0

so I started using Yara rules, I have a mysql database with files and their base64 encodes saved in a column. Is there any way to input in Yara a base64 string without storing it in a file? if so, what is the command? If not, is there a way in Python? This is what I tried to do:

rule string_exist{
    strings:
        $a = "just for use in the Virtual Mechanics tutorials. More text. And more" base64
    condition:
        $a
}

and then in cmd: yara64.exe -r manual_code.yar ..........long base64 string`` but recieved an error: could not open file

Thanks in advance.

IdanB
  • 167
  • 1
  • 3
  • 13

0 Answers0