Shulou(Shulou.com)06/01 Report--

Sometimes encounter a large number of samples, but also find many similarities, this time the need for pattern matching, yara is well-deserved in the analysis.

What are the specific yara rules? there are relevant articles on freebuff, otherwise it is OK to read the documentation. Here are only a few steps that I used for the first time.

(1) download yara and go directly to github to find it. I chose the code written by C++.

(2) find the directory yara-3.8.1\ windows\ vs2015 after decompression. I need a vs at this time, so I download vs2017 and open the yara.sln file.

(3) therefore, you will see three projects.

As the name implies, the dll,yarac of yara is used to compile yara rules, and the result of yarac compilation rules is passed to the yara project for final output.

Set yara as the startup item, compile, run, and solve your own problems. To see the wrong log.

(4) then run yara, select the parameters, take the yara rule, and the yara sample path will be available.

(5) I used the option of-s to match my sample set and output it to a file.

(6) output result

That's it. It feels good.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.