Cybersecurity Researchers Launch New Malware Hunting Tool YARAify


A group of security researchers from and ThreatFox launched a new hub for scanning and hunting files.

Dubbed YARAify, the defensive tool is designed to scan suspicious files against a large repository of YARA rules.

“YARA is an open source tool for pattern matching,” founder Roman Hüssy said in an interview with The Daily Swig. “It allows anyone […] to write their own rules to detect [issues] such as malicious or suspicious files.”

YARAify can scan files using public YARA rules and integrate both public and non-public YARA rules from Malpedia, which is operated by the Fraunhofer Institute in Germany.

Additionally, researchers can use the tool to scan files using open and commercial ClamAV signatures, set up hunting rules to match both YARA rules and ClamAV signatures and link YARAify to other tools via application programming interfaces (APIs). 

According to Hüssy, YARAify was created to facilitate the handling of YARA rules, which he described as powerful but difficult to handle.

Before the release of YARAify, malware hunters had to find YARA rules across platforms and git repositories, without a direct way of sharing them and with no consistent naming convention (leading to duplicates).

“We decided to launch the YARAify platform to the public to allow anyone to share their YARA rules with the community in a structured way and to use those to hunt for suspicious and malicious files seen within the universe,” Hüssy concluded.

For context, YARA rules have been used by several organizations and individuals in the past and have helped numerous security researchers spot dangerous threats.

For instance, in February 2021, FireEye used YARA rules during the events surrounding its data breach. The tool was also used months later by Microsoft to find evidence of the infamous Emotet botnet.

Products You May Like

Articles You May Like

Critical GitHub Enterprise Server Flaw Allows Authentication Bypass
Network Outages Hit 59% of Multi-Site Businesses Monthly
Ebury is alive but unseen: 400k Linux servers compromised for cryptocurrency theft and financial gain
UK Councils Warn of Data Breach After Attack on Medical Supplier
New XM Cyber Research: 80% of Exposures from Misconfigurations, Less Than 1% from CVEs

Leave a Reply

Your email address will not be published. Required fields are marked *