YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings and a boolean expression which determines its logic. YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the yara-python extension. YARA-CI may be a useful addition to your toolbelt. This is GitHub application that provides continuous testing for your rules, helping you to identify common mistakes and false positives. If you plan to use YARA to scan compressed files (.zip, .tar, etc) you should take a look at yextend, a very helpful extension to YARA developed and open-sourced by Bayshore Networks.
Features
- YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples
- With YARA you can create descriptions of malware families
- Each description, a.k.a. rule, consists of a set of strings and a boolean expression which determine its logic
- YARA is multi-platform, running on Windows, Linux and Mac OS X
- Can be used through its command-line interface
- Can be used from your own Python scripts with the yara-python extension
Project Samples
