Collaborate Disseminate
Most of us do it, be it romantic, familial, friendly or formal, but kissing among humans and where and how it originated is still hotly debated among historians and anthropologists. Now a new theory has been put forward: That our evolutionary loss of b… Continue reading Why we kiss: A fascinating new theory that predates human life on Earth
VirusTotal has incorporated a powerful new tool to fight against
malware: JA4 client fingerprinting. This feature allows
security researchers to track and identify malicious files based
on the unique characteristics of their TLS client communications.
JA4,
developed by
FoxIO, represents a significant
advancement over the older JA3 fingerprinting method. JA3’s
effectiveness had been hampered by the increasing use of TLS
extension randomization in https clients, which made
fingerprints
less consistent. JA4 was specifically designed to be
resilient to this randomization, resulting in more stable and
reliable fingerprints.
JA4 fingerprinting focuses on
analyzing the
TLS Client Hello packet, which is sent unencrypted from
the client to the server at the start of a TLS connection.
This packet contains a treasure trove of information that can
uniquely identify the client application or its underlying
TLS library. Some of the key elements extracted by JA4
include:
VirusTotal has integrated JA4
fingerprinting into its platform through the behavior_network
file
search modifier. This allows analysts to quickly
discover relationships between files based on their JA4
fingerprints.
To find the JA4 value, navigate to the “behavior” section of
the desired sample and locate the TLS subsection. In addition
to JA4, you might also find JA3 or JA3S there.
Example Search: Let’s say you’ve encountered a suspicious
file that exhibits the JA4 fingerprint
“t10d070600_c50f5591e341_1a3805c3aa63” during VirusTotal’s
behavioral analysis.
You can click on this JA4 to pivot using the
search query
behavior_network:t10d070600_c50f5591e341_1a3805c3aa63
finding other files with the same fingerprint This search
will pivot you to additional samples that share the same JA4
fingerprint, suggesting they might be related. This could
indicate that these files are part of the same malware family
or share a common developer or simply share a common TLS
library.
To broaden your search, you can
use wildcards within the JA4 hash. For instance, the search:
behaviour_network:t13d190900_*_97f8aa674fd9
Returns files that match the
JA4_A and JA4_C components of the JA4 hash while allowing
for variations in the middle section, which often corresponds
to the cipher suite. This technique is useful for identifying
files that might use different ciphers but share other JA4
characteristics.
YARA hunting rules using the
“vt” module can be written to
automatically detect files based on their JA4 fingerprints.
Here’s an example of a YARA rule that targets a specific JA4
fingerprint:
This rules will flag any file submitted to VirusTotal that
exhibits the matching JA4 fingerprint. The first example only
matches “t12d190800_d83cc789557e_7af1ed941c26” during
behavioral analysis. The second rule will match a regular
expression /t10d070600_.*_1a3805c3aa63/, only matching JA4_A
and JA4_C components, excluding the JA4_B cipher suite. These
fingerprints could be linked to known malware, a suspicious
application, or any TLS client behavior that is considered
risky by security analysts.
| Description | JA4 | Example SHA256 |
|---|---|---|
| Linux miner, trojan | t12d5908h1_7bd0586cbef7_046e095b7c4a | caed9b2d91f5802da4b1844068e7df971d50a11411ff2a792aedce96554539f9 |
| GoLang | t13d190900_9dc949149365_97f8aa674fd9 | 00b001f5d30e7a51bf9eced4e41267912353153dcc52605a737a6778aaecfbfb |
| SnakeLogger / Redline | t10d070600_c50f5591e341_1a3805c3aa63 | 03461c2a07431aed5ff68bbcf42d7ef82f32190b44ba140befd3f474614b5f3d |
VirusTotal’s adoption
of JA4 client fingerprinting will provide users with an
invaluable tool for dissecting and tracking TLS client
behaviors, leading to enhanced threat hunting, pivoting, and
more robust malware identification.
Happy Hunting.
Continue reading Unveiling Hidden Connections: JA4 Client Fingerprinting on VirusTotal
A fascinating new insight into elephant communication has been uncovered, with researchers finding that a group of males will harmonize a rumbling sound, from one to the next, to signal that it’s time for everyone to move on. They liken it to the way a… Continue reading Elephants ‘sing’ like a barbershop quartet when it’s time to get moving
If you’ve ever seen TV cat behavioralist Jackson Galaxy at work, you’ll know that while we may (well, many of us) love feline company, there’s a lot we don’t understand about their needs. Now, a new study delves deep into the domestic lives of cat fami… Continue reading Why your cat shreds the sofa – and how to get them to stop for good
Because it doesn’t produce perception-altering effects like THC does, cannabidiol (CBD), one of the active ingredients in cannabis, is deemed to be safe. Indeed, it’s been shown to be an effective treatment for a wide variety of health issues, from red… Continue reading CBD use during pregnancy produces strange behavior in offspring
Engaging in activities that are designed to blow off steam when you’re angry – like jogging or hitting a punching bag – probably isn’t going to be effective at reducing your anger, researchers have found. It’s better, they say, to try activities that d… Continue reading There are solutions for anger, but ‘blowing off steam’ doesn’t work
For the first time ever, a lone orca has been observed killing and eating a great white shark. Although orcas were already known to hunt great whites in packs or pairs, one had never been seen going solo before. The finding suggests the emergence of a … Continue reading Video: Orca makes first-known solo attack on a great white shark
It’s safe to say that this distinctive orange and and white creature is one of the most recognizable fish on the planet, due largely to the 2001 hit Finding Nemo. Now, scientists have discovered they also recognize each other, counting the white stripe… Continue reading Clownfish can count – but only to bully enemies away from anemones
From sniffing out diseases and explosives, to some clever animal and dinosaur adaptations for life, the nose and its broad olfactory functions are an important, if somewhat underappreciated, part of many animals’ sensory systems.Continue ReadingCategor… Continue reading Time cell discovery reveals the bizarre way the nose powers actions
A fascinating study has found that sniffing female tears significantly reduced male aggression and decreased activity in aggression-related brain networks. It’s suggested that the effect, which is caused by chemical signals in tears and is also seen in… Continue reading Sniffing women’s tears reduces male aggression by 44%, study finds