🦠 Malware theater
Aggregates and analyzes malware families — loaders, stealers, RATs, and botnets — powering intrusions across the threat landscape. Drives detection engineering and IOC production.
Live indicators
0
in this theater
High severity
0
score ≥ 0.75 (top 60)
Actors tracked
2
documented
Mapped sources
0
in catalog
🏹 Threat Actors
🦠 Malware & Tools
📚 Priority sources & datasets
📜 Malware Playbook
- Pull fresh samples and IOCs from MalwareBazaar, ThreatFox, and sandbox telemetry.
- Detonate samples in a sandbox and extract config, C2, mutexes, and dropped payloads.
- Classify the family via YARA, imphash, and behavioral signatures, mapping capabilities to ATT&CK.
- Link the sample to a family or operator through code reuse, packer, and C2 conventions.
- Publish IOCs, detection rules, and a capability summary to defenders.
- Update sinkholes and blocklists and hunt for the family across the estate.
⚡ AI Skills & Automation
Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).
🧩 Advanced Capabilities
🔗 Cross-domain pivots
🔄 Data Feeds & Datasets
| Feed | Category | Format | Status |
|---|---|---|---|
| DigitalSide latest URLs | Malware URLs | text | enabled |
| MalwareBazaar Full (hash) | Malware Hashes | csv | enabled |
| ThreatFox Full | Malware Attribution | csv | enabled |
| URLhaus text (online) | Malware URLs | text | enabled |
| Maltrail malware domains | Malware Domains | text | enabled |
| Maltrail bad_ip | Malware IPs | text | enabled |
| MISP Galaxy Tools/Malware | Malware Families | json | enabled |
| Malpedia families (key) | Malware Families | json | enabled |
| URLhaus Full | Malware URLs | csv | enabled |
| URLhaus (tags/family) | Malware URLs | csv | enabled |
| MalwareBazaar Recent (hash→family) | Malware Attribution | csv | enabled |
| ThreatFox SHA256 | Malware Hashes | text | enabled |
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports
🤖 AI Copilot
⚡ AI Skills
🔍 Lookup & Enrich
📚 Docs & Reports
💡 Recommendations
- Explore related tools below
- Automate recurring work via cron