Stringa dhe Obfuskim

Running the classic Unix strings tool on a binary extracts ASCII and Unicode character sequences of a minimum length and can reveal URLs, registry keys, filenames, command lines and error messages.

Strings is the quickest first pass on any sample. You will often find command-and-control URLs, hardcoded IP addresses, user-agent strings, DLL names used via LoadLibrary, and shell commands. These form a starting point for both indicators of compromise and hypotheses about behavior. However, malware authors are aware of this and routinely obfuscate strings to defeat simple analysis. Common obfuscation techniques include XOR encoding with a fixed or rolling key, stack strings (building strings one byte at a time via MOV instructions to avoid them appearing in the rdata section), base64 encoding, string hashing for API resolution, and stream ciphers like ChaCha20 for configuration. Tools like FLOSS (FireEye Labs Obfuscated String Solver) emulate the binary and extract strings that are deobfuscated at runtime, recovering much of what plain strings misses. A seasoned analyst uses strings as a triage tool — cheap, fast, often enough to confirm what family a sample belongs to — and moves to deeper static analysis or dynamic analysis when the strings alone are too sparse or too obfuscated to answer the analyst's question.

Mjete:

• strings, floss (FireEye — deobfuscates stacked strings).
• yara për signatures statike.
• CAPA — identifikim capability.

Nxjerrje stringash me kontekst:

strings -a -n 6 -e l sample.exe > strings_unicode.txt
floss sample.exe
capa sample.exe

Rule YARA që detekton një family specifike:

rule Suspicious_Packer_Hint {
    strings:
        $upx = "UPX!"
        $enc = "This program cannot be run in DOS mode"
    condition:
        $upx and $enc
}

1. Ekstrakto stringat dhe klasifiko si: URL, IP, path, API name, plaintext command.
2. Shkruaj një rule YARA për një mostër specifike dhe testoje në VT Hunting.

• VirusTotal — YARA Hunting.
• Mandiant CAPA GitHub.