Using YARA to attribute malware

JMH · Oct 12, 2013

If you’ve performed malware research, you’ve likely observed samples that are very similar in functionality, yet have different hashes, file sizes, etc.

When looking at the same malware at the assembly level, you might have noticed the “differing” malware may have functions and strings that are exactly the same.

Given enough analysis time, researchers can attribute samples to certain malware families. However, in-depth analysis methods (such as reverse engineering) can be a lengthy process, and that’s why tools are developed to streamline the analysis process and assist researchers in rapid identification when possible.

Using YARA to attribute malware | Malwarebytes Unpacked

Search

Search

Using YARA to attribute malware

JMH

Emeritus, Contributor