Payloads observatory

Malware our honeypots were told to download.

When an exploit payload carries a wget/curl one-liner, we fetch the file in a sandboxed collector, hash it, and check it against VirusTotal (uploading samples VT has not seen). Files a client hands over directly in a session our interactive sensors answer, over SMB or SCP, are kept by the sensor and looked up by hash. 379 files so far, 321 flagged malicious. URLs are shown in Safe-IOC form; hashes link to the VT report, and both the staging host and the IPs seen delivering each sample open their per-IP report.

Files handed to sensors

Executables, scripts and web payloads a client uploaded or wrote during a session one of our interactive sensors answered, one row per hash over the last 90 days. The sensor keeps the file; the collector looks the hash up on VirusTotal and never uploads it. A hash it has not looked up yet reads "not checked".