sudo apt-get install automake libtool make gcc flex bison libssl-dev libjansson-dev libmagic-dev
wget https://github.com/VirusTotal/yara/archive/v3.9.0.tar.gz
tar -xvf yara-3.9.0.tar.gz
cd yara-3.9.0
./build.sh --enable-cuckoo --enable-magic --enable-dotnet
make
sudo make install
(Optional)
pip install yara-python
or
git clone https://github.com/VirusTotal/yara-python
cd yara-python
python setup.py build --enable-cuckoo
python setup.py installcuckooyara.py : /usr/local/lib/python2.7/dist-packages/cuckoo/reporting/cuckooyara.py
config.py : /usr/local/lib/python2.7/dist-packages/cuckoo/common/config.py
reporting.conf : .cuckoo/conf/reporting.conf
$yara -x cuckoo=behavior_report_file rules_file pe_fileimport yara
rules = yara.compile('./rules_file')
report_file = open('./behavior_report_file')
report_data = report_file.read()
rules.match(pe_file, modules_data={'cuckoo': bytes(report_data)})import "cuckoo"
rule test
{
condition:
cuckoo.network.dns_lookup(/\.com/) or
cuckoo.network.http_request(/\.com/)
}
cuckoo module uses the value of report.json to compare.
last argument does not affect the cuckoo rule.
Virustotal Intelligence supported YARA's cuckoo module. (Link)
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent