Just doing a quick write up of tools I use to do malware/threat research for free. Most of the time, I don't really have any company directly backing the research/analysis stuff I put on this blog. I'm also not a professional malware analyst/threat researcher, for what its worth.
(I wrote this myself. No AI was used)
I do recommend these courses if your employer pays:
https://paralus.co/online/ - Applied Threat Intelligence/Operational Threat Intelligence - I've done this course and it goes over handling IOCs, pivoting, and more.
https://academy.intel-ops.io/courses/hunting-adversary-infra - Hunting Adversary Infrastructure - I haven't done this course but I've seen the authors work on Twitter and Medium and it was interesting.
Regarding articles and finding things to research:
Hunt.io blog (https://hunt.io/blog) and Censys Arc blog (https://censys.com/censys-arc/) have info about interesting things they've come across.
I also use this: https://start.me/p/wMrA5z/cyber-threat-intelligence which has links to various other sites/blogs.
You can always come up with your own ideas based on what you see or what you think you should see in an attack.
There are a bunch of tools in start.me link but I'm just focusing on things I use.
There is obviously VirusTotal.
You can search hashes, domains, IPs, and etc and do limited pivoting off of it or move to other tools.
For files, the Details tab provides binary info which may include things like pdb path, certificate info, imphash, etc that you can pivot from (using other tools) or search on Google.
Relations tab will let you find related domains/IPs/files, etc which may lead to additional files. In some cases, this will provide in-the-wild URL where this file was downloaded from.
Behavior tab has sandbox results which again may help find additional IOCs which may lead to more files. You may see yara/sigma/suricata rules in here as well that may help with pivoting.
VirusTotal free does not let you download files.
If you actually want files, you may be able to use AnyRun, Hybrid-Analysis, Triage, VXUG, and Abuse.ch to acquire files. You may also be able to ask for files in certain Slack and Discord channels. Make friends!
AnyRun, Hybrid-Analysis, and Triage also support basic searches like hashes, IP's, and domains.
You can also obtain pcaps, memory dumps, dropped files, and other behavior data from these products.
These tools may report suricata/snort signatures. You can view sigs on Evebox: https://rules.evebox.org/
Hybrid-Analysis researcher account also supports searching yara signatures/string searches to find files.
AnyRun Intelligence (https://intelligence.any.run) lets you also do complex behavior searches like if you wanted to search for a family that specifically writes a file to one very specific location or uses a very specific command. They also let you do yara searches.
Abuse.ch provides multiple products that may be useful for tracking malware campaigns.
Malware Bazaar has files. You can pivot off of various fields too.
Feodo Tracker has C2 info. This could be useful if you wanna monitor C2 with emulated malware or use C2 info to do more pivoting.
URLhaus has URLs for malware.
YARAify lets you do yara scans on files but besides that, you can search files that have matched yara rules.
Malware Bazaar, URLhaus, Yaraify all give you options to get notified based on various things such as yara match, URL match, etc... It's under Hunting Alerts option.
URLScan is another tool I use. I think a lot of people use this but never use the filtering options. Free account has limits obviously. You can see filters here: https://docs.urlscan.io/pages/search-api-reference#searchable-fields
For IP's/infra, you can use Shodan, Censys, and other tools (listed in start.me link).
Shodan and Censys both let you pivot off of certain fields, such as favicon hash, content hash, cert info, html page title, etc..
You can utilize Greynoise and AbuseIPDB for IPs. You just have to make sure you look at timestamp for events you see. Threat actors can just use a VPS for an hour then get a new one and have a completely different IP.
Finally, Github search and other tools that search github are very useful. These two exist beside just GH search feature:
Sourcegraph - https://sourcegraph.com/search
Grep App - https://grep.app/
You can search Github for certain strings/variables names or commands you may see during your analysis. You may discover analysis from other people or maybe source code.
