Kaspersky shares malware detection tool with industry
Kaspersky make malware scanner available to other security researchers
Kaspersky Lab has made a one of its malware detection tools for researchers available as open source.
The KLara tool was created by Kaspersky to accelerate the search for related malware samples. The distributed, rule-based malware scanner has been used by its own security team, and will now be available online for other security professionals to use.
Detecting related malware samples is a key part of threat research, helping researchers to track cyber-threats over time and protect users against the full scope of a malicious operation. Many researchers rely on YARA rules (a common tool for malware detection), which help them identify related malware by looking for specific characteristics or patterns.
YARA rules are particularly useful when tracking advanced threat actors and operations involving ‘fileless' malware, or legitimate tools, or those where malicious code is adapted to individual campaigns or even victims. However, creating quality YARA rules and testing them can be a time-consuming operation.
To address this problem, Kaspersky Lab's researchers created KLara: a distributed system that can run a fast, distributed series of YARA searches, involving multiple rules and multiple sample collections, including researchers' own private malware collections. This allows related samples to be identified more quickly, leading to faster protection for users. The team has now passed KLara to the open source domain where it is available for everyone to use.
"Detecting cyber-threats requires tools and systems that can hunt effectively for malware - particularly when tracking advanced targeted threat campaigns through months or even years of activity. We created KLara to help us hunt threats better and faster and we'd now like to share it with the rest of the security community so that everyone can enjoy the benefits of the tool," said Dan Demeter, security researcher at Kaspersky Lab and one of KLara's creators.
The software is available from Kaspersky Lab's official GitHub account: