A new year celebration is not complete without a recap of the previous year. So here it is, graphics and compilation of what was seen by the C2 tracker in 2022.

A total of 979 Live C2 panels were registered in the tracker from January to December 2022. The panels were spread across 56 malware families. Some big malware name left the trakcer while new families made it in.

TOP10 of malware names

TOP10 Hosting Country

Top10 Hosting IP addresses

TOP10 Hostnames

Today, I got some time to makes some changes on the tracker side of the website. I added some new elements on the stats page, some new download options, and a clickable malware name that renders pivoting easier for a given malware family.

First Off, the stats page now shows 2 new elements:

Last 30 days Top 10 malware family for panels seen in the tracker.

It also displays last 30 days in the form of an histogram, for numbers of panel added daily.

Malware Name now clickable

The malware name on the page of the tracker is now clickable. This will generate a url for a specific family, with all entries for said family.

2 new download options

As the data count grows, I received some request to have a more digestable download options.

I added 2 new options:

• Download last 30 days of panels in CSV
• Download last 50 panels in CSV

The bulk dump download option still exists.

New design for the blog

As you may have noticed, I redesigned the blog template to a basic design in same color tone.

Now in ThreatFox by Abuse.ch

Abuse.ch who does a wonderful job of providing multiple platforms to fight cybercrime and allow easy sharing of IOC, as now started to ingest Viriback Tracker data:

See: https://threatfox.abuse.ch/browse/tag/ViriBack/

Hovering with the mouse cursor over a specific C2 panel login page will provide a screenshot of the page when added to the crawler. This feature is powered by URLScan.io

Whenever I add a new panel url to the tracker , it will also be added to URLScan for crawling. Furthermore, clicking on the panel url will open a new window to the URLScan report.

Proper tags will be added to the submission on URLScan for better clustering.

I hear good news and new features are coming to URLScan that will leverage tags and similarity between submissions.

Here is an example provided by the tracker: PredatorTheThief

So far the number distince malware families is : 43

Here is a pie chart of the Top 10 families I have seen live and recorded:

The worlwide geographical distribution of the IP addresses is similar to the first month of recording, however, Russia is far more colored this time.

These are the top 15 ips seen :

Here is a Top 13 distribution according to respective ASN:

I added a Malware C2 Panels tracker on the blog. It can be located at http://tracker.viriback.com

A search feature in the header is available to search for a specific malware family, or search part of a url.

You can also dump the entire data in csv format.

I might do a stats page, but I am currenlty building the data set before I play with graphs.

If you have corections, requests or suggestions do not hesitate to reach to me on Twitter: @viriback

Same goes if you would like to contribute, twitter is the best way to share 😉