YARA

What is Yara? A pattern matching swiss knife for malware researchers

Yara is an open-source powerful tool that helps malware researchers in identifying and categorizing malware samples. It enables users to generate profiles of malware families or any desired description using textual or binary patterns. Each profile, referred to as a rule, comprises a collection of strings and a boolean expression that defines its logic.

Yara Template:

rule (Rulename)
{
meta:
     author = "Threat Researcher"
     date = "2024/04/14"
     category = "Malware"
     threat_level = 1
     in_the_wild = true
     description = "Yara rule to detect (Campaign Name)"

strings:
     $a = ""
     $b = ""
     $c = ""
     $d = ""

condition:
     ($a and $b and $c and $d)
}

How to install Yara on Windows Platform?

Numerous third-party tools are accessible in the wild. This blog will demonstrate the utilization of Chocolatey with simple installation steps.

What is Chocolatey?

Chocolatey is an open-source package manager designed for Windows, operating akin to Apt or DNF in Linux environments. This tool installs software via the Windows command line, handles program downloads and installations, and automatically updates installed software as needed.

Choco presents a unique software management approach, allowing users to craft deployment packages using PowerShell and deploy them through various Windows utilities.

Using Powershell:

Set-ExecutionPolicy AllSigned
Set-ExecutionPolicy Bypass -Scope Process
Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) 
choco -v

Using cmd:

@"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command " [System.Net.ServicePointManager]::SecurityProtocol = 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))" && SET "PATH=%PATH%;%ALLUSERSPROFILE%\chocolatey\bin"
Choco -v

Sample Outputs:

After installing Yara, you can create a Yara rule based on the sample you possess. Below is a basic Yara Rule for the One-note campaign:

rule Onenote_Malware
{
meta:
     author = "Threat Researcher"
     category = "Malware"
     description = "Yara rule to detect Qakbot onenote files"

strings:
     $a = "RUn"
     $b = "This document contains attachments from the cloud, to receive them,"
     $c = "OneNote"
     $d = "C:\\Users\\Public\\1.cmd&&start"
     $e = ".ocxxxx"

condition:
     ($a and $b and $c and $d)
}

Syntax:

yara64 <Yara file Path> <Sample file Path>

Conclusion:

In summary, Yara is a helpful tool for malware researchers. It helps them find and sort malware samples using rules they can customize. With Yara, users can create profiles based on text or binary patterns to spot different kinds of malware. By using Yara's features to make rules with specific words and logic, researchers can better find and deal with new cyber threats.

Happy Learning !!!