ARTICLE YARA v1.3 - A malware identification and classification tool

Tuesday 27 October 2009 - 1315 read - ( Keywords : Malware Scanner , Security Solutions , YARA )

YARA is a tool aimed at helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families based on textual or binary patterns contained on samples of those families.

Each description consists of a set of strings and a Boolean expression which determines its logic.

YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the yara-python extension.

Version 1.3

  • C-style include directives
  • Rules can contain metadata information
  • Multiple files/sources can be compiled at once in yara-python

After installing YARA you can build yara-python this way:

  • tar xzvf yara-python-1.3.tar.gz
  • cd yara-python-1.3
  • python setup.py build
  • sudo python setup.py install

Read the YARA User’s Manual


POSTSCRIPTUM

Download YARA v1.3


RELATED ARTICLES

Malware Scanner, Security Solutions, YARA,

27 October 2009 : YARA v1.3 - A malware identification and classification tool