Lab Instructions

For this exercise, examine the provided sample of the DarkSide ransomware, extract strings, and compose and test rules for it.


Compose one rule that is specific or precise, with a lot of high-quality strings that catch this exact sample.
Compose another rule that is “broader” or “looser” or less specific, that will catch this and other samples of the same malware.

Sample Sha256: da3bb9669fb983ad8d2ffc01aab9d56198bd9cedf2cc4387f19f4604a070a9b5
Zip of sample: mal-darkside-da3bb9.zip
Zip password: infected


Attempt this exercise yourself first, then review my walkthrough to see how I approached it.


Lab Solutions & Walkthrough


Full Rule Solutions

rule MAL_Darkside_ELF {
	meta:
		author = "smiller"
		description = "Strings from a DARKSIDE ELF sample."
		sha256 = "da3bb9669fb983ad8d2ffc01aab9d56198bd9cedf2cc4387f19f4604a070a9b5"
	strings:
		$a = "N8CryptoPP7GrouperE"
		$b = "/tmp/software.log"
		$c = "darkside_readme.txt"
		$d = "Welcome to DarkSide"
		$e = "darksidfqzcuhtk2.onion"
		$f = "!!! DANGER !!!"
	condition:
		all of them
}
rule MAL_Darkside_Loose {
	meta:
		author = "authorname"
		description = "Looks for multiple matches of the darkside string."
		sha256 = "da3bb9669fb983ad8d2ffc01aab9d56198bd9cedf2cc4387f19f4604a070a9b5"
	strings:
		$a = "darksid" nocase
	condition:
		#a >= 3
}
