Skip to content
yararules.org
Menu

YARA · CAPE Sandbox (CAPEv2)

CAPE_Zloader

Zloader Payload

GenericCAPE Sandbox (CAPEv2)GNU General Public License v3.0Compiles with YARA-X
Author
kevoreilly, enzok
Date
2020-04-04
Modified
2025-12-09
Score / Quality
75 / 70

What this rule detects

Zloader Payload

Targets: Windows PE.

It defines 7 patterns (0 text, 7 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
zloader.yarGNU General Public License v3.0
rule CAPE_Zloader : FILE
{
	meta:
		description = "Zloader Payload"
		author = "kevoreilly, enzok"
		id = "a4250532-ddfc-58c2-bbae-82cc201d0c5d"
		date = "2020-04-04"
		modified = "2025-12-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/Zloader.yar#L1-L18"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		hash = "adbd0c7096a7373be82dd03df1aae61cb39e0a155c00bbb9c67abc01d48718aa"
		logic_hash = "525670973b67aac048199529c97d6be00b0a8cca9bc90deb647366d92a5ea540"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Zloader Payload"

	strings:
		$rc4_init = {31 [1-3] 66 C7 8? 00 01 00 00 00 00 90 90 [0-5] 8? [5-90] 00 01 00 00 [0-15] (74|75)}
		$decrypt_conf = {83 C4 04 84 C0 74 5? E8 [4] E8 [4] E8 [4] E8 [4] ?8 [4] ?8 [4] ?8}
		$decrypt_conf_1 = {48 8d [5-11] e8 [4] 48 [3-4] 48 [3-4] 48 [6] E8}
		$decrypt_conf_2 = {48 8d [5] 4? [5] e8 [4] 48 [3-4] 48 8d [5] E8 [4] 48}
		$decrypt_key_1 = {66 89 C2 4? 8D 0D [3] 00 4? B? FC 03 00 00 E8 [4] 4? 83 C4 [1-2] C3}
		$decrypt_key_2 = {48 8d 0d [3] 00 66 89 ?? 4? 89 F0 4? [2-5] E8 [4-5] 4? 83 C4}
		$decrypt_key_3 = {48 8d 0d [3] 00 e8 [4] 66 89 [3] b? [4] e8 [4] 66 8b}

	condition:
		uint16( 0 ) == 0x5A4D and 1 of ( $decrypt_conf* ) and ( 1 of ( $decrypt_key* ) or $rc4_init )
}

Strings (7 patterns)

IdentifierTypeValueModifiers
$rc4_inithex{31 [1-3] 66 C7 8? 00 01 00 00 00 00 90 90 [0-5] 8? [5-90] 00 01 00 00 [0-15] (74|75)}
$decrypt_confhex{83 C4 04 84 C0 74 5? E8 [4] E8 [4] E8 [4] E8 [4] ?8 [4] ?8 [4] ?8}
$decrypt_conf_1hex{48 8d [5-11] e8 [4] 48 [3-4] 48 [3-4] 48 [6] E8}
$decrypt_conf_2hex{48 8d [5] 4? [5] e8 [4] 48 [3-4] 48 8d [5] E8 [4] 48}
$decrypt_key_1hex{66 89 C2 4? 8D 0D [3] 00 4? B? FC 03 00 00 E8 [4] 4? 83 C4 [1-2] C3}
$decrypt_key_2hex{48 8d 0d [3] 00 66 89 ?? 4? 89 F0 4? [2-5] E8 [4-5] 4? 83 C4}
$decrypt_key_3hex{48 8d 0d [3] 00 e8 [4] 66 89 [3] b? [4] e8 [4] 66 8b}

Condition

uint16( 0 ) == 0x5A4D and 1 of ( $decrypt_conf* ) and ( 1 of ( $decrypt_key* ) or $rc4_init )

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • At least 1 patterns in ( $decrypt_conf* ) must match.
  • At least 1 patterns in ( $decrypt_key* ) must match.
  • Pattern $rc4_init must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • adbd0c7096a7373be82dd03df1aae61cb39e0a155c00bbb9c67abc01d48718aa

Licence & attribution

Author: kevoreilly, enzok

Source repository: CAPE Sandbox (CAPEv2) @ 6b15e76f28

Licence: GNU General Public License v3.0 (repository licence)

Copyright notice: Cuckoo Sandbox is copyrighted by the Cuckoo Foundation.

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: a4250532-ddfc-58c2-bbae-82cc201d0c5d

Metadata

cape_typeZloader Payload

Tags:FILE