From b83a3fbfd3be1fae5608e1838906fa204dbc9b63 Mon Sep 17 00:00:00 2001
From: Kevin O'Reilly <kevoreilly@gmail.com>
Date: Tue, 28 Jul 2026 17:59:13 +0100
Subject: [PATCH] PhantomStealer yara

---
 data/yara/CAPE/PhantomStealer.yar | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 data/yara/CAPE/PhantomStealer.yar

diff --git a/data/yara/CAPE/PhantomStealer.yar b/data/yara/CAPE/PhantomStealer.yar
new file mode 100644
index 00000000000..3c2dbdba54c
--- /dev/null
+++ b/data/yara/CAPE/PhantomStealer.yar
@@ -0,0 +1,13 @@
+rule PhantomStealer
+{
+    meta:
+        author = "kevoreilly"
+        description = "PhantomStealer Payload"
+        cape_type = "PhantomStealer Payload"
+    strings:
+        $a1 = "PhantomStealer"
+        $a2 = "FormatCreditCards"
+        $a3 = "Telegram"
+    condition:
+        uint16(0) == 0x5A4D and (all of ($a*))
+}