Today, I got some time to makes some changes on the tracker side of the website. I added some new elements on the stats page, some new download options, and a clickable malware name that renders pivoting easier for a given malware family.

First Off, the stats page now shows 2 new elements:

Last 30 days Top 10 malware family for panels seen in the tracker.

It also displays last 30 days in the form of an histogram, for numbers of panel added daily.

Malware Name now clickable

The malware name on the page of the tracker is now clickable. This will generate a url for a specific family, with all entries for said family.

2 new download options

As the data count grows, I received some request to have a more digestable download options.

I added 2 new options:

• Download last 30 days of panels in CSV
• Download last 50 panels in CSV

The bulk dump download option still exists.

New design for the blog

As you may have noticed, I redesigned the blog template to a basic design in same color tone.

Now in ThreatFox by Abuse.ch

Abuse.ch who does a wonderful job of providing multiple platforms to fight cybercrime and allow easy sharing of IOC, as now started to ingest Viriback Tracker data:

See: https://threatfox.abuse.ch/browse/tag/ViriBack/

Hovering with the mouse cursor over a specific C2 panel login page will provide a screenshot of the page when added to the crawler. This feature is powered by URLScan.io

Whenever I add a new panel url to the tracker , it will also be added to URLScan for crawling. Furthermore, clicking on the panel url will open a new window to the URLScan report.

Proper tags will be added to the submission on URLScan for better clustering.

I hear good news and new features are coming to URLScan that will leverage tags and similarity between submissions.

Here is an example provided by the tracker: PredatorTheThief

I added a Malware C2 Panels tracker on the blog. It can be located at http://tracker.viriback.com

A search feature in the header is available to search for a specific malware family, or search part of a url.

You can also dump the entire data in csv format.

I might do a stats page, but I am currenlty building the data set before I play with graphs.

If you have corections, requests or suggestions do not hesitate to reach to me on Twitter: @viriback

Same goes if you would like to contribute, twitter is the best way to share 😉