Skip to content

Pithus/yara

This branch is 1 commit ahead of, 363 commits behind VirusTotal/yara:master.

Folders and files

NameName
Last commit message
Last commit date

Latest commit

author
evilcel3ri
Mar 8, 2022
991e576 · Mar 8, 2022
Oct 28, 2021
Dec 2, 2020
Feb 17, 2022
Jun 19, 2020
Mar 7, 2022
Sep 8, 2021
Mar 8, 2022
Dec 15, 2016
Dec 2, 2020
Feb 25, 2022
Dec 21, 2021
May 12, 2020
Oct 19, 2020
Dec 17, 2021
May 13, 2015
Aug 24, 2021
Jul 9, 2019
Jun 24, 2016
Aug 24, 2021
Feb 25, 2022
May 11, 2020
May 24, 2021
Dec 1, 2014
Jan 16, 2018
Feb 1, 2022
Jun 24, 2016
May 11, 2021
Oct 29, 2021
Nov 22, 2016

Repository files navigation

Join the chat at https://gitter.im/VirusTotal/yara AppVeyor build status Coverity status

YARA in a nutshell

YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a. rule, consists of a set of strings and a boolean expression which determine its logic. Let's see an example:

rule silent_banker : banker
{
    meta:
        description = "This is just an example"
        threat_level = 3
        in_the_wild = true

    strings:
        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}
        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}
        $c = "UVODFRYSIHLNWPEJXQZAKCBGMT"

    condition:
        $a or $b or $c
}

The above rule is telling YARA that any file containing one of the three strings must be reported as silent_banker. This is just a simple example, more complex and powerful rules can be created by using wild-cards, case-insensitive strings, regular expressions, special operators and many other features that you'll find explained in YARA's documentation.

YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the yara-python extension.

Additional resources

Do you use GitHub for storing your YARA rules? YARA-CI may be a useful addition to your toolbelt. This is GitHub application that provides continuous testing for your rules, helping you to identify common mistakes and false positives.

If you plan to use YARA to scan compressed files (.zip, .tar, etc) you should take a look at yextend, a very helpful extension to YARA developed and open-sourced by Bayshore Networks.

Additionally, the guys from InQuest have curated an awesome list of YARA-related stuff.

Who's using YARA

Are you using it? Want to see your site listed here?

Packages

No packages published

Languages

  • C 89.7%
  • Yacc 3.9%
  • C++ 1.8%
  • Lex 1.6%
  • Starlark 1.1%
  • M4 1.0%
  • Other 0.9%