YARA · CAPE Sandbox (CAPEv2)
CAPE_Zloader2025
Zloader Payload
- Author
- enzok
- Date
- 2020-04-04
- Modified
- 2025-12-09
- Score / Quality
- 75 / 70
What this rule detects
Zloader Payload
Targets: Windows PE.
It defines 3 patterns (0 text, 3 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
zloader2025.yarGNU General Public License v3.0
rule CAPE_Zloader2025 : FILE
{
meta:
= "Zloader Payload"
= "enzok"
= "dd6ee439-9599-564c-8841-94bd89ae2db0"
= "2020-04-04"
= "2025-12-09"
= "https://github.com/kevoreilly/CAPEv2"
= "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/Zloader.yar#L36-L49"
= "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
= "86ffd411b42d8d06bdb294f48e79393adeea586c56c5c75c1a68ce6315932881"
= "cc9c39f0b5e7e8c8853982d9c896bbaac5a36bb0f501c8901d8854f2d5e1a19c"
= 75
= 70
= "FILE"
= "Zloader Payload"
strings:
$conf = {4? 01 ?? [4] E8 [4] 4? 8D 15 [4] 4? 89 ?? 4? 89 ?? E8 [4] C7 46 30 00 00 00 00 8B 7E 34}
$confkey_1 = {4? 01 ?? [2] E8 [4] 4? 8D 15 [4] 4? 89 ?? 4? 89 ?? E8 [4] C7 46 34 00 00 00 00 8B 46 38}
$confkey_2 = {4? 01 ?? [2] E8 [4] 4? 8D 15 [4] 4? 89 ?? 4? 89 ?? E8 [4] C7 46 38 00 00 00 00 48 83 C4 28}
condition:
uint16( 0 ) == 0x5A4D and $conf and all of ( $confkey_* )
}
Strings (3 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $conf | hex | {4? 01 ?? [4] E8 [4] 4? 8D 15 [4] 4? 89 ?? 4? 89 ?? E8 [4] C7 46 30 00 00 00 00 8B 7E 34} | |
| $confkey_1 | hex | {4? 01 ?? [2] E8 [4] 4? 8D 15 [4] 4? 89 ?? 4? 89 ?? E8 [4] C7 46 34 00 00 00 00 8B 46 38} | |
| $confkey_2 | hex | {4? 01 ?? [2] E8 [4] 4? 8D 15 [4] 4? 89 ?? 4? 89 ?? E8 [4] C7 46 38 00 00 00 00 48 83 C4 28} |
Condition
uint16( 0 ) == 0x5A4D and $conf and all of ( $confkey_* )In plain words (Heuristic)
- The file must start with “MZ” — a Windows executable (PE).
- All patterns in ( $confkey_* ) must match.
- Pattern $conf must be present.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.
References
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- 86ffd411b42d8d06bdb294f48e79393adeea586c56c5c75c1a68ce6315932881
Licence & attribution
Author: enzok
Source repository: CAPE Sandbox (CAPEv2) @ 6b15e76f28
Licence: GNU General Public License v3.0 (repository licence)
Copyright notice: Cuckoo Sandbox is copyrighted by the Cuckoo Foundation.
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: dd6ee439-9599-564c-8841-94bd89ae2db0
Metadata
| cape_type | Zloader Payload |
|---|
Tags:FILE
Related rules
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2025-09-02
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2025-09-02
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2024-01-18
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2024-01-18
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2024-10-29
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2023-11-30
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2022-04-21
- GenericCAPE Sandbox (CAPEv2)· enzok· 2025-06-16