VIRTUALGATE
Description
(Mandiant) The Windows guest virtual machines which were hosted by the infected hypervisors also contained a unique malware sample located at C:\Windows\Temp\avp.exe. This malware, which we refer to as VIRTUALGATE, is a utility program written in C that is comprised of two (2) parts, a dropper, and the payload. The memory only dropper deobfuscates a second stage DLL payload that uses VMware’s virtual machine communication interface (VMCI) sockets to run commands on a guest virtual machine from a hypervisor host, or between guest virtual machines on the same host.
Names
| Name |
|---|
| VIRTUALGATE |
Category
Malware
Type
- Dropper
Information
Malpedia
Other Information
Uuid
bab2da7c-d096-486f-acb5-a7bae7d53afc
Last Card Change
2024-08-27