Jump to content


VirusTotal now analyses network traffic

  • Please log in to reply
No replies to this topic

#1 TheSentinel


    The man in the dark

  • General Admin
  • 31,818 posts

Posted 27 April 2013 - 05:54 PM

24 April 2013, 16:01
VirusTotal now analyses network traffic
The popular VirusTotal service, which can run more than 20 anti-virus scanners over a sample in one pass, can now also look for signs of malware infections in captured network traffic. To perform a check, users upload network packets that are captured in the common PCAP format instead of sending VirusTotal the more traditional suspicious EXE, PDF or HTML file. Such network traffic dumps can be created with sniffers like Wireshark or tcpdump. VirusTotal will extract all transmitted files and present them to the familiar virus scanners; registered users will also receive copies of the extracted files. The scan service also looks at the network traffic data with the Snort and Suricata intrusion detection systems. These services can, for instance, detect the communication between a botnet client and its command & control server, as well as other typical attack patterns.