0

I've run a malware ruleset from the Yara rules repository run on my Sys32 directory

yara64.exe -f -r ./malware_index.yar C:\Windows\System32

and come across a lot of positives (+extra counts) for GLASSES and GLASSESCode

Most matches are with DirectX DLLs but I assume it's just coincidental matches.

I would appreciate knowing more about this from someone who understands the thread matches for this (MALW_Glasses.yar). Maybe I'm infected?

enter image description here

Improve this question
2
  • 1
    Note that many, many tools use yara rules. Thank you for explaining what tool you used.
    – schroeder ♦
    Commented Nov 17, 2021 at 7:39
  • Hi schroder thanks for helping me with the edit. Just wondering, does yara tend to give 'false positives' if the user is not aware of what the rules are doing specifically. Im not familiar with how hexidecimal threads work in dll processes but i wonder if these positives are just coincidental? i.e the rule hex thread matches a chunk in the scanned file's hex data by coincedence(sheer volume of hex data in the scanned file)
    – N S
    Commented Nov 17, 2021 at 12:30

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .