Learning Malware Analysis

2.3 Detecting Crypto Signatures Using YARA

Another way to identify the use of cryptography in a binary is by scanning the binary with YARA rules containing crypto signatures. You can either write your own YARA rules, or you can download the YARA rules written by other security researchers (such as at https://github.com/x64dbg/yarasigs/blob/master/crypto_signatures.yara) and then scan the binary with the YARA rules.

The x64dbg integrates YARA; this is useful if you wish to scan for the crypto signatures in a binary while debugging. You can load the binary into x64dbg (make sure the execution is paused somewhere in the binary), then right-click on the CPU window and select YARA (or Ctrl + Y); this will bring up the Yara dialog shown here. Click ...