Project 12: Yara (10 pts + 30 pts extra)

What You Need for This Project

Purpose

To practice using Yara.

Install Visual C++ Redistributable

In a Web browser, go to

https://www.microsoft.com/en-us/download/details.aspx?id=52685

Click the red Download button.

Check the box next to vc_redist.x64.exe and click the Next button.

Double-click the file and install the software.

Install Yara

On your Windows machine, in a Web browser, go to

https://yara.readthedocs.io/en/v3.6.0/gettingstarted.html#installing-on-windows

Click the "Download Windows binaries" link.

Click the appropriate version for your OS. If you are using Windows Server 2016, it's the 64-bit version, on the right side of the image below.

Two files appear, as shown below. On the right side, click Download, "Direct Download". Save the file in your Downloads folder.

Open File Explorer and navigate to your Downloads folder. Right-click the yara file and click "Extract All", Extract.

A folder appears containing the two files, as shown below.

Preparing a Working Folder

On your Windows desktop, click Start and type CMD

Right-click "Command Prompt" and click "Run as Administrator".

In the Administrator Command Prompt window, execute this command. If you are not logged in as "administrator", you will need to change the path to refer to your actual Downloads folder. 

dir c:\users\administrator\downloads\
Find the folder containing the unzipped yara files, as shown below.

In the Administrator Command Prompt window, execute these commands. You may need to change the folder name to match the correct folder on your system. 

mkdir c:\yara
copy c:\users\administrator\downloads\yara-3.8.1-win64\yara*.* c:\yara
The files are copied, as shown below.

Writing a Yara Rule

In the Administrator Command Prompt window, execute these commands. 
cd c:\yara
notepad test.yar
A Notepad box pops up, asking "Do you want to create a new file?". Click Yes.

In Notepad, enter this text, as shown below. 

rule ExampleRule
{
    strings:
        $my_text_string = "EVIL"

    condition:
        $my_text_string
}
The rule is shown below. This rule looks for the string "EVIL" in a file.

In Notepad, click File, Save.

Close the Notepad window.

Creating Test Files

In the Administrator Command Prompt window, execute these commands. 
mkdir test
echo "GOOD" > test\goodfile.txt
echo "EVIL" > test\badfile.txt
The files are created, as shown below.

Running Yara on the Test Files

In the Administrator Command Prompt window, execute this command. 
yara64 test.yar test
Yara scans the files in the "test" folder and finds one file matching the rule, as shown below.

Getting Minesweeper

We'll use this file just as an example of a file to analyze. It's a modified version of a Windows game.

On your Windows machine, in a Web browser, go to

https://samsclass.info/126/proj/p11mine.htm

Scroll down to the "minesam.exe.zip" link, as shown below.

Right-click minesam.exe.zip and save the file in your Downloads folder.

Open File Explorer and navigate to your Downloads folder. Right-click the minesam.exe.zip file and click "Extract All", Extract.

A folder appears containing a minesam.exe file, as shown below.

Getting a Yara Rule

On your Windows machine, in Firefox, go to

https://raw.githubusercontent.com/Yara-Rules/rules/master/Packers/packer_compiler_signatures.yar

A page containing a set of Yara rules to detect executable files and packers opens, as shown below.

Right-click inside the Web page and click "Save Page As.... Save the page in your Downloads folder with its default name, which is packer_compiler_signatures.yar

Adding Test Files to the Test Folder

In the Administrator Command Prompt window, execute these commands. Don't omit the period at the end of the third command. 
cd c:\yara
move c:\users\administrator\downloads\minesam.exe\minesam.exe test
move c:\users\administrator\downloads\packer_compiler_signatures.yar .
The files are copied, as shown below.

Scanning the Test Files

In the Administrator Command Prompt window, execute this command. 
yara64 packer_compiler_signatures.yar test
Yara finds various signatures in the files, as shown below.

12.1 Scan Executable Files (10 pts)

Find the text covered by the green box in the image above, and enter it into the form below to record your success.
Name or Email:
Text:

12.2 Find More Evil (10 pts extra)

Download this file:

ran.zip

Unzip it. It contains 100 files with two letter names, such as AA.

Scan those files with Yara and find the files containing "EVIL". Concatenate the filenames and enter them into the form below to record your success.

Name or Email:
Filenames, like this AABB:

12.3 Find Fours (10 pts extra)

Use the same group of 100 files.

Scan those files with Yara and find the files containing three bytes of 0x04 in a row.

You may find this document helpful: " Writing YARA rules".

Concatenate the filenames and enter them into the form below to record your success.

Name or Email:
Filenames, like this AABB:

12.4 Find Fours (10 pts extra)

Use the same group of 100 files.

Scan those files with Yara and find the files containing this pattern:

Concatenate the filenames and enter them into the form below to record your success.
Name or Email:
Filenames, like this AABB:

References

How to install YARA and write basic YARA rules to identify malware
Writing YARA rules

Posted 10-1-18
Visual C++ added 10-8-18