Reverse Engineering Beta

Questions tagged [yara]

Ask Question

The tag has no usage guidance.

5 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
1
vote
1answer
63 views

Code based Yara rule

I have to write a Yara rules for malwares that is based on assember code. Suppose I have an unpacked malware sample. To avoid false positives, the selected code must be unique. Can anyone tell me ...
0
votes
0answers
25 views

Yara sigs based on imported functions used in code snippet

I'm looking to write a yara signature based on an interesting decoding algorithm in a family of malware, but I'm having difficulty with correlating addresses with imported functions. Specifically, I ...
1
vote
1answer
1k views

Detecting cracked Themida packed malware

I'm working in a large SOC and my manager has tasked me with finding some way to provide coverage for Themida packed malware samples. As alluring as it is to suggest just blacklisting all Themida ...
5
votes
3answers
694 views

Is there any websites to get malware files using YARA rules?

I want to know, Is there any websites which has malware files (Windows OS) that are detected by YARA rules? Note: I know some websites to get android malware samples using YARA. But, I need Windows ...
0
votes
1answer
349 views

How do I make a YARA signature that does NOT look in the resource section?

I'm trying to use YARA to sort out a variety of files into families. Some malware drops other malware from images within their resource images. What I'd like to do is write a signature that ignores ...