Exploring VirisTotal: Online Malware Scanning Tool for Security Analysts (SOC Analyst)

---

Can you 100% trust your antivirus will catch all malicious files? Hmm… that is a confusing question. How about we have an option that can scan a file using all anti-malware solutions in one go?

In this post, we will discuss what is VirusTotal and how to useVirusTotal, The No.1 online malware scanning tool for security analysts.

What is VirusTotal

VirusTotal is a free online service that allows users to analyze files and URLs for the presence of malware, viruses, worms, trojans, and other malicious content. It uses multiple antivirus engines and website scanners to perform the analysis, providing a comprehensive report on the potential security threats associated with a specific file or website.

VirusTotal was created in 2004 by Spanish company Hispasec Sistemas and was later acquired by Google in 2012. The service is widely used by security professionals, researchers, and everyday users to identify and avoid security risks. Users can upload a file or submit a URL to VirusTotal’s website, where it will be scanned and analyzed by multiple antivirus engines. The resulting report will provide details on the findings and an overall verdict on whether the file or URL is safe or malicious.

How to Use VirusTotal? Online Malware Scanning Tool for Security Analysts (SOC Analyst)

VirusTotal is a go-to tool for all security researchers, SOC analysts, etc. We will see how to use the VirusTotal and explore VirusTotal and by exploring all the features available.

How to useVirusTotal?

1. Access the VirusTotal website: Open your web browser and navigate to the VirusTotal website at https://www.virustotal.com/.
2. Choose your method of scanning:a. File scanning: To scan a file, click on the “Choose file” button or the “File” tab on the homepage. This will open a file explorer window. Locate and select the file you want to analyze, then click “Open” to upload the file to VirusTotal. The maximum file size allowed is 650 MB.b. URL scanning: To scan a URL, click on the “URL” tab on the homepage. Enter the URL you want to analyze in the input field, and then click the “Scan it!” button.
3. Wait for the analysis: VirusTotal will now analyze the uploaded file or URL using multiple antivirus engines and website scanners. Depending on the size of the file or the number of engines being used, this process might take a few seconds to several minutes.
4. Review the results: Once the analysis is complete, you’ll see a detailed report with the results from each antivirus engine and scanning tool. The report will show whether the file or URL has been flagged as malicious by any of the participating engines. If a significant number of engines detect a threat, it’s likely that the file or URL is indeed malicious.
5. Make informed decisions: Based on the results, you can decide whether to proceed with caution, avoid the file or URL, or seek additional information from other sources.

Things Can Be Done With VirusTotal:

VirusTotal offers several features and capabilities to enhance your online security and malware analysis. Here are some things you can do with VirusTotal:

1. File scanning: Upload and scan files for potential threats using multiple antivirus engines. This helps identify malicious content before it can harm your device or compromise your data.
2. URL scanning: Analyze URLs and websites for potentially malicious content, such as phishing sites or sites hosting malware. This helps you avoid visiting unsafe websites and falling victim to online scams.
3. IP address and domain analysis: Check the reputation of an IP address or domain by examining its historical data, detected malicious content, and other information. This can help identify potentially harmful web resources and servers.
4. Search and filter: Search for specific files, URLs, domains, or IP addresses within VirusTotal’s vast database. You can filter the results based on various criteria, such as detection rate, file type, or date of submission.
5. API access: Integrate VirusTotal’s services into your own applications, scripts, or tools using the VirusTotal API. This allows you to automate scans and analysis, retrieve detailed information, and make use of the platform’s functionality within your own projects.
6. Community engagement: Sign up for a free account to participate in the VirusTotal community. You can contribute comments, vote on detections, and share your insights with other users to help improve the platform’s knowledge base and threat detection capabilities.
7. VirusTotal Intelligence: A premium feature available to researchers and security professionals, VirusTotal Intelligence provides advanced search capabilities, access to malware samples, and additional tools for in-depth analysis.
8. VirusTotal Monitor: A service for software developers that allows them to upload and monitor their files to ensure they are not incorrectly flagged as malicious by antivirus engines. This helps reduce false positives and improve the reputation of legitimate software.

Remember that VirusTotal should be used as a supplementary security measure and not as a replacement for dedicated antivirus software.

Exploring VirisTotal and Its Features:

As a demo, let’s scan a malicious IOC belonging to the Batloader trojan and analyzing the results. We can look up hashes in any commonly used hashing algorithms like MD5, SHA256, etc.

Hash used- 61e0926120f49b3d5edf3a5e0842b04640911974ecbbc93b6b33ca20c1f981bc

Exploring the Dashboard

When we do a lookup for the above-provided hash, we will see the above results. We will investigate the details of what all parameters are:

1. We can see a detection rate that shows a 34/60 score which means out of the 60 anti-malware tools, 34 engines have tagged that file as malicious.
2. This explains that 34 security vendors have tagged that file as malicious.
3. The third box represents the last time the file was scanned in the above case. The last scan happened a month ago.
4. This shows that the hash value belongs to a JavaScript file.  
5. These symbols show that.

• We can automate this information using API.
• We can request a new scan.
• Graphical representation of the malicious activity done by that file.

1. The VirusTotal flagged the hash as Batloader malware.

Exploring Detection Tab

This tab shows which security vendors tagged the file as malicious or clean. In this case, we can see that the file was labeled as a ‘trojan.batloader’ clearly. This tab shows details of which all security vendors have flagged this file as malicious. In the below image, we can see some of the famous security vendors, like Avast, BitDefender, etc., also flagged this file as malicious.

Exploring Details Tab

This tab will provide us with the full details on the file related to the hash. Whatever hash format we are uploading, we can see other hash algorithms, the file type, when the file was first submitted inVirusTotal, the last submission, the last analysis, what all names the file is known as, etc.

Exploring Relations Tab

This tab will show you to which all domains or IPs that file has communicated. This tab also has a very advanced feature of representing the whole attack in a graphical format showcasing every minute detail required.

As you can see, the graph shows us the domains and IPs to which the malicious file has communicated, and it also shows which region these IPs belong to and also provides graphs on the presence of the file reported.

Exploring Behavior Tab

This tab gives more details on the behavior analysis of the malware. Here we can see all MITRE signatures related to the file, IDS rules, and Sigma rules, if any. So, all these details will help in hunting malware within an organization.

 

Exploring Community tab

This is the tab where we can see all the community contributions. Researchers who observe any further details can give more input and give back to the community.

Domain or IP analysis using VirusTotal

We can search the reputation of any IP or domain inVirusTotal. The process is the same, but let’s see what extra details we can observe while analyzing an IP or domain. I uploaded a malicious IP and domain, and apart from the analysis which we discussed above, we can see ‘who is’ information on the domain. This contains the creation date of the domain, expiry date, registrar details, name server details, etc.

How Can You Contribute to The Society?

We saw all the information available while we looked for an artifact. Now in some cases, the score might be 0, i.e., it is not malicious; however, we cannot conclude that the file is clean. The reason might be that the security vendors haven’t flagged it as malicious yet. In such cases, if we as a researcher are sure that the file is malicious or clean, we can give a vote in the community score. We can also add comments in the community tab section.

VirusTotal Alternatives: Other Online Malware Scanning Tools or Websites like VirusTotal

If you want to know about the alternatives to VirusTotal, there are many.

There are several other online malware scanning tools and websites that offer similar functionality to VirusTotal. Some of the popular alternatives include:

1. Jotti’s Malware Scan: Jotti’s Malware Scan is a free service that allows users to scan files with multiple antivirus engines. While it doesn’t have as many engines as VirusTotal, it still provides valuable insights into potential threats.
2. MetaDefender Cloud: MetaDefender Cloud is a comprehensive security platform that offers file scanning, vulnerability detection, and data sanitization. Users can scan files with multiple antivirus engines and get detailed information about potential threats.
3. Hybrid Analysis: Hybrid Analysis is a free malware analysis service that focuses on in-depth analysis using automated sandboxing technology. Users can submit files for scanning, and the platform provides detailed reports on the behavior of the files, including network activity, file system modifications, and more.
4. Any.Run: app.any.run/ is an interactive online malware analysis sandbox that allows users to execute and observe the behavior of files in a controlled environment. This can help identify the presence of malware and understand how it operates.
5. Joe Sandbox: Joe Sandbox is an advanced automated malware analysis platform that combines static, dynamic, and behavior-based analysis techniques. Users can submit files for analysis, and the platform generates detailed reports on the observed activities and indicators of compromise.
6. Kaspersky VirusDesk: Kaspersky VirusDesk is a free online scanning tool provided by the Kaspersky security company. Users can scan files or URLs for potential threats using Kaspersky’s antivirus engine.
7. FortiGuard Online Scanner: FortiGuard Online Scanner is a free service provided by Fortinet that allows users to scan files or URLs for malware and other threats. The service utilizes Fortinet’s FortiGuard antivirus engine.

Conclusion 

VirusTotal is a very efficient tool that can provide so many details under one umbrella. The visualization of this tool makes the analysis very easy. There are highly advanced features of this tool that will help in detailed analysis. The graphical representation of the attack will provide an overview, and this information helps in hunting for malicious activity in your environment.