Hey everybody, welcome back to salted hash. I'm your host Steve Regan today
We're going to be talking about virustotal intelligence with Carl here Emoto. So stay tuned it we'll be right back
All right, so as I promised earlier we are in blackhat in Las Vegas, it's hot and humid outside
So we're up in a suite now here at the Mandalay Bay four seasons to be more specific
But Carl here has something really cool to show you and it's called virustotal intelligence so really quickly
Give me a brief overview of what this is
so virustotal intelligence is like a search engine like think of it as a google search engine where you can search
For any type of malware you can search based on what type of malware it is. What type of detection it has
what it does in a sandbox what any other behavior or any type of
Metadata you can think of is searchable on in intelligence and
The the interesting thing about that is is that's kind of what people have come to expect from virustotal
but there's a lot more that this product can do which is thread things together to find the
hidden or often overlooked
Commonalities or connections between things so like incident responders for exams. Yeah or incident responders
It's great to see like, you know
When was it uploaded how many people have uploaded it?
The time span and like the evolution of like detection of get started. What's a few detections and then texans grew or then?
Comments on the file or any type of extra data we gather as time goes on
So today we're gonna look at some Mac OS don't worry. I think you were talkin. So let's walk through that
show me what you think this thing can do so we have
This in this case, we have a fake Dropbox installer. Mm-hmm. So we have the Dropbox installer here in the middle
And we have relationships between different things so
Here it's in a container in a contained dmg file and
Then in the sandbox, it calls out to these other contacted domains or other servers
And then you can see where this file was downloaded from so we know this fake installer is downloaded from this host here and
all these different URLs
You can see then commonalities with other adware in the same family so like frogs
Or
HP printer manager, they're fake drivers. They're all related from the same company
and
you can see that visually here in the graph and
then if you click on
the individual sample, you can click the link to the free public report, which is what
What we would get if we were to upload it on the virus, correct?
And then there's the intelligence side report, which has the more detailed information
so we'd have like
submissions, whether it be could be multiple submissions over a period of time and then we would have
the dates on the first submission last submission and in the behavior tab you have
Soundbox to information and so how much of this is
Stuff you can get directly by
accessing it public the the free version like you said and then how much of this is on top of like the
Extra the stuff like the extra stuff is like an intelligence you can do
Yaar hunting so you can search with your own signatures
You can write Owen signatures unique to your company and then get notifications when something hits that signature
which is really good because if you're writing your own signatures then then if a
criminal crew or even a another security researcher if they
Upload something that comes in contact with your signatures and you get the alert
So now you know that either a this is out there
somebody has seen something that you thought so like if I found
Something suspicious on my network and I was curious about it ever owned a signature, you know
If anybody else sees that thing, I've got a pattern I thought sometimes I could look more
Ok, and so and also in the sandbox and now so we have like screenshots of how the install process goes
so in this case, they're like faking it's a booking or Dropbox application and
Let's you get all the operations. It runs to the months of the install
And then we gather data and that goes on in the reports. Nice nice. So
I can show you here's in the hunting tab. We have different where you can load the signatures here
so you write your own signatures in your and
Then you can get email notifications or we also have RSS feeds our JSON
Then you are there's a interface here with all the hits you get you can also take that feed and import it into whatever
Back-end you want so like if you've got a sim somewhere and you want to dump this stuff into you can pull it from that
Or you just keep your own custom configs going. So when you're you're doing the hunting with the signatures and stuff like that
It's not just new uploads as well. You can go back and it shows you everything that's been uploaded in the past, right?
Well, so humidity signatures, you can search. Yep
You can search over time and the it's useful for people searching like you find version 10 of the malware
but you want to go back and search for version 9 and then
Black triangle back in time and find the evolution of of them all where so you guys have been testing this for a while
I first saw it earlier this year shortly after RSA and I know there's been some improvements
What kind of feedback are you getting from customers who have tried it?
On intelligence are you yes people love it and hunting and also we're getting
We're gonna include the more data. We're going to include a icon search
We're going to include it's like a lot of like PDF installer. So I'll have like the fake
PDF icon or and then you can search everything with the same icon. Ooh
That would be neat. So you can find like groups who use the same art and all of their their various campaigns, right?
I'd be able to find those those groups can find the artwork or know who's sharing between the two. Yeah, okay, and
Then another cool feature here is an intelligence we can click and find
This here's the
Here's the water cry example. Mm-hmm, but we can find similar examples. So there's a sip there's like fuzzy hashing so you can search by
Import hash or search by SS deep and we have our own
In-house similar to query which is similar to and then you see they actually they find if everything is similar to that file
What's gonna be good for going for those?
Variants that company yeah, it's quick to hide behind when in reality it's you know
Something minor updated on the mother like the same cluster of malware are same
Same family. You often get yes. Yes
Well, it's like I said earlier when I first saw this this was just really cool because everybody knows fires total
But there's a lot more you can do on the back end, so I thought that was worth exploring. Thanks again Karl
I really appreciate talking to me
If you'd like to learn more about virustotal Intelligencer or any other type of malware attacks
Remember to check us out online at CSO online.com. This has been salted hash and I'm your host Steve Reagan. We'll see you soon