statiStrings: YARA Rule Strings Statistics Calculator
statiStrings
statiStrings is a strings statistics calculator for YARA rules.
The goal is to aid malware research by:
- Finding common and unique strings within malware samples
- Finding common strings within clean files
- Saving time by finding the common characteristics of malware samples automatically
This tool helps writing better, more precise YARA rules for malware detection and malware hunting, based on custom databases of malicious and clean files.
For a given YARA rule and a directory of files, this tool returns the prevalence of each string from the rule in the matched files from the directory.
Install
git clone https://github.com/Sh3llyR/statiStrings.git
pip install yara
Use
Usage example
Research of common strings in malicious batch scripts: First, I wrote a YARA rule with many commands that were found in malicious scripts. The condition was “any of them” – very generic. Then, I ran this tool with the rule I wrote against a malicious scripts directory (shown in the following example). Finally, I ran it against a directory with clean scripts. After Going through the results of both clean and malicious scripts, I was able to:
- Group the strings of the YARA rule to suspicious ($s_…), for example, tskill, and noisy ($n_…), for example, echo.
- Create a condition for my rule that catches the malicious samples but not the clean samples, minimizing false positives.
- python statiStrings.py -y .\batch_commands.yar -d .\batch_samples -t s
- Results:
- python statiStrings.py -y .\batch_commands.yar -d .\batch_samples -t p
- Results:
Author: Shelly Raban
Source: https://github.com/Sh3llyR/
