Threat-Intel on Blue Team Write-upshttps://zviarcyber.github.io/tags/threat-intel/Recent content in Threat-Intel on Blue Team Write-upsHugoen-usWed, 24 Dec 2025 00:00:00 +0000YellowRAT — Threat Intelligence on Yellow Cockatoo with VirusTotalhttps://zviarcyber.github.io/posts/yellow-cyberdefenders/Wed, 24 Dec 2025 00:00:00 +0000https://zviarcyber.github.io/posts/yellow-cyberdefenders/<h2 id="scenario">Scenario</h2> <blockquote> <p>During a routine IT security check at GlobalTech Industries, abnormal network traffic was detected from multiple workstations. Employees&rsquo; search queries were being redirected to unfamiliar websites. Your task is to investigate the incident and gather as much information as possible.</p></blockquote> <p><strong>Tool used:</strong> VirusTotal (plus open-source threat intel).</p> <h2 id="investigation">Investigation</h2> <h3 id="q1-what-is-the-name-of-the-malware-family-causing-the-abnormal-traffic">Q1. What is the name of the malware family causing the abnormal traffic?</h3> <p>The challenge provides a file hash, so the starting point is a VirusTotal lookup. The file is flagged by most vendors, with a popular threat label of <code>trojan.msil/polazert</code> and YARA matches for <code>Windows_Trojan_Jupyter</code> and <code>Jupyter_Infostealer_DLL</code>. That label does not match the expected answer format, so I checked the <strong>Community</strong> tab:</p>