The rule that cannot read UTF-16

A credential-stealer rule finds the C build but misses the .NET build. Look at how Windows programs store strings, add the wide modifier, and rescan.

Terminal mission
Beginner
3 objectives
0 of 3 solved

Briefing

The intel team shared four builds of the same browser-password stealer. The rule in rules/v1.yar catches only some of them.

Many Windows programs, and .NET ones in particular, store strings as UTF-16: every character followed by a zero byte. A YARA text string is ASCII unless you add wide.

analyst@detect-lab

detect-lab · YARA triage

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@detect-lab:~$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.