5 ms·
VT is more than just the antivirus engines. If you subscribe (expensive!) you can actively hunt for malware using Yara-rules and a powerful search engine. if yo
by agnsaft 8y ago
VT is more than just the antivirus engines. If you subscribe (expensive!) you can actively hunt for malware using Yara-rules and a powerful search engine. if you know some patterns in malware you are tracking, you can add Yara rules that will run each time a file is uploaded and will notify you of any matches.
Lets assume you know a threat actor always uses the same variable names during heap sprays, you can discover new malware from this threat actor with a Yara rule to look for this pattern.
- juliusmusseau 8y agoThanks for the explanation. Very helpful!
- badrabbit 8y agoNot just using yara rules but any file in VT you can find by hash,name,etc... And you get extra metadata like where it was uploaded from.