<aside> 🎯

YARA Rule [Definition] → set of conditions used to identify malware or other suspicious files based on patterns like unique strings, file structures, or behavior indicators. IE: a recipe that tells your computer what to look for in potentially dangerous files.

</aside>

<aside>

High-Level Summary

</aside>

This portion outlines the creation and testing of a custom YARA rule to detect a specific malware sample. Using tools like PEStudio and Ghidra, unique strings and behavioral indicators were identified like hardcoded filenames which ensures accurate detection and minimizing false positives. These indicators were used to construct a YARA rule, written in Notepad++, and structured with metadata, string definitions, and logical conditions. The rule was then tested using PowerShell to confirm it successfully detects the malware, demonstrating how static analysis and rule-based detection can be used to automate threat identification across systems.

<aside> ✏️

Definitions

</aside>

• False Positives → When your rule mistakenly flags a harmless file as malicious. You want to reduce these by choosing unique, rare indicators.

• Notepad++

• Ghidra

• PowerShell

<aside>

Tools Used in Analysis

</aside>

<aside>

Analysis Reviewed

</aside>

• String - “brbconfig.tmp” → C2 URL, user agent that show malware functionality providing the config file, and or what it reads or network headers it uses

<aside> 📂

YARA Rule Properties

</aside>

1. Header – Rule name and any tags.
2. Meta – Info like who wrote it, why, or when.
3. Strings – Specific indicators to match (e.g., "brbconfig.tmp").
4. Condition – The logic that decides if the rule matches. This might check if all strings appear, only one, or in specific locations.

<aside> ⚒️

Creating Detections with YARA Rules

</aside>

YARA Rules are great ways to detect malware samples on files. Similar to recipes, YARA rules can act as commands and recipes mixes to find specific types of malware. As they can describe the characteristics of malware families, which allow us to identify malicious files in an automated fashion.

Firstly, using pe-studio, we will identify the unique strings to detect specific malware samples. Example of this include: “brbconfig.tmp” or “This program cannot be run in DOS mode.” These examples were chosen to reduce false positives, to ensure the rule doesn’t match with benign files with common strings.

• "brbconfig.tmp" is a likely C2-related string.

Figure #1: Identifying unique strings using pe-studio: “This program cannot be run in DOS mode.”

Figure #2: Using pe-studio to identify another unique string: “brbconfig.tmp”

<aside> 🗒️

Writing a YARA Rule Using NotePad++

</aside>

With our target strings now identified, we can begin writing our first YARA rule. A standard YARA rule consists of four main components: the rule header, which defines the rule’s name and optional scope; the meta section, which includes descriptive information such as the author, purpose, or creation date; the strings section, which lists the specific indicators or patterns to detect (such as file names, commands, or encoded values); and finally, the condition section, which defines the logic that determines when the rule should match. This condition can specify whether all strings must be present, just one, or a combination, and may include additional logic such as file size, offsets, or match counts. These sections allow for flexible and precise detection of malicious files.

Figure #3: The composed YARA rule including all information related to which strings will be reviewed, the meta data related to the author composing the rule (in this case, me), and conditions defining the logic of the rules

Another approach is including the uint16(0) == 0x5A4D portion in the condition to not include irrelevant file types which can improve accuracy and speed.