Malware Intelligence by Intel 471 actively tracks weaponized and productionized threats. The core of Intel 471 Malware Intelligence is its unique and patented Malware Emulation and Tracking System (METS). METS provides ongoing surveillance of malware activity at the command and control level, delivering near real-time insights and deep context in support of numerous cybersecurity and intelligence use cases. Mobile Malware, a feature of Malware Intelligence, tracks top tier families focused on systems access, information stealing, and financial fraud to help detect and prevent account takeover, 2FA bypass, fraud, and data leakage. It builds a comprehensive picture of the Android malware landscape by combining analysis and tracking of mobile malware families and the actors behind their development and use across the underground. In-depth Malware Intelligence Reports analyze malware families, features, network traffic, identification, detection, decoding, configuration extraction, control server encryption keys, and campaign IDs. Detailed Tactics, Techniques, Procedures, and Context are provided for understanding detected and blocked events, including linked malware family, version, encryption key, botnet ID, plugins, expiration time, and associated intelligence requirements. Timely and high-fidelity file and network-based indicator feeds can be automatically ingested and operationalized within security stacks to block and detect malicious activity from malware. YARA Rules and Intrusion Detection Systems (IDS) are used to accurately identify malware families, malicious network traffic, and improve detection systems. Malware and Botnet Configuration Information provides decoded, decrypted, and parsed configuration information on targets of banking trojans, spam campaigns, or other malware payloads. In-depth monitoring of Command and Control (C&C) servers captures commands and updates from threat actors, including secondary payloads and plugins. All data is available for download for local processing and analysis.
