Malware and Campaign Intelligence

Malware Family Classification

Malware taxonomy matters for CTI because the family classification tells you what the malware is designed to do, what actor categories typically use it, and what behavioral indicators to look for in your telemetry. Knowing that a sample is a loader is different from knowing it is a RAT, which is different from knowing it is ransomware, even if you have not analyzed the binary itself yet.

Loaders are malware whose primary function is to download and execute a second-stage payload. They are often delivered via phishing and are small, designed to evade initial detection, and contain minimal functionality beyond establishing a foothold and pulling down the actual threat. Loaders include Emotet, IcedID, BazarLoader, and Qakbot. Identifying a loader in an environment means a second-stage payload likely exists or was attempted, and the hunt scope should include identifying what the loader retrieved.

Remote Access Trojans (RATs) provide persistent remote control of a compromised system. RAT capabilities typically include keylogging, screenshot capture, file system access, command execution, and C2 communication. Common RATs include AsyncRAT, njRAT, Remcos, and Agent Tesla. Commercial RATs sold on underground markets are frequently used by lower-sophistication actors, while advanced actors tend to use custom implants or legitimately purchased post-exploitation frameworks like Cobalt Strike.

Backdoors are similar to RATs but typically more minimal in their feature set, focused on maintaining a persistent shell or command execution channel. Many custom nation-state implants are backdoors: they provide the attacker with a persistent foothold and command channel while minimizing their detection footprint. The distinction between RAT and backdoor is sometimes blurred in vendor reporting.

Infostealers focus on credential and data theft: browser-stored passwords, cookies, credit card data, cryptocurrency wallets, FTP credentials, and email account data. Prominent infostealers include RedLine, Raccoon, Vidar, and Lumma Stealer. They are commonly sold as malware-as-a-service with subscription pricing. Infostealer logs are frequently sold on underground markets and represent a significant initial access vector for subsequent intrusions: compromised credentials from an infostealer provide legitimate access without requiring exploitation.

Ransomware encrypts files and demands payment. Modern ransomware operations typically involve double extortion: encrypt and threaten to publish stolen data. The ecosystem is heavily organized around Ransomware-as-a-Service (RaaS) models where a ransomware developer licenses their platform to affiliates who conduct the intrusions. Notable families include LockBit, BlackCat/ALPHV, Cl0p, Play, and Black Basta. Ransomware pre-encryption activity (credential harvesting, lateral movement, data staging) follows predictable patterns that are huntable before encryption occurs.

Wipers destroy data rather than encrypt it for ransom. They are primarily used by nation-state actors in destructive operations. NotPetya, WhisperGate (used in the Ukraine conflict), and HermeticWiper are examples. Wipers are designed to cause maximum damage quickly and are not designed for stealth. Their presence in an environment is typically discovered during or immediately after the destructive phase.

Reading Sandbox Reports

Sandbox reports are automated behavioral analysis outputs produced by running a malware sample in an instrumented virtual environment and observing what it does. They are valuable even for analysts without reverse engineering skills because they surface behavioral indicators, network IOCs, persistence mechanisms, and file system changes without requiring manual code analysis. Most public sandbox platforms (Hybrid Analysis, Any.run, Triage, Joe Sandbox) produce rich reports that a CTI analyst can extract significant value from in under 20 minutes.

Process tree analysis is the first place to look. The process tree shows parent-child process relationships from execution. Suspicious patterns include: document process (Word, Excel, PDF reader) spawning a scripting engine (PowerShell, cmd.exe, wscript.exe), followed by that scripting engine spawning a download tool (certutil, curl, mshta) or injecting into a system process. Each step in an unusual process tree is a potential detection point and maps to a specific ATT&CK technique.

Network indicators from sandbox reports include C2 domains and IPs, HTTP request paths and User-Agent strings, DNS queries made during execution, and any certificates or protocol fingerprints captured in the simulated traffic. C2 domains observed in a sandbox report are high-confidence malicious indicators: the malware reached out to them during execution. Note the exact HTTP paths, User-Agent strings, and connection patterns: these are more durable than the domain itself if the actor rotates infrastructure.

Persistence mechanisms documented in sandbox reports tell you exactly how to hunt for the malware in an already-compromised environment. Common persistence indicators include: registry Run key modifications (HKCU\Software\Microsoft\Windows\CurrentVersion\Run), scheduled task creation, service installation (Windows Services), startup folder file drops, and COM object hijacking. Each of these maps to Windows Event IDs or EDR events that can be searched retroactively.

File system changes include dropped files, created directories, and modified system files. The paths where malware drops secondary payloads are often consistent across samples within a family: a family that consistently drops to C:\Users\Public\ or C:\ProgramData\Microsoft\ is providing a high-signal hunt location. File naming conventions for dropped payloads also often persist within a family.

Campaign Clustering

Campaign clustering is the process of grouping related malware samples, infrastructure, and incidents into a coherent campaign picture. Individual samples are data points. Clustering them reveals patterns: this family of samples all use the same packer, share C2 infrastructure, were distributed in the same phishing wave, and target the same sector. The cluster is a campaign; the campaign belongs to an actor; the actor has a profile that predicts what they will do next.

Code similarity clustering identifies samples that share significant code regions. Tools like BinDiff, YARA, and Malpedia's code similarity feature can identify when two malware samples share a function, a crypter, a string decryption routine, or a persistence mechanism. High code similarity between samples, especially in non-trivial code regions, is strong evidence they come from the same developer or are variants of the same family. This is more durable than hash clustering because it survives recompilation.

Infrastructure clustering groups samples by shared C2 infrastructure. Samples that beacon to the same IP, the same domain, or the same hosting provider cluster together. The value of infrastructure clustering is that it can link samples that share no code, because the attacker deployed multiple distinct tools but pointed them at the same backend infrastructure. Passive DNS and certificate analysis are the primary tools for infrastructure clustering.

Behavioral clustering groups samples by what they do rather than what they are. Samples that use the same persistence mechanism, the same injection technique, the same anti-analysis technique, and the same exfiltration method cluster together even if their code differs significantly. YARA rules that target behavioral patterns rather than specific strings are the primary tool for behavioral clustering at scale.

Attribution from clustering is probabilistic and should be expressed with calibrated confidence. Two samples sharing a rare crypter and the same C2 infrastructure from the same hosting provider are likely linked. Whether they are linked to a specific named actor requires additional evidence. Good clustering practice produces activity clusters first, then assesses whether those clusters match known actor profiles, rather than starting with attribution and working backward.

YARA Rule Basics

YARA is a pattern-matching tool designed for malware identification and classification. A YARA rule defines conditions that must be true for a file to be considered a match. Rules can match on byte sequences, text strings, regular expressions, file structure characteristics (PE header fields, section names), or combinations of these. You do not need to be a reverse engineer to write useful YARA rules: many effective rules can be written directly from sandbox reports and behavioral analysis without touching a disassembler.

A YARA rule has three sections: meta (descriptive information), strings (the patterns to search for), and condition (the Boolean logic that determines a match). The meta section contains author, date, description, and any other metadata fields the rule author wants to include. The strings section defines named string variables. The condition section specifies which combinations of strings must be present for the rule to fire.

String extraction from sandbox reports is the fastest route to YARA rule candidates. Look for: mutex names (often unique per malware family), registry key paths used for persistence, User-Agent strings used in C2 communication, URL paths in network connections, and hardcoded strings in API call parameters. Strings that are unusual, specific, and unlikely to appear in legitimate software are the strongest YARA candidates. Strings that are generic (like "Windows" or "Mozilla") will generate massive false positive rates and should be avoided or combined with more specific conditions.

Context-based rules require fewer strings to be useful because they anchor string matches to their position within the file. The uint16(0) == 0x5A4D condition (PE header check) ensures the rule only fires on Windows executables. Conditions like $string at entrypoint or $string in (0..1024) anchor matches to specific file regions. These context conditions dramatically reduce false positives without sacrificing detection coverage.

Malware Intelligence Feeds

Several public and commercial platforms provide ongoing malware intelligence that is useful without requiring in-house analysis capabilities. Understanding what each platform provides and how to consume it effectively is part of operating an intel-driven CTI function.

MalwareBazaar (abuse.ch) is a free community platform for sharing malware samples and associated indicators. Samples can be searched by hash, tag, family name, or signature. The platform provides JSON API access, so samples and metadata can be pulled programmatically. MalwareBazaar is particularly useful for newly observed samples: it often has samples within hours of initial discovery, before vendor analysis is complete.

Malpedia (Fraunhofer FKIE) maintains a curated library of malware families with actor associations, YARA rules, and references to analysis reports. Each family page aggregates vendor reporting, lists known aliases across vendors, maps to ATT&CK Groups, and provides reference samples. Malpedia is the authoritative cross-vendor malware family reference, equivalent to ATT&CK Groups but for malware rather than techniques.

VirusTotal Intelligence (paid tier) provides access to the full VirusTotal dataset including YARA hunting (search for files matching a YARA rule across submissions), retrohunting (apply a YARA rule against historical submissions), and similarity search (find files similar to a seed sample). For organizations with budget for it, VirusTotal Intelligence enables proactive malware discovery rather than reactive indicator matching.

OALabs (Open Analysis Live) publishes detailed malware analysis reports with extracted configuration data, C2 indicators, and YARA rules. Particularly strong coverage of commodity RATs and infostealers. Their UnpacMe service automates unpacking of common packers and provides analysis of the extracted payload. Any.run and Triage provide interactive sandbox environments where analysts can observe malware execution in real time, which is valuable for understanding behavior that static analysis misses.

Consuming malware intelligence feeds effectively requires integration with your analysis workflow. A YARA hunting feed from MalwareBazaar integrated with an EDR platform allows new malware families to be automatically searched across endpoint telemetry without manual effort. A Malpedia family update integrated with an actor profile can automatically flag when a previously profiled actor deploys a new tool variant. These integrations transform passive feed consumption into active threat detection.