yara

Pattern-matching engine for malware classification (Kali / Debian).

$ yara rules.yar suspicious.bin
$ yara -r rules.yar /var/lib/samples/
$ yara -s rules.yar file
$ yara -C rules.yarc target