YARA - TryHackMe Write-up
Info
- Name: Yara
- Description: Learn the applications and language that is Yara for everything threat intelligence, forensics, and threat hunting!
- Difficulty: Easy
- Room link: https://tryhackme.com/room/yara
Write-up
Task 2
Q: What is the name of the base-16 numbering system that Yara can detect?
A: Hex
Q: Would the text "Enter your Name" be a string in an application? (Yay/Nay)
A: Yay
Task 9
Q: Scan file 1. Does Loki detect this file as suspicious/malicious or benign?
A: suspicious
Q: What Yara rule did it match on?
A: webshell_metaslsoft
Q: What does Loki classify this file as?
A: Web Shell
Q: Based on the output, what string within the Yara rule did it match on?
A: Str1
Q: What is the name and version of this hack tool?
A: b374k 2.2
Q: Inspect the actual Yara file that flagged file 1. Within this rule, how many strings are there to flag this file?
A: 1
Q: Scan file 2. Does Loki detect this file as suspicious/malicious or benign?
A: benign
Q: Inspect file 2. What is the name and version of this web shell?
A: b374k 3.2.3
Task 10
Q: From within the root of the suspicious files directory, what command would you run to test Yara and your Yara rule against file 2?
A: yara file2.yar file2/1ndex.php
Q: Did Yara rule flag file 2? (Yay/Nay)
A: Yay
Q: Test the Yara rule with Loki, does it flag file 2? (Yay/Nay)
A: Yay
Q: What is the name of the variable for the string that it matched on?
A: Zepto
Q: Inspect the Yara rule, how many strings were generated?
A: 20
Q: One of the conditions to match on the Yara rule specifies file size. The file has to be less than what amount?
A: 700KB
Task 11
Q: Enter the SHA256 hash of file 1 into Valhalla. Is this file attributed to an APT group? (Yay/Nay)
A: Yay
Q: Do the same for file 2. What is the name of the first Yara rule to detect file 2?
A: Webshell_b374k_rule1
Q: Examine the information for file 2 from Virus Total (VT). The Yara Signature Match is from what scanner?
A: THOR APT Scanner
Q: Enter the SHA256 hash of file 2 into Virus Total. Did every AV detect this as malicious? (Yay/Nay)
A: Nay
Q: Besides .PHP, what other extension is recorded for this file?
A: exe
Q: What JavaScript library is used by file 2?
A: Zepto
Q: Is this Yara rule in the default Yara file Loki uses to detect these type of hack tools? (Yay/Nay)
A: Nay
