Investigating a Malware Hash Using AlienVault OTX and Creating a YARA Detection Rule

Threat intelligence investigations often start with very little information. Sometimes a security team receives only a file hash and must determine whether it is malicious, what infrastructure it uses, and how it can be detected in the future.

In this investigation scenario, a newly established organization was building its threat intelligence capability. As part of a security risk assessment, the security team received a single file hash and was tasked with performing malware research on it. The objective was to identify the threat, extract indicators of compromise, and create a detection rule that could help identify similar malware in the future.

This article walks through the complete process of analyzing the hash using AlienVault OTX, extracting threat indicators, and writing a YARA rule for malware detection.

Scenario

A security team responsible for protecting a database-heavy infrastructure received a suspicious file hash during a threat intelligence handover. The team had to determine:

• What malware the hash belongs to • Whether the malware communicates with external infrastructure • What indicators can be used for threat detection • How to create a detection rule for identifying similar samples

The investigation environment was limited to Kali Linux and AlienVault OTX.

Step 1 — Identifying the Hash Type

The first step was to identify the type of hash that was provided.

The hash contained approximately 65 characters, which indicates it is a SHA256 hash.

Example hash:

24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c

SHA256 is a cryptographic hashing algorithm that generates a unique fingerprint for a file. Security analysts frequently use it to identify malware samples and track them across threat intelligence platforms. Preparing the SHA256 hash for threat intelligence lookup.

Step 2 — Searching the Hash in AlienVault OTX

After identifying the hash type, the next step was to search the hash in AlienVault OTX.

OTX is a collaborative threat intelligence platform where security researchers share indicators related to malware, attacks, and malicious infrastructure.

By searching the hash in OTX, the investigation revealed several important details.

Threat Intelligence Results

Associated IP Addresses

• 78.46.218.253
• 144.217.74.156

Associated Domain

• www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

Malware Tags Identified

• Ransomware
• WannaCry
• Malware
• Zeppelin
• W32.Bloat-A
• Zero-Day-Delivery

The results strongly indicated that the hash belonged to the infamous WannaCry ransomware family.

Threat intelligence details retrieved from AlienVault OTX.

Step 3 — Understanding the WannaCry Malware

WannaCry is one of the most notorious ransomware outbreaks in cybersecurity history.

In 2017, it spread globally by exploiting a vulnerability in the Windows SMB protocol using the EternalBlue exploit.

Once executed on a system, WannaCry would:

1. Encrypt user files
2. Display a ransom note demanding Bitcoin
3. Attempt to spread across other vulnerable machines on the network

Interestingly, the malware contained a kill-switch domain. If the malware successfully connected to that domain, the infection process stopped.

The domain discovered during the investigation:

www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

This unusual domain became famous in cybersecurity history because registering it helped stop the global spread of the attack.

The WannaCry kill-switch domain discovered during threat intelligence analysis

Step 4 — Extracting Indicators of Compromise

Indicators of Compromise (IOCs) are artifacts that help security teams detect malicious activity.

Based on the threat intelligence results, the following indicators were extracted.

File Indicator

24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c

IP Indicators

78.46.218.253
144.217.74.156

Domain Indicator

www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

These indicators were added to a threat intelligence pulse in OTX so they could be shared with the wider security community.

Adding indicators of compromise to an OTX Pulse.

Step 5 — Creating a YARA Rule for Detection

To improve malware detection, a YARA rule was written based on artifacts discovered during the investigation.

YARA is widely used by malware analysts to identify malicious files based on patterns and behavioral characteristics.

The following rule was created to detect the analyzed malware sample.

rule WannaCry_OTX_Sample
{
    meta:
        description = "Detects WannaCry ransomware sample"
        author = "Yeswanth Kola"
        date = "2026-03-12"
        hash = "24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c"
  strings:
        $killswitch = "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com"
        $cmd = "cmd.exe"
        $dll = "KERNEL32.dll"
  condition:
        2 of ($*)
}

This rule detects the malware by searching for unique artifacts associated with the WannaCry sample.

Step 6 — Validating the Detection Rule

After attaching the YARA rule to the OTX Pulse, the rule was tested.

The validation result showed:

Custom YARA rule created for detecting the analyzed malware.

No false positives found

This means the rule did not incorrectly match legitimate files, making it a reliable detection rule.

False positives are a major concern in threat detection systems because they can generate unnecessary alerts and waste analyst time. Ensuring that a rule produces no false positives is an important step in rule validation.

Conclusion

This investigation demonstrated how a single file hash can reveal extensive information about a malware threat.

Using AlienVault OTX and Kali Linux, it was possible to:

• Identify the hash type • Determine that the sample belongs to the WannaCry ransomware family • Extract network infrastructure indicators • Share those indicators with the threat intelligence community • Develop a YARA rule for malware detection

Threat intelligence platforms play a crucial role in modern cybersecurity. By sharing indicators and detection rules, organizations can collaboratively defend against evolving malware threats.

Even a simple hash can uncover the story of a global cyberattack.