We are happy to introduce the Intezer Analyze plugin for Maltego. Combine insights from our malware analysis platform with Maltego’s graphical tool (And you know we love graphs).
Maltego is a graphical intelligence tool based on open-source intelligence and forensics data. It enriches data by making connections between different entities such as files, network, accounts and more. Data linking is done by using ‘Transforms.’ Transforms are pieces of code that take an entity as an input and provide related information as an output. For example, a transform that connects a URL (input) with an IP address (output).
On Maltego’s Transform Hub you can find the plugins of many different intelligence and analysis vendors, now including Intezer!
Intezer Analyze Plugin
Intezer Analyze is a complete malware analysis tool. Gain immediate context about any malware-related artifact, including: verdict, malware family, related samples, TTPs, network IoCs and more.
The plugin can be found under the Transforms Hub.
The following transforms are available in the plugin:
| Transform Name | Input Entity | Description |
| To Dropped File Hashes [Intezer] | maltego.Hash | This transform gets files dropped by the input entity. |
| To Malware Family [Intezer] | maltego.Hash | This transform gets the file’s malware family name. |
| To Tags [Intezer] | maltego.Hash | This transform gets the file’s technical characteristics (tags). |
| To IoCs [Intezer] | maltego.Hash | This transform gets the file's network IoCs. |
| To Related File Hashes [Intezer] | maltego.Hash | This transform gets files that share the same code with the input entity. |
Take a look at the analysis of Sofacy in Intezer Analyze. You are provided with immediate malware classification, network IoCs, tags and dropped executables for the sample. This information is useful for researchers, IR, SOC and threat intelligence teams, and doesn’t require sifting through long, complicated sandbox reports to get the bottom line.
The graph below shows the output after running all of Intezer’s transforms on this file.
Key components from Intezer Anlyze’s GUI provided by the plugin include network IoCs, classification, tag, other files that share code, and the dropped executable.
All You Need is an API Key
Start using the plugin with your Intezer Analyze API key. To get an API key, sign up for free.
Next, register to Maltego and download their software.
If you do not have an API key you will be able to run up to 15 transforms.
Go ahead and give the plugin a spin!
Intezer Analyze users can start by analyzing and classifying 50 files per month.
Intezer
Count on Intezer AI SOC to triage, investigate and respond to every alert at unmatched speed and accuracy.
In this article
Share article
Intezer Analyze Transforms for Maltego
.png)
AI SOC
AI
Company News
5 minutes
Loop engineering comes to the SOC: Introducing the Intezer Org Brain
Organizational context in an AI SOC is table stakes. Org Brain is very different. It learns, it recalls, it fetches what it's missing, and it gets sharper with every alert it touches, all autonomously.
Detection Engineering
AI SOC
8 minutes
Detection engineering in the AI era
AI is lowering the barrier to sophisticated attacks. Explore why detection engineering matters and where most programs fall short.
AI SOC
CISO
Company News
Introducing Custom Agents: Automate your SOC, your way
Add your own agents and automations on top of the ones Intezer runs out of the box, take more of the manual work off your analysts, and tailor AI SOC to the way your team actually operates.
