Create YARA rules with GHIDRA | MALWARE Analysis of Havoc Demon implants
Today we use Ghidra and Yara to detect 'Demon' implants via API hashes used in The Havoc Framework.
** Find me at **
Twitter/X - / cyberraiju
Blog - https://www.jaiminton.com/
Mastodon - https://infosec.exchange/@CyberRaiju
** Finished Yara Rule **
https://github.com/JPMinty/Detection_...
** Tools **
Yara - https://virustotal.github.io/yara/
YaraCI - https://github.com/apps/virustotal-ya...
Ghidra - https://github.com/NationalSecurityAg...
PE-Bear - https://github.com/hasherezade/pe-bear/
Notepad++ - https://notepad-plus-plus.org/
** Fantastic Tool for Yara Development **
Yara Toolkit - https://yaratoolkit.securitybreak.io/
** Sample **
https://bazaar.abuse.ch/download/0bc0...
https://www.virustotal.com/gui/file/0...
https://www.unpac.me/results/4e15055e...
https://www.unpac.me/yara/results/891...
** Further Reading **
https://malpedia.caad.fkie.fraunhofer...
https://www.fortinet.com/blog/threat-...
https://github.com/HavocFramework/Havoc
** Embee Research Blog **
https://embee-research.ghost.io/
** Timestamps **
00:00 - Intro
00:25 - Examine sample in PE-Bear
00:47 - Examine sample in Ghidra
01:13 - Examine strings in Ghidra
01:58 - Entry point analysis
02:13 - View function calls
02:23 - Understanding the segment register
03:33 - Recognising hashed APIs in assembly
04:23 - Dynamic API resolution in Havoc Demon
05:08 - Raw assembly to hash comparison
05:44 - Embee Research
06:05 - Basic Yara rule template
06:24 - VirusTotal YaraCI integration
07:00 - Basic Yara rule creation and modifiers
07:40 - Difference between ASCII and Unicode strings
08:03 - Demonstrating ASCII vs Unicode strings
08:50 - Basic byte-based Yara rule creation
09:55 - Timelapse of Yara rule creation
10:39 - Duplicated NtCreateEvent API resolution
10:51 - Continued timelapse
11:30 - Disclaimer on Yara rule
12:15 - Copy pasta issues
13:18 - v1.0 of Yara rule
14:00 - Hunting for samples using Yara rules
16:06 - Outro
Credits:
SFX by Pixabay
Music by Julius H via Pixabay - https://pixabay.com/users/juliush-392...