virustotal.github.io Open in urlscan Pro
2606:50c0:8000::153  Public Scan

Form analysis
0 forms found in the DOM

Text Content

THE PATTERN MATCHING SWISS KNIFE FOR MALWARE RESEARCHERS (AND EVERYONE ELSE)


YARA IN A NUTSHELL

YARA is a tool aimed at (but not limited to) helping malware researchers to
identify and classify malware samples. With YARA you can create descriptions of
malware families (or whatever you want to describe) based on textual or binary
patterns. Each description, a.k.a rule, consists of a set of strings and a
boolean expression which determine its logic. Let's see an example:

rule silent_banker : banker
{
    meta:
        description = "This is just an example"
        threat_level = 3
        in_the_wild = true

    strings:
        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}
        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}
        $c = "UVODFRYSIHLNWPEJXQZAKCBGMT"

    condition:
        $a or $b or $c
}


The above rule is telling YARA that any file containing one of the three strings
must be reported as silent_banker. This is just a simple example, more complex
and powerful rules can be created by using wild-cards, case-insensitive strings,
regular expressions, special operators and many other features that you'll find
explained in YARA's documentation.

YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used
through its command-line interface or from your own Python scripts with the
yara-python extension.


ADDITIONAL RESOURCES

Do you use GitHub for storing you YARA rules? YARA-CI may be a useful addition
to your toolbelt. This is GitHub application that provides continuous testing
for your rules, helping you to identify common mistakes and false positives.

If you plan to use YARA to scan compressed files (.zip, .tar, etc) you should
take a look at yextend, a very helpful extension to YARA developed and
open-sourced by Bayshore Networks.

Additionally, the guys from InQuest have curated an aweseome list of
YARA-related stuff.


WHO'S USING YARA

 * ActiveCanopy
 * Adlice
 * AlienVault
 * Avast
 * BAE Systems
 * Bayshore Networks, Inc.
 * BinaryAlert
 * Blue Coat
 * Blueliv
 * Claroty
 * Cofense
 * Conix
 * CrowdStrike FMS
 * Cuckoo Sandbox
 * Cyber Triage
 * Digita Security
 * Dragos Platform
 * Dtex Systems
 * ESET
 * ESTSecurity
 * Fidelis XPS
 * FireEye, Inc.
 * Fox-IT
 * FSF
 * Guidance Software
 * Heroku
 * Hornetsecurity
 * InQuest
 * JASK
 * Joe Security
 * jsunpack-n
 * Kaspersky Lab
 * KnowBe4
 * Koodous
 * Laika BOSS
 * Lastline, Inc.
 * LimaCharlie
 * McAfee Advanced Threat Defense
 * Metaflows
 * NBS System
 * Nozomi Networks
 * osquery
 * Payload Security
 * PhishMe
 * Picus Security
 * Radare2
 * Raytheon Cyber Products, Inc.
 * RedSocks Security
 * ReversingLabs
 * root9B
 * Scanii
 * RSA ECAT
 * SpamStopsHere
 * stoQ
 * Symantec
 * Tanium
 * Tenable Network Security
 * The DigiTrust Group
 * ThreatConnect
 * ThreatStream, Inc.
 * Thug
 * Trend Micro
 * VirusTotal Intelligence
 * VMRay
 * We Watch Your Website
 * Websense
 * x64dbg
 * YALIH

Are you using it? Want to see your site listed here?

View project inGitHub DownloadLatest release Read theDocumentation Ask for help
atYARA's group SendBug Report
Contact the author: