# YARA

> VirusTotal's pattern-matching tool for identifying and classifying files such as malware samples with rules that combine text, hex and regular-expression strings with a Boolean condition. It scans a file, a folder or a running process from the command line, through the libyara C API or from Python with yara-python. Modules expose parsed structure to rules: pe and elf expose most fields of PE and ELF headers, dotnet adds .NET metadata, math adds calculations such as entropy, and the optional magic and cuckoo modules add libmagic file types and Cuckoo sandbox behavior reports.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-11-05
- Added to the catalog: 2026-11-06
- Original resource: <https://github.com/VirusTotal/yara>
- Primary source: <https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/README.md>
- Catalog page: <https://awesomerea.org/resources/yara/>
- Record JSON: <https://awesomerea.org/resources/yara/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/yara/index.md)

## Requirements & limits

- **Prerequisites:** Runs on Windows, Linux and macOS; release at review: v4.6.0, published 2026-10-27. Source builds need automake, libtool, make, gcc and pkg-config. Features that depend on OpenSSL are enabled only when OpenSSL is installed, and the cuckoo (Jansson) and magic (libmagic) modules are compiled only with --enable-cuckoo or --enable-magic; vcpkg also packages YARA.
- **Limits:** The README marks YARA as in maintenance mode; the YARA-X README says YARA still receives bug fixes and minor features, while new modules and large features go only into YARA-X. The command-line documentation warns that compiled rules from untrusted sources can lead to the execution of malicious code; since YARA 3.9 they load only with -C.
- **License:** BSD-3-Clause per COPYING.

## Primary sources

1. <https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/README.md>
2. <https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/docs/gettingstarted.rst>
3. <https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/docs/commandline.rst>
4. <https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/docs/modules/pe.rst>
5. <https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/docs/modules/elf.rst>
6. <https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/docs/modules/math.rst>
7. <https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/docs/modules/cuckoo.rst>
8. <https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/COPYING>
9. <https://github.com/VirusTotal/yara/releases/tag/v4.6.0>
10. <https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/README.md>
11. <https://virustotal.github.io/yara-x/blog/yara-x-is-stable/>

## More in Native binaries

- [Cheat Engine](https://awesomerea.org/resources/cheat-engine/index.md) · Tool
- [Noriben](https://awesomerea.org/resources/noriben/index.md) · Tool
- [QEMU](https://awesomerea.org/resources/qemu/index.md) · Tool
- [Hex Fiend](https://awesomerea.org/resources/hex-fiend/index.md) · Tool
- [ScyllaHide](https://awesomerea.org/resources/scyllahide/index.md) · Tool
- [YARA-X](https://awesomerea.org/resources/yara-x/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.