Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Possile MD5 Skill Issue #2024

Open
WinterLily opened this issue Dec 21, 2023 · 0 comments
Open

Possile MD5 Skill Issue #2024

WinterLily opened this issue Dec 21, 2023 · 0 comments
Labels

Comments

@WinterLily
Copy link

Describe the bug
hash.md5 doesn't seem to be working, attempting to compile a rule (yara-python) throws 'yara.SyntaxError: ~/analyzeFile/yaraRules/sourceRules/./malware/RAT_CrossRAT.yar(19): invalid field name "md5"'
To Reproduce
Steps to reproduce the behavior:

  1. New Ubuntu 22.04 server,
  2. YARA built from source.
  3. yara-python module installed.
  4. Attempt to compile rule containing hash.md5(0, filesize) == "some_hash" condition.

Expected behavior
Would expect the rule to compile.

Please complete the following information:

  • OS: Ubuntu 22.04.3 LTS
  • YARA version: 4.4

Additional context
This also happens for sha1 and sha256 - I'm aware that OpenSSL has recently deprecated these, but I assume there is/will be some workaround so that hash-based rules continue to work?

@WinterLily WinterLily added the bug label Dec 21, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant