YARA v1.3 - A malware identification and classification tool

In: Malware Scanner , Security Solutions , YARA

27 October 2009

YARA is a tool aimed at helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families based on textual or binary patterns contained on samples of those families.

Each description consists of a set of strings and a Boolean expression which determines its logic.

YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the yara-python extension.

Version 1.3

C-style include directives
Rules can contain metadata information
Multiple files/sources can be compiled at once in yara-python

After installing YARA you can build yara-python this way:

tar xzvf yara-python-1.3.tar.gz
cd yara-python-1.3
python setup.py build
sudo python setup.py install

Read the YARA User’s Manual

Post scriptum

Download YARA v1.3

Malware Scanner	11 May 2010 : iScanner v0.5 released - Malicious codes scanner 7 April 2010 : Malware Check Tool v1.0 released 3 April 2010 : Focus on Zero Wine Tryouts Malware Analyzer Alpha 2 release 28 March 2010 : Zenamics released BinCrowd the First collaborative reverse engineering tool 28 March 2010 : StreamArmor v1.0 the advanced forensics tool released
Security Solutions	1 May 2010 : Spiceworks v4.7 build 50667 released 9 April 2010 : Secured Qubes OS Initial public release 16 December 2009 : Ninja v0.1.3 - privilege escalation detection and prevention 3 December 2009 : GreenSQL-FW v1.2.0 released 16 November 2009 : Offensive-Security released its Exploit Database
YARA	27 October 2009 : YARA v1.3 - A malware identification and classification tool