search

VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
8.28k stars 1.45k forks source link

RFE: Support for an import hash and/or a fuzzy hash #1495

Open Kogl1n opened 3 years ago

Kogl1n commented 3 years ago

Hello Yara developers!

Imphash currently is the only import hash in Yara's official modules. Regarding Linux, there is not even one import or fuzzy hash available. Issue #216 (telfhash) and issue #1378 (pehash) apparently didn't make it since the first required a disassembler dependency and the latter had problems with a correct implementation of the paper. Since VT implemented vhash and also uses ssdeep, Yara supporting those would certainly be helpful in utilizing the intel on the endpoint. Therefore I kindly request to consider it in your roadmap! Thank you!

wanderingbug commented 2 years ago

I second this, it would be very very helpful

dmknght commented 1 year ago

Latest Yara added telfhash. The ssdeep library is inside libfuzzy-dev and it looks kinda easy to call the APIs from this lib. Hope Yara can officially add the ssdeep