A backdoor also known as: Ransomware.Weelsof.C5 Trojan/Weelsof.b Trojan.Symmi.D1959 Ransom_Weelsof.R002C0CAD18 Win32.Trojan.Kryptik.tx W32/Trojan2.NUBG Win32/Weelsof.BC Ransom_Weelsof.R002C0CAD18 Trojan.Win32.Weelsof.bbkjex Trojan.Win32.Z.Weelsof.116224 Trojan.Winlock.6870 Trojan.Weelsof.Win32.258 W32/Trojan.ECLA-1171 Trojan/Weelsof.ok TR/Weelsof.wm Trojan/Win32.Weelsof Ransom:Win32/Weelsof.C Trojan/Win32.Weelsof.C408750 Trj/CI.A Trojan.Weelsof.B Win32/Weelsof.B Win32.Trojan.Weelsof.cuoj Trojan.Weelsof!AcPYBHX50TA Win32/Trojan.Ransom.434


A backdoor also known as: Backdoor/W32.Protux.61400 Backdoor.Protux Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan BKDR_PROTUX.SMZKEB-A Win.Trojan.Protux-22 Trojan.Win32.Protux.illnz TrojWare.Win32.TrojanDownloader.JMXQ.~0 BackDoor.Diho.190 Backdoor.Protux.Win32.108 BKDR_PROTUX.SMZKEB-A Backdoor.Win32.Protux Backdoor/Protux.dj Trojan:Win32/Dingu.A Trojan[Backdoor]/Win32.Protux Trojan.Heur.E43D7C Backdoor:Win32/Protux.B!dll Trojan/Win32.Xema.R89528 Backdoor.Protux Trj/Protux.C Win32/Protux.NAF Win32.Backdoor.Protux.Pfsy Backdoor.Protux!S6uzS9ogTK0 W32/Protux.KJ!tr.bdr


These malicious apps are distributed via SEO-optimized fake websites, with keywords targeting hot scandals and affairs used.


Earlier this year, the Andromeda botnet was seen using macro-based malware, which is yet again an old trick.


First observed as early as 2004, NetTraveler is a Trojan used widely in targeted attacks.


A backdoor also known as: W32.FamVT.QqpaNHm.Trojan Backdoor.Hupigon.275309 Trojan.Danginex.A2 Backdoor.Hupigon.275309 Backdoor/Hupigon.pgzz Backdoor.Hupigon.D4336D Win32.Trojan.FakeIME.d Win32/Oflwr.A!crypt Backdoor.Hupigon.275309 Trojan.Win32.Hupigon.chvyyc Backdoor.Hupigon.275309 Backdoor.Hupigon.275309 BackDoor.BlackHole.19996 Backdoor.Hupigon.Win32.133590 Backdoor.Win32.Hupigon TR/Orsam.A.7773 Trojan[Backdoor]/Win32.Hupigon Unwanted/Win32.HackTool.R19815 Backdoor.Hupigon Trojan.Offend!DNC2JYmeA/w


A backdoor also known as: Trojan.Tinba.19899 W32/Trojan.WNMW-0038 TROJ_MALKRYP.SM7 Trojan.Win32.Androm.dqyyyn Trojan.PWS.Tinba.161 Trojan.Zbot.Win32.178596 TROJ_MALKRYP.SM7 BehavesLike.Win32.PWSZbot.dc Trojan/PSW.Tepfer.ccuq TR/Bunitu.A.194 Trojan.Graftor.D2D2CC TrojanDownloader:Win32/Tonnejoom.A Trojan/Win32.ZBot.R141968 Trojan.ProxyChanger!r8e5ImNFSC4 Trojan.Win32.Injector W32/Injector.BZCD!tr Trojan.ProxyChanger


During the month of November, Proofpoint observed multiple campaigns from TA530 - an actor we have previously referred to as the personalized actor for their highly personalized campaigns - targeting customer service and managerial staff at retailers.


EternalRocks is a network worm i.e. self-replicating, emerged in first half of May 2017.


We'll discuss how we discovered it, as well as possible attribution towards the individual behind these attacks.


The attack used highly targeted malicious software to destroy the TV network systems.


Proofpoint researchers recently observed a campaign targeting telecom and military in Russia.


A backdoor also known as: Trojan-PWS/W32.WebGame.65536.HV TrojanDownloader.Kolilks.B5 Trojan/Scar.cavw Trojan.Graftor.Elzob.D3707 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Dropper Win32/SillyDl.HER TROJ_DLOADE.SMEP Trojan.Win32.Scar.bxwdr Trojan.DownLoad1.2460 TROJ_DLOADE.SMEP W32.Malware.Downloader Trojan/Win32.Scar TrojanDownloader:Win32/Kolilks.B Trojan.Win32.A.Scar.48640.J Trojan/Win32.Scar.R4127 TrojanDownloader.BHO Worm.Win32.Kolios.a Trojan-Downloader.Win32.Kolilks W32/Mdrop.EB!tr


Stealing FTP credentials and browser cookies


In this campaign, a PDF file with an embedded javascript is used to download the payload from a Google Drive shared link.


With the new architecture, PluginPhantom achieves more flexibility to update its modules without reinstalling apps.


A backdoor also known as: Pwstool.Netpass Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32.Riskware.WebBrowserPassView.A Riskware.Win32.PassView.eqrnrb Tool.PassView.1871 BehavesLike.Win32.Dropper.gc PSWTool.NetPass.gh RiskWare[PSWTool]/Win32.NetPass PUP.Optional.PasswordViewer Riskware.PSWTool! Win32/Virus.PSW.a52


A backdoor also known as: W32.OnGameERALV.Trojan Trojan/W32.Loader.36932 Trojan.Win32.Loader!O Trojan.Myma.A3 Trojan.Loader.Win32.2 Troj.W32.Loader.c!c Trojan/Loader.c Trojan.Graftor.D51D2 Win32.Trojan.Loader.b Backdoor.Trojan Win32/Loader.B TROJ_LOADER.SMIA Win.Trojan.Starter-291 Trojan.Win32.Loader.c Trojan.Win32.Loader.bwzwn Trojan.Win32.A.Loader.36864 Trojan.Loader.575 TROJ_LOADER.SMIA Trojan/Loader.b Backdoor.Trojan TR/Loader.C Trojan/Win32.Loader Trojan:Win32/Loader.WOD Trojan.Win32.Loader.c Trojan/Win32.Loader.R4213 Trojan.Loader Trj/Loader.B Trojan.Win32.Loader.cc Trojan.Loader!V/30nEGDEMU Trojan.Win32.LOADER W32/LOADER.C!tr Trojan.PSW.Win32.QQPass.D


This app carries a number of the capabilities : Upload GSM , WhatsApp , Telegram , Facebook , and Threema messages Upload voice notes , contacts stored , accounts , call logs , location information , and images Upload the expanded list of collected device information ( e.g. , IMEI , product , board , manufacturer , tag , host , Android version , application version , name , model brand , user , serial , hardware , bootloader , and device ID ) Upload SIM information ( e.g. , IMSI , operator code , country , MCC-mobile country , SIM serial , operator name , and mobile number ) Upload wifi information ( e.g. , SSID , wifi speed , and MAC address ) Upload other information ( e.g. , display , date , time , fingerprint , created at , and updated at ) The app is capable of stealing messages from popular messaging apps by abusing the notification permissions to read the notification content and saving it to the database .


A backdoor also known as: TROJ_FAM_00005ae.TOMA Win32.Trojan-Downloader.Small.bh W32/Downldr2.GMBK TROJ_FAM_00005ae.TOMA Win.Downloader.77716-1 Trojan.Win32.DownLoad.cvxyj Trojan.DownLoad.50492 Backdoor.CPEX.Win32.14166 W32/Downloader.FCDJ-0388


A backdoor also known as: Trojan/W32.FraudPack.30252 Trojan.Win32.FraudPack!O TjnDownldr.Ladivyrop.S79502 Win32.Trojan.WisdomEyes.16070401.9500.9993 Trojan.Win32.FraudPack.aie Trojan.Win32.FraudPack.cysfht Trojan.FraudPack.Win32.31030 BehavesLike.Win32.Dropper.mc Trojan-Downloader.Win32.Adload Trojan/FraudPack.anzn Trojan.Kazy.D5D389 Trojan.Win32.FraudPack.aie TrojanDownloader:Win32/Ladivyrop.A Trojan.FraudPack Trojan.FraudPack!cVlSVwD6LBI


A backdoor also known as: HW32.Packed.F2DC Trojan.JS.StartPage!O Win32.Trojan.WisdomEyes.16070401.9500.9691 W32/Meredrop.MBVJ-0788 HV_STARTPAGE_CA223323.TOMC Trojan.JS.StartPage.dv Trojan.JS.StartPage.dv Trojan.Script.Ocyt.cqtcgb Trojan.StartPage.35625 Trojan.Win32.Meredrop BehavesLike.Win32.RansomTescrypt.nc Trojan.JS.IEstart W32/Meredrop.DRO Trojan/JS.te W32.Trojan.Meredrop Win32.Troj.Undef.kcloud Trojan:JS/Ociyota.A Trojan.JS.StartPage.dv Trojan/Win32.StartPage.C53044 Trojan.Win32.Meredrop Trojan.Meredrop!IA1ZWY8Gf9I W32/StartPage.IMA!tr


A backdoor also known as: W32.BlackEnergy.Trojan Trojan/W32.Small.27648.MW Trojan.Win32.Jorik.Tedroo!O Trojan.Mauvaise.SL1 Win32.Trojan.BlackEnergy.b Backdoor.Win32.BlackEnergy.d Backdoor.Win32.A.Kbot.27648.B TrojWare.Win32.Rootkit.BlackEnergy.AC Trojan-Downloader.Win32.Phdet Backdoor/Kbot.ara Trojan[Backdoor]/Win32.Kbot TrojanDownloader:Win32/Phdet.E Backdoor.Win32.BlackEnergy.d Backdoor/Win32.Kbot.R47968 Backdoor.BlackEnergy Backdoor.Kbot!JCoulsYcyBQ W32/BlackEnergy.AC!tr


Several papers have been published about the group's operations, but until the Epic Turla research was published by Kaspersky Lab, little information was available about the more unusual aspects of their operations, such as the first stages of infection through watering-hole attacks.


A backdoor also known as: W32.Clodfcc.Trojan.046a TrojanDownloader.Halocy Win32.Trojan.WisdomEyes.16070401.9500.9785 Trojan.Win32.Palibu.ekyevo Troj.Banker.W32.Palibu!c BehavesLike.Win32.Dropper.vh W32/Trojan.JGOQ-7647 TR/Spy.Banker.ysyj W32/Delf.BUL!tr.dldr TrojanDownloader:Win32/Halocy.B!bit Trojan/Win32.Banload.C1318047 Trojan.DL.Delf!CR51fUDm05E Trojan.Spy.Banker Trj/CI.A Win32/Trojan.ca7


In this post, we are going to explain how Dridex gain persistence in the system and how Dridex performs AtomBombing in detail.


Two of these victims were under the protection of Managed Defense who identified and responded to the threat before significant impact occurred.


A backdoor also known as: TROJ_SAMSA.H Win32.Trojan.WisdomEyes.16070401.9500.9936 W32/Trojan.XHGP-7520 Win32/SillyDl.GBZ TROJ_SAMSA.H Win.Trojan.Inject-46 Trojan.Win32.Samsa.rznk Trojan.Win32.A.Samsa.53248 Troj.W32.Samsa.e!c Backdoor:W32/Enfal.K BackDoor.Mask Trojan-Ransom.SamSam W32/Trojan.BDWY Trojan/PSW.Almat.vn TR/Enfal.F Trojan/Win32.Enfal Win32.Troj.Samsa.d.kcloud Trojan.Symmi.D100E7 Trojan:Win32/Samsa.A Trojan.Win32.Samsa.aw Trj/Qhost.ER Win32.Trojan.Invader.Duml W32/Samsa.H!tr Win32/Trojan.e6d


A backdoor also known as: Trojan/Scar.dxkn Trojan.Win32.Scar.ecdkn Scar.HF TROJ_SCAR_000002b.TOMA Trojan.Win32.Scar.dxkn Trojan.Scar!44JrqMeLFEQ BackDoor.IRC.Bot.947 SPR/Tool.271360 TROJ_SCAR_000002b.TOMA Trojan/Scar.abjq Backdoor:Win32/ProxyBot.D Trojan/Win32.Scar Win32/CryptExe.A Trj/Scar.AL


In this blog, we will discuss how the TinyV Trojan spreads and how it works.


Akamai researchers on the Security Intelligence Response Team SIRT have discovered a new Go-based, DDoS-focused botnet.


By analyzing Trigona ransomware binaries and ransom notes obtained from VirusTotal, as well as information from Unit 42 incident response, we determined that Trigona was very active during December 2022, with at least 15 potential victims being compromised.


A backdoor also known as: W32.SayokaroiEA.Trojan Worm.Hilgild.A4 Troj.Banker.W32.Tinba.mAnM Trojan.Symmi.DB2FC W32.SillyFDC WORM_HILGIL.SMRP Trojan.Win32.Hesv.avgr Win32.Trojan.Hesv.Wwok TrojWare.Win32.Hilgild.AKO BackDoor.Nethief.310 WORM_HILGIL.SMRP Worm:Win32/Hilgild.A Trojan.Win32.Hesv.avgr Worm.Win32.Hilgild.A


A backdoor also known as: Trojan/W32.Deshacop.195072 Ransomware.ShinoLock.A3 Ransom.ShinoLocker.MSIL Trojan.Ransom.Shinolock.5 Ransom_SHINOLOCK.SMI0 Win32.Trojan.WisdomEyes.16070401.9500.9975 Ransom_SHINOLOCK.SMI0 Trojan.Win32.Ransom.195074 Trojan.DownLoader22.15733 Trojan.Win32.Filecoder Trojan.Deshacop.rk Ransom:MSIL/ShinoLock.A Trj/GdSda.A Trojan-Ransom.Win32.ShinoLocker.a Trojan.Deshacop!


The Dukes primarily target Western governments and related organizations, suchas government ministries and agencies, political think tanks, and governmental subcontractors.


Over the last few weeks, we collaborated with ClearSky and uncovered several indicators that were researched and found to be related to a new hacking campaign targeting large Vietnamese organisations.


The critically acclaimed show focuses on a fictional group of political hacktivists, and follows a young cybersecurity engineer called Elliot Alderson who suffers from social anxiety disorder and forms connections through hacking.


A backdoor also known as: Trojan.Sartmob.r3 Trojan.StartPage!bEEY6Bd79s4 Trojan.Zbot Trojan.MSIL.StartPage.az Trojan.Win32.StartPage.cvohfz Trojan.StartPage.61440 W32/Trojan.CBVH-4150 Trojan/MSIL.bjlms.aigeayx Trojan/MSIL.StartPage Trojan:MSIL/Sartmob.A Trojan.MSIL.StartPage Trj/CI.A MSIL/StartPage.AD Msil.Trojan.Startpage.Efus Trojan.MSIL2 W32/StartPage.AZ!tr MSIL2.BIFV Trojan.MSIL.StartPage.az Win32/Trojan.Dropper.a9c


Before connecting with the socket , it creates a malware environment in ‘ APPDATA/myupd ’ and creates a sqlite3 database there – ‘ myupd_tmp\\mng.db ’ : CREATE TABLE MANAGE ( ID INT PRIMARY KEY NOT NULL , Send INT NOT NULL , Keylogg INT NOT NULL , Screenshot INT NOT NULL , Audio INT NOT NULL ) ; INSERT INTO MANAGE ( ID , Send , Keylogg , Screenshot , Audio ) VALUES ( 1 , 1 , 1 , 1 , 0 ) Finally , the malware modifies the ‘ Software\Microsoft\Windows\CurrentVersion\Run ’ registry key to enable autostart of the main module .


A backdoor also known as: Heuristic_Anomaly.A TROJ_TRACUR.SMVD Trojan:Win32/Chroject.D!dll Trojan.Win32.Kryptik.bCOPL Trojan.Win32.Crypt W32/Kryptik.COPL!tr Crypt3.BBGH


The Linux VENOM rootkit is a two-component malicious software aimed at maintaining unauthorized access on compromised Linux systems.


This report describes the latest iteration in a long-running espionage campaign against the Tibetan community.


While we do not have detailed telemetry, we have reason to believe this attack targeted an individual at a public utilities company in the Middle East.


It is also a keylogger and can take screenshots.


Tordow 2.0 can make telephone calls, control SMS messages, download and install programs, steal login credentials, access contacts, encrypt files, visit webpages, manipulate banking data, remove security software, reboot a device, rename files, and act as ransomware.


The 3102 payload used in this attack also appears to be related to the Evilgrab payload delivered in the watering hole attack hosted on the President of Myanmar's website in May 2015.


Since August 1, Palo Alto Networks WildFire has captured over 18,000 Android apps that contain this library.


APT-C-61 Tengyun Snake organization is an APT organization mainly active in South Asia.


The attachment instead tries to download a template file over an SMB connection so that the user s credentials can be silently harvested.


A backdoor also known as: Backdoor.Dokstormac Trojan.Downloader Trojan.Injector.Win32.137915 Trojan/Injector.upj Backdoor.Arcomrat TSPY_DOKSTORMAC_BK220249.TOMC Win.Trojan.7639863-1 Trojan.Win32.Pakes.vtl Trojan.Win32.Pakes.bbujhs BackDoor.Minirat TSPY_DOKSTORMAC_BK220249.TOMC BehavesLike.Win32.AdwareDealPly.fc BDS/Dokstormac.A.1 Backdoor:Win32/Dokstormac.A Trojan.Win32.Pakes.vtl Trojan/Win32.Pakes.R39576 Trojan-Injector.61205 Win32/Fynloski.AA Trojan.Injector!2nop4664l2U Backdoor.Win32.Dokstormac RAT.Arcom


With access to business critical information, senior executives and consultants are often said to be valuable targets for threat actors tasked with obtaining sensitive business secrets.


Yoroi ZLab has discovered evidence of new campaign utilizing different tactics, including more complex delivery mechanisms and victimology, which began in April, 2022.


A backdoor also known as: Trojan.Unruy.5 Win32.Trojan.Kryptik.ak Trojan.ADH.2 Trojan.Win32.Crypted.bbxiyv Backdoor.Win32.A.Banito.73728.A Trojan.Scar.Win32.47454 BehavesLike.Win32.Downloader.fc Trojan-Downloader.Win32.Bulilit Trojan/Scar.ajgx Trojan:Win32/Tript.A Trojan/Win32.ADH.C261975 TScope.Malware-Cryptor.SB Win32.Trojan.Deepscan.Wnlw Trojan.DL.Unruy!ze+OfqNv7J8 Win32/Trojan.PSW.ea7


While still compromised, the ARC website also hosted an archive with the filename: the 3rd ASEAN Defence Ministers' Meeting.rar.


AgentTesla is a fairly popular keylogger built using the Microsoft .NET Framework and has shown a substantial rise in usage over the past few months.


A backdoor also known as: Trojan-Dropper.Win32.EliteWrap!O Trojan/Dropper.EliteWrap.103 Win32.Trojan.WisdomEyes.16070401.9500.9872 Win32/EliteWrap.103 Trojan-Dropper.Win32.EliteWrap.103 Trojan.Win32.EliteWrap.cstdvv TrojWare.Win32.EliteWrap.103 Trojan.MulDrop.19 Dropper.EliteWrap.Win32.6 Trojan-Dropper.Win32.EliteWrap TrojanDropper.Win32.EliteWrap.103 Trojan[Dropper]/Win32.EliteWrap Win32.Troj.ElitWrap.kcloud Trojan.Graftor.D934B Trojan-Dropper.Win32.EliteWrap.103 TrojanDropper:Win32/Elitewrap.A Trojan/Win32.HDC.C67537 TrojanDropper.EliteWrap Trojan.DR.EliteWrap!+qx1E/0nG5w W32/Multidr.E!tr


A backdoor also known as: Trojan.Qhost Trojan/KillProc.b Win.Trojan.4904185-1 Trojan.Inject.10975 Trojan.Win32.FakeAV TR/Qhost.DK.1 W32/Qhost.BE!tr Trojan:Win64/Qhost.DK Trj/CI.A Win32/Trojan.1ea


A backdoor also known as: Trojan/W32.Glomaru.10240 Trojan.Mauvaise.SL1 Trojan.Win32.Glomaru.a Trojan.Win32.FraudLoad.egvymu Troj.W32.Dialer.lwu8 Win32.Trojan.Glomaru.Wozz TrojWare.Win32.Glomaru.A Trojan.DownLoader23.35677 Trojan.Glomaru.a TR/FraudLoad.poenc Trojan.Zusy.D3521C Trojan.Win32.Glomaru.a Win32.Trojan.Small.P Trojan.Glomaru


A backdoor also known as: Backdoor/W32.Small.43520.J Backdoor.Win32.PcClient!O Backdoor.Pcclient.19199 Backdoor.PcClient.Win32.16939 Trojan/PcClient.ngo Trojan.Tsaisda.1 Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan Win32/PcClient.BIJ Win.Trojan.PcClient-5088 Trojan.Win32.Pcclient.cqndw Backdoor.Win32.A.PcClient.43520 Backdoor.W32.Hupigon.kYKa TrojWare.Win32.PcClient.NOP BackDoor.PcClient.5363 Trojan.FraudPack Backdoor/PcClient.aesj W32.Tsaisda.A BDS/Pcclient.AL Trojan[Backdoor]/Win32.PcClient Backdoor:Win32/Tsaisda.A Trojan/Win32.PcClient.R25878 Backdoor.PcClient Backdoor.PcClient!ID9InYPBgAg W32/PcClient.GG!tr Win32/Backdoor.fa2


A backdoor also known as: W32.HfsAutoB.8048 Win32.Nemim.A Win32.Trojan.WisdomEyes.16070401.9500.9999 HT_GARVEEP_FI060DBE.UVPM Win32.Nemim.A Win32.Pioneer.C Virus.Win32.Pioneer.e Win32.Nemim.A Win32.Nemim.A BehavesLike.Win32.Ramnit.th Virus.Win32.Nemim TR/Taranis.3944 TrojanDownloader:Win32/Garveep.D Win32.Nemim.A W32.Pioneer.mv7p Win32.Nemim.A Win32.Nemim.A Win32/Nemim.B Trojan.DownLoader! W32/Nemim.B Trj/CI.A


Given what we ve seen previously with Vawtrak, simply switching to HTTPS is not a major update in terms of development -- but it does show that the threat actors are interested in protecting their C2 communications.


Most recently, we have observed the same group targeting military and aerospace interests in Russia and Belarus.


A backdoor also known as: Backdoor.Meciv Win32/Pucedoor.A Trojan.Enfal-11 Application.Win32.BlkIC.IMG Trojan.MulDrop1.40578 TR/Spy.174210 Trojan.Heur.E0B301 Backdoor:Win32/Meciv.A Trj/CI.A


This current variant includes a link to the following payment onion website: http://zvnvp2rhe3ljwf2m[.]onion.


TV5Monde was taken off air in April 2015.


Kaspersky Some time ago while tracking Winnti group activity we came across a suspicious 64-bit sample.


The group discussed in this white paper is part of this new trend.


A backdoor also known as: HW32.Packed.3E85 Backdoor.Win32.Nepoe!O Dropper.Paradrop.Win32.108 W32/Korgo.worm PE_AGOBOT.AQM Win32.Trojan.WisdomEyes.16070401.9500.9889 W32/Bobax.AO W32.Bleshare PE_AGOBOT.AQM Win.Trojan.Poebot-45 Trojan-Dropper.Win32.Paradrop.a Trojan.Win32.Paradrop.xhlx Dropper.Paradrop.180736 Troj.Dropper.W32.Paradrop.kYTK TrojWare.Win32.TrojanDropper.Paradrop.a0 Trojan.MulDrop.2267 BehavesLike.Win32.Conficker.cc Backdoor.Win32.PoeBot.C W32/Bobax.LVYX-1108 TrojanDropper.Paradrop TR/Drop.Paradro.a.3 Trojan[Backdoor]/Win32.Agobot TrojanDropper:Win32/Paradrop.J Trojan-Dropper.Win32.Paradrop.a W32/Polybot.dr Backdoor.PoeBot Trj/Droppofonic.A Win32/TrojanDropper.Paradrop.A Worm.PoeBot.S W32/Paradrop.B!tr.dr


This blog will provide an analysis of the Bookworm Trojan and known indicators of compromise.


Copy the stage 5 DLL into winlogon.exe Allocate a chunk of memory in winlogon.exe process and copy the same APC routine seen previously Read and save the original pointer of the __fnDWORD internal User32 routine ( located at offset +0x10 of the KernelCallbackTable ) and replace this pointer with the address of the APC stub routine After this function pointer hijacking , when winlogon.exe makes any graphical call ( GDI ) , the malicious code can execute without using CreateRemoteThread or similar triggers that are easily detectable .


SentinelLabs analyzed several iterations of AlienFox, a comprehensive toolset for harvesting credentials for multiple cloud service providers.


A backdoor also known as: W32.OnGamesLTPGOWF.Trojan Trojan/W32.Small.35840.NP Backdoor.Win32.Floder!O Backdoor/Floder.rlw Win32/Tnega.ANRP Backdoor.Win32.A.Floder.37376[UPX] Trojan.MulDrop1.37252 Backdoor/Floder.age Trojan[Backdoor]/Win32.Floder Backdoor:Win32/RDPopen.A


The remaining 99 C C servers were duplicated configurations from different APKs. This is likely due to configuration files being hardcoded within the APK, and old spam campaigns infecting different users, thus, old configurations still being detected in the wild.


A backdoor also known as: Ransom_Ciluf.R002C0DL517 Win32.Trojan.WisdomEyes.16070401.9500.9967 Ransom_Ciluf.R002C0DL517 BehavesLike.Win32.Backdoor.ct W32/Trojan.QHYA-4995 Ransom:Win32/Ciluf.A Ransom.Lucifer Trj/GdSda.A


A backdoor also known as: Backdoor/W32.Tiny.3072 Backdoor.Win32.Tiny!O Backdoor.Tiny BackDoor-IQ.b Troj.Dropper.W32.Small.l6P3 Backdoor/Tiny.c Win32.Trojan.WisdomEyes.16070401.9500.9646 Backdoor.Trojan BKDR_IQ.B Backdoor.Win32.Tiny.c Backdoor.Win32.Tiny.6144 BackDoor.Tiny.40 BKDR_IQ.B BackDoor-IQ.b Backdoor/Tiny.aw TR/Tiny.nmclh Trojan[Backdoor]/Win32.Tiny.c Trojan.Zusy.Elzob.804 Backdoor.Win32.Tiny.c Backdoor:Win32/Tiny.FBC Win-Trojan/IQ.B Backdoor.Win32.Small.Epi Bck/Tiny.B Win32.Backdoor.Tiny.Pcsz Backdoor.Win32.Tiny BDoor.IQ!tr.bdr Win32/Trojan.d37


A backdoor also known as: Worm.Nofear.C W32.W.Fearso.kYUv W32/Fearso.c Win32.Worm.Farex.a W32/Worm.AEST W32.Nofer.A@mm win32/Nofear.A Win.Worm.Fearso-2 Email-Worm.Win32.Fearso.c Trojan.Win32.Fearso.cssoyh I-Worm.Win32.A.Fearso.86541 Worm.Win32.Fearso.~BAAA Trojan.AVKill.9837 Worm.Fearso.Win32.9 BehavesLike.Win32.Nofear.mh Backdoor.Win32.Gobot W32/Worm.ENOQ-1581 I-Worm/Fearso.c Worm:Win32/Nofear.C@mm Worm[Email]/Win32.Fearso Worm:Win32/Nofear.C@mm Worm.Fearo Email-Worm.Win32.Fearso.c Worm.Fearso W32/Fearso.V.worm I-Worm.Farex.Y Win32/Farex.Y Trojan.Win32.Fearso.c I-Worm.Fearso!qiaAnheOcEc Worm.Win32.Nofear.A


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9925 Trojan.Win32.Yakes.vpge TR/Crypt.ZPACK.jrfyx Trojan:Win64/Carberp.A!bit Trojan.Win32.Yakes.vpge


A worm that spreads by copying itself to file shares and removable drives.


A backdoor also known as: Trojan.MSIL Win32.Trojan.WisdomEyes.16070401.9500.9554 Trojan.Win32.Mlw.eugajo Trojan.Win32.Z.Firsot.3520512 W32/Trojan.KPJB-2397 Backdoor:MSIL/Firsot.A Trj/CI.A Backdoor.MSIL.Firsot Win32/Trojan.289


A backdoor also known as: Trojan.Kazy.D1D724 W32/Trojan.PVRS-3848 Trojan.Win32.PcClient.eptxte Trojan.Win32.Z.Pcclient.356864 BackDoor.PcClient.6543 Trojan.Reconyc.Win32.20285 BehavesLike.Win32.Dropper.fc Trojan.Win32.Krypt Trojan.Reconyc.gyp TR/Crypt.ZPACK.igurt Trojan[DDoS]/Win32.Macri TrojanDownloader:Win32/Redosdru.F!bit Trojan/Win32.Infostealer.R206663 TrojanDDoS.Macri Trj/CI.A W32/Kryptik.FQKI!tr Win32/Trojan.443


One interesting new fact about Gaza cybergang activities is that they are actively sending malware files to IT Information Technology and IR Incident Response staff; this is also obvious from the file names they are sending to victims, which reflect the IT functions or IR tools used in cyber attack investigations.


Once delivered, Escelar has multiple installation stages where malware is downloaded using direct connections to multiple Microsoft SQL servers.


However, unlike Dyre which was designed to target banking information, Rombertik collects information from all websites in an indiscriminate manner.


A backdoor also known as: Trojan.Heur.DP.E18DA6 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32.W.Dorifel.moev TrojWare.Win32.Delf.OSP1 Trojan.DownLoad1.16614 Trojan-Downloader.Win32.Rochap TR/Dldr.Rochap.J Trojan/Win32.Unknown TrojanDropper:Win32/Rochap.H Win32/Delf.OSP W32/Dropper.VFR!tr


A backdoor also known as: Trojan.Downloader.Harnig.al Trojan-Downloader.Win32.Harnig!O Downloader.Small.28090 Trojan/Downloader.Harnig.al Win32.Trojan.WisdomEyes.16070401.9500.9939 Downloader.Trojan Win.Downloader.Small-579 Trojan.Downloader.Harnig.al Trojan-Downloader.Win32.Harnig.al Trojan.Downloader.Harnig.al Trojan.Win32.Harnig.voqq Trojan.Win32.A.Downloader.10240.FS Troj.Downloader.W32.Harnig.al!c Trojan.Downloader.Harnig.al TrojWare.Win32.TrojanDownloader.Harnig.AL Trojan.Downloader.Harnig.al Trojan.DownLoader.919 Downloader.Harnig.Win32.353 BehavesLike.Win32.Cutwail.lt Trojan-Downloader.Win32.Harnig Trojan/Startpage.nv W32.Trojan.Downloader.Harnig Trojan[Downloader]/Win32.Harnig Trojan.Downloader.Harnig.al Trojan-Downloader.Win32.Harnig.al Trojan/Win32.Downloader.R39433 Trojan.Downloader.Harnig.al OScope.Downloader.GCLA Trj/Harnig.AD Win32/TrojanDownloader.Harnig.AL Win32.Trojan-downloader.Harnig.Sxyp Trojan.QHost.L W32/Harnig.AI!tr


This campaign involved five separate phishing attacks, each carrying a different variant of Sysget malware, also known as HelloBridge.


A backdoor also known as: W32.SkipnetA.Trojan Trojan.VB W32/Bybz.ehk Trojan.IPZ.3 Win32.Trojan.WisdomEyes.16070401.9500.9995 TROJ_VB_GA2509B6.UVPM Win.Trojan.Injector-397 Trojan.Win32.AutoRun.thcnx Worm.Win32.AutoRun.dck Trojan.MulDrop2.2467 Worm.Bybz.Win32.935 TROJ_VB_GA2509B6.UVPM BehavesLike.Win32.VBobfus.dc Trojan/Cosmu.gzo W32/Llac.PMC!tr Worm/Win32.Bybz Worm.Win32.A.AutoRun.206367 Worm/Win32.AutoRun.C11891 PWS-Spyeye.ai OScope.Worm.Bybz.31321 Worm.Bybz!gMC6zzOscGs Backdoor.Win32.Poison


These tools included utilities from Microsoft Sysinternals and parts of open-source projects.


To distribute the malicious excel file, the attackers registered a domain which impersonated the identity of most influential Indian think tank IDSA Institute for Defence Studies and Analyses and used the email id from the impersonating domain to send out the spear-phishing emails to the victims.


The malware appears to have been named Hinata by the malware author after a character from the popular anime series, Naruto.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9964 Infostealer.Gampass Trojan-GameThief.Win32.OnLineGames.jez Trojan.Win32.OnLineGames.csyqf Trojan.PWS.Gamania.6047 BehavesLike.Win32.BadFile.lc Trojan-PWS.OnlineGames Trojan/PSW.OnLineGames.cqju Win32.PSWTroj.OnLineGames.kcloud Trojan-GameThief.Win32.OnLineGames.jez Trojan/Win32.OnlineGameHack.R6228 TScope.Malware-Cryptor.SB Win32/PSW.OnLineGames.HCV


A backdoor also known as: Bck/DSNX.05 Bloodhound.Morphine Trojan.Packed-86 Backdoor.Win32.DSNX.05.a Backdoor.Dsnx.05.A Backdoor.Win32.DSNX.05.a Backdoor:Win32/DSNX.E Backdoor.DSNX.05.a BackDoor.Dsnx Backdoor.DSNX.05 Bck/DSNX.05 Trojan.Dsnx Trojan-Spy.Win32.Flux.a Win32/DSNX.05 Bck/DSNX.05


In July 2014, Trend Micro published a report about a threat called Retefe, an ebanking Trojan that is targeting financial institutions in Switzerland, Austria, Sweden and Japan.


Based on other public reports, SANs saw the expected Qakbot activity.


A backdoor also known as: Backdoor.Regin.A Trojan.Regin Backdoor.Regin.A Trojan/Downloader.Tiny.br Backdoor.Regin.A W32/Backdoor.NAZD-1177 Backdoor.Regin Backdoor.Regin.A Backdoor.Regin.A Backdoor.Regin.A Heur.Packed.Unknown Backdoor.Regin.A Virus.Win32.Dion.b TR/Regin.qzqib Trojan:WinNT/Regin.A!dha Trj/CI.A Win32/Trojan.2d3


A backdoor also known as: Hacktool.Paycrack Trojan/Hacktool.PayCrack.a W32/Trojan.TVD Win32/HackTool.PayCrack.A HackTool.Win32.PayCrack.a Riskware.Win32.PayCrack.hsmb Win32.Hacktool.Paycrack.Amwe Application.Win32.HackTool.PayCrack.A Tool.PayCrack.Win32.1 W32/Trojan.IFEJ-8553 HackTool.PayCrack.a Malware_fam.gw HackTool/Win32.PayCrack Win32.HackTool.PayCrack.a.kcloud Trojan.Kazy.D2127B HackTool.W32.PayCrack.a!c HackTool.Win32.PayCrack.a HackTool:Win32/Paycrack.A Trojan.VBRA.03914 HackTool.PayCrack!/HSSYr26Jv4


A backdoor also known as: Trojan/W32.Rootkit.13224.C Win32.Trojan.KillAV.aa Trojan.Win32.NtRootKit.crkykj Trojan.NtRootKit.12298 Trojan.Zusy.75 Trojan:WinNT/Kernelpatch.A Trojan.Win32.KillAV


A backdoor also known as: TrojanDownloader.Mariofev Dropper.Drooptroop.Win32.3960 Trojan/Dropper.Drooptroop.jqh Trojan.TDss.50 Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/MalwareF.QVRD TROJ_DROPPER.OFB Trojan.Win32.Drooptroop.cphrc Backdoor.Win32.Shiz.A Trojan.DownLoader1.42134 TROJ_DROPPER.OFB BehavesLike.Win32.Ramnit.mc W32/Risk.VWDX-4897 TrojanDropper.Drooptroop.cvo W32.Malware.Downloader TrojanDownloader:Win32/Mariofev.B Win-Trojan/Drooptroop.29184 Trojan.SB.01742 Trj/Sinowal.WXO Win32.Trojan-dropper.Drooptroop.Suxo Trojan.DR.Drooptroop!YuxRFC8vqfA Win32/Trojan.Downloader.5d7


A backdoor also known as: W32.HfsAutoB.6E94 Dropped:Backdoor.Hupigon.AACP Backdoor.Delf.13917 Backdoor.Delf.Win32.18733 Trojan/Ceckno.nag Backdoor.Hupigon.AACP Win32.Trojan.Hupigon.b Win.Trojan.Crypted-5 Backdoor.Win32.Delf.cxe Dropped:Backdoor.Hupigon.AACP Trojan.Win32.Delf.ivaq Backdoor.W32.Delf.lqj!c Win32.Backdoor.Delf.Lkxm Dropped:Backdoor.Hupigon.AACP Packed.Win32.Klone.~KE Dropped:Backdoor.Hupigon.AACP BackDoor.Beizhu.origin Trojan.Win32.Cosmu VirTool.MaskPE.f Trojan[Backdoor]/Win32.Delf PWS:Win32/Populf.E!dll Dropped:Backdoor.Hupigon.AACP Backdoor/Win32.Delf.C195770 Dropped:Backdoor.Hupigon.AACP TScope.Trojan.Delf Backdoor.Delf!JSU0HMDt5JA W32/PEMask.A!tr Win32/Backdoor.Hupigon.88a


A backdoor also known as: Backdoor.Tosct BKDR_WEBRV.A Win32.Trojan.WisdomEyes.16070401.9500.9995 BKDR_WEBRV.A W32/Trojan.FUQN-2612 W32.Trojan.Downloader Trojan.Heur.RP.EBE28B Backdoor:Win32/Tosct.A W32/Dloader.GQ!tr


The spam messages we observed used several different tactics to deliver malicious payloads to users, including macros, packager shell objects aka OLE objects, and links.


In this blog we begin with data from a real attack in the wild, and use the evidence from that attack to make a connection back to underground forums and the actors who are using them.


A backdoor also known as: Trojan.Gatt.A Backdoor.Small.oo Backdoor/Small.oo W32/Trojan.AVEH Infostealer.Onlinegame BKDR_SMALL.ALN Trojan.Downloader-17400 Backdoor.Win32.Small.oo Trojan.Gatt.A Trojan.Win32.Veslorn!IK Trojan.Gatt.A DDoS.Bonke BKDR_SMALL.ALN W32/Trojan.AVEH Trojan.Gatt.A Win-Trojan/Xema.variant Backdoor.Win32.Small.oo Trojan-PSW.Onlinegame Backdoor.Pina.k Trojan.Win32.Veslorn


A backdoor also known as: Trojan.KillProc.33379 Trojan.Foreign.Win32.54666 Trojan[Ransom]/Win32.Foreign TrojanDropper:Win32/Rovnix.N W32/Kryptik.DDLY!tr


He told Amnesty International: one of my colleagues called me…and said I received an email from you and you're mentioning something about political prisoners and there is an attachment there.


In the summer of 2015, Fidelis Cybersecurity had the opportunity to analyze a Derusbi malware sample used as part


Recent samples are shown to infect Windows hosts with the NetSupport Manager remote access tool RAT.


Tracking Subaat: Targeted Phishing Attacks Point Leader to Threat Actor's Repository


Following their activities and evolving tactics and techniques helped us uncover the proverbial red string of fate that connected three seemingly disparate campaigns: PLEAD, Shrouded Crossbow, and of late, Waterbear.


Following the seemingly quiet state of point-of-sale PoS malware these past few months, we are now faced with two new PoS malware named Katrina and CenterPoS now available to cybercriminals.


We recently wrote about the KONNI Remote Access Trojan RAT which has been distributed by a small number of campaigns over the past 3 years.


A backdoor also known as: W32.Virut.G W32/Virut.CF_2 Win32/Virut.17408 PE_VIRUX.F-1 Virus.Win32.Virut.ce Win32.Virut.AL Virus.Win32.Virut.Ce Win32.Virut.56 PE_VIRUX.F-1 Win32/Virut.bn Trojan:Win32/Ertfor.A Virus.Virut.06 HeurEngine.MaliciousPacker Win32/Virut.NBP W32/PackTDss.W!tr W32/Sality.AO


During our research into a widespread spam campaign, we discovered yet another POS malware that we've named NitlovePOS.


A backdoor also known as: Worm.Win32.VB!O W32/Autorun.worm.aba Win32.Trojan.WisdomEyes.16070401.9500.9993 W32.SillyFDC Trojan-Dropper.Win32.Dapato.ddfx Trojan.Win32.Dapato.efldrk Win32.HLLW.Autoruner.10315 Worm.VB.Win32.2517 W32/Autorun.worm.aba Worm.Win32.VB Worm/VB.pfc W32.Worm.Sphr Worm/Win32.VB Worm.VB.kcloud Worm:Win32/Dashvolex.A Trojan.Strictor.DCDB Trojan-Dropper.Win32.Dapato.ddfx Worm/Win32.VB.C95007 Trojan.VBO.014708 Worm.VB!8247fVrcIiA W32/VB.OAN!tr Win32/Trojan.Dropper.d0e


The Carbanak group is infamous for infiltrating various financial institutions, and stealing millions of dollars by learning and abusing the internals of victim payment processing networks, ATM networks and transaction systems.


This blog discusses targeted attacks against the Middle East taking place between February and October 2017 by a group Unit 42 is naming MuddyWater


A backdoor also known as: Backdoor.Dtr.1.4.4 Backdoor.DTR BackDoor-WF.svr.rmv Email-Worm.Win32.GOPworm.196 Backdoor.Dtr.1.4.4 W32/Risk.RVZV-3966 Backdoor.Trojan Win32/DTR.14.rmvr BKDR_WF.SVR Backdoor.Dtr.1.4.4 Backdoor.Dtr.1.4.4 Trojan.Win32.Dtr.zmvuu Backdoor.Dtr.1.4.4 Backdoor.Win32.DTR.14.rmvr BackDoor.Dtr.143 Backdoor.Win32.C01A9ACD BackDoor-WF.svr.rmv W32.DTR.B BDS/Dtr.1.4.4 Backdoor:Win32/DTR.B Backdoor.Dtr.1.4.4 Email-Worm.Win32.GOPworm.196 Win32.Trojan.Wf.Pefg Backdoor.WF!ynwdN87+ujc Trojan.Win32.DTR W32/Bdoor.WH!tr.bdr Win32/Backdoor.9a4


In this attack, AutoIT was utilized to install a Remote Access Trojan RAT and maintain persistence on the host in a manner that's similar to normal administration activity.


This report contained a sentence of particular interest to Cyber4Sight: FIN7 is referred to by many vendors as Carbanak Group,' although we do not equate all usage of the Carbanak backdoor with FIN7. In their previous report on this threat actor group, FireEye stopped short of making this direct connection, stating instead that The use of the CARBANAK malware in FIN7 operations also provides limited evidence that these campaigns are linked to previously observed CARBANAK operations leading to fraudulent banking transactions, ATM compromise, and other monetization schemes.


UNIX-based operating systems are widely used in servers, workstations, and even mobile devices.


I.e., malicious email messages are sent to selected targets rather than random mass distribution, but are not tailored specifically to each and every target.


A backdoor also known as: Worm.Win32.AutoDoor!O Worm.AutoDoor Trojan.Win32.Buzus Win32.Trojan.WisdomEyes.16070401.9500.9827 W32/Trojan2.CWJR W32.IRCBot Win32/DfInject.CI TROJ_BUZUS.JW Win.Trojan.Buzus-2971 Worm.Win32.AutoDoor.fd Trojan.Win32.Buzus.qvdn Trojan.Win32.Buzus.48128 TrojWare.Win32.Buzus.~BAAM Trojan.MulDrop.27694 Trojan.Buzus.Win32.5559 TROJ_BUZUS.JW BehavesLike.Win32.Worm.cz Trojan/Buzus.esq Trojan/Win32.Buzus Trojan:Win32/Buzus.A Worm.Win32.AutoDoor.fd Trojan/Win32.Buzus.C140550 Trojan.Win32.Buzus.ck Trojan.Win32.Buzus Trj/Buzus.ER Virus.Win32.Virut.ue Worm.Win32.AutoDoor W32/Injector.fam!tr Win32/Worm.07d


A backdoor also known as: TrojanPWS.Mintluks.FC.1419 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Inject.dhybnf Trojan.DownLoader11.61306 PWS:MSIL/Mintluks.A Trojan.Razy.D2D0CD MSIL.Trojan.Injector.HD Backdoor.Bot Trojan.MSIL.Injector Trj/CI.A


The Patchwork attack group has been targeting more than just government-associated organizations.


It is usually used as a downloader for the actual binary payload.


However, over a period of just over two weeks June 10 to June 28, we saw a recurrence of this threat.


Hundreds of malware samples have been used, most are Remote Access Trojans and keyloggers.


The attackers initially injected a malicious user-defined function Downloader.Chikdos into servers in order to compromise them with the Trojan.Chikdos.A DDoS malware According to Symantec telemetry, the majority of the compromised servers are in India, followed by China, Brazil and the Netherlands.


A backdoor also known as: Trojan.Retefe W32/Trojan.IYLJ-0833 Ransom.Cry Trojan.Win32.Banker1.euqajf TrojWare.Win32.Amtar.TAW Trojan.PWS.Banker1.23740 Trojan.Adware.a Trojan/Win32.Injector.C2217431 Trj/CI.A Win32.Trojan.Fakeversign.Vgov Win32/Trojan.Adware.37e


A backdoor also known as: TrojanProxy.Roficor W32/Trojan.GIFJ-9110 Win32/Tnega.TOWATOC TrojanProxy:Win32/Roficor.A Win32.Trojan.Falsesign.Duco


Adwind is a Java-based remote access tool RAT used by malware authors to infect computers with backdoor access.


All modules set hidden attributes to their files : Module Paths Exfiltrated data format msconf.exe % APPDATA % /myupd/gen/ % Y % m % d- % H % M % S_filesystem.zip ( file structure dump ) system.exe % APPDATA % /myupd/aud/ % d % m % Y % H % M % S.wav ( surrounding sounds ) update.exe % APPDATA % /myupd_tmp/txt/ % APPDATA % /myupd/txt/ % Y % m % d- % H % M % S.txt ( keylogging ) wow.exe % APPDATA % /myupd/scr/ % Y % m % d- % H % M % S.jpg ( screenshots ) skype_sync2.exe % APPDATA % /myupd_tmp/skype/ % APPDATA % /myupd/skype/ yyyyMMddHHmmss_in.mp3 yyyyMMddHHmmss_out.mp3 ( skype calls records ) Moreover , we found one module written in .Net – skype_sync2.exe .


A backdoor also known as: Trojan/W32.Scar.995328.O Trojan/Scar.dzrv Win32.Trojan.WisdomEyes.16070401.9500.9996 Trojan.Bayrob Trojan.Win32.Scar.cpddg Troj.W32.Scar.dzrv!c Trojan.Scar.Win32.50507 BehavesLike.Win32.GameVance.dt Trojan/Scar.bagk TR/Woripecs.A.48 Trojan.Heur.JP.EFC713 Backdoor:Win32/Nivdort.A!dll Trojan/Win32.Bayrob.C236811 Trojan.Scar!yb6+goUnDvM Trojan.Win32.Woripecs W32/Scar.AT!tr Win32/Trojan.Spy.84a


The spreading method of a fake antivirus website was also quite confusing, normally I see these things dropping FakeAV's as I've written on in the past.


Some of Regin's custom payloads point to a high level of specialist knowledge in particular sectors, such as telecoms infrastructure software, on the part of the developers.


A backdoor also known as: W32.Tagazie.Trojan Trojan/W32.Small.36864.ACH Trojan.Win32.Scar!O TrojanDownloader.Bredolab.AJ2 Virus.Virut.Win32.1911 Trojan/Scar.eaml Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_SCAR_0000027.TOMA Trojan.Win32.Scar.eaml Trojan.Win32.Scar.djhme Trojan.Win32.Scar.9216.A Trojan.Win32.Scar.eaml Trojan.Proxy.19837 BehavesLike.Win32.PWSZbot.nc Trojan/Scar.airi Trojan/Win32.Scar Trojan:Win32/Hioles.D Troj.W32.Scar.lrnw Trojan.Win32.Scar.eaml Trojan/Win32.Scar.R7877 Worm.Fakeupdate.2821 Win32.Magistr Trojan.Scar!QrzKm85lu1k Trojan.Win32.Comame


A backdoor also known as: Trojan.Script.634117 Trojan.Win32.Miner!O Win32.Trojan.WisdomEyes.16070401.9500.9944 PUA.Deminnix Trojan.Win32.Miner.aau Trojan.Script.634117 Riskware.Win32.BitCoinMiner.csteyy Trojan.Script.634117 Tool.BtcMine.83 Trojan.Miner.Win32.426 W32/Trojan.IJIB-0603 Trojan/Miner.dc Trojan.Graftor.D194A6 Trojan.Win32.Miner.aau Trojan.BitMiner Win32/CoinMiner.EC Riskware.BitCoinMiner!FKk5sgQEcRQ Trojan.Win32.Deminnix


The investigations showed that the attacks shared a number of common features, such as involving large amount of monetary loss originating from what initially appeared to be legitimate bank customer accounts.


A backdoor also known as: W32.eHeur.Malware03 Trojan.Kimad.19394 Trojan/Downloader.Stantinko.o TROJ_KIMAD_EK04051A.UVPM Win32.Trojan-Downloader.Stantinko.a TROJ_KIMAD_EK04051A.UVPM Win.Trojan.12288703-1 Trojan.Kbdmai.14 Downloader.Stantinko.Win32.10 Trojan-Downloader.Win32.Stantinko Variant.Graftor.eb Trojan.Graftor.D2AB64 Trojan/Win32.Kimad.R138166 Trojan.DL.Stantinko! Win32/Trojan.Stantinko.A


DarkKomet is a freeware remote access trojan that was released by an independent software developer.


A backdoor also known as: W32.DownloadGelodeA.Trojan Adware.WSearch.Win32.494 TROJ_RUGO.SM Win32.Trojan.WisdomEyes.16070401.9500.9989 TROJ_RUGO.SM Trojan.Win32.Dwn.vrhnq Trojan.DownLoader5.16461 TR/Graftor.16274.28 Trojan/Win32.Unknown TrojanDownloader:Win32/Nekotimed.A Trojan.Graftor.D3F92 Downloader/Win32.Nekill.R1661 Adware.WSearch!QcX4Awfq1EM Trojan-Downloader.Win32.Adnur


A backdoor also known as: VB:Trojan.Valyria.163 Trojan.FTKN-6 Doc.Macro.Injection-6355574-0 VB:Trojan.Valyria.163 Troj.Downloader.Script!c VB:Trojan.Valyria.163 W97M.DownLoader.631 VB:Trojan.Valyria.163 VB:Trojan.Valyria.163 Win32.Outbreak VB:Trojan.Valyria.163 virus.office.qexvmc.1070


The effectiveness of a zero-day quickly deteriorates as an attack tool after it gets discovered and patched by the affected software vendors.


Small businesses are generally more likely to use remote administration software for their POS terminals so that 3rd parties can manage the terminals.


A backdoor also known as: Trojan.Nurjax TROJ_GE.273CBA41 Trojan.Win32.Nurjax.ufm Trojan.Win32.Nurjax.dxmzxe Trojan.Win32.Z.Nurjax.10297344 Troj.W32.Nurjax!c BehavesLike.Win32.Dropper.tc W32/Trojan.TKWG-0004 Trojan.Nurjax.a Trojan/Win32.Nurjax TrojanDownloader:Win32/Lentrigy.A Trojan.Win32.Nurjax.ufm Trj/CI.A Win32.Trojan.Nurjax.Ajbs Trojan.Nurjax! W32/Nurjax.BQZ!tr Win32/Trojan.e9c


The Fidelis Threat Research team recently analyzed a new variant to Vawtrak using HTTPS for C2 communications.


These thefts targeted banks in Vietnam, Bangladesh, Taiwan, and Mexico between 2016 and 2017.


North Korea conducted a test missile launch on 3rd July.


A backdoor also known as: Trojan/Hacktool.BruteForce.mp Win32.Trojan.WisdomEyes.16070401.9500.9985 Win.Trojan.Hacktool-315 Trojan.Win32.BruteForce.recrn Tool.Bruteforce.84 Tool.BruteForce.Win32.143 HTool.BruteForce.g


In order to ensure we have the most effective detection possible, Talos reverse engineered CryptoWall 4 to better understand its execution, behavior, deltas from previous versions and share our research and findings with the community.


We collaborated with Dropbox to investigate the threat, and our cooperation revealed what may be a second, similar operation.


PluginPhantom implements each element of malicious functionality as a plugin, and utilizes a host app to control the plugins.


A backdoor also known as: Trojan-Downloader/W32.Byterage.8193 Trojan/Downloader.Byterage Trojan.Win32.Byterage.hipq W32/Downloader.HPW Byterage.C TROJ_EXCEPTION.F Trojan-Downloader.Win32.Byterage Trojan.Byterage.A Trojan.Win32.Downloader.8193 Virus.Win32.Part.k TrojWare.Win32.TrojanDownloader.Byterage Trojan.Duho TR/Byterage.Dldr TROJ_EXCEPTION.F TrojanDownloader.Win32.Byterage Trojan/Win32.Byterage Win32.Troj.DownByteage.kcloud W32/Downloader.KOEY-6366 Win-Trojan/Byterage.8193 Malware-Cryptor.InstallCore.1 Win32/TrojanDownloader.Byterage Trojan.DL.Byterage Trojan-Downloader.Win32.Small W32/Dloader.AW!tr Downloader.Byterage


In addition, thanks to a coding mistake by the attackers, this particular backdoor does not always run the right commands.


The gopuram backdoor might be the main implant and the final payload in the attack chain.


We also observed that the threat actors were actively changing their tools, tactics, and procedures TTPs to bypass security solutions.


A backdoor also known as: Java.Exploit.CVE-2012-0507.K Exp.JAVA.CVE-2012-0507 Trojan.Inject.GE Exploit.CVE.JS.1533 Exploit.Java.Cve!c Java.Exploit.CVE-2012-0507.K Trojan.Maljava Java/Exploit.CVE-2012-0507.AJ JAVA_EXPLOIT.KRZ Exploit.Java.CVE-2012-0507.gd Exploit.Java.CVE20120507.cqxpdq Java.S.CVE-2012-0507.141383[h] Java.Exploit.CVE-2012-0507.K Java.Exploit.CVE-2012-0507.K Exploit.CVE2012-0507.13 JAVA_EXPLOIT.KRZ BehavesLike.Downloader.cz Exploit.CVE-2012-0507.d JAVA/Adwind.sagg.26 Java.Exploit.CVE-2012-0507.K Exploit.Java.CVE-2012-0507.eg Java.Exploit.Cve-2012-0507.Akpd Exploit.Java.CVE-2012-0507 Java.Exploit.CVE-2012-0507.K Java/Exploit.AZT


The final stage is an ARMEB version from the LuaBot Malware.


A backdoor also known as: W32.HfsAutoB.5441 Win32.Trojan.WisdomEyes.16070401.9500.9941 TROJ_INJECT.AUSPTO Trojan.Win32.Phpw.gez Trojan.Win32.Phpw.expttn TROJ_INJECT.AUSPTO BehavesLike.Win32.Trojan.cc Trojan.Win32.Themida W32/Trojan.JODZ-3607 Trojan.Win32.Phpw.gez Backdoor:MSIL/Zqorat.A Trojan/Win32.Phpw.C2403487 TScope.Malware-Cryptor.SB Trj/CI.A Win32.Trojan.Phpw.Ahym


A backdoor also known as: Trojan.VBS.Downloader.ADR JS.Ransom.R VBS/Downldr.HM VBS.Downloader.B Vbs.Downloader.Locky-6348805-0 Trojan.VBS.Downloader.ADR Trojan.VBS.Downloader.ADR Trojan.Script.Vbs-heuristic.druvzi VBS.Downloader.11760 Troj.Downloader.Script!c Trojan.VBS.Downloader.ADR Trojan.VBS.Downloader.ADR VBS.DownLoader.957 VBS/Downloader.ea VBS/Downldr.HM Trojan.VBS.Downloader.ADR VBS/Obfus.S4 VBS/Downloader.ea Js.Trojan.Raas.Auto Trojan-Downloader.JS.Nemucod


A backdoor also known as: W32.eHeur.Malware14 Trojan/W32.Nymaim.478544 Trojan.Win32.Shiz.3!O Trojan.Kryptik.Win32.905858 Trojan.Inject2.25223 Trojan:Win32/Pennelas.A!gfc Trojan/Win32.Silcon.R186780 Trojan.Nymaim!w9Ehxpvgr9U Trj/GdSda.A


A backdoor also known as: Application.Htool.WIP Trojan.Mauvaise.SL1 HackTool.BruteForce Trojan/Hacktool.BruteForce.ze Application.Htool.WIP Win32.Trojan.WisdomEyes.16070401.9500.9930 Win32/Tnega.dRWGBOC HV_BRUTEFORCE_CG153BD9.RDXN Win.Trojan.Bruteforce-13 Application.Htool.WIP Application.Htool.WIP Trojan.Win32.BruteForce.srzyv Application.Htool.WIP Tool.Bruteforce.185 Tool.BruteForce.Win32.254 HackTool.Win32.BruteForce HTool.BruteForce.f SPR/DUBrute.owoan HackTool/Win32.BruteForce HackTool:Win32/DUBrute.A HackTool.BruteForce Trojan/Win32.Bruteforce.R23399 HackTool.BruteForce!jw9TQR6yLS4


This is worm-like ransomware based on Petya.


A backdoor also known as: W32.FamVT.ExpiroPC.PE W32.Francette.M W32.Francette.Worm Heur.Corrupt.PE Backdoor.Win32.RedSpy Worm:Win32/Francette.M.dam#2


IOCS Hashes 139edb1bc033725539b117f50786f3d3362ed45845c57fe1f82e7ed72b044367 e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 e5f346d8f312cc1f93c2c6af611e2f50805c528934786ea173cabc6a39b14cda 1849a50a6ac9b3eec51492745eeb14765fe2e78488d476b0336d8e41c2c581d4 d328fca14c4340fcd4a15e47562a436085e6b1bb5376b5ebd83d3e7218db64e7 59b9809dba857c5969f23f460a2bf0a337a71622a79671066675ec0acf89c810 120474682ea439eb0b28274c495d9610a73d892a4b8feeff268c670570db97e2 ed234e61849dcb95223676abe2312e1378d6130c0b00851d82cda545b946ec83 27410d4019251a70d38f0635277f931fb73f67ac9f2e1f3b475ce680ebfde12a 6e6c210535b414c5aa2dd9e67f5153feeb43a8ac8126d8e249e768f501323a3e 4a32ced20df7001da7d29edc31ca76e13eef0c9b355f62c44888853435e9794f ac5abaebd9f516b8b389450f7d27649801d746fb14963b848f9d6dad0a505e66 3a45d7a16937d4108b5b48f44d72bb319be645cbe15f003dc9e77fd52f45c065 Domains cvcws [ .


A backdoor also known as: Worm.Win32.AutoRun!O Worm.Emudbot.S15201 Worm.AutoRun.Win32.57341 W32/AutoRun.diqe Win32.Trojan.WisdomEyes.16070401.9500.9953 Win.Worm.Autorun-9966 Worm.AutoRun Trojan.Win32.Emud.reytg Win32.HLLW.EmudBot.12 BehavesLike.Win32.BadFile.kh Worm/AutoRun.agrm W32.Worm.Autorun Worm.Autorun.kcloud Worm:Win32/Emudbot.A Trojan.Graftor.Elzob.D3011 Worm/Win32.AutoRun.C69047 Win32/AutoRun.Delf.MI Worm.AutoRun!NSqws7tLdQs Worm.Win32.Emudbot W32/Autorun.BGT!tr Win32/Trojan.Dropper.65e


We Kaspersky have already seen some cryptor attacks where malicious programs with different functions have been used in combination.


iSIGHT Partners has dubbed the intrusion operators who leverage the CVE-2014-4114 zero-day Sandworm Team. The name was chosen due to unique references to the classic science fiction series Dune, which are characterized by the use of multiple BlackEnergy malware variants.


A backdoor also known as: Trojan.Teper Trojan/AutoRun.Delf.lv Trojan.MSIL.Krypt.11 Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_INJECTOR_FA250012.UVPM Trojan.Win32.DarkKomet.dkhkpy TrojWare.MSIL.Teper.A Trojan.PWS.Stealer.13025 TROJ_INJECTOR_FA250012.UVPM BehavesLike.Win32.Trojan.dc Backdoor/Androm.dvy TR/Inject.xbbeiet W32/Vobfus.GEP.worm Win32/AutoRun.Delf.LV Win32.Worm.Autorun.Suxp Win32/Trojan.d74


They are using the RockLoader malware to download Bart over HTTPS.


A backdoor also known as: Win32.Worm.Autorun.MK Win32.Worm.Autorun.MK Win32.Worm.Autorun.MK Win32.Trojan.WisdomEyes.16070401.9500.9996 W32.SillyFDC Win32/Auraax.W Win.Trojan.Zbot-1219 Win32.Worm.Autorun.MK Win32.Worm.Autorun.MK Win32.Worm.Autorun.MK Win32.Worm.Autorun.MK Trojan.DownLoad.5092 Worm.AutoRun.Win32.24333 Backdoor.W32.Bifrose.kZn8 Win32/AutoRun.YM Trojan-Spy.Win32.Zbot W32/Autorun.MFA!worm Trj/CI.A


The threat posed by custom malware such as Dripion illustrates the value of multilayered security.


However, it doesn't stop there: some versions of RAA also include a Pony Trojan file, which steals confidential information from the infected computer.


The attack was initially thought to be attributed to North Korea, by way of a Chinese IP found during the attack, but no other strong evidence of North Korea's involvement has been produced since then.


A backdoor also known as: Trojan.PPDropper.F PPT97/PPDropper.C TROJ_PPDROPPER.L TROJ_PPDROPPER.L Exploit-PPT.d Exploit:Win32/Nappto.A Exploit-PPT.d PP97M/TrojanDropper.PPDrop.F Trojan-Dropper.PP97M.Ppdrop Exploit/PPT.A


This is the same behaviour we have been seeing with the recent UPS failed to deliver nemucod ransomware versions


A backdoor also known as: Ransom.Ryzerlo.S4 Trojan.Ransom.HiddenTear Trojan.Ransom.HiddenTears.1 Win32.Trojan.WisdomEyes.16070401.9500.9717 Ransom.HiddenTear!g1 Ransom_CRYPTEAR.SMI1 Trojan.Win32.Encoder.ewzwkj Trojan.Win32.Z.Ransom.174592.P Trojan.Encoder.10598 Ransom_CRYPTEAR.SMI1 Trojan-Ransom.HiddenTear W32/Ransom.EJHW-4383 TR/Downloader.fuswg Ransom:MSIL/Flyterper.A Trj/GdSda.A Win32/Trojan.Ransom.786


Several indicators inside the samples we have analysed point to a new major version of the malware.


A backdoor also known as: W32.DroppenAS.Trojan Worm.Nohad.A9 Trojan/AutoRun.Delf.qi Win32.Worm.Delf.bw W32/Trojan.KDXB-0268 Win32/Tnega.AUMK WORM_SOHANAD.SM0 Win32.Worm.Autorun.T Trojan.Win32.Special.dtabba Trojan.Fakealert.51818 WORM_SOHANAD.SM0 W32/Trojan2.OEMC TR/Dropper.pjrqu Trojan.Zusy.D18D1A HEUR/Fakon.mwf Win32/AutoRun.Delf.QI W32/AutoRun.QIAU!tr VBS/Jenxcus.A


We identified over two hundred samples of malware generated by the group over the last two years.


A backdoor also known as: W32/AutoRun.bhyp Trojan.Heur.E5CD44 Win32.Trojan.WisdomEyes.16070401.9500.9985 W32/MalwareF.IWEH Win.Spyware.76175-2 Trojan.Win32.FrusEfas.iumlo Worm.Win32.Autorun.2101887 Trojan.MulDrop1.52015 BehavesLike.Win32.BadFile.vc W32/Risk.GYGM-4699 TrojanClicker.FrusEfas.a Trojan:Win32/Tofe.A Worm.AutoRun Trojan-GameThief.Win32.Magania


To that end, I have been working on automating ways to help ASERT better understand the context around samples so we can answer question about what may have been targeted, why it was targeted and when it was targeted.


A backdoor also known as: Backdoor.Simda.A Trojan.Beaugrit.S714409 Backdoor.Simda.A Trojan.Shiz.Win32.341 Trojan/Spy.Shiz.ncd Win32.Trojan-Spy.Shiz.b Backdoor.Trojan TROJ_BEAUGRIT_GC3101D5.UVPM Backdoor.Simda.A Backdoor.Simda.A TrojWare.Win32.Spy.Shiz.AB Backdoor.Simda.A Trojan.PWS.Ibank.300 TROJ_BEAUGRIT_GC3101D5.UVPM BehavesLike.Win32.Backdoor.jh Backdoor.Win32.Simda Backdoor.Simda.A Backdoor.Simda.A Backdoor.Simda TrojanSpy.Shiz!u9u05UapnAM W32/Shiz.NBX!tr


A backdoor also known as: W32.AutorunSevLnr.Worm Worm.AutoRun.Win32.27239 WORM_VERST.SM Win32.Worm.AutoRun.fp W32/Trojan2.OAQT WORM_VERST.SM Trojan.Win32.AutoRun.bxdzl W32.Virut.mDxm BackDoor.Pushnik.16 BehavesLike.Win32.Autorun.jc W32/Trojan.ORVC-8944 Worm/AutoRun.zqc W32.Worm.Lj Worm:Win32/Verst.A Trojan.Rimecud.2 Worm.Win32.A.P2P-Palevo.649216 HEUR/Fakon.mwf W32/Autorun.worm.bcf Worm.AutoRun Trojan.Dropper Win32/AutoRun.Delf.DK Trojan.Kryptik!Od8vCev28v4 Trojan.Win32.DNSChanger Trj/CI.A


A backdoor also known as: Trojan.Win32.FakeTool.eqvbgr Trojan.Strictor.D13D9C Riskware.HackTool!mJNDS6pSVDk HackTool.Win32.FakeHack


In this report, Trend Micro and ClearSky expose a vast espionage apparatus spanning the entire time the group has been active.


the first of a new wave of malspam.


MacSpy is advertised as the most sophisticated Mac spyware ever with the low starting price of free.


However, they do deploy some novel tactics, detailed below, and the implications of these attacks could be significant.


A backdoor also known as: W32.RsRabND.Worm Trojan.Ransom.BUY Trojan.Ransom.BUY Ransom.BadRabbit Win32.Trojan.Ransom.b Ransom_BADRABBIT.SM Win.Ransomware.BadRabbit-6355462-2 Trojan.Ransom.BUY Trojan-Ransom.Win32.BadRabbit.e Trojan.Ransom.BUY Trojan.Win32.BadRabbit.euhxbd Trojan.Win32.Ransom.441899 Trojan.Ransom.BUY Trojan.BadRabbit.2 Ransom_BADRABBIT.SM BehavesLike.Win32.Malware.gc Trojan.Win32.Diskcoder Trojan.BadRabbit.d TR/Dropper.uobxc Trojan.Ransom.BUY Trojan-Ransom.Win32.BadRabbit.e Trojan/Win32.Diskcoder.R211512 Trojan-Ransom.BadRabbit Trj/CI.A Trojan.Badrabbit Win32/Diskcoder.D Trojan.Diskcoder! ransom.BadRabbit Win32/Trojan.RansomBadRabbit.E


We actually track samples of Winnti malware all the time, but so far we haven't been able to catch one with solid clues indicating other targeted industries.


A backdoor also known as: TR/Drop.Hirin.B PWS:MSIL/Parple.B PWS.MSIL Trj/CI.A


Google's Threat Analysis Group TAG recently discovered usage of an unpatched security bypass in Microsoft's SmartScreen security feature, which financially motivated actors are using to deliver the Magniber ransomware without any security warnings.


A backdoor also known as: Hacktool.Gamehack Trojan.Packed.Win32.57174 Win32.Packed.VMProtect.a HT_GAMEHACK_GH01014A.UVPM HT_GAMEHACK_GH01014A.UVPM Trojan.VMProtect!


Few details were given and no hashes were available, which made it interesting to find samples and conduct an initial analysis.


Given its age, it might seem logical that security controls would have this threat on lockdown.


A backdoor also known as: Trojan.Win32.Clicker!BT Win32.Trojan.Wowlik.a W32/Trojan.AKEF-2737 Trojan.Win32.Graftor.espyif Win32.Trojan.Graftor.Llrb TrojWare.Win32.Wowlik.BE Trojan.DownLoader11.55853 Trojan.Graftor.D26FB7 TrojanClicker:Win32/Spackit.A Trojan.Win32.Clicker!BT Trj/CI.A Win32/Trojan.55a


What's particularly interesting is that the malware that was used this time is not BlackEnergy, which poses further questions about the perpetrators behind the ongoing operation.


A backdoor also known as: W97m.Downloader.EMU W97M.Downloader.MF W97M/Dropper.cp Troj.Dropper.Msword!c Trojan.Mdropper W2KM_DROPPR.CSYH W97m.Downloader.EMU W97m.Downloader.EMU W97m.Downloader.EMU Trojan:W97M/Nastjencro.A W97M.MulDrop.142 W2KM_DROPPR.CSYH W97M/Dropper.cp W97m.Downloader.EMU W97m.Downloader.EMU OLE.Win32.Macro.700400 virus.office.obfuscated.5


The version number was bumped to 1.6.2a.


Our research points to centralized planning and development by one or more advanced persistent threat APT actors.


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G W32/Virut.AM Win32/Virut.17408 PE_VIRUX.R Win32.Virus.Virut.U Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg W32.Virut.lqR9 Win32.Virut.56 Virus.Virut.Win32.1938 PE_VIRUX.R BehavesLike.Win32.VBObfus.dc W32/Virut.AM Win32/Virut.bt Virus/Win32.Virut.ce Win32.Virut.dd.368640 Virus.Win32.Virut.ce Win32/Virut.F Win32/Virut.NBP W32/Virut.CE Virus.Virut.14 W32/Sality.AO Virus.Win32.VirutChangeEntry.A


A backdoor also known as: W32.LionumD.Trojan Trojan.Injector.AF Trojan-Spy.Win32.Zbot!O Trojan.CoinMiner.Win32.82 Trojan.Injector.AF Trojan.Win32.Delf.bkqgta Trojan.Injector.AF Trojan.DownLoader7.62911 Trojan/Win32.Miner TrojanDownloader:Win32/Hoptto.B Trojan.Injector.AF Trojan.Injector.AF Trojan.Injector.AF Virus.Win32.DelfInject


Research reports on the adversary are published from LAC SecureWorks and Palo Alto Networks


A backdoor also known as: HW32.Packed.50FA Trojan.Win32.Pakes.miu Trojan.Symmi.D62C5 Trojan.Win32.Bepiv TR/Drop.RKit.CM Backdoor:WinNT/Tofsee.A.dr


The Root of All ( Android ) Evil So how does TrickMo get around these security features ? It abuses accessibility services .


A recent research by Check Point Research shows how voice phishing can be used to infiltrate the South Korean banking sector and extract private data from the victim's mobile device, and how to prevent it.


The malware goes to great lengths to identify a total of 24 potential security products that may be running on a system and customizes its installation mechanism to specifically evade those that are installed.


A backdoor also known as: Trojan.PWS.ZIY Trojan-PSW.Win32.Tepfer!O Trojan.Fareit.S467850 Trojan.Tepfer.Win32.85789 Trojan/Fareit.a Trojan.PWS.ZIY Win32.Trojan-PSW.Fareit.a Win32/PSW.Fareit.A BKDR_PONY.SM Win.Trojan.Fareit-403 Trojan.PWS.ZIY Trojan.Win32.Tepfer.dnnwuu Trojan.PWS.ZIY TrojWare.Win32.PWS.Fareit.GS Trojan.PWS.ZIY Trojan.PWS.Stealer.1932 BKDR_PONY.SM BehavesLike.Win32.ZBot.nh W32.Tepfer TR/PSW.Fareit.iloen Trojan[PSW]/Win32.Tepfer Trojan.Win32.PSW-Tepfer.92672 Trojan/Win32.Tepfer.R50650 Trojan.PWS.ZIY BScope.Malware-Cryptor.Ponik Spyware.Pony Trj/Tepfer.D Trojan.Fareit Win32.Outbreak Win32.Trojan-Stealer.Zbot.AB Win32/Trojan.PSW.5cd


A backdoor also known as: TSPY_DOWNLOADER_DD300501.UVPA Win32.Trojan.WisdomEyes.16070401.9500.9967 Infostealer.Donx TSPY_DOWNLOADER_DD300501.UVPA Trojan.Win32.VB.ckqm Trojan.VB.Win32.119679 BehavesLike.Win32.Sality.dm Worm.Win32.VB Trojan/VB.cvqf Trojan/Win32.VB Worm:Win32/Vberaspul.A Trojan.Heur.RX.E04E5F Trojan.Win32.VB.ckqm Trojan/Win32.VB.R85915 Trojan.VB Win32/AutoRun.VB.BDA Trojan.VB!nw7hcYRbBc8


A backdoor also known as: TROJ_CLICKER.API W32/Trojan.HUCV-9091 TROJ_CLICKER.API Win.Trojan.Clicker-2623 Trojan.Win32.Click.ddmsji W32/Trojan2.GMLR Adware/Clicker.hjb TrojanDownloader:Win32/Valfroc.A Win32.Trojan.Clicker.Tbip W32/CLICKER.API!tr Win32/Trojan.Multi.daf


Additionally , rootdaemon attempts to remove its own power usage statistics from Huawei phones ' SystemManager : Similarly , the malicious application probably attempts to minimize traces on Samsung phones by adding to the file /data/data/com.samsung.android.securitylogagent/shared_prefs/apm_sp_status_of_apps.xml the following lines : And adding to the file /data/data/com.samsung.android.securitylogagent/shared_prefs/com.samsung.android.securitylogagent_preferences.xml these lines instead : Data Collection and Exfiltration As mentioned , mike.jar equips the spyware with extensive collection capabilities , including : Retrieve a list of installed applications .


Seeing this type of activity typically indicates that a particular ransomware will see much wider distribution and thus a larger amount of victims.


A backdoor also known as: Trojan-Downloader.Win32.LibPatcher!O W32/Trojan.KFBA-3961 Trojan.KillAV Win32/KillAV.EA RTKT_BUREY.C TrojWare.Win32.AntiAV.~B Trojan.MulDrop.30985 Downloader.LibPatcher.Win32.272 RTKT_BUREY.C BehavesLike.Win32.Backdoor.mc W32/Dldr.Age.41984.C Trojan[Downloader]/Win32.LibPatcher Trojan:Win32/Perkesh.A Trojan/Win32.KillAV.R5311 Win32.Trojan-downloader.Libpatcher.Dumk Trojan-Downloader.Win32.Perkesh W32/Perkesh.A!tr Win32/Virus.81b


A backdoor also known as: W32.CKTNum.Trojan Virus.Win32.VB!O Virus.VB.Win32.90 W32.W.Mabezat.kZb9 Trojan.Heur.E2A0A7 Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Worm.EJIG-5497 Trojan.Killfiles Win32/Disackt.B TROJ_VB.BHC Trojan.Win32.VB.mrc Virus.Win32.VB.bcfhqp Win32.Trojan.Vb.Eddp TrojWare.Win32.VB.AMN TROJ_VB.BHC BehavesLike.Win32.Downloader.mz W32/Worm.AWSI Virus.VB.bc W32/Overwriter.A Worm:Win32/Disackt.A Trojan.Win32.VB.mrc TScope.Trojan.VB Win32/VB.AMN Trojan.VB!eJU5EBjve4c Virus.Win32.VB W32/VB.AMN!tr Trj/CI.A


A backdoor also known as: Trojan/W32.Small.49152.AYF Trojan.Dofoil.A Trojan/Kryptik.vgb Win32.Trojan.WisdomEyes.16070401.9500.9963 W32/Trojan.QQGJ-6488 Trojan.Win32.ULPM.eszgb Trojan.Yakes.Win32.1447 BehavesLike.Win32.Conficker.pc Trojan-Dropper.Win32.Injector W32/Kryptik.VIA!tr Trojan.Kazy.DABAF TrojanDropper:Win32/Finkmilt.C Trojan/Win32.Yakes.C144665 BScope.Trojan.Jorik.1421 Trojan.Kryptik!Y5cjjPIzRWk Bck/Qbot.AO Win32/Trojan.aeb


At the end of December 2015, the network system of Ukrainian power companies was attacked by


A backdoor also known as: W32/Socks.agz Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/Trojan2.BFTZ HT_PHDET_FD042CB0.UVPM Trojan.Win32.Socks.utqwi Trojan.MulDrop7.51577 HT_PHDET_FD042CB0.UVPM BehavesLike.Win32.Dropper.jc W32/Trojan.NOBV-3130 TrojanDownloader.Small.sui Worm/Win32.Socks Trojan:Win32/Phdet.E Worm.Win32.A.Socks.93017 SScope.Worm.Socks.afv Worm.Socks!GMlFK48cpa8 W32/Kryptik.BD!tr Win32/Trojan.e0b


Recently, WeipTech was analyzing suspicious Apple iOS tweaks reported by users and found over 225,000 valid Apple accounts with passwords stored on a server.


A backdoor also known as: W32.HfsAutoB.D676 Win32.Trojan.WisdomEyes.16070401.9500.9591 TR/Drop.Delfsnif.pmkbu TrojanDropper:Win32/Delfsnif.A


A backdoor also known as: Trojan-Dropper.Win32.AphexLace!O TrojanDropper.AphexLace Dropper.AphexLace.Win32.1 Troj.W32.Inject!c Trojan/Dropper.AphexLace.b Trojan.Heur.EA2D6B TROJ_APHEXLACE.D Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Dropper.IHO Trojan.Dropper TROJ_APHEXLACE.D Trojan.Win32.Inject.vgog Trojan.Win32.AphexLace.glqv Dropper.AphexLace.17920 TrojWare.Win32.TrojanDropper.AphexLace.B Trojan.MulDrop.12656 Trojan-Dropper.Win32.Delf W32/Risk.JBWO-6048 TrojanDropper.AphexLace.b TR/Drop.AphexLace.B Trojan[Dropper]/Win32.Poisoner TrojanDropper:Win32/AphexLace.B Trojan.Win32.Inject.vgog Dropper/Win32.Xema.C57521 TrojanDropper.Poisoner Win32/TrojanDropper.AphexLace.B Win32.Trojan.Inject.Dypn Trojan.DR.AphexLace!M08TVuH6+oM


Indicators related to the Sundown Exploit Kit


CopyCat is a fully developed malware with vast capabilities, including elevating privileges to root, establishing persistency, and to top it all - injecting code into Zygote.


A backdoor also known as: HW32.Packed.D9E5 TrojanSpy.Zbot Spyware.LokiBot Win.Packer.VbPack-0-6334882-0 Trojan-Spy.Win32.Zbot.yjsw Trojan.Win32.Zbot.etexpw Trojan.Win32.Z.Zbot.1081344 Trojan.PWS.Panda.12377 Trojan.Zbot.Win32.204854 BehavesLike.Win32.Fareit.tc Trojan.Win32.Injector TrojanSpy.Zbot.fkpq TR/AD.Zbot.cxjcv Trojan[Spy]/Win32.Zbot Trojan.Symmi.D1360F Trojan-Spy.Win32.Zbot.yjsw Trojan:Win32/Dukrid.A!bit Spyware/Win32.Zbot.R210148 TScope.Trojan.VB Trj/GdSda.A Win32.Trojan-spy.Zbot.Lqer TrojanSpy.Zbot!AasFtIJIGGs W32/Zbot.YJSW!tr Win32/Trojan.BO.553


The WordPress.org team has intervened and removed the plugin from the official WordPress Plugins repository.


It is likely these spearphishes are generated via a builder - so attribution to an exact group of attackers may be incorrect.


This campaign was found to be connected to the same party which previously targeted Vietnam Airlines and some other high profile targets possibly led by the Chinese 1937CN group.


A backdoor also known as: I-Worm.Stator.A Worm/W32.Stator.62976 Email-Worm.Win32.Stator!O W32.Stator.A Worm.Stator.Win32.3 W32/Stator.worm I-Worm.Stator.A W32/Stator.A W32.Stator@mm Win32/Stator.62464.A WORM_STATOR.A Win.Worm.Stator-1 I-Worm.Stator.A Email-Worm.Win32.Stator.a I-Worm.Stator.A Trojan.Win32.Stator.jahi I-Worm.Win32.Stator I-Worm.Stator.A EmailWorm.Win32.Stator.a0 I-Worm.Stator.A Win32.HLLW.Plict WORM_STATOR.A BehavesLike.Win32.Downloader.kc Email-Worm.Win32.Stator.a W32/Stator.A I-Worm/Stator.a Worm[Email]/Win32.Stator Worm:Win32/Stator.A@mm Email-Worm.Win32.Stator.a Trojan/Win32.HDC.C40377 I-Worm.Stator.A Win32.HLLW.Stator.A I-Worm.Stator.62464 Win32/Stator.62464 Win32.Stator.B W32/Stator.A


encrypt its APK and shell code,


It looked like a typical backdoor that could be uploaded anywhere on a compromised server, not just in this particular plugin.


Emissary is related to the Elise Trojan and the Operation Lotus Blossom attack campaign, which prompted us to start collecting additional samples of Emissary.


To quote the original article: It could be through attachments in spam messages, downloads from untrusted websites or something else.


Command Action Unistxcr Restart the app dowsizetr Send the file stored in the /sdcard/DCIM/.dat/ directory to the C & C server Caspylistx Get a list of all hidden files in the /DCIM/.dat/ directory spxcheck Check whether call details are collected by the spyware S8p8y0 Delete call details stored by the spyware screXmex Take screenshots of the device screen Batrxiops Check battery status L4oclOCMAWS Fetch the victim 's location GUIFXB Launch the fake Facebook login page IODBSSUEEZ Send a file containing stolen Facebook credentials to the C & C server FdelSRRT Delete files containing stolen Facebook credentials chkstzeaw Launch Facebook LUNAPXER Launch apps according to the package name sent by the C & C server Gapxplister Get a list of all installed applications DOTRall8xxe Zip all the stolen files and store in the /DCIM/.dat/ directory Acouxacour Get a list of accounts on the victim 's device Fimxmiisx Open the camera Scxreexcv4 Capture an image micmokmi8x Capture audio Yufsssp Get latitude and longitude GExCaalsss7 Get call logs PHOCAs7 Call phone numbers sent by the C & C server Gxextsxms Get a list of inbox SMS messages Msppossag Send SMS with message body sent by the C & C server Getconstactx Get a list of all contacts Rinxgosa Play a ringtone bithsssp64 Execute commands sent by the C & C server DOWdeletx Deletes the file specified by the C & C server Deldatall8 Delete all files stored in the /sdcard/DCIM/.dat/ directory We do n't have the space to cover all of the commands , but let 's take a look at some of the major ones .


It has been the subject of many analysis reports, including those describing targeted espionage campaigns like Operation Night Dragon and the GhostNet attacks on Tibet.


A backdoor also known as: Trojan.Miner Troj.W32.Miner!c Trojan.MulDrop7.60223 TR/Muldrop.jzijj Trojan.Win32.Miner.tjvn


The threat actor's campaigns attempt to convince high-profile North American and European government officials as well as CEOs of prominent companies and celebrities into participating in recorded phone calls or video chats.


The earliest evidence obtained shows it has been in use since at least November 2016.


The hash listed in the Pastebin led us to a malicious Word document that had also been uploaded to a public sandbox.


A backdoor also known as: Ransom/W32.Locky.48128 Exploit.Cve20151701 Win32.Trojan.WisdomEyes.16070401.9500.9999 Exploit.Win32.CVE-2015-1701.bd Exploit.Win32.CVE20151701.euekja Trojan.Win32.LockCrypt.48128.A Trojan.Encoder.12135 BehavesLike.Win32.Mydoom.pm W32/Trojan.JPLA-3344 Exploit.CVE-2015-1701.ar TR/AD.RansomHeur.fbqvj Exploit.W32.Cve!c Exploit.Win32.CVE-2015-1701.bd Ransom:Win32/LockCrypt.A!bit Trojan/Win32.Scar.R211760 Exploit.CVE-2015-1701 Ransom.DXXD Trj/GdSda.A Trojan.Win32.Filecoder Win32.Trojan-Ransom.LockCrypt.A Win32/Trojan.Exploit.3d9


This is exactly what we saw in late October and early November 2016, when the espionage group Pawn Storm also known as Fancy Bear, APT28, Sofacy, and STRONTIUM ramped up its spear-phishing campaigns against various governments and embassies around the world.


A backdoor also known as: Virus.Win32!O W32.Etap W32/Etap.dr Win32.Trojan.WisdomEyes.16070401.9500.9929 W32.Simile Virus.Win32.Etap Win32.Etap.E Win32/Linux.Etap W32/Etap.dr Virus.Win32.Etap Backdoor/Hupigon.ish Virus/Win32.Etap Trojan.Kazy.D65E9 Virus.Win32.Etap Backdoor:Win32/Etap.dr Win32/Etap.E W32/Etap.D


Furthermore, each of the stages used different development platform and was obfuscated in a different way.


Rather than simply copying the features that were present within the Zeus trojan as-is Floki Bot claims to feature several new capabilities making it an attractive tool for criminals.


A backdoor also known as: Worm/W32.Silva.447488 Worm.Keco W32.W.Silva.d!c W32/Silva.d W32/Silva.D W32.Silva@mm Trojan.Win32.Silva.envq Worm.Win32.Silva.D Win32.HLLW.Silva Worm.Win32.Silva W32/Silva.QGXV-8360 I-Worm/Silva.d Worm:Win32/Silva.D@mm Worm:Win32/Silva.D@mm Email-Worm.Keco W32/Keco.G.worm Win32/Silva.D Win32.Worm-email.Keco.Peze I-Worm.Silva!97fYr5ijFvQ W32/Silva.D@mm


Below are a couple of images of the panel that the attacker would be utilizing.


A backdoor also known as: Trojan.BHO.Delf.T Trojan.Win32.Delf!O Trojan.Lnkhyd.A7 Trojan.Delf.Win32.15794 Troj.W32.Delf.lV2h Win32/Delf.AXIT TROJ_DELF.PVC Win.Trojan.Delf-11211 Trojan.BHO.Delf.T Trojan.Win32.Delf.ssh Trojan.BHO.Delf.T Trojan.Win32.Delf.cjzwb Trojan.Win32.Delf.157696.J Trojan.BHO.Delf.T TROJ_DELF.PVC Trojan.Lnkhyd Trojan/Delf.mdz Trojan:Win32/Lnkhyd.A Trojan/Win32.Delf Trojan.BHO.Delf.T Trojan.Win32.Delf.ssh Trojan:Win32/Lnkhyd.A Trojan/Win32.Fides.R3508 Trojan.BHO.Delf.T TScope.Trojan.Delf Win32.Trojan.Delf.Ednr Trojan.Win32.BHO.R


Interaction with these servers is performed in two different threads.


They use compromised e-mail accounts to distribute their malware widely and their targeting appears opportunistic rather than specific.


A backdoor also known as: PUP.Riskware.Tool Trojan.Win32.Cindyc.wrlqe TR/DyCode.A.110 Backdoor/Cindyc.bv Win32.Troj.Undef.kcloud Trojan:Win32/DyCode.A Backdoor.Win32.A.Cindyc.141184 Backdoor/Win32.Cindyc Backdoor.Cindyc.adk Backdoor.Win32.Cindyc Trj/CI.A


Credit card industry giant Visa on Friday issued a security alert warning companies using point-of-sale devices made by Oracle s MICROS retail unit to double-check the machines for malicious software or unusual network activity, and to change passwords on the devices.


The dropper family, referred to internally as PNG_dropper, was observed being used as a second stage tool in different targeted attacks.


A backdoor also known as: Trojan.StartPageCRTD.Win32.8798 Win32.Trojan.WisdomEyes.16070401.9500.9990 Trojan.Win32.Clicker!BT Trojan.MSIL.EzirizNetReactor TR/Dropper.MSIL.76348 TrojanClicker:MSIL/Balamid.B Trojan.Jatif.32 Trojan/Win32.FakeMS.R113384 Trojan.Win32.Clicker!BT Win32/Trojan.Dropper.2f1


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9589 TROJ_DELF.IVW Trojan-Downloader.Win32.Delf.acc Troj.Downloader.W32.Delf!c Win32.Trojan-downloader.Delf.Edoh TrojWare.Win32.TrojanDownloader.Delf.~ABI Trojan.DownLoader.46506 Trojan-Downloader.Win32.Delf.ACC TrojanDownloader.Delf.fqq Trojan[Downloader]/Win32.Delf Win32.TrojDownloader.Delf.ac.kcloud Trojan.Downloader.bGWcaOz2KakG Trojan.Win32.A.Downloader.34816.FA Trojan-Downloader.Win32.Delf.acc Trj/Banbra.FSU Win32/Trojan.Downloader.dac


It does this by leveraging the Android plugin technology.


Trojan Ransom Xpan was created by an organized gang, which used targeted attacks via RDP that abused weak passwords and wrong implementations.


The operators have used use a range of techniques to target Windows computers and Android phones with the apparent goal of penetrating the computers of well-connected individuals in the Syrian opposition.


On the network traffic analysis end, post compromise activity results in some interesting but not unexpected activity.


Based on this evidence we believe this new malware is likely targeting South Koreans.


A series of malware attacks targeting users of cryptocurrency wallets has been identified by security firm Kaspersky, which has developed an anti-malware solution to detect and prevent such attacks in the future.


A backdoor also known as: Virus/W32.Patched.P W32.Patched.QC1 Trojan.Razy.D19982 PE_PATCHED.SMB Win32.Trojan.ImPatch.a W32/Floxif.A PE_PATCHED.SMB Trojan.Win32.Patched.qc Troj.W32.Patched.lnCt Trojan.Starter.3187 W32/Floxif.A Trojan.Win32.Patched.qc Trojan.Patched.al W32/Patched.AL Virus.Win32.Loader.abd Trojan.Win32.Patched W32/Patched.AL!tr Virus.Win32.Patched.DG


A backdoor also known as: W32.OnGamesGBTOFAB.Trojan Trojan-Dropper.Win32.Dapato!O Trojan/Vilsel.bftr Trojan-Dropper.Win32.Dapato.bzqh Trojan.Win32.Vilsel.dktcmg Trojan.Vilsel.Win32.24133 Trojan-PWS.Win32.QQPass TrojanDropper.Dapato.jop Trojan/Win32.Vilsel Win32.Troj.Vilsel.kcloud Trojan-Dropper.Win32.Dapato.bzqh Trojan.Vilsel


Most users are pushing a variety of information stealers with the service.


First, users cannot easily spot any malicious behavior since PowerShell runs in the background.


root9B's analysis determined that the adversary is using advanced memory-resident techniques to maintain persistence and avoid detection.


The malware has a remote controlling function, and attackers sending these emails seem to attempt intruding into the targets' network using the malware.


A backdoor also known as: Virus.Win32.Sality!O Ransom.Exxroute.A3 Trojan.Kryptik.Win32.1099877 Troj.Downloader.W32.Banload.l42y Ransom_CERBER.SM3B Win32.Trojan.Kryptik.bjm W32/Trojan.FUEH-0857 Backdoor.Trojan Ransom_CERBER.SM3B Trojan.Encoder.10103 BehavesLike.Win32.Cutwail.ph Trojan.Spora.mw TR/AD.Spora.svton Trojan[Ransom]/Win32.Spora Trojan.Symmi.DB88E Ransom:Win32/Spora.A Hoax.Spora Virus.Win32.VBInject


A backdoor also known as: BKDR_PIRPI.YE Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan BKDR_PIRPI.YE Trojan.Heur.LP.E69C7F Trojan:Win32/Pirpi.O Win32.Backdoor.Backdoor.Hwmn Win32/Trojan.9b5


A backdoor also known as: TSPY_MAJIKPOS.SMA Trojan.Majikpos TSPY_MAJIKPOS.SMA Trojan.DownLoader23.50404 W32/Trojan.QKOU-4044 Trojan.MSIL.Krypt.2 TrojanSpy:MSIL/Majikpos.A Spyware/Win32.Majikpos.C1861368 Trj/GdSda.A PUA.BrowseSmart Win32/Trojan.d60


The DragonOK group has been actively launching attacks for years.


A backdoor also known as: W32.OnGameMITL.Trojan RDN/Downloader.a!vq Win32.Trojan.WisdomEyes.16070401.9500.9883 Trojan.FakeAV Trojan.DownLoad.41552 BehavesLike.Win32.Backdoor.ch Trojan.Win32.Redosdru Trojan/PSW.WOW.amc TrojanDownloader:Win32/Induiba.A Trojan.Heur.RP.EEBC2E Trj/CI.A


By analyzing the TaskManager class we can see the new commands that are supported at this stage : As can be seen in the code snippet above , there are quite a lot of data collection tasks that are now available : Collect device info Track location Upload contacts information Upload sent and received SMS messages Upload images Upload video files Send recursive dirlist of the external storage Upload specific files Record audio using the microphone Record calls Use the camera to capture bursts of snapshots Those tasks can either run periodically , on event ( such as incoming call ) or when getting a command from the C & C server .


A backdoor also known as: Trojan.Win32.Kargatroj!O Trojan.Kargatroj.Win32.5 BKDR_DEPPEELS.A Win32.Trojan.WisdomEyes.16070401.9500.9993 W32/Trojan.FYPB-4329 Backdoor.Kargatroj BKDR_DEPPEELS.A Win.Trojan.Kargatroj-5 Trojan.Win32.Kargatroj.a Trojan.Win32.Kargatroj.zribt Trojan.Win32.A.Kargatroj.288256 Trojan.Click2.18984 BehavesLike.Win32.Virus.dh Backdoor.Win32.IRCBot Trojan/Kargatroj.e WORM/Autorun.Agr.3 Trojan/Win32.Kargatroj Backdoor:Win32/Deppeels.A Trojan.Win32.Kargatroj.a Trojan/Win32.Kargatroj.R50492 Trojan.Kargatroj Trojan.Kargatroj!+VQ4l8zO8kI


We refer to this utility as BOOTRASH.


A backdoor also known as: W32.W.Fujack.lmEa Trojan.Dropper Win.Trojan.Packed-24 Trojan.Win32.Baidu.iidnc Trojan.Win32.A.PSW-Magania.1913020.A Trojan/Win32.Zegost Trojan.Zusy.D88F TrojanDropper:Win32/Demekaf.A Trojan.MalPack.NSPack Win32/TrojanDropper.Demekaf.A Trojan.Win32.Jorik W32/Obfuscated.AAAD!tr Win32/Trojan.4b9


A backdoor also known as: Trojan-Dropper/W32.Hirhir.2779437 TrojanDropper.Hirhir.20 Trojan/Dropper.Hirhir.20 Trojan-Dropper.Win32.Hirhir.20 Win32/TrojanDropper.Hirhir.20 W32/Hirhir.A Trojan.Dropper W32/Smalldrp.BTL Win32.Dropper.Hirhir Trojan.Dropper-1156 Trojan-Dropper.Win32.Hirhir.20 Trojan.Dropper.Hirhir.2.0 TrojWare.Win32.TrojanDropper.Hirhir.20 Trojan.Dropper.Hirhir.2.0 Trojan.MulDrop.1734 TR/Drop.Hirhir.20.5 TROJ_HIRHIR.20 Trojan.Drop.Hirhir.20.5 Win32/DigitalM.10 W32/Hirhir.A TrojanDropper.Dmexeb.10 Trojan-Dropper.Win32.Hirhir.20!IK TrojanDropper:Win32/Hirhir.2_0 Trojan.Win32.Hirhir.2164429 Trojan.Dropper.Hirhir.2.0 Dropper/Hirhir.11776 Win32.TrojanDropper.Hirhir.20 Trojan.DR.Hirhir.H Trojan.Dmexeb.10 Trojan-Dropper.Win32.Hirhir.20 W32/Hirhir.A!tr.dr Dropper.Hirhir Trj/Hirhir.A


A backdoor also known as: W32.FamVT.ExpiroPC.PE TROJ_ZYX_BK083A77.TOMC Heur.Corrupt.PE TROJ_ZYX_BK083A77.TOMC Trojan-Downloader.Win32.Vorloma TrojanDownloader:Win32/Vorloma.A


A backdoor also known as: PE:Trojan.Win32.Xcomp.a!1075128424 Heur.Packed.MultiPacked DDoS.Rincux Backdoor.Httpbot.Win32.799 BehavesLike.Win32.Trojan.cz Backdoor:Win32/Luder.H Trojan/Win32.Injector Virus.Win32.Heur.c Trj/CI.A Packed.Win32.PolyCrypt Trojan.Win32.Downloader.aC


The specific points of connection between these new samples and Operation Blockbuster include: payloads delivered by the macros discussed in Operation Blockbuster Sequel


A backdoor also known as: Trojan.ADH.2 Win.Trojan.Mediyes-1761 Trojan.Hosts.5806 Trojan.VBCRTD.Win32.7945 Trojan:Win32/Mediyes.C Trojan.Pirminay Trojan.Win32.Mediyes


A backdoor also known as: Backdoor.Aimaster.A Backdoor/W32.Aimaster.49152 Backdoor.Aimmaster Backdoor.RAT.Aimaster Backdoor.Trojan Win32/Aimaster.A BKDR_AIMASTER.A Win.Trojan.Aimaster-4 Backdoor.Win32.Aimaster Backdoor.Aimaster.A Trojan.Win32.Aimaster-Bd.fdhc Win32.Backdoor.Aimaster.Ahyt Backdoor.Aimaster.A Backdoor.Win32.Aimaster.A Backdoor.Aimaster.A BackDoor.Master.10 BackDoor-XT.svr W32/Risk.FHHV-3782 BDS/Aimaster.B W32/Aimaste.A!tr.bdr Trojan[Backdoor]/Win32.Aimaster Backdoor.Aimaster.A Backdoor.W32.Aimaster!c Backdoor.Win32.Aimaster Trojan/Win32.Aimaster.C662411 BackDoor-XT.svr Backdoor.Aimaster Backdoor.Aimaster!2o1TvHIl4Fg Backdoor.Aimaster.A Win32/Backdoor.IM.d95


The data available in the leaked Hacking Team files provides circumstantial evidence pointing to an interest in compromising individuals with ties to South Korea i.e., Korean language speakers who use software or apps popular in South Korea, or South Korean editions of Samsung phones.


A backdoor also known as: Backdoor/W32.Amitis.827392 Backdoor.Amitis!GgBFlh0m/G4 W32/Amitis.MXVV-8538 Backdoor.Amitis Win32/Amitis.13 BKDR_AMITIS.B Trojan.Amitis.13-B Backdoor.Win32.Amitis.13 Trojan.Win32.Amitis.dbhy Backdoor.Win32.S.Amitis.827392.A[h] Backdoor.W32.Amitis.13!c Backdoor.Win32.Amitis.13 BackDoor.Amitist.13 Backdoor.Amitis.Win32.17 BKDR_AMITIS.B BehavesLike.Win32.Downloader.ch W32/Amitis.N@bd Backdoor/Amitis.p W32/Amitis.C!tr Trojan[Backdoor]/Win32.Amitis Win-Trojan/Amitis.827392 Backdoor:Win32/Amitis.1_3 Win32/Amitis.13 Backdoor.Amitis Win32.Backdoor.Amitis.Akfc Backdoor.Win32.Amitis BackDoor.Amitis.G Backdoor.Win32.Amitis.13


A backdoor also known as: HackTool.Patcher Backdoor.RBot.Win32.54805 Troj.GameThief.W32.Magania.lHhM Multi.Threats.InArchive W32.Pilleuz Win.Worm.Mytob-399 Trojan.Win32.Rbot.bhwabq Heur.Packed.Unknown Win32.HLLW.MyBot.based Trojan[Backdoor]/Win32.Rbot Trojan/Win32.Malco.R7515 Trj/CI.A Win32.Viking.BJ Backdoor.Win32.Rbot


A backdoor also known as: Trojan.Win32.Mlw.ewdlbx TR/Dropper.lusig Trojan.Win32.Eightow Trj/CI.A


Though Orcus has all the typical features of RAT malware, it allows users to build custom plugins and also has a modular architecture for better management and scalability.


A backdoor also known as: Win32.Worm.SdDrop.C Worm.Sddrop W32/Sddrop.worm.c!p2p Win32.Worm.SdDrop.C Win32.Trojan.WisdomEyes.16070401.9500.9999 W32.Kwbot.Worm Unix.Tool.IRC-1 Win32.Worm.SdDrop.C P2P-Worm.Win32.SdDrop.c Win32.Worm.SdDrop.C Trojan.Win32.SdDrop.entp W32.W.SdDrop.c!c Win32.Worm.SdDrop.C Win32.Worm.SdDrop.C Win32.SdDrop.3 Worm.SdDrop.Win32.21 W32/Sddrop.worm.c!p2p Backdoor.Win32.SdBot I-Worm/P2P.SdDrop.c BDS/Sdbot.AA Worm[P2P]/Win32.SdDrop Worm:Win32/Sddrop.C P2P-Worm.Win32.SdDrop.c Trojan/Win32.HDC.C38855 Win32.Worm.SdDrop.C Backdoor.Sdbot Trj/CI.A Worm.SdDrop Win32/Sddrop.C Win32.Worm-p2p.Sddrop.Lknd Worm.P2P.SdDrop!LrfriCz8zKY W32/KWBot.E!worm


Recently, the FortiGuard Labs research team observed that a new variant of Poison Ivy was being spread through a compromised PowerPoint file.


Many victims have discussed YiSpecter infections of their jailbroken and non-jailbroken iPhones in online forums and have reported the activity to Apple.


The campaign operated out of handful of IPs, but we ended up finding in excess of 80K malicious subdomains associated with more than 500 domains leveraging various registrant accounts.


A backdoor also known as: Udsdangerousobject.Multi TROJ_DLOADR.YLP TROJ_DLOADR.YLP Trojan.Win32.Dwn.dcbaru Trojan.Win32.Z.Tapaoux.49152 Trojan.DownLoader11.19325 W32/Trojan.FALA-2329 TR/Rogue.icdl Trojan.DownLoader! Trojan.Rogue


A backdoor also known as: Trojan.MSIL.Bladabindi.1 Win32.Trojan.WisdomEyes.16070401.9500.9922 Trojan.Win32.Bladabindi.etjjte Trojan.Win32.Z.Clicker.90624 Trojan.Win32.Clicker!BT BehavesLike.Win32.PWSZbot.mm Trojan.Win32.Clicker!BT Trj/Chgt.O Win32.Outbreak


The file size of the malware is mostly around ~50Kb, as you can see from the list of sample hashes at the end of this report.


A backdoor also known as: W32.YahooPass.Spyware Backdoor.Win32.Bredavi!O Backdoor.Bredavi.Win32.215 Backdoor.W32.Bredavi.kYWA Backdoor/Bredavi.le Win32.Trojan-PSW.Yahoo.a Backdoor.Trojan Win32/Bredolab.PS Win.Trojan.Bredolab-1635 Trojan.Win32.Krap.ihir Backdoor.Win32.Bredavi.348960 Application.Win32.Adware.Superjuan.~JAJ Trojan.BhoSpy.97 Trojan.Win32.Glecia Backdoor/Bredavi.bf BDS/Glecia.A Trojan[Backdoor]/Win32.Bredavi Adware.Heur.E51E88 Trojan/Win32.Bredavi.C83160 Backdoor.Bredavi Trj/Sinowal.WNX Win32/PSW.YahooPass.NAD


A backdoor also known as: Email-Worm.Win32.Scano!O W32/Scano.bm WORM_SCANO.BT Win32.Worm.Scano.a W32.Areses.P@mm WORM_SCANO.BT Win.Worm.Scano-70 Email-Worm.Win32.Scano.bm Trojan.Win32.LdPinch.fmye I-Worm.Win32.A.Scano.105231 W32.W.Otwycal.l7h6 Win32.HLLM.Perf Worm.Scano.Win32.69 BehavesLike.Win32.Autorun.cm Email-Worm.Win32.Scano Worm/Scano.at W32.Worm.Areses Worm[Email]/Win32.Scano Email-Worm.Win32.Scano.bm Worm/Win32.Scano.R1851 BScope.Trojan-Dropper.Injector Win32/Scano.BM I-Worm.Scano!zrLOU/XMrws W32/Scano.AA@mm


A backdoor also known as: Trojan.Fsysna Win32.Trojan.WisdomEyes.16070401.9500.9969 Trojan.Win32.Fsysna.eqvl Trojan.Win32.Z.Strictor.607232.C Trojan.MulDrop7.49159 Trojan.Fsysna.Win32.15357 Trojan.MSIL.Spy TrojanSpy:MSIL/Logadat.A Trojan.Win32.Fsysna.eqvl Trojan.Fsysna Trj/GdSda.A Win32.Trojan.Fsysna.Lqym


The report includes extra detail to help potential targets recognize similar attacks.


ThreatStream Labs recently became aware of a campaign beginning on 30 June 2015 by the omniprescent Wekby threat actors a/k/a TG-0416, APT-18, Dynamite Panda.


Adding this extra layer of filtering may help the group focus on targets of interest and evade detection due to use of known malware.


A backdoor also known as: W97M.Downloader TROJ_CVE201711882.E Exploit.Xml.CVE-2017-0199.equmby Xml.Exploit.Cve!c TROJ_CVE201711882.E Malicious_Behavior.SB DOC.S.Exploit.11442 XML/Dloader.S1 Exploit.CVE-2017-0199 XML.Exploit.CVE-2017-0199.E


It was a standalone utility with the name HDD Rootkit for planting a bootkit on a computer.


A backdoor also known as: Win32/Goft.B Trojan.Win32.cvrsqp.eaqdwq Trojan.MyRunner BehavesLike.Win32.PWSZbot.nc Virus.Win32.AA Trojan/PSW.QQPass.fx Trojan/Win32.QQTail.R5474


It provides the same functionality you would expect from a remote access tool: keylogging, webcam access, microphone access, remote desktop, URL download, program execution, etc.


Attacks that use completely fileless malware are a rare occurrence, so we thought it important to discuss a new trojan known as JS_POWMET Detected by Trend Micro as JS_POWMET.DE, which arrives via an autostart registry procedure.


As you can see in the sample list below, this means that many school employees will have received this spam, as K-12 schools very commonly use .us domain names.


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G PE_VIRUX.R W32/Virut.AM Win32/Virut.17408 Trojan.Scar PE_VIRUX.R Win.Trojan.Virtob-1456 Win32.Virus.Virut.U Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg Virus.Win32.Virut.CE Win32.Virut.56 Virus.Virut.Win32.1938 BehavesLike.Win32.Virut.qh W32/Virut.AM Virus/Win32.Virut.ce Win32.Virut.dd.368640 W32.Virut.lqR9 Virus.Win32.Virut.ce Trojan:Win32/QHosts.BR Win32/Virut.F Virus.Virut.14 W32/Sality.AO Win32/Virut.NBP Trojan.Win32.Downloader.toh Trojan.Win32.Scar Virus.Win32.VirutChangeEntry.A


All of these attacks leveraged CVE-2014-4114 and were delivered via malicious Microsoft PowerPoint Slideshow files *.pps.


Brambul and Joanap appear to be used to download extra payloads and carry out reconnaissance on infected computers.


A backdoor also known as: Packed.Win32.Tibs!O Worm.Zhelatin Trojan.Heur.RP.fqWcaaXp5um Win32.Trojan.WisdomEyes.16070401.9500.9882 W32/Trojan.LQOD-4441 Trojan.Dropper Email-Worm.Win32.Zhelatin.rn Trojan.Win32.Z.Zhelatin.88576 MalCrypt.Indus! Trojan.Spambot.2559 Email.Worm.W32!c Email-Worm.Win32.Zhelatin.rn Worm/Win32.Zhelatin.R38109 BScope.Trojan.Zhelatin.12 Trj/CI.A Win32/Nuwar.BH Win32.Worm-email.Zhelatin.Sxxs Worm.Win32.Nuwar Win32/Worm.Email-Worm.43d


A backdoor also known as: Backdoor.Rustock.NDU Backdoor.Win32.Rbot!O Backdoor.Rustock.NDU Backdoor.Rbot Win32.Trojan.WisdomEyes.16070401.9500.9989 W32/Trojan.TDBQ-4167 Backdoor.Rustock.B Win.Trojan.Crypt-278 Backdoor.Rustock.NDU Backdoor.Win32.Rbot.szn Backdoor.Rustock.NDU Backdoor.Win32.A.Rbot.70656.J Backdoor.Rustock.NDU Backdoor.Rustock.NDU Trojan.Fakealert.33205 BehavesLike.Win32.Downloader.kt Rootkit.KernelBot.m TR/Tiny.705 Backdoor.Rustock.NDU Backdoor.Win32.Rbot.szn Trojan:Win32/Silentbanker.B Worm/Win32.IRCBot.C36854 Backdoor.Rbot Trj/CI.A Win32.Backdoor.Rbot.Aiik Virus.Win32.Virut.n W32/RBot.SZN!tr.bdr Win32/Backdoor.0a5


During a recent United States Secret Service investigation, Trustwave encountered a new family of POS malware, that we named Punkey.


A backdoor also known as: Trojan/W32.FakeAV.29696.H Backdoor.Ziyazo Trojan.Graftor.D21706 TROJ_FAKEAV.ORH Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan.B TROJ_FAKEAV.ORH Win.Trojan.Ziyazo-1 Trojan.Win32.FakeAv.cuscpt Troj.W32.FakeAv.rxda!c Trojan.Fakealert.45728 Trojan.FakeAV.Win32.293288 BehavesLike.Win32.Backdoor.mc W32/Trojan.TSSV-1630 Trojan/Fakeav.blva Trojan/Win32.FakeAv Backdoor:Win32/Ziyazo.A Trojan/Win32.FakeAV.R94861 Trj/Dynamer.A Trojan.FakeAv!73pMuD6/3rE Trojan.Win32.FakeAV W32/FakeAv.RXDA!tr


Subsequent to the publishing of this article, through cooperation with the parties responsible for the C2 domains, Unit 42 researchers successfully gained control of multiple C2 domains.


A backdoor also known as: Hacktool.Superscan Trojan.Win32.XFMP5368.dfvidz HackTool:Win32/SuperScan.A


Lurk was believed to have siphoned over $45 million from financial organizations, ultimately disrupting the victims' operations, reputation, and bottom line.


While Empire RIG-E disappeared at the end of December after 4 months of activity on 2017-02-17 an advert for a new exploit kit dubbed Nebula appeared underground.


A powerful threat actor known as Wild Neutron also known as Jripbot and Morpho has been active since at least 2011, infecting high profile companies for several years by using a combination of exploits, watering holes and multi-platform malware.


A backdoor also known as: Application.Hacktool.Pipecmd.B HackTool.Pipecmd Win32.HackTool.Pipecmd.a Application.Hacktool.Pipecmd.B Application.Hacktool.Pipecmd.B Application.Hacktool.Pipecmd.B Trojan.Starter.5008 BehavesLike.Win32.PUP.lc Application.Hacktool.Pipecmd.B Trojan/Win32.Inject.C500093


Following a three-month hiatus, Emotet spam activities resumed in March 2023, when a botnet known as Epoch 4 began delivering malicious documents embedded in Zip files that were attached to the emails.


A backdoor also known as: Ransom.Sage.S1609000 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.TNMG-4793 Ransom.Cry Trojan.Win32.Yakes.etrgag BehavesLike.Win32.Ramnit.fc TR/AD.MalwareCrypter.zdeue Trojan.Zusy.D3FCFB Trojan/Win32.Yakes.C2201035 Trojan.Yakes Trojan.Yakes!KiOJwMzaTlA


Bots can use various methods to establish a line of communication between themselves and their command-and-control C C server.


Knowledge of the threat landscape and implementation of the right detection tools remains crucial to be able to protect yourself from fraud ; Cerberus is yet a new Trojan active in the wild ! Appendix Samples Some of the latest Cerberus samples found in the wild : App name Package name SHA 256 hash Flash Player com.uxlgtsvfdc.zipvwntdy 728a6ea44aab94a2d0ebbccbf0c1b4a93fbd9efa8813c19a88d368d6a46b4f4f Flash Player com.ognbsfhszj.hqpquokjdp fe28aba6a942b6713d7142117afdf70f5e731c56eff8956ecdb40cdc28c7c329 Flash Player com.mwmnfwt.arhkrgajn ffa5ac3460998e7b9856fc136ebcd112196c3abf24816ccab1fbae11eae4954c Flash Player com.wogdjywtwq.oiofvpzpxyo 6ac7e7ed83b4b57cc4d28f14308d69d062d29a544bbde0856d5697b0fc50cde4 Flash Player com.hvdnaiujzwo.fovzeukzywfr cfd77ddc5c1ebb8498c899a68ea75d2616c1c92a0e618113d7c9e5fcc650094b Flash Player com.gzhlubw.pmevdiexmn 3f2ed928789c200e21fd0c2095619a346f75d84f76f1e54a8b3153385850ea63 Target list The actual observed list of mobile apps targeted by Cerberus contains a total of 30 unique applications .


CVE-2015-5122 was the second Adobe Flash zero-day revealed in the leak of HackingTeam's internal data.


At the peak of procrastinators filing their taxes at the last minute, those who send in their tax forms are exactly the technically less-sophisticated users these kinds of campaigns target.


A backdoor also known as: Worm/W32.Vesenlosow.1237156 Worm.Vesenlosow Worm.VB.Win32.13725 W32.W.Vesenlosow.luZW Trojan/VB.nzt WORM_VESENLO.SMA Win32.Worm.VB.m W32.Winiga WORM_VESENLO.SMA Trojan.Win32.Vesenlosow.bclidy Worm.Win32.A.Vesenlosow.909312 Trojan.MulDrop3.6950 BehavesLike.Win32.Rontokbro.tm Trojan.Win32.VB Worm/Vesenlosow.q WORM/VB.argu Trojan/Win32.VB Worm:Win32/Vesenlosow.A Trojan/Win32.VB.R46099 Trojan.Keylogger.1021 W32/Vobfus.GEP.worm Win32.Virut.NBP Win32/VB.NZT Win32.Worm.Vb.Akzk Worm.Win32.Msmm.A


A backdoor also known as: VB:Trojan.Valyria.1034 VBS/Downldr.IA W97M.Dropper TROJ_RUBREG.SM VB:Trojan.Valyria.1034 Trojan.Script.ExpKit.evbkht Troj.Downloader.Script!c VB:Trojan.Valyria.1034 VB:Trojan.Valyria.1034 VBS.DownLoader.1040 TROJ_RUBREG.SM VBS/Downloader.ea VBS/Downldr.IA TrojanDownloader:VBS/Vibrio.P VB:Trojan.Valyria.D40A VBS/Downloader.ea virus.vbs.houdini.b


A backdoor also known as: Trojan.Win32.Mydse!O TrojanDropper.Goriadu Win32.Trojan.WisdomEyes.16070401.9500.9578 TROJ_GORIADU.SMX Trojan.Win32.Mydse.az Trojan.Win32.Click.tdtvg TROJ_GORIADU.SMX BehavesLike.Win32.BadFile.fh Trojan-Clicker.ANTO TR/Clicker.9984610 Win32.Troj.AntiCloudAV.d.kcloud TrojanDropper:Win32/Goriadu.A!bit Trojan.Zusy.D38CD Trojan.Win32.Mydse.az W32/GORIADU.SMX!tr


Who is affected ? Gooligan potentially affects devices on Android 4 ( Jelly Bean , KitKat ) and 5 ( Lollipop ) , which is over 74 % of in-market devices today .


Figure 1 shows embedded URL in an Elirks sample found in early 2016.


This malware is well-known for its ability to steal credentials and quickly spread through an enterprise over network shares.


A backdoor also known as: W32.eHeur.Virus02 Adware.Heur.E101B3 Win32.Trojan.BHO.r Trojan.Win32.BHO.bropxr Adware.Softomate.603 Trojan:Win32/Jifcapi.A


A backdoor also known as: Trojan.Kromebit TROJ_KROMEBIT.SM Win32.Trojan.WisdomEyes.16070401.9500.9982 TROJ_KROMEBIT.SM Trojan.Win32.Dwn.eurwpx Trojan.Win32.Z.Kromebit.1068032 Trojan.DownLoader25.50889 BehavesLike.Win32.Dropper.tt W32/Trojan.EJDN-0785 Trojan:Win32/Kromebit.B Trj/CI.A Trojan.Win32.Kromebit W32/KROMEBIT.SM!tr


The report closes with some security suggestions, highlighting the importance of two-factor authentication.


This week the spam party did not just include CERBER, but also decided to invite an old friend – the KOVTER family.


Tofsee, also known as Gheg, is another botnet analyzed by CERT Polska.


A backdoor also known as: Trojan/W32.Small.15616.H Trojan.Bibei.A6 Bibei.a Win.Trojan.Rootkit-3954 Trojan.Win32.NtRootKit.rigfr TrojWare.Win32.Olmarik.AWI Trojan.NtRootKit.12543 Bibei.a TR/Offend.69286423 Trojan.Zusy.D27F7 Trojan:WinNT/Bibei.A


A backdoor also known as: Trojan/W32.Propas.110663 Trojan.Heur.RP.EDD84E Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/Trojan.AQD TROJ_PASSPRO.C Win.Trojan.Enfal-62 Trojan.PWS.Winlog TROJ_PASSPRO.C BehavesLike.Win32.Dropper.ch W32/Trojan.IWQS-9238 Trojan:Win32/Propas.A Trojan:Win32/Propas.A Trojan.Propas!M9i4NRQV2R8 W32/Propas.A!tr


A backdoor also known as: Backdoor.Syph.B Backdoor/W32.Syph.361984 Backdoor.Syph Backdoor.W32.Syph.b!c Trojan/Syph.b Backdoor.Syph.B Backdoor.Trojan BKDR_SYPH.B Win.Trojan.Syph-2 Backdoor.Syph.B Backdoor.Win32.Syph.b Backdoor.Syph.B Trojan.Win32.Syph.bfjuy Backdoor.Win32.Syph.361984 Win32.Backdoor.Syph.cyqv Backdoor.Syph.B Backdoor.Win32.Syph.B BackDoor.Syph BKDR_SYPH.B W32/Risk.GBZV-6047 Backdoor/Syph.b BDS/Syph.b.Srv Trojan[Backdoor]/Win32.Syph Backdoor:Win32/Syph.B Backdoor.Win32.Syph.b Backdoor.Syphillis Backdoor.Syph.b Bck/Syphillis.1.18 Win32/Syph.B Backdoor.Syph!hEmUZuSaZVQ Win32/Backdoor.e16


From April 19-24, 2017, a politically-motivated, targeted campaign was carried out against numerous Israeli organizations.


Although this technique has been used before by other malware campaigns, it is still not a common strategy.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9692 TR/Brysay.A PWS:Win32/Enesbot.A Trojan-Downloader.MSIL.Banload


Yet I recently uncovered evidence that suggests it was the work of a well-known Chinese threat group.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9982 Trojan.Win32.Farfli Backdoor:Win32/Dorbop.B!bit Trj/GdSda.A


A backdoor also known as: Trojan.Win32.AD.eqoszf TR/AD.PSLoader.kykon Trojan.Razy.D1F16C Win32/Powerless.F Trojan.Powerless! W32/Powerless.F!tr


We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013.


In our previous research, we detailed how an information stealer Trojan was deployed via a Word macro, in order to spy on its victims various parts of the Saudi Government.


A backdoor also known as: W32.FakeMsHelpCenter.Trojan Trojan.Graftor.D67ED Win32.Trojan.WisdomEyes.16070401.9500.9997 TROJ_ALTHUMS_EI030112.UVPM Trojan.Win32.DownLoad2.rlsdn Trojan.Win32.A.Downloader.84626 Trojan.DownLoad2.63614 Trojan.Allthumbs.Win32.1 TROJ_ALTHUMS_EI030112.UVPM BehavesLike.Win32.Worm.tz Trojan:Win32/Althums.A Trojan/Win32.Goz.R10705 Trj/CI.A Trojan.Graftor!H+8m5ivUpKY Win32/Trojan.0be


A backdoor also known as: BKDR_MATSNU.SM0 Win32.Trojan.WisdomEyes.16070401.9500.9999 BKDR_MATSNU.SM0 BehavesLike.Win32.Ransom.ch TR/Crypt.ZPACK.8577 Trojan/Win32.Trapwot.R152769 Trojan.FakeAV.01657


This finding was listed in our Anthem blog, and we have continued to monitor it in ThreatConnect since mid February.


A backdoor also known as: W32.JapiletAA.Trojan Trojan.Dropper.Delf.BB Worm.Win32.Fesber!O Worm.Fesber Worm.Fesber.Win32.3 Trojan/Fesber.a W32/Fesber.A Win32/Fesber.A WORM_YERO.A Win.Worm.Yero-1 Worm.Win32.Fesber.g Trojan.Dropper.Delf.BB Virus.Win32.Fesber.iiof Worm.Win32.A.Fesber.13116[UPX] Virus.Win32.Fesber.k Trojan.Dropper.Delf.BB Win32.HLLW.FSB WORM_YERO.A BehavesLike.Win32.Fesber.vh W32/Fesber.QPGQ-0002 Worm/Fesber.g Worm/Win32.Fesber.g Worm.Fesber.kcloud Worm:Win32/Fesber.A Trojan.Dropper.Delf.BB Troj.PSW32.W.QQPass.lgj2 Worm.Win32.Fesber.g Trojan.Dropper.Delf.BB Worm/Win32.Fesber.R4309 Trojan.Dropper.Delf.BB Virus.Fsb.1 I-Worm.Fesber.A Win32/Fesber.A Worm.Fesber!I2XPvd5yXYs Worm.Win32.Fesber W32/Cosmu.H.worm Worm.Win32.Fesber.A


What is special about it is that it comes as a Windows link file, .LNK, that downloads and runs a malicious HTML application, .HTA, that drops and executes a malicious binary.


Our analysis of the Adobe Flash zero-day vulnerability used in the latest Pawn Storm campaign reveals that the previous mitigation techniques introduced by Adobe were not enough to secure the platform.


The actors behind Dridex 220 and Locky Affid=3 have introduced a new ransomware called Bart


A backdoor also known as: Application.Joke.Flipped.E Joke.Flipped Riskware.Win16.Flipped.yzsd Joke.Flipped JOKE_FLIPPED.A Joke.Flipped Application.Joke.Flipped.E Joke.Flipped Application.Joke.Flipped Joke.Flipped JOKE_FLIPPED.A Joke.Flipped Backdoor/IRC.IRC Joke:Win32/Flipped.A Trojan.Win32.A.Zbot.4128 Application.Joke.Flipped.E Joke.Flipped Joke.Flipped


Komplex shares a significant amount of functionality and traits with another tool used by Sofacy – the Carberp variant that Sofacy had used in previous attack campaigns on systems running Windows.


In 2014, our colleagues at Crowdstrike wrote an exposé about a long-standing Chinese APT threat group they self-named Putter Panda, which Mandiant/FireEye refers to as APT2.


Apache Tomcat is a java based web service that is used for different applications.


Among the 153 configuration files, 54 distinct command and control C C servers were detected.


A backdoor also known as: Trojan.Win32.RedCap.ewfcku BehavesLike.Win32.VBobfus.gc Trojan.CopyKittens TR/RedCap.eevfy Trojan.Razy.D33AF6 TrojanDropper:Win32/Noratops.B!dha Trj/GdSda.A


According to a blog article by Microsoft, the malware is associated with an attacker group identified as DarkHotel Microsoft calls it as Dubnium .


A backdoor also known as: W32.Lamer.KL8 PE_LAMER_EL150191.UVPM Win32.Trojan.WisdomEyes.16070401.9500.9987 PE_LAMER_EL150191.UVPM Virus.Win32.Lamer.kl Virus.W32.Lamer!c ApplicUnsaf.Win32.ScreenMate.AA Backdoor.PePatch.Win32.75884 Virus.Win32.Lamer TR/Taranis.2787 Trojan[Ransom]/Win32.CryFile Virus.Win32.Lamer.kl Hoax.CryFile Virus.Win32.Lamer.j Win32/Virus.HideDoc.L


Google's security team recently identified a new domain masquerading as an official EFF site as part of a targeted malware campaign.


A backdoor also known as: W32.OnGameELAIUZAC.Trojan Trojan.Zusy.D3B59 Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Win32.Clicker.cwyjjr Trojan.Click2.34240 Win32.Troj.Undef.kcloud Trojan:MSIL/Ainscomp.A Trj/CI.A Trojan.Ainscomp!KTuN3cZslCo Trojan.Msil Win32/Trojan.bfc


The three InPage exploit files are linked through their use of very similar shellcode, which suggests that either the same actor is behind these attacks, or the attackers have access to a shared builder.


A new type of macOS-based stealer is being sold on the dark web for $100 £70.


The emails sent by this campaign may look spartan to the professional eye but, as ever, the human point of interaction with systems is the most vulnerable: by potentially reaching so many individuals, campaigns such as this can - and do - succeed in infecting people.


Most custom backdoors used by advanced attackers have limited functionality.


A backdoor also known as: Trojan/Bifrose.nel Win.Trojan.AutoIT-6333854-0 Trojan-Dropper.Win32.Autoit.bvg Trojan.Win32.AutoIt.expdpu BehavesLike.Win32.Backdoor.tc Trojan.Win32.Z.Autoit.1633763 Dropper/Win32.Androm.C2387785 Win32/Injector.Autoit.DFJ Backdoor.MSIL W32/Injector.CYH!tr Win32/Trojan.38f


Over the past couple of months McAfee Labs has seen an increase in the usage of macros to deliver malware.


We mostly observe attacks using Elirks occurring in East Asia.


We observed an anomaly when approximately 60 domains all [.]top TLDs registered on April 7, 2016 started serving a coin mining malware – to mine BitMonero, a form of digital currency – on their main page under the mime-type of html/text.


A backdoor also known as: W32.HfsAutoB.E147 Trojan.Banker.Win32.5895 Trojan/Banker.ju W32/Banker.AJC Win.Trojan.Bancos-852 Trojan-Banker.Win32.Banker.ju Trojan.Win32.Banker.bmncx Trojan.PWS.Banker.based Trojan-Spy.Win32.Banker W32/Banker.WTGS-4277 Trojan/Banker.Banker.ufm Trojan[Banker]/Win32.Banker Trojan-Banker.Win32.Banker.ju TrojanBanker.Banker Trojan.Banker!qguLAzH8AII W32/Banker.DUU!tr Trj/Banker.FWD Win32/Trojan.a46


At least two different stealers, Rhadamanthys and RedLine, were abusing the search engine promotion plan in order to deliver malicious payloads to victims' machines.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9925 Trojan.Win32.Graftor.bovqdb TrojWare.Win32.GameThief.Nilage.~CRSH TR/Graftor.Elzob.6117.1 Backdoor:Win32/Parcim.A Trj/CI.A Trojan.Graftor.Elzob.D17E5


It has been in the news the past few weeks as it is the bot that was used in the DDoS attack on Brian Kreb's security blog.


A backdoor also known as: Trojan.Jevafus.A Trojan.Jevafus.A Trojan.Jevafus.A Trojan.Win32.Drop.euelge Trojan.Jevafus.A Trojan.Jevafus.A BehavesLike.Win32.BadFile.vh TrojanDropper:Win32/Jevafus.A Trojan.Jevafus.A


So far, all theories regarding the spread of ExPetr/Petya point into two directions:


The CatB ransomware family, sometimes referred to as CatB99 or Baxtoy, was first observed in late 2022, with campaigns being observed steadily since November.


A backdoor also known as: Trojan.Svectas.Win64.1 Packer.Win32.Katusha TR/Svectas.smnlb W64/Svectas.B!tr