CAPE_Stxrat

rule CAPE_Stxrat : FILE
{
	meta:
		description = "No description has been set in the source file - CAPE"
		author = "YungBinary"
		id = "9ce51412-52ce-5682-802d-fad96c053c30"
		date = "2026-04-11"
		modified = "2026-04-14"
		reference = "https://www.esentire.com/blog/stx-rat-a-new-rat-in-2026-with-infostealer-capabilities"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/STXRat.yar#L49-L120"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		logic_hash = "f82b832e6bf936ff936332c059b1d3b981ce387bf82964ecf64a9cb12cda955d"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "STXRat Payload"

	strings:
		$s1 = {
            8D 51 BF
            83 FA 19
            8D 41 20
            0F 47 C1
            C2 
        }
		$s2 = {
            48 8D 05 ?? ?? ?? ??
            66 C7 45 ?? 48 B8 [0-6]
            48 89 45 ??
            48 8D 55 ??
            66 C7 45 ?? FF E0
        }
		$s3 = {
            65 48 8B 04 25 60 00 00 00
            80 78 02 01
        }
		$s4 = "Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)" ascii
		$s5 = {
            B9 10 66 00 00 [0-3]
            0F 44 C1
            B9 0F 66 00 00
            41 81 ?? C0 00 00 00
            0F 44 C1
            B9 0E 66 00 00
        }
		$s6 = {
            48 83 FB 5A
            73 ??
            88 84 1C ?? ?? ?? ??
            48 FF C3
            48 FF C1
            8A 01
            84 C0
            75
        }
		$s7 = {
            83 61 18 00
            83 61 14 00
            C7 01 01 23 45 67
            C7 41 04 89 AB CD EF
            C7 41 08 FE DC BA 98
            C7 41 0C 76 54 32 10
            C7 41 10 F0 E1 D2 C3
            C3
        }
		$s8 = {
            80 61 1F 3F
            80 49 1F 40
            80 21 F8
        }

	condition:
		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) )
}