It involves modifying browser proxy configurations and capturing traffic between a client and a server, acting as Man-In-The-Middle.


Late last year, a wave of cyber-attacks hit several critical sectors in Ukraine.


A backdoor also known as: W32.FamVT.LocktETTc.Worm Trojan.Miuref.S21958 Trojan.MalPack Variant.Symmi.m8Nr Win32.Trojan.WisdomEyes.16070401.9500.9995 BehavesLike.Win32.Miuref.tc Trojan.Win32.Miuref Trojan.Miuref.3 Trojan:Win32/Miuref.B Win32.Trojan.Miuref.Wqws Win32/Trojan.eb2


Its primary institutional targets have included government bodies, diplomatic institutions, and military forces and installations in NATO member states and certain Eastern European countries.


After the cyber attack on the German Bundestag in 2015, some protective functions that the BSI has established for government networks have also been adopted by the German Bundestag for its own networks.


A backdoor also known as: Trojan.Graftor.D5ABC0 BackDoor.IRC.Skynet.69 BehavesLike.Win32.AdwareLinkury.dc W32/Trojan.ETUC-5276 Trojan[Spy]/Win32.Zbot Trojan:Win32/Zeeborot.A Trj/CI.A BackDoor.Skynet! Trojan.Win32.Zeeborot


A backdoor also known as: Trojan/W32.Darkhotel.692224 Trojan.Inexsmar.r5 Trojan/Inexsmar.a Trojan.Zusy.D25651 W32/Trojan.GJSD-2947 Win32/Inexsmar.A TROJ_INEXSMAR.SMA Trojan.Win32.Darkhotel.c Trojan.Win32.Darkhotel.duiemo Trojan.Win32.Z.Darkhotel.692224[h] Trojan/Win32.Darkhotel Trojan:Win32/Inexsmar.A Troj.W32.Darkhotel.c!c Trojan/Win32.DarkHotel Win32.Trojan.Darkhotel.Pftk Trojan.Darkhotel! Trojan.Win32.Inexsmar W32/Darkhotel.C!tr Trojan.Win32.Darkhotel.c


A backdoor also known as: Trojan.Inject.FC.363 Trojan.MSILKrypt.57 BKDR_HPNOANCOOE.SM Win32.Trojan.WisdomEyes.16070401.9500.9998 BKDR_HPNOANCOOE.SM Trojan.DownLoader24.26511 Trojan.Injector.Win32.512453 Trojan.MSIL.Crypt Trojan.MSIL.fwua TR/Dropper.MSIL.uuodb Trojan:MSIL/Kuhaname.A Trojan/Win32.MSIL.C957690 Trojan.Malicious Trojan.Injector!2xVDVY5re4U Trj/GdSda.A


Category: Unit 42 Tags: EITest, HoeflerText, malware, RAT


A backdoor also known as: Android.Downloader.N Android.Trojan.Downloader.KY Other:Android.Reputation.2 Android.Trojan.Downloader.KY A.L.Rog.BlackCert Android.HiddenAds.171.origin Android.Trojan.Downloader.KY Android-Trojan/Boosad.3b718 a.gray.hiddendown.g Trojan.AndroidOS.Hiddenapp


A paper released today by our colleagues at Palo Alto Networks presented a portion of data on this crew under the label the Lotus Blossom Operation likely named for the debug string present in much of the Elise codebase since at least 2012: d:\lstudio\projects\lotus\…


This particular SLocker variant is notable for being one of the first Android file-encrypting ransomware, and the first mobile ransomware to capitalize on the success of the previous WannaCry outbreak.


A backdoor also known as: Exploit.SWF.CVE-2016-4117.B Exploit-RTF.docswf.d Trojan.Mdropper Win32/Exploit.CVE-2016-4117.A TROJ_CVE20164117.A Exploit.SWF.CVE-2016-4117.B Exploit.Swf.CVE20164117.ecpjvq Exploit.SWF.CVE-2016-4117.B Exploit.SWF.CVE-2016-4117.B Exploit.SWF.1001 TROJ_CVE20164117.A Exploit-RTF.docswf.d RTF/Trojan.XBFM-4 TrojanDropper:Win32/CVE-2016-4117.A Exploit.SWF.CVE-2016-4117.B Exploit.SWF.CVE-2016-4117.B Trojan-Dropper.Win32.CVE-2016-4117 Malicious_Behavior.SB swf.exp.shellcode.b


A backdoor also known as: W32.WoletixC.Trojan Backdoor.Likseput.B3 Win32.Trojan.WisdomEyes.16070401.9500.9998 BKDR_LIKSPUT.SMR Trojan.Win32.A.Downloader.14336.AV Win32.Trojan.Spy.Wnmg Trojan.DownLoad2.44669 BKDR_LIKSPUT.SMR BehavesLike.Win32.Downloader.lm Backdoor:Win32/Likseput.B Win32/Backdoor.b78


A backdoor also known as: Backdoor.Androm.Win32.27371 Backdoor.W32.Androm.mAsy Trojan/Spy.Shiz.nct Win32.Trojan.Kryptik.qb Win.Trojan.Shifu-6330434-1 Trojan.DownLoader17.28342 Backdoor.Androm.fj TR/AD.Beaugrit.M.29 Trojan[Backdoor]/Win32.Androm Win32.Trojan-Ransom.TeslaCrypt.N SScope.Malware-Cryptor.Drixed Win32/Spy.Shiz.NCT Backdoor.Androm!fkBWkP4HCvw


Currently, the trojan spy is still in development and is not spotted in-the-wild yet.


A backdoor also known as: Backdoor.Prosti.AG8 BackDoor-DUG.a Trojan.DL.Delphi!PZt9n9YNSJ4 Hacktool.Rootkit W32/Delf.GRUM Win32/SillyDl.RUQ TROJ_DLOAD.SMMO Trojan.Scraze Trojan.Win32.Scar.cbyd Trojan.Win32.Downloader.723460 TrojWare.Win32.TrojanDownloader.Delf.~QEA Trojan.DownLoad.40151 TR/Dldr.Delf.uvk TROJ_DLOAD.SMMO BackDoor-DUG.a Backdoor.Win32.Prosti!IK TrojanDownloader.Delf.rui Backdoor:Win32/Prosti.AG Adware.ScreenBlaze Trojan/Win32.Scar Trojan-Downloader.Win32.Delf.uvk Hacktool.Rootkit Win32/Adware.ScreenBlaze.AA Backdoor.Win32.Prosti.xa Backdoor.Win32.Prosti W32/Delf.SCB!tr Downloader.Delf Trj/Downloader.MDW


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9997 BehavesLike.Win32.Downloader.nt Trojan:Win32/Uniemv.B Trojan/Win32.Cryptolocker.C301960 Trj/CI.A


Turla macro maldoc - Embassy of the republic of Kazakhstan Helsinki.


In late October, Proofpoint researchers identified and began tracking a financially-motivated threat actor group with access to banking Trojans and other malware, including Dridex, Ursnif, Tinba, and the point-of-sale POS malware AbaddonPOS with its loader, TinyLoader.


On a regular basis for the past several months, we have observed the inclusion of QRAT in a number of spam campaigns.


A backdoor also known as: Banker/W32.BestaFera.3193856 W32/Trojan.UWMZ-4840 Trojan.Win32.Depok.dsfkzn Troj.W32.Depok.akz!c BehavesLike.Win32.Dropper.wh Trojan/Win32.Depok Trojan.Heur.EDDAE3 Backdoor:Win32/Nioriglio.A Trojan.Depok!iA0ZBWd8EAg Trojan.Win32.Depok


A backdoor also known as: Win32.Trojan-Downloader.Dluca.by Trojan.Downloader.Dluca-29 Trojan-Downloader.Win32.Dluca.by TrojWare.Win32.TrojanDownloader.Dluca.~D3 Dialer.Adultparty Trojan-Downloader.Win32.Dluca.dj!IK TrojanDownloader.Dluca.bg TrojanDownloader:Win32/Dluca.DK Win-Trojan/Dluca.94208 Trojan-Downloader.Win32.Dluca.dj


The actors appear to have learned from our previous takedown and sinkholing of their Command and Control C2 infrastructure – Foudre incorporates new anti-takeover techniques in an attempt to avoid their C2 domains being sinkholed as we did in 2016.


On April 20, Proofpoint observed a targeted campaign focused on financial analysts working at top global financial firms operating in Russia and neighboring countries.


The loader injects a DLL component found in its body into explorer.exe.


These key technologies allow RSA analysts to process massive datasets and find forensically interesting artifacts in near real-time and more quickly than using standard incident response processes.


A backdoor also known as: Trojan.Posmemdump.A8 TSPY_RAWPOS.SM Win32.Trojan.WisdomEyes.16070401.9500.9903 Infostealer.Rawpos!g1 TSPY_RAWPOS.SM Win.Trojan.RawPOS-1 Trojan.Win32.POSCardStealer.dqfnqc Trojan.Inject1.54360 TrojanSpy.POSCardStealer.e Trojan:Win32/MemCCDump.A!POS Trojan.POSMemDump Trj/CI.A


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 BehavesLike.Win32.Trojan.tc MSIL/Injector.TDS!tr


A backdoor also known as: Backdoor.Win32!O Backdoor.Takit W32/Recerv.a.dr Trojan.Heur.E5D728 Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Zyxerv Backdoor.Win32.Takit Trojan.Win32.Invader.euuocd Trojan.Win32.Z.Takit.135680 Backdoor.W32.Takit!c Backdoor.Win32.Takit.A BackDoor.TakeIt.1 W32/Recerv.a.dr Backdoor/Takit.a BDS/RedCap.xurnc Trojan/Win32.Invader Backdoor.Win32.Takit Backdoor.Takit Win32/Takit.A Win32.Backdoor.Takit.Wrgr Trojan.Win32.Takit W32/RECERV.A!tr


A backdoor also known as: BehavesLike:Win32.Malware


A backdoor also known as: Python/Motovilo.A Win32.Worm.Motovilo.Hvjc Win32.HLLW.Motovilo.2 BehavesLike.Win32.Trojan.tc Python/Motovilo.A!worm Trojan:Win32/Motve.A Trj/CI.A Win32/Trojan.09a


Whether its Exploit Kits or SPAM messages threat actors are pushing as many different variants of Ransomware as possible.


Our new intelligence on BlackEnergy expands previous findings on the first wide-scale coordinated attack against industrial networks.


The country is resource rich, with a variety of natural resources and a steady labor supply.


ince mid-2016 we have observed multiple new samples of the Android Adware family Ewind


Organizations in 31 countries have been targeted in a new wave of attacks which has been underway since at least October 2016.


A backdoor also known as: W32.HLLW.Cloner Trojan.Vir.HLL Trojan.Heur.EA0E79 W32/HLLW.Cloner W32.Cloner PE_CLONER.A Virus.Win32.HLLW.Cloner Virus.Win32.HLLW.gcdu W32.HLLW.Cloner!c Win32.HLLW.Cloner Win32.HLLW.Cloner.32768 Virus.Cloner.Win32.1 PE_CLONER.A W32/Cloner.worm.a Virus.Win32.HLLW W32/HLLW.Cloner Virus/Win32.Cloner Virus.Win32.HLLW.Cloner W32/Cloner.worm.a W32/HLLW.SelfCloner Win32/HLLW.Cloner Win32.HLLW.Cloner


In this collaboration post with Morphisec Lab and Cisco s Research and Efficacy Team, we are now publishing details of this new document variant that makes use of an LNK embedded OLE object, which extracts a JavaScript bot from a document object, and injects a stealer DLL in memory using PowerShell.


Alert from the CNCERT related to a piece of malware that is being used to perform DDoS attacks.


A backdoor also known as: Troj.W32.Buzus.kZ4S BKDR_PHDET.SMI Win32.Trojan.WisdomEyes.16070401.9500.9959 BKDR_PHDET.SMI Trojan.Win32.A.Downloader.34304.CO BackDoor.Dax BehavesLike.Win32.FDoSBEnergy.nt W32.Trojan.Trojan-downloader.Ge Backdoor:Win32/Phdet.B


A backdoor also known as: Win32/Dedler.B Win32.Worm.Dedler.U Worm/W32.Dedler.38400.B Win32.Worm.Dedler.U W32/Dedler.c Win32.Worm.Dedler.U W32.Dedler.Worm Win32/Dedler.E WORM_DEDLER.C Win.Worm.Dedler-12 Win32.Worm.Dedler.U Net-Worm.Win32.Dedler.c Win32.Worm.Dedler.U Trojan.Win32.Dedler.frkx Worm.Win32.S.Net-Dedler.38400 W32.W.Dedler.c!c Win32.Worm-net.Dedler.Ahok Win32.Worm.Dedler.U Worm.Win32.Dedler.E Win32.Worm.Dedler.U Trojan.DownLoader.198 Worm.Dedler.Win32.19 BehavesLike.Win32.Downloader.nc Net-Worm.Win32.Dedler W32/Dedler.B.unp Worm/Dedler.c Worm:Win32/Dedler.B WORM/Dedler.G Worm[Net]/Win32.Dedler Worm:Win32/Dedler.B Net-Worm.Win32.Dedler.c Trojan/Win32.Horst.R28469 Worm.Dedler Backdoor.Dedler.E W32/ICQ.Smvss.A!tr Win32/Worm.352


A backdoor also known as: Trojan.Snojan Trojan.Strictor.D43F0 Win.Trojan.Ag-1 Trojan.Win32.Snojan.kbr Trojan.Win32.DownLoad3.csckao Trojan.Win32.Z.Strictor.268488 Troj.W32.Snojan!c Trojan.DownLoad3.30879 Trojan/Invader.kbu TR/Spy.182784.101 Trojan/Win32.Invader TrojanDropper:Win32/Coopop.B Trojan.Win32.Snojan.kbr Trojan.Snojan Win32.Trojan.Snojan.Llhd Trojan-Banker.Win32.Banker Win32/Trojan.67a


A backdoor also known as: Multi.Threats.InArchive Worm.Win32.Poswauto W64/Trojan.LELA-7925 WORM/Poswauto.gwore Worm:Win32/Poswauto.A Trj/CI.A


A backdoor also known as: W32.eHeur.Malware03 Trojan.Win32.Pakes!O TSPY_SUKWIDON.C Win32.Trojan.WisdomEyes.16070401.9500.9998 Infostealer.Sofacy Win32/Metlar.A TSPY_SUKWIDON.C Win.Trojan.Sofacy-1 Trojan.Win32.Pakes.qcb Trojan.Win32.Pakes.fizzg Win32.Trojan.Pakes.Pdmf Trojan.KillProc.7386 Trojan.Pakes.Win32.11534 BehavesLike.Win32.Mydoom.nc Trojan/Win32.Pakes Win32.Troj.Unknown.c.kcloud PWS:Win32/Sukwidon.A Trojan.TDss.20 Troj.W32.Pakes.qcb!c Trojan.Win32.Pakes.qcb Trojan/Win32.Xema.C81978 Trojan.Qhost Trojan.DR.Tiny!eZN8HfCUlLI Trojan.Win32.Sasfis W32/Malware_fam.NB


A backdoor also known as: W97M.Downloader Win32/Exploit.CVE-2017-8570.A TROJ_CVE20170199.JVU Exploit.Xml.CVE-2017-0199.equmby PPT.S.Exploit.35022 Trojan[Exploit]/Win32.CVE-2017-8570 Trojan.Win32.Exploit


Ironically the decoy document is a flyer concerning the Cyber Conflict U.S. conference organized by the NATO Cooperative Cyber Defence Centre of Excellence on 7-8 November 2017 at Washington, D.C. Due to the nature of this document, we assume that this campaign targets people with an interest in cyber security.


A backdoor also known as: Worm/W32.AutoRun.110592.V Worm.Win32.AutoRun!O Win32.Worm.VB.rp Win.Worm.Autorun-7819 Worm.Win32.AutoRun.hvo Trojan.Win32.AutoRun.ubuid Win32.Worm.Autorun.Aihq Win32.HLLW.Autoruner1.8766 Worm.AutoRun.Win32.41616 BehavesLike.Win32.BadFile.ch Worm.Win32.AutoRun Worm/AutoRun.alsp Worm/Win32.AutoRun Worm:Win32/Krangtor.A Trojan.Heur.VP2.gm0faiC9QKoi Worm.Win32.A.AutoRun.87040.A Worm.AutoRun Win32/AutoRun.VB.AJW Worm.AutoRun!P7D8pPa150U


A backdoor also known as: Win32.Malachite.A W32.WLKSM.A1 Virus.WLKSM.Win32.1 Win32.Malachite.A Win32.Virus.MoonRover.a W32/Malachite.A Virus.Win32.MoonRover Virus.Win32.WLKSM.a Virus.Win32.Infector.dleseh Virus.Win32.WLKSM.AA BehavesLike.Win32.Virut.cc W32/Malachite.A Win32.Malachite.A Virus.Win32.WLKSM.a Win32.Malachite.A Win32.Malachite.A Win32.Malachite.A Virus.Win32.Wlksm.c


A backdoor also known as: Win32/Otlard.A W32/Smalltroj.YCPZ Virus.Win32.Heur.c TROJ_OTLARD.SM Trojan-Dropper.Win32.Otlard!IK BackDoor.Gootkit.4 TROJ_OTLARD.SM Win32/Droplet.NU Backdoor/IEbooot.iz TrojanDropper:Win32/Otlard.A Trojan/Win32.Xema Rootkit.Otlard.aa Trojan-Dropper.Win32.Otlard


A backdoor also known as: Worm.Win32.Fasong!O Trojan.Reconyc Worm.Fasong.Win32.10 Win32.Trojan-PSW.OLGames.bm W32/Worm.DPJC-5721 Trojan.PWS.QQPass WORM_FASONG.L Win.Trojan.Fasong-9 Trojan.Win32.Fsysna.djfi Trojan.Win32.Legmir.bonls Worm.Win32.A.Fasong.461667 Worm.Win32.Fasong.G Win32.HLLW.Fasong.7 WORM_FASONG.L BehavesLike.Win32.Virut.gh W32/Worm.AVIX Worm/Fasong.a W32.Worm.Fasong BDS/Delf.H Worm/Win32.Fasong Worm:Win32/Ming.A W32.W.Fasong.l6SH Trojan.Win32.Fsysna.djfi Trojan/Win32.HDC.C154421 Worm.Fasong Win32/Fasong.G Worm.Fasong!UQMX8yr/3P8 Worm.Win32.Fasong


A backdoor also known as: Joke/W32.BadJoke.561258 Trojan.Aduser.A4 Trojan/AddUser.t TROJ_GRAFTOR_EK2501C5.UVPM Win32.Trojan.AddUser.e TROJ_GRAFTOR_EK2501C5.UVPM Win32.Application.PUPStudio.A Trojan.Win32.Z.Graftor.561258 Worm.Win32.Dropper.RA Trojan.Adduser.216 Tool.BadJoke.Win32.3025 Trojan/Pasta.hsb TR/Winlock.KB Trojan.Graftor.D1E8A6 Trojan:Win32/Adduser.D Spyware.OnlineGames Win32/AddUser.T Win32.Trojan-psw.Badjoke.Taer Trojan.AddUser!BXWljasYS+k


A backdoor also known as: Trojan.Blocker TROJ_PUWIN.A Win32.Trojan.WisdomEyes.16070401.9500.9979 TROJ_PUWIN.A Trojan-Ransom.Win32.Blocker.kgxt Trojan.Win32.Keylogger.evercw Trojan.Win32.Z.Blocker.17408.C Troj.Ransom.W32.Blocker!c Trojan.DownLoader25.58899 W32/Trojan.BMCJ-5014 Trojan.Blocker.hvt Trojan[Ransom]/Win32.Blocker Trojan:MSIL/Puwin.A Trojan-Ransom.Win32.Blocker.kgxt Trojan-Ransom.Blocker Trj/GdSda.A Win32.Trojan.Blocker.Tbsp Trojan.Blocker!xyv3gcnzFBI Trojan-Ransom.Win32.Blocker W32/Blocker.KGXT!tr Win32/Trojan.Ransom.460


A backdoor also known as: MemScan:Backdoor.Turkojan.DQ Backdoor.Turkojan Backdoor.Turkojan.Win32.25407 Win32.Backdoor.Cakl.c Backdoor.Trojan Win32/Turkojan.A HT_TURKOJAN_HA110001.UVPM Win.Trojan.Truko-10 Backdoor.Win32.Turkojan.zwh MemScan:Backdoor.Turkojan.DQ Trojan.Win32.Turkojan.jebp Win32.Backdoor.Turkojan.Wnwd MemScan:Backdoor.Turkojan.DQ Win32.HLLW.MyBot HT_TURKOJAN_HA110001.UVPM BackDoor-CZP.dr Trojan.Win32.Cakl Backdoor/Turkojan.x BDS/Turkojan.im Trojan[Backdoor]/Win32.Turkojan Backdoor:Win32/Turkojan.AI Backdoor.Turkojan.DQ Troj.W32.Buzus.l4J9 MemScan:Backdoor.Turkojan.DQ Backdoor/Win32.Turkojan.R148548 MemScan:Backdoor.Turkojan.DQ Trojan.SDP.27105 Win32/Cakl.NAG Backdoor.Turkojan.I Trj/CI.A


These unknown actors continued launching DDoS attacks over the next few years.


A backdoor also known as: Trojan.Brambul Troj.W32.Brambul.toT6 Win32/Pepex.F Trojan.Win32.Brambul.bp Worm.Win32.Pepex.E0 Win32.HLLW.Bumble BehavesLike.Win32.Downloader.mz Trojan:Win32/Brambul.A Trojan:Win32/Brambul.A!dha Trojan.Win32.Brambul.bp Win32/Tnega.WW Win32.Trojan.Brambul.Dvzk


First reports could be linked to Operation Aurora and dated back to 2009 2.


A backdoor also known as: Sefnit.ab Trojan/Jorik.Gbot.cdb Trojan.Sefnit.2 TROJ_DLDR.SMII Win32.Trojan.WisdomEyes.16070401.9500.9938 Trojan.ADH.2 TROJ_DLDR.SMII Win.Trojan.Gbot-539 Trojan.Win32.Jorik.wkvaa Trojan.DownLoader4.46549 Trojan.Jorik.Win32.14116 BehavesLike.Win32.MultiPlug.tz Trojan/Win32.Gbot TrojanDownloader:Win32/Tegtomp.A Trojan/Win32.ADH.C90187 Trojan.Gbot Bck/Qbot.AO Trojan.DL.Tegtomp!ykAGemfy9WA W32/Buzus.AABB!tr


A backdoor also known as: W32.HfsAutoB.3DA4 Trojan/W32.Sasfis.432279 Trojan.Sasfis.Win32.35026 Win32.Trojan.Injector.jm Trojan.Win32.StartPage.ecbeu Trojan.Win32.A.Sasfis.432083 Troj.W32.Invader.liPS Trojan.StartPage.40117 BehavesLike.Win32.Sdbot.gc Trojan/Win32.Sasfis Trojan:Win32/Kilonepag.A Win32.Trojan.Killav.Losk Trojan.Sasfis!92bCxe6lda4 Win32/Trojan.48c


Zscaler ThreatLabZ has been closely monitoring a new Spy Banker Trojan campaign that has been targeting Portuguese-speaking users in Brazil.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9989 Trojan.Win32.Kryptik.exgddi Trojange.N TR/Dropper.MSIL.hlkdw Trj/GdSda.A Msil.Trojan.Kryptik.Eyg


A backdoor also known as: W32.OnGameAZPIXS.Trojan Trojan-Dropper.Win32.Dapato!O Dropper.Dapato.Win32.12031 Trojan.Delf.106 Trojan.Coinbitminer Win32/CoinMiner.AJ Trojan.Win32.Dapato.vksez Troj.Dropper.W32.Dapato.boht!c Trojan.Packed.194 TR/Kryptik.GZC Trojan[Dropper]/Win32.Dapato Trojan:Win32/Kexqoud.A TrojanDropper.Dapato Trojan.Injector!8vu2hFasaTU Trojan-Dropper.Win32.Dapato W32/Injector.URR!tr Trj/CI.A


A backdoor also known as: Win32.Trojan.WisdomEyes.151026.9950.9999 Trojan-Downloader.Win32.Gootkit.kn Trojan.Packed Trojan.Kryptik.Win32.910183 BehavesLike.Win32.BadFile.cm W32/Trojan.TLOU-5726 TR/Renaz.ivfk W32/Gootkit.KN!tr.dldr Trojan/Win32.Inject Trojan.Win32.Crypt Crypt5.BVAN Trj/GdSda.A


A backdoor also known as: W32.ServerAJ.Trojan Trojan.Bublik.28294 Trojan.Zusy.Elzob.D833 TSPY_SASFIS_CD10021A.RDXN Win32.Backdoor.Naprat.d W32/Trojan2.MXXM Win32/Spyrat.B TSPY_SASFIS_CD10021A.RDXN Win.Trojan.Hupigon-28437 Trojan.Win32.Bublik.lkn Trojan.Win32.Bot.bblhdq Trojan.Win32.Bublik.lkn TrojWare.Win32.Naprat.A BackDoor.IRC.Bot.355 BehavesLike.Win32.Worm.cc Trojan/Naprat.c Trojan-GameThief.Win32.OnLineGames W32/Trojan.APHW-4252 Trojan/Win32.Sasfis Backdoor:Win32/Naprat.A Trojan.Win32.Bublik.lkn Win-Trojan/Antisb.190976.J Trojan.Bublik Win32/Naprat.C


Today, we have discovered more pieces of the puzzle: two more Corebot samples and an online crypt service.


The modules analyzed by CTU researchers list recently accessed documents, enumerate installed programs, list recently visited websites, steal passwords, and steal installation files for the IDA tool.


A backdoor also known as: Virus.Win32.Sality!O Ransom_Natasa.R039C0DLB17 W32/Trojan.IPMQ-6780 Ransom_Natasa.R039C0DLB17 Trojan-Ransom.Satan Ransom:Win32/Natasa.A Trojan-Ransom.Win32.Satan.x Trj/CI.A W32/MBRlock.AP!tr


A backdoor also known as: Trojan-GameThief.Win32.OnLineGames!O Trojan.Onlinegames Troj.Gamethief.W32.Onlinegames!c Trojan-GameThief.Win32.OnLineGames.bnfw Trojan.Win32.OnLineGames.bwrpuv TrojWare.Win32.GameThief.OnLineGames.~bnfw Trojan.PWS.Qqpass.4325 Trojan-Dropper.Win32.Nemqe Trojan/Vilsel.dki Trojan[GameThief]/Win32.OnLineGames Trojan.Heur.ED351E Trojan-GameThief.Win32.OnLineGames.bnfw TrojanPSW.OnLineGames.a Win32.Trojan-gamethief.Onlinegames.Pfje Win32/Trojan.GameThief.844


A backdoor also known as: Trojan/W32.Cosmu.41472.E Backdoor.Begman.A Trojan/Cosmu.anpk Trojan.Autorun.3 Win32.Trojan.Delf.v W32.Begmian BKDR_BEGMA.SM Trojan.Cosmu.Win32.6467 BKDR_BEGMA.SM BehavesLike.Win32.Sality.pc BDS/Begman.cmnra Worm/Win32.AutoRun Backdoor:Win32/Begman.B Trojan/Win32.Cosmu.R11227 Trj/GdSda.A Trojan.Win32.Autorun.bwq Backdoor.Win32.Begman W32/Begma.SM!tr


The campaign, which experts believe is still in its early stages, targets Android OS devices.


In addition, Sundown doesn't have the anti-crawling feature used by other exploit kits.


It uses a multi-stage installation process with specific checks at each point to identify if it is undergoing analysis by a security researcher.


A backdoor also known as: Trojan.PWS.ZKD Trojan/W32.naKocTb.106496 Trojan.Mauvaise.SL1 Spyware.Infostealer.Fareit Spyware.LokiBot Trojan/Fareit.l Trojan.PWS.ZKD TSPY_LOKI.SMA Win32.Trojan.WisdomEyes.16070401.9500.9723 W32/Trojan.LAPN-1109 TSPY_LOKI.SMA Win.Trojan.naKocTb-6331389-1 Trojan.PWS.ZKD Trojan.PWS.ZKD Trojan.Win32.Stealer.eshrhl Trojan.PWS.Stealer.17779 Trojan.naKocTb.Win32.12 BehavesLike.Win32.Downloader.ch W32/Trojan2.PBTA Trojan.naKocTb.l PWS:Win32/Primarypass.A Trojan.PWS.ZKD Troj.W32.naKocTb.tnB5 Trojan/Win32.naKocTb.C1575888 Trojan.naKocTb Trj/GdSda.A Trojan.Nakoctb Win32/PSW.Fareit.L Trojan-Spy.Dyzap Win32/Trojan.15d


Starting in November 2022, Morphisec has been tracking an advanced info stealer we have named SYS01 stealer. SYS01 stealer uses similar lures and loading techniques to another information stealer recently dubbed S1deload by the Bitdefender group, but the actual payload stealer is different.


Article primarily covering activity from 2016.


A backdoor also known as: W32.AutoHotkeyA.Worm Virus.Win32.Sality!O Backdoor.Vercuser.B4 Worm.AutoHotKey.Win32.37 Trojan.Heur.uquarfYBWDlih Win32/Tnega.NCdVJJ Win.Trojan.Ag-13 Worm.Win32.AutoHotKey.a Trojan.Win32.AutoHotKey.cmxqxy Win32.HLLW.Autoruner1.26246 BehavesLike.Win32.Virut.fc Backdoor.Win32.Vercuser Worm:Win32/Vercuser.B Trojan/Win32.Hupigon.R57102 Trj/CI.A Win32/Vercuser.B Win32.Worm.Autohotkey.Dzjb Worm.AutoHotKey!


A backdoor also known as: Trojan.Pirril.B5 Trojan/BHO.aisa TROJ_PIRRIL.SMI Win.Trojan.Pirril-7 Trojan.Win32.BHO.czvu Trojan.Win32.BHO.btaog Troj.W32.Bho!c Backdoor.Win32.Ripinip.a TrojWare.Win32.Pirril.smi Win32.HLLW.Riplip.10 Trojan.BHO.Win32.9746 TROJ_PIRRIL.SMI BehavesLike.Win32.Pirril.mm Adware/BHO.bmy Trojan.Graftor.D453B Trojan.Win32.Z.Bho.90112 Trojan.Win32.BHO.czvu Pirril.a Trojan.BHO Trojan.Win32.BHO W32/BHO.AJZ!tr Backdoor.Win32.Ripinip.C


Additionally, others have been referring to the group responsible for the OilRig campaign itself as the OilRig group as well.


Expanded with indicators generated by Alienvault Labs


What 's new ? WolfRAT is based on a previously leaked malware named DenDroid .


However, Buckeye's focus appears to have changed as of June 2015, when the group began compromising political entities in Hong Kong.


F5 research conducted in March 2017 followed 153 Marcher configuration files to uncover target and activity trends in the worldwide attack campaigns.


The Word document initiated the same multiple-stage infection process as the file from the Hybrid Analysis report we previously discovered and allowed us to reconstruct a more complete infection process.


SpiderLabs has uncovered a new strain of malware that can steal cryptocurrencies and other digital currencies.


A backdoor also known as: Worm/W32.Protoride.59392 W32.Protoride.E Worm.RAHack W32/Protoride2.worm Trojan.Win32.Protoride.fsfk W32/Protoride.C.unp W32.Protoride.Worm Win32/Protoride.E Worm.Protoride.F Worm.Win32.Protoride.59392[h] W32.W.Protoride.e!c Worm.Win32.Protoride.E BackDoor.IRC.Cirilico Worm.Protoride.Win32.7 BehavesLike.Win32.SpyLydra.qc W32/Protoride.ZUZR-8900 Worm/Protoride.e WORM/Protoride.E.2 Worm[Net]/Win32.Protoride Worm/Win32.IRCBot Worm:Win32/Protoride.F Win32/Protoride.F W32/Protoride.worm BScope.Trojan.IRCbot Win32.Worm-net.Protoride.Lorr Net-Worm.Win32.Protoride


Following the April 2017 Patch Tuesday, in which Microsoft disabled EPS, FireEye detected a second unknown vulnerability in EPS.


In the most recent versions, APT19 added an application whitelisting bypass to the macro-enabled Microsoft Excel XLSM documents.


The NCSC has observed these tools being used by the Turla group to maintain persistent network access and to conduct network operations.


A backdoor also known as: Ransom.Cerber.B NSIS/ObfusRansom.f Ransom_Enestaller.R00EC0CL417 Packed.NSISPacker!g4 Ransom_Enestaller.R00EC0CL417 Trojan.Nsis.Zerber.emhumo BehavesLike.Win32.ObfusRansom.dc Ransom.Cerber/Variant Trojan/Win32.Cerber.R196343 Ransom.Cerber W32/Injector.UQ!tr


A file called x32dbg.exe was used to sideload a malicious DLL we identified as a variant of PlugX.


A backdoor also known as: Trojan.Graftor.Elzob.D5035 Win32.Trojan.WisdomEyes.16070401.9500.9799 W32/Trojan2.HUBT Win32/Tnega.RA Trojan.Cebaek BehavesLike.Win32.PWSOnlineGames.pm W32/Trojan.JRGD-8081 PWS:Win32/Jomloon.E BScope.Trojan-Downloader.6707 W32/PWS_y.XR!tr


A backdoor also known as: Backdoor/W32.WinShell.12832 Backdoor.WinShell.I W32/Backdoor.LOY Backdoor.Winshell.50 W32/Winshell.AIC Backdoor.Win32.WinShell.50 BackDoor.WinShell.74 Backdoor.Win32.WinShell.50!IK Backdoor/WinShell.50 Backdoor:Win32/Winshell.G Backdoor.Win32.A.WinShell.203004.A W32/Backdoor.LOY Win-Trojan/Winshell.54178 Backdoor.Win32.WinShell.50 Win32/WinShell.50 Backdoor.WinShell Backdoor.Win32.WinShell.50 W32/Winshell.A!tr.bdr Bck/Winshell.F


A backdoor also known as: Trojan.Win32.VB!O Trojan.VB.Win32.23241 Trojan/VB.ymg Win32.Trojan.WisdomEyes.16070401.9500.9965 TROJ_VB.JNH Worm.Win32.VBNA.b Trojan.Win32.VB.edhhbs Trojan.Win32.A.VB.206336[UPX] Backdoor.W32.VB.l0cp TrojWare.Win32.Trojan.VB.~Ymg Trojan.VbCrypt.68 TROJ_VB.JNH BehavesLike.Win32.Rontokbro.lc Trojan.Win32.Sopcol Worm.VBNA.skk Trojan:Win32/Sopcol.A Worm/Win32.VBNA Trojan.Jaiko.DF2A Worm.Win32.VBNA.b Trojan:Win32/Sopcol.A Trojan/Win32.Xema.C33567 SScope.Trojan.VBO.0286 Trojan.VB!6EP+kawqBsw


Black Vine's targets include gas turbine manufacturers, large aerospace and aviation companies, healthcare providers, and more.


A backdoor also known as: W32.WinfileH.Worm Email-Worm.Win32.VB!O Worm.Wukill.AM3 Trojan.TempCom Win32.Worm.VB.sg W32/VB.KL W32.Traxg@mm Win32/Traxg.B WORM_VB.F Win.Worm.Traxg-4 Trojan.Win32.Scar.avxe Trojan.Win32.Scar.bjfnz Troj.W32.Scar!c Trojan.Win32.Rays.tzs Win32.HLLM.Utenti Worm.Rays.Win32.3 WORM_VB.F BehavesLike.Win32.Autorun.cz W32/VB.CWJD-9096 I-Worm/Wukill.j W32.Email-worm.Win32.Rays WORM/Traxgy.B Worm[Email]/Win32.VB Worm.Rays.8192 I-Worm.Win32.Traxg.57344 Trojan.Win32.Scar.avxe Worm:Win32/Wukill.G@mm Worm/Win32.Traxg.R2565 W32/Nethood.worm SScope.Trojan.VBO.0362 I-Worm.VB.NBB Win32/VB.NBB I-Worm.Rays.K W32/Vinet.A.worm Trojan.Win32.VBCode.D


A backdoor also known as: W32.Tufei503.PE Win32.Tufik.A Virus.Win32.Tufik!O W32.Tufik.A Troj.GameThief.W32.Magania.leKk PE_TUFIK.B Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Tufik.A W32.Tufik Win32/Tufik.A PE_TUFIK.B Win.Trojan.Tufik-3 Win32.Tufik.A Packed.Win32.Krap.hm Win32.Tufik.A Virus.Win32.Tufik.cdpn Win32.Tufik.A Virus.Win32.Virut.Ce VBS.Dropper.128 Virus.Tufik.Win32.2 BehavesLike.Win32.PWSZbot.dh Trojan-Dropper.Win32.Wlord W32/Tufik.A Win32/Tufei.a W32/Tufik.J Win32.Tufik.a.13824 Win32.Tufik.A Packed.Win32.Krap.hm Worm:Win32/Tufik.A Win32.Tufik.A Virus.Win32.Tufei.13798 Worm.Qakbot W32/Tufei.A Trojan.Zbot Win32/Tufik.A Virus.Win32.Tufik.cb Win32.Perez.B Win32/Sorter.AutoVirus.VMKUKU.A


In our initial two-part blog series on FIN7 we covered network activity patterns, payloads, and defensive best practices.


hackers, leaving most areas of western Ukraine in the dark.


The threat actors behind Operation Tropic Trooper—we named specifically for its choice of targets—aim to steal highly classified information from several Taiwanese government ministries and heavy industries as well as the Philippine military.


In addition to using PlugX and Poison Ivy PIVY, both known to be used by the group, they also used a new Trojan called ChChes by the Japan Computer Emergency Response Team Coordination Center JPCERT.


A backdoor also known as: Trojan.Quolko.A Trojan/Dropper.Drooptroop.ixt Trojan.Heur.JP.dmGfaeisekjc Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Bamital.I Win32/Droplet.LNE TROJ_KRYPTIK.SMY Trojan.Win32.Drooptroop.cxmbc Troj.GameThief.W32.OnLineGames.lkrK Backdoor.Win32.Shiz.A Trojan.Packed.21232 Dropper.Drooptroop.Win32.3912 TROJ_KRYPTIK.SMY BehavesLike.Win32.Ramnit.qc Trojan.Win32.Bulta W32/Bamital.I TrojanDropper.Drooptroop.cuc Worm:Win32/Yahos.A Trojan/Win32.Zbot.C168741 Trojan.SB.01742 Win32.Trojan-dropper.Drooptroop.Wlzg Trojan.DR.Drooptroop!S4bmnA2fbPM W32/Drooptroop.SMY!tr Win32/Trojan.98f


A backdoor also known as: AIT:Trojan.Autoit.CLU Win32.Trojan.WisdomEyes.16070401.9500.9768 AIT:Trojan.Autoit.CLU AIT:Trojan.Autoit.CLU AIT:Trojan.Autoit.CLU AIT:Trojan.Autoit.CLU Trojan.Autoit.F


A backdoor also known as: Trojan.Win32.Nosok!O Trojan/Nosok.dez Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Worm.AMZR Trojan.Win32.Nosok.ignra Worm.Win32.A.AutoRun.78881 Trojan.DownLoader11.6990 Trojan.Nosok.Win32.81 BehavesLike.Win32.VirRansom.dc W32/Worm.SMLT-2477 Trojan/Nosok.df Trojan.Razy.D2AA1A Trojan/Win32.Xema.C90213 Worm.AutoRun!dge3lshCyjI


The Threat Actor would then craft specific spear phishing emails to direct their targets to visit the malicious web sites and open the malware laden documents.


A backdoor also known as: Trojan.Scar Win32.Trojan.WisdomEyes.16070401.9500.9573 Trojan.Win32.Scarsi.apft Trojan.Win32.Inject.ewxioq Trojan.MulDrop6.38561 BehavesLike.Win32.AdwareSearchProtect.jc TR/Inject.oiycd TrojanSpy:MSIL/CoinStealer.C!bit Trojan.Win32.Scarsi.apft Trojan/Win32.Scarsi.C2337044 Trj/CI.A Win32.Trojan.Scarsi.Dkx Trojan.Win32.Injector W32/Injector.DUUK!tr Win32/Trojan.f68


In the second half of 2016, ESET researchers identified a unique malicious toolset that was used in targeted cyberattacks against high-value targets in the Ukrainian financial sector.


In this blog we will detail our discovery of the next two versions of MM Core, namely BigBoss 2.2-LNK and SillyGoose 2.3-LNK.


During the preparation of the IT threat evolution Q2 2017 report I found several common Trojans in the Top 20 mobile malware programs list that were stealing money from users using WAP-billing – a form of mobile payment that charges costs directly to the user's mobile phone bill so they don't need to register a card or set up a user-name and password.


Here is a full list of possible commands that can be executed by the first module : Command name Description @ stop Stop IRC @ quit System.exit ( 0 ) @ start Start IRC @ server Set IRC server ( default value is “ irc.freenode.net ” ) , port is always 6667 @ boss Set IRC command and control nickname ( default value is “ ISeency ” ) @ nick Set IRC client nickname @ screen Report every time when screen is on ( enable/disable ) @ root Use root features ( enable/disable ) @ timer Set period of IRCService start @ hide Hide implant icon @ unhide Unhide implant icon @ run Execute specified shell @ broadcast Send command to the second module @ echo Write specified message to log @ install Download and copy specified component to the system path The implant uses a complex intent-based communication mechanism between its components to broadcast commands : Approximate graph of relationships between BusyGasper components Second ( main ) module This module writes a log of the command execution history to the file named “ lock ” , which is later exfiltrated .


This post takes a look at a new banking malware that has, so far, been targeting financial institutions in Latin America—specifically, Mexico and Peru.


On June 9th, 2017 Morphisec Lab published a blog post detailing a new infection vector technique using an RTF document containing an embedded JavaScript OLE object.


A backdoor also known as: Trojan.JS.QAI PDF.Trojan.4250 JS.Exploit.Pdfka.jr JS/Exploit.Pdfka.QNP JS_PIDIEF.SMQ Exploit.JS.Pdfka.axt Trojan.JS.QAI Exploit.Script.Pdfka.otnl Trojan.JS.QAI Exploit.JS.Pdfka.aqn Trojan.JS.QAI JS_PIDIEF.SMQ BehavesLike.PDF.Exploit.zb EXP/Pidief.hcb Trojan[Exploit]/JS.Pdfka.axt Trojan.JS.QAI Exploit.JS.Pdfka.axt Exploit.JS.Pdfka.axt Exploit.JS.Pdfka JS/Pdfka.AABY!exploit virus.js.pdfjs


Targeted individuals that enabled macros in a malicious Microsoft Word document may have been infected with Poison Ivy, a popular remote access tool RAT that has been used for nearly a decade for key logging, screen and video capture, file transfers, password theft, system administration, traffic relaying, and more.


A backdoor also known as: PDF/Phish.AGU Troj.Downloader.Pdf!c PDF/Phish.AGU Trojan.PDF.Phishing Win32/Trojan.Downloader.8a8


Sundown remained highly vigilant and the subdomains in use were recycled quickly to help in avoiding detection.


Dridex has drastically reduced in volume throughout 2016.Actors are now appearing to prefer crypto-ransomware such as Locky over the infamous banking trojan.However, Dridex is still being actively developed.


From September 2016 through late November 2016, a threat actor group used both the Trochilus RAT and a newly idenfied RAT we've named MoonWind to target organizations in Thailand, including a utility organization.


A backdoor also known as: Trojan.Killav Downloader.Betload.Win32.51 Win32.Trojan.WisdomEyes.16070401.9500.9783 Trojan.Win32.KillAV.me Troj.W32.SchoolGirl.tnx1 Trojan.Win32.Killav BehavesLike.Win32.Downloader.lh Trojan.Win32.KillAV.me Trojan.Win32.Killav BAT/KillAV.NCO Win32.Trojan.Killav.Pgwh PUA.Bat.Hoax W32/KillAV.ME!tr Win32/Trojan.ba9


The group has been in operation since at least 2011 but has re-emerged over the past two years from a quiet period following exposure by Symantec and a number of other researchers in 2014.


A backdoor also known as: Trojan.Bamital.EC Trojan/PornoBlocker.jhw W32/PornoBlocker.N Win32/PornoBlocker.EW TROJ_KRYPTK.SM11 Trojan-Ransom.Win32.Gimemo.cpe Trojan.Win32.A.PornoBlocker.59904 Trojan-Ransom.Win32.PornoBlocker!IK TrojWare.Win32.Bamital.FA Trojan.Hosts.4025 TROJ_KRYPTK.SM11 Trojan/PornoBlocker.aba TrojanDropper:Win32/Bamital.I Hoax.PornoBlocker.jhw Downloader.Lofog Win32/Bamital.FA Trojan-Ransom.Win32.PornoBlocker W32/Bamital.FA!tr Bck/Qbot.AO


The user would have to then open the downloaded executable in order to infect their computer.


The first sample found was submitted 7 months ago.


A backdoor also known as: Swrort.d Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Swrort-5710536-0 Packed.Win32.BDF.a Trojan.Win32.Shellcode.ewfvwj TrojWare.Win32.Rozena.A Trojan.Swrort.1 Swrort.d Trojan:Win32/Meterpreter.A Packed.Win32.BDF.a W32/Swrort.C!tr Win32/Trojan.6bc


A backdoor also known as: W32/Downldr2.EOVV Infostealer.Bancos Trojan-Downloader.Win32.Banload.aadik Trojan.Win32.Banload.bmdsil Trojan.DownLoad.22103 BehavesLike.Win32.Pate.dc W32/Downloader.SIUT-2288 TrojanDownloader.Banload.bhyz Troj.Downloader.W32.Banload.aadik!c Trojan-Downloader.Win32.Banload.aadik Trojan:Win32/Pitke.A Trojan/Win32.Banker.R143357 Win32.Trojan-downloader.Banload.Ebrq Trojan.Win32.Scar W32/DelpBanc.A!tr


A backdoor also known as: Backdoor/W32.Runar.53248 Backdoor/Runar.b W32/Backdoor.LCQ Backdoor.Trojan Win.Trojan.Runar-2 Backdoor.Win32.Runar.b Trojan.Win32.Runar.dmmx Backdoor.Win32.A.Runar.53248 Win32.Backdoor.Runar.duq Backdoor.Win32.Runar.b BackDoor.Hiper Backdoor.Runar.Win32.6 W32/Backdoor.WJPY-2871 BDS/Runar.B Trojan[Backdoor]/Win32.Runar Backdoor.W32.Runar.b!c Backdoor.Win32.Runar.b Backdoor:Win32/Runar.B Backdoor.Runar Backdoor.Runar!lU3ZFWcAWmA W32/Runar.B!tr.bdr Win32/Backdoor.d80


It did not take long for attackers to repackage this PoC and use it in attacks in the wild.


A backdoor also known as: Ransom:Win32/Jaffrans.A!rsm


There are the following relevant detection paths ( the last one is an alternative Telegram client – “ Telegram X “ ) : Name Detection path Sex Game For Adults 18.apk /storage/emulated/0/WhatsApp/Media/WhatsApp Documents/ 4_6032967490689041387.apk /storage/emulated/0/Telegram/Telegram Documents/ Psiphon-v91.apk /storage/emulated/0/Android/data/org.thunderdog.challegram/files/documents/ Backdoored Open Source During the course of our analysis , we also found samples sharing code with the ViceLeaker malware , in particular they shared a delimiter that was used in both cases to parse commands from the C2 server .


The Darkhotel APT continues to spearphish targets around the world, with a wider geographic reach than its previous botnet buildout and hotel Wi-Fi attacks.


A backdoor also known as: Backdoor.Mangit BKDR_MANGIT.SM W32/Adware5.BH BKDR_MANGIT.SM Trojan-Banker.Win32.Banbra.tolm Trojan.Win32.Banker1.eeflxo Trojan.PWS.Banker1.21424 Dropper.DapatoCRTD.Win32.29 W32/Adware.ZANB-0757 Trojan.Banker.19 Trojan-Banker.Win32.Banbra.tolm Backdoor:Win32/Mangit.A Trj/GdSda.A Win32.Trojan-banker.Banbra.Syia Trojan.PWS.Banbra!KoDGdYjSbaA Trojan-Downloader.Win32.Delf Win32/Trojan.5ed


FireEye recently detected malicious Microsoft Office RTF documents that leverage CVE-2017-0199, a previously undisclosed vulnerability.


A backdoor also known as: W32.eHeur.Virus02 Worm.Rikihaki.A4 Trojan.Razy.D23D4 WORM_RIKIHAKI.SM Trojan.Tinba WORM_RIKIHAKI.SM Trojan.Win32.KillFiles.didhhl Trojan.KillFiles.14550 BehavesLike.Win32.Worm.gh TR/ATRAPS.sxzgc Worm:Win32/Rikihaki.A Trj/GdSda.A


This could change once the trojan spy has fully developed.


A backdoor also known as: W32/VBTroj.CYJD Trojan.Win32.VB!IK Trojan.Win32.VB


Most of the attacks begin with a phone call from a UK phone number, with attackers speaking in either English or Farsi.


While some ransomware i.e. Chimera give bogus threats about stealing and releasing private files, there are other malware families that in fact have made this possibility a reality.


Unit 42 researchers have uncovered a backdoor Trojan used in an espionage campaign.


The software masqueraded as a confidential document and was intended to infect a Windows computer.


A backdoor also known as: Trojan.Proxy.Delf.C Trojan-Proxy/W32.Steredir.524288 Trojan/Proxy.Steredir.a TROJ_PROXY.ARF Backdoor.Trojan.Client TROJ_PROXY.ARF Win.Trojan.Proxy-467 Trojan.Proxy.Delf.C Trojan-Proxy.Win32.Steredir.a Trojan.Proxy.Delf.C Trojan.Win32.Steredir.dqbk Trojan.Win32.Proxy.524288 Troj.Proxy.W32.Steredir.a!c Trojan.Proxy.Delf.C TrojWare.Win32.TrojanProxy.Delf.C Trojan.Proxy.Delf.C BackDoor.StealthRedir.20 W32/Risk.HXFA-2912 TrojanProxy.Steredir.m TR/Proxy.Steredir.A.2 Trojan.Proxy.Delf.C Trojan-Proxy.Win32.Steredir.a TrojanProxy:Win32/Delf.C Backdoor.RAT.StealthRedirector.V2.0 TrojanProxy.Steredir Win32/TrojanProxy.Delf.C Win32.Trojan-proxy.Steredir.Eawz Trojan.PR.Steredir!IftwXs0S3T4 W32/Delf.A!tr Win32/Trojan.Proxy.118


These attempts differed from other tactics seen by us elsewhere, such as those connected to Iran, with better attention paid to the operation of the campaign.


A backdoor also known as: Dropper.Dinwod.Win32.1277 Trojan.Zusy.D217BF Win32.Trojan.Delf.iv Trojan.Win32.Dinwod.dqohqi Trojan.MulDrop6.4509 Trojan[Dropper]/Win32.Dinwod Trojan:Win32/Walinlog.A TrojanDropper.Dinwod Win32/Delf.SRU Trojan.DR.Dinwod!WCRzCOHRNbg Win32/Trojan.c58


A backdoor also known as: Trojan.Win32.Swisyn!O Trojan.Swisyn W32/Backdoor.KUPO-4695 TROJ_SWISYN.KK Trojan.Win32.Swisyn.cbuq Troj.W32.Swisyn!c Win32.Trojan.Swisyn.Lrsk Trojan.MulDrop3.21821 Trojan.Swisyn.Win32.23323 TROJ_SWISYN.KK Trojan.Win32.Swisyn W32/Backdoor2.HJRU Trojan/Swisyn.vuq Trojan/Win32.Swisyn Trojan.Win32.A.Swisyn.35840.B[UPX] Trojan.Win32.Swisyn.cbuq TrojanDropper:Win32/Bolardoc.A Trojan/Win32.Swisyn.R43544 Trojan.Swisyn Win32/VB.ODF Trojan.Swisyn!Pk7uhYgClNU W32/Swisyn.CBUQ!tr Win32/Trojan.Dropper.c9f


The adversary had also conducted attacks using Daserf malware in the past, and Symantec refers to them as Tick in their report


A backdoor also known as: HW32.Packed.DB9B Spyware.OnlineGames W32/Palevo.eszc Riskware.Win32.Lime.cukpjv HV_PALEVO_CA2255B5.TOMC W32.Worm.Palevo-187 Worm.P2P.Palevo!qwzmy5h6XK0 Worm.Win32.A.P2P-Palevo.2637834[h] Win32.HLLW.Lime.2579 Worm.Palevo.Win32.83875 BehavesLike.Win32.Trojan.vc Worm/Palevo.cubr Worm[P2P]/Win32.Palevo Trojan.Kazy.D1020 Worm/Win32.Palevo Worm.Palevo P2P-Worm.Win32.Palevo


Malicious programs of this family request administrator rights and then make themselves invisible in the list of installed apps.


RSA Research investigated the source of suspicious, observed beaconing


A backdoor also known as: Win32.Enemany.A@mm Worm/W32.Alcaul.9728.C W32.Enemany.A.int Enemany.A Win32/Enemany.A!intended WORM_ENEMANY.A Email-Worm.Win32.Alcaul.r Win32.Enemany.A@mm I-Worm.Enemany!xtYbjkEFnbQ Win32.Enemany.A@mm Worm.Win32.Enemany.A Win32.Enemany.A@mm Worm.Alcaul.Win32.145 WORM_ENEMANY.A W32/Risk.ZRGC-4282 Worm.Alcaul.r.kcloud Worm:Win32/Enmny.A I-Worm.Win32.Enemany.A[h] Win32/Enemany.worm.9728 Win32.Enemany.A@mm Worm.Win32.Alcaul.am Win32/Enemany.A Email-Worm.Win32.Alcaul W32/Alcaul.R!worm W32/Enemany.A


A backdoor also known as: TrojanSpy.Hakey.FC.1702 TSPY_HAKEY.SM MSIL.Trojan-Spy.Keylogger.a Backdoor.Trojan Win32/SillyAutorun.FJI TSPY_HAKEY.SM Trojan.Win32.Win32.dcdhel W32/Application.ZMXW-2371 TrojanSpy:MSIL/Hakey.A MSIL/Spy.Keylogger.DY Trojan-Dropper.MSIL


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9914 Trojan-Ransom.Win32.Birele.aisl Win32.Trojan.Birele.Wtxf Trojan.MulDrop6.10288 Trojan-Ransom.Win32.Birele.aisl Trojan-Ransom.Win32.Foreign


Moreover, the presence of intrusion software does not necessarily equate to its misuse, as such software may be utilized by intelligence or law enforcement agencies in a manner that conforms with rule of law and democratic principles.


What is the scope of Chrysaor ? Chrysaor was never available in Google Play and had a very low volume of installs outside of Google Play .


This is significant, because it indicates a potential shift in the motives of this adversary.


A backdoor also known as: Backdoor/Inject.knu Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan Win.Trojan.Inject-4540 Trojan.Win32.Donbot.ctdhoe Trojan.Win32.Z.Inject.646633 BackDoor.Donbot.2 Backdoor.Inject.Win32.2858 BehavesLike.Win32.PWSZbot.jc Backdoor/Inject.cpw TR/Donbot.hjsmv Trojan/Win32.Invader Win32.Troj.Undef.kcloud Trojan:Win32/Donbot.A Backdoor/Win32.Trojan.R78442 Backdoor.Inject Win32.Trojan.Spnr.Pijv Backdoor.Inject!WaCQ7k+5qK0 Win32/Trojan.BO.cc2


The original name given to the encryptor by its creator is not known; other security vendors detect it as Trojan.Encoder.858, Ransom:Win32/Troldesh.


A backdoor also known as: W32.JaydarkE.Trojan Win32.Runouce.B@mm Virus.Worm.Win32.Runouce.1!O W32.Runouce.B Win32.Runouce.B@mm W32.W.Runouce.lk4E W32/Chir.b.dannado Win32.Runouce.E2C45E W32.Chir.B@mm Win32/Chir.B WORM_CHIR.DI Win.Worm.Brontok-88 Win32.Virus.Chir.A Win32.Runouce.B@mm Virus.Win32.Runouce.bxafx Win32.Chir.B Win32.Runouce.B@mm Win32.Runonce.6652 WORM_CHIR.DI BehavesLike.Win32.Virut.nh Email-Worm.Win32.Runouce Win32/cnPeace.b W32/Chir.I Worm[Email]/Win32.Runouce.b Worm.NimdaT.d.18848 Trojan:JS/Nimda.A Win32/ChiHack.6652 W32/Chir.b@MM Virus.Win32.Chur.A Win32/Chir.B Worm.Win32.Runouce.a I-Worm.Chir.B Win32/Trojan.1a7


A backdoor also known as: W32.Sality.PE Win32.Sality.3 Virus/W32.Sality.D Worm.Dumpy.S19687 Win32.Sality.3 Virus.Sality.Win32.25 Win32.Sality.3 Win32.Sality.3 W32.Sality.AE Win32/Sality.AA PE_SALITY.RL Trojan-Ransom.Win32.Blocker.gfeq Virus.Win32.Sality.beygb Win32.Sality.3 Win32.Sality.3 Win32.Sector.30 BehavesLike.Win32.Sality.cm Win32/HLLP.Kuku.poly2 W32/Sality.AT Worm:Win32/Dumpy.B Trojan-Ransom.Win32.Blocker.gfeq Win32.Virus.Sality.A HEUR/Fakon.mwf Virus.Win32.Sality.bakc Worm.AutoRun W32/Sality.AA Win32.Sality Win32/Sality.NBA Trojan-Ransom.Win32.Blocker.b Win32.Sality.BL Worm.Win32.Dumpy Virus.Win32.Sality.I


This all started with the great analysis and blog done by RSA in August 2017 about a phishing wave targeting Russian Banks.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9717 Trojan.Win32.Zbot.dsnigs Trojan.Reconyc.Win32.16630 TrojanSpy.Zbot.ewlp


The emails come with an attached Microsoft Word document file.


During our monitoring of activities around the APT28 threat group, McAfee Advanced Threat Research analysts identified a malicious Word document that appears to leverage the Microsoft Office Dynamic Data Exchange DDE technique that has been previously reported by Advanced Threat Research.


A backdoor also known as: Trojan.Win32.Webprefix!O Trojan.Webprefix.B3 Trojan.Webprefix.Win32.30550 Trojan/Webprefix.agl Win32.Trojan.Webprefix.d Trojan.Farfli Win32/Webprefix.F Trojan-Downloader.Win32.Klevate.bv Trojan.Win32.Webprefix.balbkt Troj.W32.Webprefix.agl!c Trojan.Win32.Krypttik.a Trojan.Webprefix.13 BehavesLike.Win32.Trojan.ch Trojan/Webprefix.w W32.Trojan.Webprefix Trojan[Packed]/Win32.Katusha Trojan:Win32/Webprefix.B Trojan.Win32.A.Webprefix.128000.B Trojan-Downloader.Win32.Klevate.bv Packed/Win32.Katusha.R3725 Trojan.Webprefix.01 Trojan.Webprefix!EZ6BvH+ekbw Packer.Win32.Katusha


A backdoor also known as: Trojan/Constructor.MS04-032.b Riskware.Win32.MS04-032.hrwi W32/Trojan.NOKE-5825 Trojan.Moo Constructor.Win32.MS04-032.b Exploit.MS04-032.B Constructor.Win32.MS04-032.b Tool.MS04.Win32.28 W32/TrojanX.IRQ Constructor.MS04-032.d KIT/MS04-032.B W32/MS04_032.B!kit HackTool[Constructor]/Win32.MS04-032 Constructor.W32.MS04-032.b!c Constructor/Xema.36864 Trojan:Win32/Shelcod.A Constructor.MS04032 VirTool.Win32.MS04 Constructor.AMN Trojan.Win32.MS04-032.b Win32/Constructor.990


A backdoor also known as: Backdoor.BO2K.1.1.2.plugin Backdoor.BO2K.1.1.2.plugin Backdoor/Orifice2K.plugin Win32.Trojan.WisdomEyes.16070401.9500.9851 W32/Risk.JQIA-3547 Backdoor.BO2K.1.1.2.plugin Backdoor.Win32.BO2K.112.plugin Backdoor.BO2K.1.1.2.plugin Trojan.Win32.BO2K-112.guih Win32.Backdoor.Bo2k.Edxg Backdoor.BO2K.1.1.2.plugin Backdoor.Win32.BO2K.112.plugin Backdoor.BO2K.1.1.2.plugin BackDoor.BO2k.plugin Backdoor.BO2K.Win32.168 Backdoor/BO2K.112.Plugin BDS/Bo2k.112.plugin.3 Trojan[Backdoor]/Win32.BO2K Backdoor.BO2K.1.1.2.plugin Backdoor.Win32.BO2K.112.plugin Backdoor:Win32/BO2K.1_12 Backdoor.BO2K.112 Win32/BO2K.112.plugin Backdoor.BO2K.plugin!QCV0kLCiRV0 Trojan.Win32.BO2K


In late August 2015, Symantec identified a previously unknown back door Trojan Backdoor.Dripion infecting organizations primarily located in Taiwan, as well as Brazil and the United States.


A backdoor also known as: TrojanDownloader.Rakhni Downloader.Rakhni.Win32.344 Trojan-Downloader.Win32.Rakhni.moc TrojanDownloader.Rakhni.hu TR/Dldr.Delf.ltfzo TrojanDownloader:Win32/Docdobex.A Trojan.Zusy.D3FCFF Trojan-Downloader.Win32.Rakhni.moc Downloader/Win32.Rakhni.C2136522 TrojanDownloader.Rakhni W32/Delf.CDW!tr.bdr Trj/GdSda.A


Malware mostly communicating with compromised domains


Programs of this family interfere with bank apps, such as the Commerzbank app or Google Play.


A backdoor also known as: Trojan.Win32.VB!O Trojan.VB Trojan/VB.pra Trojan.Kazy.D61DA Win32.Trojan.WisdomEyes.16070401.9500.9965 W32.SillyFDC Win32/Tnega.AEVL Trojan.Win32.VB.aspi Trojan.Win32.VB.eijsbx Trojan.Win32.A.VB.40960.AS Troj.W32.Vb!c Trojan.VB.Win32.100469 BehavesLike.Win32.Vilsel.pz Trojan/VB.ckmo Trojan:Win32/Tazi.A Trojan.Win32.VB.aspi HEUR/Fakon.mwf Trojan.VB Worm.AutoRun Win32/VB.PRA Win32.Trojan.Vb.Ljka Trojan.VB!n6riGwYVvNo Trojan.Win32.VB W32/SillyFDC.IZ!tr Win32/Trojan.db1


A backdoor also known as: Ransom/W32.WannaCry.5267459 Ransom.WannaCrypt.S1670344 Ransom.WannaCrypt Trojan/Exploit.CVE-2017-0147.a Ransom_WCRY.SMALYM Win32.Worm.Rbot.a Ransom.Wannacry Ransom_WCRY.SMALYM Win.Ransomware.WannaCry-6313787-0 Win32.Exploit.CVE-2017-0147.A Trojan-Ransom.Win32.Wanna.m Trojan.Win32.Wanna.epxkni Trojan.Win32.WannaCry.5267459 Troj.Ransom.W32.Wanna.toP0 Trojan.Encoder.11432 Exploit.CVE.Win32.1765 BehavesLike.Win32.RansomWannaCry.th Trojan.Wanna.k Trojan[Ransom]/Win32.Wanna Ransom:Win32/WannaCrypt.A!rsm Trojan-Ransom.Win32.Wanna.m Trojan/Win32.WannaCryptor.R200894 Hoax.Wanna Trj/GdSda.A Win32/Exploit.CVE-2017-0147.A Trojan-Ransom.Win32.Wanna.m Exploit.CVE-2017-0147! Trojan.Win32.Exploit W32/WannaCryptor.H!tr.ransom


A backdoor also known as: Packer.FSG.A Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Downloader.BFIA Downloader.Trojan TROJ_APHER.A Win.Trojan.Small-10534 Packer.FSG.A Trojan-Downloader.Win32.WebDown.10 Packer.FSG.A Trojan.Win32.WebDown.cdwvkr Packer.FSG.A TrojWare.Win32.TrojanDownloader.Apher.0700 Packer.FSG.A Trojan.DownLoader.4572 TROJ_APHER.A Trojan-Downloader.Win32.WebDown W32/Downloader.MUZI-7025 Trojan/Downloader.WebDown.10 Trojan/Win32.Unknown Packer.FSG.A Trojan-Downloader.Win32.WebDown.10 Win-Trojan/Apher.1312 Packer.FSG.A Trj/Downloader.GE Win32/Randon.A W32/Dloader.AE!tr


A backdoor also known as: Trojan.Heur.D.EED80 Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Win32.Bayrob.etejdt BehavesLike.Win32.Ipamor.jc Trojan/Win32.Scar.C59481 Trojan.Win32.Woripecs W32/Scar.CTI!tr


A backdoor also known as: Trojan/W32.Small.14336.BM Trojan.Zenshirsh.SL7 Backdoor.Small.Win32.3772 Backdoor/Small.wn BKDR_RINCUX.AD Trojan.Win32.Scar.nzec Backdoor.Win32.Small.32768.H[UPX] Backdoor.W32.Small.wn!c Trojan.DownLoad3.19355 BKDR_RINCUX.AD BehavesLike.Win32.Backdoor.lm BDS/Salamdom.A Trojan.Win32.Scar.nzec Backdoor:Win32/Salamdom.A Adware/AdHelper.B Win32/Salamdom.AA Win32.Backdoor.Small.Sxyt Backdoor.Small!t0Kn4UZH16w Trojan-Downloader.Win32.Pangu W32/ServStart.AS!tr


Our analysis confirms the excellent investigative work done by TALOS and expands on what they found.


TABLE OF CONTENTS Key Findings Introduction Threat Analysis Fakespy Code Analysis Dynamic Library Loading Stealing Sensitive Information Anti-Emulator Techniques Under Active Development Who is Behind Fakespy 's Smishing Campaigns ? Conclusions Cybereason Mobile Detects and Stops FakeSpy Indicators of Compromise INTRODUCTION For the past several weeks , Cybereason has been investigating a new version of Android malware dubbed FakeSpy , which was first identified in October 2017 and reported again in October 2018 .


A backdoor also known as: Joke/W32.ArchSMS.2449920.C Trojan.Zusy.D14269 Win32.Trojan.WisdomEyes.16070401.9500.9992 not-a-virus:WebToolbar.Win32.Webatla.b Trojan.Win32.ArchSMS.csnmld Trojan.SMSSend.4975 Tool.ArchSMS.Win32.17120 BehavesLike.Win32.BadFile.vc Trojan:Win32/Blinerarch.A Trojan/Win32.ArchSMS.C198920 Hoax.ArchSMS Trojan.ArchSMS!HGAxbs185b0 Hoax.Win32.ArchSMS


Over the course of their campaigns, we analyzed their modus operandi and dissected their tools of the trade—and uncovered common denominators indicating that PLEAD, Shrouded Crossbow, and Waterbear may actually be operated by the same group.


Hancitor is one of the better-known malware downloaders due to its numerous SPAM runs and evolving delivery technique.


A backdoor also known as: W32.FantibagB.Trojan Email-Worm.Win32.Bagle!O Win32.Trojan.WisdomEyes.16070401.9500.9958 Win32/Fantibag.E Email-Worm.Win32.Bagle.cv Email-Worm.Win32.Bagle Worm/Bagle.aac TR/Bagle.BR.A.Dll I-Worm.Win32.Bagle.FA Email-Worm.Win32.Bagle.cv Trojan:Win32/Fantibag.B Win32/Bagle.BI Trojan.Fantibag.A1


It is meant solely to empty the safe of ATMs. We detect this new malware family as BKDR_ALICE.A.


A backdoor also known as: Trojan.Dropper.Refroso.B Trojan/W32.Refroso.62976.D Trojan.Win32.Refroso!O Trojan.Injector.5265 Trojan.Refroso.Win32.766 Trojan/Refroso.dzt Trojan.Dropper.Refroso.B Win32.Trojan.WisdomEyes.16070401.9500.9997 TROJ_LETHIC.SMA Trojan.Win32.Refroso.ayz Trojan.Dropper.Refroso.B Trojan.Win32.Refroso.bwzzc Trojan.Dropper.Refroso.B Trojan.Dropper.Refroso.B BackDoor.Bifrost.26171 TROJ_LETHIC.SMA BehavesLike.Win32.Downloader.kc Backdoor/Poison.bhw Worm:Win32/Refroso.A Trojan[Downloader]/Win32.Refroso Win32.Troj.Refroso.kcloud Worm:Win32/Refroso.A Backdoor.Win32.Poison.46632 Trojan.Dropper.Refroso.B Trojan/Win32.Refroso.R694 Trojan.Dropper.Refroso.B Trojan.Win32.Buzus.8101325 Trojan.Refroso Trojan.Win32.Buzus W32/Injector.IA!tr


A backdoor also known as: TrojanPSW.LdPinch.cds PWS-Lineage.dll Trojan.Downloader-35380 Trojan-GameThief.Win32.OnLineGames.stab Trojan.PWS.Wsgame.origin PWS:Win32/Kotwir.A.dll Trojan-Downloader.Win32.Banload.aqi


A backdoor also known as: Trojan/W32.Blocker.194764 Trojan.Bepush.Win32.889 Trojan.Strictor.D7317 TROJ_SPNR.11GF13 Win32.Trojan.WisdomEyes.16070401.9500.9800 TROJ_SPNR.11GF13 Win.Trojan.Truado-1 Trojan.Win32.Dapato.dcitdy Trojan-Downloader:W32/Kilim.T Trojan.DownLoader9.41166 Trojan.JS.FBExt W32/Trojan.CAKN-6742 Trojan/Blocker.eyy TR/Dldr.Truado.B.5 TrojanDownloader:MSIL/Truado.B Trojan/Win32.Blocker.R77853 Hoax.Blocker Trj/CI.A Trojan.Blocker!Jm7NxUGe2as Win32/Trojan.a10


A backdoor also known as: Trojan.PWS.LdPinch.TMK Trojan-PWS/W32.LdPinch.557056 Trojan.PWS.LdPinch.TMK Trojan.PWS.LdPinch.TMK Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Win32.Pakes.nkj Trojan.PWS.LdPinch.TMK Trojan.Win32.Pakes.gkhlc Trojan.PWS.LdPinch.TMK Trojan.PWS.LdPinch.TMK BehavesLike.Win32.VirRansom.hc Trojan.PWS.LdPinch.TMK Trojan.DR.Jeshex!G2i88bn5YEw W32/LdPinch.TNV!tr.pws Win32/Trojan.PWS.912


A backdoor also known as: BehavesLike.Win32.BadFile.nm TrojanDownloader:Win32/Xuwuq.A


A backdoor also known as: W64.HfsAutoA.4EC7 Exploit.CVE-2015-1701.A Trojan.Win64 Exploit.CVE-2015-1701.A W64/Trojan.CBXE-7834 Exploit.CVE-2015-1701.A Exploit.Win64.CVE-2015-1701.b Exploit.CVE-2015-1701.A Exploit.CVE-2015-1701.A Exploit.CVE2015-1701.1 BehavesLike.Win64.BadFile.mh Virus.Win32.Virut Exploit.CVE-2015-1701.e Trojan[Exploit]/EXE.CVE-2015-1701 Exploit.CVE-2015-1701.A Exploit.Win64.CVE.tnlV Exploit.Win64.CVE-2015-1701.b Trojan/Win32.Exploit.R200799 Exploit.Win64.CVE-2015-1701 Trj/CI.A Win64.Exploit.Cve-2015-1701.Ahyf W64/CVE_2015_1701.A!tr Win32/Trojan.Exploit.059


A backdoor also known as: Trojan.Win32.Cult.fvly W32/Cult.B@mm W32.HLLW.Cult@mm Win32/Cult.E Email-Worm.Win32.Cult.b Win32.Cult.B@mm I-Worm.Cult.B Worm.Win32.Cult.B Win32.HLLW.SpyBot I-Worm/Cult.b Worm.Cult.b.kcloud Worm:Win32/Cult.D@mm I-Worm.Win32.Cult.16418 Win32/Cult.worm.16418 Win32.Cult.B@mm W32/Cult.B@mm Worm.Cult Net-Worm.Cult Win32/Cult.B Worm.Cults.b Email-Worm.Win32.Cult W32/Cult.B


Last week, an Endgame researcher was analyzing spam emails for indications of emergent malicious activity.


Symantec is currently investigating reports of yet another new attack in the Middle East involving the destructive disk-wiping malware used by the Shamoon group W32.Disttrack, W32.Disttrack.B.


A backdoor also known as: W32.OnlineGamesXTUG.Worm Trojan-PSW.Win32.QQShou!O Trojan/PSW.QQShou.aqt Trojan.Win32.QQShou.evyqv TROJ_AGKT.SMUS6 Trojan.Qqshou-23 Trojan-PSW.Win32.QQShou.pfp Trojan.PWS.QQShou!WQNr+ttAX9g Trojan.Win32.PSWQQShou.80480[h] Troj.PSW32.W.QQShou.aqt!c Trojan.QQShou.Win32.1230 TROJ_AGKT.SMUS6 BehavesLike.Win32.Autorun.lc Trojan/PSW.QQShou.adz W32/VB.NII!tr Trojan[PSW]/Win32.QQShou Trojan.Graftor.D33E1 Trojan/Win32.QQShou PWS:Win32/QQpass.DW Win32/QQPass.NVO TrojanPSW.QQShou Win32.Trojan-qqpass.Qqrob.Hwwq Trojan-PWS.Qqshou Trojan.Win32.VB.NII


A backdoor also known as: Trojan/W32.Rootkit.9056.H Win32.Trojan.WisdomEyes.16070401.9500.9999 Hacktool.Rootkit Win32/Rookuz.S Trojan.Win32.Hmir.bczend Trojan.NtRootKit.13456 Downloader.Hmir.Win32.3829 Backdoor.Winnt Trojan[Downloader]/Win32.Hmir Troj.GameThief.W32.OnLineGames.kZeW Backdoor:WinNT/Blazgel.A Trojan/Win32.Rootkit.R24603 TrojanDownloader.Hmir Win32/RootKit.Rootkit.03f


A backdoor also known as: HW32.Packed.BD3E


Symantec first began looking into this threat in the fall of 2013.


A backdoor also known as: Trojan.Win32.A.Downloader.39936.EG Trojan.DownLoad2.31494 W32/Trojan.BMBV-5898 TR/Vodvit.A.10 Trojan:Win32/Vodvit.A Trojan.Graftor.D79FB


A backdoor also known as: HW32.Packed.71D4 Win32.Trojan.Kryptik.hj W32/Trojan.YMZM-8551 Trojan.Win32.SpyEyes.cxesvi Trojan.PWS.Papras.244 BehavesLike.Win32.DocumentCrypt.dc Trojan[Spy]/Win32.SpyEyes Trojan.Kazy.D5A6E2 TrojanDropper:Win32/Vawtrak.A Trojan/Win32.Reveton.R107579 TrojanPSW.Tepfer Backdoor.Andromeda Win32.Trojan.Atraps.Pbfq TrojanSpy.SpyEyes!jq5iqgzT3B4 Trojan-Spy.Zbot W32/Kryptik.EWVT!tr Win32/Trojan.73f


A backdoor also known as: W32.BackdoorWabot.Trojan Backdoor.Win32.Wabot!O Trojan.Wabot.A8 Trojan/Delf.nrf Win32.Backdoor.Wabot.a W32.Wabot Win32/DCMgreen.A BKDR_WABOT.SMIA Win.Trojan.Wabot-6113548-0 Backdoor.Win32.Wabot.a Trojan.Win32.Wabot.dmukv Backdoor.Win32.Wabot.157619 Backdoor.W32.Wabot.tn6b Trojan.Win32.Wabot.a Backdoor.Win32.Wabot.A Trojan.MulDrop6.64369 Backdoor.Wabot.Win32.1 BKDR_WABOT.SMIA BehavesLike.Win32.Wabot.wc P2P-Worm.Win32.Delf Backdoor/Wabot.z Trojan[Backdoor]/Win32.Wabot.a TrojanSpy:MSIL/Omaneat.B Trojan.ShellIni.E7E294 Backdoor.Win32.Wabot.a Worm/Win32.IRCBot.R3689 Backdoor.Wabot Backdoor.Wabot I-Worm.Delf.NRF Win32/Delf.NRF Backdoor.Wabot!jai+hnpgbwI W32/Luiha.M!tr


Starting on May 11, 2017, Flashpoint analysts observed several large spam campaigns originating from the Necurs botnet that aim to dupe recipients into opening malicious attachments that infect their computers with Jaff ransomware.


A backdoor also known as: Backdoor.Celofot.D Trojan/W32.Sasfis.93184.B Trojan.Win32.Sasfis!O Trojan.Sasfis TROJ_DELF.SMH Win32.Trojan.WisdomEyes.16070401.9500.9986 W32/Risk.WXEM-5531 Backdoor.Bifrose Trojan.Sasfis Win32/Sasfis.NUH Win.Trojan.Sasfis-42 Backdoor.Celofot.D Trojan.Win32.Sasfis.aobz Backdoor.Celofot.D Trojan.Win32.Sasfis.ikchn Trojan.Win32.A.Sasfis.93696.C Troj.W32.Smardf.lrGo Backdoor.Celofot.D Trojan.DownLoader4.42747 BehavesLike.Win32.SpywareLyndra.nc Trojan-Dropper.Delf W32/MalwareS.BHQS Trojan/Sasfis.koz Trojan/Win32.Sasfis.aobz Backdoor:Win32/Nitvea.A Backdoor.Celofot.D Trojan.Win32.Sasfis.aobz Trojan/Win32.Sasfis.R20535 Backdoor.Celofot.D Backdoor.Celofot.D Win32.Trojan.Sasfis.Pijo Trojan.Sasfis!nQm4iaN0os8 W32/Sasfis.LB!tr Win32/Trojan.6e1


A backdoor also known as: W32.FamVT.ExpiroPC.PE Win32.Backdoor.Prorat.e W32/Prorat.BNXP-3134 Backdoor.Prorat Win32/Prorat.19.P Win.Trojan.Delf-1540 Trojan.Win32.Tiny.baadu Backdoor.W32.Prorat!c BackDoor.ProRat.19 BehavesLike.Win32.Adware.tc Backdoor.Win32.Prorat W32/ProratX.ANJ BDS/Lurpen.rts W32/BDoor.AVW!dam Backdoor/Win32.Prorat.R111443 Backdoor.Prorat Bck/Prorat.HT Backdoor.Prorat!o+pRlXhwebo


A backdoor also known as: W32.OnlinegameJTPX.Trojan Virus.Win32.Sality!O Troj.GameThief.W32.WOW.hre!c Win32.Trojan.WisdomEyes.16070401.9500.9997 Infostealer.Gampass Win32/Wowpa.HS TROJ_FAM_0001989.TOMA Win.Trojan.Delf-1669 Trojan.Win32.PSWWow.22440.B TrojWare.Win32.Trojan.Banker.~d08 Trojan.PWS.Wow.1283 Trojan.WOW.Win32.2972 TROJ_FAM_0001989.TOMA BehavesLike.Win32.Sality.lc W32/Trojan.EOQM-5227 Trojan/PSW.Moshou.ars Trojan[GameThief]/Win32.WOW Win32.Troj.PswWowT.lk.kcloud TrojanDropper:Win32/Dozmot.B Trojan/Win32.OnlineGameHack.C54025 BScope.Trojan.OnlineGames.0825 Win32/PSW.WOW.DZI Win32.Trojan.Heurinject.Lnxt


A backdoor also known as: Joke.Movingmouse Joke/W32.BadJoke.21504 Joke.Movingmouse Joke.MoveMouse Win.Joke.MovingMouse-1 Hoax.Win32.BadJoke.MovingMouse.a Joke.Movingmouse Riskware.Win32.MovingMouse.hrfx Hoax.BadJoke.21504.A Win32.Trojan-psw.Badjoke.Suno Joke.Win32.BadJoke.MovingMouse.~FCD Joke.Movingmouse Trojan.MulDrop.28720 Aplicacion/MovingMouse.a not-a-virus:BadJoke.Win32.MovingMouse.a W32/Joke.RZZA-1623 not-virus:Joke.Win32.MovingMouse HackTool[Hoax]/Win32.MovingMouse Joke.Movingmouse Hoax.W32.BadJoke.MovingMouse.a!c Hoax.Win32.BadJoke.MovingMouse.a Joke.Movingmouse Unwanted/Win32.Movingmouse.R123022 Joke.Movingmouse Win32/Hoax.MovingMouse.B Win32/Trojan.2ff


A backdoor also known as: W64/Application.KFTW-0763 Trojan.Win64.AdAnti.exbcmq ADWARE/AdAnti.nqwib Adware.ChinAd Trj/CI.A Win32/Trojan.7be


A backdoor also known as: Trojan.MSIL Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.MSIL.SpyGate.wsr Trojan.Win32.Disfa.dqmqly BehavesLike.Win32.Trojan.cc GrayWare/MSIL.Injector.AWA Trojan.Zusy.D28231 Trj/CI.A Trojan.Win32.Fsysna Win32/Trojan.7c5


Consumers in English-speaking countries, in particular the US and UK, are most at risk, since this is where the largest numbers of targeted banks are located.


Earlier this month, we spotted a phishing campaign that led victims to unknowingly download the Banker malware.


A backdoor also known as: Trojan.Skeeyah.S5 Downloader.Chindo.Win32.162 Trojan.Adware.Graftor.D374DC not-a-virus:Downloader.Win32.Chindo.ap Trojan.Win32.Chindo.dumnyn Variant.Mikey.mvHB Adware.Chindo.12 PUA.RiskWare.Chindo RiskWare[Downloader]/Win32.Chindo.ap TrojanDownloader:Win32/Codumwis.B not-a-virus:Downloader.Win32.Chindo.ap BScope.Malware-Cryptor.Ngrbot Win32/RiskWare.Chindo.L


Odatv is a secular news organization founded in 2007 with a reputation for being critical of Turkey's government and the Gülen Movement.


This threat can download other malware and unwanted software onto your PC.


These URLs are all in the form of “ http : // $ C2. $ SERVER. $ IP/api/ ? id= $ NUM ” .


A backdoor also known as: Backdoor.Bladabindi.FC.3722 Trojan.Zusy.D3D182 Win32.Trojan.WisdomEyes.16070401.9500.9999 BehavesLike.Win32.Trojan.lt MSIL/Small.CM!tr


A backdoor also known as: Trojan.Yakes.8842 Trojan/CsNowDown.c Win32.Trojan.WisdomEyes.16070401.9500.9736 Downloader.Darkmegi Win.Trojan.Darkcpn-1 Trojan.Win32.Yakes.ktpl Trojan.Win32.Gamania.dridjs Trojan.PWS.Gamania.34539 BehavesLike.Win32.Backdoor.ct Trojan.Graftor.DCAF7 Trojan.Win32.Yakes.ktpl Trojan:WinNT/Waltrodock.A Downloader/Win32.Darkmegi.C1839200 Trj/CI.A W32/CsNowDown.C


Upon investigation we have determined the malware payload to be DELoader, which downloads a Zeus variant banking trojan upon execution.


A backdoor also known as: Trojan.Lexfir.A TrojanAPT.Lexfir.A6 Trojan.Lexfir.A TSPY_DERUSBI.SMJ1 Win32.Trojan.WisdomEyes.16070401.9500.9979 Infostealer.Derusbi TSPY_DERUSBI.SMJ1 Win.Trojan.Derusbi-42 Trojan.Lexfir.A Backdoor.Win32.Winnti.jr Trojan.Lexfir.A Trojan.Lexfir.A Trojan.Lexfir.A DLOADER.PWS.Trojan W32/Trojan.ZNCA-7493 TR/PSW.Lexfir.A.3 Trojan.Lexfir.A Backdoor.Win32.Winnti.jr PWS:Win32/Lexfir.A Backdoor/Win32.Etso.R30303 Win32.Backdoor.Winnti.Lfzs Trojan.Derusbi!jrrDP0rufRk Trojan-Spy.Win32.Derusbi W32/DERUSBI.C!tr Win32/Trojan.PSW.186


The unidentified financial group targeted regional and global banks with offices in the Middle East.


Security Service of Ukraine SBU indicated that Russian spies had implanted malicious softwares in the State Grid which caused power plants shut down unexpectedly.


A backdoor also known as: W32.LarmogasD.Trojan Dropped:Backdoor.Hupigon.211672 W32.Jadtre.B4 Trojan.Black.Win32.3180 Trojan/Dropper.Delf.dlv Dropped:Backdoor.Hupigon.211672 W32/Risk.UMVG-4201 TROJ_JADTRE.SMM Win.Spyware.66802-2 TScope.Malware-Cryptor.SB W32.Parite.lf96 TrojWare.Win32.PSW.OnLineGames.~LLD Trojan.PWS.Legmir.3153 BehavesLike.Win32.Gate.nh W32/Dropper.ANYI Trojan/KillAV.bbj TR/Drop.Delfdru.O Win32.PSWTroj.OnLineGames.kcloud Backdoor.Hupigon.D33AD8 Dropped:Backdoor.Hupigon.211672 Dropper/Win32.Microjoin.R1379 Dropped:Backdoor.Hupigon.211672 Dropped:Backdoor.Hupigon.211672 Trj/CI.A Trojan.DR.Delfdru!ayAD7it/9FQ Win32/Trojan.Dropper.cad


APT19 used three different techniques to attempt to compromise targets.


A backdoor also known as: AIT:Trojan.Autoit.CAQ AIT:Trojan.Autoit.CAQ Win32.Trojan.WisdomEyes.16070401.9500.9949 AIT:Trojan.Autoit.CAQ Trojan-Banker.Win32.AutoIt.zl AIT:Trojan.Autoit.CAQ Trojan.DownLoader23.53524 Trojan/Banker.AutoIt.bu TrojanSpy:Win32/Aneatop.A Trojan-Banker.Win32.AutoIt.zl Win32.Trojan-banker.Autoit.Suny Win32/Trojan.5f1


A backdoor also known as: W32.WscmgrA.Trojan Trojan-PSW.Win32.Delf!O Trojan/PSW.Delf.abx Win32.Trojan.WisdomEyes.16070401.9500.9700 W32/Autorun.MSPP-2235 W32.SillyFDC Win32/Retecha.A WORM_DELF.NAN Win.Trojan.Delf-3449 Trojan-PSW.Win32.Delf.abx Trojan.Win32.Delf.brmlqc Trojan.Win32.Autorun.382020 Win32.Trojan-qqpass.Qqrob.Sxyo Trojan.PWS.Sadas Trojan.Delf.Win32.3468 WORM_DELF.NAN W32/Autorun.O Trojan/PSW.GamePass.yqg TR/PSW.Delf.abx.3 Worm:Win32/Hamtacker.A Trojan-PSW.Win32.Delf.abx Worm/Win32.AutoRun.R76556 Worm.Brontok Trojan.Delf.ABX Win32/PSW.Delf.ABX Hacktool.Dialuppass.A not-a-virus:PSWTool.Win32.Dialupass.an W32/Autorun.PG.worm Win32/Trojan.PSW.8bb


Yet perhaps most notably, BianLian has shifted the main focus of their attacks away from ransoming encrypted files to focus more on data-leak extortion as a means to extract payments from victims.


Visa also published a list of Internet addresses that may have been involved in the Oracle breach and are thought to be closely tied to an Eastern European organized cybercrime gang.


Destructive malware used by unknown computer network exploitation CNE operators has been identified.


The earliest instance where a cyber attack was attributed to the OilRig campaign was in late 2015.


If the geolocation points to Brazil, then another malicious file is downloaded.


A backdoor also known as: Trojan.BitcoinMiner Win32.Trojan.WisdomEyes.16070401.9500.9983 Downloader.MisleadApp not-a-virus:RiskTool.Win32.BitCoinMiner.iqlc Trojan.Win32.Z.Svcminer.27648 RiskTool.BitCoinMiner.gvg TR/Downloader.knzhj RiskWare[RiskTool]/Win32.BitCoinMiner TrojanDownloader:Win32/SvcMiner.A!bit not-a-virus:RiskTool.Win32.BitCoinMiner.iqlc Trojan/Win32.Mepaow.C87266 Trj/GdSda.A Trojan.CoinMiner


A backdoor also known as: W32.RadmasAM.Trojan Worm/W32.Updater.65536.B Virus.Win32.Sality!O Win32.Worm.Pepex.b W32.Virut.CF Win32/Tnega.AQRF WORM_DIPASIK.SM Win.Worm.Updater-4 Email-Worm.Win32.Updater.n Hoax.W32.ArchSMS.m5oU Win32.HLLM.Updater.5 WORM_DIPASIK.SM Email-Worm.Win32.Atak Worm/Updater.e Worm[Email]/Win32.Updater Worm:Win32/Networm.A Email-Worm.Win32.Updater.n Trojan/Win32.Kykymber.R128813 Worm.Updater Win32/Pepex.I Trojan.Win32.Snake.a


Several days ago, researchers at FireEye attributed a recent phishing campaign to FIN7, a campaign in which cybercriminals delivered malicious Microsoft Office documents to users, deploying both Cobalt Strike and a VBS-based backdoor on infected workstations.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9974 Trojan.Win32.ArchSMS.cwxrht Hoax.MSIL.gn Trojan:MSIL/Blinerarch.AU Trj/CI.A Msil.Risk.Hoax.Wure Trojan.ArchSMS!IMpJTYjIG18 Hoax.MSIL Win32/Trojan.Dropper.411


A backdoor also known as: W32/Systex.A Trojan.Inject1.7920 Win32.Troj.Undef.kcloud VirTool:Win32/Obfuscator.XZ Rootkit.Xytets HeurEngine.Vmpbad Trojan.Spy.Texy!4898 Trojan.Win32.Spy Trj/Thed.W


A backdoor also known as: Trojan.Graftor.D255EA Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan BackDoor.Miniduke.3 BehavesLike.Win32.RansomWannaCry.tz Trojan.Win32.Bayrob TR/Crypt.ZPACK.88814 Trojan[Backdoor]/Win32.CosmicDuke Win32.Hack.CosmicDuke.h.kcloud Trojan:Win32/Bandiu.A Backdoor.CosmicDuke Backdoor.CosmicDuke! W32/CosmicDuke.F!tr.bdr


A backdoor also known as: Virus.Pesin.Win32.2 Trojan.Heur.E41DEE Win32.Trojan.WisdomEyes.16070401.9500.9997 Win32/Pesin.C Virus.Win32.HLLW.Delf.b Virus.Win32.HLLW.gjjl Trojan.PWS.Mob Trojan/HLLP.s W32/Banker.TOA!tr Worm:Win32/Pesin.C Virus.Win32.HLLW.Delf.b Trojan.Worm.Delf


A backdoor also known as: W32.HfsAutoB.35FE WORM_METSYS.SMI W32/Trojan.ZLO Win32/ProRat.AL WORM_METSYS.SMI Trojan.Ratibe W32/Trojan.JJUN-8278 Trojan:Win32/Metsys.A HEUR/Fakon.mwf W32/MediaTest.A.worm


A backdoor also known as: W32.RansomGimemoE.Trojan Trojan-Ransom.Win32.Gimemo!O Trojan.Dofoil.A Trojan.Gimemo.Win32.2687 Trojan/Injector.sxm Win32.Trojan.Injector.ec W32.Pilleuz Win32/Loktrom.FR TROJ_RANSOM.SM3 Win.Trojan.Injector-603 Trojan-Ransom.Win32.Gimemo.vhu Trojan.Win32.Gimemo.tfgni Trojan.Win32.A.Gimemo.83968 Trojan.Packed.22718 TROJ_RANSOM.SM3 BehavesLike.Win32.ZBot.dc Trojan/Gimemo.cmk Trojan[Ransom]/Win32.Gimemo Ransom:Win32/Loktrom.A Trojan.Zusy.D2A53 Win.Adware.Websearch.moge Trojan-Ransom.Win32.Gimemo.vhu Trojan/Win32.Injector.R30428 BScope.Trojan-Injector.2151 Trojan.Injector!ZShGusAMkc8 Trojan-Ransom.Win32.Gimemo W32/Zbot.YW!tr


In the past two years, two campaigns of Sakula activity stand out as being particularly significant – the French Aerospace Campaign and the Ironman Campaign.


After the files are encrypted filenames are appended with .rokku


A backdoor also known as: Trojan.VB Trojan.Midie.DA596 Win32.Trojan.VB.gx W32/Trojan.ZVBM-4484 Win32/FakeRecycled.A WORM_VB.SMF Win.Trojan.VB-684 Trojan.Win32.VB.aqt Trojan.DownLoad3.64248 WORM_VB.SMF BehavesLike.Win32.Dropper.wc Trojan.Atros6 W32/Trojan.XUP Trojan.Qhost.pw TR/VB.AQT Trojan/Win32.VB Worm:Win32/Fakerecy.A Trojan.Win32.VB.aqt Trojan/Win32.Tiggre.R216587 SScope.Trojan.VBRA.7311 Trj/CI.A Worm.Autorun.DU


As a part of this campaign, we also observed attacks on Russian-speaking financial analysts working at global financial firms and covering telecom corporations in Russia, likely a result of collateral damage caused by the attackers targeting tactics.


A backdoor also known as: Trojan.Win32.Jorik.IRCbot!O Trojan.Jorik Trojan.Jorik.Win32.190644 Troj.W32.Jorik.Ircbot!c Trojan/IRCBot.nhr Win32.Trojan.WisdomEyes.16070401.9500.9992 W32.IRCBot Trojan.Win32.Jorik.IRCbot.wja Trojan.Win32.Jorik.dgdeqb BackDoor.IRC.Sdbot.17833 BehavesLike.Win32.Trojan.nh Trojan.Win32.Jorik Trojan/Jorik.gmen Trojan/Win32.IRCbot Trojan.Win32.Jorik.IRCbot.wja Trojan:Win32/Squida.A Worm/Win32.IRCBot.R123038 Trojan.IRCbot Win32.Trojan.Jorik.Ahef Win32/Trojan.053


The newest variant, TeslaCrypt 2.0, uses the same encryption algorithm; however, the keys and other configuration data are stored in the Windows Registry instead of a file on the local disk as in previous versions.


During our investigation, we were able to discover a number of domains all part of the same infrastructure with custom skimmers for several Magento stores.


The Trojan may ask the user to pay a ransom in order to have their files decrypted.


While SeaDuke is a single - albeit cross-platform - trojan, CloudDuke appears to be an entire toolset of malware components, or solutions as the Duke group apparently calls them.


A backdoor also known as: Trojan.Strictor.D1A6AB BehavesLike.Win32.DlHelper.tc Trojan:Win32/Merca.A Trj/GdSda.A Trojan-Spy.Banker W32/Delf.OKU!tr


A backdoor also known as: W32.HfsAuto.5860 Backdoor.Lesbot.152 Backdoor.Lesbot.152.n2 Trojan.Win32.Lesbot.djep Win32/Lesbot.B WORM_NETSPREE.A Backdoor.Win32.Lesbot.152 Backdoor.Lesbot.152 Backdoor.Leeter.B Worm.Win32.Netspree Worm.Win32.Netspree.A Backdoor.Lesbot.152 Win32.IRC.Bot.based WORM_NETSPREE.A Backdoor/Lesbot.152 Bck/Lesbot.152 Win32.Hack.Lesbot.kcloud Backdoor.Lesbot.152 W32/Risk.OZRI-5730 Win32/Netspree.worm.48448 Win32/Netspree.A Backdoor.Lesbot.152.a Backdoor.Win32.Lesbot.152 W32/Lesbot.152!tr


A backdoor also known as: Trojan-Spy/W32.AutoHK.877056 TrojanSpy.AutoHK W32/Trojan.FIJU-8952 Trojan-Spy.Win32.AutoHK.b Trojan.Win32.Z.Autohk.877056.A Win32.Trojan-spy.Autohk.Anzi TrojWare.Win32.Hadoc.AS BehavesLike.Win32.Dropper.ch PUA.EnigmaProtector TrojanSpy.AutoHK.a Trojan:Win32/Haudicx.A!bit Troj.Spy.W32!c Trojan-Spy.Win32.AutoHK.b Trojan/Win32.Asprox.R130565 TrojanSpy.AutoHK Win32/Spy.AHK.E


A backdoor also known as: W32.Cantone.Trojan Win32.Worm.TTE Worm.Win32.Zombaque!O Worm.Ppzombie.A3 Worm.Zombaque.Win32.16 Win32.Worm.TTE WORM_BIZOME.SMF W32/Risk.KAIL-2278 W32.Spybot.Worm Win32/Zombaque.B WORM_BIZOME.SMF Win.Worm.Bizome-4 Worm.Zombaque Worm.Win32.Zombaque.h Trojan.Win32.Zombaque.igegn Trojan.Win32.P2P-Icmp.437760 Win32.HLLW.RAhack.2 BehavesLike.Win32.Downloader.gc Worm.Win32.Zombaque W32/Zombaque.A Worm/Zombaque.k Win32.Virut.cr.61440 Worm:Win32/Ppzombie.A Win32.Worm.TTE Worm.Win32.Zombaque.h Worm/Win32.Zombaque.R15854 Win32.Worm.TTE Win32.Worm.TTE Win32/Zombaque.B Virus.Win32.Virut.ue Worm.Zombaque!1mLwNArV7Hg


The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality.


A backdoor also known as: Trojan.Ceeinject.6879 PWS-Spyeye.cr Trojan/PornoAsset.avl TROJ_KRYPTO.SMOZ Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Ransom.AQY TROJ_KRYPTO.SMOZ Win.Trojan.Ransom-1156 Trojan.Win32.A.PornoAsset.43521 Trojan.Winlock.3300 PWS-Spyeye.cr Trojan/PornoAsset.nh TR/Winlock.CR Trojan[Backdoor]/Win32.Buterat Trojan.Barys.D8A2 Ransom:Win32/Trasbind.A Trojan/Win32.Tdss.R14197 Hoax.PornoAsset Trojan.Win32.Jorik


On the 9th of August, a tweet from @MalwareHunterTeam caught my eye; it mentioned a fake Flash update that used a PowerShell script to connect to a very particular host


Nemesis, the malware ecosystem used by FIN1, includes comprehensive backdoors that support a variety of network protocols and communication channels for command and control CnC.


A backdoor also known as: W32.HfsOval.152A Backdoor.Win32.VB!O Backdoor.VB.MV3 Trojan.Llac.Win32.24709 Trojan/Injector.eih BKDR_RSHOT.SMA Win32.Backdoor.VB.y BKDR_RSHOT.SMA Win.Trojan.6387874-3 Trojan.Win32.Temr.ssc Trojan.Win32.Temr.ejiehl Backdoor.W32.Ciadoor.lo5L TrojWare.Win32.Qhost.nls Trojan.DownLoader16.56820 Backdoor.Win32.VB BehavesLike.Win32.Trojan.tc Trojan.Temr.ak Backdoor:Win32/Lybsus.A Trojan.Graftor.D4305 Backdoor.Win32.A.VB.168034 Trojan.Win32.Temr.ssc Backdoor.Win32.VB Backdoor.VB Trojan.Injector!pDYfo+3Pf04 Trojan-Spy.Win32.KeyLogger W32/DarkKomet.GUKH!tr Trj/CI.A


Technical details Here is the meta information for the observed samples , certificates and hardcoded version stamps : Certificate MD5 Module Version Serial Number : 0x76607c02 Issuer : CN=Ron Validity : from = Tue Aug 30 13:01:30 MSK 2016 to = Sat Aug 24 13:01:30 MSK 2041 Subject : CN=Ron 9e005144ea1a583531f86663a5f14607 1 – 18abe28730c53de6d9e4786c7765c3d8 2 2.0 Serial Number : 0x6a0d1fec Issuer : CN=Sun Validity : from = Mon May 16 17:42:40 MSK 2016 to = Fri May 10 17:42:40 MSK 2041 Subject : CN=Sun 9ffc350ef94ef840728564846f2802b0 2 v2.51sun 6c246bbb40b7c6e75c60a55c0da9e2f2 2 v2.96s 7c8a12e56e3e03938788b26b84b80bd6 2 v3.09s bde7847487125084f9e03f2b6b05adc3 2 v3.12s 2560942bb50ee6e6f55afc495d238a12 2 v3.18s It ’ s interesting that the issuer “ Sun ” matches the “ Sun1 ” and “ Sun2 ” identifiers of infected devices from the FTP server , suggesting they may be test devices .


A backdoor also known as: Backdoor.Masteseq Win32.Trojan.WisdomEyes.16070401.9500.9872 Backdoor.Masteseq Trojan.Win32.Masteseq.evvgyd Backdoor.W32.Masteseq!c BackDoor.Liskey Backdoor.Masteseq.x Backdoor:Win32/Masteseq.AC Trojan/Win32.Masteseq.R12342 Trj/GdSda.A Win32.Backdoor.Masteseq.Lpbn Backdoor.Win32.Masteseq Win32/Trojan.d37


Cisco Talos is currently observing a widespread campaign leveraging the Samas/Samsam/MSIL.B/C ransomware variant.


Last March 2016, we noted that PowerWare crypto-ransomware also abused PowerShell.


What makes this botnet successful is its highly configurable and modular design that can fit any malicious intent, like distributing Zeus or, more recently, distributing a Lethic bot.


A backdoor also known as: Trojan.Exploit.WordPerf.B Trojan/Exploit.WordPerf.b TROJ_WORDPERF.B W32/Risk.DAAG-1937 Win32/Exploit.WordPerf.B TROJ_WORDPERF.B Win.Trojan.Exploit-204 Exploit.Win32.WordPerf.b Trojan.Exploit.WordPerf.B Exploit.Win32.WordPerf.gpac Exploit.W32.WordPerf.b!c Trojan.Exploit.WordPerf.B TrojWare.Win32.Exploit.WordPerf.B Trojan.Exploit.WordPerf.B Exploit.Qaaz Exploit.WordPerf.Win32.2 Exploit.WordPerf.b TR/Expl.WordPerf.B Trojan[Exploit]/Win32.WordPerf Win32.EXPLOIT.WordPerf.b.kcloud Exploit:Win32/WordPerf.B Trojan.Exploit.WordPerf.B Exploit.Win32.WordPerf.b Trojan.Exploit.WordPerf.B Trojan.Exploit.WordPerf.B Win32.Exploit.Wordperf.Wxrv Exploit.WordPerf!zPzGZ0A1+Q4 Trojan.Win32.Exploit W32/WordPerf.B!exploit Win32/Trojan.827


Rokku seems to be distributed by a malicious document, which contains a macro that when is executed downloads and runs Rokku.


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G PE_VIRUX.O W32.Virut.CF Win32/Virut.17408 PE_VIRUX.O Win32.Virus.Virut.Q Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg W32.Virut.mzNk Win32.Virut.56 Virus.Virut.Win32.1938 Win32/Virut.bt Virus/Win32.Virut.ce Win32.Virut.cr.61440 TrojanDownloader:MSIL/Tackerkin.A Virus.Win32.Virut.ce Win32/Virut.F Virus.Virut.14 W32/Sality.AO Win32/Virut.NBP Trojan-Downloader.MSIL W32/Virut.CE Virus.Win32.VirutChangeEntry.A


A backdoor also known as: Ransom.Ryzerlo.A3 Trojan.Ransom.HiddenTears.1 Ransom_BLOCCATO.SM Ransom.HiddenTear Ransom_BLOCCATO.SM MSIL.Trojan-Ransom.Cryptear.B Trojan.Win32.Filecoder.ethwkz Trojan.Win32.Z.Ransom.211968.EF TrojWare.MSIL.Ransom.Ryzerlo.A Trojan.Encoder.10598 Trojan-Ransom.HiddenTear TR/ATRAPS.jnrzk Ransom.HiddenTear/Variant Trojan.Ransom.HiddenTear Trj/GdSda.A MSIL/Filecoder.Y!tr Win32/Trojan.61e


A backdoor also known as: W32.Clod232.Trojan.380a Heur.Win32.Veebee.1!O TrojanSpy.VB!WEMPyAgOnlg W32/MalwareF.ZFHU Trojan-Spy.Win32.VB.dwb Trojan.Win32.VB.cpxay Trojan.Win32.A.VB.77932 TrojWare.Win32.TrojanSpy.VB.NNW Trojan.DownLoader1.62643 Trojan[Spy]/Win32.VB PWS:Win32/Gypthoy.A W32/Risk.FBWB-6710 Trojan.VBRA.02824 Trojan-Spy.Win32.VB W32/VB.DWB!tr


The attack was found to heavily rely on RTF exploits and at the time, thought to make use of the PlugX malware family.


A backdoor also known as: W32.Vetor.PE Backdoor.Bot.97496 W32.Virut.D Backdoor.Bot.97496 Virus.LdPinch.Win32.1 W32/Virut.F Backdoor.Bot.D17CD8 Win32.Virus.Virut.i W32/Sdbot.ACIH W32.IRCBot PE_VIRUT.D-1 Win.Trojan.Virut-16 Backdoor.Bot.97496 Virus.Win32.Virut.n Backdoor.Bot.97496 Virus.Win32.Virut.jxol Backdoor.Win32.A.IRCBot.97792 Virus.W32.Virut!c Backdoor.Bot.97496 PE_VIRUT.D-1 BehavesLike.Win32.Virut.pc Worm.Win32.Kulsibot W32/Sdbot.OGIG-1311 Win32/Virut.e Virus/Win32.Virut.n Win32.Virut.n.2600 Worm:Win32/Kulsibot.A Virus.Win32.Virut.n Win32/Virut.D Win32/Virut.E Virus.Win32.HanKu.e Virus.Win32.Virut.AT


A backdoor also known as: W32.BypauTH.Trojan Application.Hacktool.Vncpass.A Trojan-Spy/W32.Vnc.32768 NetTool.Win32.VNC!O Tool.VNC.Win32.1 Win32.Trojan.WisdomEyes.16070401.9500.9990 W32/Tool.PPKE-1202 Backdoor.Prorat Application.Hacktool.Vncpass.A not-a-virus:NetTool.Win32.VNC.a Application.Hacktool.Vncpass.A Riskware.Win32.VNC.hsfc Application.Hacktool.Vncpass.A ApplicUnsaf.Win32.NetTool.VNC.A Application.Hacktool.Vncpass Tool.VncBypauth not-a-virus:NetTool.Win32.VNC W32/HackTool.CDN NetTool.VNC.b HackTool[NetTool]/Win32.VNC Application.Hacktool.Vncpass.A not-a-virus:NetTool.Win32.VNC.a Win-AppCare/Vnc.32768 HackTool.VNC!Pb5Dm1ZMh30 Win32/Virus.NetTool.8e7


US defense contractors were only fairly recent targets based on the operation's history, which we traced to spear-phishing in 2010.


By now, most of the malware researchers are used to seeing drive-by infections that serve up a handful of malware, from droppers to payloads.


However, global security companies are limited in collecting attack information in Korea, and there is also a lack of information about the attacks that Lazarus or Lazarus are suspected of as a small group of threat groups in Korea.


But SamSam isn't the only ransomware out there charging eye-watering amounts to decrypt business servers.


This variant uses a new UAC bypass method that has been used by the Dridex malware since December, 2014.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9882 Backdoor.Teambot Trojan.Win32.Kazy.cxkslh Trojan.PWS.Spy.19585 Trojan.Kazy.D1E900 Backdoor:Win32/Pavica.B!dll Backdoor/Win32.Pavica.R161181


It also drops decoy documents in an attempt to camouflage the attack.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9821 BehavesLike.Win32.Trojan.tc Trojan/Win32.MSILKrypt.C2372735


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9890 Backdoor.Win32.Ruledor.c BackDoor.Ruller Downloader.Adload.Win32.15034 BehavesLike.Win32.Sural.tc Trojan[Backdoor]/Win32.Ruledor Backdoor:Win32/Ruledor.B Backdoor.Win32.Ruledor.c


They evade detection by keeping their code simple and flying under the radar.


We speculate that other attacks delivering Bookworm were also targeting organizations in Thailand based on the contents of the associated decoys documents, as well as several of the dynamic DNS domain names used to host C2 servers that contain the words Thai or Thailand


A backdoor also known as: Trojan.Autoit.ARV Worm.AutoIt.Helompy.A Trojan.Autoit.ARV Worm.AutoRun.Win32.33975 Win32.Trojan.AutoIt.a W32/Trojan2.MFAR W32.SillyDC Win.Trojan.Autoit-1267 Worm.Win32.AutoIt.agm Trojan.Autoit.ARV Trojan.Win32.Napad.ijfyd Worm.Win32.A.IM-Sohanad.278196 Win32.HLLW.Napad BehavesLike.Win32.YahLover.hc W32/Trojan.MASJ-0546 Worm/AutoRun.sfx Worm:Win32/Helompy.A Trojan.Autoit.ARV Worm.Win32.AutoIt.agm HEUR/Fakon.mwf Trojan.Autoit.ARV Trj/CI.A I-Worm.Autoit.GP Worm.Win32.Autorun.aao Win32/Trojan.e4c


A backdoor also known as: Trojan.ArchSMS Win32.Trojan.WisdomEyes.16070401.9500.9977 Hoax.Win32.ArchSMS.upa Win32.Trojan-psw.Archsms.Pgnh Trojan.Fraudster.307 Trojan:Win32/MobicArch.A Hoax.Win32.ArchSMS.upa Win32.Trojan.ArchSMS.D Spyware/Win32.ArchSMS.R32549 Hoax.ArchSMS.ge Hoax.Win32.ArchSMS Win32/Trojan.b8b


A backdoor also known as: Trojan.Pokey.A Trojan.Pokey.A Trojan.Pokey.A WORM_PIKACHU.A W32/Trojan.GNFD-9297 W32.Pokey.Worm Win32/Pikachu.32768 WORM_PIKACHU.A Win.Worm.Pikachu-2 Trojan.Pokey.A Email-Worm.Win32.Pikachu Trojan.Pokey.A Trojan.Win32.Pikachu.enlz I-Worm.Win32.Pikachu Trojan.Pokey.A Worm.Win32.Pikachu.A Trojan.Pokey.A Worm.Pikachu.Win32.2 Pokey.a Email-Worm.Win32.Pikachu W32/Trojan2.CSH Worm:Win32/Pokey.A@mm WORM/Pikachu.AuExec Worm[Email]/Win32.Pikachu Worm:Win32/Pokey.A@mm Worm.Pokey Email-Worm.Win32.Pikachu Pokey.a Email-Worm.Pikachu Win32/Pikachu.A I-Worm.Pikachu W32/Pikachu.A!tr


Derusbi has been widely covered and associated with Chinese threat actors.


The macro will download ransomware or banking malware after execution. JavaScript files, executed by Wscript in Windows, dropping, for example, Locky ransomware.


OceanLotus, also known as APT32, is believed to be a Vietnam-based APT group that has become increasingly sophisticated in its attack tactics, techniques, and procedures TTPs.


A backdoor also known as: Win32.Worm.SoulClose.E Worm.Win32.VB!O W32.Vb.RC Win32.Worm.SoulClose.E W32/VB.rc Win32.Worm.SoulClose.E PE_SOULOPEN.A Win32.Worm.VB.bc W32/Worm.EGII-1744 W32.Fujacks.C Win32/NoelOpus.B PE_SOULOPEN.A Win.Worm.VB-5176 Win32.Worm.SoulClose.E Worm.Win32.VB.rc Win32.Worm.SoulClose.E Trojan.Win32.VB.ooto Worm.Win32.A.VB.66048.A[UPX] Worm.W32.Vb!c Win32.Worm.SoulClose.E Virus.Win32.VB.~A Win32.Worm.SoulClose.E Win32.HLLW.Autoruner.2173 BehavesLike.Win32.Dropper.tm W32/Worm.VIF Worm/VB.pcu TR/VB.dek.1 Worm/Win32.VB Worm.VB.rc.kcloud Worm:Win32/Soulclose.A Worm.Win32.VB.rc Trojan/Win32.HDC.C146348 W32/HLLP.Soul.a Worm.VB Win32/AutoRun.VB.HG Win32.Worm.Vb.Eex Worm.Soulclose!T6Z53ODblJg Virus.Worm.Win32.VB W32/VB.MJU!tr Virus.Win32.VBViking.I


A backdoor also known as: Backdoor.Way Backdoor.Way.Win32.124 W32/Backdoor.HAT Backdoor.Trojan Win32/FakeMS.WOCR Win.Trojan.Dealply-6391261-0 Backdoor.Win32.Way.10 Trojan.Win32.Way.wibi Trojan.Win32.Z.Way.314010 Backdoor.W32.Way!c BackDoor.Way.10 Backdoor.Win32.Way W32/Backdoor.EORF-5693 Backdoor/NetStar.10 Trojan[Backdoor]/Win32.Way Backdoor.Win32.Way.10 Win32.Backdoor.Way.Dztb Backdoor.Way!jjTH+E6uXaw W32/Way.A!tr Win32/Backdoor.008


A backdoor also known as: Trojan.Sirefef.A Backdoor/ZAccess.trq Win32.Trojan.WisdomEyes.16070401.9500.9982 TROJ_SIREFEF.SM Trojan.Win32.ZAccess.tiikz Backdoor.Win32.A.ZAccess.190464.AD Backdoor.Win32.ZAccess.TZS BackDoor.Maxplus.5433 Trojan.FakeAV.Win32.243037 TROJ_SIREFEF.SM BehavesLike.Win32.ZeroAccess.cc Trojan.Win32.Sirefef Backdoor/ZAccess.dbk Trojan[Backdoor]/Win32.ZAccess Trojan:Win32/Sirefef.P Trojan.Kazy.D1335F Backdoor/Win32.ZAccess.R28242 ZeroAccess.ex BScope.Backdoor.Maxplus.2613 Rootkit.0Access


A backdoor also known as: Android.Leech.I HEUR:Trojan-Dropper.AndroidOS.Leech.c Android.Packed.5 ZIP/Trojan.PXTI-7 SPR/ANDR.Jiagu.zhye Troj.Dropper.Androidos!c HEUR:Trojan-Dropper.AndroidOS.Leech.c PUA.AndroidOS.MoneyReward


When reversing malware samples, one of the things that we as analysts look for are places where the attackers slip up.


A backdoor also known as: Trojan/Packed.EZip.a Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_BIFROS.SMI Win.Trojan.Mybot-4352 Trojan.Win32.139069.ebchy Backdoor.Win32.Rbot.~d5 TROJ_BIFROS.SMI Trojan/Win32.Unknown Trojan.ManBat.1 Troj.W32.Refroso.lnM8 TrojanDropper:Win32/Bifrose.F Trojan.Win32.Rbot


A backdoor also known as: Trojan.Qhosts Virus.W32.Specx.B!c Heur.Corrupt.PE Trojan[Backdoor]/Win32.IRCBot Worm:Win32/Specx.C.dam#2 Trj/CI.A Worm.Win32.Specx Win32/Trojan.bba


After analysis, it was confirmed that the sample belonged to the discovered botnet family Kaiji.


The spam e-mails are enticing users by impersonating well known companies, using their logos and known subject lines to further sell the deception.


The Blogspot page contained a javascript window location that redirected the visitor to a second URL hosted on a dedicated server.


In this campaign, it mainly tries to steal Firefox and other credentials.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9900 Win.Spyware.Banker-4198 not-a-virus:HEUR:RiskTool.Win32.BitCoinMiner.heur Trojan.Winlock.5377 BehavesLike.Win32.Kespo.cc Troj.W32.Delf.l4mb not-a-virus:HEUR:RiskTool.Win32.BitCoinMiner.heur Trojan:Win32/Comine.A Trojan-Downloader.Win32.Banload


A backdoor also known as: Trojan.Kryptik.Win32.1331272 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Kryptik.ewfvwr Trojan.DownLoader24.52368 BehavesLike.Win32.Trojan.jz Trj/GdSda.A Trojan.MSIL.Crypt


A backdoor also known as: Trojan.Razy.DAD41 Win32.Trojan.WisdomEyes.16070401.9500.9993 PUA.Downloader Trojan.Win32.AVKill.dciepf Trojan.AVKill.30546 TR/Kryptik.clfug Trojan:MSIL/Krolol.A Win32/Trojan.b49


A backdoor also known as: W32.Cloda53.Trojan.5b54 W32/Delf.g W32/SillyWorm.CE W32.Miliam@mm Win.Worm.Minima-1 Email-Worm.Win32.Delf.g Trojan.Win32.Delf.gmcr W32.W.Delf.g!c Worm.Win32.Delf.g Worm.Delf.Win32.349 BehavesLike.Win32.Downloader.lc W32/Worm.NVHR-2426 I-Worm/Delf.ls WORM/Atak.L W32/Delf.G@mm Worm[Email]/Win32.Delf Worm/Win32.Xema.N403133190 Worm:Win32/Miliam.A@mm Worm.Delf Win32.Worm-email.Delf.Ebqb Email-Worm.Win32.Delf I-Worm/Delf.X


A backdoor also known as: Softwarebundler.Wizrem.FC.2316 Win32.Trojan.WisdomEyes.16070401.9500.9991 Trojan.Win32.Z.Revirdit.463872 Backdoor:MSIL/Revirdit.A Trojan.MSILPerseus.D1F0A1 Trj/GdSda.A Win32/Trojan.ed9


During a recent compromise assessment, Cylance incident responders and threat researchers uncovered a surreptitious and sophisticated remote access trojan RAT that had been planted and operated by the suspected threat actor.


A backdoor also known as: W32/Trojan.DPQH-6594 Win32/Tnega.aTYcGTB Trojan.Win32.Small.cjn Troj.W32.Small!c TR/Jord.dvwus Trojan:Win32/Mvpaten.A Trojan.Win32.Small.cjn Win32.Trojan.Small.Llqr


Targets included a wide array of high-profile entities, including intelligence services, military, utility providers telecommunications and power, embassies, and government institutions.


Curiously, the Word document does not contain any macros, or even an exploit.


A backdoor also known as: Win32.Netsky.T@mm.Damaged Damage.Small W32/Netsky.t@MM W32/Netsky.T@MM I-Worm.Netsky.FJ Netsky.T@mm WORM_NSKY.DAM Win32.NetSky.t Email-Worm.Win32.NetSky.t Email-Worm.Win32.NetSky!IK Heur.Corrupt.PE Win32.HLLM.Netsky.18432 Worm/Netsky.#1 WORM_NSKY.DAM W32/Netsky.t@MM I-Worm/NetSky.u Worm:Win32/Netsky.CY@mm.dam#4 Email-Worm.Win32.NetSky.t Worm.Mail.Win32.NetSky.daq Email-Worm.Win32.NetSky W32/Netsky.T@mm W32/Netsky.T.worm


And finally it's important to highlight that the RAT itself is not new.


A backdoor also known as: Trojan.Autoit.CoinMiner.AT Trojan/CoinMiner.jr Win32.Trojan.WisdomEyes.16070401.9500.9906 TROJ_GE.DAFBBB38 Win32.Trojan.Coinminer.A Troj.W32.Autoit.lWc9 Application.Win32.CoinMiner.B Tool.BtcMine.195 Trojan.CoinMiner.Win32.1291 TR/Comitsproc.gbs Trojan.Autoit.Wirus Win32/Fynloski.AN Worm.Win32.AutoIt


At that time of the analysis, it was unclear how victims were exposed to OSX/Keydnap.


A backdoor also known as: Trojan.Win32.BSKG.dlyohq Trojan.Packed.29890 Trojan:Win32/Chanitor.A Trojan/Win32.Zbot.C916515 Win32/Injector.BSKG


A backdoor also known as: Trojan.Marijku TROJ_DLOAD.XL W32/Downldr2.FJJI Win32/Tnega.AZ TROJ_DLOAD.XL Trojan.Win32.Downloader.208896.AR Trojan.DownLoad3.7906 BehavesLike.Win32.Downloader.dc W32/Downloader.MIEG-4062 Trojan.Heur.D.nm6fbaHVu8n Trojan:Win32/Marijku.A Trojan/Win32.Downloader.R6539 Win32/BHO.NIZ Trojan.Win32.StartPage.BE


A spear-phishing email targeting a voice actor YouTuber in South Korea was used to distribute Lumma Stealer malware, according to analysis by S2W TALON and the BBC.


A backdoor also known as: Troj.Downloader.W32.Zlob.kYLL W32/Trojan.BZWN Trojan.Farfli RTKT_FARFLI.EOJ Win.Downloader.13148-1 TrojWare.Win32.Magania.~E Trojan.DownLoad.47002 Downloader.Win32.55183440 RTKT_FARFLI.EOJ Virus.Win32.Hmir Win32.Troj.RootkitT.r.16800 Backdoor:WinNT/Farfli.B!sys Trojan/Win32.Hmir.C55747 Trojan.Graftor.D5437


Their targets have also included the governments of members of the Commonwealth of Independent States; Asian, African, and Middle Eastern governments; organizations associated with Chechen extremism; and Russian speakers engaged in the illicit trade of controlled substances and drugs.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9545 Trojan.Win32.Qhost


A backdoor also known as: Ransom_Anunau.R002C0DK417 Trojan.Win32.RansomHeur.eutbif Ransom_Anunau.R002C0DK417 BehavesLike.Win32.Evasion.dh Trojan.Win32.Injector TR/AD.RansomHeur.ibtfr Ransom:Win32/Anunau.A Trojan/Win32.Inject.R211968 SScope.Trojan.FakeAV.01695 Trj/CI.A Trojan.Symmi.D13583


A backdoor also known as: W32.eHeur.Virus02 Worm.Seroteb.Win32.16 Win32.Trojan.WisdomEyes.16070401.9500.9522 W32/Trojan2.MQYM Worm.Win32.Seroteb.g BehavesLike.Win32.Trojan.nm W32/Trojan.QDYC-8978 Worm:Win32/Serot.A@mm Trojan.CryptRedol!B3FmVPsxcak Worm.Win32.Serot Trj/CI.A Win32/Trojan.029


AT&T Alientlabs researchers has discovered new variant of BlackGuard stealer infections using spear phisng attack.


A backdoor also known as: Trojan.Goabeny.A8 Trojan.Delf.Win32.88456 HT_GRAFTOR_GI070668.UVPM HT_GRAFTOR_GI070668.UVPM Trojan.Win32.Sdbot.ercwiz TrojWare.Win32.Delf.QJW BackDoor.IRC.Sdbot.34285 BehavesLike.Win32.Trojan.dc


One interesting thing is that it added some other functions you wouldn't expect to try and emphasize it wasn't a malicious tool by including a piano game and fun manager


A backdoor also known as: Riskware.Win32.Winnti.erfdhv Win32.Winnti.1 HackTool:Win32/Passdash.A!dha Trj/CI.A Win32.Risk.Adware.Ecbn Win32/Virus.Adware.708


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9994 W32/Trojan.RBLM-5940 Trojan[Dropper]/Win32.Dapato TrojanDownloader:Win32/Dapato.M Trojan.Symmi.DB644 Trojan.DR.Dapato!vPidh5qsMRE W32/Onlinegames.QRT!tr Trj/CI.A


A backdoor also known as: W32.HfsAdware.CA66 not-a-virus:Downloader.Win32.Elex.u Riskware.Win32.WinZipper.eoijjb Adware.Mutabaha.229 Pua.337.Technologies RiskWare[Downloader]/Win32.Elex.u PUP.Adware.Elex Adware.Elex.612528.A not-a-virus:Downloader.Win32.Elex.u PUP.Optional.Elex PUA.Downloader!


A backdoor also known as: W32.HfsAutoB.542D Trojan.Zenshirsh.SL7 TSPY_MSPOSER.SMZ TSPY_MSPOSER.SMZ Trojan-Dropper.Win32.Daws.dxwt BehavesLike.Win32.Sality.mc Trojan.Win32.Sisron Trojan:Win32/Blihan.A Trj/GdSda.A Trojan.Win32.Sisron.weqa Win32/Trojan.a66


a Federal contractor command and control domains, we couldn't help but notice a peculiar related OPM-themed domain, opm-learning[.]org.


This campaign was sent to millions of recipients across numerous organizations primarily in Australia.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9966 Trojan.Win32.Disfa.eoyfmo


Malware authors are evolving their techniques to evade network and host-based detection mechanisms.


A backdoor also known as: Backdoor.Win32.VBbot!O Trojan.Jorik.Win32.68017 Win32.Trojan.WisdomEyes.16070401.9500.9994 Trojan.ADH.2 Win.Trojan.Dishigy-5 Worm.Win32.WBNA.ipa Trojan.VbCrypt.68 BehavesLike.Win32.Backdoor.dc Trojan.Win32.Spyeye Worm/Kolab.fyb Worm.Win32.WBNA.ipa Trojan/Win32.Bifrose.C110110 Trojan.Injector!36BeufFOyC8 Trj/CI.A


A backdoor also known as: Other:Android.Reputation.2 HEUR:Trojan-Downloader.AndroidOS.Masplot.a Riskware.Android.RemoteCode.epsqsx Troj.Downloader.Androidos!c Android/Masplot.A!tr.dldr Trojan[Downloader]/Android.Masplot HEUR:Trojan-Downloader.AndroidOS.Masplot.a Android-PUP/Metasploit.5b3de a.gray.stdon


This vulnerability allows a malicious actor to inject arbitrary code during the parsing of SOAP WSDL definition contents.


Because we hate scammers of all types but especially these guys -- tricking people out of their money by lying to them is evil here are some more Tech Support Scam sites, along with some sample screenshots to give you a sense of the different ways they pitch their scams:


A backdoor also known as: W32.Mofei.A Trojan.Win32.Mofeir.ruhef W32/Mofei.A W32.Femot.Worm WORM_MOFEI.A Win32.Femot Net-Worm.Win32.Mofeir.a Win32.Worm.Mopfei.B I-Worm.Mofai!mDpfss79YzI Worm.Win32.Mofei.A Win32.Worm.Mopfei.B BackDoor.Mofei BDS/Mofeir.101.B WORM_MOFEI.A Backdoor/Mofei.101 Worm.Mofeir.kcloud Backdoor:Win32/Mofeir.1_01 Worm.Win32.MoFei.11776 Worm/Win32.Mytob Win32.Worm.Mopfei.B W32/Mofei.CGUW-2000 Worm.Mofeir Net-Worm.Femot Win32/Mofei.A Net-Worm.Win32.Mofeir W32/MoFei.D!worm Worm/Mofeir.B


How do Android devices become infected ? We found traces of the Gooligan malware code in dozens of legitimate-looking apps on third-party Android app stores .


A backdoor also known as: Trojan.Zenshirsh.SL7 Win32.Trojan.FlyStudio.F Riskware.Win32.Adw.dneswh Trojan.MulDrop6.42243 BehavesLike.Win32.PWSZbot.tm Trojan.Win32.Seodec TR/Seodec.abne RiskWare[Downloader]/Win32.AdLoad Trojan:Win32/Seodec.A


A backdoor also known as: W32.RustogaLTF.Worm Backdoor/W32.Androm.37888 Worm.Kasidet.20653 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Neutrino-6 Backdoor.Win32.Androm.hkrm Trojan.Win32.Neutrino.cwggio BackDoor.Neutrino.1 BehavesLike.Win32.VTFlooder.nh Backdoor/Androm.kfh Trojan[Backdoor]/Win32.Androm Worm:Win32/Kasidet.A Backdoor.Win32.Androm.hkrm Backdoor.Neutrino


A backdoor also known as: W32.VBKryptPS.Trojan Trojan/W32.VBKrypt.147456.CC Downldr.Umbald.S624840 Trojan.VBKrypt.Win32.179340 Troj.W32.VBKrypt.tpcC Trojan/VBKrypt.mhte Win32.Trojan.WisdomEyes.16070401.9500.9970 W32/VBTrojan.Dropper.4!Maximus Trojan.VBKrypt Trojan.Win32.VBKrypt.xabo Trojan.Win32.Umbra.efkzrr Trojan.Win32.A.VBKrypt.147456.YW BackDoor.Umbra.10 W32/VBTrojan.Dropper.4!Maximus Trojan/VBKrypt.hmyy Trojan/Win32.VBKrypt Win32.Troj.VBKrypt.kcloud TrojanDownloader:Win32/Umbald.A Trojan.Symmi.DD60 Trojan.Win32.VBKrypt.xabo Trojan/Win32.Jorik.R27694 Trojan.Crypt Win32/Delf.AVY W32/VBKrypt.MBSX!tr


The malware calls itself Grabit and is distinctive because of its versatile behavior.


A backdoor also known as: Worm.Botter Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Wortrik Email-Worm.Win32.Botter.bv Trojan.Win32.Botter.eroupz Email.Worm.W32!c Win32.HLLW.Phorpiex.222 Worm.AutoRun.Win32.131461 Worm.Win32.Phorpiex Worm.Botter.j Email-Worm.Win32.Botter.bv Worm:Win32/Dipasik.C!bit Trojan/Win32.Phorpiex.C1326764 BScope.Trojan.IRCbot Win32.Worm-email.Botter.Hyy W32/IRCBot.C!worm


A backdoor also known as: Trojan.VB.Win32.155357 Trojan.Symmi.DEA81 Win32.Trojan.VB.hs Trojan.Win32.VB.ebwbzr TrojWare.Win32.Downloader.FraudLoad.R BehavesLike.Win32.BadFile.vh W32/VB.GI!tr Trojan:Win32/Tacpud.A Trojan/Win32.VB.C2028217 Trj/GdSda.A Win32.Trojan.Vb.Amcv Trojan.VB!9TqYT8CSaE0 Trojan.Win32.VB


A backdoor also known as: W32.HfsAutoB.E9A8 Trojan.Zusy.D3F56 Win32.Trojan.WisdomEyes.16070401.9500.9972 W32/Backdoor.RTBO-4851 Backdoor.Trojan BKDR_EXPLOIT.AN Win.Trojan.Ploit-1 BackDoor.Xconf.21 BKDR_EXPLOIT.AN W32/Backdoor.KWF BDS/DarkView.A.3 Backdoor:Win32/DarkView.A


A backdoor also known as: TROJ_WEVARM.SM Win32.Trojan.WisdomEyes.16070401.9500.9998 TROJ_WEVARM.SM Win.Trojan.Regrun-429 Trojan.Win32.KillProc.boctad Trojan.Win32.Z.Regrun.1865432 W32.W.AutoRun.l6Zu Trojan.KillProc.12652 BehavesLike.Win32.VirRansom.tc TrojanDropper:Win32/Vixemb.A Trojan.KillProc Trj/CI.A Worm.Swimnag!wS08av/7yqU Worm.Win32.Swimnag W32/Swimnag.E!tr Win32/Trojan.1e8


OpcJacker is an interesting piece of malware, since its configuration file uses a custom file format to define the stealer's behavior.


A backdoor also known as: Trojan.Zbot.Win32.171106 Win32.Trojan.Zbot.a Trojan.Zbot TSPY_ZBOT.SMQF Win.Spyware.Zbot-1275 Trojan-Spy.Win32.Zbot.wqpm Trojan.Win32.Panda.cqqwdy Trojan-Spy:W32/Zbot.AVTH Trojan.PWS.Panda.11236 TSPY_ZBOT.SMQF BehavesLike.Win32.PWSZbot.dh Trojan/Win32.Unknown Trojan.Kazy.D359E8 Spyware/Win32.Zbot.R27121 SScope.Trojan.FakeAV.01110 Win32/Spy.Zbot.AAO Trojan.Win32.Zbot.aaw TrojanSpy.Zbot!A8UvbpHn23U Trojan-Spy.Banker.Citadel W32/Zbot.AT!tr


This pulse contains indicators related to a phishing campaign launched against the US election system in 2016.


A backdoor also known as: Trojan-Dropper.Win32.Dorgam!O Win32.Trojan-Dropper.Dorgam.cgdc Backdoor.Bifrose Trojan.Win32.Clicker.ddouvz Trojan.Win32.A.PSW-QQPass.802816 Trojan.Click2.1642 BehavesLike.Win32.BadFile.ch TR/Taranis.4038 Backdoor:Win32/Babmote.A Troj.W32.Sasfis.lqzi Win32.Trojan.FlyStudio.F TrojanDropper.Dorgam Trojan.DR.Dorgam!Cb+DVu4OzCQ W32/QQPass.YZN!tr.pws


A backdoor also known as: Trojan.Modphip.A3 Trojan.Graftor.D45BA7 Win32.Trojan.WisdomEyes.16070401.9500.9995 Win32/Pilleuz.H Packed.Win32.Krap.hm Trojan.Win32.Krap.bsvym Trojan.Packed.20343 Trojan.Win32.Yakes Trojan[Packed]/Win32.Krap Trojan:Win32/Modphip.A Packed.Win32.Krap.hm Trojan/Win32.Krap.R35222 BScope.P2P-Worm.Palevo W32/Kryptik.DKU!tr


The stolen information was transmitted back to the threat actors' infrastructure in an encrypted format.


Based on reports, as of 2014, it has global users of more than 490 million registered users.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Proxy.21493 BehavesLike.Win32.VBObfus.nm Trojan.Trickster.a Trojan:Win32/Donvba.A Trojan.Jaik.D3551 Trojan/Win32.Fareit.C1614161 W32/Injector.DGQK!tr


It contained a part of recently leaked Zeus source code, which allowed Ramnit to become a banking trojan.


A backdoor also known as: Backdoor.Garex Trojan.Win64.Wurser.b Troj.Win64.Wurser!c Trojan.Win64.Wurser W64/Trojan.LBAM-3513 Trojan.Win64.Wurser.b Backdoor:Win32/Garex.B!dha Trojan.Win64.Wurser Win64.Trojan.Wurser.Peqd Win32/Trojan.7be


A backdoor also known as: Trojan.Inject Win32.Trojan.Delf.am W32/Trojan.SHRZ-8205 Win32.Worm.Delf.Dxcp Trojan.PWS.Banks.799 W32.W.AutoRun.lmnK Backdoor:Win32/Aybo.B Trojan.Delf Trojan.Win32.VMProtect Win32/Trojan.079


On several occasions, we verified that these details are correct for the intended victim.


A backdoor also known as: Trojan.Packed-76 Trojan-Downloader.Win32.Qvod.col Trojan.Win32.Swisyn!IK Trojan.Win32.Swisyn W32/Qvod.EF!tr


The Wekby actors have recently been observed compromising organizations in the Manufacturing, Technology and Utilities verticals, but have had a long standing interest in the HealthCare industry.


A backdoor also known as: Win32.Redrac.A@mm Win32.Redrac.A@mm Win32.Redrac.A@mm Trojan.Win32.Redrac.enor W32.Redrac@mm Win32/Redrac.A Email-Worm.Win32.Redrac Win32.Redrac.A@mm Worm.Redrac!vQPr8wluFnM W32.W.Redrac!c Win32.Redrac.A@mm Worm.Win32.Redrac.A Win32.Redrac.A@mm Win32.HLLM.Redrac Worm.Redrac.Win32.1 BehavesLike.Win32.AdwareRBlast.cc W32/Redrac.AFIQ-7566 Worm/Sramota.axa WORM/Redrac.A Worm[Email]/Win32.Redrac Win32.Redrac.E90817 Trojan/Win32.Xema Worm:Win32/Redrac.A@mm Virus.Win32.Heur.l W32/Gnome.C.worm Win32.Redrac.A@mm I-Worm/Redrac.A


It provides a robust set of capabilities, including: file transfer, screen capture, keystroke logging, process injection, process manipulation, and task scheduling.


A common misconfiguration attempts to download the non-existant file at http://www.server.com/sqlite3.dll


A backdoor also known as: Win32.Ladex.A@mm W32/Ladex.worm W32.W.Ladex.a!c W32/Ladex.worm Win32.Ladex.E90817 W32.Dalbug.Worm Win32/Ladex.A Win.Worm.Ladex-1 Worm.Win32.Ladex.a Win32.Ladex.A@mm Trojan.Win32.Ladex.bxker Win32.Ladex.A@mm Worm.Win32.Ladex.A Win32.Ladex.A@mm Win32.HLLW.Ladex Worm.Ladex.Win32.2 W32/Ladex.worm W32/Risk.UDJC-2718 WORM/Ladex.A W32/Ladex.A!worm Worm/Win32.Ladex Worm.Win32.Ladex.a Win32.Ladex.A@mm Worm.Ladex W32/Ladex.D.worm Worm.Win32.Ladex.a.2 Trojan-IM.Win16.PS Win32.Ladex.A@mm Win32/Worm.f02


A backdoor also known as: Trojan.ZbalCS.S302126 Backdoor.Konus.Win32.1 Trojan/Kryptik.flew Trojan.Midie.D88E4 TROJ_KRYPTIK_GC140164.UVPM Win32.Trojan.WisdomEyes.16070401.9500.9700 TROJ_KRYPTIK_GC140164.UVPM Win.Trojan.Ag-4254306-1 Trojan.Win32.Kryptik.emceui Trojan.DownLoader23.52205 BehavesLike.Win32.PWSZbot.fc Backdoor.Konus.b TR/Crypt.EPACK.rguwm Backdoor.Konus! W32/Kryptik.FLEW!tr


Enterprises are currently being targeted by the macro malware BARTALEX in a recent outbreak of thousands of spammed emails.