Serious Discussion Looking for Help with YARA Rules for My Open-Source Antimalware Scanner

[eroniko]

Project: Antimalware Scanner with Multiple Detection Modules (Open Source)

Hi everyone,

As a hobby project, I developed an Antimalware Scanner, and I plan to share it as open-source on GitHub. Here are some details about the scanner:

• Programming Languages: The project is developed using Python, C++, and Delphi.
• Scanning Modules: It includes modules for NSRL whitelist, SSDEEP, TLSH, YARA rules, AI analysis, and digital signature checking.
• For example, when scanning a file, it checks:
  • NSRL whitelist
  • Digital signature verification
  • SSDEEP database
  • TLSH database (using Annoy for fast lookup)
  • YARA rules database
  • Performs an AI-based scan
• Based on the results of all these checks, it assigns an overall score to the file.
• Kernel-level Hooking: The scanner also features kernel-level hooking for enhanced control.
• Cloud Compatibility: It is designed to be compatible with cloud operations, although I haven't done detailed cloud testing yet.

Example Video of the Scan: A sample video of the scanning process is attached. Here are the steps performed during the scan of a single file:

1. Querying 55 million entries in the NSRL whitelist database.
2. Querying 1.5 million entries in the SSDEEP database.
3. Querying 50,000 entries in the TLSH database.
4. AI-based analysis.
5. Querying 9,000 YARA rules.

(Note: The databases used may not contain fully reliable data.)

Computer Specifications Used for the Scan:

• i3-9100f CPU
• 16GB RAM
• SSD

Question: I’m looking for a comprehensive YARA rule database. I tried using Nextron-Systems Thor Lite, but the .yas files are encrypted. I also downloaded YARA rules from Valhalla, but I encountered a lot of false positives, with many files being flagged as malware.

Does anyone have recommendations for a more reliable and advanced YARA rule database?

Thanks in advance for your suggestions!

Example Video of the Scan: Youtube Video

 

[Bot]

Hello,

Your project sounds impressive! For a comprehensive YARA rule database, you might want to consider using the YARA rules provided by the Yara-Rules project on GitHub. They have a good collection of rules, but remember that no database is perfect and false positives can occur. You might also want to consider developing your own rules based on your specific needs.

Good luck with your project!

 

[eroniko]

I have tested the YARA rules from GitHub, but the false positive rates are quite high.

 

[Shadowra]

Hello

If you have a compiled, usable version in English, I'd be happy to help you test it against real malware and healthy software

 

[eroniko]

Hello

If you have a compiled, usable version in English, I'd be happy to help you test it against real malware and healthy software

Thanks a lot for the offer! I'm still working on the software, but once it's ready for testing, I'd love to get your help with real malware and clean software. I’ll let you know when it's ready!