Skip to content
THREATWIRE

YARA

Pattern matching for malware research

Tool and rule language from VirusTotal to identify and classify malware samples using textual and binary patterns plus conditions.

Open sourceBSD-3-Clause
Visit website View repository Docs
Homepage of YARA
Official website (virustotal.github.io), captured by ThreatWire.

What YARA does

YARA rules describe families of malware or other files with strings, hex patterns and boolean conditions, and modules expose file metadata (PE, ELF, hashes, math). The engine scans files or process memory and reports which rules match.

YARA rules are a common way to share detection logic in threat intelligence. VirusTotal also develops YARA-X, a Rust rewrite, in a separate repository.

Key features

  • Rule language with strings, hex patterns and conditions
  • Modules for PE, ELF, hashes and more
  • File and process memory scanning
  • C library and Python bindings
  • Widely used rule sharing format

Licence

BSD-3-Clause · BSD 3-Clause License · Open source

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: BSD-3-Clause.

Security of YARA itself

No published advisory found for YARA in GitHub repository advisories. That does not mean the tool has no vulnerabilities.

Sources: GitHub repository advisories · checked 2026-10-20.

Categories and tags

Reverse engineering and malware analysisThreat intelligence platformsDigital forensics and incident response#malware#rules#pattern-matching#c

Related tools

  • radare2

    UNIX-like reverse engineering framework

    Command-line reverse engineering framework with a disassembler, debugger, hex editor and scripting for many architectures and file formats.

    Stars
    25k
    Forks
    3.4k
    Last commit
    today
    LGPL-3.0-onlyOpen sourceReverse engineering and malware analysis
    Alternative toIDA Pro

  • Ghidra

    Software reverse engineering framework from the NSA

    Reverse engineering suite released by the NSA with disassembly, decompilation, graphing and scripting for many processor architectures.

    Stars
    92k
    Forks
    10k
    Last commit
    today
    Apache-2.0Open sourceReverse engineering and malware analysis
    Alternative toIDA Pro

  • Apktool

    Reverse engineering tool for Android APK files

    Decodes Android APK resources and code to a near-original form (smali) and rebuilds them after modification, for analysis and testing.

    Stars
    26k
    Forks
    4.1k
    Last commit
    2 days ago
    Apache-2.0Open sourceMobile application security

  • osquery

    Query your endpoints with SQL

    Exposes the operating system as a relational database so processes, users, packages and configuration can be queried with SQL on Linux, macOS and Windows.

    Stars
    24k
    Forks
    2.6k
    Last commit
    4 days ago
    Apache-2.0 OR GPL-2.0-onlyOpen sourceEndpoint visibility and response
    Alternative toCrowdStrike Falcon

  • SpiderFoot

    OSINT automation for footprinting

    OSINT automation tool with a web UI and more than 200 modules that gather data on IPs, domains, emails, names and more from public sources.

    Stars
    24k
    Forks
    3.8k
    Last commit
    2 years ago
    MITOpen sourceOSINT and attack surface discovery
    Alternative toMaltego

Related on ThreatWire

Share on X@threatwire_https://www.threatwire.tech/tools/yara