 0x5A4D and 2 of themIn plain words (Heuristic)
- The file must start with “MZ” — a Windows executable (PE).
- At least 2 patterns in the rule must match.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.
References
Licence & attribution
Author: kevoreilly
Source repository: CAPE Sandbox (CAPEv2) @ 6b15e76f28
Licence: GNU General Public License v3.0 (repository licence)
Copyright notice: Cuckoo Sandbox is copyrighted by the Cuckoo Foundation.
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 140a3e20-9837-5f66-85dc-af278d75e074
Metadata
| cape_type | PikaBot Payload |
|---|---|
| packed | 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9 |
Tags:FILE
Related rules
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2024-03-07
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2024-03-07
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2023-02-13
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2023-02-13
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
- MalwareEmbee Research· Matthew @ Embee_Research· 2023-10-03
- RUSSIANPANDA_Pikabot_1Metadata onlyMalwareRussianPanda· RussianPanda· 2024-01-02
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2026-07-31