YARA · CAPE Sandbox (CAPEv2)
CAPE_Ursnifv3
UrsnifV3 Payload
- Author
- kevoreilly
- Date
- 2022-05-31
- Modified
- 2023-03-23
- Score / Quality
- 75 / 70
What this rule detects
UrsnifV3 Payload
Targets: Windows PE.
It defines 6 patterns (1 text, 5 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
ursnifv3.yarGNU General Public License v3.0
rule CAPE_Ursnifv3 : FILE
{
meta:
= "UrsnifV3 Payload"
= "kevoreilly"
= "9dd32f80-b535-52a3-91e1-4db005362fd4"
= "2022-05-31"
= "2023-03-23"
= "https://github.com/kevoreilly/CAPEv2"
= "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/UrsnifV3.yar#L1-L18"
= "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
= "501cd52388aba16f9d33b4555f310e1ad58326916b15358a485c701acb87abd8"
= 75
= 70
= "FILE"
= "UrsnifV3 Payload"
= "75827be0c600f93d0d23d4b8239f56eb8c7dc4ab6064ad0b79e6695157816988"
= "5d6f1484f6571282790d64821429eeeadee71ba6b6d566088f58370634d2c579"
strings:
$crypto32_1 = {8B C3 83 EB 01 85 C0 75 0D 0F B6 16 83 C6 01 89 74 24 14 8D 58 07 8B C2 C1 E8 07 83 E0 01 03 D2 85 C0 0F 84 AB 01 00 00 8B C3 83 EB 01 85 C0 89 5C 24 20 75 13 0F B6 16 83 C6 01 BB 07 00 00 00}
$crypto32_2 = {8B 45 ?? 0F B6 3? FF 45 [2-4] 8B C? 23 C? 40 40 D1 E? 7?}
$crypto32_3 = {F6 46 03 02 75 5? 8B 46 10 40 50 E8 [10-12] 74 ?? F6 46 03 01 74}
$crypto32_4 = {C7 44 24 10 01 00 00 00 8B 4? 10 [12] 8B [2] 89 01 8B 44 24 10 5F 5E 5B 8B E5 5D C2 0C 00}
$cpuid = {8B C4 FF 18 8B F0 33 C0 0F A2 66 8C D8 66 8E D0 8B E5 8B C6 5E 5B 5D C3}
$cape_string = "cape_options"
condition:
uint16( 0 ) == 0x5A4D and 1 of ( $crypto32_* ) and $cpuid and not $cape_string
}
Strings (6 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $crypto32_1 | hex | {8B C3 83 EB 01 85 C0 75 0D 0F B6 16 83 C6 01 89 74 24 14 8D 58 07 8B C2 C1 E8 07 83 E0 01 03 D2 85 C0 0F 84 AB 01 00 00 8B C3 83 EB 01 85 C0 89 5C 24 20 75 13 … | |
| $crypto32_2 | hex | {8B 45 ?? 0F B6 3? FF 45 [2-4] 8B C? 23 C? 40 40 D1 E? 7?} | |
| $crypto32_3 | hex | {F6 46 03 02 75 5? 8B 46 10 40 50 E8 [10-12] 74 ?? F6 46 03 01 74} | |
| $crypto32_4 | hex | {C7 44 24 10 01 00 00 00 8B 4? 10 [12] 8B [2] 89 01 8B 44 24 10 5F 5E 5B 8B E5 5D C2 0C 00} | |
| $cpuid | hex | {8B C4 FF 18 8B F0 33 C0 0F A2 66 8C D8 66 8E D0 8B E5 8B C6 5E 5B 5D C3} | |
| $cape_string | text | "cape_options" |
Condition
uint16( 0 ) == 0x5A4D and 1 of ( $crypto32_* ) and $cpuid and not $cape_stringIn plain words (Heuristic)
- The file must start with “MZ” — a Windows executable (PE).
- At least 1 patterns in ( $crypto32_* ) must match.
- Pattern $cape_string must NOT be present.
- Pattern $cpuid must be present.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.
References
Licence & attribution
Author: kevoreilly
Source repository: CAPE Sandbox (CAPEv2) @ 6b15e76f28
Licence: GNU General Public License v3.0 (repository licence)
Copyright notice: Cuckoo Sandbox is copyrighted by the Cuckoo Foundation.
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 9dd32f80-b535-52a3-91e1-4db005362fd4
Metadata
| cape_type | UrsnifV3 Payload |
|---|---|
| packed | 75827be0c600f93d0d23d4b8239f56eb8c7dc4ab6064ad0b79e6695157816988 |
| packed | 5d6f1484f6571282790d64821429eeeadee71ba6b6d566088f58370634d2c579 |
Tags:FILE
Related rules
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2026-07-31
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2024-02-26
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2024-01-05
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2024-01-05
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2024-01-05
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2024-03-07
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2024-03-07
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2024-10-04