2.3 Detecting Crypto Signatures Using YARA

Another way to identify the use of cryptography in a binary is by scanning the binary with YARA rules containing crypto signatures. You can either write your own YARA rules, or you can download the YARA rules written by other security researchers (such as at https://github.com/x64dbg/yarasigs/blob/master/crypto_signatures.yara) and then scan the binary with the YARA rules.

The x64dbg integrates YARA; this is useful if you wish to scan for the crypto signatures in a binary while debugging. You can load the binary into x64dbg (make sure the execution is paused somewhere in the binary), then right-click on the CPU window and select YARA (or Ctrl + Y); this will bring up the Yara dialog shown here. Click ...

Get Learning Malware Analysis now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.