[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-6279":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":16,"subscribersCount":16,"size":16,"stars1d":17,"stars7d":18,"stars30d":19,"stars90d":16,"forks30d":16,"starsTrendScore":20,"compositeScore":21,"rankGlobal":10,"rankLanguage":10,"license":22,"archived":23,"fork":23,"defaultBranch":24,"hasWiki":25,"hasPages":25,"topics":26,"createdAt":10,"pushedAt":10,"updatedAt":27,"readmeContent":28,"aiSummary":29,"trendingCount":16,"starSnapshotCount":16,"syncStatus":30,"lastSyncTime":31,"discoverSource":32},6279,"yara","VirusTotal\u002Fyara","VirusTotal","The pattern matching swiss knife","https:\u002F\u002Fvirustotal.github.io\u002Fyara\u002F",null,"C",9664,1567,317,154,0,1,14,68,7,40.59,"BSD 3-Clause \"New\" or \"Revised\" License",false,"master",true,[],"2026-06-12 02:01:17","[![Join the chat at https:\u002F\u002Fgitter.im\u002FVirusTotal\u002Fyara](https:\u002F\u002Fbadges.gitter.im\u002FJoin%20Chat.svg)](https:\u002F\u002Fgitter.im\u002FVirusTotal\u002Fyara?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)\n[![AppVeyor build status](https:\u002F\u002Fci.appveyor.com\u002Fapi\u002Fprojects\u002Fstatus\u002F7glqg19w4oolm7pr?svg=true)](https:\u002F\u002Fci.appveyor.com\u002Fproject\u002Fplusvic\u002Fyara)\n[![Coverity status](https:\u002F\u002Fscan.coverity.com\u002Fprojects\u002F9057\u002Fbadge.svg?flat=1)](https:\u002F\u002Fscan.coverity.com\u002Fprojects\u002Fplusvic-yara)\n\n> [!IMPORTANT]\n> This project is in maintenance mode. More info: https:\u002F\u002Fvirustotal.github.io\u002Fyara-x\u002Fblog\u002Fyara-x-is-stable\u002F\n\n\n## YARA in a nutshell\n\nYARA is a tool aimed at (but not limited to) helping malware researchers to\nidentify and classify malware samples. With YARA you can create descriptions of\nmalware families (or whatever you want to describe) based on textual or binary\npatterns. Each description, a.k.a. rule, consists of a set of strings and a\nboolean expression which determine its logic. Let's see an example:\n\n```yara\nrule silent_banker : banker\n{\n    meta:\n        description = \"This is just an example\"\n        threat_level = 3\n        in_the_wild = true\n\n    strings:\n        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}\n        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}\n        $c = \"UVODFRYSIHLNWPEJXQZAKCBGMT\"\n\n    condition:\n        $a or $b or $c\n}\n```\n\nThe above rule is telling YARA that any file containing one of the three strings\nmust be reported as *silent_banker*. This is just a simple example, more\ncomplex and powerful rules can be created by using wild-cards, case-insensitive\nstrings, regular expressions, special operators and many other features that\nyou'll find explained in [YARA's documentation](https:\u002F\u002Fyara.readthedocs.org\u002F).\n\nYARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used\nthrough its command-line interface or from your own Python scripts with the\nyara-python extension.\n\n## Additional resources\n\nDo you use GitHub for storing your YARA rules? [YARA-CI](https:\u002F\u002Fyara-ci.cloud.virustotal.com)\nmay be a useful addition to your toolbelt. This is GitHub application that provides\ncontinuous testing for your rules, helping you to identify common mistakes and\nfalse positives.\n\nIf you plan to use YARA to scan compressed files (.zip, .tar, etc) you should\ntake a look at [yextend](https:\u002F\u002Fgithub.com\u002FBayshoreNetworks\u002Fyextend), a very\nhelpful extension to YARA developed and open-sourced by Bayshore Networks.\n\nAdditionally, the guys from [InQuest](https:\u002F\u002Finquest.net\u002F) have curated an\nawesome list of [YARA-related stuff](https:\u002F\u002Fgithub.com\u002FInQuest\u002Fawesome-yara).\n\n## Who's using YARA\n\n* [0x101 Cyber Security](https:\u002F\u002F0x101-cyber-security.de)\n* [Adlice](https:\u002F\u002Fwww.adlice.com\u002F)\n* [AlienVault](https:\u002F\u002Fotx.alienvault.com\u002F)\n* [Avast](https:\u002F\u002Fwww.avast.com\u002F)\n* [BAE Systems](https:\u002F\u002Fwww.baesystems.com\u002Fhome?r=ai)\n* [Bayshore Networks, Inc.](https:\u002F\u002Fwww.bayshorenetworks.com)\n* [Binalyze](https:\u002F\u002Fwww.binalyze.com\u002F)\n* [BinaryAlert](https:\u002F\u002Fgithub.com\u002Fairbnb\u002Fbinaryalert)\n* [Blueliv](https:\u002F\u002Fwww.blueliv.com)\n* [Cado Security](https:\u002F\u002Fdocs.cadosecurity.com\u002Fcado-response\u002Finvestigate\u002Fdetections#setting-up-detections)\n* [Cisco Talos Intelligence Group](https:\u002F\u002Ftalosintelligence.com\u002F)\n* [Cloudina Security](https:\u002F\u002Fcloudina.co.uk)\n* [Cofense](https:\u002F\u002Fcofense.com)\n* [Conix](https:\u002F\u002Fwww.conix.fr)\n* [Corelight](https:\u002F\u002Fcorelight.com\u002Fproducts\u002Fyara)\n* [CounterCraft](https:\u002F\u002Fwww.countercraft.eu)\n* [Cuckoo Sandbox](https:\u002F\u002Fgithub.com\u002Fcuckoosandbox\u002Fcuckoo)\n* [Cyber Triage](https:\u002F\u002Fwww.cybertriage.com)\n* [Cybereason](https:\u002F\u002Fwww.cybereason.com)\n* [Digita Security](https:\u002F\u002Fdigitasecurity.com\u002Fproduct\u002Fuxprotect)\n* [Dragos Platform](https:\u002F\u002Fdragos.com\u002Fplatform\u002F)\n* [Dtex Systems](https:\u002F\u002Fdtexsystems.com)\n* [ESET](https:\u002F\u002Fwww.eset.com)\n* [ESTsecurity](https:\u002F\u002Fwww.estsecurity.com)\n* [Elastic Security](https:\u002F\u002Fgithub.com\u002Felastic\u002Fprotections-artifacts)\n* [FactorX.ai](https:\u002F\u002Ffactorx.ai)\n* [Fidelis XPS](https:\u002F\u002Fwww.fidelissecurity.com\u002Fnetwork-security-appliance\u002FFidelis-XPS)\n* [FireEye, Inc.](https:\u002F\u002Fwww.fireeye.com)\n* [Forcepoint](https:\u002F\u002Fwww.forcepoint.com)\n* [Fox-IT](https:\u002F\u002Fwww.fox-it.com)\n* [FSF](https:\u002F\u002Fgithub.com\u002FEmersonElectricCo\u002Ffsf)\n* [Guidance Software](https:\u002F\u002Fwww.guidancesoftware.com\u002Fendpointsecurity)\n* [Heroku](https:\u002F\u002Fheroku.com)\n* [Hornetsecurity](https:\u002F\u002Fwww.hornetsecurity.com\u002Fen\u002F)\n* [ICS Defense](https:\u002F\u002Ficsdefense.net\u002F)\n* [InQuest](https:\u002F\u002Fwww.inquest.net\u002F)\n* [IntelOwl](https:\u002F\u002Fgithub.com\u002Fintelowlproject\u002FIntelOwl)\n* [Joe Security](https:\u002F\u002Fwww.joesecurity.org)\n* [Kaspersky Lab](https:\u002F\u002Fwww.kaspersky.com)\n* [KnowBe4](https:\u002F\u002Fwww.knowbe4.com)\n* [Koodous](https:\u002F\u002Fkoodous.com\u002F)\n* [Laika BOSS](https:\u002F\u002Fgithub.com\u002Flmco\u002Flaikaboss)\n* [Lastline, Inc.](https:\u002F\u002Fwww.lastline.com)\n* [libguestfs](https:\u002F\u002Fwww.libguestfs.org\u002F)\n* [LimaCharlie](https:\u002F\u002Flimacharlie.io\u002F)\n* [Malpedia](https:\u002F\u002Fmalpedia.caad.fkie.fraunhofer.de\u002F)\n* [Malwation](https:\u002F\u002Fmalwation.com\u002F)\n* [McAfee Advanced Threat Defense](https:\u002F\u002Fmcafee.com\u002Fatd)\n* [Metaflows](https:\u002F\u002Fwww.metaflows.com)\n* [NBS System](https:\u002F\u002Fwww.nbs-system.com\u002F)\n* [ndaal](https:\u002F\u002Fndaal.eu)\n* [NetLock](https:\u002F\u002Fnetlockendpoint.com)\n* [Nextron Systems](https:\u002F\u002Fwww.nextron-systems.com)\n* [Nozomi Networks](https:\u002F\u002Fwww.nozominetworks.com)\n* [osquery](https:\u002F\u002Fwww.osquery.io)\n* [Payload Security](https:\u002F\u002Fwww.payload-security.com)\n* [PhishMe](https:\u002F\u002Fphishme.com\u002F)\n* [Picus Security](https:\u002F\u002Fwww.picussecurity.com\u002F)\n* [Radare2](https:\u002F\u002Frada.re)\n* [RedSocks Security](https:\u002F\u002Fredsocks.eu\u002F)\n* [ReversingLabs](https:\u002F\u002Freversinglabs.com)\n* [Scanii](https:\u002F\u002Fscanii.com)\n* [SecondWrite](https:\u002F\u002Fwww.secondwrite.com)\n* [SonicWall](https:\u002F\u002Fwww.sonicwall.com\u002F)\n* [SpamStopsHere](https:\u002F\u002Fwww.spamstopshere.com)\n* [Spyre](https:\u002F\u002Fgithub.com\u002Fspyre-project\u002Fspyre)\n* [stoQ](https:\u002F\u002Fstoq.punchcyber.com)\n* [Sublime Security](https:\u002F\u002Fsublime.security)\n* [SumoLogic](https:\u002F\u002Fsumologic.com)\n* [Tanium](https:\u002F\u002Fwww.tanium.com\u002F)\n* [Tenable Network Security](https:\u002F\u002Fwww.tenable.com\u002F)\n* [Tenzir](https:\u002F\u002Ftenzir.com)\n* [The DigiTrust Group](https:\u002F\u002Fwww.digitrustgroup.com\u002F)\n* [ThreatConnect](https:\u002F\u002Fwww.threatconnect.com\u002F)\n* [ThreatStream, Inc.](https:\u002F\u002Fwww.threatstream.com)\n* [Thug](https:\u002F\u002Fgithub.com\u002Fbuffer\u002Fthug)\n* [Threat.Zone](https:\u002F\u002Fthreat.zone)\n* [TouchWeb](https:\u002F\u002Fwww.touchweb.fr)\n* [Trend Micro](https:\u002F\u002Fwww.trendmicro.com)\n* [UnpacMe](https:\u002F\u002Fwww.unpac.me)\n* [UpSight Security Inc.](https:\u002F\u002Fupsight.ai\u002F)\n* [Uptycs Inc](https:\u002F\u002Fwww.uptycs.com\u002F)\n* [Veeam](https:\u002F\u002Fwww.veeam.com\u002F)\n* [Verisys Antivirus API](https:\u002F\u002Fwww.ionxsolutions.com\u002Fproducts\u002Fverisys-virus-api)\n* [VirusTotal Intelligence](https:\u002F\u002Fwww.virustotal.com\u002Fintelligence\u002F)\n* [VMRay](https:\u002F\u002Fwww.vmray.com\u002F)\n* [Volexity](https:\u002F\u002Fwww.volexity.com\u002Fproducts-overview\u002Fvolcano\u002F)\n* [We Watch Your Website](https:\u002F\u002Fwww.wewatchyourwebsite.com\u002F)\n* [x64dbg](https:\u002F\u002Fx64dbg.com)\n* [YALIH](https:\u002F\u002Fgithub.com\u002FMasood-M\u002FYALIH)\n\nAre you using it? Want to see your site listed here?\n","YARA 是一个主要用于帮助恶意软件研究人员识别和分类恶意软件样本的工具。它允许用户基于文本或二进制模式创建描述（规则），这些规则由一组字符串和布尔表达式组成，用于定义匹配逻辑。YARA 支持使用通配符、大小写不敏感字符串、正则表达式等高级功能来编写复杂的规则。该工具跨平台运行，支持Windows、Linux和Mac OS X，并可通过命令行界面或Python脚本调用yara-python扩展进行操作。YARA非常适合需要对大量文件进行自动分析以检测潜在威胁的安全研究场景，如企业安全监控、反病毒软件开发等领域。",2,"2026-06-11 03:06:12","top_language"]