Technology and tools
What is YARA?
A pattern-matching language for describing malware by strings, bytes and conditions, used to scan files and memory for known families.
YARA is a tool and rule language for identifying files by patterns. A rule lists strings, byte sequences or regular expressions and a condition for how they must appear, for example "at least three of these strings and the file is under 500 KB".
Analysts write YARA rules for malware families, tools and documents, then run them against file stores, sandboxes, memory images and repositories such as VirusTotal. A good rule targets what the author cannot easily change, not a single hash.