Scenario: Abnormal network traffic was detected across multiple workstations at GlobalTech
Industries, with employee search queries silently redirected to unfamiliar sites. Given only a malware hash, the
task is to pivot entirely through open threat intelligence — VirusTotal and Red Canary's public research — to
identify the malware family, its file artifacts, its compilation and detection timeline, and its full C2
infrastructure.
Q1What is the name of the malware family that causes abnormal network traffic?
Pivoting on the provided hash in VirusTotal's Relations → Graph Summary surfaces a linked OTX pulse — "How to Detect Yellow Cockatoo Remote Access Trojan" — confirming the family directly, along with its associated ATT&CK techniques (T1059 PowerShell/CMD execution, T1140 deobfuscation, T1547.009 shortcut modification, T1218.005 Mshta, T1055.001 DLL injection).
answerYellow Cockatoo RAT
Q2What is the common filename associated with the malware discovered on our workstations?
VirusTotal's file version information shows the sample is unsigned, with its Original/Internal Name both set to a GUID-style filename — a common Yellow Cockatoo trait used to blend in among legitimate-looking DLLs dropped in temp/app-data directories.
answer111bc461-1ca8-43c6-97ed-911e0e69fdf8.dll
Q3What is the compilation timestamp of the malware that infected our network?
The Portable Executable header's Compilation Timestamp gives a hard lower bound on when this specific build was created — useful for correlating against other campaigns using the same or nearby build times.
answer2020-09-24 18:26
Q4When was the malware first submitted to VirusTotal?
VT's History panel separates Creation Time, First Seen In The Wild, and First Submission — the first submission date shows roughly three weeks passed between compilation and this sample first reaching public threat intel, a useful dwell-time indicator.
answer2020-10-15 02:47
Q5What is the name of the .dat file that the malware dropped in the AppData folder?
Red Canary's own writeup on Yellow Cockatoo (linked from the OTX pulse) documents its C2-related behavior directly: it loads a randomly-generated identifier string into
%USERPROFILE%\AppData\Roaming\solarmarker.dat, which serves as a persistent unique ID for the infected host across C2 check-ins.answersolarmarker.dat
Q6What is the C2 server that the malware is communicating with?
The same Red Canary reference documents the next step in the chain immediately below the
.dat detail: the malware connects to https://gogohid[.]com/gate?q=ENCODED_HOST_INFO, sharing the collected host information and retrieving its first command in what becomes an infinite command-fetch loop.answerhttps://gogohid.com
IOC Summary
| Item | Value |
|---|---|
| Malware Family | Yellow Cockatoo RAT (Jupyter Infostealer/Backdoor) |
| Sample Hash (SHA1) | 30e527e45f50d2ba82865c5679a6fa998ee0a1755361ab01673950810d071c85 |
| Dropped Filename | 111bc461-1ca8-43c6-97ed-911e0e69fdf8.dll |
| Compilation Timestamp | 2020-09-24 18:26 UTC |
| First VT Submission | 2020-10-15 02:47 UTC |
| Persistence Artifact | %USERPROFILE%\AppData\Roaming\solarmarker.dat |
| C2 Domain | gogohid.com |
| C2 Endpoint | /gate?q=ENCODED_HOST_INFO |
Lessons learned: A single hash is often enough to reconstruct an entire campaign without ever
touching the sample directly — VirusTotal's Relations/Graph view surfaces linked open-source research, and following
that research (here, Red Canary's own public writeup) fills in exactly the C2 and persistence details a sandbox
report alone might not spell out as clearly. Randomly-named DLLs dropped under AppData with no code signing are a
cheap but persistently effective evasion move; file-integrity monitoring on user-writable AppData paths for newly
created, unsigned DLLs is a reasonable general detection to pair with this specific IOC set. Comparing compilation
timestamp against first-seen-in-the-wild and first-VT-submission dates is a quick, repeatable way to estimate how
long a given build had already been circulating before the security community caught up to it.