Issue: “OSError: /usr/lib/libyara.so: cannot open shared object file: No such file or directory” while running cuckoo.py

Question

I have installed cuckoo and all the dependencies and have also created VM using virtual box. I am getting an error "OSError: /usr/lib/libyara.so: cannot open shared object file: No such file or directory" whenever i try to run cuckoo.py using python

I have tried searching in all forums and also tested whether yara is installed properly. It seems to be working fine using terminal. Checked that libyara.so is present in /usr/local/lib and python or cuckoo is checking in /usr/lib/

Also tried updating local library using

sudo echo "/usr/local/lib" >> /etc/ld.so.conf sudo ldconfig

I have installed yara using tar ball. Have also used --enable-cuckoo --enable-magic args too.

Where might have I gone wrong?

Configuration of my system: Ubuntu 16.04; python 2.7; yara 3.4.0

Answer 1

your script is looking for the lib in /usr/lib/libyara.so but you said the lib is in /usr/local/lib

i'd create as softlink to fix this.

ln -s /usr/local/lib/libyara.so /usr/lib/libyara.so

Answer 2

If soft link is not working

cp /usr/local/lib/python2.7/dist-packages/usr/lib/libyara.so /usr/lib/

Answer 3

Had the same problem. Seems to be two different packages.

The one I was looking for was yara-python instead of only yara.

Fixed it with:

$ python3 -m pip uninstall yara
$ python3 -m pip install yara-python

Answer 4

According to official documentation, It means that the loader is not finding the libyara library which is located in /usr/local/lib. In some Linux flavors the loader doesn’t look for libraries in this path by default, we must instruct him to do so by adding /usr/local/lib to the loader configuration file /etc/ld.so.conf:

sudo echo "/usr/local/lib" >> /etc/ld.so.conf
sudo ldconfig

Answer 5

Had a similar issue but mine was stored in /usr/local/lib/python2.7/dist-packages/usr/lib/libyara.so

Creating the soft-link to that Location solved the issue

*ln -s /usr/local/lib/python2.7/dist-packages/usr/lib/libyara.so /usr/lib/libyara.so*

Answer 6

I followed this link to resolve

https://www.pythonanywhere.com/forums/topic/29428/

apt list --installed |grep yara                                                                                                      

libyara4/kali-rolling,now 4.0.5-1 amd64 [installed,automatic]
python3-yara/kali-rolling,now 4.0.4-1 amd64 [installed,automatic]





apt remove python3-yara/kali-rolling  
apt remove libyara4/kali-rolling 

This may be possibly caused due to multiple version of yara in system.

Yara started working well after this change.

Answer 7

You can create a virtual environment and install requirement.txt inside it, then complete the installation steps.