Worm Charming: Harvesting Malware Lures for Fun and Profit
summary
A pipeline uses YARA rules over VirusTotal Intelligence to pull interesting lures from ~1.3M daily uploads, applying decompilers (CFR, JD), PDF/RTF tools (Didier Stevens), sandbox detonation, and ML clustering to reduce the corpus to 1.3M → 2,500/day. The system extracts image XMP metadata and other anchors like symbols and chaff, tracks XMP IDs, exposes an API/dissector and YARA generators, and surfaces zero‑day samples months before campaigns, proving the approach effective.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 1:20Who am I
- 2:34What is Worm Charming
- 4:01Lures
- 6:17Where do we dig
- 7:51Attacker infrastructure
- 9:54VirusTotal Intelligence
- 12:27Good Vibrations
- 16:03Chaff
- 16:51Bite Nibble
- 18:55Primitives
- 21:38RealWorld Samples
- 22:18Stevi 2018 8174
- 28:39ZeroDay
- 32:14Clustering
- 37:19Why is this useful
- 39:50Labs
- 40:22Document dissector
- 42:17API driven example
- 42:48Base64 record generator
- 43:22Reputation aggregation
- 44:00Thank you
- 44:31Questions
related talks
48m"Utilizing YARA to Find Evolving Malware"
47mDetecting and analyzing files-less malware
48mCatch me if you can: Building a Web Malware Analyzer using Machine Learning
30mTrawling for IOCs: Catching C2 in a Sea of Data
01h 03mEffects Malware hunting in Cloud environment
33mBasic Malware Analysis for Incident Responders
30mDeception at Scale: How Malware Abuses Trust
43mGoing Viral for Fun, not Profit