Worm Charming - Harvesting Malware Lures for Fun and Profit

Explore the intriguing world of digital "worm charming" in this 47-minute Black Hat conference talk. Learn how to apply YARA rules to attract interesting malware samples from the vast daily uploads to VirusTotal, mirroring the traditional earthworm harvesting technique. Discover methods for identifying attacker infrastructure, analyzing lures, and understanding the value of this approach in cybersecurity. Delve into real-world examples, clustering techniques, and practical applications through labs and API-driven demonstrations. Gain insights into document dissection, base64 record generation, and reputation aggregation to enhance your malware analysis skills.

Introduction
Who am I
What is Worm Charming
Lures
Where do we dig
Attacker infrastructure
VirusTotal Intelligence
Good Vibrations
Chaff
Bite Nibble
Primitives
RealWorld Samples
Stevi 2018 8174
ZeroDay
Clustering
Why is this useful
Labs
Document dissector
API driven example
Base64 record generator
Reputation aggregation
Thank you
Questions