YARA是一個惡意軟件識別和分類工具,它的目標是幫助惡意軟件研究人員對惡意進行分類和識別。YARA為惡意軟件創建描述。YARA使用python編寫，支持多個平台。目前YARA更新至1.6，新版本主要改變如下：
* Added support for bitwise operators
* Added support for multi-line hex strings
* Scan speed improvement for regular expressions (with PCRE)
* Yara-python ported to Python 3.x
* Yara-python support for 64-bits Python under Windows
* BUGFIX: Buffer overflow in error printing
工具下載：http://code.google.com/p/yara-project/downloads/list
「YARA is a malware identification and classification tool. It is aimed at helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families based on textual or binary patterns contained on samples of those families. Each description consists of a set of strings and a Boolean expression which determines its logic.
It is multi-platform, running on Windows, Linux and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the yara-python extension.」
發表文章
0 意見: