Learning Android Forensics - Second Edition

Android malware identification using YARA rules

According to the official documentation (which can be found at https://yara.readthedocs.io/en/v3.8.1/), YARA is a tool aimed at helping malware researchers (and forensic examiners—both computer and mobile, of course) to identify and classify malware samples.

With the help of YARA, an examiner can write rules based on textual or binary patterns. Here is an example of such a rule:

rule test_rule{   meta:      description = "Test YARA rule"      author = "Oleg Skulkin"   strings:      $string = "teststring"   condition:      $string}

This rule will detect any file that contains the teststring string. Let's look closely at the principal parts of the rule:

• meta: This part contains the rule's metadata, for example, what ...