Module 13 · Malware Family Classification

Last updated: April 29, 2026

Classifying samples by family enables tracking actor evolution. YARA is the de-facto language.

YARA basics

rule MyMalware_v2 {
    meta:
        author = "RingSafe"
        family = "Cobalt Strike"
        version = "4.x"
    strings:
        $beacon_str = "Mozilla/5.0 (Windows NT 6.1)" wide
        $config_marker = { 00 01 00 0E ?? ?? }
    condition:
        uint16(0) == 0x5A4D and any of them
}