RULE MALWARE ANALYSIS

YARA

YARA란?

virustotal에서 만든 악성코드의 패턴을 이용해 특성과 행위를 기준으로 악성코드를 분류하는 도구이다.

YARA_OFFSEC : https://www.kali.org/tools/yara/
YARA_GITHUB : https://github.com/virustotal/yara

사용법

yara는 3개의 부분으로 나뉜다. meta, stirngs, conditions 3가지의 영역은 각 역할을 기반으로 나뉩니다.

rule rule_name
{
	meta:
		author = ""
		type = ""
		filetype = ""
		version = ""
		date = ""
		description = ""
 
	strings:
		$str = ""
		$hex = {}
		$re = 
	
	conditions:
		all of them
}

strings

악성코드의 특정 문자열, hex 값을 변수화 하는 공간입니다. 주로 정규 표현식, 특정 문자, signature hex값을 저장하는데 사용합니다.

conditions

yara 명령어 정리

root@kali:~# yara -h
YARA 4.5.6, the pattern matching swiss army knife.
Usage: yara [OPTION]... [NAMESPACE:]RULES_FILE... FILE | DIR | PID
 
Mandatory arguments to long options are mandatory for short options too.
 
       --atom-quality-table=FILE           path to a file with the atom quality table
  -C,  --compiled-rules                    load compiled rules
  -c,  --count                             print only number of matches
  -E,  --strict-escape                     warn on unknown escape sequences
  -d,  --define=VAR=VALUE                  define external variable
  -q,  --disable-console-logs              disable printing console log messages
       --fail-on-warnings                  fail on warnings
  -f,  --fast-scan                         fast matching mode
  -h,  --help                              show this help and exit
  -i,  --identifier=IDENTIFIER             print only rules named IDENTIFIER
       --max-process-memory-chunk=NUMBER   set maximum chunk size while reading process memory (default=1073741824)
  -l,  --max-rules=NUMBER                  abort scanning after matching a NUMBER of rules
       --max-strings-per-rule=NUMBER       set maximum number of strings per rule (default=10000)
  -x,  --module-data=MODULE=FILE           pass FILE's content as extra data to MODULE
  -n,  --negate                            print only not satisfied rules (negate)
  -N,  --no-follow-symlinks                do not follow symlinks when scanning
  -w,  --no-warnings                       disable warnings
  -m,  --print-meta                        print metadata
  -D,  --print-module-data                 print module data
  -M,  --module-names                      show module names
  -e,  --print-namespace                   print rules' namespace
  -S,  --print-stats                       print rules' statistics
  -s,  --print-strings                     print matching strings
  -L,  --print-string-length               print length of matched strings
  -X,  --print-xor-key                     print xor key and plaintext of matched strings
  -g,  --print-tags                        print tags
  -r,  --recursive                         recursively search directories
       --scan-list                         scan files listed in FILE, one per line
  -z,  --skip-larger=NUMBER                skip files larger than the given size when scanning a directory
  -k,  --stack-size=SLOTS                  set maximum stack size (default=16384)
  -t,  --tag=TAG                           print only rules tagged as TAG
  -p,  --threads=NUMBER                    use the specified NUMBER of threads to scan a directory
  -a,  --timeout=SECONDS                   abort scanning after the given number of SECONDS
  -v,  --version                           show version information
 
Send bug reports and suggestions to: vmalvarez@virustotal.com.

yarac 명령어 정리

yarac는 yara 컴파일러이다.

Haeyul Blog

Explorer

14. RULE WRITING & REPORT PUBLISHING