{"id":26654169,"url":"https://github.com/malice-plugins/yara","last_synced_at":"2025-07-02T03:31:55.354Z","repository":{"id":85384237,"uuid":"48824553","full_name":"malice-plugins/yara","owner":"malice-plugins","description":"Malice Yara Plugin","archived":false,"fork":false,"pushed_at":"2019-09-08T23:50:46.000Z","size":4061,"stargazers_count":30,"open_issues_count":0,"forks_count":12,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-04-11T08:00:23.850Z","etag":null,"topics":["docker","golang","malice","malice-plugin","malware","malware-analysis","malware-analyzer","malware-detection","malware-research","plugin","yara"],"latest_commit_sha":null,"homepage":"https://hub.docker.com/r/malice/yara/","language":"YARA","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/malice-plugins.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2015-12-31T00:02:51.000Z","updated_at":"2024-09-21T12:28:43.000Z","dependencies_parsed_at":null,"dependency_job_id":"eb0e69b3-d2a3-49a1-8f46-ac22a9873dd6","html_url":"https://github.com/malice-plugins/yara","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/malice-plugins/yara","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/malice-plugins%2Fyara","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/malice-plugins%2Fyara/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/malice-plugins%2Fyara/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/malice-plugins%2Fyara/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/malice-plugins","download_url":"https://codeload.github.com/malice-plugins/yara/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/malice-plugins%2Fyara/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":263069248,"owners_count":23408918,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","golang","malice","malice-plugin","malware","malware-analysis","malware-analyzer","malware-detection","malware-research","plugin","yara"],"created_at":"2025-03-25T04:57:36.991Z","updated_at":"2025-07-02T03:31:55.272Z","avatar_url":"https://github.com/malice-plugins.png","language":"YARA","funding_links":[],"categories":[],"sub_categories":[],"readme":"![YARA-logo](https://raw.githubusercontent.com/malice-plugins/yara/master/logo.png)\n\n# malice-yara\n\n[![Circle CI](https://circleci.com/gh/malice-plugins/yara.png?style=shield)](https://circleci.com/gh/malice-plugins/yara) [![License](http://img.shields.io/:license-mit-blue.svg)](http://doge.mit-license.org) [![Docker Stars](https://img.shields.io/docker/stars/malice/yara.svg)](https://hub.docker.com/r/malice/yara/) [![Docker Pulls](https://img.shields.io/docker/pulls/malice/yara.svg)](https://hub.docker.com/r/malice/yara/) [![Docker Image](https://img.shields.io/badge/docker%20image-52.9MB-blue.svg)](https://hub.docker.com/r/malice/virustotal/)\n\nMalice Yara Plugin\n\nThis repository contains a **Dockerfile** of the [Yara](http://virustotal.github.io/yara/) malice plugin **malice/yara**.\n\n### Dependencies\n\n- [malice/alpine](https://hub.docker.com/r/malice/alpine/)\n\n## Image Tags\n\n```\nREPOSITORY          TAG                 SIZE\nmalice/yara         latest              51.9MB\nmalice/yara         0.1.0               51.9MB\nmalice/yara         neo23x0             51.3MB\n```\n\n\u003e **NOTE:** tag `neo23x0` contains all of the [signature-base](https://github.com/Neo23x0/signature-base/tree/master/yara) rules\n\n## Installation\n\n1.  Install [Docker](https://www.docker.io/).\n2.  Download [trusted build](https://hub.docker.com/r/malice/yara/) from public [DockerHub](https://hub.docker.com): `docker pull malice/yara`\n\n## Usage\n\n```\ndocker run --rm -v /path/to/rules:/rules:ro malice/yara:neo23x0 FILE\n```\n\n### Or link your own malware folder\n\n```bash\n$ docker run -v /path/to/malware:/malware:ro -v /path/to/rules:/rules:ro malice/yara:neo23x0 FILE\n\nUsage: yara [OPTIONS] COMMAND [arg...]\n\nMalice YARA Plugin\n\nVersion: v0.1.0, BuildTime: 20180902\n\nAuthor:\n  blacktop - \u003chttps://github.com/blacktop\u003e\n\nOptions:\n  --verbose, -V          verbose output\n  --elasticsearch value  elasticsearch url for Malice to store results [$MALICE_ELASTICSEARCH_URL]\n  --callback, -c         POST results to Malice webhook [$MALICE_ENDPOINT]\n  --proxy, -x            proxy settings for Malice webhook endpoint [$MALICE_PROXY]\n  --table, -t            output as Markdown table\n  --timeout value        malice plugin timeout (in seconds) (default: 60) [$MALICE_TIMEOUT]\n  --rules value          YARA rules directory (default: \"/rules\")\n  --help, -h             show help\n  --version, -v          print the version\n\nCommands:\n  web   Create a Yara web service\n  help  Shows a list of commands or help for one command\n\nRun 'yara COMMAND --help' for more information on a command.\n```\n\nThis will output to stdout and POST to malice results API webhook endpoint.\n\n## Sample Output\n\n### [JSON](https://github.com/malice-plugins/yara/blob/master/docs/results.json)\n\n```json\n{\n  \"yara\": {\n    \"matches\": [\n      {\n        \"Rule\": \"APT30_Generic_7\",\n        \"Namespace\": \"malice\",\n        \"Tags\": null,\n        \"Meta\": {\n          \"author\": \"Florian Roth\",\n          \"date\": \"2015/04/13\",\n          \"description\": \"FireEye APT30 Report Sample\",\n          \"hash0\": \"2415f661046fdbe3eea8cd276b6f13354019b1a6\",\n          \"hash1\": \"e814914079af78d9f1b71000fee3c29d31d9b586\",\n          \"hash2\": \"0263de239ccef669c47399856d481e3361408e90\",\n          \"license\": \"https://creativecommons.org/licenses/by-nc/4.0/\",\n          \"reference\": \"https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf\",\n          \"super_rule\": 1\n        },\n        \"Strings\": [\n          {\n            \"Name\": \"$s1\",\n            \"Offset\": 29824,\n            \"Data\": \"WGphcG9yXyphdGE=\"\n          },\n          {\n            \"Name\": \"$s2\",\n            \"Offset\": 29848,\n            \"Data\": \"WGphcG9yX28qYXRh\"\n          },\n          {\n            \"Name\": \"$s4\",\n            \"Offset\": 29864,\n            \"Data\": \"T3VvcGFp\"\n          }\n        ]\n      }\n    ]\n  }\n}\n```\n\n### FILTERED Output JSON:\n\n```bash\n$ cat JSON_OUTPUT | jq '.[][][] .Rule'\n\n\"_Microsoft_Visual_Cpp_v50v60_MFC_\"\n\"_Borland_Delphi_v60__v70_\"\n\"_dUP_v2x_Patcher__wwwdiablo2oo2cjbnet_\"\n\"_Free_Pascal_v106_\"\n\"_Armadillo_v171_\"\n```\n\n### [Markdown](https://github.com/malice-plugins/yara/blob/master/docs/SAMPLE.md)\n\n---\n\n#### Yara\n\n| Rule              | Description                 | Offset   | Data                    | Tags |\n| ----------------- | --------------------------- | -------- | ----------------------- | ---- |\n| `APT30_Generic_7` | FireEye APT30 Report Sample | `0x7480` | `\u0026#34;Xjapor_*ata\u0026#34;` | []   |\n\n\u003e NOTE: **Data** truncated to 25 characters\n\n---\n\n## Documentation\n\n- [To write results to ElasticSearch](https://github.com/malice-plugins/yara/blob/master/docs/elasticsearch.md)\n- [To create a Yara scan micro-service](https://github.com/malice-plugins/yara/blob/master/docs/web.md)\n- [To post results to a webhook](https://github.com/malice-plugins/yara/blob/master/docs/callback.md)\n\n## TODO\n\n- [ ] add rules _(tagged?)_ from https://github.com/Yara-Rules/rules\n- [x] add rules _(tagged?)_ from https://github.com/Neo23x0/signature-base\n\n## Issues\n\nFind a bug? Want more features? Find something missing in the documentation? Let me know! Please don't hesitate to [file an issue](https://github.com/malice-plugins/yara/issues/new) and I'll get right on it.\n\n## CHANGELOG\n\nSee [`CHANGELOG.md`](https://github.com/malice-plugins/yara/blob/master/CHANGELOG.md)\n\n## Contributing\n\n[See all contributors on GitHub](https://github.com/malice-plugins/yara/graphs/contributors).\n\nPlease update the [CHANGELOG.md](https://github.com/malice-plugins/yara/blob/master/CHANGELOG.md) and submit a [Pull Request on GitHub](https://help.github.com/articles/using-pull-requests/).\n\n## License\n\nMIT Copyright (c) 2016 **blacktop**\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmalice-plugins%2Fyara","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmalice-plugins%2Fyara","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmalice-plugins%2Fyara/lists"}