Category: VirusTotal Blog

Important Update: IP Address Change for VirusTotal

We’re making a change to the IP address for www.virustotal.com. If you’re currently whitelisting our IP address in your firewall or proxy, you’ll need to update your rules to maintain access to VirusTotal. Starting November 25th, we’ll be gradually transitioning…

VirusTotal AI-Generated Conversations: Threat Intel Made Easy

At VirusTotal, we’re constantly exploring new ways to make threat intelligence more digestible and available to a wider audience. Our latest effort leverages the power of AI to create easily understood audio discussions from technical information. Using Google NotebookLM’s innovative…

Leveraging LLMs for Malware Analysis: Insights and Future Directions

By Gerardo Fernández, Joseliyo Sánchez and Vicente Díaz Malware analysis is (probably) the most expert-demanding and time-consuming activity for any security professional. Unfortunately automation for static analysis has always been challenging for the security industry. The sheer volume and complexity…

VirusTotal += Huorong

We welcome Huorong anti-malware engine to VirusTotal. In the words of the company: “Huorong is a Chinese information security company founded in 2011, which has been committed to the research and development of endpoint security products. Huorong anti-malware engine utilizes…

We Made It, Together: 20 Years of VirusTotal!

Hi Everyone, We can hardly believe it, but VirusTotal is turning 20 on June 1st! As we sit down to write this, we’re filled with a mix of pride and gratitude. It’s been an incredible journey, and we wouldn’t be…

Tracking Threat Actors Using Images and Artifacts

When tracking adversaries, we commonly focus on the malware they employ in the final stages of the kill chain and infrastructure, often overlooking samples used in the initial ones. In this post, we will explore some ideas to track adversary…

YARA is dead, long live YARA-X

For over 15 years, YARA has been growing and evolving until it became an indispensable tool in every malware researcher’s toolbox. Throughout this time YARA has seen numerous updates, with new features added and countless bugs fixed. But today, I’m…

Crowdsourced AI += ByteDefend

We are pleased to announce the integration of a new solution into our Crowdsourced AI initiative. This model, developed by Dr. Ran Dubin from the Department of Computer Science at Ariel University and head of ByteDefend Cyber Lab at the…

Analyzing Malware in Binaries and Executables with AI

In a recent post titled “From Assistant to Analyst: The Power of Gemini 1.5 Pro for Malware Analysis”, published on the Google Cloud Security blog, we explore the capabilities of Gemini 1.5 Pro, which enhances malware analysis by processing up…

Mastering VirusTotal: Certification Course

We are pleased to announce the partnership with The SOC Academy, a new startup dedicated to providing cybersecurity education, debuting with a VirusTotal Certification course. Founded by Laura, a passionate entrepreneur and especially a cybersecurity enthusiast, The SOC Academy aims…

Know your enemies: An approach for CTI teams

VirusTotal’s Threat Landscape can be a valuable source of operational and tactical threat intelligence for CTI teams, for instance helping us find the latest malware trends used by a given Threat Actor to adjust our intelligence-led security posture accordingly. In…

COM Objects Hijacking

The COM Hijacking technique is often utilized by threat actors and various malware families to achieve both persistence and privilege escalation in target systems. It relies on manipulating Component Object Model (COM), exploiting the core architecture of Windows that enables…

Following MITRE’s footsteps in analyzing malware behavior

The MITRE framework helps all defenders speak the same language regarding attackers’ modus operandi. VirusTotal provides multiple data points where MITRE’s Tactics and Techniques are dynamically extracted from samples when detonated in our sandboxes. In particular, samples’ MITRE mapping can…

Following in Mitre’s footsteps and malware behavior

The MITRE framework helps all defenders speak the same language regarding attackers’ modus operandi. VirusTotal provides multiple data points where MITRE’s Tactics and Techniques are dynamically extracted from samples when detonated in our sandboxes. In particular, samples’ MITRE mapping can…

VT Livehunt Cheat Sheet

Today we are happy to announce the release of our “Livehunt Cheat Sheet”, a guide to help you quickly implement monitoring rules in Livehunt. You can find the PDF version here. VirusTotal Livehunt is a service that continuously scans all…

Uncovering Hidden Threats with VirusTotal Code Insight

In the constantly changing world of cybersecurity, generative AI is becoming an increasingly valuable tool. This blog post shows various examples that elude traditional detection engines yet are adeptly unveiled by Code Insight. We explore diverse scenarios, ranging from firmware…

Monitoring malware trends with VT Intelligence

Please note that this blogpost is part of our #VTMondays series, check out our collection of past publications here. VT Intelligence can be a powerful tool for monitoring malware trends, enhancing your detection capabilities and enabling proactive defense against evolving…

Hunting for malicious domains with VT Intelligence

Please note that this blogpost is part of our #VTMondays series, check out our collection of past publications here. Many cyberattacks begin by victims visiting compromised websites that host malware or phishing scams, threat actors use domains for different malicious…

Sigma rules for Linux and MacOS

TLDR: VT Crowdsourced Sigma rules will now also match suspicious activity for macOS and Linux binaries, in addition to Windows. We recently discussed how to maximize the value of Sigma rules by easily converting them to YARA Livehunts. Unfortunately, at…

VTMondays

Welcome to VTMondays! A weekly series of bite-sized educational pills exploring the use of VirusTotal in real-world scenarios. Here’s what you’ll get: Short lessons: VTMondays are packed with valuable info in under 5 minutes read. Real-world scenarios: We’re not talking…

How AI is shaping malware analysis

We just released our “Empowering Defenders: How AI is shaping malware analysis” report, where we want to share VirusTotal’s visibility to help researchers, security practitioners and the general public better understand the nature of malicious attacks, this time focusing on…

The definitive VirusTotal’s admin guide

VirusTotal administrators’ tasks are key for the good health of the groups they manage. Unfortunately it is not always clear the best way to do this or that task. But we heard our beloved community, and we created the definitive…

Unifying threat context with VirusTotal connectors

In an age where cyber threats continue to grow in sophistication and frequency, the pursuit of a unified threat contextualization platform is no longer a mere convenience but an absolute necessity. When faced with an unfamiliar file, hash, domain, IP…

Crowdsourced AI += NICS Lab

We are pleased to share that NICS Lab, a security research group from the Computer Science Department at the University of Malaga, is joining the Crowdsourced AI initiative at VirusTotal. By extending our capabilities using a different AI model for…

Apology and Update on Recent Accidental Data Exposure

We are writing to share information about the recent customer data exposure incident on VirusTotal. We apologize for any concern or confusion this may have caused. On June 29, an employee accidentally uploaded a CSV file to the VirusTotal platform.…

VirusTotal += Crowdsourced AI

We are pleased to announce the launch of Crowdsourced AI, a new initiative from VirusTotal, dedicated to leveraging the power of AI in tandem with community contributions. Spearheading this endeavor, Hispasec brings to the table an AI solution designed to…

Threat hunting converting SIGMA to YARA

Malware threat hunting is the process of proactively searching for malicious activity. It is a critical part of any organization’s security posture, as it can help to identify and mitigate threats that may have otherwise gone undetected. Sigma rules and…

VirusTotal += Docguard

We are excited to announce our integration with DOCGuard for the analysis of Office documents, PDFs and other file types as a behavioral analysis engine.   This document analysis collaboration will allow the community to get the another opinion on the scanned documents. …

Actionable Threat Intel (II) – IoC Stream

Access to RELEVANT threat data is a recurring challenge highlighted by SOCs and CTI teams, at VirusTotal we want to help you understand your unique threat landscape. Indeed, tracking campaigns and threat actors in VirusTotal’s Threat Landscape module should be…

Actionable Threat Intel (I) – Crowdsourced YARA Hub

 YARA rules are an essential tool for detecting and classifying malware, and they are one of VirusTotal’s cornerstones. Other than using your own rules for Livehunts and Retrohunts, in VirusTotal we import a number of selected crowdsourced rules provided by…

VirusTotal += Deep Instinct

 We welcome Deep Instinct to VirusTotal. In their own words: “Deep Instinct is the only prevention-first cybersecurity company with a natively architected deep learning platform. We keep enterprises safe by stopping >99% of threats before other solutions even see them…

Deep Instinct += VirusTotal

 We welcome Deep Instinct to VirusTotal. In their own words: “Deep Instinct is the only prevention-first cybersecurity company with a natively architected deep learning platform. We keep enterprises safe by stopping >99% of threats before other solutions even see them…

Introducing VT4Splunk – The official VirusTotal App for Splunk

 TL;DR: VT4Splunk, VirusTotal’s official Splunk plugin, correlates your telemetry with VirusTotal context to automate triage, expedite investigations and unearth threats dwelling undetected in your environment. This extends Splunk’s own VirusTotal plugin for their SOAR. Next March 30th we will host…

Threat Hunting with VirusTotal – Episode 2

Last week we conducted the second episode of our “Threat Hunting with VirusTotal” open training session, where we covered YARA services at VirusTotal. We focused on practical aspects of YARA rules providing real life examples of infamous malware and historical…

Threat Hunting with VirusTotal

We recently conducted our first “Threat Hunting with VirusTotal” open training session, providing some ideas on how to use VT Intelligence to hunt for in-the-wild examples of modern malware and infamous APT campaigns. In case you missed it, here you…

Upgrading from API v2 to v3: What You Need to Know

The VirusTotal API is a versatile and powerful tool that can be utilized in so many ways. Although it is commonly used for threat intelligence enrichment and threat analysis, the potential uses are virtually limitless. The latest version, VirusTotal API…

Upgrading from API v2 to v3: What You Need to Know

The VirusTotal API is a versatile and powerful tool that can be utilized in so many ways. Although it is commonly used for threat intelligence enrichment and threat analysis, the potential uses are virtually limitless. The latest version, VirusTotal API…

Lessons learned from 2022

One of our goals is sharing with the security community as much as we learn from VirusTotal’s data to help stop, monitor and mitigate malicious activity. When looking back to 2022 we observe different interesting trends; we decided to go…

Lessons learned from 2022

One of our goals is sharing with the security community as much as we learn from VirusTotal’s data to help stop, monitor and mitigate malicious activity. When looking back to 2022 we observe different interesting trends; we decided to go…

Lessons learned from 2022

One of our goals is sharing with the security community as much as we learn from VirusTotal’s data to help stop, monitor and mitigate malicious activity. When looking back to 2022 we observe different interesting trends; we decided to go…

Mandiant’s CAPA + GoReSym to reinforce VT’s capabilities

VirusTotal, the world’s largest crowdsourced threat intelligence platform, is made possible thanks to a large community of security practitioners and vendors who integrate into our platform their best security tools. We are happy to announce the inclusion of two remarkable…

VT Intelligence Cheat Sheet

Many of you asked for this, and today we are happy to announce the release of our VTI Cheat Sheet with hints and examples on the most useful VT Intelligence queries and modifiers. Instead of providing a list of already…

VT Intelligence Cheat Sheet

Many of you asked for this, and today we are happy to announce the release of our VTI Cheat Sheet with hints and examples on the most useful VT Intelligence queries and modifiers. Instead of providing a list of already…

Threat Hunting with VirusTotal

We recently conducted our first “Hunting with VirusTotal” open training session, providing some ideas on how to use VT Intelligence to hunt for in-the-wild examples of modern malware and infamous APT campaigns. In case you missed it, here you can…

From zero to Zanubis

 A few weeks ago we stumbled upon a suspicious Android sample from a tweet from @malwrhunterteam which was only detected by four antivirus engines: Antivirus verdicts didn’t provide specifics about the malware family other than it might be either a…

Stopping Cobalt Strike with YARA

 VirusTotal was born with the idea of community in mind – an ecosystem where everybody contributes and benefits. This helped grow our product around the concept of crowdsourced intelligence, where all the security community could contribute in different ways to…

Stopping Cobalt Strike with YARA

 VirusTotal was born with the idea of community in mind – an ecosystem where everybody contributes and benefits. This helped grow our product around the concept of crowdsourced intelligence, where all the security community could contribute in different ways to…

Deception at scale: How attackers abuse governmental infrastructure

 Continuing our initiative of sharing VirusTotal’s visibility to help researchers, security practitioners and the general public better understand the nature of malicious attacks, we are proud to announce our “Deception at scale: How attackers abuse governmental infrastructure” report. Here are…

Deception at scale: How attackers abuse governmental infrastructure

 Continuing our initiative of sharing VirusTotal’s visibility to help researchers, security practitioners and the general public better understand the nature of malicious attacks, we are proud to announce our “Deception at scale: How attackers abuse governmental infrastructure” report. Here are…

Service Accounts are here to help

Tl;dr: We created Service Accounts you can use with your Enterprise license to use API keys not bound to any user in particular. The new Service Accounts allow creating virtual VirusTotal accounts not associated with any particular corporate email address.…

VT Collections: citius, altius, fortius – communiter

Last November 2021 we launched VirusTotal Collections as a way of helping organize, share and work with IoCs. Today we are announcing significant improvements that make Collections an actionable tool for strategic intelligence.   As a quick reminder, our original concept…

VirusTotal += Bkav Pro

 We welcome Bkav Pro Internet Security AI AV software by Bkav Corporation to VirusTotal. In their own words: “Bkav is a leading technology corporation in Vietnam, which operates in cyber security, software, smartphone, smart home and AI camera. In Vietnam,…

VirusTotal += Bkav Pro

 We welcome Bkav Pro Internet Security AI AV software by Bkav Corporation to VirusTotal. In their own words: “Bkav is a leading technology corporation in Vietnam, which operates in cyber security, software, smartphone, smart home and AI camera. In Vietnam,…

VT Collections: citius, altius, fortius – communiter

Last November 2021 we launched VirusTotal Collections as a way of helping organize, share and work with IoCs. Today we are announcing significant improvements that make Collections an actionable tool for strategic intelligence.   As a quick reminder, our original concept…

VT Collections: citius, altius, fortius – communiter

Last November 2021 we launched VirusTotal Collections as a way of helping organize, share and work with IoCs. Today we are announcing significant improvements that make Collections an actionable tool for strategic intelligence.   As a quick reminder, our original concept…

Hunting Follina

CVE-2022-30190 (aka Follina) is a 0-day vulnerability that was disclosed on Twitter last May 27th by the nao_sec Cyber Security Research Team. According to their announcement, this vulnerability was found in (at the time) recently uploaded sample to VirusTotal from…

VirusTotal += Google

Today, we are happy to announce that in addition to Google’s URL scanning service (Safe Browsing), which has been integrated with VirusTotal, Google is now also providing a file scanning service to the VirusTotal community. In their own words: “Google…

Deception at a scale

Continuing our initiative of sharing VirusTotal’s visibility to help researchers, security practitioners and the general public better understand the nature of malicious attacks, we are proud to announce our “Deception at scale: How malware abuses trust” report.  This time, we…

Threat-landscape of Financial attacks

Financial institutions have been a traditional target for all kinds of attacks. We wanted to understand what kind of malware families have been used against them in recent cases and track their evolution. It is not easy, though, having details…

Introducing Autocomplete for VirusTotal Intelligence queries

This article has been indexed from VirusTotal Blog  TL;DR: We implemented an Autocomplete feature for VirusTotal Intelligence queries  VirusTotal Intelligence is one of the most powerful, flexible and intuitive tools for security researchers around the world. It was designed with…

VirusTotal’s MISP modules get a fresh upgrade

This article has been indexed from VirusTotal Blog Tldr: We upgraded the VirusTotal MISP modules and added new cool relationships. Historically, VirusTotal provides integration to MISP through two modules (corresponding to public and VT Enterprise subscriptions) created and maintained by…

VT4Browsers++ Any indicator, every detail, anywhere

This article has been indexed from VirusTotal Blog TL;DR: VirusTotal’s browser extension can now automatically identify IoCs in any website and enrich them with superior context from our crowdsourced threat intelligence corpus, in a single pane of glass fashion. Install…

VT4Browsers++ Any indicator, every detail, anywhere

This article has been indexed from VirusTotal Blog TL;DR: VirusTotal’s browser extension can now automatically identify IoCs in any website and enrich them with superior context from our crowdsourced threat intelligence corpus, in a single pane of glass fashion. Install…

Meet our new improved VirusTotal Graph

This article has been indexed from VirusTotal Blog TL;DR; We are publishing a new version of VirusTotal Graph that, among other things, supports VirusTotal Collections and provides a new filter engine to speed up your investigations. Today we are proud…

MISP and VT Collections

This article has been indexed from VirusTotal Blog At VirusTotal we are actively working on expanding integrations with the most popular tools used by the infosec community.  Today we are thrilled to announce tighter integration with MISP through our most…

VIrusTotal Multisandbox += SecneurX

This article has been indexed from VirusTotal Blog VirusTotal welcomes SecneurX to the multi-sandbox project. This new behavioral analysis platform is helping provide additional details on Windows executables, Office documents, and Android APKs. In their own words: SecneurX Advanced Malware…

Monitoring malware abusing CVE-2020-1599

This article has been indexed from VirusTotal Blog CVE-2020-1599 is a vulnerability that can be abused by adding data (that will be later executed) to the signature section of a file, for instance appending a VB script. Unfortunately, Microsoft signature…

Monitoring malware abusing CVE-2020-1599

This article has been indexed from VirusTotal Blog CVE-2020-1599 is a vulnerability that can be abused by adding data (that will be later executed) to the signature section of a file, for instance appending a VB script. Unfortunately, Microsoft signature…

VT Collections Swiss army knife

This article has been indexed from VirusTotal Blog Since we announced VirusTotal Collections we are really grateful for the warm adoption we received from the VirusTotal community (please remember to help us gather your feedback using the following form). Indeed,…

VirusTotal += Vir.IT

This article has been indexed from VirusTotal Blog We welcome the Vir.IT eXplorer PRO by TG Soft to VirusTotal. In the words of the company: “TG Soft is an Italian cyber-security company. Since 1992, TG Soft has been analyzing computer…

VirusTotal += Vir.IT

This article has been indexed from VirusTotal Blog We welcome the Vir.IT eXplorer PRO by TG Soft to VirusTotal. In the words of the company: “TG Soft is an Italian cyber-security company. Since 1992, TG Soft has been analyzing computer…

Introducing VirusTotal Collections

This article has been indexed from VirusTotal Blog TL;DR: Threat researchers use Pastebin and similar sites to share sets of IoCs among themselves. We believe there is a more actionable and contextualized way to perform this task, enter VirusTotal Collections.…

Insights on ransomware attacks

This article has been indexed from VirusTotal Blog Our first “Ransomware in a global context” report offered an overview on how ransomware attacks evolved since 2020, highlighting GanCrab’s supremacy in 2020 and its rebranding as REvil with a different targeting.…

Uncovering brandjacking with VirusTotal

This article has been indexed from VirusTotal Blog  Malicious activity comes in all kinds of colors and flavors, sometimes abusing users’ trust by impersonating well known brands to get their private data, install malware or any other form of scam.…