base64_substring

A tool that generates YARA rules to search for specific terms within base64-encoded malware samples by enumerating all possible encoding variations.

Security Operations

Free

Visit website

base64_substring

A tool that generates YARA rules to search for specific terms within base64-encoded malware samples by enumerating all possible encoding variations.

Security Operations•Digital Forensics and Incident Response

Free

Security Analysis Digital Forensics Malware Analysis

40stars

GitHub Stars

13 Jul

Last commit

Visit Website

Updated 16 Oct 25

base64_substring Description

The base64_substring tool is designed to assist malware analysts in searching through base64-encoded samples by generating comprehensive search patterns. The tool enumerates all possible base64 encodings for a given search term, accounting for different alignment positions and padding scenarios that can occur when text is encoded within larger data structures. It automatically generates YARA rules that check for these various encoding possibilities, enabling analysts to detect specific strings or patterns within base64-encoded malware samples regardless of their position or alignment within the encoded data. The tool addresses the challenge of searching for known strings in base64-encoded content where the encoding can vary depending on the surrounding data and byte alignment.