YARA · CAPE Sandbox (CAPEv2)
CAPE_Pikahook
Pikabot anti-hook bypass
- Author
- kevoreilly
- Date
- 2024-03-07
- Modified
- 2024-03-12
- Score / Quality
- 75 / 70
What this rule detects
Pikabot anti-hook bypass
Associated malware family: Pikabot.
Targets: Windows PE.
It defines 3 patterns (0 text, 3 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
pikahook.yarGNU General Public License v3.0
rule CAPE_Pikahook : FILE
{
meta:
= "Pikabot anti-hook bypass"
= "kevoreilly"
= "e1b7a807-135f-52d7-bc36-c0419e82b424"
= "2024-03-07"
= "2024-03-12"
= "https://github.com/kevoreilly/CAPEv2"
= "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/analyzer/windows/data/yara/Pikabot.yar#L1-L14"
= "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
= "2a50a5f2d905122a5b7ac8ca3666b47caa24d325e246841129e53807daf2a1dd"
= 75
= 70
= "FILE"
= "clear,sysbp=$indirect+40,sysbpmode=1,force-sleepskip=1"
= "89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9"
strings:
$indirect = {31 C0 64 8B 0D C0 00 00 00 85 C9 74 01 40 50 8D 54 24 ?? E8 [4] A3 [4] 8B 25 [4] A1 [4] FF 15}
$sysenter1 = {89 44 24 08 8D 85 20 FC FF FF C7 44 24 04 FF FF 1F 00 89 04 24 E8}
$sysenter2 = {C7 44 24 0C 00 00 00 02 C7 44 24 08 00 00 00 02 8B 45 0C 89 44 24 04 8B 45 08 89 04 24 E8}
condition:
uint16( 0 ) == 0x5A4D and 2 of them
}
Strings (3 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $indirect | hex | {31 C0 64 8B 0D C0 00 00 00 85 C9 74 01 40 50 8D 54 24 ?? E8 [4] A3 [4] 8B 25 [4] A1 [4] FF 15} | |
| $sysenter1 | hex | {89 44 24 08 8D 85 20 FC FF FF C7 44 24 04 FF FF 1F 00 89 04 24 E8} | |
| $sysenter2 | hex | {C7 44 24 0C 00 00 00 02 C7 44 24 08 00 00 00 02 8B 45 0C 89 44 24 04 8B 45 08 89 04 24 E8} |
Condition
uint16( 0 ) == 0x5A4D and 2 of themIn plain words (Heuristic)
- The file must start with “MZ” — a Windows executable (PE).
- At least 2 patterns in the rule must match.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.
References
Licence & attribution
Author: kevoreilly
Source repository: CAPE Sandbox (CAPEv2) @ 6b15e76f28
Licence: GNU General Public License v3.0 (repository licence)
Copyright notice: Cuckoo Sandbox is copyrighted by the Cuckoo Foundation.
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: e1b7a807-135f-52d7-bc36-c0419e82b424
Metadata
| cape_options | clear,sysbp=$indirect+40,sysbpmode=1,force-sleepskip=1 |
|---|---|
| packed | 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9 |
Tags:FILE
Related rules
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2024-03-07
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2023-02-13
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2023-02-13
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2023-02-13
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
- MalwareEmbee Research· Matthew @ Embee_Research· 2023-10-03
- RUSSIANPANDA_Pikabot_1Metadata onlyMalwareRussianPanda· RussianPanda· 2024-01-02
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2026-07-31