Questions tagged [yara]
YARA is a tool for classifying and identifying malware.
False Positives for YARA rule
I've run a malware ruleset from the Yara rules repository run on my Sys32 directory yara64.exe -f -r ./malware_index.yar C:\Windows\System32 and come across a lot of positives (+extra counts) for ...
How long is a typical malware signature?
I read in Peter Szor's Art of Computer Virus Research and Defense that, in the past, a 16-byte malware signature was sufficient to 16-bit detect malware, but that longer signatures are necessary for ...
Yara condition count operator with wildcard [closed]
I have a yara rule that looks for multiple strings in a file and fires if the count is greater than 3. But how would I change the condition statement to only fire if greater than 3 but less than 5? ...
Scanning a binary against YARA rules dictionary
I have found a malware binary, Which i am curious to see what patterns has been found from this file. Also i have a collection of ~1000 ioc's and yara-rule's related to Malwares and RAT's. I used Loki,...
How to find malware added in supply chain to Android phone?
As has become a mainstream news story many times over, some Android phones are being shipped with malware preinstalled, because they go from factory to a second party who adds the malware and then to ...
Yara rules not working in debian [closed]
Yara rules are working on Windows 7 perfectly. I am able to scan and detect malicious commands in .exe malware files but when I run the same program in debian v8.6, it can't detect malicious commands ...
How can I write logical signature for ClamAV simillar as it is in YARA?
First of all, I know that yara rules can be used in combination with ClamAV, but here I have something else in my mind, so my question is; how can I write logical signature simillar as it is in YARA. ...
Unusual case of Microsoft Calculator
Pretty interesting series of event unfolded. I had a newly installed Windows Image downloaded from Microsoft Dreamspark/Imagine. less 3 weeks old with some security restriction policy, gpos etc. ...
How do I use a directory of YARA files?
I'm going through the Malware Cookbook PEScanner and they want a path to my YARA files to search on. I currently have a directory full of YARA rules for known pieces of malware. What would be the ...