Abstract: The present disclosure generally relates to a multi-phase malware identification and/or profiling process that can be implemented by one or more computer systems and/or computer-implemented methods. For example, one or more embodiments described herein can regard a method that includes detecting one or more cybersecurity threat indicators of malware targeting a computer device. The one or more cybersecurity threat indicators can characterize a delivery of the malware, an infrastructure of the malware, or a combination thereof. The method can also include generating an adversary profile that includes a correlation between the one or more cybersecurity threat indicators and an operation of the malware.

Abstract: A method may include receiving a smart contract, which includes a binary file, from a contributor on a blockchain network, validating the smart contract, analyzing the binary file for malicious features, and generating a cybersecurity threat intelligence report using a contractual transaction incentivizing malware submission by the contributor. In some instances, analyzing the binary file comprises receiving the binary file by a feature extractor operable to extract one or more features based on one or more of analyzing the binary file using one or more of a header of the binary file, an image visualization of the binary file, natural language processing of application programming interface (API) calls, encoded strings, assembly instructions of the binary file, and sentiment analysis, and wherein the method further comprises delivering an extracted feature to a threat evaluator.