Search yara hits other than YRP

[rimuru1066]

It seems that every yara search for yrp/* works, but not for any other.

Example hash: 6d14bb5ee2d7b2ecb28530324e7452a48476c79f7ded0a5727035d74744e5772

It has a CuckooSandbox/shellcode tag in the Yara hits, but the search returns nothing.

[silascutler]

Had this exact same issue earlier this week. Thanks for the spot

[Squiblydoo]

This is to note that the problem seems to still exist. I was able to reproduce it by looking for any rule using the following sets. Or even putting "[rulename]/*". Each of the following return with No results.

            "CuckooSandbox/*"  
            "FlorianRoth/*"    
            "KevTheHermit/*"
            "BAMFDetect/*" 

Using "YRP/*" returns a message that says "YARA rule with this name could not be found", which is probably the correct and expected behavior. This suggests to me that the check for the existence of the YARA rules themselves for the other repositories is not working as expected.

[larsborn]

There was a logic bug in the code preventing any YARA-based search from running. This should be fixed now.

@Squiblydoo is this kind of wild-card search a use case or did you just post it to help debugging? Asking because the current implementation doesn't allow wildcards but it would be possible to add that feature.

[Squiblydoo]

I posted it as a method to help debugging. Unfortunately, because of this and adjacent issues, I haven't used Malshare much so I cannot comment on need or desire for the feature.