Questions tagged [yara]
YARA is a tool for classifying and identifying malware.
9
questions
6
votes
1
answer
3k
views
Unusual case of Microsoft Calculator
Pretty interesting series of event unfolded. I had a newly installed Windows Image downloaded from Microsoft Dreamspark/Imagine. less 3 weeks old with some security restriction policy, gpos etc. ...
- 103
6
votes
1
answer
227
views
How to find malware added in supply chain to Android phone?
As has become a mainstream news story many times over, some Android phones are being shipped with malware preinstalled, because they go from factory to a second party who adds the malware and then to ...
- 69
4
votes
1
answer
697
views
How can I write logical signature for ClamAV simillar as it is in YARA?
First of all, I know that yara rules can be used in combination with ClamAV, but here I have something else in my mind, so my question is; how can I write logical signature simillar as it is in YARA.
...
- 10.1k
4
votes
1
answer
3k
views
How do I use a directory of YARA files?
I'm going through the Malware Cookbook PEScanner and they want a path to my YARA files to search on. I currently have a directory full of YARA rules for known pieces of malware.
What would be the ...
- 41
2
votes
1
answer
1k
views
Scanning a binary against YARA rules dictionary
I have found a malware binary, Which i am curious to see what patterns has been found from this file. Also i have a collection of ~1000 ioc's and yara-rule's related to Malwares and RAT's. I used Loki,...
- 1,142
1
vote
1
answer
357
views
Yara rules not working in debian [closed]
Yara rules are working on Windows 7 perfectly. I am able to scan and detect malicious commands in .exe malware files but when I run the same program in debian v8.6, it can't detect malicious commands ...
0
votes
1
answer
1k
views
Yara condition count operator with wildcard [closed]
I have a yara rule that looks for multiple strings in a file and fires if the count is greater than 3. But how would I change the condition statement to only fire if greater than 3 but less than 5?
...
- 143
0
votes
0
answers
257
views
False Positives for YARA rule
I've run a malware ruleset from the Yara rules repository run on my Sys32 directory
yara64.exe -f -r ./malware_index.yar C:\Windows\System32
and come across a lot of positives (+extra counts) for ...
- 41
-2
votes
1
answer
272
views
How long is a typical malware signature?
I read in Peter Szor's Art of Computer Virus Research and Defense that, in the past, a 16-byte malware signature was sufficient to 16-bit detect malware, but that longer signatures are necessary for ...
- 345