1

Yara rules are working on Windows 7 perfectly. I am able to scan and detect malicious commands in .exe malware files but when I run the same program in debian v8.6, it can't detect malicious commands in .exe. When I run the same rule against a .txt file it works.

I don't understand what the issue is.

Yara rule:

rule isThis_Suspicious
{
    strings:
        $a = "CHAN"
        $b = "JOIN"
        $c = "arun"
    condition:
        1 of them
}

Output on debian v8.6 :

root@debian:/Thwart/yaraCmd/yara-3.7.1# yara -s rule2.txt test.txt
isThis_Suspicious test.txt
0x5:$c: arun
root@debian:/Thwart/yaraCmd/yara-3.7.1# yara -s rule2.txt  srvcp.exe

yara with -n

root@debian:/Thwart/yaraCmd/yara-3.7.1# yara -n rule2.txt test.txt
root@debian:/Thwart/yaraCmd/yara-3.7.1# yara -n rule2.txt srvcp.exe
isThis_Suspicious srvcp.exe

Why its not matching the rule in debian but the same rule is working on windows.

output on windows 7:

D:\yara>yara64.exe rule2.txt test.txt
isThis_Suspicious test.txt

D:\yara>yara64.exe rule2.txt srvcp.exe
isThis_Suspicious srvcp.exe
  • Can you confirm that srvcp.exe is the same file on both systems (via e.g., sha1sum)? Which version of Yara do you have on Windows? Also I assume you've installed Yara to a $PATH on debian since you don't have a ./ in the command there... – David Jan 18 '18 at 0:40
  • hello David, on your suggestion I checked the md5sum of srvcpe.exe on both windows and debian so it was different, I don't know how it is different because i am using same file in both operating system then again i copy the file from windows to debian through samba.. – Arun Pratap Singh Jan 18 '18 at 0:50
  • again i checked the md5sum now its same on both machine and it looks like yara rules are working but let me confirm it completely – Arun Pratap Singh Jan 18 '18 at 0:53
  • @David tell me one thing, why md5sum of srvcp.exe was different? I am using the same file on both O.S. – Arun Pratap Singh Jan 18 '18 at 0:55
  • @shawn_parker the file may have become corrupted in the transfer. – schroeder Jan 18 '18 at 9:14
0

Yara should have the same behavior on all platforms. As was discovered in the comments, it's important to make sure the rules files and targets are the same on both systems (by comparing sizes, sha1sums, etc.). It's possible for file transfers/copies to get interrupted, leading to file corruption or truncation that results in incomplete YARA matches.

Not the answer you're looking for? Browse other questions tagged or ask your own question.