CAPE_Worldwind

rule CAPE_Worldwind : FILE
{
	meta:
		description = "Detects WorldWind infostealer"
		author = "ditekSHen"
		id = "226f591a-dc06-54f5-96ae-d142f624ff71"
		date = "2024-10-09"
		modified = "2025-02-03"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/AsyncRAT.yar#L60-L82"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		logic_hash = "9bb04fad460193cd877ea7f2de9337f69aadda01aee6c79f0a23cdf564b1e6c8"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "WorldWind Payload"

	strings:
		$c1 = /WorldWind(\s)?Stealer/ ascii wide
		$x2 = "@FlatLineStealer" ascii wide
		$x3 = "@CashOutGangTalk" ascii wide
		$m1 = ".Passwords.Targets." ascii
		$m2 = ".Modules.Keylogger" ascii
		$m3 = ".Modules.Clipper" ascii
		$m4 = ".Modules.Implant" ascii
		$s1 = "--- Clipper" wide
		$s2 = "Downloading file: \"{file}\"" wide
		$s3 = "/bot{0}/getUpdates?offset={1}" wide
		$s4 = "send command to bot!" wide
		$s5 = " *Keylogger " fullword wide
		$s6 = "*Stealer" wide
		$s7 = "Bot connected" wide

	condition:
		uint16( 0 ) == 0x5a4d and 1 of ( $c* ) and ( 1 of ( $x* ) or 2 of ( $m* ) or 3 of ( $s* ) )
}