YARA v4.2 RC1 releases, The pattern matching swiss knife
YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings and a boolean expression that determine its logic. Let’s see an example:
The above rule is telling YARA that any file containing one of the three strings must be reported as silent_banker. This is just a simple example, more complex and powerful rules can be created by using wild-cards, case-insensitive strings, regular expressions, special operators and many other features that you’ll find explained in YARA’s documentation.
It is multi-platform, running on Windows, Linux, and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the Yara-python extension.
If you plan to use YARA to scan compressed files (.zip, .tar, etc) you should take a look at yextend, a very helpful extension to YARA developed and open-sourced by Bayshore Networks.
Changelog v4.2 RC1
- New syntax for counting string occurrences within a range of offsets. Example:
#a in (0..100)(#1565).
- New syntax for checking if a set of strings are found within a range of offsets
all of them in (0..100)(#1554).
ofoperator now accepts sets of rules, Examples:
2 of (rule1, rule2, rule3),
2 of (rule*)(##1597)
- New syntactic sugar allows writing
0 of ($a)as
none of ($a*)(#1559).
- New operator
%for string sets. Example:
20% of them(#1434).
- New operator
- Added functions
- Added new
- Added support of delayed imports to
- Reduce memory pressure when scanning process memory in Linux (#1470).
- Improve performance while matching certain hex strings (#1526, #1552).
- Implement support for unicode file names in Windows (#1491).
- Add new API functions
--max-process-memory-chunkoption for controlling the size of the chunks while scanning a process memory (#1393).
--skip-largeroption for skipping files larger than a certain size while scanning directories.
fullwordmodifier not working properly under all locales (#1544).
- BUGFIX: Fix edge case when files have a numeric name that was interpreted as a PID number (#1541).
- BUGFIX: Fix memory leaks in
Copyright (c) 2007-2016. The YARA Authors. All Rights Reserved.
Christian Blichmann <email@example.com>
Hilko Bengen <firstname.lastname@example.org>
Joachim Metz <email@example.com>
Karl Hiramoto <firstname.lastname@example.org>
Mike Wiacek <email@example.com>
Shane Huntley <firstname.lastname@example.org>
Stefan Buehlmann <email@example.com>
Victor M. Alvarez <firstname.lastname@example.org>;<email@example.com>
Wesley Shields <firstname.lastname@example.org>