This came out while I was traveling last week and it's a good read on a single campaign from this group we've been tracking: dslua.org/publications... - They are fairly active doing this kind of phishing and also other nefarious activities.

Phishing Campaign Against “Civil Network OPORA” – Gmail Account Takeover via OAuth – Лабораторія цифрової безпеки

dslua.org

I found the newly added feature in YARA-X to ignore certain rules on compilation errors to be interesting and exposed it in the python API. The original requester (and implementer) raises a good point that this makes using large rulesets much easier.

Turns out there was a small bug in the "private" modifier on hex and RE patterns in YARA-X, in that they were not honored at all. Fixed that in github.com/VirusTotal/y... - original issue spotted by someone else: github.com/VirusTotal/y...

fix: Do not ignore private modifier on hex and RE patterns. by wxsBSD · Pull Request #698 · VirusTotal/yara-x

This fixes the "private" modifier on hex strings so they are properly hidden from output and also fixes it so the modifier is properly displayed in both AST and CST representations. This ...

github.com

Happy early Fourth of July from my front porch!

Jordan doing good work deep diving into Turla related malware we’ve been tracking for a while now. If you’re into Turla this is a good read. cloud.google.com/blog/topics/...

The Latest Addition to Turla’s Intelligence Gathering Apparatus | Google Cloud Blog

Analysis of a backdoor, STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla.

cloud.google.com

Patrick sharing some good work on activity of this PRC nexus actor that is quite broad!

@pdub5.bsky.social · last mo.

Completely forgot to post this here last week. 😅 🚨Our latest research into a sophisticated PRC-nexus campaign! The threat actor is pursuing defense intelligence on AI, UVS, offensive cyber, medical research, and geo-strategic policy 🧑‍💻💉🌏. Read the full report here: cloud.google.com/blog/topics/...

github.com/VirusTotal/y... This fixes an issue with certain header constraints that you really should update for. There are other nice bug fixes and features too, but the header constraints is a big one.

Release v1.19.0 · VirusTotal/yara-x

Add missing machine architecture types to pe module (#687). Add warning for single-byte patterns (71baa67). Add warning for duplicate patterns in a rule (9061803). Small optimization when generatin...

github.com

github.com/VirusTotal/y... Performance improvements and some nice new features. It only gets better with each release! Congratulations to all contributors and Victor!

Release v1.16.0 · VirusTotal/yara-x

Multiple performance improvements (#623, #624, #626, #627, #629, #631, #632, #635, #649, #654). Implement constant folding for bitwise operations (#634). Allow specifying context size for matches (...

github.com

Next time AI makes up a garbage answer just remember wxs' first law of AI: "Never trust robots, a bunch of assholes if you ask me."

So @xorhex.bsky.social asked (in our YARA keybase chat) how one might only iterate through the last 10 matches of a string in YARA. I took a shot at answering it by logging the last 10 locations of a match in descending order: for all i in (0..10): (console.log(@a[#a - i]))

github.com/VirusTotal/y... - congrats to all involved! These new features are really great!

Release v1.15.0 · VirusTotal/yara-x

Add full support for WASM. The whole yara-x create now can be built for WASM (#583, #588, #598). New playground at https://virustotal.github.io/yara-x/playground/ (#601). The yr check command now n...

github.com

Not so fun fact: The imphash implementation in pefile has diverged from the implementation in YARA and YARA-X... and any other one in the last 15 years. This has existed for 2 years and I'm pushing to get it reverted and a new pefile release made. github.com/erocarrera/p...

Imphash implementation does not follow convention · Issue #141 · erocarrera/pefile

https://www.mandiant.com/blog/tracking-malware-import-hashing/ Mandiant's imphash convention requires the following: Resolving ordinals to function names when they appear Converting both DLL names ...

github.com

It really annoyed me that we could not return multiple tag linter errors, but returned multiple errors for other linters. The root cause is kind of interesting. More importantly, I put up a fix for it: github.com/VirusTotal/y...

fix: Properly handle multiple errors with the tag linter. by wxsBSD · Pull Request #614 · VirusTotal/yara-x

When the tag linter comes across multiple errors only the first one is returned. This is due to an oversight in the API where we can only return a single error, not a vector of errors. I realize th...

github.com

Two for one today! Added support for console.log(offset, length) to the console module in YARA-X, per the suggestion of a user. Makes it nicer to work with arbitrary sequences of bytes. Hopefully it makes it in the next release!

two men are standing next to each other and one of them is wearing a shirt that says nuts

ALT: two men are standing next to each other and one of them is wearing a shirt that says nuts

media.tenor.com

I've been struggling to find time to write code during the week, and I know I need to get better at that as I still very much enjoy contributing to this project. Anyways, here's the PR that adds the linter functionality the compiler has to the Python API: github.com/VirusTotal/y...

Wesley Shields@wxs.bsky.social · 5mo ago

So @tlansec.bsky.social asked about exposing the linter capabilities of `yr check` (sometimes called the "checker") in the python API. It is done modulo test cases and some minor tweaks to the API I'm considering to make it a bit nicer. PR up hopefully by the end of this weekend.

One of those days. I have a bit of time to work on some code, so I start in on it. I quickly realize I want a feature that was added sometime after I started my branch. Fine, I pull it down into my repository BUT COMPLETELY FORGET TO REBASE MY WORK ON IT! Took me a solid 20 minutes of debugging.

a man in a suit and tie sits at a desk with the words " i don 't even really work here " above him

ALT: a man in a suit and tie sits at a desk with the words " i don 't even really work here " above him

media.tenor.com

So @tlansec.bsky.social asked about exposing the linter capabilities of `yr check` (sometimes called the "checker") in the python API. It is done modulo test cases and some minor tweaks to the API I'm considering to make it a bit nicer. PR up hopefully by the end of this weekend.

Did some work to expose the functionality of the “yr check” command (what I call the linter) in the python bindings. The basic gist is done, just need to clean it up this weekend. Should have a PR up soon.

Victor just released v1.14.0 - improvements in macho module, tighter code generation in the compiler and the new “deps” command. Congratulations to everyone involved! github.com/VirusTotal/y...

Spent some time yesterday cleaning up my dependency graphing code for yara-x. No longer outputs graphviz. Instead it dumps an ascii tree. You can try it with “yr deps” in the next release.

Some of the analysis I've done over the past few years is referenced in various places in this overview. I might be most happy that my sneaky reference to the time a half-dozen of us ate a Vermonster in a single attempt made it into the report. cloud.google.com/blog/topics/...

Threats to the Defense Industrial Base | Google Cloud Blog

The defense sector faces a relentless barrage of operations conducted by state-sponsored actors and criminal groups.

cloud.google.com

github.com/VirusTotal/y... - Once again, new release with some good bug fixes and nice improvements.

Release v1.13.0 · VirusTotal/yara-x

Add crx and dex modules to Python invoke API (#534). Add Python API for specifying the metadata that should be passed to modules (6bebe34): Output filenames that needs reformatting when using yr fm...

github.com

YARA-X 1.12.0 is out. Some small bug fixes but still worth upgrading! Once again, congrats to Victor and the contributors as the project keeps getting better. github.com/VirusTotal/y...

Release v1.12.0 · VirusTotal/yara-x

Improvements in the parser to produce better Concrete Syntax Trees (#531, c46b3bd). BUGFIX: avoid panic when parsing some regular expressions (136ab9f).

github.com

github.com/VirusTotal/y... - 1.11.0 is out! Lots of new features, modules and bug fixes. Read the release notes and congrats to Victor and the contributors!

Release v1.11.0 · VirusTotal/yara-x

Make the parser stricter (#502). Implement dex module (#458). Implement C api console log (#515). Implement permhash for the crx module (#510). Implement the imports() method for the Rules object i...

github.com

One wheel Jesus was at the Christmas parade again. All praise be to one wheel Jesus and his crew.

Quality of life improvement for yara-x: I realized the functions that output hash values do not have constraints on them like the hash module functions do. See virustotal.github.io/yara-x/blog/... for details on why this is useful to extend everywhere. PR that fixes it: github.com/VirusTotal/y...

feat: More constraints on hashes by wxsBSD · Pull Request #509 · VirusTotal/yara-x

The imphash implementation always returns a lowercase md5. This commit switches the type of the returned value so that it can be used to generate warnings. Warnings are now generated if you use an ...

github.com

Yara-x 1.10.0 released today! It can now automatically fix some warnings, and some improvements in code generation. This is another great step forward for the project. github.com/VirusTotal/y...

Release v1.10.0 · VirusTotal/yara-x

New yr fix warnings command (#493). Generate more efficient WASM code for some expressions, reducing the size of compiled rules (5efc214, a865681). Improve the API for traversing the AST in DFS ord...

github.com

Don't ask why but you may now refer to me as "Sir Wesley, robot, esq." (thanks @gabagool.ing for that one) and gemini thinks this is what I look like. It may have had some help with the Pikachu hoodie and hot dogs. You're welcome for this visual.

Finally put this up for review in a PR (github.com/VirusTotal/y...) - it's now in it's own command and has been tested on some pretty gnarly graphs of rules. If you have huge dependency graphs the output gets messy, but it works well otherwise.

feat: Add "deps" command to generate a graph of rule depdendencies. by wxsBSD · Pull Request #498 · VirusTotal/yara-x

This branch adds a "deps" command that generates dependency information for a set of rules. It walks the AST looking for identifiers of rules, modules and unknown identifiers (hopefully e...

github.com

Wesley Shields@wxs.bsky.social · 9mo ago

If you're interested in my dependency querying code for yara rules check out my deps branch: github.com/wxsBSD/yara-... You can build it with "cargo build --features=debug-cmd" and use it like "yr debug deps -h". My TODO list for this is basically: - Write tests - Move to it's own command

If you're interested in my dependency querying code for yara rules check out my deps branch: github.com/wxsBSD/yara-... You can build it with "cargo build --features=debug-cmd" and use it like "yr debug deps -h". My TODO list for this is basically: - Write tests - Move to it's own command

GitHub - wxsBSD/yara-x at deps

Experimenting with YARA and Rust. Contribute to wxsBSD/yara-x development by creating an account on GitHub.

github.com