Malware Analysis - Malware Hunting and Classification with YARA

[@dooboodot]

You seem to know A LOT about what you're doing! Great tutorial.

[@devislight]

Thank you Very much. Informative, educational, well presented and well paced.

[@ded1ights869]

who u

[@Demonslay335]

So that's how you found all those ransomware this week, "condition: true". :P Excellent video, I learned quite a bit. :)

[@MalwareAnalysisForHedgehogs]

Haha, yes that signature has the best detection rate. X)
I am glad I could teach you something.

[@splytek2140]

Thank you so much. Regards from México!

[@mazmac4474]

Good job 👍🏻

[@ukaszcom9832]

Great movie. thanx !

[@JohnSmith-iq5gy]

This was very helpful and informative, thank you!!

[@MalwareAnalysisForHedgehogs]

Thanks. I am glad this helps you. :)

[@atifjafri4351]

Thankyou

[@MalwareAnalysisForHedgehogs]

Glad it helped!

[@000maestro000]

cool video, definitely useful. how do you come by the binaries though ? random web browsing or specific requests from clients ?

[@MalwareAnalysisForHedgehogs]

I get them via Virustotal most of the time.

[@000maestro000]

Cool, only after watching i realized you can apply the yara rules to virustotal database and download the samples that match. That was the missing link for me ☺️

[@chrisfrazier6933]

Great video Thank you

[@shreyas1475]

Thankyou again what system do you recommend doing malware analysis in? XP and Ubuntu? I am really bored of hunting and looking to expand my knowledge ;) Also a list of tools that are needed to do so would be good to know

[@MalwareAnalysisForHedgehogs]

By now I would prefer Windows 7 x64 bit if you have only one system of choice (more is better). There's now quite some x64 malware out there and newest .NET versions do not work for XP either.
I don't have a comprehensive tool list by now. You find a list of the tools used in my videos always in the description below.

[@shreyas1475]

I see...thanks!

[@qe4wsy5]

nice video ☺
tq 😎

[@MalwareAnalysisForHedgehogs]

Thank you! :)

[@drarunanoopm5366]

i have one doubt. Which file format we can create these rules if i use notepad++?

[@MalwareAnalysisForHedgehogs]

The rules themselves are text files.
The detected files can have any file format.

[@drarunanoopm5366]

@@MalwareAnalysisForHedgehogs ok fine. Can you print "I love yara" based on rules?

[@drarunanoopm5366]

@@MalwareAnalysisForHedgehogs actually i want to print "i love yara". suppose i declare $text_a=i $text_b=love $text_c=yara....and finally in cond $text_a or $text_b or $text_c is enough to print so?

[@MalwareAnalysisForHedgehogs]

@@drarunanoopm5366 No. Yara is to detect files, not to write programs in it.

[@coyzor]

thanks for this vid

[@cherifaly6757]

What's this program icon between Die and visual studio in the Taskbar?

[@MalwareAnalysisForHedgehogs]

ILSpy

[@v34395]

nice :) keep posting..

[@000maestro000]

I must have a paid account to download matching samples from VT right ?

[@MalwareAnalysisForHedgehogs]

Yes, it only works with a paid account. Unfortunately I don't know of anything similar that is for free.

[@anikettate150]

@brak brak hey can you please share me invite

[@navjotsingh2251]

brak brak hi, if available could you send me one? Contact me on: [e-mail]

[@xenn1]

Great Videos! :-) Please make a video and show us all tools are you using.
i can recommend the tool fakenet-ng it is great for research

[@MalwareAnalysisForHedgehogs]

Thank you! Someone else also suggested fakenet-ng, so I guess I will give it a try :)

[@swayam14u]

nice video