25

YARA – The pattern matching swiss knife for malware researchers

 5 years ago
source link: https://www.tuicool.com/articles/iAJ3aq3
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
neoserver,ios ssh client

YARA in a nutshell

YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings and a boolean expression which determine its logic. Let's see an example:

rule silent_banker : banker
{
    meta:
        description = "This is just an example"
        thread_level = 3
        in_the_wild = true

    strings:
        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}
        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}
        $c = "UVODFRYSIHLNWPEJXQZAKCBGMT"

    condition:
        $a or $b or $c
}

The above rule is telling YARA that any file containing one of the three strings must be reported as silent_banker . This is just a simple example, more complex and powerful rules can be created by using wild-cards, case-insensitive strings, regular expressions, special operators and many other features that you'll find explained in YARA's documentation .

YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the yara-python extension.

If you plan to use YARA to scan compressed files (.zip, .tar, etc) you should take a look at yextend , a very helpful extension to YARA developed and open-sourced by Bayshore Networks.

Additional resources

If you plan to use YARA to scan compressed files (.zip, .tar, etc) you should take a look at yextend , a very helpful extension to YARA developed and open-sourced by Bayshore Networks.

Additionally, they guys from InQuest have curated an aweseome list of YARA-related stuff .

Who's using YARA

Are you using it? Want to see your site listed here?


report

Recommend

About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK