Module 13 · Malware Family Classification

Last updated: April 29, 2026

Classifying samples by family enables tracking actor evolution. YARA is the de-facto language.

YARA basics

rule MyMalware_v2 {
    meta:
        author = "RingSafe"
        family = "Cobalt Strike"
        version = "4.x"
    strings:
        $beacon_str = "Mozilla/5.0 (Windows NT 6.1)" wide
        $config_marker = { 00 01 00 0E ?? ?? }
    condition:
        uint16(0) == 0x5A4D and any of them
}

Tools

• YARA — pattern matching
• ssdeep / TLSH / pHash — fuzzy hashing for similarity
• VirusTotal vhash — proprietary similarity
• capa — Mandiant’s capability detection (FLOSS-style)

Workflow

1. Acquire sample
2. Static analysis — strings, imports, structure
3. Run existing YARA rules — known family?
4. If novel, write detection rule
5. Hunt for similar samples in retro