Elvis Wiki - User contributions [en]

Evasive Malware Detection mit YARA

2026-01-19T19:55:51Z

PPfaffl: Created page with "== Summary == This documentation describes the setup of a malware analysis environment and the methodology for detecting evasive malware using static analysis with YARA. The focus is on identifying byte patterns (hardware instructions) and suspicious strings in order to distinguish evasive malware from legitimate software. == Requirements == * VirtualBox * YARA * Windows 10 * 6 evasive malware samples * 6 additional malware samples * 6 benign .exe files (Windows syst..."

== Summary ==

This documentation describes the setup of a malware analysis environment and the methodology for detecting evasive malware using static analysis with YARA. The focus is on identifying byte patterns (hardware instructions) and suspicious strings in order to distinguish evasive malware from legitimate software.

== Requirements ==

* VirtualBox
* YARA
* Windows 10
* 6 evasive malware samples
* 6 additional malware samples
* 6 benign .exe files (Windows system)

== Installation ==
Install REMnux in VirtualBox by downloading and importing the official distribution from [[https://remnux.org/#distro DownloadREMnux]]
, and also set up a Windows 10 VM for executing and transferring the required .exe files. Ensure both VMs start correctly.

== Hardening ==

Perform the installation steps inside the REMnux and Windows 10 in VirtualBox as part of system hardening for safe, isolated malware analysis.

Shared Clipboard disabled:

[[File:SharedClipboard.png|400px]]

No Drag and Drop:

[[File:DragAndDrop.png|400px]]

No USB Passthrough:

[[File:USB.png|400px]]

No Shared Folders:

[[File:SharedFolder.png|400px]]

Take a clean snapshot of both VMs before introducing malware. This allows for a quick revert the start state after infection.

== Network ==

=== Gateway REMnux Config ===

Shows a host-only adapter configured for a secure, internet-isolated analysis environment on both machines:

[[File:Adapter1.png|400px]]

Shows a second NAT/bridged adapter used temporarily for downloading tools and samples, which is disabled before malware analysis on REMNUX (as Gateway):

[[File:Adapter2.png|400px]]

sudo nano /etc/sysctl.conf

[[File:IPForwarding.png|400px]]

# activate:
sudo sysctl -p

# Routing
sudo iptables -t nat -A POSTROUTING -o enp0s8 -j MASQUERADE

# netplan
sudo nano /etc/netplan/01-netcfg.yaml

[[File:RemnuxIPTable.png|400px]]

sudo netplan apply

# Check
ip a

[[File:IPA.png|500px]]

=== Windows Config===

Shows a host-only adapter configured for a secure, internet-isolated analysis environment

[[File:Adapter1.png|400px]]

Change the IP address:

[[File:WindowsIP.png|300px]]

== Dataset ==

Download the required malware samples from MalwareBazaar [[https://bazaar.abuse.ch MalewareDatabase]] and store them inside the REMnux virtual machine in a dedicated analysis folder. Keep the VM isolated from the internet before and during analysis.

Warning: Malware samples are live and dangerous. Handle with extreme caution and ensure the analysis environment is completely isolated from the host and local network.

=== Evasive Malware ===

[[File:EvasiveMalware.png|500px]]

=== Malware ===

[[File:Malware.png|500px]]

=== Benign Software ===

copy files to REMnux

scp "C:\Windows\System32\<benignSoftware>.exe" remnux@10.0.0.1:/home/remnux/

[[File:Copyexe.png|500px]]

* calc.exe
* chrome.exe
* vlc.exe
* notepad.exe
* cmd.exe
* taskmgr.exe

== YARA ==

=== YARA run ===

Create a YARA rule file inside the REMnux virtual machine and store it in your analysis directory.

evasive_rules.yar

Run YARA against your samples to scan for static indicators of evasive behavior:

yara evasive_rules.yar /path/to/malware/

-s option will display the specific strings and patterns that triggered a match and -r for rekurisve:

yara -r -s evasive_rules.yar /path/to/malware/

=== YARA Final Rule ===

The final rule Evasive_Malware_Final checks for VM artifacts, analysis tools, and RDTSC-based timing evasion into a single detection logic to identify suspicious behavior.

[[File:FinalRulesEvasive.png|500px]]

The condition uint16(0) == 0x5A4D specifically targets the "MZ" magic bytes at the beginning of the file. This ensures the rule only scans Windows Portable Executable files:

[[File:Condition.png|300px]]

A hex dump of a benign sample (notepad.exe) confirms the presence of the signature 4d 5a:

[[File:Stringheader.png|400px]]

== Used Hardware ==

CPU: AMD Ryzen 7 5800X
RAM: 32 GB DDR4 System Memory
GPU: NVIDIA GeForce RTX 3070 Ti

== References ==

* https://remnux.org/
* https://yara.readthedocs.io/en/latest/
* https://github.com/virustotal/yara/releases
* https://bazaar.abuse.ch/ (Sample Source)
* https://learn.microsoft.com/en-us/windows/win32/debug/pe-format

[[Category:Documentation]]

File:Stringheader.png

2026-01-19T19:28:59Z

PPfaffl:

File:Condition.png

2026-01-19T19:28:13Z

PPfaffl:

File:FinalRulesEvasive.png

2026-01-19T19:26:13Z

PPfaffl:

File:FinalRule.png

2026-01-19T19:22:55Z

PPfaffl:

File:Copyexe.png

2026-01-19T17:53:40Z

PPfaffl:

File:WindowsIP.png

2026-01-19T17:43:26Z

PPfaffl:

File:IPA.png

2026-01-19T17:37:25Z

PPfaffl:

File:RemnuxIPTable.png

2026-01-19T17:33:33Z

PPfaffl:

File:IPForwarding.png

2026-01-19T17:31:27Z

PPfaffl:

File:EvasiveMalware.png

2026-01-19T17:13:49Z

PPfaffl:

File:Malware.png

2026-01-19T17:11:13Z

PPfaffl:

File:Adapter2.png

2026-01-19T16:56:04Z

PPfaffl:

File:Adapter1.png

2026-01-19T16:54:38Z

PPfaffl:

File:SharedFolder.png

2026-01-19T16:46:43Z

PPfaffl:

File:USB.png

2026-01-19T16:46:04Z

PPfaffl:

File:DragAndDrop.png

2026-01-19T16:44:13Z

PPfaffl:

File:SharedClipboard.png

2026-01-19T16:40:43Z

PPfaffl:

NFCGate: Setup and Execution of a Relay Attack

2025-07-04T20:40:29Z

PPfaffl:

== Summary ==

We used NFCGate to do a relay attack. In this attack, the data from a real card is sent to a phone and then to the card reader. The card doesn’t need to be close to the reader. This can be used to trick the system, for example in contactless payments or door access.

== Architecture ==

The following diagram illustrates the architecture we used to implement our relay attack. One smartphone functions as the Tag, while the other acts as the Reader. Communication between the two devices is routed through a server, which for the purpose of this project, was hosted on a laptop.

[[File:Architecture.jpg|500px]]

== Requirements ==

=== smartphone Applications ===
* Magisk v26.0 [1]
* LineagesOS v18.1 [2]
* NFC Gate [[#Smartphones|install NFC Gate]]
=== Laptop Applications ===
* NFC Gate Server [[#Ubuntu Server|install NFC Server]]

== Installation ==

=== Smartphones ===

==== Download NFC Gate ====

Download the APK v2.4.4.apk: [https://github.com/nfcgate/nfcgate/releases Download NFCGate]

==== Install NFC Gate ====

Install via ADB:

adb install Downloads/NFCGate.2.4.4.apk

=== Ubuntu ===

==== Download NFC Server ====

Create a folder:

mkdir nfcGate
cd nfcGate

==== Install NFC Server ====

Clone the repository:

sudo git clone https://github.com/nfcgate/server.git

== Attack ==

=== Hotspot ===

Enable hotspot from smartphone and connect the server (Ubuntu)

=== Run server ===

go to the folder:

cd nfcGate/server

run the server:

python3 server.py

[[File:ServerListening.png|550px]]

=== Ip server ===

Check the IP address (from hotspot)

ip a

[[File:IpHotspot.png|450px]]

=== NFC Gate settings ===

Open the NFCGate app and go to settings:

[[File:AppNFCGate.png|150px]] [[File:NfcGateMenue.jpg|150px]]

Go to "Hostname and Port":

[[File:HostnamePortnumber.jpg|150px]]

The hostname is the same IP address as the server:

[[File:NFCGateHostname.jpg|150px]] [[File:IpHotspot.png|450px]]

Port number is always '''5566''':

[[File:NFCGatePortnumber.jpg|150px]]

In the NFCGate app, go to '''Relay mode'''.
Use the '''Tag''' option for the card and the '''Reader''' option for the NFC terminal.

[[File:RelayModeReaderTag.jpg|200px]]

Now you have a connection through the server:

[[File:ConnectionStatus.jpg|200px]]

=== Relay Attack ===

Hold the smartphone with the '''Tag''' side near the card:

[[File:SmartphoneToCard.jpeg|150px]]

Hold the smartphone with the '''Reader''' side near the terminal:

[[File:PhoneToAutomate.jpg|200px]]

== Used Hardware ==

* 2 Smarthones with root and [[https://github.com/nfcgate/nfcgate/blob/v2/doc/Compatibility.md Compatibility]]
* Laptop as Server [[https://ubuntu.com/download/desktop Ubuntu]]

== References ==

* 1. https://github.com/topjohnwu/Magisk/releases
* 2. https://github.com/LSPosed/LSPosed
* https://github.com/nfcgate/nfcgate
* https://github.com/nfcgate/nfcgate/blob/v2/doc/Compatibility.md
* https://github.com/nfcgate/server
* https://ubuntu.com/download/desktop

[[Category:Documentation]]

NFCGate: Setup and Execution of a Relay Attack

2025-07-03T17:44:16Z

PPfaffl:

== Summary ==

We used NFCGate to do a relay attack. In this attack, the data from a real card is sent to a phone and then to the card reader. The card doesn’t need to be close to the reader. This can be used to trick the system, for example in contactless payments or door access.

== Architecture ==

The following diagram illustrates the architecture we used to implement our relay attack. One smartphone functions as the Tag, while the other acts as the Reader. Communication between the two devices is routed through a server, which for the purpose of this project, was hosted on a laptop.

[[File:Architecture.jpg|500px]]

== Requirements ==

=== smartphone Applications ===
* Magisk v26.0 [1]
* LineagesOS v18.1 [2]
* NFC Gate [[#Smartphones|install NFC Gate]]
=== Laptop Applications ===
* NFC Gate Server [[#Ubuntu Server|install NFC Server]]

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Installation ==

=== Smartphones ===

==== Download NFC Gate ====

Download the APK v2.4.4.apk: [https://github.com/nfcgate/nfcgate/releases Download NFCGate]

==== Install NFC Gate ====

Install via ADB:

adb install Downloads/NFCGate.2.4.4.apk

=== Ubuntu ===

==== Download NFC Server ====

Create a folder:

mkdir nfcGate
cd nfcGate

==== Install NFC Server ====

Clone the repository:

sudo git clone https://github.com/nfcgate/server.git

== Attack ==

=== Hotspot ===

Enable hotspot from smartphone and connect the server (Ubuntu)

=== Run server ===

go to the folder:

cd nfcGate/server

run the server:

python3 server.py

[[File:ServerListening.png|550px]]

=== Ip server ===

Check the IP address (from hotspot)

ip a

[[File:IpHotspot.png|450px]]

=== NFC Gate settings ===

Open the NFCGate app and go to settings:

[[File:AppNFCGate.png|150px]] [[File:NfcGateMenue.jpg|150px]]

Go to "Hostname and Port":

[[File:HostnamePortnumber.jpg|150px]]

The hostname is the same IP address as the server:

[[File:NFCGateHostname.jpg|150px]] [[File:IpHotspot.png|450px]]

Port number is always '''5566''':

[[File:NFCGatePortnumber.jpg|150px]]

In the NFCGate app, go to '''Relay mode'''.
Use the '''Tag''' option for the card and the '''Reader''' option for the NFC terminal.

[[File:RelayModeReaderTag.jpg|200px]]

Now you have a connection through the server:

[[File:ConnectionStatus.jpg|200px]]

=== Relay Attack ===

Hold the smartphone with the '''Tag''' side near the card:

[[File:SmartphoneToCard.jpeg|150px]]

Hold the smartphone with the '''Reader''' side near the terminal:

[[File:PhoneToAutomate.jpg|200px]]

== Used Hardware ==

* 2 Smarthones with root and [[https://github.com/nfcgate/nfcgate/blob/v2/doc/Compatibility.md Compatibility]]
* Laptop as Server [[https://ubuntu.com/download/desktop Ubuntu]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* 1. https://github.com/topjohnwu/Magisk/releases
* 2. https://github.com/LSPosed/LSPosed
* https://github.com/nfcgate/nfcgate
* https://github.com/nfcgate/nfcgate/blob/v2/doc/Compatibility.md
* https://github.com/nfcgate/server
* https://ubuntu.com/download/desktop

[[Category:Documentation]]

NFCGate: Setup and Execution of a Relay Attack

2025-07-03T17:43:32Z

PPfaffl: NFCGate install and Attack

== Summary ==

We used NFCGate to do a relay attack. In this attack, the data from a real card is sent to a phone and then to the card reader. The card doesn’t need to be close to the reader. This can be used to trick the system, for example in contactless payments or door access.

== Architecture ==

The following diagram illustrates the architecture we used to implement our relay attack. One smartphone functions as the Tag, while the other acts as the Reader. Communication between the two devices is routed through a server, which for the purpose of this project, was hosted on a laptop.

[[File:Architecture.jpg|500px]]

== Requirements ==

=== smartphone Applications ===
* Magisk v26.0 [1]
* LineagesOS v18.1 [2]
* NFC Gate [[#Smartphones|install NFC Gate]]
=== Laptop Applications ===
* NFC Gate Server [[#Ubuntu Server|install NFC Server]]

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Installation ==

=== Smartphones ===

=== Magisk ===

=== LSPosed ===

==== Download NFC Gate ====

Download the APK v2.4.4.apk: [https://github.com/nfcgate/nfcgate/releases Download NFCGate]

==== Install NFC Gate ====

Install via ADB:

adb install Downloads/NFCGate.2.4.4.apk

=== Ubuntu ===

==== Download NFC Server ====

Create a folder:

mkdir nfcGate
cd nfcGate

==== Install NFC Server ====

Clone the repository:

sudo git clone https://github.com/nfcgate/server.git

== Attack ==

=== Hotspot ===

Enable hotspot from smartphone and connect the server (Ubuntu)

=== Run server ===

go to the folder:

cd nfcGate/server

run the server:

python3 server.py

[[File:ServerListening.png|550px]]

=== Ip server ===

Check the IP address (from hotspot)

ip a

[[File:IpHotspot.png|450px]]

=== NFC Gate settings ===

Open the NFCGate app and go to settings:

[[File:AppNFCGate.png|150px]] [[File:NfcGateMenue.jpg|150px]]

Go to "Hostname and Port":

[[File:HostnamePortnumber.jpg|150px]]

The hostname is the same IP address as the server:

[[File:NFCGateHostname.jpg|150px]] [[File:IpHotspot.png|450px]]

Port number is always '''5566''':

[[File:NFCGatePortnumber.jpg|150px]]

In the NFCGate app, go to '''Relay mode'''.
Use the '''Tag''' option for the card and the '''Reader''' option for the NFC terminal.

[[File:RelayModeReaderTag.jpg|200px]]

Now you have a connection through the server:

[[File:ConnectionStatus.jpg|200px]]

=== Relay Attack ===

Hold the smartphone with the '''Tag''' side near the card:

[[File:SmartphoneToCard.jpeg|150px]]

Hold the smartphone with the '''Reader''' side near the terminal:

[[File:PhoneToAutomate.jpg|200px]]

== Used Hardware ==

* 2 Smarthones with root and [[https://github.com/nfcgate/nfcgate/blob/v2/doc/Compatibility.md Compatibility]]
* Laptop as Server [[https://ubuntu.com/download/desktop Ubuntu]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* 1. https://github.com/topjohnwu/Magisk/releases
* 2. https://github.com/LSPosed/LSPosed
* https://github.com/nfcgate/nfcgate
* https://github.com/nfcgate/nfcgate/blob/v2/doc/Compatibility.md
* https://github.com/nfcgate/server
* https://ubuntu.com/download/desktop

[[Category:Documentation]]

File:Architecture.jpg

2025-07-03T13:48:41Z

PPfaffl:

File:SmartphoneToCard.jpeg

2025-07-03T13:33:10Z

PPfaffl:

File:PhoneToAutomate.jpg

2025-07-03T13:32:25Z

PPfaffl:

File:ConnectionStatus.jpg

2025-07-03T13:24:53Z

PPfaffl:

File:RelayModeReaderTag.jpg

2025-07-03T13:09:44Z

PPfaffl:

File:NFCGatePortnumber.jpg

2025-07-03T12:44:21Z

PPfaffl:

File:NFCGateHostname.jpg

2025-07-03T12:43:08Z

PPfaffl:

File:HostnamePortnumber.jpg

2025-07-03T12:41:36Z

PPfaffl:

File:NfcGateMenue.jpg

2025-07-03T12:35:24Z

PPfaffl:

File:AppNFCGate.png

2025-07-03T12:25:25Z

PPfaffl:

File:IpHotspot.png

2025-07-03T12:18:26Z

PPfaffl:

File:ServerListening.png

2025-07-03T11:54:09Z

PPfaffl: