The pattern matching swiss knife
C C++ Yacc Lex M4 Other Other
Clone or download
Pull request Compare This branch is 615 commits behind VirusTotal:master.
Latest commit fd346a7 Jun 8, 2016
Failed to load latest commit information.
dist Update RPM spec May 27, 2015
docs Replace "backslashes" with "forward slashes" in documentation as repo… May 12, 2016
extra Convert logo to vectorial format Dec 10, 2015
libyara Fix memory leak Jun 8, 2016
m4 Use ACX_PTHREAD macro for configuring PTHREADS Sep 23, 2014
tests Extend the lexer to accept hex strings with inline comments. May 31, 2016
windows Configure Visual Studio 2015 projects for static linking Apr 22, 2016
.gitignore Cumulative fixes for building on Windows Apr 22, 2016
.travis.yml Update COVERITY_SCAN_TOKEN Jun 7, 2016
AUTHORS Add Hilko Bengen to AUTHORS and CONTRIBUTORS May 13, 2015
CONTRIBUTORS Add Christian Blichmann to CONTRIBUTERS Feb 4, 2016
COPYING Change to Apache 2.0 license May 22, 2012 Add test case for #429 Mar 30, 2016 Fix link to Travis CI badge Mar 21, 2016
args.c Remove execution permission from some source files Mar 9, 2015
args.h Remove execution permission from some source files Mar 9, 2015 Fix issues while building in some systems Dec 1, 2014 Improve build system Dec 3, 2013 Add --enable-debug option to "configure" script May 12, 2016
sample.rules Initial import Sep 26, 2008
threading.c Add support for compiling under cygwin. Feb 13, 2016
threading.h Organize threading-related functions Apr 22, 2016
yara.c Fix issue #444 May 12, 2016 Add --stack-size option to man page Mar 21, 2016
yarac.c Fix issue #444 May 12, 2016 Add man page for yarac Jan 17, 2014

Join the chat at Build Status

YARA in a nutshell

YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings and a boolean expression which determine its logic. Let's see an example:

rule silent_banker : banker
        description = "This is just an example"
        thread_level = 3
        in_the_wild = true

        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}
        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}

        $a or $b or $c

The above rule is telling YARA that any file containing one of the three strings must be reported as silent_banker. This is just a simple example, more complex and powerful rules can be created by using wild-cards, case-insensitive strings, regular expressions, special operators and many other features that you'll find explained in YARA's documentation.

YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the yara-python extension.

If you plan to use YARA to scan compressed files (.zip, .tar, etc) you should take a look at yextend, a very helpful extension to YARA developed and open-sourced by Bayshore Networks.

Who's using YARA

Are you using it? Want to see your site listed here?