News for hackers. Stuff that matters.
Re:Taking apart a double zero-day sample discovered in joint... by agnsaft on Wednesday July 04, 2018 @04:07PM (#17459203)
VT is more than just the antivirus engines. If you subscribe (expensive!) you can actively hunt for malware using Yara-rules and a powerful search engine. if you know some patterns in malware you are tracking, you can add Yara rules that will run each time a file is uploaded and will notify you of any matches.

Lets assume you know a threat actor always uses the same variable names during heap sprays, you can discover new malware from this threat actor with a Yara rule to look for this pattern.

Re:Taking apart a double zero-day sample discovered in joint... by badrabbit on Wednesday July 04, 2018 @06:20PM (#17459724)
Not just using yara rules but any file in VT you can find by hash,name,etc... And you get extra metadata like where it was uploaded from.
Re:Taking apart a double zero-day sample discovered in joint... by juliusmusseau on Wednesday July 04, 2018 @05:53PM (#17459624)
Thanks for the explanation. Very helpful!