Learning Malware Analysis

7.4.3 Running YARA

Once you have the rule ready, the next step is to use the yara utility to scan the files using the YARA rules. In the preceding example, the rule looked for three suspicious strings (defined in $a, $b and $c), and based on the condition, the rule matched if any of the three strings is present in a file. The rule was saved as suspicious.yara, and running the yara against a directory containing malware samples returned two malware samples matching the rule:

$ yara -r suspicious.yara samples/suspicious_strings samples//spybot.exesuspicious_strings samples//wuamqr.exe

The preceding YARA rule, by default, will match on ASCII strings, and it performs the case-sensitive match. If you want the rule to detect both ASCII and Unicode ...