OH-SINT: Merging OSINT Into RE Workflows to Simplify Analysis

A SOC analyst escalated an alert that looked like ransomware but matched no known samples, and the sandboxes timed out on it. The malware had been delivered through a lookalike download site that bundled trojanized copies of popular applications. By the time the team dug in, the command-and-control server was offline, leaving only a domain, a file hash and a little network detail.

The speaker walked through how open-source research filled the gaps. A user agent and a URI from the sample led to a vendor report on a stealer advertised on Telegram, which gave the ports and paths to look for. Searching Shodan for matching login pages and HTML titles surfaced live servers, and pivoting through VirusTotal relations exposed fresher samples, including a developer build uploaded before a sale. The talk also covered developer documentation, which sometimes explains the sandbox and virtual machine checks a sample performs, so analysts can change their setup instead of fighting obfuscated code.

The main takeaway is to treat reverse engineering as a cycle rather than a straight pass through the code, with each outside finding feeding new searches. The speaker listed tools for this work, including dark web search engines, alternative scanning databases such as Censys, BinaryEdge and ZoomEye, URLScan, SecurityTrails for DNS and IP history, and DNSTwist for typosquatting domains. The core message was that developers often publish what analysts need, and checking those sources early can shorten time to value.