start	end	text
0	1660	We're gonna get started right away.
1660	4820	It is my pleasure to introduce an old friend of ours,
4820	5940	Ghida Liabari.
5960	8780	Thank you so much.
8780	9920	Thanks, everyone.
10000	12040	Thanks for your patience, first of all,
12040	14640	and thanks for coming to my presentation.
14780	17300	I'm going to talk about Yalda.
17520	20920	It's an automated tool that I wrote recently,
20920	22200	one of my recent projects,
22200	24200	and I thought to share it with you.
24700	27560	I work for Fidelity Cyber Security,
29500	31520	and I'm going to talk about Yalda.
31560	34520	So, we are going to talk about
34520	36920	having an introduction of Yalda,
36920	40080	how was it created, and what was the object of it.
40080	42500	Then, how could you use Yalda,
42500	44780	and what it could get used.
44900	48820	Then, we are going to have an overview of
48820	50840	architecture of Yalda,
51100	52800	a quick demonstration,
52800	56000	and a GitHub that you can go ahead and download it,
56000	59920	and start using it on your own files.
59920	62720	Using it is actually pretty much simple,
62720	66060	it's just going and clicking on a file
66060	69200	to configure and add some directories to it.
71840	73840	So, introducing Yalda.
76680	80200	The motivation was basically creating a tool
80200	83360	that analyzes files and gives you some indicators
83360	88360	that saves time for repeating the job
88360	90520	for each single file.
90520	95660	And also, it was just for fully understanding
95660	97860	what the file does,
97860	102880	and creating automated bulk intelligence collection.
103520	106880	And sort of being independent of other sources,
106880	107980	third parties.
107980	110720	So, that was the motivation.
113020	116500	So, that guy in the back, John Baminak,
116500	118000	he actually is my boss,
118000	120980	and he passed me a project to start with.
120980	127280	So, he started giving me some files,
127280	131280	massive files, I mean millions of files in directories,
131280	132960	and they were all compressed,
132960	135280	and they were in JSON format,
135280	138740	each one of them had a dictionary inside it,
138740	144100	and then the dictionary had information about the emails,
144840	147120	like each dictionary was corresponding
147120	148740	to a malicious email.
148740	151500	It has all the key and values, of course, for that one,
151500	155100	and it has some mime-encoded keys
155720	158220	that the values were there.
158220	159140	If you decode them,
159140	161220	then you would be able to download the files.
161220	163480	So, that is how Yalda was born.
163480	165800	I started analyzing them manually,
165800	167960	and then figured out that, yeah,
167960	171380	campaign from the same sort of campaigns,
171380	176060	although the format and everything
176060	177520	is a little bit different,
177520	180580	but the fingerprint and the way that they are introducing stuff
180580	181920	is almost the same.
181920	184280	And I figured out that it could get automated.
184280	185840	This is just like an example.
185840	187160	By just looking at it,
187160	189700	I found out that this just doesn't make sense.
189700	191040	This is malicious.
191100	193540	I mean, I would be able to just say by a glance
193540	194460	that this is malicious.
194460	195620	Look at the from.
195700	197440	It's coming from Russia,
197440	199540	and it's saying that USPS ground.
199540	200560	I mean, come on.
203020	205980	And so, the analyzing JSON file,
205980	207080	each dictionary,
207080	209400	this is just like the process of automation
209400	213320	that I would get the base 64 encoded MIME,
213320	214140	which was the key,
214140	216060	and then the value decoded it,
216060	218640	and getting a couple of files.
218640	220760	The most important one was the file
220760	223660	that I was getting that had the attachments.
223700	226740	And then, looking at the attachments,
227080	230540	this was, again, for a particular campaign,
230540	232540	it was almost the same.
232540	234240	Like, the domains were the same.
234240	235380	The domains were different,
235380	237000	but the structure was the same.
237000	239640	So, I started writing an automated tool
239640	241560	for extracting the information.
241560	244440	The steps was pretty much like following
244440	246790	whatever I'd done manually.
247120	251760	It was... yeah, it works at least.
251860	254480	So, I was getting the JSON MIME,
254480	257540	analyze keys, analyze from address,
257540	259280	analyze the body,
259280	261700	get base 64 encoded data, decode it,
261700	264140	download attachments, analyze files,
264140	265940	and extract domains.
266220	271360	So, that's how YALDA started working.
271400	272960	So, manual analysis,
272960	274840	non-process for automation,
274840	276480	automating it, YALDA,
276480	278960	and then adding more and more to it.
279020	280500	YALDA was born.
281060	285580	So, as I was extracting information,
285580	287420	then I started just talking to analysts
287420	288520	and then asking,
288520	291480	what do you guys do for getting more information?
291480	294240	And then I made YALDA somehow
294240	296580	that it does all of this stuff.
296580	298760	Automated Bulk Intelligence Collection,
298760	301140	it's a file scanner and analyzer,
301140	303260	extracts data,
303260	304560	cluster files,
304560	307400	and it categorizes files.
310180	313080	So, Automated Bulk Intelligence Collection Tool,
313080	317540	it has an automated process of analyzing files.
317540	321100	It applies intelligence in collected data
321100	325200	and clusters files based on the similarities.
326480	329060	It's a file scanner and analyzer.
329060	331940	YALDA scans and analyzes files.
331940	335160	It collects detailed information of the file.
335160	337820	About 20 indicators are being extracted
337820	340200	from each single file.
340200	341720	And it makes it possible...
341720	344200	How many of you guys are analysts here?
344940	347720	Okay, so it makes it possible for you guys,
347720	352760	instead of hours of doing sort of like analyzes,
352760	355320	you just run YALDA on the set of files,
355320	358060	let's say even like a million samples that you have,
358060	360780	and then it's going to analyze each single one of them
360780	364260	and it's going to give you some indicators,
364260	366860	like 20 indicators is going to be extracted.
366860	368960	Then based on whatever you are looking for
368960	370900	and whatever interests you,
370900	372860	it is going to extract the information
372860	375900	that is valuable for you guys.
375900	377360	So you can just like apply your filter
377360	379700	and you can extract the information.
381900	384060	It also extracts data,
384060	385960	like it collects embedded objects
385960	390820	and also it collects malicious URL and domains.
392960	395340	And it categorizes files.
395340	397000	There is like a flag and severity
397000	400220	that in combination they are being used.
400220	402660	So depending on the algorithm
402660	404200	that is being applied to the file
404200	406400	and the founding of the file,
406580	409100	a file could be categorized as clear
409100	411960	with a low severity like a 1 and 2,
411960	416460	suspicious with higher severity,
416460	419260	and malicious, of course, higher severity.
419680	421400	It also clusters data.
421400	425160	It gets the... if there is a malicious hash
425160	426280	that it detects,
426280	428570	it's going to cluster the strings
428820	430320	out of the file
430320	432180	and it's going to insert it
432180	433490	in a different collection.
433880	437260	Same applies if it is an executable file
437260	438640	that is malicious.
438640	442960	It is going to get the names of P sections,
442960	444260	convert it to SHA-1,
444260	446860	and in combination of the hash
446860	449530	and channel entropy is going to use it.
451340	453840	Now, what to do with Yalda
453840	455510	and when to use it.
455510	457770	So if you want to have a feed,
457950	461230	a collection of feeds that you could use it,
461230	464150	you could go ahead and just submit files to Yalda
464150	466550	and it could be used for extracting
466550	469250	MD5 feed, domain feed, URL feed,
469250	470630	all of them malicious.
471770	474290	Also, as I said,
474290	475650	there are 20 indicators
475650	478810	that are being extracted from each single file.
478810	480010	Depending on the file type,
480010	481850	some of them might be empty.
481850	483310	Like, for example,
483310	485750	if there is no P sections in it,
485750	486870	then it's going to be empty.
486870	490190	However, you are able to get all of these,
490190	493130	like MD5, SHA-1, SHA-256,
493130	494570	similar MD5.
494590	498350	If there are some malicious MD5s
498350	500570	that are similar to this particular file
500570	501930	that you are analyzing,
501930	505250	it is going to give you a list of similar MD5s.
505250	507910	File type, if there is any malicious URL
507910	510110	that has been extracted from the file,
510110	511950	it is going to be given to you.
511950	514090	Magic literal source,
514830	516470	VirusTotal information.
516470	517930	This is basically,
517930	519930	just gives you a paramount link
519930	521590	to VirusTotal page,
521590	523090	if it exists in VirusTotal
523090	525650	with the number of positive ABN genes
525650	527550	that are able to detect it.
527590	529150	You don't have to have the key
529150	530370	or use VirusTotal.
530370	531490	You can just disable it.
531490	532890	It's not mandatory.
533070	535550	Severity and flag are being used together.
535550	538150	Severity is like clear,
538150	541930	or it could be suspicious or malicious.
541930	543150	And then the flag,
543150	544910	it could be from 1 to 5.
544910	546310	1 stands for clear,
546310	548850	and 5 stands for very malicious.
548850	550830	So it just sort of gives you a scope
550830	553470	of how the file is analyzed.
553510	555650	File name, ingest time,
555650	558270	the time that it got analyzed
558270	560930	and got inserted in database.
560930	563510	Domain list, if it has any malicious domain.
563510	566270	URL list, I'm going to go through it in detail,
566270	568510	but the list of the functions
568510	570190	in URL rules that are matching
570190	572410	the particular file is also going
572410	574350	to be extracted in a list.
574550	576310	File path and the source
576310	577610	is going to be Yalda.
577610	579150	It is just like an indicator
579150	581950	to be able to collect the information
581950	583310	from database.
583310	585550	Embedded files, the list of objects
585550	586910	that are embedded in the file
586910	589150	also is going to be displayed to you.
589150	591490	PE sections in detail
591490	592950	is going to be there.
593230	595450	Parent MD5 and parent file path,
595450	596910	if the file is embedded
596910	598650	and is being analyzed,
598650	599970	then you are going to have a link
599970	601170	to the parent.
602810	604090	So let's say
604090	605670	that you are interested to
606310	608030	like you are analyzing the
608030	609810	obtained results and you are interested
609810	612190	to extract a PDF file
612190	614430	that has embedded objects in it.
614430	616150	It has also malicious domains
616150	618150	and it is
618150	619890	malicious with a stability of five.
619890	621530	So you could go ahead and apply a filter
621530	623970	and it's going to extract the data for you.
623970	625790	So just based on the indicators,
625790	627530	it is possible that you
627530	630470	select exactly what you are looking for.
630650	631810	It's a good source
631810	633650	for generating YARA rules
633650	635890	because it has detailed information about it
635890	637690	and if it is malicious, also it's going
637690	639750	to have strings out of it and PE sections
639750	641830	so you can use it as a good
641830	643410	source for writing your
644130	645530	YARA rules.
647170	648450	It's a
648450	650090	smart feed to Cocoa
650090	652250	Sandbox. Again, you don't want to submit
652250	653950	everything to Cocoa Sandbox, but if
654190	655370	there is a specific malicious
655370	657290	characteristic that you are interested in,
657290	659390	you can go ahead and start
659390	661250	feeding that category
661250	663570	to Sandbox
663570	665730	to see what is happening next.
667670	668050	YALDA
668050	668730	Architecture
670710	671710	Basically,
671710	673250	the architecture could be
673250	677210	categorized in four sections.
677210	678130	File,
678130	679630	you submit it,
679630	681750	then extract files,
681750	683610	it starts extracting files,
683610	685590	and then it starts analyzing and
685590	687490	scanning every single file
687490	689450	that has been extracted, and then
689450	691870	inserts data in database.
694210	695770	Extracting files is done
696410	697550	so mainly
697550	698970	what you need to have is
698970	700810	you need to have a directory
701590	703730	in your Linux box and dump
703730	705470	all of the subfolders and
705470	707690	files that you want, any type.
707690	709590	It could be compressed, it could be JSON,
709590	711130	it could be encoded
711130	713030	MIME, and
713030	715270	what it does, it goes through each single
715270	717010	one of them and it starts extracting
717010	718270	the files.
718950	720270	If it is
720930	723090	compressed file, it's going to uncompress it.
723090	725070	If it is having many
725070	726950	different subfolders, like what
726950	729090	my boss initially passed me, it's
729090	731010	going to walk through each single
731010	732950	folder and extract every
732950	734410	single file, and
734910	737010	again, if it is in
737010	738790	mail format, it's going to
738790	740670	download the mail attachments.
740670	742770	So you're going to get a list of smaller
742770	744730	files, and then for each file
744730	747430	it's going to apply foremost in it.
747470	748710	Now, when foremost
748710	750550	gets applied, it's going to have
750550	752850	sort of like children, embedded objects
752850	755110	in it. And not only it's going to
757030	758750	analyze the parent's file, but
758750	760710	it's going to analyze all the
760710	762790	children of the file, and each
762790	764810	one of them is going to be sent to the decoder
764810	766770	and it's going to get analyzed through
766770	767710	Yalda.
769070	770610	Decoding files.
770990	772870	Let me just put a pause
772870	775190	here and see,
775190	776170	like,
776710	778750	just want to ask you, how many of you
778750	780650	do automated process for
781690	782730	extracting information
782730	783930	of a file?
785130	786790	So the first thing that you would
786790	788530	do is manual
788530	790750	analysis. It's just like you have to
790750	792690	know what you are looking for,
792690	794630	and you have to know what is this malicious
794630	796530	file doing. And then you would need
796530	798490	to have a couple of samples to see what
798490	800330	is common between these.
800390	802570	The decoder part is actually written based
802570	804590	on the same thing here, that I
804590	806530	told you. So, based on
806530	808410	the file type, how Yalda
808410	810550	is designed, based on the file type, it's
810550	812990	going to apply,
812990	814410	it's going to send the file
814410	816350	to a set of decoders,
816350	818470	and then if there is a match with one
818470	820410	of the decoders or more, it's going to
820410	822230	just like flag it and go further
822230	824570	and see what could be extracted from it.
824570	826230	If there is any domain or
826230	828250	URL that could be matched, it's going to
828250	830790	extract it, and then it's going to flag the file.
831050	832470	Now,
832470	834310	the decoders, the way that they are written
834310	836230	is they,
836930	837810	as I said,
838430	840610	sort of like manual analyzer, detects
840610	842310	the malware, detects the campaign, and
842310	844490	starts analyzing them, one by one
844490	846230	sort of, and see what is the common
846230	848070	part that is being repeated.
848130	850030	When you know that part, then you can start
850030	851990	automation, and you can write the decoder
851990	853970	for it. That's how it's done, actually,
853970	854910	in Yalda.
856290	858130	Analyze known malicious samples
858130	860090	from fingerprints.
861610	862210	CVE2017
862930	863530	0199
864130	865970	Who heard of it?
866350	867690	Yeah, cool.
867690	869450	So, we know that it's
869450	872010	an RTF file with embedded
872010	873950	OLE object, and
873950	876030	it has a link,
877470	878150	like,
878150	879950	something like this, and then
879950	882030	analyzing all of them, we
882030	883630	can just extract the
883630	886050	comment section out of it,
886050	888250	because you see that it has a
888250	890430	link to download the embedded doc,
890430	892470	and what it does is actually,
892470	894310	as you see, this is the common part.
894310	896030	So if you start
896830	899290	parsing the file,
899470	900390	and write a regex
900390	902250	for it to see if
902250	903850	it is RTF file, go ahead and just
904590	905950	analyze it and see
905950	907890	if there is a pattern match
907890	910070	with this regex, then you could extract
910070	912550	the URL, just as simple as this.
914150	916090	This is, like, an analysis
916090	918510	that is done in one of the RTF files.
918510	920030	So, these are the information
920030	921870	that Yalda extracted.
922190	924530	The MD5, SHA1, SHA256,
924530	925790	size of file, magic
925790	928150	literal, file type, file name,
928150	929910	and then the severity is 5,
929910	931670	the highest severity, and it's
931670	933670	flagged as malicious. This is the
933670	935690	domain that has been extracted from this
935690	937470	particular file. There is no
937470	939810	piece section, of course. The source is
939810	941650	Yalda mining data. This is just an
941650	943430	indicator that I used.
943830	945990	And vtinfo,
945990	947910	if you want to have information,
947910	949590	this is, like, the AVN genes that are
949590	950950	able to detect it, and
951750	953630	paramelling to get detailed
953630	955550	information from VirusTotal.
955550	957550	URL list, it's empty because
957550	960410	I didn't apply any URL rules on it.
960410	962250	This is actually the dictionary
962250	964510	format of the output of Yalda,
964510	966450	and it's just, like, everything that I just told
966450	968430	you, it is going to be in dictionary format
968430	970610	and it's going to be inserted in database.
970650	972350	If you're interested to have it in JSON
972350	974390	format, it could be done easily, and you can
974390	977010	just have the information on Splunk.
979290	980430	When I talk
980430	982370	to analysts, usually they say
982370	984530	that, yeah, detecting a malware
984530	986830	is just like a chain of detection,
986830	988410	and usually it's just not
988410	990450	just one file, it's just a combination
990450	992530	of steps that is being done.
992530	994290	So it's really important to detect
994290	996350	the first chain, and then
996350	998270	start analysing it.
999290	1000430	So there was
1000430	1002490	actually an email campaign that
1002490	1004470	was going on, and it was sending
1004470	1006410	PDF attachments, and
1006410	1008610	none of the AVN genes were able to detect
1008610	1010410	it. When it was
1010410	1012650	analysed, we found out that there is
1012950	1014330	a URL list embedded
1014330	1016650	in the PDF file, the URL
1016650	1018630	downloads JavaScript,
1018630	1021090	JavaScript has a link to a
1021090	1023470	URL, URL downloads
1023470	1024850	another executable file, so it's
1024850	1026930	just like a chain, right? But how
1026930	1028930	about if we just
1028930	1031070	detect the first chain, and just
1031070	1033110	understand that, okay, this is a
1033110	1034950	PDF file, and it is matching
1034950	1038910	with this particular chain.
1038910	1040830	Then we have the flag, right? Then we have
1040830	1043290	the flag that this is suspicious, at least.
1043290	1044670	And then we even can
1044670	1046750	extract the URL that is the first
1046750	1049010	URL that it's pointing.
1049010	1050630	So that we can just extract it,
1050630	1052770	have the information, and if you want, you can send it
1052770	1055250	to Kuku Sandbox for detailed information.
1055990	1056450	Applying
1056450	1058490	Yara rules. So I am not
1058490	1060570	giving you any Yara rules
1060570	1062810	myself, but Yalda is able to
1064070	1064630	apply
1064630	1066630	Yara rules on the given
1066630	1068270	files. There is just like
1069510	1070450	sort of like
1070450	1072650	enable, disable line
1072650	1074630	that you need to enable or disable it in the
1074630	1076690	config file, and then you would need to
1076690	1078750	pass some of the Yara rules
1078750	1080830	that interest you based
1080830	1082930	on your needs in a directory.
1082930	1084610	It goes to that directory if it is
1084610	1086910	enabled, and then applies every single
1086910	1088690	Yara rule to the file.
1088690	1091010	And if there is a match with one of the functions,
1091010	1092790	it's going to extract the file
1092790	1094610	and it's going to show you as a list
1094610	1096330	of the files that has been
1096330	1098810	extracted. So according
1098810	1100590	to the match, and according to the
1100590	1102530	number of functions that are
1102530	1104510	similar, it's going to get flagged as
1104510	1106510	malicious, suspicious, or clear
1106510	1107890	with appropriate
1108750	1110590	severity. Yalda
1110590	1112870	scoring is actually the brain in Yalda
1112870	1114630	because everything so far that
1114630	1116490	I told you, you should know
1116490	1118490	that there is a malicious file, or
1118490	1120250	there is a malicious campaign, and then
1120250	1122530	you have to write the decoder, so there are
1122530	1123830	none. It's not like
1124490	1126650	something new get detected. But
1126650	1128410	this method is somehow
1128410	1130430	based on similarities.
1130710	1131910	And when I
1131910	1134570	find, when actually Yalda finds a file
1134570	1136530	that is malicious, then it starts
1136530	1138350	clustering the strings.
1138350	1140250	So it applies clusters
1140250	1142090	on strings, and also
1142090	1144290	if it is executable and it's detected
1144290	1146210	as malicious, it's getting the
1146210	1148370	PE sections, the name
1148370	1150310	section of it, and then Shannon
1150310	1153090	entropy, and it clusters the information.
1153090	1154390	So it's something like this.
1154390	1155010	See?
1155950	1156990	The file
1156990	1158930	is detected as malicious. I'm applying
1158930	1160750	strings, and
1160750	1163050	get all of the strings out of it
1163050	1165310	and also a Unicode
1166410	1166930	string
1166930	1168530	out of it,
1168530	1171330	the Unicode strings, and then making a
1171330	1173250	list and cluster the information in
1174050	1176710	another collection.
1176710	1177370	There is
1177370	1179450	a file that I have no idea about.
1179450	1181550	Like, none of my decoders were able to
1181550	1182890	detect it, and none of the URLs were
1182890	1184830	able to detect it. Still, I apply the
1184830	1186930	strings on it. And now, based on
1186930	1188830	the similarities that I find with
1188830	1190650	these strings, the list of strings
1190650	1192810	found here, and the list of malicious
1192810	1194890	strings in my database, I
1194890	1196490	start scoring it.
1196630	1198510	How many files have been detected
1198510	1200410	malicious that are having similar
1200410	1203110	strings as the list of this file?
1203110	1204910	So if the score goes higher,
1204910	1207050	I would say that, yeah, it is suspicious.
1207050	1208070	It needs more
1209630	1210630	analysis.
1210630	1212630	So it's based on the similarities.
1212630	1214010	Same thing is applied for
1214610	1216510	the name in p-sections and
1216510	1218990	Shannon entropy. Name of p-sections,
1218990	1220630	if the file is executable,
1220630	1222510	and if it is malicious, I'm
1222510	1224550	getting it, and then I convert
1224550	1225990	it to SHA-1.
1226090	1228310	And also, the
1228310	1230510	entropy, the Shannon entropy, I'm just
1230510	1232450	collecting these two, and I'm using
1232450	1234270	an AND logic
1234270	1236910	for these two, and the malicious hash.
1236910	1238230	And all of this information
1238230	1240230	are being clustered somewhere.
1240230	1242130	Now it's just sort of like a scaling,
1242130	1244090	again, scaling of the file
1244090	1246150	that right now I'm seeing, and
1246150	1248050	see what are the similarities. If it is
1248050	1250270	executable, then what are the similarities
1250270	1252110	between these two? And
1252110	1254230	based on the similarities and the scoring
1254230	1256130	that I set a threshold, then
1256130	1258630	I'm going to flag it as suspicious.
1260510	1262570	Now, whitelisting.
1264770	1265290	Who
1266750	1267250	handles
1267250	1268450	feeds?
1270050	1271290	So you guys
1271290	1273410	know that how life is when you have
1273410	1275030	false positives, right?
1275030	1277110	And you start using all of
1277110	1279090	the possible scenarios
1279090	1281550	and all of the cases for whitelisting.
1281550	1283710	You're going to have manual whitelisting,
1283710	1285230	you're going to have a lot of different
1285230	1287150	sources, and still you'll have some false
1287150	1288370	positives, right?
1288750	1291770	To avoid such a thing in Yalda,
1291770	1293410	I started saying that, okay, fine,
1293410	1295390	I'm going to use the traditional way.
1295390	1297230	I'm going to use a log
1297230	1298170	file for
1299170	1301850	whitelisting. But at the same time,
1301850	1303030	how about just
1303030	1305290	clustering the good guys instead of
1305290	1307150	just clustering bad guys?
1307150	1308930	So how about whitelisting
1308930	1311030	the clear files, the ones that I
1311030	1313690	know that they are clear and they are not malicious?
1313790	1315150	And then extract that
1315150	1316330	information for
1316910	1318950	using it as whitelist.
1319050	1320930	So as Yalda is running
1320930	1322970	more samples, it's going to extract
1322970	1324610	more bad stuff
1324610	1327090	and good stuff at the same time, right?
1327090	1328730	So the whitelisting is getting
1328730	1331210	stronger as the detection of
1331210	1332450	malicious
1332450	1334030	hashes also gets
1334930	1336290	stronger.
1336830	1338930	So as I said, I'm just
1338930	1340710	applying strings on
1340710	1342270	clear files and
1342930	1344970	clustering it, and also I'm clustering
1344970	1346790	the PE section names and
1346790	1349050	Shannon entropy of executable
1349050	1351490	files that are known as clear.
1351490	1353390	And then I'm using this information
1353390	1354830	sort of to whitelist
1356330	1357010	for
1357010	1359090	having more
1359090	1360890	accurate results.
1361210	1363410	Let's have a demonstration.
1364630	1367130	So here I'm having three files in
1367130	1368730	the folder and
1368730	1371370	it starts analyzing the file.
1371370	1372950	It extracts the
1372950	1375190	files and then in this
1375190	1376890	case it's downloading the attachments
1376890	1379030	and you see that there are a list
1379030	1380910	of domain lists that they are all malicious
1380910	1382950	and it's extracting it. Also
1382950	1384910	it goes and analyzes
1384910	1386950	each single file, like in detail, if
1386950	1388950	there is any embedded object, it is going
1388950	1390930	to extract it. Like in this case,
1390930	1392890	it does have embedded objects, so it just
1392890	1395070	lists the list of embedded objects
1395070	1397270	here, like embedded files.
1397310	1399010	And not only it has the
1399010	1401130	detailed information of the file itself
1401130	1402570	but it also
1403130	1404970	analyzes the embedded
1404970	1406990	file in it and it gives you
1406990	1409410	information with a link to the parent.
1410330	1411170	And everything
1411170	1412970	is being inserted in the database,
1412970	1414170	as I mentioned.
1415070	1416850	So Yalda sort of like
1416850	1418850	minimizes false
1418850	1420810	positive or better
1420810	1423130	to be said, it has better correlation.
1423370	1424870	So the way
1424870	1426790	that we are doing Yalda scoring,
1426790	1428690	we get more accurate results
1428690	1431170	because as we are analyzing
1431170	1432750	more samples, we are getting
1432750	1435370	stronger results.
1435470	1437030	Same thing for automated
1437030	1438850	whitelisting, that we are
1438850	1440950	getting better results as we start
1441630	1443550	analyzing more samples.
1443570	1444750	And then this clustering
1444750	1447030	data, again, we are having better results
1447030	1449030	and then categorizing algorithm is
1449030	1450550	somehow that
1450550	1452550	I'm not saying that if I
1452550	1454850	don't know, like it doesn't match with
1454850	1456950	my decoders, then I'm not going
1456950	1458770	to say 100% it's malicious
1458770	1460710	but it has enough
1460710	1462690	high severity that you can select
1462690	1464490	and say that, okay, this is suspicious
1464490	1466870	and there is a flag going on, so I better
1466870	1468690	start analyzing this set of files
1468690	1470490	with this criteria, because you have 20
1470490	1472810	indicators that you can select out of it.
1474810	1476790	This is the GitHub, so you can
1476790	1477870	go ahead and start
1478970	1480750	downloading and using it.
1480750	1482430	It's in Fidelis GitHub.
1491480	1492220	So there
1492220	1494280	are three folders, like bin,
1494280	1496220	source, Yara rules. Yara rules is a
1496220	1497840	place that you place your
1497840	1500100	Yara rules if you want to. If not,
1500100	1502100	you don't have to worry about it.
1502300	1503640	Bin has all the
1504120	1506100	modules and functions, as you
1506100	1508220	see here. You can even go ahead
1508220	1509900	it's just like very straight format
1509900	1511900	and you can just go ahead and if you want
1511900	1514620	to add more decoders, you can do that.
1515160	1515640	And
1515640	1517880	the config file is something that I go
1517880	1519740	through it in detail. It's very
1519740	1521900	simple, it's just like a couple of lines that
1521900	1524060	you need to specify the directories in it
1524060	1526060	and when you want to run it, run
1526060	1528480	this guy, Yalda file analyzer.
1530100	1532060	So you would need to install the
1532060	1533680	required Python modules
1534620	1536060	and you would need
1536060	1538600	these are the Python modules that you would need.
1539060	1540080	And this is the
1540080	1542160	config file. You just go ahead and open it
1542160	1542920	and start
1544300	1546000	just adding the directories
1546000	1548020	that you want or enable or disable.
1548020	1549840	Like if you don't want to have virus
1549840	1552500	total information or if you don't want to have
1552500	1554300	sort of like Yara
1554300	1556360	rule to be applied to it, you can
1556360	1558620	say that zero, just like
1558620	1560760	disable it. If you want to
1560760	1562640	sort of like have a printout, you can have
1562640	1564620	debug one or you can just make it
1564620	1566840	zero. And of course, because I'm using
1566840	1568660	MongoDB, you would need to
1568660	1570540	have MongoDB
1570540	1572400	installed and just like specify
1572400	1574580	the criteria that you're looking for.
1575200	1576560	And to run it, you
1576560	1578720	go to source and you start running
1578720	1580420	its Yalda file analyzer
1580420	1582360	and it starts analyzing each single
1582360	1585420	file in detail and passes you the information.
1585420	1586560	I'd like to talk
1586560	1588460	to... thanks to
1588460	1590360	John Bamenak, my
1590360	1592140	boss, Hardik Modi
1592140	1594280	and Chad Robertson
1594280	1595940	and Jason Reeves. They
1595940	1598540	actually gave me really great feedback
1598540	1600200	for improving Yalda
1600200	1601080	and
1602320	1604860	really appreciate all of your feedback.
1605540	1606520	So if
1606520	1608420	you need to contact me or if you
1608420	1610740	have any questions, this is my email address
1610740	1612000	or Twitter.
1613520	1615180	Thank you so much.
1615180	1616480	If you have any questions or
1617480	1617960	feedback...