Security expert Marco Ramilli released for free the Malware Hunter tool

guest · Feb 6, 2019

Security expert Marco Ramilli released for free the Malware Hunter tool
February 6, 2019
https://securityaffairs.co/wordpress/80765/malware/ramilli-malware-hunter-tool.html

Malware researcher Marco Ramilli released for free the Malware Hunter tool a simple but interesting catching tool base on static YARA rules.

Today I’d like to introduce you a simple but interesting malware catching tool base on static YARA rules that is available HERE.
Malware Static Analysis
It takes sample feeds and it analyses them against hundreds of YARA rules. Some of them are publicly available some other have been written on my own. The engine is quite slow right now, but it has analysed several recent Samples.
You might decide to get deep into last processed samples by clicking on table raw (which highlights last 10 processed samples) or to search for a specific hash by pasting your desired sha256 and clicking on the “Search” button.

In both ways, a modal form will appear showing out the rules that match the hash you asked for. Since it’s a personal platform it could be quite slow so far.
Click to expand...

guest · Nov 25, 2019

After 1 Million of malware samples analyzed
One year after its launch, Marco Ramilli shared the results of its project
November 25, 2019
https://securityaffairs.co/wordpress/94359/malware/1-million-malware-samples.html

One year ago I decided to invest in static Malware Analysis automation by setting up a full-stack environment able to grab samples from common opensources and to process them by using Yara rules.
I mainly decided to offer to cybersecurity community a public dataset of pre-processed analyses and let them be “searchable” offering PAPI and a simple visualization UI available HERE. Today after one year is time to check how the project has grown and see its running balance.
Findings
Observing the most snapped Yara rules it is nice to check that the most analyzed samples were executable files. Many of them (almost 400k) hid a PE file compressed and/or encrypted into themselves.
From signatures such as: keyloggers and screenshots it’s clear that most of the nowadays malware is recording our keyboard activities and wants to spy on us by getting periodical screenshots. [...]
Click to expand...

Log in or Sign up

Security expert Marco Ramilli released for free the Malware Hunter tool

guest Guest

guest Guest

Log in or Sign up

Security expert Marco Ramilli released for free the Malware Hunter tool

guest Guest

guest Guest

Useful Searches