Collaborate Disseminate
I would like to statically sign a malware, specifically MSIL Crypter, with a YARA rule. I want to sign specific functions (Assembly.Load for example) but I couldn’t find an informative documentation about how to disassemble a… Continue reading Disassembling a .NET manually
I have a yara rule that looks for multiple strings in a file and fires if the count is greater than 3. But how would I change the condition statement to only fire if greater than 3 but less than 5?
Essentially I want somethi… Continue reading Yara condition count operator with wildcard
I am having a little difficulty determining what the best source of malware patterns in Yara format is.
Is there a gold standard?
Continue reading What is the biggest, most reliable Yara-compatible library of malware patterns?
I’m working in a large SOC and my manager has tasked me with finding some way to provide coverage for Themida packed malware samples.
As alluring as it is to suggest just blacklisting all Themida packed software and calling … Continue reading Detecting cracked Themida packed malware
I am running a VM which has most of the .yara files in /korn/a/b/yara.
Samples are in /korn/a/samples. Whenever I run
yara -m /korn/a/b/yara/yara_rules.rules /korn/a/samples/World1.doc
I get error: could not open file: /korn… Continue reading yara unable to access .yara files (could not open file error) even though all permissions are set [on hold]
I have found a malware binary, Which i am curious to see what patterns has been found from this file. Also i have a collection of ~1000 ioc’s and yara-rule’s related to Malwares and RAT’s. I used Loki, yara-gui, The yara64 (i… Continue reading Scanning a binary against YARA rules dictionary
As has become a mainstream news story many times over, some Android phones are being shipped with malware preinstalled, because they go from factory to a second party who adds the malware and then to the US.
What is the strategy for exami… Continue reading How to find malware added in supply chain to Android phone?
Yara rules are working on Windows 7 perfectly. I am able to scan and detect malicious commands in .exe malware files but when I run the same program in debian v8.6, it can’t detect malicious commands in .exe. When I run the … Continue reading Yara rules not working in debian
First of all, I know that yara rules can be used in combination with ClamAV, but here I have something else in my mind, so my question is; how can I write logical signature simillar as it is in YARA.
Here is an example; Let’… Continue reading How can I write logical signature for ClamAV simillar as it is in YARA?
I published the following diary on isc.sans.org: “Stop relying on file extensions“. Yesterday, I found an interesting file in my spam trap. It was called ‘16509878451.XLAM’. To be honest, I was not aware of this extension and I found this on the web: “A file with the XLAM file extension is an
[The post [SANS ISC] Stop relying on file extensions has been first published on /dev/random]