{"id":6931,"date":"2020-03-20T18:26:19","date_gmt":"2020-03-20T17:26:19","guid":{"rendered":"https:\/\/www.nextron-systems.com\/?p=6931"},"modified":"2022-03-25T14:14:58","modified_gmt":"2022-03-25T13:14:58","slug":"thor-lite-free-yara-and-ioc-scanner","status":"publish","type":"post","link":"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/","title":{"rendered":"THOR Lite – Free YARA and IOC Scanner"},"content":{"rendered":"

[et_pb_section fb_built=”1″ _builder_version=”4.4.1″][et_pb_row column_structure=”2_5,3_5″ _builder_version=”4.4.1″][et_pb_column type=”2_5″ _builder_version=”4.4.1″][et_pb_text _builder_version=”4.4.1″]<\/p>\n

We are proud to announce the release of THOR Lite. It is a trimmed-down version of THOR v10 with a reduced feature set and the open source signature base used in LOKI and the now obsolete scanner SPARK Core.<\/p>\n

It uses the completely rewritten code base of THOR v10 “Fusion” and is therefore faster, more thorough and stable than SPARK.<\/p>\n

 <\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”3_5″ _builder_version=”4.4.1″][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/03\/Screenshot-2020-03-20-at-14.01.17.png” _builder_version=”4.4.1″][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.4.1″][et_pb_column type=”4_4″ _builder_version=”4.4.1″][et_pb_text _builder_version=”4.4.1″]<\/p>\n

As you can see in the table below, we’ve come a long way since 2012. We’ve phased out the old THOR version based on Python and SPARK in 2019. Today, we’re replacing the community version of SPARK named SPARK Core with a community version of THOR v10, named THOR Lite.\u00a0<\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.4.1″][et_pb_column type=”4_4″ _builder_version=”4.4.1″][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/03\/Screenshot-2020-03-20-at-14.17.30.png” _builder_version=”4.4.1″][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”2_5,3_5″ _builder_version=”4.4.1″][et_pb_column type=”2_5″ _builder_version=”4.4.1″][et_pb_text _builder_version=”4.4.1″]<\/p>\n

There are two main differences between THOR Lite and THOR:\u00a0<\/p>\n

    \n
  1. Reduced feature set<\/li>\n
  2. Open source signature base<\/li>\n<\/ol>\n

    Apart from that, you’ll get a fully maintained and tested scanner pre-compiled for the Windows, Linux and macOS platform.\u00a0A limited support is available via the issues section on the <\/span>github page<\/a>\u00a0for auxiliary scripts.<\/p>\n

    [\/et_pb_text][\/et_pb_column][et_pb_column type=”3_5″ _builder_version=”4.4.1″][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/03\/Screenshot-2020-03-24-at-09.55.26.png” _builder_version=”4.4.1″ hover_enabled=”0″][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.4.1″][et_pb_column type=”4_4″ _builder_version=”4.4.1″][et_pb_text _builder_version=”4.4.1″]<\/p>\n

    Upgrading from SPARK Core<\/h3>\n

    There is no direct upgrade path from SPARK Core, since SPARK Core and THOR Lite are completely different products and have different upgrade paths.<\/p>\n

    New users have to subscribe to the newsletter to get download links and a free license. You can subscribe and download THOR Lite using the link on the\u00a0product page<\/a>.\u00a0<\/p>\n

    SPARK Core users that already have a valid license can use the following download links to download THOR Lite:<\/p>\n

    THOR Lite for Windows<\/a>
    THOR Lite for Linux<\/a>
    THOR Lite for macOS<\/a><\/p>\n

    Important: These download packages do not include a license. You need to subscribe on the product page<\/a> to receive a valid license OR use your existing SPARK Core license with THOR Lite.\u00a0<\/p>\n

    [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.4.1″][et_pb_column _builder_version=”4.4.1″ type=”4_4″][et_pb_text _builder_version=”4.4.1″ hover_enabled=”0″]<\/p>\n

    Issues<\/h3>\n

    Please report problems in the issues section<\/a> of THOR Lite’s helper scripts github page<\/a>.\u00a0<\/p>\n

    [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"

    We are proud to announce the release of THOR Lite. It is a trimmed-down version of THOR v10 with a reduced feature set and the open source signature base used in LOKI and the now obsolete scanner SPARK Core. It uses the completely rewritten code base of THOR v10 “Fusion” and is therefore faster, more thorough and stable than SPARK.  As you can see in the table below, we’ve come a long way since 2012. We’ve phased out the old THOR version based on Python and SPARK in 2019. Today, we’re replacing the community version of SPARK named SPARK Core with a community version of THOR v10, named THOR Lite.\u00a0There are two main differences between THOR Lite and THOR:\u00a0 Reduced feature set Open source signature base Apart from that, you’ll get a fully maintained and tested scanner pre-compiled for the Windows, Linux and macOS platform.\u00a0A limited support is available via the issues section on the github page\u00a0for auxiliary scripts.Upgrading from SPARK Core There is no direct upgrade path from SPARK Core, since SPARK Core and THOR Lite are completely different products and have different upgrade paths. New users have to subscribe to the newsletter to get download links and a […]<\/p>\n","protected":false},"author":1,"featured_media":6982,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[1,33,111,32,248],"tags":[],"class_list":["post-6931","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-nextron","category-spark","category-spark-core","category-thor","category-thor-lite"],"yoast_head":"\nTHOR Lite - Free YARA and IOC Scanner - Nextron Systems<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/\"},\"author\":{\"name\":\"Florian Roth\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\"},\"headline\":\"THOR Lite – Free YARA and IOC Scanner\",\"datePublished\":\"2020-03-20T17:26:19+00:00\",\"dateModified\":\"2022-03-25T13:14:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/\"},\"wordCount\":548,\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/03\/THOR_Lite_Cover_1b-3.png\",\"articleSection\":[\"Nextron\",\"SPARK\",\"SPARK Core\",\"THOR\",\"THOR Lite\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/\",\"url\":\"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/\",\"name\":\"THOR Lite - Free YARA and IOC Scanner - Nextron Systems\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/03\/THOR_Lite_Cover_1b-3.png\",\"datePublished\":\"2020-03-20T17:26:19+00:00\",\"dateModified\":\"2022-03-25T13:14:58+00:00\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/#primaryimage\",\"url\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/03\/THOR_Lite_Cover_1b-3.png\",\"contentUrl\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/03\/THOR_Lite_Cover_1b-3.png\",\"width\":1810,\"height\":660},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.nextron-systems.com\/#website\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"name\":\"Nextron Systems\",\"description\":\"We Detect Hackers\",\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.nextron-systems.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\",\"name\":\"Nextron Systems GmbH\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"contentUrl\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"width\":260,\"height\":260,\"caption\":\"Nextron Systems GmbH\"},\"image\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\",\"name\":\"Florian Roth\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"caption\":\"Florian Roth\"},\"description\":\"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.\",\"url\":\"https:\/\/www.nextron-systems.com\/author\/florian\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"THOR Lite - Free YARA and IOC Scanner - Nextron Systems","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/#article","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/"},"author":{"name":"Florian Roth","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919"},"headline":"THOR Lite – Free YARA and IOC Scanner","datePublished":"2020-03-20T17:26:19+00:00","dateModified":"2022-03-25T13:14:58+00:00","mainEntityOfPage":{"@id":"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/"},"wordCount":548,"publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"image":{"@id":"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/#primaryimage"},"thumbnailUrl":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/03\/THOR_Lite_Cover_1b-3.png","articleSection":["Nextron","SPARK","SPARK Core","THOR","THOR Lite"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/","url":"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/","name":"THOR Lite - Free YARA and IOC Scanner - Nextron Systems","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/#primaryimage"},"image":{"@id":"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/#primaryimage"},"thumbnailUrl":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/03\/THOR_Lite_Cover_1b-3.png","datePublished":"2020-03-20T17:26:19+00:00","dateModified":"2022-03-25T13:14:58+00:00","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/2020\/03\/20\/thor-lite-free-yara-and-ioc-scanner\/#primaryimage","url":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/03\/THOR_Lite_Cover_1b-3.png","contentUrl":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/03\/THOR_Lite_Cover_1b-3.png","width":1810,"height":660},{"@type":"WebSite","@id":"https:\/\/www.nextron-systems.com\/#website","url":"https:\/\/www.nextron-systems.com\/","name":"Nextron Systems","description":"We Detect Hackers","publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.nextron-systems.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.nextron-systems.com\/#organization","name":"Nextron Systems GmbH","url":"https:\/\/www.nextron-systems.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","contentUrl":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","width":260,"height":260,"caption":"Nextron Systems GmbH"},"image":{"@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919","name":"Florian Roth","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","caption":"Florian Roth"},"description":"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.","url":"https:\/\/www.nextron-systems.com\/author\/florian\/"}]}},"_links":{"self":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/6931","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/comments?post=6931"}],"version-history":[{"count":14,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/6931\/revisions"}],"predecessor-version":[{"id":6994,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/6931\/revisions\/6994"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/media\/6982"}],"wp:attachment":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/media?parent=6931"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/categories?post=6931"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/tags?post=6931"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}