FLARE FLOSS vs YARA
GitHub Stats
About FLARE FLOSS
FLARE FLOSS (FireEye Labs Obfuscated String Solver) automatically extracts obfuscated strings from malware binaries. While the standard 'strings' utility only finds plaintext, FLOSS uses advanced static analysis techniques to identify string decoding routines, emulates them, and recovers the decoded strings. It handles XOR encoding, stack strings (built character-by-character), tight strings (short encoded sequences), and custom decryption routines. FLOSS integrates with FLARE's analysis toolkit and produces output compatible with YARA rule generation. It dramatically reduces manual reverse engineering time for string-heavy malware analysis.
About YARA
YARA is the pattern matching swiss knife for malware researchers. It allows you to create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each rule consists of a set of strings and a boolean expression which determines its logic. YARA is used by security researchers, incident responders, and threat hunters to identify and classify malware samples, suspicious files, and network artifacts.
Platform Support
Tags
FLARE FLOSS only
YARA only