Mtracker – our take on malware tracking

This report presents CERT Polska’s Mtracker, a system that mimics malware C2 protocols to safely and efficiently harvest actionable intelligence (configs, webinjects, samples, spam templates, and peer IPs) without generating malicious traffic. It traces the evolution from simple config extraction to a distributed, proxy-enabled architecture with Tor and Namecoin DNS support, augmented by passive DNS and a web UI for orchestration and analysis, and summarizes tracking results across numerous malware families.