Systems and methods for automated malware artifact retrieval and analysis

1. A computerized method for automatically intercepting communications passing through a command and control node, comprising:

receiving a target resource identifier, the target resource identifier specifying:

an address for a command and control node; and

a location of a malware artifact electronically stored at the command and control node,

wherein the malware artifact comprises a command or data being exchanged between an attacker computing device and a victim computing device;

receiving the malware artifact at an analyzer device separate from the command and control node and the victim computing device;

determining whether the malware artifact is at least partially obfuscated;

decoding the malware artifact to reverse at least one obfuscating transformation if the malware artifact is at least partially obfuscated;

storing the malware artifact in an electronic data store; and

analyzing the decoded malware artifact at the analyzer device to determine whether it contains a command or data stored therein.

2. The computerized method of claim 1 , further comprising:

repeatedly accessing the command and control node according to a fetch schedule and attempting to retrieve the malware artifact available at the address;

electronically analyzing the malware artifact to determine a deobfuscation algorithm for the malware artifact;

decoding the malware artifact to identify a second address within the malware artifact according to the determined deobfuscation algorithm;

storing the second address in the electronic data store; and

accessing a second command and control node at the second address to retrieve a second malware artifact.

3. The computerized method of claim 1 , further comprising:

processing the malware artifact to identify a second address identifying a second malware artifact at a second command and control node;

retrieving the second malware artifact stored at the second command and control node; and

storing the second malware artifact in the electronic data store.

4. The computerized method of claim 1 , further comprising:

predicting a second address identifying a second malware artifact at a second command and control node, the prediction based on the first address, and wherein the second address identifies a host and a file name; and

generating the second address based on the prediction.

5. The computerized method of claim 1 , wherein:

the malware artifact is a file uploaded by a victim computing device to the command and control server; and

the malware artifact comprises data having been exfiltrated from the victim computing device by an attacker.

6. The computerized method of claim 1 , wherein the malware artifact comprises one or more commands provided by an attacker computing device.

7. The computerized method of claim 6 , wherein the command provided by the attacker computing device comprises at least one instruction directed to the victim computing device.

8. The computerized method of claim 1 , wherein the malware artifact further comprises program code for controlling execution of malware on the victim computing device.

9. The computerized method of claim 8 , wherein the program code comprises an instruction to the victim computing device to upload one or more files to the command and control node.

10. The computerized method of claim 1 , wherein the command and control node is in communication with the victim computing device and the attacker computing device.

11. The computerized method of claim 1 , wherein the command and control node is a publicly accessible network resource and accessing the command and control node does not legally constitute access without authorization by a third-party.

12. A computerized system for automatically intercepting communications passing through a command and control node, comprising:

an input module configured for:

receiving a target resource identifier, the target resource identifier specifying:

an address for a command and control node; and

the location of a malware artifact electronically stored at the command and control node, wherein the malware artifact comprises a command or data being exchanged between an attacker computing device and a victim computing device;

an analyzer module configured for:

receiving the malware artifact, wherein the analyzer module is separate from the command and control node and the victim computing device;

determining whether the malware artifact is at least partially obfuscated;

decoding the malware artifact to reverse at least one obfuscating transformation if the malware artifact is at least partially obfuscated;

analyzing the decoded malware artifact at the analyzer module to determine whether it contains a command or data stored therein; and

an electronic data store configured for storing the malware artifact.

13. The computerized system of claim 12 , wherein the analyzer module is further configured for:

repeatedly accessing the command and control node according to a fetch schedule and attempting to retrieve the malware artifact available at the address;

electronically analyzing the malware artifact to determine a deobfuscation algorithm for the malware artifact;

decoding the malware artifact to identify a second address within the malware artifact according to the determined deobfuscation algorithm;

storing the second address in the electronic data store; and

accessing a second command and control node at the second address to retrieve a second malware artifact.

14. The computerized system of claim 12 , wherein the analyzer module is further configured for:

processing the malware artifact to identify a second address identifying a second malware artifact at a second command and control node;

retrieving the second malware artifact stored at the second command and control node; and

storing the second malware artifact in the electronic data store.

15. The computerized system of claim 12 , wherein the analyzer module is further configured for:

predicting a second address identifying a second malware artifact at a second command and control node, the prediction based on the first address, and wherein the second address identifies a host and a file name; and

generating the second address based on the prediction.

16. The computerized system of claim 12 , wherein:

the malware artifact is a file uploaded by a victim computing device to the command and control server; and

the malware artifact comprises data having been exfiltrated from a victim computing device by an attacker.

17. The computerized system of claim 12 , wherein the malware artifact comprises one or more commands provided by an attacker computing device.

18. The computerized system of claim 17 , wherein the command provided by the attacker computing device comprises at least one instruction directed to the victim computing device.

19. The computerized system of claim 12 , wherein:

the malware artifact further comprises program code for controlling execution of malware on the victim computing device; and

wherein the program code comprises an instruction to the victim computing device to upload one or more files to the command and control node.

20. A non-transitory computer readable storage medium comprising code executable by a processor for performing a method, the method comprising:

receiving a target resource identifier, the target resource identifier specifying:

an address for a command and control node; and

a location of a malware artifact electronically stored at the command and control node,

wherein the malware artifact comprises a command or data being exchanged between an attacker computing device and a victim computing device;

receiving the malware artifact at an analyzer device separate from the command and control node and the victim computing device;

determining whether the malware artifact is at least partially obfuscated;

decoding the malware artifact to reverse at least one obfuscating transformation if the malware artifact is at least partially obfuscated;

storing the malware artifact in an electronic data store; and

analyzing the decoded malware artifact at the analyzer device to determine whether it contains a command or data stored therein.