CAPE_Koiloader

rule CAPE_Koiloader
{
	meta:
		description = "KoiLoader"
		author = "YungBinary"
		id = "258e8857-7ea6-5098-9949-06d9d83853d4"
		date = "2024-10-25"
		modified = "2024-10-25"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/KoiLoader.yar#L1-L35"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		hash = "b462e3235c7578450b2b56a8aff875a3d99d22f6970a01db3ba98f7ecb6b01a0"
		logic_hash = "264a536632f8f11c904b00c9d2e505b3263c733ad8fbc2ef19c25a5ad58cef90"
		score = 75
		quality = 70
		tags = ""
		cape_type = "KoiLoader Payload"

	strings:
		$chunk_1 = {
            68 27 11 68 05
            8B 45 ??
            50
            E8 ?? ?? ?? ??
            83 C4 08
            89 45 ??
            68 15 B1 B3 09
            8B 4D ??
            51
            E8 ?? ?? ?? ??
            83 C4 08
            89 45 ??
            68 B5 96 AA 0D
            8B 55 ??
            52
            E8 ?? ?? ?? ??
            83 C4 08
            89 45 ??
            6A 00
            FF 15 ?? ?? ?? ??
        }

	condition:
		$chunk_1
}