datto / fireeye-red-team-countermeasure-scanner

A scanner to detect the use of stolen FireEye red team tools
BSD 2-Clause "Simplified" License
20 stars 5 forks source link

YARA unable to run due to missing Visual C++ Redistributable #3

Open BlueToast opened 3 years ago

BlueToast commented 3 years ago

I have received this error message upon running build23.ps1:

ERROR: YARA was unable to run on this device. The Visual C++ Redistributable is required in order to use YARA.

I have the latest versions of both the 32-bit and 64-bit of the following runtimes installed:

It is greatly appreciated to have this scanner tool available, but it is somewhat concerning that the script errors out on a "missing distributable" error message despite all supported runtime redistributables being installed. Additionally, the README of this release does not specify what runtime (year) and version needs to be installed.

Datto-StanLee commented 3 years ago

Hi; Take a look here. Their documentation isn't great but it suggests that the Visual C++ redistributable 2010 is required. Remember also that you need both the x86 and x64 builds installed if you are on a 64-bit system. If you continue to see issues I think you may have more luck asking VirusTotal. Try executing the yara.exe binary directly on your device and seeing if it gives you an error that makes more sense than our best guess within the script.

compunutter commented 2 years ago

Had a server with the same error, installed the vcpp redist one by one testing until I found the one that allowed the script to run. In the end it was the 2015-2022 x64 version that did the trick: https://docs.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170#visual-studio-2015-2017-2019-and-2022