AwesomeREA.org

Tool

YARA

VirusTotal's pattern-matching tool for identifying and classifying files such as malware samples with rules that combine text, hex and regular-expression strings with a Boolean condition. It scans a file, a folder or a running process from the command line, through the libyara C API or from Python with yara-python. Modules expose parsed structure to rules: pe and elf expose most fields of PE and ELF headers, dotnet adds .NET metadata, math adds calculations such as entropy, and the optional magic and cuckoo modules add libmagic file types and Cuckoo sandbox behavior reports.

Targets
Binary
Category
Native analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Prerequisites: Runs on Windows, Linux and macOS; release at review: v4.6.0, published 2026-10-27. Source builds need automake, libtool, make, gcc and pkg-config. Features that depend on OpenSSL are enabled only when OpenSSL is installed, and the cuckoo (Jansson) and magic (libmagic) modules are compiled only with --enable-cuckoo or --enable-magic; vcpkg also packages YARA.
  • Limits: The README marks YARA as in maintenance mode; the YARA-X README says YARA still receives bug fixes and minor features, while new modules and large features go only into YARA-X. The command-line documentation warns that compiled rules from untrusted sources can lead to the execution of malicious code; since YARA 3.9 they load only with -C.
  • License: BSD-3-Clause per COPYING.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · VirusTotal/yara · Revision 6d47342
  2. docs/gettingstarted.rst GitHub · VirusTotal/yara · Revision 6d47342
  3. docs/commandline.rst GitHub · VirusTotal/yara · Revision 6d47342
  4. docs/modules/pe.rst GitHub · VirusTotal/yara · Revision 6d47342
  5. docs/modules/elf.rst GitHub · VirusTotal/yara · Revision 6d47342
  6. docs/modules/math.rst GitHub · VirusTotal/yara · Revision 6d47342
  7. docs/modules/cuckoo.rst GitHub · VirusTotal/yara · Revision 6d47342
  8. COPYING GitHub · VirusTotal/yara · Revision 6d47342
  9. https://github.com/VirusTotal/yara/releases/tag/v4.6.0
  10. README.md GitHub · VirusTotal/yara-x · Revision 1bda5fc
  11. https://virustotal.github.io/yara-x/blog/yara-x-is-stable/

More in Native binaries

All 166 entries in Native binaries