YARA in a nutshell

YARA is a tool aimed at (but not limited to) helping malware researchers toidentify and classify malware samples. With YARA you can create descriptions ofmalware families (or whatever you want to describe) based on textual or binarypatterns. Each description, a.k.a rule, consists of a set of strings and aboolean expression which determine its logic. Let's see an example:

YARA is described as “The pattern matching Swiss knife for malware researchers (and everyone else)”. Think of it as like grep, but instead of matching based on one pattern, YARA matches based on a set of rules, with each rule capable of containing multiple patterns, and complex condition logic for further refining matches. YARA – Installation on windows (64 bit) YARA is a tool created to help researchers identify and classify malware samples. Its a rule based analyzer which means we can right rules to identify the binary as well as textual patterns that is there in malware samples.

The above rule is telling YARA that any file containing one of the three stringsmust be reported as silent_banker. This is just a simple example, morecomplex and powerful rules can be created by using wild-cards, case-insensitivestrings, regular expressions, special operators and many other features thatyou'll find explained in YARA's documentation.

YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be usedthrough its command-line interface or from your own Python scripts with theyara-python extension.

Additional resources

If you plan to use YARA to scan compressed files (.zip, .tar, etc) you shouldtake a look at yextend, a veryhelpful extension to YARA developed and open-sourced by Bayshore Networks.

Additionally, the guys from InQuest have curated anawesome list of YARA-related stuff.

Who's using YARA

Are you using it? Want to see your site listed here?

Latest version

Last released:

Python interface for YARA

Project description

yara-python

With this library you can use YARA fromyour Python programs. It covers all YARA鈥檚 features, from compiling, savingand loading rules to scanning files, strings and processes.

Here it goes a little example:

Installation

The easiest way of installing YARA is by using pip:

But you can also get the source from GitHub and compile it yourself:

Notice the --recursive option used with git. This is important becausewe need to download the yara subproject containing the source code forlibyara (the core YARA library). It鈥檚 also important to note that the twomethods above link libyara statically into yara-python. If you want to linkdynamically against a shared libyara library use:

For this option to work you must build and installYARA separately before installingyara-python.

Documentation

Find more information about how to use yara-python athttps://yara.readthedocs.org/en/latest/yarapython.html.

Release historyRelease notifications

3.10.0

3.9.0

3.8.1

3.8.0

3.7.0

3.6.3

3.6.2

3.6.1

3.6.0

3.5.0

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for yara-python, version 3.10.0
Filename, size	File type	Python version	Upload date	Hashes
Filename, size yara_python-3.10.0-cp27-cp27m-win32.whl (619.1 kB)	File type Wheel	Python version cp27	Upload date	Hashes
Filename, size yara_python-3.10.0-cp27-cp27m-win_amd64.whl (690.4 kB)	File type Wheel	Python version cp27	Upload date	Hashes
Filename, size yara_python-3.10.0-cp33-cp33m-win32.whl (624.2 kB)	File type Wheel	Python version cp33	Upload date	Hashes
Filename, size yara_python-3.10.0-cp33-cp33m-win_amd64.whl (689.5 kB)	File type Wheel	Python version cp33	Upload date	Hashes
Filename, size yara_python-3.10.0-cp34-cp34m-win32.whl (624.1 kB)	File type Wheel	Python version cp34	Upload date	Hashes
Filename, size yara_python-3.10.0-cp34-cp34m-win_amd64.whl (689.4 kB)	File type Wheel	Python version cp34	Upload date	Hashes
Filename, size yara_python-3.10.0-cp35-cp35m-win32.whl (618.6 kB)	File type Wheel	Python version cp35	Upload date	Hashes
Filename, size yara_python-3.10.0-cp35-cp35m-win_amd64.whl (711.4 kB)	File type Wheel	Python version cp35	Upload date	Hashes
Filename, size yara_python-3.10.0-cp36-cp36m-win32.whl (618.6 kB)	File type Wheel	Python version cp36	Upload date	Hashes
Filename, size yara_python-3.10.0-cp36-cp36m-win_amd64.whl (711.4 kB)	File type Wheel	Python version cp36	Upload date	Hashes
Filename, size yara_python-3.10.0-cp37-cp37m-win32.whl (618.6 kB)	File type Wheel	Python version cp37	Upload date	Hashes
Filename, size yara_python-3.10.0-cp37-cp37m-win_amd64.whl (711.4 kB)	File type Wheel	Python version cp37	Upload date	Hashes
Filename, size yara-python-3.10.0.tar.gz (366.7 kB)	File type Source	Python version None	Upload date	Hashes

Yara Signature Example

Close

Hashes for yara_python-3.10.0-cp27-cp27m-win32.whl

Hashes for yara_python-3.10.0-cp27-cp27m-win32.whl
Algorithm	Hash digest
SHA256	`c5385f28efd42ec615870f30572576b6e3cc12d08025178c9040979244e42eb3`
MD5	`dafe92ff8dd2c996887c35568b64f153`
BLAKE2-256	`96a8ecbc6aa55107d915bd0685579b9ad9126c15eca3c0e0180268ee128b8f79`

Close

Hashes for yara_python-3.10.0-cp27-cp27m-win_amd64.whl

Yara Rule Examples

Hashes for yara_python-3.10.0-cp27-cp27m-win_amd64.whl
Algorithm	Hash digest
SHA256	`024fb818ece339a378c562b3b49c28bf861b004ab5c57e488556d49bcd8ab76d`
MD5	`39496a2b59cb8cdab3c34afc27cf005f`
BLAKE2-256	`25df17760aea417d926799ed83f1c0b14910d6552f3bffd94ca179ab4b77aa91`

Close

Hashes for yara_python-3.10.0-cp33-cp33m-win32.whl

Hashes for yara_python-3.10.0-cp33-cp33m-win32.whl
Algorithm	Hash digest
SHA256	`16bbd479078f3cce33b4966c112913c0c9a7d22d0a63df23e06be5a84e51d5f4`
MD5	`30a066fe08c4a6ac01ccb3c0aa6d00d4`
BLAKE2-256	`c4674e1c2bef1687726cd5556058ceaf92e339216a4b68a3e7d5193229022e9d`

Close

Hashes for yara_python-3.10.0-cp33

Yara Download Windows