CAPE_Prynt

rule CAPE_Prynt : FILE
{
	meta:
		description = "Detects Prynt infostealer"
		author = "ditekSHen"
		id = "844fd100-b04e-5ff0-9fab-d45f48b55bcc"
		date = "2024-10-09"
		modified = "2025-02-03"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/AsyncRAT.yar#L85-L107"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		logic_hash = "84f2b33285ab1d129a62940a02990639cc8f7c92d490d7257e6aed9170d1e34e"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Prynt Payload"

	strings:
		$c1 = /Prynt(\s)?Stealer/ ascii wide
		$x2 = "@FlatLineStealer" ascii wide
		$x3 = "@CashOutGangTalk" ascii wide
		$m1 = ".Passwords.Targets." ascii
		$m2 = ".Modules.Keylogger" ascii
		$m3 = ".Modules.Clipper" ascii
		$m4 = ".Modules.Implant" ascii
		$s1 = "--- Clipper" wide
		$s2 = "Downloading file: \"{file}\"" wide
		$s3 = "/bot{0}/getUpdates?offset={1}" wide
		$s4 = "send command to bot!" wide
		$s5 = " *Keylogger " fullword wide
		$s6 = "*Stealer" wide
		$s7 = "Bot connected" wide

	condition:
		uint16( 0 ) == 0x5a4d and 1 of ( $c* ) and ( 1 of ( $x* ) or 2 of ( $m* ) or 3 of ( $s* ) )
}