CAPE_Vipkeylogger

rule CAPE_Vipkeylogger : FILE
{
	meta:
		description = "Detects VIPKeyLogger Keylogger"
		author = "kevoreilly"
		id = "71606fcc-89b4-519a-833a-b6cb4b569cb8"
		date = "2025-09-11"
		modified = "2025-09-11"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/data/yara/CAPE/VIPKeyLogger.yar#L1-L14"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/6b15e76f28cd83fd1187da6c9aaaad2174255356/LICENSE"
		logic_hash = "b9dba7562bba4807c0789692d44650996e62c8d0c4031dedd65773877621b1de"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "VIPKeyLogger Payload"
		packed = "edaba79c3d43a416a86003f336d879ed3a513aa24dd401340584615647ed6da2"

	strings:
		$s1 = "/ VIP Recovery \\" wide
		$s2 = "Clipboard Logs ID" wide
		$s3 = "Keylogger" wide

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}