text: Yara – Identify and Classify Malware Samples
  Y:
  Ubuntu, Debian:
  Yara help information can be listed simply like below.
  Yara Help
  We can see also the usage of yara command like below. Yara supports target as binary file, directory or process id as we see below.
  Download Binary Sample
  We will download our binary samples from web. Our sample binary is popular ssh client named
  Putty . Download following link to get.
  We use
  wget for Linux for download operation.
  Run Yara
  Now we can run our first rule with yara.
  The result is not se exiting but it works. This rule file simply print text
  dummy and the file name in this example
  putty.exe
  Rule
  Yara rule syntax is similar to C programming language. Here is a simple rule named
  myrule . .
  If we run the rule like below the rule matches the condition and prints the rule name with the binary name..
  For example in this example we will check whether given file is a
  Portable Executable (PE) file..
  Private Rules
  Yara provides inheritance like feature to create basic rules and create super rules which inherits these basic rules conditions. In this situations we can use
  private keyword before rule definition. We will use private rules for building blocks of other rules.
  Rules Tags
  Tags are used while printing the matched rules in order to filter. They have no effect on matching. There is no restriction about tag count. In this rules
  Foo ,
  Bar and
  Baz are tags of the rules.
  Metadata
  We may need to specify additional information about the rule. We can use
  metadata for this work. We will create a new section with
  meta: keyword like below.
  Modules
  Modules are extensions for YARA. We can use some modules like
  PE or
  Cuckoo those comes with YARA. We can also write our own modules too. Modules can be imported with
  import statement.
  In this example we will import and use
  PE module.
  Including Other Files
  We can include other rule files with
  include keyword. We will simply include other yara rule files in the following example. We can use relative or absolute path without a problem.