【逆向】使用yarGen自动生成yara规则

前言

yarGen是一款yara规则生成器，它可以从恶意软件中获取可疑字符串来创建yara规则，同时过滤掉正常的字符串。

下载安装

yarGen是一个开源项目，源代码以zip和tar.gz的形式提供，你可以在Github页面中进行下载。

使用以下命令安装所有依赖项

sudo pip install scandir lxml naiveBayesClassifier pefile
//如果出现错误请尝试以下命令：
sudo pip install pefile
sudo pip install scandir lxml naiveBayesClassifier

使用以下命令下载内置数据库，并保存到“./dbs”子文件夹中

python yarGen.py --update

也可以从百度云下载，下载后解压到“./dbs”子文件夹中即可

使用示例

安装完成后可以使用“python yarGen.py -h”命令获取更多命令行参数信息。

usage: yarGen.py [-h] [-m M] [-y min-size] [-z min-score] [-x high-scoring]
                 [-w superrule-overlap] [-s max-size] [-rc maxstrings]
                 [--excludegood] [-o output_rule_file] [-e output_dir_strings]
                 [-a author] [-r ref] [-l lic] [-p prefix] [-b identifier]
                 [--score] [--strings] [--nosimple] [--nomagic] [--nofilesize]
                 [-fm FM] [--globalrule] [--nosuper] [--update] [-g G] [-u]
                 [-c] [-i I] [--dropzone] [--nr] [--oe] [-fs size-in-MB]
                 [--noextras] [--debug] [--trace] [--opcodes] [-n opcode-num]

yarGen

optional arguments:
  -h, --help            show this help message and exit

Rule Creation:
  -m M                  Path to scan for malware
  -y min-size           Minimum string length to consider (default=8)
  -z min-score          Minimum score to consider (default=0)
  -x high-scoring       Score required to set string as 'highly specific
                        string' (default: 30)
  -w superrule-overlap  Minimum number of strings that overlap to create a
                        super rule (default: 5)
  -s max-size           Maximum length to consider (default=128)
  -rc maxstrings        Maximum number of strings per rule (default=20,
                        intelligent filtering will be applied)
  --excludegood         Force the exclude all goodware strings

Rule Output:
  -o output_rule_file   Output rule file
  -e output_dir_strings
                        Output directory for string exports
  -a author             Author Name
  -r ref                Reference (can be string or text file)
  -l lic                License
  -p prefix             Prefix for the rule description
  -b identifier         Text file from which the identifier is read (default:
                        last folder name in the full path, e.g. "myRAT" if -m
                        points to /mnt/mal/myRAT)
  --score               Show the string scores as comments in the rules
  --strings             Show the string scores as comments in the rules
  --nosimple            Skip simple rule creation for files included in super
                        rules
  --nomagic             Don't include the magic header condition statement
  --nofilesize          Don't include the filesize condition statement
  -fm FM                Multiplier for the maximum 'filesize' condition value
                        (default: 3)
  --globalrule          Create global rules (improved rule set speed)
  --nosuper             Don't try to create super rules that match against
                        various files

Database Operations:
  --update              Update the local strings and opcodes dbs from the
                        online repository
  -g G                  Path to scan for goodware (dont use the database
                        shipped with yaraGen)
  -u                    Update local standard goodware database with a new
                        analysis result (used with -g)
  -c                    Create new local goodware database (use with -g and
                        optionally -i "identifier")
  -i I                  Specify an identifier for the newly created databases
                        (good-strings-identifier.db, good-opcodes-
                        identifier.db)

General Options:
  --dropzone            Dropzone mode - monitors a directory [-m] for new
                        samples to processWARNING: Processed files will be
                        deleted!
  --nr                  Do not recursively scan directories
  --oe                  Only scan executable extensions EXE, DLL, ASP, JSP,
                        PHP, BIN, INFECTED
  -fs size-in-MB        Max file size in MB to analyze (default=10)
  --noextras            Don't use extras like Imphash or PE header specifics
  --debug               Debug output
  --trace               Trace output

Other Features:
  --opcodes             Do use the OpCode feature (use this if not enough high
                        scoring strings can be found)
  -n opcode-num         Number of opcodes to add if not enough high scoring
                        string could be found (default=3)

使用“-m”参数对“vir”文件夹中的样本自动生成yara规则

//在不使用其它参数的情况下，会在当前目录下输出一个名为“yarGen_rules.yar”的规则文件
python yarGen.py -m vir

规则解释

yarGen会对规则中的每个字符串进行评分，并按得分高低进行分类，每个分类的字符串会以不同的前缀进行区分。
以“$s”开头的字符串，是“高度特定的字符串”，该类字符串不会出现在合法软件中。
以“$x”开头的字符串，是“特定的字符串”，该类字符串可能同时在恶意软件与合法软件中出现。
以“$z”开头的字符串，是“普通字符串”，该类字符串可能很常见，但是还没有被收集加入到合法字符串数据库中。

总结

关于更多yarGen使用说明，可以查看“-h”参数，或者参考github中作者列出的博客文章，这里不再赘述。
对于yarGen自动生成的yara规则，我们需要在其基础上根据不同的字符串前缀，结合实际分析情况进行修改完善后，才能将其应用到实际工作中。

参考资料

https://github.com/Neo23x0/yarGen
https://securityonline.info/yargen-generator-yara-rules/
https://medium.com/bugbountywriteup/diving-into-yargen-9e8c00e18b65