CAPE_Socks5Systemz

rule CAPE_Socks5Systemz : FILE
{
	meta:
		description = "Socks5Systemz Payload"
		author = "kevoreilly"
		id = "ef14953a-2b48-54f4-8d15-c07c7459103e"
		date = "2024-05-22"
		modified = "2025-05-23"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/Socks5Systemz.yar#L1-L19"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		logic_hash = "7e324bacd1ea57585435b6a5a4c93bda63ca146c100f2361a1c5530b87668299"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Socks5Systemz Payload"
		packed = "9b997d0de3fe83091726919a0dc653e22f8f8b20b1bb7d0b8485652e88396f29"

	strings:
		$chunk1 = {0F B6 84 8A [4] E9 [3] (00|FF)}
		$chunk2 = {0F B6 04 8D [4] E9 [3] (00|FF)}
		$chunk3 = {66 0F 6F 05 [4] E9 [3] (00|FF)}
		$chunk4 = {F0 0F B1 95 [4] E9 [3] (00|FF)}
		$chunk5 = {83 FA 04 E9 [3] (00|FF)}
		$chunk6 = {8A 04 8D [4] E9 [3] (00|FF)}
		$chunk7 = {83 C4 04 83 C4 04 E9}
		$chunk8 = {83 C2 04 87 14 24 5C E9}

	condition:
		uint16( 0 ) == 0x5A4D and 5 of them
}