Skip to main content

Questions tagged [yara]

YARA is a tool for classifying and identifying malware.

Filter by
Sorted by
Tagged with
6 votes
1 answer
343 views

How to find malware added in supply chain to Android phone?

As has become a mainstream news story many times over, some Android phones are being shipped with malware preinstalled, because they go from factory to a second party who adds the malware and then to ...
1 vote
1 answer
286 views

Examining linux memory dump with signs of compromise in yarascan

I have captured a memory dump of recent Ubuntu 22.04 kernel 6.2.0-39-generic. captured image with LiMe and analyzed with volatility3. did a yarascan against all known rules and found a suspicious ...
0 votes
0 answers
360 views

False Positives for YARA rule

I've run a malware ruleset from the Yara rules repository run on my Sys32 directory yara64.exe -f -r ./malware_index.yar C:\Windows\System32 and come across a lot of positives (+extra counts) for ...
-1 votes
1 answer
321 views

How long is a typical malware signature?

I read in Peter Szor's Art of Computer Virus Research and Defense that, in the past, a 16-byte malware signature was sufficient to 16-bit detect malware, but that longer signatures are necessary for ...
0 votes
1 answer
1k views

Yara condition count operator with wildcard [closed]

I have a yara rule that looks for multiple strings in a file and fires if the count is greater than 3. But how would I change the condition statement to only fire if greater than 3 but less than 5? ...
2 votes
1 answer
1k views

Scanning a binary against YARA rules dictionary

I have found a malware binary, Which i am curious to see what patterns has been found from this file. Also i have a collection of ~1000 ioc's and yara-rule's related to Malwares and RAT's. I used Loki,...
1 vote
1 answer
417 views

Yara rules not working in debian [closed]

Yara rules are working on Windows 7 perfectly. I am able to scan and detect malicious commands in .exe malware files but when I run the same program in debian v8.6, it can't detect malicious commands ...
4 votes
1 answer
743 views

How can I write logical signature for ClamAV simillar as it is in YARA?

First of all, I know that yara rules can be used in combination with ClamAV, but here I have something else in my mind, so my question is; how can I write logical signature simillar as it is in YARA. ...
6 votes
1 answer
3k views

Unusual case of Microsoft Calculator

Pretty interesting series of event unfolded. I had a newly installed Windows Image downloaded from Microsoft Dreamspark/Imagine. less 3 weeks old with some security restriction policy, gpos etc. ...
4 votes
1 answer
3k views

How do I use a directory of YARA files?

I'm going through the Malware Cookbook PEScanner and they want a path to my YARA files to search on. I currently have a directory full of YARA rules for known pieces of malware. What would be the ...