Press ESC to close

Monitoring malware trends with VT Intelligence

Please note that this blogpost is part of our #VTMondays series, check out our collection of past publications here.
VT Intelligence can be a powerful tool for monitoring malware trends, enhancing your detection capabilities and enabling proactive defense against evolving threats. To leverage it effectively, analysts can refine searches with threat indicators relevant to their business, technologies and to the malware trends occurring at the moment. Analysts can use this intelligence to identify and hunt emerging malicious samples and investigate new trends and capabilities.

To begin with a simple query we will search for new files (“entity:files”) first seen during the last week (“fs:7d+”) and detected by AV vendors as keylogger (“engines:keylogger”) with more than 5 positives (“p:5+”).
entity:file engines:keylogger p:5+ fs:7d+

In our second query we search for fresh (“fs:7d+”) Windows, Linux or MacOS files (“type:peexe or type:elf or type:macho”). To focus on popular/emerging malware, we will use the submissions modifier with a relatively high number (“submissions:10+”), these thresholds serve as illustrative examples and can be adjusted according to the investigation.
entity:file p:10+ (type:peexe or type:elf or type:macho) fs:7d+ submissions:10+

Finally, we will look for Zip files (“type:zip”) that potentially contain ransomware. For discriminating using verdict of AV engines we use the “engines” keyword (“engines:ransom or engines:ransomware”) and use both “ransom” and “ransomware” strings as some engines use different criteria for verdicts. An alternative way of detecting ransomware is through dedicated YARA rules (“crowdsourced_yara_rule:ransomware”).
entity:file type:zip fs:7d+ (engines:ransom or engines:ransomware or crowdsourced_yara_rule:ransomware)

You can learn more about file search modifiers in the documentation.
As always, we would like to hear from you.
Happy hunting!

.my-code{
font-family: “Courier”, sans-serif;
font-size: medium;
width: 100%;
background: Black;
color: White;
/*padding: 24px;*/
border-collapse: collapse;
}

.my-yara-code{
font-family: “Courier”, sans-serif;
font-size: medium;
width: 100%;
background: #F7F9F9;
color: Black;
/*padding: 24px;*/
border-collapse: collapse;
text-align: center;
}

mark.green {
color:#3cb371;
background: none;
}
mark.gray {
color:Gray;
background: none;
}
mark.yellow {
color:Yellow;
background: none;
}
mark.orange {
color:Orange;
background: none;
}
mark.red {
color:Red;
background: none;
}
mark.blue {
color:#33BEFF;
background: none;
}

mark.dark-blue {
color:Blue;
background: none;
}
.table-container {
/*padding: 32px;*/
font-family: “Courier”, sans-serif;
font-size: medium;
}

.table-container table {
width: 100%;
background: #fff;
color: #222;
/*padding: 24px;*/
border-collapse: collapse;
}

.table-container table th {
font-weight: bold!important;
text-transform: none!important;
}

th:first-child { width: 24%; }
th:first-child+th { width: 39%; }

/*
.table-container table td,
.table-container table th {
padding: 16px 32px;
}
*/

.table-container table tr {
border-bottom: 1px solid #eee;
}

@media (max-width: 580px) {
.table-container table thead {
display: none;
}

.table-container table td {
display: block;
}

}

a {
color: blue!important;
}

.central_img {
position: relative;
display: block;
margin-left: auto;
margin-right: auto;
}

.central_img img {
border: 1px solid #000000;
}

.central_img p {
text-align: center;
font-style: italic;
}

.width_10 {
width: 10%;
}

.width_15 {
width: 15%;
}

.width_20 {
width: 20%;
}

.width_30 {
width: 30%;
}

.width_40 {
width: 40%;
}

.width_50 {
width: 50%;
}

.width_60 {
width: 60%;
}

.width_80 {
width: 80%;
}

.width_90 {
width: 90%;
}

.width_100 {
width: 100%;
}

ul{
margin-bottom: 5px!important;
}

.interval_12{
margin-bottom: 12px!important;
}

Related posts:

URL File NTLM Hash Disclosure Vulnerability (0day) – and Free Micropatches for it Europol Shuts Down Manson Market Fraud Marketplace, Seizes 50 Servers The Future of Serverless Security in 2025: From Logs to Runtime Protection Default Thumbnail2024 Trustwave Risk Radar Report: Cyber Threats to the Retail Sector

Leave a Reply

Your email address will not be published. Required fields are marked *

Stay Updated with Our Newsletter

Filter Posts by Date

Explore Topics