【逆向】使用yarGen自動生成yara規則

前言

yarGen是一款yara規則生成器，它可以從惡意軟件中獲取可疑字符串來創建yara規則，同時過濾掉正常的字符串。

下載安裝

yarGen是一個開源項目，源代碼以zip和tar.gz的形式提供，你可以在Github頁面中進行下載。

使用以下命令安裝所有依賴項

sudo pip install scandir lxml naiveBayesClassifier pefile
//如果出現錯誤請嘗試以下命令：
sudo pip install pefile
sudo pip install scandir lxml naiveBayesClassifier

使用以下命令下載內置數據庫，並保存到“./dbs”子文件夾中

python yarGen.py --update

也可以從百度雲下載，下載后解壓到“./dbs”子文件夾中即可

使用示例

安裝完成后可以使用“python yarGen.py -h”命令獲取更多命令行參數信息。

usage: yarGen.py [-h] [-m M] [-y min-size] [-z min-score] [-x high-scoring]
                 [-w superrule-overlap] [-s max-size] [-rc maxstrings]
                 [--excludegood] [-o output_rule_file] [-e output_dir_strings]
                 [-a author] [-r ref] [-l lic] [-p prefix] [-b identifier]
                 [--score] [--strings] [--nosimple] [--nomagic] [--nofilesize]
                 [-fm FM] [--globalrule] [--nosuper] [--update] [-g G] [-u]
                 [-c] [-i I] [--dropzone] [--nr] [--oe] [-fs size-in-MB]
                 [--noextras] [--debug] [--trace] [--opcodes] [-n opcode-num]

yarGen

optional arguments:
  -h, --help            show this help message and exit

Rule Creation:
  -m M                  Path to scan for malware
  -y min-size           Minimum string length to consider (default=8)
  -z min-score          Minimum score to consider (default=0)
  -x high-scoring       Score required to set string as 'highly specific
                        string' (default: 30)
  -w superrule-overlap  Minimum number of strings that overlap to create a
                        super rule (default: 5)
  -s max-size           Maximum length to consider (default=128)
  -rc maxstrings        Maximum number of strings per rule (default=20,
                        intelligent filtering will be applied)
  --excludegood         Force the exclude all goodware strings

Rule Output:
  -o output_rule_file   Output rule file
  -e output_dir_strings
                        Output directory for string exports
  -a author             Author Name
  -r ref                Reference (can be string or text file)
  -l lic                License
  -p prefix             Prefix for the rule description
  -b identifier         Text file from which the identifier is read (default:
                        last folder name in the full path, e.g. "myRAT" if -m
                        points to /mnt/mal/myRAT)
  --score               Show the string scores as comments in the rules
  --strings             Show the string scores as comments in the rules
  --nosimple            Skip simple rule creation for files included in super
                        rules
  --nomagic             Don't include the magic header condition statement
  --nofilesize          Don't include the filesize condition statement
  -fm FM                Multiplier for the maximum 'filesize' condition value
                        (default: 3)
  --globalrule          Create global rules (improved rule set speed)
  --nosuper             Don't try to create super rules that match against
                        various files

Database Operations:
  --update              Update the local strings and opcodes dbs from the
                        online repository
  -g G                  Path to scan for goodware (dont use the database
                        shipped with yaraGen)
  -u                    Update local standard goodware database with a new
                        analysis result (used with -g)
  -c                    Create new local goodware database (use with -g and
                        optionally -i "identifier")
  -i I                  Specify an identifier for the newly created databases
                        (good-strings-identifier.db, good-opcodes-
                        identifier.db)

General Options:
  --dropzone            Dropzone mode - monitors a directory [-m] for new
                        samples to processWARNING: Processed files will be
                        deleted!
  --nr                  Do not recursively scan directories
  --oe                  Only scan executable extensions EXE, DLL, ASP, JSP,
                        PHP, BIN, INFECTED
  -fs size-in-MB        Max file size in MB to analyze (default=10)
  --noextras            Don't use extras like Imphash or PE header specifics
  --debug               Debug output
  --trace               Trace output

Other Features:
  --opcodes             Do use the OpCode feature (use this if not enough high
                        scoring strings can be found)
  -n opcode-num         Number of opcodes to add if not enough high scoring
                        string could be found (default=3)

使用“-m”參數對“vir”文件夾中的樣本自動生成yara規則

//在不使用其它參數的情況下，會在當前目錄下輸出一個名為“yarGen_rules.yar”的規則文件
python yarGen.py -m vir

規則解釋

yarGen會對規則中的每個字符串進行評分，並按得分高低進行分類，每個分類的字符串會以不同的前綴進行區分。
以“$s”開頭的字符串，是“高度特定的字符串”，該類字符串不會出現在合法軟件中。
以“$x”開頭的字符串，是“特定的字符串”，該類字符串可能同時在惡意軟件與合法軟件中出現。
以“$z”開頭的字符串，是“普通字符串”，該類字符串可能很常見，但是還沒有被收集加入到合法字符串數據庫中。

總結

關於更多yarGen使用說明，可以查看“-h”參數，或者參考github中作者列出的博客文章，這里不再贅述。
對於yarGen自動生成的yara規則，我們需要在其基礎上根據不同的字符串前綴，結合實際分析情況進行修改完善后，才能將其應用到實際工作中。

參考資料

https://github.com/Neo23x0/yarGen
https://securityonline.info/yargen-generator-yara-rules/
https://medium.com/bugbountywriteup/diving-into-yargen-9e8c00e18b65