Malware and phishing analysis for security service providers: MSSP and MDR.
Your margin is analyst time, and your reputation is the quality of what you deliver. Accurate verdicts your triage can act on, behavioral depth your analysts can hand to a client, and threat intelligence built from what you see across your customers.
100+ MSSP and MDR providers worldwide trust VMRay toAutomate malware and phishing triage
Accelerate analysis and response
Build threat intelligence their clients cannot buy elsewhere
What makes service provider security different
Three conditions change what an analysis layer has to do.
ECONOMY OF SERVICEAnalyst minutes are the cost of the service
ESCALATIONWhat tier 1 can close determines your capacity
ACCOUNTABILITYYou hold other organizations’ data under their rules
What VMRay provides service providers
Three capabilities behind the three outcomes above.
01 / AUTOMATION Verdicts your automation can act on
Automation is only as reliable as the analysis feeding it. When a verdict cannot be trusted, the alert escalates, and escalation is where the margin goes.
- Definitive verdicts: malicious, suspicious, or benign
- Benign verdicts precise enough to close an alert at tier 1
- Scored IOCs for automated blocking and allowing decisions
- Native integrations and REST API into EDR, SIEM, SOAR, and TIP
02 / ANALYSIS AND RESPONSE Clarity to accelerate analysis and response
Depth does not have to arrive as complexity. VMRay goes deep into the threat and returns a report that reads cleanly, which shortens investigations and lets a tier 1 analyst hand a client a finding they can act on.
- Noise-free reports that crystallize complex analysis
- Full execution chain, including multi-step delivery
- Interactive analysis and PDF reports built for client-facing work
- Malware configuration extraction: C2 addresses, campaign detail
03 / THREAT INTELLIGENCE Intelligence their clients cannot buy elsewhere
Commercial feeds are available to everyone, which limits the advantage they offer. Intelligence derived from your own analysis and your own client base is yours alone, and it is a service you can sell.
- High-confidence IOCs extracted from observed behavior
- Malware configuration extraction: C2 servers, campaign identifiers
- MITRE ATT&CK TTP mapping across your client estate
- STIX 2.1 and TAXII output for machine-to-machine client delivery
FIG 1 / SIGNAL · VERDICT · DEPTHHow analysis fits into the flow
Samples arrive from across the stack. Verdicts and indicators return to every system that needs them.
How service providers are using VMRay
Three providers, three starting points. Investigation speed, proprietary intelligence, and analysis at scale.
FEATURED CUSTOMER STORYHow Expel gets answers, not alerts
Expel harnesses security signals from their clients’ existing investments and delivers alert management and investigation around the clock. Their goal is to give a client the full story of an intrusion, not a queue of alerts, which means analysts have to move through the investigative process without waiting and without losing the detail a client needs to act on.
- Complex investigations resolved in minutes rather than escalated
- Automated triage combined with manual analysis of reported email
- Multiple samples analyzed at once through the Expel Workbench
In the past, we might have had to wait hours or even days for L2 and L3 analysts to investigate a challenging attack, but with VMRay, I can have that done in less than 15 minutes.
Tyler Fornes, Principal Security Solutions Architect
ExpelCUSTOMER STORYHow a national cybersecurity provider builds proprietary threat intelligence on its own terms
Sensitive samples that cannot leave the environment, deployed on-premises with no compromise in analytical depth. Their own reputation engine and YARA rules plugged directly into the platform.
Read the full storyCUSTOMER STORYHow a global technology provider automated manual analysis
Time-consuming manual analyses turned into an automated pipeline, freeing senior responders for the engagements that genuinely need them.
Read the full storyFour deployment models, one analysis capability
Where VMRay runs is your decision, and it does not cost you capability. Feature parity is maintained across deployment models wherever technically applicable.
VMRay Cloud
Instant to deploy, always current.
European Sovereign Cloud
Hosted in Germany, governed by EU law.
On-premises
Full control of your own infrastructure.
Air-gapped
Maximum isolation, no connection required.
Same analysis. Same accuracy. Wherever you run it.For cloud deployments, you select the hosting region and the retention period that applies to the data you hold on behalf of your clients.
What this looks like in the product
One analysis, six views. Move through the tabs to follow a single sample from verdict to extracted configuration.
Click any tab to move through the analysisMALICIOUSDynamic Analysis ReportXjgkkltfdhdfhfjg.exeWindows Exe (x86-32)Remarks (1 / 1)Anti-Sleep Triggered (0x0200000E) — the overall sleep time of all monitored processes was truncated from 43 s to 10 s to reveal dormant functionality.VMRay Threat Identifiers 19 rules · 72 matchesScoreCategoryOperationCount5 / 5 Extracted Configuration Pikabot configuration was extracted 1A configuration for Pikabot was extracted from artifacts of the dynamic analysis.VMRay Threat Identifiers 19 rules · 72 matches Behaviour scoredScoreCategoryOperationCount1 / 5Discovery Enumerates running processes15 / 5Extracted Configuration Pikabot configuration was extracted1A configuration for Pikabot was extracted from artifacts of the dynamic analysisC2 recovered T1027 · Obfuscated Files or Information2 / 5Persistence Hides a known RMM tool11 / 5Defense Evasion Masquerades process name21 / 5Collection Reads clipboard contents10 / 5Execution Spawns child process3MITRE ATT&CK MatrixWindowsTechniques observed during dynamic analysis, mapped to tactics.Initial
AccessExecutionPersistencePrivilege
EscalationDefense
EvasionCredential
AccessDiscoveryLateral
MovementWindows Management InstrumentationScheduled TaskScheduled TaskRegistry Run Keys / Startup FolderScheduled TaskModify RegistryDisabling Security ToolsHidden WindowCredentials in FilesSystem Information DiscoverySecurity Software DiscoveryFile and Directory DiscoveryRemote File CopyHigh severity Medium Low 13 techniques · 8 tacticsGeneral168.55 KBsent,18.16 MBreceived6ports23817, 23759, 80, 53, 44325contacted IP addresses11files downloaded1malicious host detectedDNS22queries for22domains7queries returned errorsHTTP / S19URLs,13contacted servers26sessions detectedContacted infrastructure (25 IP addresses)DEGermany9USUnited States6FIFinland3CZCzechia2HUHungary2NLNetherlands2SGSingapore131 HostsRequestsSeverity185.215.113.44🇩🇪:2375965.108.69.168🇫🇮:16278185.215.113.35🇩🇪:80msdl.microsoft.com🇺🇸:443server5.trumops.com🇺🇸:443212.192.241.62🇨🇿:80iplogger.org🇺🇸:44391.219.236.207🇭🇺:80TCP Sessions (11)TLSSrc IPSrc PortDest IPDest Port✕192.168.0.3349865185.215.113.4423759✕192.168.0.3349452185.215.113.4423759✕192.168.0.3349360185.215.113.4423759✕192.168.0.3349758185.215.113.4423759✕192.168.0.3349551185.215.113.4423759✕192.168.0.3349649185.215.113.4423759Filter 93 other artifactsALL TYPES70FILE1URL64IP2PROCESS3TypeValueFileC:\Users\RDHJ0C~1\Desktop\5Dq6sWcmD.dll.ocx+2IP104.168.155.143IP167.172.248.70URLhttps://197.242.150.244:8080URLhttps://159.89.202.34URLhttps://206.189.28.199:8080URLhttps://45.235.8.30:8080URLhttps://201.94.166.162URLhttps://188.44.20.25URLhttps://183.111.227.137:8080DetailsRelated VTIs (1)URLhttps://197.242.150.244:8080Original URLshttps://197.242.150.244:8080CategoriesExtractedIP Addresses197.242.150.244User-Agents—5 / 5Malware ConfigurationA configuration for Pikabot was extracted from artifacts of the dynamic analysis.Extracted C2 commands recovered from memorystd::string::assign(&v45, "shi", 3ui64);
*(_QWORD *)sub_1800149DC((__int64 *)v61, (__int64)&v45) = func_shi;
// …
std::string::assign(&v45, "dij", 3ui64);
*(_QWORD *)sub_180014ADC((__int64 *)v61, (__int64)&v45) = func_dij;
// …
std::string::assign(&v45, "dex", 3ui64);
*(_QWORD *)sub_180014BDC((__int64 *)v61, (__int64)&v45) = func_dex;
// …
std::string::assign(&v45, "sdl", 3ui64);
*(_QWORD *)sub_180014CDC((__int64 *)v61, (__int64)&v45) = func_sdl;Extracted configuration Pikabot configuration was extracted Go to memory dumpIntegrations with your platform and your clients’ stacks
VMRay connects into the tools you already run and the systems your clients depend on. Verdicts and indicators move into EDR, SIEM, SOAR, and threat intelligence platforms through native connectors or the REST API, and into your own pipelines and client-facing feeds through STIX and TAXII.
Our intelligence is our most valuable asset, so it has to stay ours. Running VMRay on-premises gives us full control of our data with no loss of capability, and we always understand why a sample was flagged.
Head of Cyber Threat Intelligence
National cybersecurity providerAdditional resources
See VMRay on a threat from your environment
Submit a sample and see the verdict, the behavior, and the indicators returned.
