YellowRAT — Threat Intelligence on Yellow Cockatoo with VirusTotal
Scenario During a routine IT security check at GlobalTech Industries, abnormal network traffic was detected from multiple workstations. Employees’ search queries were being redirected to unfamiliar websites. Your task is to investigate the incident and gather as much information as possible. Tool used: VirusTotal (plus open-source threat intel). Investigation Q1. What is the name of the malware family causing the abnormal traffic? The challenge provides a file hash, so the starting point is a VirusTotal lookup. The file is flagged by most vendors, with a popular threat label of trojan.msil/polazert and YARA matches for Windows_Trojan_Jupyter and Jupyter_Infostealer_DLL. That label does not match the expected answer format, so I checked the Community tab: ...