YARA · CAPE Sandbox (CAPEv2)

CAPE_Rhadunhook

No description has been set in the source file - CAPE

GenericCAPE Sandbox (CAPEv2)GNU General Public License v3.0Compiles with YARA-X

Author: Kevin O'Reilly
Date: 2023-01-25
Modified: 2025-11-11
Score / Quality: 75 / 70

What this rule detects

No description has been set in the source file - CAPE

It defines 2 patterns (0 text, 2 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

rhadunhook.yarGNU General Public License v3.0

rule CAPE_Rhadunhook
{
	meta:
		description = "No description has been set in the source file - CAPE"
		author = "Kevin O'Reilly"
		id = "7bbeeb3a-9437-50d8-89e6-306a07886a17"
		date = "2023-01-25"
		modified = "2025-11-11"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/analyzer/windows/data/yara/Rhadamanthys.yar#L26-L36"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		logic_hash = "f2da2f1ee6b0a3b9fe58b2c35ccf0a0f6dee44228ec92659370d30defdef7ea3"
		score = 75
		quality = 70
		tags = ""
		cape_options = "bp0=$scan*,action0=scan:rbx,count=0,patch=$target+21:9090"
		packed = "dd4af0f1888977f6d9eb820b19f4afc2a73d1c494a132ab4261498328005dda7"

	strings:
		$scan = {48 85 DB 0F 84 E1 00 00 00 4C 8D 44 24 70 48 8D 54 24 40 48 8B CE 44 89 7C 24 50 4C 89 64 24 40 48 C7 44 24 48 00 00 00 00 C6 44 24 54 00 FF}
		$target = {4D 85 C9 48 8B C6 4A 8D 0C 1E 74 15 48 2B D8 49 2B DB 8A 04 0B 88 01 48 83 C1 01 49 83 E9 01 75 F1 5F 5E 5D 5B C3}

	condition:
		any of them
}

Strings (2 patterns)

Identifier	Type	Value	Modifiers
$scan	hex	{48 85 DB 0F 84 E1 00 00 00 4C 8D 44 24 70 48 8D 54 24 40 48 8B CE 44 89 7C 24 50 4C 89 64 24 40 48 C7 44 24 48 00 00 00 00 C6 44 24 54 00 FF}
$target	hex	{4D 85 C9 48 8B C6 4A 8D 0C 1E 74 15 48 2B D8 49 2B DB 8A 04 0B 88 01 48 83 C1 01 49 83 E9 01 75 F1 5F 5E 5D 5B C3}

Condition

any of them

In plain words (Heuristic)

At least one pattern in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/kevoreilly/CAPEv2

Licence & attribution

Author: Kevin O'Reilly

Source repository: CAPE Sandbox (CAPEv2) @ 6b15e76f28

Licence: GNU General Public License v3.0 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 7bbeeb3a-9437-50d8-89e6-306a07886a17

Metadata

cape_options	bp0=$scan*,action0=scan:rbx,count=0,patch=$target+21:9090
packed	dd4af0f1888977f6d9eb820b19f4afc2a73d1c494a132ab4261498328005dda7

CAPE_Rozena
GenericCAPE Sandbox (CAPEv2)· Kevin O'Reilly· 2024-03-13