VMRay Pricing
Try VMRay 
Malware and phishing analysis for healthcare and life sciences.
Care cannot pause for an investigation, and the systems most at risk are often the ones you cannot patch or put an agent on. Accurate verdicts your playbooks can act on, an analysis layer that works independently of the endpoint, and depth to hunt for what has not alerted yet.
  Request free trial    Read the technical case study  
 100+ Healthcare and life sciences organizations worldwide trust VMRay to
Automate alert triage and response
Catch what endpoint tooling misses
Hunt for what has not alerted yet
 01 / CONTEXT
What makes healthcare defense different
Healthcare is the most targeted sector for ransomware, and the average breach takes months to identify. Three conditions change what an analysis layer has to do.
 CONTINUITY
Downtime is measured in delayed care
 COVERAGE
Systems that cannot take an agent or a patch are still on the network
 VALUE
Patient records and research IP are both targeted, and both leave
 02 / CAPABILITIES
What VMRay provides healthcare security teams
Three capabilities behind the three outcomes above.
 
 01 / AUTOMATION
Verdicts your playbooks can act on
A playbook can retrieve a file, submit it, and act on the answer without a human in the middle, but only if the answer is right. Accurate verdicts are what let a case close automatically instead of joining the queue.
  • Definitive verdicts: malicious, suspicious, or benign
  • Submissions tagged to your case ID for end-to-end traceability
  • Alerts when a verdict is reclassified after deeper analysis
  • Native integrations and REST API into EDR, SIEM, SOAR, and TIP
 
 
 02 / DEFENSE IN DEPTH
Analysis that catches what endpoint tooling misses
Endpoint tools cover a great deal, and they are not foolproof. In an estate that includes connected clinical devices that cannot be patched or agented, an independent layer that observes what a file actually does is not redundancy. It is coverage.
  • Hypervisor-based analysis that malware cannot detect
  • Behavior observed rather than inferred from signature or reputation
  • Full execution chain, including multi-stage delivery
  • Verdict transparency: the specific factors behind every decision
 
 
 03 / THREAT HUNTING
Depth to find what has not alerted yet
Attackers stage quietly before they act. Files written to public folders, drivers dropped into system directories, executables run out of archives or mounted media. Hunting those behaviors means analyzing samples that nothing has flagged.
  • Malware configuration extraction: C2 addresses, campaign identifiers
  • MITRE ATT&CK TTP mapping against your detection coverage
  • High-confidence IOCs for retrospective hunting across the estate
  • STIX 2.1-ready output for correlation and sharing
 
 FIG 1 / SIGNAL · VERDICT · DEPTH                VERDICT      BEHAVIORAL DETAIL                
 03 / THE FLOW
How analysis fits into the flow
Samples arrive from across the stack. Verdicts and indicators return to every system that needs them.
      INPUTS  Files & executables  Emails & URLs  Alerts EDR / SOAR        VMRay Platform Accuracy & clarity          SOC  EDR ALERT ENRICHMENT  MALWARE TRIAGE  SOAR ALERT INVESTIGATION  PHISHING TRIAGE  USER-REPORTED PHISHING   CTI  THREAT INTELLIGENCE GENERATION  THREAT HUNTING   CERT  INCIDENT RESPONSE  MALWARE ANALYSIS
 04 / CUSTOMER STORIES
How a healthcare security team uses VMRay
A top three US healthcare provider automated file threat hunting end to end, with no manual submission step.
 FEATURED CUSTOMER STORY
How a top three US healthcare provider automated file threat hunting
     SIEM DETECTION FILE CREATED IN STAGING PATH SOAR PLAYBOOK FILE RETRIEVED FROM ENDPOINT VMRAY ANALYSIS DETONATED, BEHAVIOR OBSERVED VERDICT TAGGED TO CASE ID         CLOSE THE CASE ESCALATE QUARANTINE HOST BLOCK HASH, REMOVE FILE
FIG / DETECTION TO RESPONSE, WITHOUT A MANUAL STEP
The team wanted to catch files staged in locations attackers favor, before anything executed. A SIEM rule watches for suspicious file types created under the public user profile. When it fires, a SOAR playbook checks the host, retrieves the file from the endpoint, and submits it to VMRay. The verdict then drives the response programmatically, which keeps analysts out of the loop on cases that resolve themselves.
 Read the technical case study 
  • Detection, retrieval, analysis, and response with no manual submission step
  • Every submission tagged to the SOAR case ID for traceability
  • Email alerts when a file is reclassified as malicious after deeper analysis
The automated integration with tools like VMRay and the SOAR platform allows for fast and efficient triage, investigation, and response, ensuring that suspicious file activity is promptly handled and mitigated before it can cause harm.
Security team
Top three US healthcare provider
 05 / DEPLOYMENT
Four deployment models, one analysis capability
Where VMRay runs is your decision, and it does not cost you capability. Feature parity is maintained across deployment models wherever technically applicable.
VMRay Cloud
Instant to deploy, always current.
European Sovereign Cloud
Hosted in Germany, governed by EU law.
On-premises
Full control of your own infrastructure.
Air-gapped
Maximum isolation, no connection required.
Same analysis. Same accuracy. Wherever you run it.
For cloud deployments, you select the hosting region and the retention period that applies to your data.
 06 / IN THE PRODUCT
What this looks like in the product
One analysis, six views. Move through the tabs to follow a single sample from verdict to extracted configuration.
      
  Click any tab to move through the analysis 
 VMRay Platform Verdict
      
  MALICIOUS
Classifications
Injector  Downloader
Threat names
Mal/HTMLGen-A  Mal/Generic-S  Pikabot
  Dynamic Analysis Report 
Xjgkkltfdhdfhfjg.exe
Created last month
Windows Exe (x86-32)
Remarks (1 / 1)
 
Anti-Sleep Triggered (0x0200000E) — the overall sleep time of all monitored processes was truncated from 43 s to 10 s to reveal dormant functionality.
 VMRay Threat Identifiers 19 rules · 72 matches
ScoreCategoryOperationCount
  5 / 5 Extracted Configuration Pikabot configuration was extracted 1
  A configuration for Pikabot was extracted from artifacts of the dynamic analysis.
 VMRay Platform Threat Identifiers
      
 VMRay Threat Identifiers 19 rules · 72 matches Behaviour scored
ScoreCategoryOperationCount
  1 / 5Discovery Enumerates running processes1
  5 / 5Extracted Configuration Pikabot configuration was extracted1
  A configuration for Pikabot was extracted from artifacts of the dynamic analysisC2 recovered T1027 · Obfuscated Files or Information
  2 / 5Persistence Hides a known RMM tool1
  1 / 5Defense Evasion Masquerades process name2
  1 / 5Collection Reads clipboard contents1
  0 / 5Execution Spawns child process3
 VMRay Platform MITRE ATT&CK Matrix
      
MITRE ATT&CK MatrixWindows
Techniques observed during dynamic analysis, mapped to tactics.
Initial
Access
Execution
Persistence
Privilege
Escalation
Defense
Evasion
Credential
Access
Discovery
Lateral
Movement
Windows Management Instrumentation
Scheduled Task
Scheduled Task
Registry Run Keys / Startup Folder
Scheduled Task
Modify Registry
Disabling Security Tools
Hidden Window
Credentials in Files
System Information Discovery
Security Software Discovery
File and Directory Discovery
Remote File Copy
 High severity Medium Low 13 techniques · 8 tactics
 VMRay Platform Network Analysis
      
General
168.55 KBsent,18.16 MBreceived
6ports23817, 23759, 80, 53, 443
25contacted IP addresses
11files downloaded
1malicious host detected
DNS
22queries for22domains
7queries returned errors
HTTP / S
19URLs,13contacted servers
26sessions detected
Contacted infrastructure (25 IP addresses)
DEGermany9
USUnited States6
FIFinland3
CZCzechia2
HUHungary2
NLNetherlands2
SGSingapore1
31 Hosts
RequestsSeverity
185.215.113.44
🇩🇪:23759
65.108.69.168
🇫🇮:16278
185.215.113.35
🇩🇪:80
msdl.microsoft.com
🇺🇸:443
server5.trumops.com
🇺🇸:443
212.192.241.62
🇨🇿:80
iplogger.org
🇺🇸:443
91.219.236.207
🇭🇺:80
TCP Sessions (11)
TLSSrc IPSrc PortDest IPDest Port
✕192.168.0.3349865185.215.113.4423759
✕192.168.0.3349452185.215.113.4423759
✕192.168.0.3349360185.215.113.4423759
✕192.168.0.3349758185.215.113.4423759
✕192.168.0.3349551185.215.113.4423759
✕192.168.0.3349649185.215.113.4423759
 VMRay Platform Artifacts & IOCs
      
Filter 93 other artifacts
ALL TYPES70
FILE1
URL64
IP2
PROCESS3
Search artifacts
Verdict
TypeValue
FileC:\Users\RDHJ0C~1\Desktop\5Dq6sWcmD.dll.ocx+2
IP104.168.155.143
IP167.172.248.70
URLhttps://197.242.150.244:8080
URLhttps://159.89.202.34
URLhttps://206.189.28.199:8080
URLhttps://45.235.8.30:8080
URLhttps://201.94.166.162
URLhttps://188.44.20.25
URLhttps://183.111.227.137:8080
Details
Related VTIs (1)
URLhttps://197.242.150.244:8080
Original URLshttps://197.242.150.244:8080
CategoriesExtracted
IP Addresses197.242.150.244
User-Agents—
 VMRay Platform Malware Configuration
      
5 / 5Malware Configuration
A configuration for Pikabot was extracted from artifacts of the dynamic analysis.
Sample file
File name
5Dq6sWcmD.dll.ocx
File size
548.00 KB
MIME type
application/vnd.microsoft.
portable-executable
MD5
b232b0df5d369ef0f7597f215c32043a
SHA1
4a4b865f1243ea1983044337500448e38557af0
SHA256
19fcf233637e0ca65c4eef3b234d3c79ad
1604b524da1b1f292cf7e7dcaf13aa
ImpHash
089cd79cc1eaac3fa7d34f758db58a4a
 Extracted C2 commands recovered from memory
std::string::assign(&v45, "shi", 3ui64);
*(_QWORD *)sub_1800149DC((__int64 *)v61, (__int64)&v45) = func_shi;
// …
std::string::assign(&v45, "dij", 3ui64);
*(_QWORD *)sub_180014ADC((__int64 *)v61, (__int64)&v45) = func_dij;
// …
std::string::assign(&v45, "dex", 3ui64);
*(_QWORD *)sub_180014BDC((__int64 *)v61, (__int64)&v45) = func_dex;
// …
std::string::assign(&v45, "sdl", 3ui64);
*(_QWORD *)sub_180014CDC((__int64 *)v61, (__int64)&v45) = func_sdl;
 Extracted configuration Pikabot configuration was extracted Go to memory dump
      
      
 GET STARTED
See VMRay on a threat from your environment
Submit a sample and see the verdict, the behavior, and the indicators returned.