VT hunting rules for Android malware

[jumbo freak]

Hi all,
I was interested to know if any one had success in writing good Yara rules for harvesting Android malware in VT intelligence. All i could think of is writing rules based on strings in resource and other bytes visible from APK.  How about writing rules for Classes.dex or Android Manifest file ? I know VT api supports "androguard : <string>" but we can't use them inside yara rule as far as i know, correct me if i'm wrong. Anyone had any success in collecting samples and want to share it with community. 

Thanks in advance.

[Emiliano Martinez]

Hello,

Intelligence hunting syntax is richer than the plain Yara syntax because it defines several externals. The ones that might particularly interesting for you are:

- file_type

- tags

- positives

This enables you to write a simple rule such as:

rule Example_1

{

  condition:

    tags contains "apk" and positives > 10

}

This would trigger on any APK sample with more than 10 AV detections. Similarly, you can combine these new features with the traditional Yara syntax, in order to focus exclusively on APKs that contain certain patterns, etc. 

You can learn more about this at:

https://www.virustotal.com/intelligence/help/malware-hunting/

Regards.

--
--
Choose a file, check it with more than 40 antivirus, fast and easy: http://www.virustotal.com

---
You received this message because you are subscribed to the Google Groups "VirusTotal" group.
To unsubscribe from this group and stop receiving emails from it, send an email to virustotal+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[leona leo]

среда, 4 июня 2014 г., 14:09:28 UTC пользователь jumbo freak написал:

Hi all,
I was interested to know if any one had success in writing good Yara rules for harvesting Android malware in VT intelligence. All i could think of is writing rules based on strings in resource and other bytes visible from APK.  How about writing rules for Classes.dex or Android Manifest file ? I know VT api supports "androguard : <string>" but we can't use them inside yara rule as far as i know, correct me if i'm wrong. Anyone had any success in collecting samples and want to share it with community. 

Thanks in advance.virustotal.com/en/file/0c10b81d1cbdb1beb0bdcd3504db3994c5762a86b65a06fcd4399ce5589e39f0/analysis/1404914630/ 2VIRUSES IN 2011 SMS SENDER NO - CLEAN!

[Shivang Desai]

Hi Emiliano,

For implementing this rule on VT, do we need to buy subscription from VT ? 
Can this rule implementation be done on regular email registration ? 

Thanks,

[Emiliano Martinez]

Malware Hunting is only available in VirusTotal Intelligence, which is a private platform requiring licensing.

Regards.

--
--
Choose a file, check it with more than 50 antivirus, fast and easy: http://www.virustotal.com

[Shivang Desai]

Thanks. Hoping for one soon. :-) 

Regards,

Shivang Desai.

[jumbo freak]

Hi VT,
there are lot of improvements in android analysis, especially behavior and relationship mapping, good work. 
Have done any updates to threat hunting, can we use androguard in yara rule ? can we hunt files on based on behavior ?