CAPE_Privateloader

rule CAPE_Privateloader
{
	meta:
		description = "PrivateLoader indirect syscall capture"
		author = "kevoreilly"
		id = "3a0b16da-ec84-5761-bcf2-106362c5667d"
		date = "2024-10-04"
		modified = "2024-10-04"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/analyzer/windows/data/yara/PrivateLoader.yar#L1-L12"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		logic_hash = "204a86bb3743f19fed0fe55ff5ccd716661f7f315b5966a29e434ccb3e160526"
		score = 75
		quality = 70
		tags = ""
		cape_options = "clear,sysbp=$syscall*-2"
		packed = "075d0dafd7b794fbabaf53d38895cfd7cffed4a3fe093b0fc7853f3b3ce642a4"

	strings:
		$syscall = {48 31 C0 4C 8B 19 8B 41 10 48 8B 49 08 49 89 CA 41 FF E3}

	condition:
		any of them
}