VirusTotal receives a large number of files and URLs every day, and each of them is analysed by antivirus solutions and other tools and sandboxes to extract rich information. These data points are critical for our ecosystem, they connect the dots and shed light into the links between entities. While performing threat investigations it is common to pivot over many different indicators (files, URLs, domains and IP addresses) to get the full picture, and this usually involves looking at multiple reports at the same time. We know this can be complicated when you have many open tabs, therefore, we’ve developed VirusTotal Graph.

One of the engineers on the VirusTotal team created a language many analysts are probably familiar with, YARA. For those who don’t know, YARA is a language and library that allows you to write your own malware signatures and then scan files to see if they match whatever rule you’ve written. VirusTotal Intelligence’s malware hunting capability allows you to write YARA rules, and then have every new file VirusTotal receives, tested against that rule. When you receive new indicators of compromise for some malware family, malware hunting is the place you should run to first. You want to be alerted when new files match any of your rules, so that you can make sure you are on the cutting edge of how malware is evolving and that you are best positioned to make sure your network and systems are ready for it.