Questions tagged [yara]

YARA is a tool for classifying and identifying malware.

Filter by
Sorted by
Tagged with
0 votes
0 answers
134 views

False Positives for YARA rule

I've run a malware ruleset from the Yara rules repository run on my Sys32 directory yara64.exe -f -r ./malware_index.yar C:\Windows\System32 and come across a lot of positives (+extra counts) for ...
user avatar
  • 41
-2 votes
1 answer
236 views

How long is a typical malware signature?

I read in Peter Szor's Art of Computer Virus Research and Defense that, in the past, a 16-byte malware signature was sufficient to 16-bit detect malware, but that longer signatures are necessary for ...
user avatar
0 votes
1 answer
713 views

Yara condition count operator with wildcard [closed]

I have a yara rule that looks for multiple strings in a file and fires if the count is greater than 3. But how would I change the condition statement to only fire if greater than 3 but less than 5? ...
user avatar
  • 143
2 votes
1 answer
794 views

Scanning a binary against YARA rules dictionary

I have found a malware binary, Which i am curious to see what patterns has been found from this file. Also i have a collection of ~1000 ioc's and yara-rule's related to Malwares and RAT's. I used Loki,...
user avatar
  • 1,132
6 votes
0 answers
145 views

How to find malware added in supply chain to Android phone?

As has become a mainstream news story many times over, some Android phones are being shipped with malware preinstalled, because they go from factory to a second party who adds the malware and then to ...
user avatar
  • 69
1 vote
1 answer
287 views

Yara rules not working in debian [closed]

Yara rules are working on Windows 7 perfectly. I am able to scan and detect malicious commands in .exe malware files but when I run the same program in debian v8.6, it can't detect malicious commands ...
user avatar
4 votes
1 answer
635 views

How can I write logical signature for ClamAV simillar as it is in YARA?

First of all, I know that yara rules can be used in combination with ClamAV, but here I have something else in my mind, so my question is; how can I write logical signature simillar as it is in YARA. ...
user avatar
  • 9,953
7 votes
1 answer
2k views

Unusual case of Microsoft Calculator

Pretty interesting series of event unfolded. I had a newly installed Windows Image downloaded from Microsoft Dreamspark/Imagine. less 3 weeks old with some security restriction policy, gpos etc. ...
user avatar
4 votes
1 answer
3k views

How do I use a directory of YARA files?

I'm going through the Malware Cookbook PEScanner and they want a path to my YARA files to search on. I currently have a directory full of YARA rules for known pieces of malware. What would be the ...
user avatar
  • 41