Free readiness test
Home / Tool labs / YARA

YARA hands-on lab Which attachment is the ransomware?

Describe malware by its patterns and hunt for it across files.

Malware & ForensicsBeginnerFree live lab6 objectives
ir@malware-lab:~/case-ransom$
$ strings -n 8 samples/invoice_8841.exe
!This program cannot be run in DOS mode.
.text  .rdata  .data
vssadmin.exe delete shadows /all /quiet
wbadmin delete catalog -quiet
YOUR FILES HAVE BEEN ENCRYPTED
.locked
README_RESTORE_FILES.txt
CryptEncrypt   CryptGenKey   CryptImportKey
bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh

What is YARA?

YARA is the pattern-matching 'Swiss army knife' for malware researchers. Rules combine text, hex and conditions to classify files, and are used in EDRs, email gateways and incident response.

1 Strings

Text, hex or regex patterns that are characteristic of a malware family.

2 Conditions

Logic such as 'is a Windows executable AND 2 of the strings', which balances detection and false positives.

3 Hunting

Run rules across folders, memory dumps or mailboxes to find every infected file.

The scenario: Which attachment is the ransomware?

The email gateway quarantined four attachments sent to finance. They're in samples/ (inert lab copies). Inspect them, run the team's ransomware rule, prove which strings match, and produce the hash for blocking.

Live lab: try it now

Type the commands in the terminal below. Everything is simulated, so it's safe and legal and nothing is installed.

Step-by-step: YARA commands used in this lab

1List the quarantined samples

ls the samples folder.

ls samples
Show sample output
invoice_8841.exe   notepad.exe   q3_report.docm   setup_vpn.msi

2Inspect readable strings in the invoice executable

strings with a minimum length of 8.

strings -n 8 samples/invoice_8841.exe
Show sample output
!This program cannot be run in DOS mode.
.text  .rdata  .data
vssadmin.exe delete shadows /all /quiet
wbadmin delete catalog -quiet
YOUR FILES HAVE BEEN ENCRYPTED
.locked

3Read the ransomware YARA rule

It's in rules/.

cat rules/ransom_generic.yar
Show sample output
rule Ransomware_Generic_ShadowDelete
{
  meta:
    description = "Generic ransomware: deletes backups and drops a ransom note"
    author      = "NERvE IR team"
    severity    = "critical"

4Scan all samples with the rule

yara <rule> <folder>

yara rules/ransom_generic.yar samples/
Show sample output
Ransomware_Generic_ShadowDelete samples/invoice_8841.exe
Only 1 of 4 files matched. The other samples are clean against this rule.

5Show exactly which strings matched

-s prints matching strings.

yara -s rules/ransom_generic.yar samples/invoice_8841.exe
Show sample output
Ransomware_Generic_ShadowDelete samples/invoice_8841.exe
0x1a2f0:$vss: vssadmin.exe delete shadows
0x1a330:$wbad: wbadmin delete catalog
0x1b004:$note: YOUR FILES HAVE BEEN ENCRYPTED
0x1b040:$ext: .locked
0x2c112:$api: CryptEncrypt

6Get the SHA-256 hash to block it

sha256sum the file.

sha256sum samples/invoice_8841.exe
Show sample output
4b9f1c2e7a03d5e8f61a72c94be03d1f58a6c0e2d917b4a3fe5c8d21a06b7e93  samples/invoice_8841.exe
Add this hash to EDR/email blocklists and search for it across endpoints.

Key takeaways

Install YARA and practise for real

sudo apt install yara   # or: pip install yara-python

Only handle real malware in an isolated VM. Practise on benign test files you create yourself. Only scan or test systems you own or are explicitly authorised to assess. Official site: virustotal.github.io/yara/ · Licence: BSD-3-Clause.

Scenario questions

Which file is the ransomware?

Answer: invoice_8841.exe. invoice_8841.exe matched all five strings including shadow-copy deletion and the ransom note.

Why require '3 of them' rather than any one string?

Answer: To reduce false positives: '.locked' alone could appear in legitimate files. Combining indicators keeps rules precise.

Why delete shadow copies?

Answer: To stop victims restoring files without paying. Ransomware removes local recovery options to pressure victims, so keep offline/immutable backups.

More open-source tool labs

🧠

Volatility 3

Investigate a memory dump: processes, command lines, connections and injected code.

📡

Nmap

Discover hosts, open ports and services on networks you're authorised to assess.

🦈

Wireshark / tshark

See exactly what's crossing the wire and spot malware calling home.

🔭

Zeek

Turn raw traffic into rich, searchable logs for threat hunting.

🚨

Suricata

Detect attacks in network traffic with signatures, and write your own.

🛡️

Wazuh

An open-source SIEM and XDR: collect logs, detect attacks, respond automatically.