IRFuzz : Simple Scanner with Yara Rules

IRFuzz is a simple scanner with yara rules for document archives or any files.

Install

1. Prerequisites

Linux or OS X

  • Yara: just use the latest release source code, compile and install it (or install it via pip install yara-python)
  • Yara Rules – You may download yara rules from here or import your own custom ruleset.
  • Python dependencies

Dependencies are managed with pipenv. To get started install dependencies and activate virtual environment with following commands:

$ pipenv install
$ pipenv shell

Running IRFuzz – Watchd

Running IRFuzz

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv

Supported Features

  • Scans new files with inotify
  • Polling if inotify is not supported
  • Custom extensions are supported
  • Delete mode will delete matched file
  • Recursive directory scan
  • Lists matched Yara functions with yarastrings with ctime
  • CSV results for Filebeat

Custom Extensions

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv --extensions .zip,.rar

Alert Matching Yara Rule

Generate token from https://irfuzz.com/tokens

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv --extensions .php --token tokenhere

Configure alerts from the website to Telegram or your email.

Delete Matched File

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv --delete

Polling (Inotify Not Supported)

$ python -m watchd.watch ~/tools/IR/ -y rules/maldocs --csv csvfile.csv --polling

Adds –poll option to force the use of polling mechanism to detect changes in data directory. Polling is slower than the underlying mechanism in OS to detect changes but it’s necessary with certain file systems such as SMB mounts.

  • Default Extensions If No Extensions Are Mentioned
    • Microsoft Office Word supported file formats
      • .doc .docm .docx .docx .dot .dotm .dotx .odt
    • Microsoft Office Excel supported file formats
      • .ods .xla .xlam .xls .xls .xlsb .xlsm .xlsx .xlsx .xlt .xltm .xltx .xlw
    • Microsoft Office PowerPoint supported file formats
      • .pot .potm .potx .ppa .ppam .pps .ppsm .ppsx .ppt .pptm .pptx .pptx .pptx
    • zipdump.py
R K

Recent Posts

Playwright-MCP : A Powerful Tool For Browser Automation

Playwright-MCP (Model Context Protocol) is a cutting-edge tool designed to bridge the gap between AI…

2 weeks ago

JBDev : A Tool For Jailbreak And TrollStore Development

JBDev is a specialized development tool designed to streamline the creation and debugging of jailbreak…

2 weeks ago

Kereva LLM Code Scanner : A Revolutionary Tool For Python Applications Using LLMs

The Kereva LLM Code Scanner is an innovative static analysis tool tailored for Python applications…

2 weeks ago

Nuclei-Templates-Labs : A Hands-On Security Testing Playground

Nuclei-Templates-Labs is a dynamic and comprehensive repository designed for security researchers, learners, and organizations to…

2 weeks ago

SSH-Stealer : The Stealthy Threat Of Advanced Credential Theft

SSH-Stealer and RunAs-Stealer are malicious tools designed to stealthily harvest SSH credentials, enabling attackers to…

2 weeks ago

ollvm-unflattener : A Tool For Reversing Control Flow Flattening In OLLVM

Control flow flattening is a common obfuscation technique used by OLLVM (Obfuscator-LLVM) to transform executable…

2 weeks ago