Sign up free

Changelog

Platform status

Changes to the Malva.RE platform, most recent first. Dates are deployment dates (UTC). Internal refactoring and dependency maintenance are listed when they affect security.

8 November 2026

Malware families

  • The families index now opens on a map of all families: each tile's area is the number of public malicious samples analysed, its colour the kind of threat (stealer, RAT, loader or crypter, botnet), with the last-30-day activity on the tile. Below it, every family with samples over 30 and 7 days, last sighting and the number of extracted configurations.
  • Family pages: key facts (kind, main file type, samples, last 30 days, first seen, configurations extracted), file types and MITRE techniques computed over every public sample, typical infection chains (STICH signatures), related families, a factual FAQ with FAQPage structured data, and real publication/update dates. Families with fewer than five public samples are no longer submitted to search engines.
  • Family pages: "Recurring C2 endpoints" is now computed over every public sample of the family (not only the latest reports) and grouped by domain, then by the most used hosts — tunnelling and dynamic-DNS providers (ply.gg, portmap.host, duckdns.org) and dead-drop services stand out at a glance. IP addresses are grouped with their ports.

Reports (search engines)

  • Report title (H1) now leads with the malware family and the short hash — e.g. "DarkCloud Stealer — static analysis of 0a97a720e22b" — with the file name underneath.
  • Structured data (TechArticle, BreadcrumbList) carries the real dates (first submission, last analysis), keywords and the canonical page; the ld+json attribute is emitted verbatim.

Incident — public API

  • The REST API (v1.api-p.malva.re) returned HTTP 500 on every request from 7 November 21:08 UTC to 8 November 02:06 UTC. Cause: a dependency-injection lifetime conflict introduced by the 6 November data update, triggered by the automatic API redeployment. Fixed and redeployed. The public sample feed, which goes through the API, was paused for the same period and resumed at 02:15 UTC; the web application and user submissions were not affected.

Platform

  • Public status page and this changelog; security.txt published on app.malva.re.

Reports

  • What's next? block at the end of every report: follow the detected family (or the file), add the sample to a collection, get an API key, copy the permanent link.
  • Home page reminder to follow a family or a file for accounts that analysed a file but follow nothing yet.

Security

  • Dependency update across the analysis engine and the web application (PowerShell SDK, cryptography libraries, MessagePack); the cabinet (.cab) extractor no longer depends on an abandoned library.
  • Removed an unmaintained graph-rendering library (last release January 2024, built on an end-of-life Angular) that was still shipped although no page used it; 14 dependency alerts closed.

7 November 2026

Analysis engine

  • DarkCloud Stealer: configuration extraction now covers the variant with hex-encoded, XOR-masked strings.
  • Public status and changelog pages planned; security.txt published on app.malva.re.

6 November 2026

Watchlist and e-mails

  • Watchlist: follow a malware family, a C2 domain or IP, or a sample; e-mail alert when something new is seen (at most once a day) and a weekly digest. Free plan: 3 entries.
  • Product e-mails: welcome, "your analysis is ready" when you left before the end of the scan, weekly digest — each with one-click unsubscribe and a preference on the account page.

Reports and public pages

  • Report overview section (key facts, related samples) and public family pages (/family/{name}) with recent samples.
  • Permanent public report links by MD5 and SHA-256 (/md5/…, /sha256/…); report titles and descriptions rewritten for search engines.
  • Sign-up flow: Google sign-in visible on the registration screen, return to the requested page after login, sign-up e-mail confirmation leads straight into the app.

Analysis engine

  • Visual Basic 6 executables decompiled with VBReFormer (forms, procedures, strings) and routed to the VB6 malware collectors.
  • New extractors: DarkCloud Stealer and Salat Stealer configurations.

25 October 2026

Reports

  • PE Explorer: headers, sections, imports, exports and resources of PE files, with a jump to the hex view.
  • Lineage tree for the file structure: see how each extracted item was obtained (archive member, decoded blob, deobfuscated script…).
  • Pricing page, plan names and upgrade dialogs clarified.

23 October 2026

Analysis engine

  • UPX: detection (x86/x64) and static decompression; the unpacked executable is analysed in turn.
  • Go loaders (Factory v3): static extraction of the embedded payload.

This changelog starts on 23 October 2026. Earlier work (AutoIt decompilation, PowerShell and VBScript deobfuscation, infection chain, structural chain signature, 70+ format and family collectors) predates it.