IRFuzz : Simple Scanner with Yara Rules

IRFuzz is a simple scanner with yara rules for document archives or any files.

Install

1. Prerequisites

Linux or OS X

  • Yara: just use the latest release source code, compile and install it (or install it via pip install yara-python)
  • Yara Rules – You may download yara rules from here or import your own custom ruleset.
  • Python dependencies

Dependencies are managed with pipenv. To get started install dependencies and activate virtual environment with following commands:

$ pipenv install
$ pipenv shell

Running IRFuzz – Watchd

Running IRFuzz

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv

Supported Features

  • Scans new files with inotify
  • Polling if inotify is not supported
  • Custom extensions are supported
  • Delete mode will delete matched file
  • Recursive directory scan
  • Lists matched Yara functions with yarastrings with ctime
  • CSV results for Filebeat

Custom Extensions

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv --extensions .zip,.rar

Alert Matching Yara Rule

Generate token from https://irfuzz.com/tokens

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv --extensions .php --token tokenhere

Configure alerts from the website to Telegram or your email.

Delete Matched File

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv --delete

Polling (Inotify Not Supported)

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv --polling

Adds –poll option to force the use of polling mechanism to detect changes in data directory. Polling is slower than the underlying mechanism in OS to detect changes but it’s necessary with certain file systems such as SMB mounts.

  • Default Extensions If No Extensions Are Mentioned
    • Microsoft Office Word supported file formats
      • .doc .docm .docx .docx .dot .dotm .dotx .odt
    • Microsoft Office Excel supported file formats
      • .ods .xla .xlam .xls .xls .xlsb .xlsm .xlsx .xlsx .xlt .xltm .xltx .xlw
    • Microsoft Office PowerPoint supported file formats
      • .pot .potm .potx .ppa .ppam .pps .ppsm .ppsx .ppt .pptm .pptx .pptx .pptx
    • zipdump.py
R K

Recent Posts

Cybersecurity – Tools And Their Function

Cybersecurity tools play a critical role in safeguarding digital assets, systems, and networks from malicious…

2 hours ago

MODeflattener – Miasm’s OLLVM Deflattener

MODeflattener is a specialized tool designed to reverse OLLVM's control flow flattening obfuscation through static…

2 hours ago

My Awesome List : Tools And Their Functions

"My Awesome List" is a curated collection of tools, libraries, and resources spanning various domains…

2 hours ago

Chrome Browser Exploitation, Part 3 : Analyzing And Exploiting CVE-2018-17463

CVE-2018-17463, a type confusion vulnerability in Chrome’s V8 JavaScript engine, allowed attackers to execute arbitrary…

2 hours ago

Chrome Browser Exploitation, Part 1 : Introduction To V8 And JavaScript Internals

The blog post "Chrome Browser Exploitation, Part 1: Introduction to V8 and JavaScript Internals" provides…

2 hours ago

Chrome Browser Exploitation, Part 3: Analyzing and Exploiting CVE-2018-17463

The exploitation of CVE-2018-17463, a type confusion vulnerability in Chrome’s V8 JavaScript engine, relies on…

5 hours ago