2.3 Detecting Crypto Signatures Using YARA

Another way to identify the use of cryptography in a binary is by scanning the binary with YARA rules containing crypto signatures. You can either write your own YARA rules, or you can download the YARA rules written by other security researchers (such as at https://github.com/x64dbg/yarasigs/blob/master/crypto_signatures.yara) and then scan the binary with the YARA rules.

The x64dbg integrates YARA; this is useful if you wish to scan for the crypto signatures in a binary while debugging. You can load the binary into x64dbg (make sure the execution is paused somewhere in the binary), then right-click on the CPU window and select YARA (or Ctrl + Y); this will bring up the Yara dialog shown here. Click on File and loacte the file containing YARA rules. You can also load multiple files containing YARA rules from a directory by clicking on the Directory button:

The following screenshot shows the cryptographic constants detected in a malicious binary as a result of scanning it with the YARA rules containing the crypto signatures. Now you can right-click on any of the entries and select Follow in Dump to look at the data in the dump window, or, if the signature is related to the cryptographic routine, then you can double-click on any of the entries to navigate to the code:

Encryption algorithms such as RC4 do not use Cryptographic constants because of which it is not easy to detect it using Crypto signatures. Often, you will see attackers using RC4 to encrypt the data because it is easy to implement; the steps used in RC4 are explained in detail in this Talos blog post: http://blog.talosintelligence.com/2014/06/an-introduction-to-recognizing-and.html.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.223.160.61