The avatar seemed specific, but I was unfamiliar with it and wondered if learning more about the avatar could help me to learn more about the malware author. For example, if you come across a logo that you’re unfamiliar with, a simple reverse image search may return information about the logo’s origin that could be useful to you, such as information about the brand or location.įor example, during the course of an investigation I came across an avatar used by a malware author that I was investigating.

By searching on those images in various ways, it can be possible to learn a lot about the subject of your investigation.įor some investigations, it may be enough to reverse image search using a regular search engine like Google or Bing. One type of data that may oftentimes be overlooked is images, such as profile pictures on forum posts, photos in malware advertisements, and more. In security research, we deal a lot with various types of data: IOCs, malware binaries, reports, and more. We won’t be covering any of the more complex aspects of image analysis but instead we’ll be focusing purely on what you can expect when uploading images for reversing. Hopefully you’re familiar with these search engines already but if you aren’t this post is a good crash course for what kind of results you can expect from each.įirst we’ll have Emily give an overview of reverse image searching, and then I’ll break down some comparisons between the most popular image search engines. We’ll look at Google, Yandex, Bing, and TinEye.

This time around I’ll be briefly comparing the reverse image search capabilities of some major image search engines. This will be another of a hopefully long series of practical OSINT blog posts from the Security Research team here at DomainTools.

Yandex reverse image search