Lab Instructions

Malware authors often use encryption and encoding to disguise or hide byte content in malware. One side effect of encrypting content is that it typically increases the entropy on those bytes. Luckily, YARA’s math module gives us a function to calculate entropy for strings or byte ranges.


To use entropy in conditions, you can reference an offset and size of bytes for which to calculate entropy. For example, this example expression says that the entropy of the the first hundred bytes is less than 5


math.entropy(0,100) < 5

For this lab, you are provided two samples of malware, each of which have high-entropy PE sections (or resources)


Compose several rules to detect each sample of malware based on its unique string content and/or image features.
Compose two generic rules, one to detect PE files with high-entropy sections, and another rule to detect PE files with high-entropy resources. Ensure at these rules match on at least one of the provided samples.

Sha256 of samples:


2639a62b2ab8ac81ad5f644837da3a900c592d650617b8fe74cb87585383ac6c
Malware from Operation Groundbait: https://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf
f9ff42037f02b6a2eedf7a6fb7aedb4b5d1f0eb460069f4e923fb60b5ad0841a
SourSnack malware: https://cert.gov.ua/article/37246

Zip of both samples:


lab-highentropycontent.zip

Zip password: infected


Attempt this lab on your own first, and then review my walkthrough video below to see how I approached it.


Tips and Hints

If you run into problems, don’t forget to revisit the YARA documentation for examples and reminders on how to use the module functions.


https://yara.readthedocs.io/en/stable/modules/pe.html
https://yara.readthedocs.io/en/stable/modules/math.html

Use the console module for testing, debugging, and printing out values to the command line!


Optional: submit rules for feedback

Submit your completed rules here *if* you'd like feedback/comments. Otherwise, check out some of the solutions for ideas on how to approach detection at various levels.



Lab Solutions & Walkthrough


Full Rule Solutions

import "pe"
import "console"
import "math"
rule MAL_GROUNDBAIT_Strings {
	meta:
		author = "smiller"
		desc = "Strings from the Operation Groundbait sample."
		ref = "2639a62b2ab8ac81ad5f644837da3a900c592d650617b8fe74cb87585383ac6c"
	strings:
		$a1 = "[EndPoint]"
		$b1 = "D:\\Install\\P r o g r a m m i n g\\21.02.2011\\x32\\"
		$b2 = "\\samlib\\Release\\samlib.pdb"
		$net1 = "User-agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)"
		$net2 = "GET http://"
		$net3 = "POST http://"
		$net4 = "Content-Length: %d"
	condition:
		$a1 and ($b1 or $b2) and all of ($net*)
}
rule high_section_entropy {
	condition:
		for any section in pe.sections:
		(
			math.entropy(section.raw_data_offset,section.raw_data_size) >= 6.8
		)
}
rule MAL_SOURSNACK_Strings {
	meta:
		author = "smiller"
		desc = "Strings from the SourSnack sample."
		ref = "f9ff42037f02b6a2eedf7a6fb7aedb4b5d1f0eb460069f4e923fb60b5ad0841a"
	strings:
		$a1 = "segelivirPdetseuqer" //backwards function
		$a2 = "WepyTgnirtSteG" // backwards functions
		$a3 = "ZYXWVUTSRQPONMLKJIHGFEDCBA"
		$b = "kwlods"
		$c = "widget.forum-pokemon.com"
	condition:
		uint16be(0) == 0x4d5a and
		(2 of ($a*) or #b > 20 or $c)
}
rule high_resource_entropy {
	condition:
		for any resource in pe.resources:
		(
			math.entropy(resource.offset,resource.length) >= 7.5
		)
}
