Fix family name capitalisation for Rat King yara signatures (cape_type)

CAPESandbox · Oct 4, 2024 · 2bcef9d · 2bcef9d
1 parent b1f4c8a
commit 2bcef9d
Show file tree

Hide file tree

Showing 5 changed files with 5 additions and 9 deletions.
diff --git a/data/yara/CAPE/DCRat.yar b/data/yara/CAPE/DCRat.yar
@@ -69,7 +69,6 @@ rule dcrat_kingrat {
     meta:
         author = "jeFF0Falltrades"
         cape_type = "DCRat Payload"
-
     strings:
         $venom_1 = "VenomRAT" wide ascii nocase
         $venom_2 = "HVNC_REPLY_MESSAGE" wide ascii

diff --git a/data/yara/CAPE/QuasarRAT.yar b/data/yara/CAPE/QuasarRAT.yar
@@ -24,8 +24,7 @@ rule QuasarRAT {
 rule quasarrat_kingrat {
     meta:
         author = "jeFF0Falltrades"
-        cape_type = "Quasarrat Payload"
-
+        cape_type = "QuasarRAT Payload"
     strings:
         $str_quasar = "Quasar." wide ascii
         $str_hidden = "set_Hidden" wide ascii

diff --git a/data/yara/CAPE/VenomRAT.yar b/data/yara/CAPE/VenomRAT.yar
@@ -15,12 +15,10 @@ rule VenomRAT {
         uint16(0) == 0x5a4d and (1 of ($x*) and 2 of ($s*))
 }
 
-
 rule venomrat_kingrat {
     meta:
         author = "jeFF0Falltrades"
-	cape_type = "VenomRat Payload"
-
+        cape_type = "VenomRAT Payload"
     strings:
         $str_id_venomrat = "venomrat" wide ascii nocase
         $str_hvnc = "HVNC_REPLY_MESSAGE" wide ascii

diff --git a/data/yara/CAPE/XWorm.yar b/data/yara/CAPE/XWorm.yar
@@ -29,7 +29,7 @@ rule XWorm {
 rule xworm_kingrat {
     meta:
         author = "jeFF0Falltrades"
-        cape_type = "Xworm payload"
+        cape_type = "XWorm payload"
     strings:
         $str_xworm = "xworm" wide ascii nocase
         $str_xwormmm = "Xwormmm" wide ascii

diff --git a/data/yara/CAPE/Xenorat.yar b/data/yara/CAPE/Xenorat.yar
@@ -1,7 +1,7 @@
- rule xenorat {
+rule XenoRAT {
     meta:
         author = "jeFF0Falltrades"
-        cape_type = "Xenorat payload"
+        cape_type = "XenoRAT payload"
     strings:
         $str_xeno_rat_1 = "xeno rat" wide ascii nocase
         $str_xeno_rat_2 = "xeno_rat" wide ascii nocase