From af1d33856c610462fedcec78e0e96fb18270495d Mon Sep 17 00:00:00 2001 From: doomedraven Date: Wed, 14 Jan 2026 14:04:18 +0100 Subject: [PATCH 1/3] Update AgentTesla rule metadata and strings --- data/yara/CAPE/AgentTesla.yar | 68 ++++++++++++++++++----------------- 1 file changed, 35 insertions(+), 33 deletions(-) diff --git a/data/yara/CAPE/AgentTesla.yar b/data/yara/CAPE/AgentTesla.yar index 0410093a7e9..d558a6e924f 100644 --- a/data/yara/CAPE/AgentTesla.yar +++ b/data/yara/CAPE/AgentTesla.yar @@ -68,46 +68,48 @@ rule AgentTeslaV2 { rule AgentTeslaV3 { meta: - author = "ditekshen" - description = "AgentTeslaV3 infostealer payload" - cape_type = "AgentTesla payload" + author = "ditekshen (cleaned by Gemini)" + description = "AgentTeslaV3 infostealer payload" + cape_type = "AgentTesla payload" strings: - $s1 = "get_kbok" fullword ascii - $s2 = "get_CHoo" fullword ascii - $s3 = "set_passwordIsSet" fullword ascii - $s4 = "get_enableLog" fullword ascii - $s5 = "bot%telegramapi%" wide - $s6 = "KillTorProcess" fullword ascii - $s7 = "GetMozilla" ascii - $s8 = "torbrowser" wide - $s9 = "%chatid%" wide - $s10 = "logins" fullword wide - $s11 = "credential" fullword wide - $s12 = "AccountConfiguration+" wide - $s13 = ".+?)\\1[^>]*>" fullword wide - $s14 = "set_Lenght" fullword ascii - $s15 = "get_Keys" fullword ascii - $s16 = "set_AllowAutoRedirect" fullword ascii - $s17 = "set_wtqQe" fullword ascii - $s18 = "set_UseShellExecute" fullword ascii - $s19 = "set_IsBodyHtml" fullword ascii - $s20 = "set_FElvMn" fullword ascii - $s21 = "set_RedirectStandardOutput" fullword ascii - - $g1 = "get_Clipboard" fullword ascii - $g2 = "get_Keyboard" fullword ascii - $g3 = "get_Password" fullword ascii - $g4 = "get_CtrlKeyDown" fullword ascii - $g5 = "get_ShiftKeyDown" fullword ascii - $g6 = "get_AltKeyDown" fullword ascii - + // --- High Fidelity Indicators (Malware Specific) --- + $s_specific1 = "get_kbok" fullword ascii + $s_specific2 = "get_CHoo" fullword ascii + $s_specific3 = "KillTorProcess" fullword ascii + $s_specific4 = "GetMozilla" ascii + $s_specific5 = "torbrowser" wide + $s_specific6 = "bot%telegramapi%" wide + $s_specific7 = "%chatid%" wide + + // Known AgentTesla Typo (High Confidence) + $s_typo = "set_Lenght" fullword ascii + + // --- Config / Stack Strings (Unique data structures) --- $m1 = "yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.htmlLogtext/html[]Time" ascii $m2 = "%image/jpg:Zone.Identifier\\tmpG.tmp%urlkey%-f \\Data\\Tor\\torrcp=%PostURL%127.0.0.1POST+%2B" ascii $m3 = ">{CTRL}Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\\WScript.ShellRegReadg401" ascii $m4 = "%startupfolder%\\%insfolder%\\%insname%/\\%insfolder%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%insregname%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\RunTruehttp" ascii $m5 = "\\WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera" ascii + + // --- Generic Functions (Require other indicators to match) --- + // These are legitimate on their own, but suspicious in context + $s_generic1 = "set_UseShellExecute" fullword ascii + $s_generic2 = "set_IsBodyHtml" fullword ascii + $s_generic3 = "set_AllowAutoRedirect" fullword ascii + $s_generic4 = "set_RedirectStandardOutput" fullword ascii + condition: - (uint16(0) == 0x5a4d and (8 of ($s*) or (6 of ($s*) and 4 of ($g*)))) or (2 of ($m*)) + uint16(0) == 0x5a4d and + ( + // 1. Strongest: Match any of the unique config blobs + 2 of ($m*) or + + // 2. Strong: Match specific malware function names + 5 of ($s_specific*) or + + // 3. Combined: The Typo + Generic email/process functions + ($s_typo and 4 of ($s_generic*)) + ) } rule AgentTeslaV4 From 322be7a7262622db14804df0a0068cffce398f05 Mon Sep 17 00:00:00 2001 From: doomedraven Date: Wed, 14 Jan 2026 14:04:48 +0100 Subject: [PATCH 2/3] Update author in AgentTesla rule metadata --- data/yara/CAPE/AgentTesla.yar | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/yara/CAPE/AgentTesla.yar b/data/yara/CAPE/AgentTesla.yar index d558a6e924f..0c50be15def 100644 --- a/data/yara/CAPE/AgentTesla.yar +++ b/data/yara/CAPE/AgentTesla.yar @@ -68,7 +68,7 @@ rule AgentTeslaV2 { rule AgentTeslaV3 { meta: - author = "ditekshen (cleaned by Gemini)" + author = "ditekshen" description = "AgentTeslaV3 infostealer payload" cape_type = "AgentTesla payload" strings: From f18bae3e3cb1980c1ab05dca34c3880421f9f7a2 Mon Sep 17 00:00:00 2001 From: doomedraven Date: Wed, 14 Jan 2026 14:33:07 +0100 Subject: [PATCH 3/3] Enhance AgentTesla rule conditions Refactor condition logic to include additional checks for malware detection. --- data/yara/CAPE/AgentTesla.yar | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/data/yara/CAPE/AgentTesla.yar b/data/yara/CAPE/AgentTesla.yar index 0c50be15def..fbd01ade42b 100644 --- a/data/yara/CAPE/AgentTesla.yar +++ b/data/yara/CAPE/AgentTesla.yar @@ -99,16 +99,18 @@ rule AgentTeslaV3 { $s_generic4 = "set_RedirectStandardOutput" fullword ascii condition: - uint16(0) == 0x5a4d and ( // 1. Strongest: Match any of the unique config blobs - 2 of ($m*) or - - // 2. Strong: Match specific malware function names - 5 of ($s_specific*) or - - // 3. Combined: The Typo + Generic email/process functions - ($s_typo and 4 of ($s_generic*)) + 2 of ($m*) + ) or ( + uint16(0) == 0x5a4d and + ( + // 2. Strong: Match specific malware function names + 5 of ($s_specific*) or + + // 3. Combined: The Typo + Generic email/process functions + ($s_typo and 4 of ($s_generic*)) + ) ) }