Issue with invalid field name "imphash" on macOS 10.14

Hestat / calamity

A script to assist in processing forensic RAM captures for malware triage

GNU General Public License v3.0

27 stars 7 forks source link

Issue with invalid field name "imphash" on macOS 10.14 #1

Closed R34rvi3w closed 5 years ago

R34rvi3w commented 5 years ago

Seems tied to Yara and Yara-rules with OpenSSL. I've tried several things including moving down to Yara-rules and Yara 3.6.2 as some reported this worked prior. I have linked /usr/bin/openssl to the home-brew 1.0.2s however I cannot determine how to get this to work and I'd really like to use Calamity on macOS. Thoughts?

R34rvi3w commented 5 years ago

Seems related to Yara-python and py crypto lib - seems its been deprecated for Loki - might consider using SPARK Core instead