Using Disassembled Code to Create Yara Rules!
Автор: Dr Josh Stroschein - The Cyber Yeti
Загружено: 2023-09-22
Просмотров: 3074
Описание:
Let's expore how to create Yara rules using code patterns from IDA Pro.
🔥 FREE DOWNLOADABLE PDF - MALICIOUS DOCS QUICK REFERENCE
https://quickreference.thecyberyeti.c...
We'll use a sample packed with PECompact2, which is a commonly used packer for malware. We'll identify code pattern to use for the signature, discuss platforms to help validate our rule, and then test our rule against representative samples.
Cybersecurity, reverse engineering, malware analysis and ethical hacking content!
🎓 Courses on Pluralsight 👉🏻 https://www.pluralsight.com/authors/j...
🌶️ YouTube 👉🏻 Like, Comment & Subscribe!
🙏🏻 Support my work 👉🏻 / joshstroschein
🌎 Follow me 👉🏻 / jstrosch , / joshstroschein
⚙️ Tinker with me on Github 👉🏻 https://github.com/jstrosch
00:16 Why PE?
1:01 Sample on VirusTotal
1:26 My approach to this analysis
2:49 Yaraify project on Abuse.ch
4:28 Analyzing the sample in IDA Pro
6:32 Recognizing ideal byte patterns
7:20 Crash course on Structured Exceptional Handling (SEH)
8:25 Identifying junk instructions
9:24 PECompact2 string
11:00 Using wildcard byte patterns
12:12 Detect-it-Easy
13:00 Creating the Yara rule
16:18 Testing our Rule
Повторяем попытку...
Доступные форматы для скачивания:
Скачать видео
-
Информация по загрузке:
