Monitoring malware trends with VT Intelligence

Please note that this blogpost is part of our #VTMondays series, check out our collection of past publications here.

VT Intelligence can be a powerful tool for monitoring malware trends, enhancing your detection capabilities and enabling proactive defense against evolving threats. To leverage it effectively, analysts can refine searches with threat indicators relevant to their business, technologies and to the malware trends occurring at the moment. Analysts can use this intelligence to identify and hunt emerging malicious samples and investigate new trends and capabilities.

To begin with a simple query we will search for new files (“entity:files”) first seen during the last week (“fs:7d+”) and detected by AV vendors as keylogger (“engines:keylogger”) with more than 5 positives (“p:5+”).

entity:file engines:keylogger p:5+ fs:7d+

In our second query we search for fresh (“fs:7d+”) Windows, Linux or MacOS files (“type:peexe or type:elf or type:macho”). To focus on popular/emerging malware, we will use the submissions modifier with a relatively high number (“submissions:10+”), these thresholds serve as illustrative examples and can be adjusted according to the investigation.

entity:file p:10+ (type:peexe or type:elf or type:macho) fs:7d+ submissions:10+

Finally, we will look for Zip files (“type:zip”) that potentially contain ransomware. For discriminating using verdict of AV engines we use the “engines” keyword (“engines:ransom or engines:ransomware”) and use both “ransom” and “ransomware” strings as some engines use different criteria for verdicts. An alternative way of detecting ransomware is through dedicated YARA rules (“crowdsourced_yara_rule:ransomware”).

entity:file type:zip fs:7d+ (engines:ransom or engines:ransomware or crowdsourced_yara_rule:ransomware)

You can learn more about file search modifiers in the documentation.

As always, we would like to hear from you.

Happy hunting!

Read More

Hunting for malicious domains with VT Intelligence

Please note that this blogpost is part of our #VTMondays series, check out our collection of past publications here.

Many cyberattacks begin by victims visiting compromised websites that host malware or phishing scams, threat actors use domains for different malicious purposes as part of their infrastructure, and malware communicates with external sites for command and control and exfiltration. Detecting suspicious domains and preemptively feeding corporate security systems can disrupt attacks before they happen, with VT Intelligence being the perfect platform to early detect them and monitor malicious campaigns’ evolution.

Let’s start by searching for domains (“entity:domain”) that use self-signed certificates (“tag:self-signed”). The use of these certificates raise some suspicion as they are unverified. This means anyone can create and issue a certificate for any domain, making it easier for malicious actors to impersonate legitimate websites. We will look for domains created no more than a week ago (“creation_date:7d+”) according to their whois information. Finally, we want samples with more than 5 detections to avoid false positives, however this is completely at your discretion.

entity:domain tag:self-signed creation_date:7d+ p:5+

Moving to the next stage, let’s look for C2 domains (“category:command and control”). Malware periodically contacts C2 servers to receive instructions, that’s why it is worth investigating any connection to them originating from our network. We will use (“lm”) modifier to look for domains updated in VT for the last week and (“detected_communicating_files_count:5+”) modifier to search for domains with at least 20 files in VirusTotal that have been observed trying to contact the domain during sandbox detonation.

entity:domain p:5+ category:"command and control" detected_communicating_files_count:20+ lm:7d+

Finally, we will hunt typosquatted (“fuzzy_domain:fedex.com”) domains to impersonate a given legitimate one, in this example we will use Fedex. In addition, we search for any suspicious domain containing "fedex" as a substring, which is typically used by attackers to confuse victims. The domain modifier (“domain:fedex”) searches for domains containing this word as a substring, and the depth modifier specifies how many subdomains to include in the search (“depth:5-”). This deep level would find subdomains up to this format “fedex.aaa.bbb.ccc.ddd.com”, where the word fedex could be contained in any of the blocks. We narrow down the results to domains with at least 5 detections (“p:5+”) to reduce noise from false positives.

entity:domain (fuzzy_domain:fedex.com or domain:fedex and depth:5-) p:5+

You can learn more about domain search modifiers in the documentation.

As always, we would like to hear from you.

Happy hunting!

Read More

Protecting the perimeter with VT Intelligence - malicious URLs

Please note that this blogpost is part of our #VTMondays series, check out our collection of past publications here.

One of the main attacking vectors attackers use for credential theft and malware deployment are malicious link-based attacks leveraging impersonated websites or distributing malware. By studying malicious campaigns, defenders can learn attacker tactics and refine their defensive arsenal. They can also use suspicious URLs preemptively, updating deny lists and searching for any suspicious internal or perimetral activity.

VT Intelligence provides a powerful toolset for this mission and can be used to improve URL filtering in your firewalls. Now, we will dive into a series of VT queries progressively increasing their complexity, and dissect the added modifiers for each step. Feel free to experiment and refine these examples to build your own customized queries.

To begin, we will start by searching for URLs (“entity:url”) categorized as phishing according to the content category of its domain (“category:phishing”) or labeled as phishing by AntiVirus engines (“engines:phishing”). We will use the “p” modifier (“p” is short for “positives”, referring to the number of engines detections) to discard benign URLs. In this case, we want URLs with more than 15 detections to avoid false positives, however this is completely at your discretion. Finally, we will look for URLs first seen (“fs” as short for first submission) in the last 7 days (7d+).

entity:url (category:phishing or engines:phishing) p:15+ fs:7d+

The following query hunts new malicious URLs submitted to VirusTotal in the last 7 days distributing Microsoft document or PDF files (“tag:downloads-doc or tag:downloads-pdf”). We use the “p” modifier to search for URLs with a high number of detections (“p:15+”). Malicious URLs used for phishing are likely to distribute this kind of files to compromise the victim's system.

entity:url (tag:downloads-doc or tag:downloads-pdf) p:15+ fs:7d+

Finally, we will hunt URLs impersonating a corporate service provider, such as Office365. We will use the “url” modifier to match substrings contained in the URL string (“url:office365”). In this scenario, we want to find URLs used by attackers to impersonate Office 365 built using Wordpress (“path:wp-content”), and filter the ones with at least 5 detections (“p:5+”). This kind of malicious URLs impersonate legitimate service providers and commonly redirect users to another location after providing their credentials, typically the legitimate site to avoid suspicion. We will check for this behaviour with the “have:redirects_to” modifier.

entity:url url:office365 have:redirects_to path:wp-content p:5+

You can learn more about URL search modifiers in the documentation.

As always, we would like to hear from you.

Happy hunting!

Read More

Protecting the perimeter with VT Intelligence - Email security

Please note that this blogpost is part of our #VTMondays series, check out our collection of past publications here.

One of the most common attack vectors to gain access to your network is through phishing emails with attachments containing malware, usually the first stage in a cyberattack kill chain. By gathering intelligence related to the latest phishing campaigns targeting our country or industry, we can prevent emails with malicious attachments reaching our company’s inboxes. This adds a security layer by reducing the burden on employees and not solely relying on their intuition to identify threats.

For this we will use VT Intelligence to hunt threats targeting our email gateway. Our approach starts with a simple example and we will gradually increase its complexity. For each VT Intelligence query we provide a detailed breakdown of the new added modifiers. We encourage you to test the examples provided and to further explore new queries.

Our first basic query searches for documents (“type:document”) tagged as attachments (“tag:attachment”) and submitted from Spain (“submitter:ES”). We will use the “p” modifier (“p” is short for “positives”, referring to the number of AntiVirus detections) to discard benign attachments. In this case, we want samples with more than 5 detections to avoid false positives, however this is completely at your discretion. Finally, we will look for files first seen (“fs” as short for first submission) in the last 14 days (14d+).

type:document tag:attachment submitter:ES p:5+ fs:14d+

Moving to the next stage, we will explore the submissions modifier to identify large-scale attacks, in this case “submissions:50” indicates the minimum number of submissions for a given file which may flag a massive phishing campaign. We use the name of an AntiVirus engine as a modifier to narrow down the results to potential blindspots. In this case, our strategy is searching for files flagged as “clean” by our AntiVirus and detected as malicious by at least 5 other engines.

type:document tag:attachment p:5+ fs:14d+ AhnLab:clean submissions:50+

Finally, we will create a bit more complex condition by combining boolean operators like OR and NOT. We search for specific document types such as docs and spreadsheets, and exclude other document types to narrow to a particular suspicious dynamic behaviour, particularly those actions associated with early stages of an attack. In this example we are searching for office documents either executing powershell or executing macros running additional files when detonated in the sandbox.

(type:doc or type:docx or type:xls or type:xlsx) p:5+ fs:7d+ (behaviour:powershell or (tag:macros and tag:run-file))

You can learn more about file search modifiers in the documentation.

As always, we would like to hear from you.

Happy hunting!

Read More

VTMondays

Welcome to VTMondays! A weekly series of bite-sized educational pills exploring the use of VirusTotal in real-world scenarios. Here's what you'll get:

• Short lessons: VTMondays are packed with valuable info in under 5 minutes read.
• Real-world scenarios: We're not talking theory, we're talking hunting malware, using intelligence to build up your defenses and staying ahead of the curve.
• Actionable tips & best practices: We'll equip you with practical hacks you can use right away.
• Community connection: Ask questions, share your experiences, and connect with other VirusTotal enthusiasts.

Below you can find the link to the published and upcoming articles.

• Threat detection - Email gateway - 11th Dec
• Threat detection - Malicious URLs - 18th Dec
• Threat detection - Malicious Domains - 25th Dec
• Threat detection - Monitoring malware trends - 1st Jan

Read More