Blog

YARA v4.0.0: BASE64 Strings, (Sun, May 10th)

YARA version 4.0.0 was released.

One of its new features that caught my eye, is base64 strings.

This is the example rule for the base64 modifier from YARA’s documentation:

rule Base64Example1
{
    strings:
        $a = “This program cannot” base64

    condition:
        $a
}

This rule will search for ASCII strings that are possible BASE64-encodings of ASCII string “This program cannot”.

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com DidierStevensLabs.com

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Reposted from SANS. View original.

Posted in: SANS

Leave a Comment (0) ↓