Skip to content

Generate a Yara rule to find base64-encoded files containg a specific keyword

License

Notifications You must be signed in to change notification settings

DissectMalware/base64_substring

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 
 
 
 
 

Repository files navigation

About

Often malware analysts require to search through base64-encoded samples with a search term such as Application.Run. base64_substring helps them by enumerating all possible base64 encoding for a given search term and generating a yara rule that checks those possiblities.

How to Run

Example: generating a yara rule that matches base64-encoded file containing Application term.

> python generate_yara_rule.py
> Please enter a rule name
  MyRule
> Please enter a text
  Application

Further Reading

"Searching for Content in Base-64 Strings" by Lee Holmes

About

Generate a Yara rule to find base64-encoded files containg a specific keyword

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages