Malware and phishing analysis for government and military, deployed on your terms.
The most targeted threats, under the tightest constraints on how you operate. Accurate verdicts your automation can act on, behavioral depth when you need it, and a deployment model that meets your obligations.
100+ Government organizations worldwide trust VMRay toCreate their own threat intelligence
Empower reliable security automation
Accelerate incident response
What makes public sector defense different
Three conditions change what an analysis layer has to do.
SCALEAlert volume beyond what manual review can absorb
CONSEQUENCEA missed detection carries consequences beyond the organization
REGULATIONRegulation decides where analysis may run
What VMRay provides public sector teams
Accurate enough to automate on, deep enough to build intelligence from, available where your obligations require.
01 / AUTOMATION Verdicts your automation can act on
Automation is only as reliable as the analysis feeding it. False positives put a human back in every loop.
- Definitive verdicts: malicious, suspicious, or benign
- Scored IOCs structured for automated use
- Native integrations and REST API into EDR, SIEM, SOAR, and TIP
- Recursive analysis of the full delivery chain, not only the submitted file
02 / THREAT INTELLIGENCE Intelligence built on the threats aimed at you
Public sector organizations are targeted specifically. Intelligence should reflect the threats actually arriving, not the landscape in general.
- Malware configuration extraction: C2 servers, encryption keys, campaign identifiers
- MITRE ATT&CK TTP mapping
- STIX 2.1-ready output for sharing and correlation
- YARA rules generated from observed behavior
03 / DEPLOYMENT Four deployment models, one analysis capability
Where VMRay runs is your decision, and it does not cost you capability. Feature parity is maintained across deployment models wherever technically applicable.
- VMRay Cloud: instant to deploy, always current
- European Sovereign Cloud: hosted in Germany, EU law
- On-premises: full control of your infrastructure
- Air-gapped: maximum isolation, no connection required
Same analysis. Same accuracy. Wherever you run it.Deployment options feature briefFIG 1 / SIGNAL · CONTEXT · DEPLOYMENTHow analysis fits into the flow
Samples arrive from across the stack. Verdicts and indicators return to every system that needs them.
How public sector teams are using VMRay
Three organizations, three starting points. Automation at scale, threat intelligence development, and analysis depth for a lean team.
FEATURED CUSTOMER STORYBuilding in-house threat intelligence at an intra-governmental organization
The team wanted independence from generic external feeds, and intelligence specific to the actors targeting them. Behavioral analysis gave them indicators they could verify, configurations they could attribute, and findings in a vocabulary their peer CERTs already shared.
- High-confidence indicators extracted from observed behavior
- Malware configuration extraction revealing C2 infrastructure
- ATT&CK-mapped findings shared with peer CERTs
VMRay’s analysis, known for its reliability and precision, has become the cornerstone of our robust security posture, enabling us to build actionable threat intelligence against the specific threats we face.
Head of Computer Security & Incident Response Capability
European Intra-Governmental OrganizationCUSTOMER STORYScaling automated defense across a 100,000-staff government department
An automation pipeline spanning EDR, SOAR, and TIP, fed by an analysis engine that took manual review back out of the loop.
Read the full storyCUSTOMER STORYRaising analysis depth at a major North American city administration
Depth and clarity of output for a small team, without adding review overhead.
Download full storyWhat this looks like in the product
One analysis, six views. Move through the tabs to follow a single sample from verdict to extracted configuration.
Click any tab to move through the analysisMALICIOUSDynamic Analysis ReportXjgkkltfdhdfhfjg.exeWindows Exe (x86-32)Remarks (1 / 1)Anti-Sleep Triggered (0x0200000E) — the overall sleep time of all monitored processes was truncated from 43 s to 10 s to reveal dormant functionality.VMRay Threat Identifiers 19 rules · 72 matchesScoreCategoryOperationCount5 / 5 Extracted Configuration Pikabot configuration was extracted 1A configuration for Pikabot was extracted from artifacts of the dynamic analysis.VMRay Threat Identifiers 19 rules · 72 matches Behaviour scoredScoreCategoryOperationCount1 / 5Discovery Enumerates running processes15 / 5Extracted Configuration Pikabot configuration was extracted1A configuration for Pikabot was extracted from artifacts of the dynamic analysisC2 recovered T1027 · Obfuscated Files or Information2 / 5Persistence Hides a known RMM tool11 / 5Defense Evasion Masquerades process name21 / 5Collection Reads clipboard contents10 / 5Execution Spawns child process3MITRE ATT&CK MatrixWindowsTechniques observed during dynamic analysis, mapped to tactics.Initial
AccessExecutionPersistencePrivilege
EscalationDefense
EvasionCredential
AccessDiscoveryLateral
MovementWindows Management InstrumentationScheduled TaskScheduled TaskRegistry Run Keys / Startup FolderScheduled TaskModify RegistryDisabling Security ToolsHidden WindowCredentials in FilesSystem Information DiscoverySecurity Software DiscoveryFile and Directory DiscoveryRemote File CopyHigh severity Medium Low 13 techniques · 8 tacticsGeneral168.55 KBsent,18.16 MBreceived6ports23817, 23759, 80, 53, 44325contacted IP addresses11files downloaded1malicious host detectedDNS22queries for22domains7queries returned errorsHTTP / S19URLs,13contacted servers26sessions detectedContacted infrastructure (25 IP addresses)DEGermany9USUnited States6FIFinland3CZCzechia2HUHungary2NLNetherlands2SGSingapore131 HostsRequestsSeverity185.215.113.44🇩🇪:2375965.108.69.168🇫🇮:16278185.215.113.35🇩🇪:80msdl.microsoft.com🇺🇸:443server5.trumops.com🇺🇸:443212.192.241.62🇨🇿:80iplogger.org🇺🇸:44391.219.236.207🇭🇺:80TCP Sessions (11)TLSSrc IPSrc PortDest IPDest Port✕192.168.0.3349865185.215.113.4423759✕192.168.0.3349452185.215.113.4423759✕192.168.0.3349360185.215.113.4423759✕192.168.0.3349758185.215.113.4423759✕192.168.0.3349551185.215.113.4423759✕192.168.0.3349649185.215.113.4423759Filter 93 other artifactsALL TYPES70FILE1URL64IP2PROCESS3TypeValueFileC:\Users\RDHJ0C~1\Desktop\5Dq6sWcmD.dll.ocx+2IP104.168.155.143IP167.172.248.70URLhttps://197.242.150.244:8080URLhttps://159.89.202.34URLhttps://206.189.28.199:8080URLhttps://45.235.8.30:8080URLhttps://201.94.166.162URLhttps://188.44.20.25URLhttps://183.111.227.137:8080DetailsRelated VTIs (1)URLhttps://197.242.150.244:8080Original URLshttps://197.242.150.244:8080CategoriesExtractedIP Addresses197.242.150.244User-Agents—5 / 5Malware ConfigurationA configuration for Pikabot was extracted from artifacts of the dynamic analysis.Extracted C2 commands recovered from memorystd::string::assign(&v45, "shi", 3ui64);
*(_QWORD *)sub_1800149DC((__int64 *)v61, (__int64)&v45) = func_shi;
// …
std::string::assign(&v45, "dij", 3ui64);
*(_QWORD *)sub_180014ADC((__int64 *)v61, (__int64)&v45) = func_dij;
// …
std::string::assign(&v45, "dex", 3ui64);
*(_QWORD *)sub_180014BDC((__int64 *)v61, (__int64)&v45) = func_dex;
// …
std::string::assign(&v45, "sdl", 3ui64);
*(_QWORD *)sub_180014CDC((__int64 *)v61, (__int64)&v45) = func_sdl;Extracted configuration Pikabot configuration was extracted Go to memory dumpIntegrations with your existing security stack
VMRay connects into the tools your team already runs. Verdicts and indicators move into EDR, SIEM, SOAR, and threat intelligence platforms through native connectors or the REST API, without manual handoff between consoles.
VMRay's ability to generate reliable IOCs, extract malware configurations and map the output on the MITRE ATT&CK framework support seamless collaboration and threat intelligence sharing among government CERTs.
Security Analyst
GovCERT in EuropeAdditional resources
See VMRay on a threat from your environment
Submit a sample and see the verdict, the behavior, and the indicators returned.
