Retrohunt

Retrohunt allows you to scan the files sent to VirusTotal in the past 12 months with your YARA rules (the 12 months limit applies to users of Hunting Pro, for standard users the limit is 3 months). Files that are larger than 80MB are not scanned by Retrohunt at all, and for those that are between 64MB and 80MB, only the first 64MB are scanned. A Retrohunt job scans a corpus of more than 500M files (~680TB worth of data) in 2-3 hours and reports you the files that matches your rules. However, the matches are limited to 10.000 per job. 

Also, you can scan a fixed and smaller corpus composed of about 1 million files that are known to be goodware, which is handy when you are testing your YARA rules, as it can help you to spot false-positives. These jobs usually finish in less than a minute.

Retrohunt jobs can't have more than 300 YARA rules and the total size of the rules in text form can not exceed 1MB. A limit of 10 concurrent jobs per user is also enforced.

Also be aware that the results cannot be sorted and you can use only the vt, pe, elf, dotnet, hash, math and time YARA rule modules.

Creating a Retrohunt job

1.  On the homepage, click on the Hunting menu at the top of the screen and then on the r the corresponding icon in the toolbar, either option leads you to the same place:

 2.  Then click on the New retrohunt job.

3.  A window will be opened with a text editor in which you can write your YARA rules and control its settings. The image below illustrates the usage of this window.

 

1. Return to retrohunt dashboard.
2. You can use different templates or you can use a known file to create rules based on its attributes.
3. YARA rules.
4. Create job button.
5. Corpus that is going to be scanned with your rules.
6. Time range.
7. Notification email.
8. You can run tests of the ruleset among a list of specific hashes.

 

Retrohunt results

1. Progress indicator.
2. Job status: Starting, Running, Aborted or Finished.
3. Number of matches found. Click on the number to see the files.
4. Button to download list of matches.
5. Cancel/Delete job.
6. Number of additional matches that you would be able to see with Hunting Pro (i.e. matches on files that have been submitted to VirusTotal more than 3 months ago).