Threatray

Our founders, @_jwagner and Endre Bangerter, sat down with @jstrosch on the Behind the Binary podcast. 🎙️ They get into binary code similarity — why comparing compiled code gets tricky once compilers, optimization, and languages like Go and Rust have had their way with the binary, how it powers real malware analysis (classification, goodware filtering, threat hunting, attribution), and what AI and ML actually bring to the table. Give it a listen 🎧 open.spotify.com/episode/2nm…

New blog post: how AI + code intelligence can help analysts rapidly identify trojanized DLLs and accelerate malware investigations. We preview our upcoming AI analysis feature, combining LLMs with Threatray’s code similarity engine to surface suspicious functionality, separate benign code from attacker logic, and speed up triage. Read it here: threatray.com/blog/leveragin…

New tutorial: From Binary Code to #YARA Rule — A Threatray Walkthrough with #Eddiestealer We just published a hands-on walkthrough showing how to build a reliable YARA rule for Eddiestealer, the Rust-based info-stealer, using Threatray’s unique binary analysis and intelligence capabilities. Since Eddiestealer encrypts and obfuscates its strings, string-based detection doesn’t work — we need a code-based YARA rule. The core challenge with code-based rules is finding pieces of code that guarantee a high true-positive and low false-positive rate. Rust binaries make this especially hard: they’re packed with statically linked runtime and library code, making it extremely difficult to separate malware logic from benign noise and to select the right code to base a YARA rule on. In this tutorial, we show how Threatray’s unique code analysis and intelligence capabilities can simplify and speed up the process of writing code-based YARA rules. Starting from 1,300+ functions in an Eddiestealer binary, we narrow them down to just 2 strong candidate functions through a largely automated process — and use those as the foundation for the final rule. Read it here: docs.threatray.com/docs/buil… A big thank you to @craiu (@wearetlpblack) and @X__Junior (@nextronsystems) for reviewing early drafts and providing valuable feedback.

🚀 We are proud to announce the availability of Threatray Release v2.2, bringing a powerful set of enhancements and new capabilities to the platform. 🔍 Function-level retro-hunting and pivoting is now available directly in the UI. Point and click on any unknown function to hunt for similar functions across our database of over 1 billion malware and goodware functions - uncovering relationships in seconds and accelerating analysis, pivoting, and detection workflows. 🧠 We’ve significantly improved our Go and Rust library identification engine, yielding up to 40 % more goodware function identifications, while reducing false matches. Library attribution is now more specific, enabling clearer distinction between known good code and potential threats. 👁️ YARA matches are now better visible throughout the UI, making detection results more accessible and intuitive. YARA classification works alongside our core code similarity engine, helping analysts quickly see all relevant classification and detection signals in one place. Explore all the new features and improvements: threatray.com/blog/threatray…

Head on over to our research account for content like this 👇

Check out the latest research, insights, and fresh IOCs from our threat intelligence team - now live at @ThreatrayLabs.

🚀 We are proud to announce the availability of Threatray Release v2.1, bringing an exciting set of additions and improvements to the platform. 🤝 We’ve partnered with @nextronsystems, a pioneer in YARA and Sigma rule detection, to bring their industry-leading detection capabilities directly into Threatray. THOR Thunderstorm YARA detection and classification is now fully integrated into the Threatray platform. 🔍 We made Hunting and Pivoting effortless – find a unified YARA search and family name autocomplete, making it easier to connect the dots between millions of analyses and hunt for threats. See details and screenshots here: threatray.com/blog/threatray…

⚡ Exciting Update ⚡ We're thrilled to announce our new partnership with @nextronsystems to take YARA rule development and malware classification to a whole new level. 🚀 This collaboration brings Nextron's high-quality YARA rules from THOR Thunderstorm directly into Threatray's Binary Intelligence Platform for even more accurate malware classification. Nextron will in turn leverage Threatray’s unique code reuse technology to accelerate their malware analysis and YARA rule development. Stay tuned for more updates as our collaboration progresses! 👉 threatray.com/blog/threatray… #cybersecurity #malwareanalysis #yara #threatintel

Threatray's @_n1ghtw0lf and @_jwagner in collaboration with @proofpoint Threat Research Team have undertaken a deep dive into the India-aligned #Bitter (TA397) cyber espionage group. Read part one over at Proofpoint, where they cover campaigns, infection chains, hand-on-keyboard activity and attribution: proofpoint.com/us/blog/threa… Then read part two, where we cover their vast payload arsenal, shared TTPs, IoCs and YARA rules: threatray.com/blog/the-bitte… We will also be presenting this research at #VB2025 later this year.

🚀 We are proud to announce the availability of Threatray Release v2.0, bringing a huge set of additions and improvements to the platform. ✅ The introduction of Goodware Identification enhances analysis by identifying benign code from runtime, third-party libraries and legitimate executables at the function level, streamlining processes such as detecting backdoors, creating YARA rules, and focusing on relevant code. 📊 We bring Code Intelligence to a new level, providing a detailed breakdown of malicious and benign code within binaries, along with capability analysis. These features accelerate investigation and triage of unknown binary code. ⚙️The IDA Pro plugin enhances reverse engineering with features such as cluster analysis to identify code overlaps and function-level retro-hunt to search through our vast code repository. We bring YARA rule development, malware tracking, and code reuse research to the next level. 🌐 Our new Chrome Extension allows for fast threat report analysis by summarizing reports, annotating hashes with malware family classifications, and enabling direct pivoting to detailed analysis in the Threatray platform. See details and screenshots here: threatray.com/blog/threatray…

⚡ Exciting Update ⚡ @TeamT5_Official and Threatray are teaming up in a joint research collaboration to level up threat actor tracking and malware analysis. 🔍 TeamT5’s threat intelligence analysis experts + Threatray’s cutting-edge malware detection and binary intelligence capabilities = stronger insights. This partnership will bring sharper threat landscape reporting and enhanced research capabilities for both teams. Continued insights ahead! threatray.com/blog/uniting-f… #Cybersecurity #ThreatIntelligence

Our code analysis engine has found that the malware sample 5bd8f9cbd108abc53fb1c44b8d10239a2a0a9dd20c698fd2fb5dc1938ae7ba96 is a variant of Beast ransomware. This sample was recently reported as Boramae ransomware by @CyfirmaR cyfirma.com/research/boramae…. We compared this sample with the Beast ransomware sample 4c44ac1eea4bc7f4ea542d611b5658d7ac2729d79abe750da83f1581cd832eaf discovered by @cybereason in October 2024 cybereason.com/blog/threat-a… Our findings show that: 1. Both samples share nearly identical code, however Boramae is statically linked with OpenSSL 1.1.0. 2. Boramae features enhanced string obfuscation techniques, including a more sophisticated XOR decryption routine and subtractive decryption. 3. It maintains Beast's GUI (accessible via Ctrl+Alt+666) but includes changes to the ransom note, file extension (.boramae), and mutex handling. For more details, check our report: threatray.com/blog/threat-up… This discovery demonstrates how older ransomware threats continue to evolve, not only through rebranding but also by incorporating enhanced functionality to avoid detection. #cybersecurity #malware #ransomware

🚨 Following up on @SentinelOne recent ransomware analysis: Our code search engine has discovered AidLocker/Frag, variants of HellCat/Morpheus. Our findings show that: (1) Like HellCat/Morpheus, AidLocker/Frag are code-wise identical but use different branding in their ransom messages. (2) AidLocker/Frag share substantial code with HellCat/Morpheus, confirming they belong to the same family. For more details, check our report: threatray.com/blog/threat-up… Special thanks to our friends @InfoGuardAG for sharing a recent in-the-wild sample of AidLocker. #Ransomware #Malware #ThreatIntel

We just released Threatray v2024.10. Check out the blog to see our new private YARA rules feature, DLL side-loading support, dark mode and lots of threat tracking updates. threatray.com/blog/threatray…

We are very happy to confirm our participation and sponsorship in @hack_lu conference. ⏰ Oct 22-25, 2024 🌍 Luxemburg 👉 Click here to see more about the event: hack.lu/ Threatray is looking forward to seeing you!