yara-sigs

To scan a memory dump for malware signatures, load YARA rule sets and apply them to memory regions within a state snapshot to detect packers, crypto constants, and anti-debug patterns. The scan produces a yara_results.json file detailing the matches.

YARA can detect malware signatures, packers, cryptographic constants, and anti-debug patterns within memory snapshots. It scans captured memory region dumps like .bin files to identify these suspicious patterns across multiple modules.

Yes, you need the yara-python dependency installed to run memory snapshot scans. The Skill requires yara-python, a captured state snapshot, and access to yarasigs to execute the signature detection process.

Yes, you can optionally merge multiple memory regions belonging to a single module using a module-filter. This supports cross-boundary YARA rules and yields consolidated scan results for the targeted module.

You analyze YARA scan results by reviewing the generated yara_results.json output. This structured file contains per-match details including rule names, sources, specific regions hit, and string matches for quick forensic analysis.

The best way to detect packers and anti-debug patterns is to run a YARA scan with a chosen category like packers, crypto, antidebug, or all against a state snapshot. This applies targeted rule sets directly to the captured memory regions.