hey guys welcome back to the malware
analysis bootcamp in this video we're
going to be talking about
yara rules and how to use them how to
create your very own rules so we'll be
taking a look at that shortly
right so let's start by understanding
what yara rules are and how we can use
them right
for identification signature based
identification right so
yara rules are used to identify samples
based on specific strings or binary data
now if you remember in my previous video
we talked about
how attackers or malwa authors will
usually
include or remove particular pieces of
data
or strings you know they'll add or
remove strings to the malware sample and
this
in turn changes the cryptographic hash
right now
that is a very simple thing that they do
and it really does not affect the
functionality which is why
error rules can be uh can be very very
powerful in the sense that
if your if the attacker preserves the
functionality
then we can bet that a lot of the
content will remain the same and we can
use
various yara rules however specific they
are
for future detection right so i'll show
you this in a second and this is what
anti-virus companies use or this this is
primarily what they do is they generate
various rules that of course are then
used to uh
you know for signature based
identification right
so this is the structure of aera rule
now i will be leaving the yara
documentation
in the description section because yara
is a very extensive tool that
we'll be covering but i will be covering
in stages so right now
would be we as we're simply focusing on
it you know from a static analysis
perspective right
but we'll be taking a look at it as we
move along so if you want to
get a head start you can check it out
for yourself right so
the structure of a yara rule or the
syntax is as follows you have the rule
right which is your um you have your
rule and then you have your rule name
you then have your meta which is not
really required which then gives you a
description of
the uh of the of the url rule so you can
again add information
in regards to its functionality you then
have strings right so strings
uh which again you're specifying can
either be hexadecimal or strings
themselves
um or rejects if you want and again this
will all make sense
in a second and of course you can you
provide these variables
or you specify them with the the dollar
sign and then the name of the variables
right so very very simple stuff here
and then finally you have the the logic
which is where you have your condition
here so your conditions can be used to
again
give you results that you're looking for
so in this case
uh we want um we want yara to print out
the the the we want er to print out an
output
uh in the event that a or b is present
right now this could be strings or
hexadecimal and i'll show you how to
specify them both
right so i'll be seeing you uh in the
virtual machine where we can get started
all right guys welcome back to flair vm
where we can actually get started
creating our very own
yara rules right so we're going to be
using the same sample we've been using
throughout the static analysis section
which is the credential harvester or the
password stealer
and we have it right over here right so
what we are going to do for the purpose
of this video is we are going to create
a yara rule
that detects the various urls or
identifies a piece of malware based on
those particular urls that it connects
to
which we already took a look at it
connects to three
russian uh command and control centers
or urls that are quite interesting
and we'll be using that to classify this
piece of malware and also to identify it
and you'll see how this works in a
second
right so if we drag the unpacked sample
into pe studio right and we took a look
at this when
uh when we were exploring uh these
strings right so
we'll just wait for this to load up and
hopefully does that really quickly
because
this is not the most important bit right
here
so we'll just wait for this to complete
uh you can also take a look at the
indicators uh whatever you want to use
for your rules you can use it um so if
we if we just take a look at this one
right over here so we have three urls
that it connects to which
again we can sort of uh we can we can
guess as to
as to what their functionality is but
we're going to assume that these are the
command and control centers
uh you know through which the this piece
of malware is being controlled or where
it's sending all the credentials back to
so
we're going to be using these three urls
as a
sort of the means of classifying or
identifying this malware
right so what we're going to do is let's
create our our first yara rule so
to do this uh let's open up notepad plus
plus right so it's very very simple you
can also use notepad or any
other ide that you want to use so as i
said
the syntax is very simple we specify the
rule we say
rule and then the rule name so we're
just going to give it a generic name
like
creds underscore ru you can use the
underscore
if you want and you can also use numbers
however the
the name of the rule uh cannot be
started
with a number right so we then open up
our curly braces here
and we'll just open it up like so we'll
also add a meta section here
uh yeah we'll add a meta section let's
do it right now and we'll say the
description of this
is going to be uh we'll say this is
going to be a simple
yara rule to
detect um let's see detect russian
and credential uh harvesters
all right so very very simple rule it
doesn't have anything to do with the
actual
uh the actual functionality we're simply
just describing it
so that we can eventually understand
what this rule does if we ever want to
look back at it right
so the next thing we need to do is we
need to specify these strings right so
these strings again
are declared and you can use variables
to declare the various strings you're
looking for
so let's start off with we will have
three strings and they'll be
denoted by a b and c and then of course
i'll show you
the other various ways of creating these
variables and you can define the
the strings in in the form of either you
know using strings or hexadecimal
so we'll say a is going to be equal to
and we'll need to specify the first url
so we'll go back into the strings here
and we'll copy the value and we'll say
we want
you to check for this url uh secondly
again we want you to check for the next
url so we'll just get the second one
again sorry let me just switch back here
copy the value and we'll paste that back
in there
and again we're using quotation marks
around this
and then we're going to specify the last
one
right over here and we'll just copy the
value there
and we'll paste it in here and there we
are so those are
are our three strings uh that will be
we want yara to look out for in any of
these samples we use
or that in any of the samples we want to
we actually want to identify or classify
based on these particular strings right
so let's say we find a
malware sample out on the internet and
we want to see if it's related
to this particular malware sample based
on these three strings or urls we can
then use this yara rule
to scan against it right so again as i
said this is what antivirus companies
use
and um you know for signature based
detection so
now let's talk about the condition or
the logic here
all right so the the condition of the
logic is very very simple to understand
of course
you have your conditional operators you
have and or not
right and we can create a very simple
condition here by saying
uh we want to detect uh if all or any of
these urls are being found so that we
can understand we can
sort of build a picture or get an idea
of uh you know
whether they belong to the same fan
whether they belong to the same family
etc are they russian etc
right so we'll say we want a or
it can be either a or b or c right so a
or b or c and we will just close this up
and that should be it right so now when
you're saving your
your your particular yara rule you want
to save it
as a yara file right so we'll go to my
desktop here
i'll just save this on my desktop and
we'll call this
uh we'll just call it creds.yara
right so you need to specify the yara
extension and i'm going to save
all right so now that we have the error
rule uh saved here and we've created it
we
we now need to open up a command prompt
now i'm using flare vm
by default uh flare comes with yara uh
32-bit installed and to use it again
we specify yara 32 and then the help
menu which will bring up right over here
and this gives us
the various options so uh we can print
these strings which is we
which is what we want to do and we also
want a recursive scan
or a fast scan if you want but i
recommend a recursive scan
so what we're going to do is we are
going to scan our particular sample
uh we're going to use this url to scan
that particular sample and we're going
to see if it
if it actually is able to detect any
particular likeness right so
whether we're able to identify this
particular sample and of course it's
going to give us the results we're
looking for
because it's the same sample that we've
got these particular strings from so
i'm just using this as a basic example
right so
uh what we'll do is we will say uh yara
we'll say yara
and we of course want to print the
string so we'll say s
and r that is recursive and then we need
to specify the um
the error file or the yara rule that we
want to use which we're going to say
it's going to be creds.yara
we then hit the sample and we're going
to use the unpacked sample of course and
we're going to drag it in here
and we're going to hit enter and yep
sorry we need to use yara 32
sorry about that we we are not on linux
here uh so we're going to say yara
uh error 32 and i'm going to hit enter
and immediately it's going to tell you
where these
uh these particular urls are so it's
detected that these urls do exist
right now you might be saying well how
do i know this is true and you know it's
just not scanning it based on the sample
without that particular rule so if we
edit this rule and i just say
uh let me just change c to some random
text like this and just say
save and i'm gonna run this one more
time and hit enter
you can see that it now only detects the
two right so that means our yara rule is
working
so i'll just get rid of this and and now
let's talk about
adding a hexadecimal uh variable here or
a value that we're looking for so when
uh when
when actually looking for hexadecimal uh
strings
or data here we're trying to identify
based on those
on hexadecimal data we can say let's
just say we're looking for the mz header
right
and we'll go back here well let's
actually drag this sample
into the hex editor there we are so
let's load it up into the x editor so
let's say we want to identify this piece
of malware based on
the hex 4d5a which again is mz right
over here so again that's a very basic
identification it can be used to
identify pe
pes uh ppe files or portable executables
we'll copy this
now when we're doing this we do not use
the quotation marks we'll just call this
variable
mz and we will now use the curly braces
put that i put these values in here
and we will hit save right so ctrl s and
we can run this one more time
and yeah sorry if we forgot to include
the condition here so we can say
a or b or c uh and it has to be
a we can say and it has to be a mz it
it has to be a portable executable or
has to have the mz
header right uh or mz yeah the empty
header so
we're gonna say save or mz here hit save
and we're going to run this one more
time and i'm going to hit enter and
there we are it gives us
immediately so again the first two bytes
and again you get the
various offsets where you can actually
locate these particular urls
so you can actually locate them now
again as i said
uh this is a is a great rule it's a very
basic rule that we've created and its
job is to classify this malware
now you can use any other strings or any
other hexadecimal
data or binary data that you want to use
to classify this malware right so this
is very basic so
again i can go back into pe studio and
look for other strings that are related
to this particular
to this particular malware sample so for
example i can use this post
this post request here so i can copy the
value and
we can again create another we can
create another
variable here and i'm going to say uh
we'll just call it post
right and we'll sorry
they copy the actual value here uh yeah
sorry that is post
and i'm gonna hit save
and hit enter and there we are so again
we get where all
the various uh where we get the various
offsets where we have http
again so you get the offsets right over
here so you can actually
look for them or identify them and
that's just a simple uh simple example
of how you can
create your very own url rules for
identification and classification
right so that is going to be it for this
video this is a very basic video
covering a malware classification and
identification as i said we'll be going
through yara a lot more as we move along
so uh yeah that's pretty much it for
this video and i'll be seeing you in the
next video