Backscatter: Automated Configuration Extraction

Backscatter is a static-analysis tool from Mandiant FLARE integrated into Google Threat Intelligence and VirusTotal that extracts malware configurations and indicators of compromise without executing samples. It complements dynamic analysis by identifying embedded IOCs, C2 servers, dropped files, and configuration attributes—enabling faster, high-confidence malware family attribution and improved IOC pivoting within the platform.