YARA is a tool primarily used in malware research and detection.
It provides a rule-based approach to create descriptions of malware families based on regular expression, textual or binary patterns. A description is essentially a YARA rule name, where these rules consist of sets of strings and a Boolean expression.
Analysts write YARA rules to capture the DNA of malware families, persistent elements like code fragments, configuration strings, and structural patterns expressed as text, hex sequences, or regex with Boolean logic. This signature-based detection survives file mutations that defeat hash matching, enabling identification of variants and related samples across large datasets.
YARA was originally developed by Victor Alvarez of VirusTotal and released on GitHub in 2013. The name is an abbreviation of YARA: Another Recursive Acronym or Yet Another Ridiculous Acronym. In 2024, Alvarez announced that YARA would be superseded by a rewrite called YARA-X, written in Rust. A first stable version of YARA-X was released in June 2025, marking the passage of the original YARA into maintenance mode.
What is YARA?
YARA by VirusTotal is open-source Windows software in the antivirus & anti-malware category. It ranks 2nd by popularity among antivirus & anti-malware in this catalogue. It is written in C.
Installation and requirements
The publisher provides Portable installers for 64-bit and 32-bit Windows. It runs without installation (portable).
Updates and version history
The current version is 4.5.5, released on October 30, 2025. The version history goes back to June 15, 2023: 4 releases, all linked to the official files. That is about 1.7 releases a year.
Popularity and file types
The Chocolatey package has been downloaded 101,124 times. The source code on GitHub (VirusTotal/yara) has 9,961 stars. Wikipedia has an article about it in 8 of our languages. Similar programs include ClamAV, Malwarebytes and FLOSS.
Project description on GitHub: “The pattern matching swiss knife”
Pros / Cons
Pros
- Open source: the code can be inspected and built by anyone
- Portable: runs without installation
- Large user base
Cons
- No native ARM64 build
In short: YARA is an open-source antivirus & anti-malware tool for 64-bit and 32-bit PCs.
Is YARA safe to download?
- The file is served by github.com, the publisher’s own domain
- The download link uses HTTPS
- A SHA256 hash is published, so you can verify the file:
352396C8A3D9B31B157A4820ABD3B9347FC934A2314CDDA8A4F566A5570163E4· Open the VirusTotal report for this hash - The link has not been checked yet
- The source code is public
- ExeAtlas does not host, wrap or modify installers
Related guide: How to check a file’s SHA256 hash on Windows
Recent versions
All 4 versions ›4 versions over 2 years · about 1.7 a year
| Version | Date | Size | Files |
|---|---|---|---|
| 4.5.5Latest | October 30, 2025 | — | 32-bit ZIP64-bit ZIP |
| 4.5.3 | May 23, 2025 | — | 64-bit ZIP32-bit ZIP |
| 4.5.2 | September 10, 2024 | — | 32-bit ZIP64-bit ZIP |
| 4.3.2 | June 15, 2023 | — | 64-bit ZIP |
Install from the command line
Silent install ›winget install --id VirusTotal.YARA -echoco install yara -yscoop install main/yaraRelated guide: How to use winget: install and update apps
Also for other systems
brew install yaraInformation
- Publisher
- VirusTotal
- Category
- Antivirus & anti-malware
- Licence
- BSD-3-Clause
- Price
- Free
- Source code
- github.com/VirusTotal/yara
- Written in
- C
- Requires
- Windows 11 / 10
- Architecture
- 64-bit, 32-bit
- Installer
- Portable
- Version
- 4.5.5
- Released
- October 30, 2025
- Added to the catalogue
- June 15, 2023
- Versions listed
- 4
- Updates / year
- 1.7
- Chocolatey downloads
- 101,124
- GitHub stars
- 9,961
- GitHub forks
- 1,588
- Website
- virustotal.github.io
- winget ID
- VirusTotal.YARA
- Chocolatey package
- yara
- Scoop package
- main/yara
Ratings and reviews
No reviews yet. Be the first to rate it.
Alternatives to YARA
See all ›-
ClamAV1.5.4ClamAV® is an open-source antivirus engine for detecting trojans, viruses, malware & other malicious threats.Open source30K ↓ -
Proprietary10.6M ↓ -
Open source3K ↓ -
Proprietary229.8K ↓ -
Free198.7K ↓ -
ESET Endpoint Antivirus13.1.2036.0ESET Endpoint Antivirus is a complete security solution produced from our long-term effort to combine maximum protection and a minimal system footprint.Proprietary168.7K ↓ -
Velociraptor0.65.3Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language (VQL) queries.Open source★ 4.4K -
Free★ 1.6K
Frequently asked questions
Is YARA free?
Yes. YARA is open-source software under the BSD-3-Clause licence.
Is YARA safe to download?
The download comes from github.com, which belongs to the publisher; ExeAtlas does not host or change the file. Compare its SHA256 hash with the one shown here, or open the VirusTotal report for that hash.
How do I install YARA with winget?
Open PowerShell or Windows Terminal and run the winget command shown on this page. winget downloads the official installer and checks its SHA256 hash before running it.
Does YARA run on ARM (Windows on Arm)?
There is no ARM64 build; Windows 11 on Arm can run the 64-bit and 32-bit version through emulation.
Where can I download an older version of YARA?
The versions page lists all 4 versions with links to their official installer files, back to June 15, 2023.
Can I use YARA without administrator rights?
Yes, it is portable: unpack and run it.
What are alternatives to YARA?
ClamAV, Malwarebytes, FLOSS, SUPERAntiSpyware and Emsisoft Emergency Kit. The alternatives page compares them.
