fireeye-red-team-countermeasure-scanner
fireeye-red-team-countermeasure-scanner copied to clipboard
YARA unable to run due to missing Visual C++ Redistributable
I have received this error message upon running build23.ps1:
ERROR: YARA was unable to run on this device. The Visual C++ Redistributable is required in order to use YARA.
I have the latest versions of both the 32-bit and 64-bit of the following runtimes installed:
- Microsoft Visual C++ 2008 Redistributable 9.0.30729.6161 [END OF LIFE]
- Microsoft Visual C++ 2010 Redistributable 10.0.40219
- Microsoft Visual C++ 2012 Redistributable 11.0.61030
- Microsoft Visual C++ 2013 Redistributable 12.0.30501, 12.0.40660, 12.0.40664
- Microsoft Visual C++ 2015-2019 Redistributable 14.27.29016
It is greatly appreciated to have this scanner tool available, but it is somewhat concerning that the script errors out on a "missing distributable" error message despite all supported runtime redistributables being installed. Additionally, the README of this release does not specify what runtime (year) and version needs to be installed.
Hi; Take a look here. Their documentation isn't great but it suggests that the Visual C++ redistributable 2010 is required. Remember also that you need both the x86 and x64 builds installed if you are on a 64-bit system. If you continue to see issues I think you may have more luck asking VirusTotal. Try executing the yara.exe binary directly on your device and seeing if it gives you an error that makes more sense than our best guess within the script.
Had a server with the same error, installed the vcpp redist one by one testing until I found the one that allowed the script to run. In the end it was the 2015-2022 x64 version that did the trick: https://docs.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170#visual-studio-2015-2017-2019-and-2022