Learning Malware Analysis

Let's take another example of the sample that was previously used in Section 6.5, Examining PE resources. The sample (5340.exe) stored a decoy excel document in its resource section; some malware programs store a decoy document to present it to the user upon execution. The following YARA rule detects an executable file containing an embedded Microsoft Office document in it. The rule will trigger if the hex string is found at an offset greater than 1024 bytes in the file (this skips the PE header), and the filesize specifies the end of the file:

rule embedded_office_document
{
meta:
description = "Detects embedded office document"

strings:
    $mz = { 4D 5A }
    $a = { D0 CF 11 E0 A1 B1 1A E1 }
condition:
    ($mz at 0) and $a in (1024..filesize)
}

Running the preceding yara rule detected only the sample that contained the embedded excel document:

$ yara -r embedded_doc.yara samples/
embedded_office_document samples//5340.exe

The following example detects a malware sample called 9002 RAT using the serial number of its digital certificate. RAT 9002 used a digital certificate with a serial number 45 6E 96 7A 81 5A A5 CB B9 9F B8 6A CA 8F 7F 69 (https://blog.cylance.com/another-9002-trojan-variant). The serial number can be used as a signature to detect samples that have the same digital certificate:

rule mal_digital_cert_9002_rat
{
meta:
    description = "Detects malicious digital certificates used by RAT 9002"
    ref = "http://blog.cylance.com/another-9002-trojan-variant"

strings:
    $mz = { 4D 5A }
    $a = { 45 6e 96 7a 81 5a a5 cb b9 9f b8 6a ca 8f 7f 69 }

condition:
    ($mz at 0) and ($a in (1024..filesize))
}

Running the rule detected all samples with the same digital certificate, and all of these samples turned out to be RAT 9002 samples:

$ yara -r digi_cert_9002.yara samples/
mal_digital_cert_9002_rat samples//ry.dll
mal_digital_cert_9002_rat samples//rat9002/Mshype.dll
mal_digital_cert_9002_rat samples//rat9002/bmp1f.exe

YARA rules can also be used to detect packers. In Section 5, Determining file obfuscation, we looked at how to detect packers using the Exeinfo PE tool. Exeinfo PE uses signatures stored in a plain text file called userdb.txt. The following is an example signature format used by Exeinfo PE to detect the UPX packer:

[UPX 2.90 (LZMA)]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB
ep_only = true

The ep_only=true in the preceding signature means that Exeinfo PE should only check for the signature at the program's address of the entry point (which is where the code starts executing). The preceding signature can be converted to a YARA rule. The new versions of YARA support the PE module, which allows you to create rules for PE files by using attributes and features of the PE file format. If you are using newer versions of YARA, the Exeinfo PE signature can be translated to a YARA rule as shown here:

import "pe"
rule UPX_290_LZMA
{
meta:
    description = "Detects UPX packer 2.90"
    ref = "userdb.txt file from the Exeinfo PE"

strings:
    $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }

condition:
    $a at pe.entry_point
}

If you are using older versions of YARA (which do not have support for the PE module), then use the following rule:

rule UPX_290_LZMA
{
meta:
    description = "Detects UPX packer 2.90"
    ref = "userdb.txt file from the Exeinfo PE"

strings:
    $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }

condition:
    $a at entrypoint
}

Now, running a yara rule on the samples directory detected the samples that were packed with UPX:

$ yara upx_test_new.yara samples/
UPX_290_LZMA samples//olib.exe
UPX_290_LZMA samples//spybot_packed.exe

Using the preceding method, all the packer signatures in Exeinfo PE's userdb.txt can be converted to YARA rules.

PEiD is another tool that detects packers (this tool is no longer supported); it stores the signature in a text file, UserDB.txt. Python scripts peid_to_yara.py written by Matthew Richard (part of Malware Analyst's Cookbook) and Didier Steven's peid-userdb-to-yara-rules.py (https://github.com/DidierStevens/DidierStevensSuite/blob/master/peid-userdb-to-yara-rules.py) convert UserDB.txt signatures to YARA rules.

YARA can be used to detect patterns in any file. The following YARA rule detects communication of different variants of the Gh0stRAT malware:

rule Gh0stRat_communications
{
meta:
Description = "Detects the Gh0stRat communication in Packet Captures"

strings:
$gst1 = {47 68 30 73 74 ?? ?? 00 00 ?? ?? 00 00 78 9c}
$gst2 = {63 62 31 73 74 ?? ?? 00 00 ?? ?? 00 00 78 9c}
$gst3 = {30 30 30 30 30 30 30 30 ?? ?? 00 00 ?? ?? 00 00 78 9c}
$gst4 = {45 79 65 73 32 ?? ?? 00 00 ?? ?? 00 00 78 9c}
$gst5 = {48 45 41 52 54 ?? ?? 00 00 ?? ?? 00 00 78 9c}
$any_variant = /.{5,16}\x00\x00..\x00\x00\x78\x9c/

condition:
any of ($gst*) or ($any_variant)
}

Running the preceding rule on a directory containing network packet captures (pcaps), detecting the GhostRAT pattern in some of the pcaps as shown here:

$ yara ghost_communications.yara pcaps/
Gh0stRat_communications pcaps//Gh0st.pcap
Gh0stRat_communications pcaps//cb1st.pcap
Gh0stRat_communications pcaps//HEART.pcap

After you analyze the malware, you can create signatures to identify its components; the following code shows an example YARA rule to detect the driver and the DLL components of Darkmegi Rootkit:

rule Darkmegi_Rootkit
{
meta:
Description = "Detects the kernel mode Driver and Dll component of Darkmegi/waltrodock rootkit"

strings:
$drv_str1 = "com32.dll"
$drv_str2 = /H:\\RKTDOW~1\\RKTDRI~1\\RKTDRI~1\\objfre\\i386\\RktDriver.pdb/
$dll_str1 = "RktLibrary.dll"
$dll_str2 = /\\\\.\\NpcDark/
$dll_str3 = "RktDownload"
$dll_str4 = "VersionKey.ini"

condition:
(all of them) or (any of ($drv_str*)) or (any of ($dll_str*))
}

The preceding rule was created after analyzing a single sample of Darkmegi; however, running the preceding rule on a directory containing malware samples detected all the Darkmegi rootkit samples matching the pattern:

$ yara darkmegi.yara samples/
Darkmegi_Rootkit samples//63713B0ED6E9153571EB5AEAC1FBB7A2
Darkmegi_Rootkit samples//E7AB13A24081BFFA21272F69FFD32DBF-
Darkmegi_Rootkit samples//0FC4C5E7CD4D6F76327D2F67E82107B2
Darkmegi_Rootkit samples//B9632E610F9C91031F227821544775FA
Darkmegi_Rootkit samples//802D47E7C656A6E8F4EA72A6FECD95CF
Darkmegi_Rootkit samples//E7AB13A24081BFFA21272F69FFD32DBF
[......................REMOVED..............................]

YARA is a powerful tool; creating YARA rules to scan a repository of known samples can identify and classify samples having same characteristics.

The strings that you use in the rule might create false positives. It is a good idea to test your signatures against known good files and also to think of situations that might trigger false positives. To write sound YARA rules, read https://www.bsk-consulting.de/2015/02/16/write-simple-sound-yara-rules/. For generating YARA rules, you might consider using Florian Roth's yarGen (https://github.com/Neo23x0/yarGen) or Joe Security's YARA rule generator (https://www.yara-generator.net/).

Table of Contents for
Learning Malware Analysis

7.4.4 Applications of YARA

Table of Contents for Learning Malware Analysis

Table of Contents for
Learning Malware Analysis