dfir, mostly
That’s it! #100DaysofYARA is complete for 2024. As a final post I have collected all of my rules into a single ruleset that can be used to easily triage a set of samples. Some of the rules use the base64 string modifier which may not be supported on older versions of YARA, and a few make use of regular expressions which may cause performance issues on larger sample sets.
Given the size of the ruleset it’s probably easier to just grab it directly from my Github repository.
I hope it’s helpful!
Today’s rule matches strings found in the note dropped post-encryption by the Yanluowang ransomware.
rule MAL_Yanluowang_ransomnote {
meta:
description = "Matches strings found in Yanluowang ransom notes."
last_modified = "2024-03-27"
author = "@petermstewart"
DaysofYara = "87/100"
strings:
$a1 = "since you are reading this it means you have been hacked"
$a2 = "encrypting all your systems"
$a3 = "Here's what you shouldn't do"
$a4 = "Do not try to decrypt the files yourself"
$a5 = "do not change the file extension yourself"
$a6 = "Keep us for fools"
$a7 = "Here's what you should do right after reading it"
$a8 = "send our message to the CEO of the company, as well as to the IT department"
$a9 = "you should contact us within 24 hours by email"
$a10 = "As a guarantee that we can decrypt the files, we suggest that you send several files for free decryption"
$a11 = "Mails to contact us"
condition:
filesize < 5KB and
8 of them
}
Find the rest of my 100DaysofYARA posts here, and the rules themselves on my Github repository.
The Yanluowang ransomware was first observed in late 2021, and has been reported to utilise code-signing on their binaries. This rule relies on PDB path and usage strings found in Windows samples.
rule MAL_Yanluowang_strings {
meta:
description = "Matches function name strings found in Yanluowang ransomware samples."
last_modified = "2024-03-26"
author = "@petermstewart"
DaysofYara = "86/100"
sha256 = "49d828087ca77abc8d3ac2e4719719ca48578b265bbb632a1a7a36560ec47f2d"
sha256 = "d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c"
strings:
$a1 = "C:\\Users\\111\\Desktop\\wifi\\project\\ConsoleApplication2\\Release\\ConsoleApplication2.pdb"
$a2 = "C:\\Users\\cake\\Desktop\\project-main\\project-main\\ConsoleApplication2\\cryptopp-master"
$a3 = "Syntax: encrypt.exe [(-p,-path,--path)<path>]"
$a4 = "yanluowang"
condition:
uint16(0) == 0x5a4d and
all of them
}
Find the rest of my 100DaysofYARA posts here, and the rules themselves on my Github repository.
Cyber Poking 