YARA helps malware researchers identify and classify samples by matching textual or binary patterns with rules.
Yara
A pattern-matching tool by VirusTotal for helping malware researchers identify and classify malware samples.
About Yara
YARA is a pattern-matching tool that helps identify and classify malware samples. Its source code is hosted in a GitHub repository under VirusTotal's account. Rules are not limited to malware, since you can describe whatever you want using textual or binary patterns. Each rule pairs a set of strings with a boolean expression that determines its logic.
Pricing is not clearly stated.
Key features
- Rules built from textual or binary patterns
- Rules that combine strings with a boolean expression
- Wild-cards, case-insensitive strings, regular expressions and special operators
- Command-line interface and yara-python extension
- Runs on Windows, Linux and Mac OS X
Best for: Malware researchers and others who need to classify files with custom pattern rules.
Good for
- Source code published under the BSD-3-Clause license
Watch out for
- The project is in maintenance mode
Yara at a glance
- Website
- github.com/virustotal/yara
- Type
- Open-source project
- Pricing
- Not confirmed. Check the site
- Platforms
- Windows, Linux, macOS
- Details verified
- Oct 22, 2026 · Official source
- Open source
- Yes · Source code
- Language
- English
- Last checked
- Oct 5, 2026 · Online when checked
- Listed
- Oct 5, 2026
Yara alternatives
Tools and sites you could use instead, ranked by how closely they match.
This open-source Windows Forms application uploads files to VirusTotal; the project notes it is not officially supported.
Open source
VirusTotal's vt-cli is a command-line interface for the service, with its repository written in Go.
Open source
Manalyze statically analyzes PE executables and collects signals that may indicate malicious behavior.
Open source
5 alternatives
Grype scans container images and filesystems for vulnerabilities; its repository lists container and security topics.
Open source
5 alternativesWinitor's pestudio accelerates malware assessment by identifying indicators in Windows executable files.
Popular in Antivirus & Malware Protection
Well-known listings from the same topic.
Microsoft Safety Scannerlearn.microsoft.com/en-us/defender-endpoint/sa…Sandboxie Plussandboxie-plus.comMalwarebytesmalwarebytes.comANY.RUNany.runSandboxsandbox.pikker.eeID Ransomwareid-ransomware.malwarehunterteam.com
Is something wrong or out of date?
Tell us and an editor will check it.
Own this website?
Claim this listing
Claim the listing and suggest updates yourself. An editor checks every claim first.