YAMA - Yet Another Memory Analyzer for malware detection

项目说明

YAMA

Yet Another Memory Analyzer for malware detection

<di="left"><img src="img/yama.png" width="128"></div>

Concept

YAMA is a system for generating scanner that can inspect specific malware during incident response. The scanner generated by YAMA is designed to explore the memory of Windows OS and detect malware. With the increasing pre of fileless malware that deploys only in memory, YAMA aims to facilitate quick response in incident handling by detecting such malware.

Features

How the scanner works

YAMA scanner operates as a Windows UserMode application, analyzing the memory spaces of processes running in user mode, scanning memory spaces with suspicious attributes using YARA, and identifying malware.

First, YAMA analyzes each process and extracts the following information:

Next, YAMA determines the memory spaces to be inspected based on the analyzed information. This is done to select only necessary memory spaces and avoid performance impacts from searching the entire memory space.

Finally, YAMA inspects the targeted memory spaces using YARA rules embedded in the binary's resource section.

Use case

By combining YARA rules a on platforms like GitHub, it is possible to create a memory scanner that can in traces of specific targeted attack campaigns.

For example, building a YAMA scanner using the APT10 rule from JPCERTCC/jpcert-yara would create a tool suitable for threat hunting APT10 malware.

JPCERTCC/jpcert-yara offers numerous YARA rules compatible with APT campaigns such as APT10, APT29, BlackTech, and Lazarus, as well as rules for different types of malware. It is highly recommended for reference.

How to build your custom YAMA scanner

Refer to the Wiki.

Dependencies

This project relies on the following open-source software to function properly:

Acknowledgements and Inspirations

We'd like to thank these GitHub repositories that inspired and influenced our project:

项目信息

开发语言：C++

Star 数：209

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Yet Another Memory Analyzer for malware detection展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。