The malware contains an old school exclusion list that performs extremely rapid double word comparisons rather than the slower but far more common string comparisons to identify which process to ignore, and internally validates the identified account data through an implementation of the Luhn algorithm.


Symantec's latest whitepaper documents multiple Black Vine operations that have been occurring since 2012.


A backdoor also known as: HT_BLADABINDI_GL190001.UVPM HT_BLADABINDI_GL190001.UVPM Backdoor.MSIL.Bladabindi.alfk Trojan.Win32.Bladabindi.exqcus Ht.Bladabindi.Gl190001!c BehavesLike.Win32.Dropper.wc Trojan:Win32/Trogle.A Backdoor.MSIL.Bladabindi.alfk Trj/CI.A Msil.Backdoor.Bladabindi.Tbsy


A backdoor targetting Linux also known as: Backdoor.Linux.Tsunami.A Linux.Kaiten.B ELF_KAITEN.SMK Trojan.Tsunami.excyez Linux.BackDoor.Tsunami.123 ELF_KAITEN.SMK ELF/Backdoor.MRMO- LINUX/Tsunami.ojldj Trojan.Backdoor.Linux.Tsunami.1 Backdoor.Linux.Tsunami!c Linux.Backdoor.Tsunami.Wrpx


August contains stealing functionality targeting credentials and sensitive documents from the infected computer.


A backdoor also known as: Trojan.Win32.VB!O Trojan/VB.htj Trojan.Heur.RX.ED14C7A Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan Win.Trojan.VB-8430 Trojan-Dropper.Win32.Daws.enmy Troj.Downloader.W32.VB.ldQ2 TrojWare.Win32.Trojan.VB.~DQ Trojan.VB.Win32.6994 BehavesLike.Win32.Trojan.nm Trojan.Win32.VB Trojan/VB.fgm Backdoor:Win32/Lordly.A Trojan-Dropper.Win32.Daws.enmy Trojan/Win32.Downloader.R12171 Trojan.VB!jnJsu+mHRvk W32/VB.JHO!tr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Revetrat Trojan:MSIL/Starter.I Trj/GdSda.A Win32/Trojan.db5


A backdoor also known as: Trojan.Win32.Z.Pemalform.45056.A W32.W.Otwycal.l4av TrojanDownloader:Win32/Raemnk.A Win32/RiskWare.PEMalform.E Win32/Trojan.444


The targets were then further narrowed to those that were running the Mac OS X operating system, had not previously visited the website, and had specific browser versions.


Ginp embeds the following set of features , allowing it to remain under the radar and successfully perform attacks : Overlaying : Dynamic ( local overlays obtained from the C2 ) SMS harvesting : SMS listing SMS harvesting : SMS forwarding Contact list collection Application listing Overlaying : Targets list update SMS : Sending Calls : Call forwarding C2 Resilience : Auxiliary C2 list Self-protection : Hiding the App icon Self-protection : Preventing removal Self-protection : Emulation-detection Update 10/03/2020 At the end of February the actors behind Ginp added screen capture capabilities to their Trojan .


A backdoor also known as: TrojanPWS.Grozlex.A3 Win32.Trojan.WisdomEyes.16070401.9500.9999 TSPY_GROZLEX.SMA Win.Spyware.Grozlex-1 TSPY_GROZLEX.SMA PWS:MSIL/Mintluks.A Trojan.PasswordStealer.MSIL


A backdoor also known as: W32.ArtemisPuty.Trojan Trojan.Modputty.A5 Trojan.Puty.Win32.1 Trojan/MalPutty.a W32/Trojan.SHOY-1500 Win.Trojan.Stealzilla-1 Trojan-PSW.Win32.Puty.a Trojan.Win32.Puty.dsnaim Troj.PSW32.W.Puty.tnaX Win32.Trojan-qqpass.Qqrob.Llhf BackDoor.DaVinci.18 BehavesLike.Win32.BadFile.hh Trojan.Win32.Modputty Trojan/PSW.Puty.a Trojan:Win32/Modputty.A Trojan-PSW.Win32.Puty.a Trojan/Win32.Modputty.C862836 TrojanPSW.Puty Trojan.PWS.Puty! W32/MalPutty.A!tr Trj/Fakeputty.A Win32/Trojan.Spy.b9b


We have analyzed the samples to determine the author's ultimate goal and have named this malware KeyRaider


A backdoor also known as: VBS/Downldr.HM VBS.Downloader.B VBS_LOCKY.DLDSARF Win.Trojan.Locky-6360731-0 Trojan.Script.ExpKit.etmlqw Troj.Downloader.Script!c VBS.DownLoader.1006 VBS_LOCKY.DLDSARF VBS/Downldr.HM Trojan/VBS.downloder TrojanDownloader:VBS/Locky.A VBS/Obfus.S8 Trojan-Ransom.Script.Locky virus.vbs.qexvmc.1


It uses insidious injection and other sophisticated and stealthy methods.


A backdoor also known as: W32.Sasser.D Win32.Trojan.WisdomEyes.16070401.9500.9679 W32.Sasser.D Win32/Sasser.D Win.Worm.Sasser-2 Net-Worm.Win32.Sasser.c Trojan.Win32.Sasser.fvek Worm.Win32.Sasser.16384 W32.W.Sasser.kZ72 W32/Sasser.worm.d I-Worm/Sasser.d WORM/Sasser.D Worm[Net]/Win32.Sasser Net-Worm.Win32.Sasser.c Worm:Win32/Sasser.dam W32/Sasser.worm.d Worm.Sasser W32/Sasser.D.worm Email-Worm.Win32.Plexus W32/Sasser.C!worm.im


Full remote access capabilities is a dream tool for the black hat community, and are highly sought after.


The purpose of using such a design is likely to make understanding and analyzing the malware's code flow more difficult for researchers.


Recently, I've been investigating malware utilizing PowerShell and have spent a considerable amount of time refining ways to identify new variants of attacks as they appear.


As proof of its popularity, certain government officials are said to employ this application for communication purposes in the office.


A backdoor also known as: Trojan/Turla.ar Trojan.Asprox.B Trojan.MulDrop7.18901 BehavesLike.Win32.Downloader.dc Trojan:Win32/Regin.D!dha Trj/Chgt.J Win32/Turla.AR Trojan.Turla!gdUjdZ2fM5A


Now, three months after the source code was published, we decided to have a look at what has changed in the banking malware landscape.


A backdoor also known as: Trojan.Crypt.RI Trojan.Crypt.RI Trojan.Crypt.RI Trojan.Crypt.RI Trojan.Crypt.RI Trojan.Crypt.RI Trojan.Crypt Trojan.Crypt.RI


Sysget malware was delivered both directly via phishing emails, as well as in Rich Text Format RTF documents exploiting the CVE-2015-1641 vulnerability patched in MS15-033 that in turn leveraged a very unique shellcode.


Indicators about Sakula and multiple RATs that are being used across multiple intrusions.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Tofsee.B Trojan-Proxy.Win32.Xorpix.m Trojan.Win32.Xorpix.zybt Trojan.Win32.Proxy.12800.C Trojan.DownLoader.19108 Trojan.Small.Win32.39831 TrojanProxy.Xorpix.k Troj.Proxy.W32!c Trojan-Proxy.Win32.Xorpix.m Trojan/Win32.Xorpix.R72000 Win32/Small.NCN Win32.Trojan-proxy.Xorpix.Amci Trojan.Win32.Small Bck/Xorpix.AG Win32/Trojan.Proxy.211


Mobile monetization platforms create software libraries that authors can embed into their apps to start earning money quickly.


It required other means to be deployed on targeted organizations' networks and is configured with previously stolen credentials.


A backdoor also known as: W32.FamVT.ExpiroPC.PE Heur.Corrupt.PE TrojanDownloader:Win32/WarezSet.dam#2


A backdoor also known as: W32.KloggerQKA.Trojan Trojan-Downloader.Win32.Delf!O Backdoor.Gobot Downloader.Delf.Win32.70 Backdoor.W32.Gobot.lfDt Trojan/Downloader.Delf.bm Win32.Trojan.WisdomEyes.16070401.9500.9965 W32/Avokado.SIKN-9031 W32.Gobot.A Backdoor.Gobot Win32/Gobot.B WORM_GOBOT.G Win.Downloader.Delf-144 Trojan.Win32.Delf.gvzc Trojan.Win32.Delf.47087 Win32.HLLW.Ghostbot WORM_GOBOT.G BehavesLike.Win32.Kudj.pc Backdoor.Win32.Gobot W32/Avokado.B@bd TrojanDownloader.Delf.pgr TR/Dldr.Delf.BM Trojan[Backdoor]/Win32.Gobot Backdoor:Win32/Gobot.A Worm/Win32.IRCBot.R29095 Bck/Gotob.AA Trojan.Delf.BM Win32/TrojanDownloader.Delf.BM Trojan.DL.Delf!UOW7nlBxiow


In recent weeks, Unit 42 has discovered three documents crafted to exploit the InPage program.


The malware families identified at this time are DarkComet, LuminosityLink RAT, Pony, ImmenentMonitor, and some multiple variations of shellcode.


Despite the 2016 Olympics coming to a close, cybercriminals remain relentless in using the sporting event as a social engineering hook to distribute a banking Trojan.


A backdoor also known as: Program.Optimizer.12 TrojanDownloader:Win32/Javsisxep.A Trj/CI.A


Of note, this is three years earlier than the oldest Elise sample we have found, suggesting this group has been active longer than previously documented.


A backdoor also known as: TSPY_KILLAV_BK2200FA.TOMC Trojan.Win32.NtRootKit.dgaent Troj.GameThief.W32.OnLineGames.l7iy Trojan.DownLoad3.35430 Trojan.KillAV.Win32.9854 TSPY_KILLAV_BK2200FA.TOMC TR/Killav.OI.2 Trojan/Win32.Unknown Trojan.Graftor.D3B65 Trojan:WinNT/Killav.E Trojan/Win32.KillAV.R32978 Trojan.Win32.KillAV.aal W32/KillAV.NKC!tr


A backdoor also known as: TrjnDwnldr.Banload.FC.2467 Win32.Trojan.WisdomEyes.16070401.9500.9993 W32/Trojan.FOJF-1615 Ransom_Blocker.R004C0DAM18 Win.Trojan.12504345-1 Trojan-Ransom.Win32.Blocker.kqil Troj.Ransom.W32.Blocker!c Trojan.DownLoader13.59179 Ransom_Blocker.R004C0DAM18 Trojan/Blocker.kir TR/Spy.Banker.37888.6 Trojan[Ransom]/Win32.Blocker Trojan.Kazy.D81FF3 Trojan-Ransom.Win32.Blocker.kqil TrojanSpy:MSIL/Banker.M Trojan/Win32.MDA.C931868 Hoax.Blocker Trojan.Banker.WHS Win32.Trojan.Blocker.Pgmu Trojan.Blocker!RxWDop6Ua70 Trojan.MSIL.PSW Win32/Trojan.Spy.d2d


Through this entry, in which we take a closer look at an individual who we believe might be connected to the Winnti group, we hope to give both ordinary users and organizations better insights into some of the tools – notably the server infrastructures- these kinds of threat actors use, as well as the scale in which they operate.


A backdoor also known as: Trojan-Dropper.Win32.Dinwod!O W32.Virut.Cur1 W32.Virut.CF Win32/Virut.17408!corrupt WORM_OTORUN.SMN1 Trojan-Dropper.Win32.Dinwod.by Trojan.Win32.Dinwod.cooobe Troj.Dropper.W32.Dinwod.mmkC Virus.Win32.Virut.ua Virus.Win32.Virut.CE Trojan.MulDrop3.51046 WORM_OTORUN.SMN1 Win32/Virut.bv TR/VB.Inject.qopannv Trojan[Dropper]/Win32.Dinwod Win32.Virut.cr.61440 Trojan.Zusy.D423D8 Dropper.Dinwod.151552 Trojan-Dropper.Win32.Dinwod.by Worm:Win32/Rortoti.A HEUR/Fakon.mwf TScope.Trojan.VB Trojan.FileLock I-Worm.Filecoder.A Win32/Virut.NBP Trojan-Dropper.Win32.Dinwod W32/Sality.AO


A backdoor also known as: Trojan.Ursu.D1347A Win32.Trojan.WisdomEyes.16070401.9500.9990 Trojan.MulDrop7.48244 Trojan-Ransom.Rantest W32.Ransomsimulation TR/StartPage.wgude Trojan/MSIL.Miner RiskWare.RansomSimulator Trj/GdSda.A Trojan.StartPage!pRfC+LclTxM Win32/Trojan.7c5


A backdoor also known as: Trojan.WebSearch W32/Application.KWFL-8070 Trojan.Win32.WebSearch.ak Trojan.Win32.WebSearch.ommdf Trojan.Win32.Z.Websearch.263168 Troj.W32.Websearch!c TR/WebSearch.V Trojan:Win32/WebSearch.F Trojan.Win32.WebSearch.ak Trj/CI.A Win32.Trojan.Websearch.Lmap Trojan.WebSearch!GWyPJuQViZY Win32/Trojan.3ff


Locky is a ransomware that can be installed when you open an attachment, usually as a Word file from a spam email.


We are seeing a bit of an uptick of emails containing java adwind or Java Jacksbot attachments.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9991 W32/Dropper.ANAB TROJ_DROPPER.SMW Packed.Win32.Krap.ap Trojan.Winlock.587 TROJ_DROPPER.SMW BehavesLike.Win32.FakeAlertSecurityTool.fc W32/Risk.VFHY-0574 Trojan[Packed]/Win32.Krap Packed.Win32.Krap.ap Dropper/Win32.Smiscer.R13962 Trojan.DR.Procesemes!WkidsgpO+Do Packed.Win32.Krap


A backdoor also known as: Trojan.Win32.BitCoinMiner.jz Trojan.Win32.BitCoinMiner.euxcee Win32.Trojan.Bitcoinminer.Wrgk Trojan.DownLoader25.54215 Trojan.CoinMiner.Win32.6503 Trojan/Win32.BitCoinMiner Trojan.Win32.BitCoinMiner.jz TrojanDownloader:MSIL/CoinMiner.A!bit Trojan.BitCoinMiner Trojan.BitCoinMiner Trj/GdSda.A Trojan.BitCoinMiner!x6PcA/gbW/U W32/BitCoinMiner.JZ!tr Win32/Trojan.5d5


A few weeks ago, we observed new activity from ChessMaster, with notable evolutions in terms of new tools and tactics that weren't present in the initial attacks.


It abuses the legitimate and popular open source framework DroidPlugin which allows an app to dynamically launch any apps as plugins without installing them in the system.


A backdoor also known as: W32.FamVT.StartPage.e.Trojan Trojan.Startpage TROJ_STARTPAGE_FD050152.UVPM Trojan.Win32.Z.Startpage.4001399 TROJ_STARTPAGE_FD050152.UVPM TR/StartPage.sdjtv W32/STARTPAGE_FD050152.UVPM!tr Win32/Trojan.41b


A backdoor also known as: Trojan.Win32.VB!O Trojan.VB Trojan/VB.bmd Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Trojan.ZJNQ-3376 TROJ_VB.FVH Win.Trojan.VB-3241 Trojan.Win32.VB.bmd Trojan.Win32.VB.crkyqv Troj.W32.Vb!c Trojan.Win32.VB.aae Trojan.SimSun Trojan.VB.Win32.1599 TROJ_VB.FVH BehavesLike.Win32.PJTbinder.qz Trojan.Win32.Elkmil W32/Trojan2.YLV W32/VB.QRB!tr Trojan/Win32.VB Win32.Troj.VB.kcloud Trojan.Heur.E1F0CA Trojan.Win32.VB.28672.K Trojan.Win32.VB.bmd Trojan/Win32.Xema.R125410 TScope.Trojan.VB Trj/QQPass.AWP Virus.Win32.HideDoc.C


A backdoor also known as: Backdoor/W32.PPdoor.159232 Backdoor.Win32.PPdoor!O Win32.Trojan.WisdomEyes.16070401.9500.9989 Backdoor.Trojan BKDR_PPDOOR.AL Win.Trojan.PPDoor-3 Backdoor.Win32.PPdoor.bo Trojan.Win32.PPdoor.qstx Backdoor.Win32.PPdoor.A BackDoor.Srvlite BKDR_PPDOOR.AL BehavesLike.Win32.Pykse.ch W32/PPdoor.GR Backdoor/PPdoor.bo DR/Pere.103936.E.2 Trojan[Backdoor]/Win32.PPdoor Backdoor:Win32/Ppdoor.AJ Backdoor.Win32.PPdoor.bo Trojan/Win32.Ppdoor.C139757 Virus.Win32.Bayan-based Backdoor.PPdoor!lYc+pVWanGQ Backdoor.Win32.PPdoor Trj/PPDoor.FD


Check Point Mobile Threat Prevention has detected a new, unknown mobile malware that targeted two customer Android devices belonging to employees at a large financial services institution.


FireEye recommends that Microsoft Office users apply the patch from Microsoft.


A backdoor also known as: Hacktool.Flystudio.16558 TSPY_AKSULA_CA083865.TOMC Win32.Trojan-PSW.Alipay.a TSPY_AKSULA_CA083865.TOMC Trojan-PSW.Win32.Alipay.peq Troj.Downloader.W32.BaiDload.lhQG TR/Aksula.jqeqy Trojan:Win32/Aksula.A Trojan.Mikey.D906C Trojan-PSW.Win32.Alipay.peq Trojan/Win32.Aksula.R27086 Win32.Trojan-qqpass.Qqrob.Phqe


IOCs C & C IP addresses : 155.133.82.181 155.133.82.240 155.133.82.244 185.234.218.59 195.22.126.160 195.22.126.163 195.22.126.80 195.22.126.81 5.45.73.24 5.45.74.130 IP addresses from which the Trojan was downloaded : 185.174.173.31 185.234.218.59 188.166.156.110 195.22.126.160 195.22.126.80 195.22.126.81 195.22.126.82 195.22.126.83 SHA256 : 158c7688877853ffedb572ccaa8aa9eff47fa379338151f486e46d8983ce1b67 3aedbe7057130cf359b9b57fa533c2b85bab9612c34697585497734530e7457d f3ae6762df3f2c56b3fe598a9e3ff96ddf878c553be95bacbd192bd14debd637 df61a75b7cfa128d4912e5cb648cfc504a8e7b25f6c83ed19194905fef8624c8 c0cfd462ab21f6798e962515ac0c15a92036edd3e2e63639263bf2fd2a10c184 d791e0ce494104e2ae0092bb4adc398ce740fef28fa2280840ae7f61d4734514 38dcec47e2f4471b032a8872ca695044ddf0c61b9e8d37274147158f689d65b9 27cea60e23b0f62b4b131da29fdda916bc4539c34bb142fb6d3f8bb82380fe4c 31edacd064debdae892ab0bc788091c58a03808997e11b6c46a6a5de493ed25d 87ffec0fe0e7a83e6433694d7f24cfde2f70fc45800aa2acb8e816ceba428951 eabc604fe6b5943187c12b8635755c303c450f718cc0c8e561df22a27264f101 Kernel Backdoor found in Gadgets Powered by Popular Chinese ARM Maker May 12 , 2016 Mohit Kumar How to Hack an Android device ? It is possibly one of the most frequently asked questions on the Internet .


All born in the 90s, these neophytes are not afraid to get caught, carelessly leaving a trail of traceable contact details online.


A backdoor also known as: W32.DefayliLTO.Trojan Trojan.Win32.Cosmu!O Trojan.Hosts Trojan.Cosmu.Win32.8116 Win32.Trojan.Qhost.y W32/Trojan2.OIIF Trojan.Qhosts TROJ_COSMU_000001b.TOMA Win.Trojan.Cosmu-1352 Trojan.Win32.Hosts2.wog Trojan.Win32.Drop.rqzxb Troj.W32.Hosts2.toz0 Virus.Win32.Virut.ua TrojWare.Win32.Qhost.rqj Trojan.MulDrop3.7647 TROJ_COSMU_000001b.TOMA BehavesLike.Win32.PUPXAN.tz W32/Trojan.VWTG-6346 Win32/Virut.bv TR/Cosmu.oiqea Trojan/Win32.Cosmu Worm:Win32/Makc.A Trojan.Graftor.D2333 Trojan.Win32.A.Cosmu.577633 Trojan.Win32.Hosts2.wog HEUR/Fakon.mwf BScope.Trojan.IRCbot Win32/Qhost.ONX Trojan.Cosmu!mnslE6bxKwc Worm.Win32.AutoIt W32/Qhost.ONX!tr


A backdoor also known as: W32.Gezak Trojan.Vir.HLL Trojan.Heur.ED5CCE WORM_GEZAK.A W32/Risk.GNIP-0600 W32.Osapex Win32/Gezak.A WORM_GEZAK.A Win.Trojan.Gezak-1 Virus.Win32.HLLW.Gezak Virus.Win32.HLLW.gjmh W32.HLLW.Gezak!c Win32.HLLW.Gezak Win32.HLLW.Osapex Virus.Gezak.Win32.1 W32/Osapex.b.worm Win32/HLLW.Gezak Virus/Win32.Gezak Win32.HLLW.kcloud Virus.Win32.HLLW.Gezak Win32/Osapex.worm.31744 W32/Osapex.b.worm Trojan.Worm Univ.AP.K Win32/HLLW.Gezak Win32.Virus.Hllw.Hnbi Win32.HLLW.Gezak Virus.Win32.HLLW W32/Gezak.A!worm Win32/Worm.fc8


Some examples are email messages claiming to be in regards to an overdue bill or invoice, utilizing such terminology in the subject line and given file name, such as invoice.zip or payment_doc_298427.zip


We haven't seen Locky for a long time, so I was quite surprised to see this one.


WHO IS BEHIND FAKESPY ’ S SMISHING CAMPAIGNS ? The Cybereason Nocturnus team suspects that the malware operators and authors are Chinese speakers .


It was hosting an Adobe Flash exploit targeting one of the newly disclosed vulnerabilities from the Hacking Team data breach, CVE-2015-5122.


A backdoor also known as: Trojan/W32.Small.14848.GD Trojan.Win32.Small!O Trojan/Small.cnp Trojan.Conjar.8 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Ransomlock TROJ_IKYTOK.SMI Trojan.Win32.Small.djdxj TROJ_IKYTOK.SMI Trojan/Small.kgz TR/Zapchast.I Trojan:Win32/Ikytoky.A Trojan.Win32.A.Small.14848 Trojan/Win32.Menti.R9065 Trojan.Karagany Trojan.Downloader.MB Trj/Hexas.HEU


A backdoor also known as: Trojan/Injector.dtxv TROJ_INJECTOR_HA010038.UVPM Win32.Trojan-PSW.Fareit.a W32/Injector.GBX TROJ_INJECTOR_HA010038.UVPM Win.Trojan.Fareit-403 Riskware.Win32.Stealer.evlqpt Trojan.PWS.Stealer.18592 Trojan.Ekstak.Win32.3539 W32/Injector.ELVO-4299 DR/Delphi.rghyi Trojan/Win32.Ekstak.R214290 Backdoor.Androm Trojan.Injector Win32/PSW.Fareit.A Trojan.Win32.Injector W32/Kryptik.GCFM!tr


Many domains in this report are compromised domains - traffic to them may not be malicious.


Analysis of TG-3390's operations, targeting, and tools led CTU researchers to assess with moderate confidence the group is located in the People's Republic of China.


In January 2016 Forcepoint Security Labs reported an email campaign delivering the Ursnif banking Trojan which used the Range' feature within its initial HTTP requests to avoid detection.


The Lazarus group, which has been identified as the backbone of the report, has been active in the past, and Novetta's research is helping to preemptively counteract and prevent Lazarus attacks around the world.


While vertical targeting varies, we observed a significant focus on Financial Services.


A backdoor also known as: W32.LRSgzengelSvrA.Trojan Trojan/W32.Rootkit.78592 Trojan.Festi.C6 Trojan/Tent.cow Trojan.Rootkit.1 RTKT_FESTI.SM Win32.Trojan.WisdomEyes.16070401.9500.9989 Trojan.Festi RTKT_FESTI.SM Win.Trojan.Rootkit-4345 Trojan.Win32.Tent.ddfje Trojan.NtRootKit.12267 Rootkit.Tent.Win32.134 Rootkit.Tent.fc RKIT/Tent.aui Trojan[Rootkit]/Win32.Tent Backdoor:WinNT/Festi.C Win-Trojan/Festi.78592 TScope.Malware-Cryptor.SB Trj/CI.A Win32.Exploit.Tent.cmvx


A backdoor also known as: W32.downCN.Adware Trojan-Downloader.Win32.Petus!O Win32.Trojan.WisdomEyes.16070401.9500.9998 TROJ_DLDR.SMIH Trojan.Win32.Petus.efjtuk Trojan.Win32.A.Downloader.69153 Troj.Dropper.W32.StartPage.lmCy Trojan.DownLoader4.54937 Downloader.Petus.Win32.9 TROJ_DLDR.SMIH Trojan-Downloader.Win32.Petus Trojan[Downloader]/Win32.Petus TrojanDownloader:Win32/Petus.C Trojan/Win32.Petus.R4023 Win32/Trojan.c81


A backdoor also known as: W32.FamVT.Cosmu.PE Win32.Worm.VB.NZQ Trojan.Win32.Cosmu!O W32.Lamer.EL3 Trojan.Downloader Worm.VB.Win32.26804 Trojan/VB.nup Win32.Virus.VBbind.a W32.Besverit Win32/VB.JU TROJ_DLOADR.SMM Win.Trojan.Cosmu-4 Virus.Win32.Lamer.el Win32.Worm.VB.NZQ Trojan.Win32.VB.ltch Trojan.Win32.Cosmu.887991 Worm.Win32.VB.kp Win32.Worm.VB.NZQ Win32.Worm.VB.NZQ Win32.HLLW.Autoruner.6014 TROJ_DLOADR.SMM BehavesLike.Win32.Autorun.vh Worm.Win32.VB Trojan/Cosmu.lan Win32.Worm.VB.NZQ Troj.Downloader.W32.VB.l4ji Virus.Win32.Lamer.el Win32.Worm.VB.NZQ Win32/Lamer.D Win32.Worm.VB.NZQ SIM.Trojan.VBO.0859 Win32/VB.NUP W32/AutoRun.RPV!worm W32/OverDoom.A Virus.Win32.Lamer.B


In early 2015, FIN1 updated their toolset to include a utility that modifies the legitimate system Volume Boot Record VBR and hijacks the system boot process to begin loading Nemesis components before the Windows operating system code.


A backdoor also known as: Exploit.Java.CVE20130422.crcqcf Exploit:Java/CVE-2013-0422.A heur:Exploit.CVE-2013-0422 Exploit:Java/Obfuscator.AS Trojan.Java.Downloader virus.java.bot.a


A backdoor also known as: W32.PasistA.Worm Worm.Sfone.A3 Worm.Sform Worm.Sfone W32/Worm.BLGI W32.SillyWNSE Win32/Sfone.A BehavesLike.Win32.Trojan.ch W32/Worm.KOKR-0749 Worm:Win32/Sfone.A Worm.Sfone.A W32/WinSxsBot.A.worm


Communicates via TOR


Without the use of SSL interception traditional IDS/IPS systems could cease to detect compromised systems.


A backdoor also known as: Worm.Theals W32/Theals.dam Worm.Theals.Win32.2 Win32.Trojan.WisdomEyes.16070401.9500.9975 Win32/VB.VOMRAe Win.Exploit.DCOM-5 Net-Worm.Win32.Theals.c Virus.Win32.Theals.vvbf Net.Worm.W32!c Virus.Win32.Theals_re.c Win32.Zombie.4214 BehavesLike.Win32.Virut.ch Worm/Theals.i W32/Theals.D Win32.Theals.bd.8704 Net-Worm.Win32.Theals.c Worm/Win32.Theals.C1456665 Virus.Win32.Stealth.c W32/Theals.C!worm.im Win32/Trojan.529


A backdoor also known as: W32.Delf.S10 Trojan.Delf.Win32.63014 Troj.W32.Bcex.tnto Win32.Trojan.Delf.ah Downloader.Ponik Win.Trojan.Delf-33216 Win32.Trojan-Dropper.FakeDoc.B Trojan.Win32.Broskod.rb Trojan.Win32.Delf.cqqvkh TrojWare.Win32.Delf.DHHK BehavesLike.Win32.AdwareDealPly.ch Worm.Win32.Takc Trojan/Win32.Unknown Worm:Win32/Takc.A Trojan.Win32.Broskod.rb Hoax.Blocker Win32.Virus.Delf.Wsjq Trojan.Delf!8gjXiSoqNjg W32/Delf.NBJ!tr Win32/Trojan.Delf.I


A backdoor also known as: Ransom.Apollo Ransom.Apollo Ransom_Apollo.R058C0TLR17 Win32.Trojan.WisdomEyes.16070401.9500.9925 W32/Trojan.MNOB-4766 Ransom_Apollo.R058C0TLR17 Win32.Trojan-Ransom.ApolloLocker.A Trojan.Win32.Crypted.ewmuiu W32.Troj.Ransom!c Ransom.Win32.Apollo Ransom:Win32/Apollo.A Trj/CI.A Win32/Trojan.160


A backdoor also known as: Trojan.JobLaunch.ODB Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Memsyl TROJ_NECURS.SMJ10 Trojan.Win32.Crypted.dgzzxe Trojan.DownLoader11.38598 TROJ_NECURS.SMJ10 W32/Trojan.TVCC-2701 TrojanDropper.Injector.atzu Trojan.Zusy.D1B5A0 Dropper/Win32.Necurs.R121870 TrojanDropper.Injector Trojan.MSIL.Inject MSIL/Injector.FWI!tr


A backdoor also known as: HW32.Packed.C675 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan2.IUJL SecurityRisk.Downldr Trojan.DownLoad.42343 W32.Malware.Downloader Trojan.Kelios.1 TScope.Malware-Cryptor.SB Trojan.Win32.Dogrobot


Initial research identified that the filename suggested a relationship to the D-30 122mm towed howitzer, an artillery weapon first manufactured in the Soviet Union in the 1960s but still in use today.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9772 Win.Trojan.Adwind-9 W32/Trojan.YEAY-3186 W32.Dropper.Java Trj/CI.A Win32/Application.22f


A backdoor also known as: HW32.Packed.38CB Virus.Win32.Virut


Until now, it was widely believed the actor's activities had largely subsided in 2013, following numerous public disclosures and detailed analyses of their backdoors.


Surprisingly, there is a lot of media attention going on at the moment on a macOS malware called OSX/Dok.


A backdoor also known as: Trojan.Symmi.DEFF7 W32.Extrat Win.Trojan.B-471 BackDoor.Cybergate.4022 BehavesLike.Win32.Backdoor.gc Troj.W32.Scar.lByG Trojan.Win32.Xtrat.ldu Backdoor/Win32.Poison.R139029 Trojan.Xtrat Trojan.Win32.Remtasu


The Trojan may send the following information to one of the remote locations: Computer name


A backdoor also known as: Trojan/W32.DoS.751104 DoS.Win32.Delf!O Trojan/DOS.Delf.j DoS.Delf!7331ealGHQM W32/Worm.ATZ Hacktool.Flooder TROJ_DELF.FOE DoS.Delf DoS.Win32.Delf.j Trojan.Win32.Delf.hdtu PE:Hack.DDoSer.Win32.Delf.j!1074949418 Tool.Delf.Win32.630 TROJ_DELF.FOE BehavesLike.Win32.Trojan.bh W32/Worm.OXOE-7458 Trojan/DDoS.Delf.f DDOS/Delf.J.4 HackTool[DoS]/Win32.Delf Win32.Hack.Delf.j.kcloud Trojan.Win32.Dos-Delf.626688[h] Win-Trojan/Xema.variant DoS.Delf Trojan.Win32.Delf.j Win32.Trojan.Delf.brp Trojan-Dropper.Delf W32/Delf.A!tr DoS.BRY Win32/Trojan.2ff


In the months leading up to August, the Sofacy group launched several waves of attacks relying on zero-day exploits in Microsoft Office, Oracle Sun Java, Adobe Flash Player and Windows itself.


A new variant of the notorious ransomware Petya is back - again - and with yet another James Bond reference for a name: Goldeneye.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9996 Trojan.Cridex Trojan.Win64.Kryptik.exmlew Trojan.Win32.Z.Mikey.577536.K Trojan.Kryptik.Win64.1541 Trojan.Win64.Crypt W64/Trojan.WNTM-1890 TR/Crypt.ZPACK.fzarm Trojan/Win64.Dridex Trojan.Mikey.D123A2 Backdoor.NanoCore Trj/CI.A Win32.Trojan.Mikey.Szbg Win32/Trojan.4d2


A backdoor also known as: Backdoor.PePatch.Win32.108052 Trojan.Razy.D2AD35 Win32.Trojan.WisdomEyes.16070401.9500.9515 Trojan.Win32.Wencho.eqsozv Backdoor.Win32.Wencho Backdoor:Win32/Wencho.A Downloader/Win32.Paph.C1961981 TrojanDownloader.Paph Trj/GdSda.A


A backdoor also known as: Trojan-Exploit/W32.IMG-WMF.23552.O Trojan-GameThief.Win32.OnLineGames!O Exploit.IMG.Win32.498 Trojan/Exploit.IMG-WMF.axd TROJ_BEHAV.FL Win32.Trojan.WisdomEyes.16070401.9500.9981 TROJ_BEHAV.FL Win.Trojan.Exploit-289 Exploit.Win32.IMGWMF.bekdjb Exploit.W32.IMG-WMF.loBk TrojWare.Win32.GameThief.Magania.~EV Trojan.DownLoad.15186 BehavesLike.Win32.Worm.mc Exploit.IMG-WMF.agp Rootkit.Small Trojan.Win32.KillAv.hd Exploit.Win32.IMG-WMF Win32/Trojan.Exploit.a54


A backdoor also known as: Trojan.Delf Trojan.Heur.iO0au4aNrMf Win32.Trojan.WisdomEyes.16070401.9500.9705 W32/Trojan.UNZI-1320 W32.Datom.Worm Trojan.Win32.Delf.enaz Trojan.Win32.Datom.euwmlv Worm.Win32.Datom.A~1 Win32.HLLW.Datom BehavesLike.Win32.Sality.cc Virus.Worm.Datom Trojan.Win32.Delf.enaz Trojan/Win32.Buzus.C104859 Trojan.Delf Win32.Trojan.Delf.Swlf


SANS has published a new blog regarding a tax filing service that has been compromised.


A backdoor also known as: Application.NirSoft.PSPassView.C PSWTool.Win32.PassView!O HackTool.Pspv.SD4 W32/PWS.IMQI-4038 Hacktool.PStorRevealer Application.NirSoft.PSPassView.C not-a-virus:PSWTool.Win32.PassView.iv Application.NirSoft.PSPassView.C Riskware.Win32.PassView.exmcew Application.NirSoft.PSPassView.C ApplicUnsaf.Win32.PSWTool.PassView.A Tool.PassView Tool.PassView.Win32.6 W32/PWStealer.CAT PSWTool.PassView.k Trojan[PSWTool]/Win32.PassView Application.NirSoft.PSPassView.C not-a-virus:PSWTool.Win32.PassView.iv TScope.Malware-Cryptor.SB PUP.Optional.PassView Trj/CI.A HackTool.IcqSmiley.A not-a-virus:PSWTool.Win32.PassView Win32/Application.40e


Unit 42 recently identified a targeted attack against an individual working for the Foreign Ministry of Afghanistan in China.


This threat targets Russians but the apps are accessible worldwide.


A backdoor also known as: Trojan.Qhost.Win32.10597 Trojan/Qhost.pdq Trojan.Zusy.D5AFC Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Hosts.bgaqwt Troj.Banker.W32.Qhost.lE9S Trojan.Hosts.5268 Trojan.Win32.Hider Trojan/Win32.Unknown Trojan:WinNT/QHosts.B Win32/Qhost.PDQ Trojan.Qhost!QXppfUGnhzI W32/Kryptic.QHS!tr


A backdoor also known as: Trojan.Spymel.A4 Trojan.ReconycCRTD.Win32.8402 Trojan.Zusy.D1E1BE Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Reconyc.inec Trojan.DownLoader13.49710 Trojan/Win32.Reconyc Backdoor:MSIL/Moidirat.A Trojan.Win32.Reconyc.inec Trojan.MSIL.Spy Win32/Backdoor.a11


A backdoor also known as: Trojan/W32.Nymaim.561152 Trojan.NymaimCS.S1199370 TROJ_NYMAIM.SMR2 Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_NYMAIM.SMR2 Trojan.Win32.Nymaim.eqlfnf TrojWare.Win32.Nymaim.CH Trojan.Nymaim.143 BehavesLike.Win32.MultiPlug.hh Trojan-Downloader.Nymaim Trojan.Nymaim.czv TR/Crypt.Xpack.owrka Trojan/Win32.Nymaim Win32.Trojan.Nymaim.M Trojan/Win32.Nymaim.C2027429 Trojan.Nymaim Trojan.Nymaim Win32/TrojanDownloader.Nymaim.BA Trojan.Nymaim!ovdfLq+hmM4 W32/Nymaim.BA!tr Trj/GdSda.A


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Java.Downloader.1096 BehavesLike.Win32.Trojan.vc Java.Obfus


Microsoft Publisher is included and installed by default in Office 365.


Kaspersky Lab began this ongoing research in the autumn of 2011.


In this post we will review the research results of Votiro Labs and ClearSky, the weaponized documents and campaign infrastructure.


A backdoor also known as: Trojan.Heur.TP.ED1233C Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Win32.Z.Starter.204271 Trojan.Win32.Starter Exploit.ShellCode Trojan:Win32/Starter.P Trojan.Win32.Starter Trj/CI.A Win32.Trojan.Crypt.Dzkb Win32/Trojan.6f7


DustySky called NeD Worm by its developer is a multi-stage malware in use since May 2015.


When a user opens the .zip file and double clicks the JavaScript, the default browser Internet Explorer, Mozilla, etc. opens and executes JavaScript.


We have identified a new distribution campaign which took place on 4th July.


A backdoor also known as: Trojan.Minxer Win32.Trojan.WisdomEyes.16070401.9500.9994 W32/Trojan.CFWS-6788 Win32.Application.Bitcoinminer.W Riskware.Win64.BtcMine.eiegeg Trojan.BtcMine.604 Worm.WBNA.Win32.419008 W32.Trojan.Minxer Trojan.Razy.D197C7 Trojan.BitCoinMiner Trj/CI.A Riskware.BitCoinMiner! Win32/Trojan.582


Linux.Rekoobe variant


Sex sells, and nowhere is that more true than the Chinese mobile landscape.


BAIJIU's goal in this attack was to deploy a set of espionage tools through a downloader we call TYPHOON and a set of backdoors we call LIONROCK.


Adding AV exceptions


The first one is used to receive a list of logins and passwords, the second one—for operation of the SOCKS proxy server.


Variants of H-Worm, primarily connecting to command and control servers located in Algeria.


A backdoor also known as: Trojan/W32.ShipUp.90112 W32.VisuDir.A3 Trojan.Zusy.D2CF33 PE_SHIPUP.A Win32.Worm.ShipUp.h Win32/Gamarue.ISACBfC PE_SHIPUP.A Trojan.Win32.ShipUp.futk TrojWare.Win32.ShipUp.AR Trojan.KillFiles.28137 Worm.Win32.ShipUp Worm:Win32/Lecna.A!dha Trojan.Win32.ShipUp.futk Trojan/Win32.Cossta.R120893 Trojan.FakeDoc Trojan.Win32.Csyr.A


The malicious macro inside the Office document is obfuscated as shown in the code snapshot below -Recently [Kaspersky] came across a new family of cross-platform backdoors for desktop environments.


Typhon is an info stealer first that was reported in mid-2022 for the first time.


A backdoor also known as: Trojan.Zenshirsh.SL7 Trojan.Win32.Pigeon.cxszod Uds.Dangerousobject.Multi!c Win32.Trojan.Mikey.Swlc BackDoor.Pigeon.8805 Backdoor.Hupigon.Win32.185096 Trojan.Mikey.D9181 HackTool:Win32/Goldoseri.A Win32/HackTool.DoSer.AE BackDoor.Pigeon! Win32/Trojan.6bf


On July 6, 2017, RSA FirstWatch noted renewed MONSOON APT campaign activity submitted from a community user in India to Virus Total.


A backdoor also known as: RDN/BackDoor-AWQ.b Heur.Corrupt.PE Backdoor.Win32.Hupigon TrojanDropper:Win32/Arbinder.B.dam#2 Backdoor/Win32.Graybird.C194482


A backdoor also known as: Trojan.Zenshirsh.SL7 Hacktool.Flooder BehavesLike.Win32.RAHack.xc Trojan-DDoS.Win32.Resod TrojanDDoS.Resod.g TR/DDoS.Maker.11.B Trojan[DDoS]/Win32.Resod DDoS:Win32/Resod.dam#2 Win32/Trojan.DDoS.835


A backdoor also known as: Win32.Wurmark.A@mm Win32.Wurmark.A@mm W32/Mugly.h@MM W32.W.Wurmark.g!c W32/Wurmark.g Win32.Wurmark.A@mm Win32.Wurmark.E90817 I-Worm.Wurmark!utsCc3R91ZU W32/Wurmark.F W32.Mugly.G@mm Win32/Wurmark.G WORM_MUGLY.H Worm.Wurmark.G Email-Worm.Win32.Wurmark.g Trojan.Win32.Wurmark.fsml Virus.Win32.Heur.c Win32.Wurmark.A@mm Worm.Win32.Wurmark.G Win32.Wurmark.A@mm Worm.Wurmark.Win32.11 WORM_MUGLY.H BehavesLike.Win32.VBObfus.fc W32/Wurmark.JPAN-1543 I-Worm.Wurmark.a WORM/Uglatad.2 Worm[Email]/Win32.Wurmark Worm:Win32/Mugly.H@mm Win32/Mugly.worm.351744 Win32.Wurmark.A@mm Win32/Mugly.G Worm.Wurmark Win32.Wurmark.A@mm Virus.Win32.QQRob.AS W32/Mugly.H@mm I-Worm/Wurmark.E Worm.Win32.Wurmark.AGmW


Darkhotel APT attacks dated 2014 and earlier are characterized by the misuse of stolen certificates, the deployment of .hta files with multiple techniques, and the use of unusual methods like the infiltration of hotel Wi-Fi to place backdoors in targets' systems.


A backdoor also known as: Trojan.Symmi.D11236 Win32.Trojan.WisdomEyes.16070401.9500.9993 DLOADER.Trojan Trojan-Downloader.Win32.Small Trojan/Win32.Rozepads.R172444 BScope.Trojan.Win32.Inject.2


A backdoor also known as: Backdoor/W32.Androm.1289728 Trojan.Skeeyah Backdoor.Bot Win32.Trojan.WisdomEyes.16070401.9500.9989 W32/Trojan.UWVT-1669 W32.Golroted TROJ_INJECTOR_FE31022B.UVPM Backdoor.Win32.Androm.hjzg Trojan.PWS.Stealer.13025 TROJ_INJECTOR_FE31022B.UVPM BehavesLike.Win32.Trojan.tc W32/Trojan2.PTAY Backdoor/Androm.gyi Trojan[Backdoor]/Win32.Androm Trojan.MSIL.Androm.9 Backdoor.Win32.Androm.hjzg Trojan:MSIL/Loksec.A Trojan/Win32.Inject.R140951 Backdoor.Androm Trojan.Injector Trj/CI.A


A backdoor also known as: Trojan/Dropper.Delf.bl TROJ_DROPPER.IPJ W32/Risk.CLFC-1497 Backdoor.Acropolis TrojanDropper.Delf TROJ_DROPPER.IPJ Win.Trojan.Acropolis-1 Trojan-Dropper.Win32.Delf.bl Trojan.Win32.Delf.ffej Dropper.Delf.972288 Troj.Dropper.W32.Delf.bl!c TrojWare.Win32.TrojanDropper.Delf.BL BackDoor.Acropolis.10 Dropper.Delf.Win32.1638 Trojan-Dropper.Win32.Delf W32/Dropper.HL TrojanDropper.Delf.cj W32.Trojan.Dropper-Tetris BDS/Acropolis.3 Trojan[Dropper]/Win32.Delf Win32.Troj.Delf.bl.kcloud Backdoor:Win32/Tetris.A Trojan.Graftor.D2B929 Trojan-Dropper.Win32.Delf.bl Win32/TrojanDropper.Delf.BL Win32.Trojan-dropper.Delf.Efao TrojanDropper.Delf!n6JtRIRZLjo W32/Acrop.A!tr.bdr Win32/Trojan.Dropper.605


A backdoor also known as: W32.FamVT.ExpiroPC.PE Backdoor.Win32.Nucleroot!O Win32.Trojan.WisdomEyes.16070401.9500.9750 Adware.Lop Win32/Talpalk.C Win.Trojan.Maha-2 Backdoor.Win32.Nucleroot.c Trojan.Win32.Maha.gubp Packer.W32.PePatch.l5Ml Packed.Win32.Klone.~KE Trojan.Maya BehavesLike.Win32.Ipamor.ch Trojan-Dropper.Delf Backdoor/Nucleroot.fk Trojan[PSW]/Win32.Maha Backdoor.Win32.A.Nucleroot.130560 Backdoor.Win32.Nucleroot.c PWS:Win32/Bividon.A Backdoor.Nucleroot W32/Nucleroot.C!tr


Security researchers have identified and identified a new type of malware, which they believe is being developed by threat actors operating from North, East and South-East Asia, and is capable of being fully undetectable.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Zbot Backdoor.Win32.DarkKomet.zvj Trojan.Win32.DarkKomet.dklzqc Trojan-Dropper.Win32.Injector Trojan[Backdoor]/Win32.DarkKomet Trojan.MSIL.Krypt.3 Backdoor.Win32.DarkKomet.zvj PWS:MSIL/Skonpri.A Backdoor/Win32.DarkKomet.R90638 Backdoor.DarkKomet Trj/CI.A Trojan.Krypt!XrXGvmn0xR4 W32/DarkKomet.FZ!tr.bdr


The main goal of the xDedic forum is to facilitate the buying and selling of credentials for hacked servers which are available through RDP.


This report is the first to detail the attack against strategic US interests to China.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Archbomb.ZIP Trojan-ArcBomb.ZIP.Bubl.b Trojan.Zip.Arch-Bomb.yngkq BehavesLike.Win32.Trojan.dh Trojan.Archbomb BOMB/ArcBomb.O Trojan-ArcBomb.ZIP.Bubl.b


The abuse of shortcut LNK files is steadily gaining traction among cybercriminals.


Initially, we've called it Matrix Banker based on its command and control C2 login panel, but it seems that Matrix Admin is a template available for the Bootstrap web framework.


A backdoor also known as: Win32/Shuq.B W32/Shuq.g I-Worm.Shuq!TBLjXfxv+A8 W32.SillyFDC Win32/Shuq.NAA TROJ_ANGEL.F Worm.Shuq.B Email-Worm.Win32.Shuq.g Trojan.Win32.Shuq.epjd Trojan.Win32.S.HDC.66048[h] W32.W.Shuq.g!c Backdoor.Win32.Shuq.NAA BackDoor.HSV.1013 Worm.Shuq.Win32.5 TROJ_ANGEL.F W32/Risk.OPXF-7688 Worm/Sramota.aws W32/ANGEL.G@mm Worm[Email]/Win32.Shuq Trojan/Win32.HDC Backdoor:Win32/Shuq.A Worm.Shuq Win32.Worm-email.Shuq.Eerm Email-Worm.Win32.Shuq I-Worm/Shuqing.E


Reasons for Taiwan being targeted range from being one of the sovereign states of the disputed South China Sea region to its emerging economy and growth with Taiwan being one of the most innovative countries in the High-Tech industry in Asia.


A backdoor also known as: Worm/W32.DipNet.139264 W32/DipNet.f Trojan.Win32.DipNet.emkm W32/Dipnet.F Trojan.Netdepix.B Win32/Dipnet.NAD Net-Worm.Win32.DipNet.f Worm.DipNet!vTuZ7jF3dLw Worm.Win32.DipNet.139264[h] W32.W.DipNet.f!c Virus.Win32.Part.a Worm.Win32.Dipnet.NAD BackDoor.Xdoor.351 Worm.DipNet.Win32.8 BehavesLike.Win32.Trojan.ch W32/Dipnet.XULH-0302 Worm/DipNet.a WORM/DipNet.b W32/Netdepix.B!worm Worm[Net]/Win32.DipNet Win32/Dipnet.worm.139264 Worm:Win32/DipNet.H Win32/Oddbob.E Net-Worm.DipNet W32/Oddbob.E.worm Backdoor.Win32.Xdoor Worm/Dipnet.M Worm.Win32.DipNet.aMVE


A backdoor also known as: Trojan.DL.VB.IHEW Trojan-Spy.Win32.Bancos.alh!IK Trojan-Downloader.Win32.VB.tbx TR/Spy.65536.194 TSPY_ZBOT.SMDM Trojan.Spy.65536.194 TrojanDownloader.VB.vhu TrojanSpy:Win32/Bancos.KY Trojan-Downloader.Win32.VB.tbx Trojan-Spy.Win32.Bancos.alh


On July 5, 2015 an unknown hacker publicly announced on Twitter that he had breached the internal network of Hacking Team – an Italian pentesting company known to purchase 0-day exploits and produce their own trojans.


A backdoor also known as: Trojan-Downloader.Win32.Harnig!O Win32.Trojan-Downloader.Harnig.cu Trojan.Gobrena TROJ_HARNIG.FC Trojan-Downloader.Win32.Harnig.cu Trojan.Win32.Harnig.dpsezu PE:Trojan.DL.Tibs.fxl!1074175505 Trojan.DownLoader.13549 Downloader.Harnig.Win32.2 TROJ_HARNIG.FC TrojanDownloader.Harnig.alh TR/Dldr.Small.dib.6 Trojan[Downloader]/Win32.Harnig.cu Win32.TrojDownloader.Harnig.co.kcloud Trojan/Win32.Harnig Trojan-Downloader.Revelation.Tibs.B Trojan-Downloader.Win32.Harnig.cr W32/Harnig.CU!tr.dldr Downloader.Harnig.AP Trojan.Win32.Harnig.Aj


Every one of these campaigns involved a Windows version of Derusbi.


On October 10, 2017, Kaspersky Lab's advanced exploit prevention systems identified a new Adobe Flash zero day exploit used in the wild against our customers.


The service offers a binder tool that allows users to masquerade their malware as legitimate software.


Malwarebytes has been observing a surge in drive-by download attacks since the recent Flash zero-day now patched.


A backdoor also known as: TrojanAPT.BrowsPass.ST3 Trojan.MSIL.Ubibila.1 Win32.Trojan.WisdomEyes.16070401.9500.9999 MSIL.Trojan.Pinject.A Trojan-Dropper.Win32.Sysn.bgns Trojan.Win32.MailPassView.dzxrgp Tool.MailPassView.236 BehavesLike.Win32.Trojan.gc Trojan.PSW.Fareit.te TR/Dropper.MSIL.sbcsg Trojan:MSIL/Golbla.B Trojan-Dropper.Win32.Sysn.bgns Trojan/Win32.Golbla.C1246680 Trj/CI.A Win32.Trojan-dropper.Sysn.Akyi Trojan.Inject MSIL/Injector.MRD!tr


A backdoor also known as: W32.AutorunXjyv.Worm Trojan.Dropper.VIO Trojan/W32.Chydo.569344.E Trojan.KillAv.DR Trojan.Chydo Win32.Worm.Autorun.j Win32/Pykspa.C WORM_MESSEN.SMF Trojan.Dropper.VIO Worm.Win32.AutoRun.iea Trojan.Dropper.VIO Trojan.Win32.Chydo.eahreo Trojan.Win32.Chydo.516096.B Trojan.Dropper.VIO Trojan.MulDrop5.14836 Worm.AutoRun.Win32.116380 WORM_MESSEN.SMF BehavesLike.Win32.Backdoor.hc Trojan/Chydo.bj Trojan.Dropper.VIO Worm.Win32.AutoRun.iea TrojanDropper:Win32/Pykspa.A Trojan/Win32.Chydo.R40147 Trojan.Dropper.VIO Trojan.Chydo Trojan.Win32.FakeAlert.ate Trojan.Win32.KillAV.Y


In this post, we will be pulling apart and dissecting the Rambo backdoor and discussing several of its evasion techniques.


DarkKomet variant, often dropped as patcher.exe


A backdoor also known as: W32.Clodee5.Trojan.2bfc Trojan.Proxy.Wopla.Q Trojan-Proxy/W32.Wopla.20992.D Trojan.Wopla.Win32.59 Trojan/Proxy.Wopla.q Trojan.PR.Wopla!heGrkrdKLNg Trojan.Tannick.B Win32/Pokier.V TSPY_WOPLA.Q Trojan.Proxy.Wopla.Q Trojan-Proxy.Win32.Wopla.q Trojan.Proxy.Wopla.Q Trojan.Win32.Wopla.csuaej PE:Trojan.Proxy.Wopla.ay!100004534 Trojan.Proxy.Wopla.Q TrojWare.Win32.TrojanDownloader.Small.AA Trojan.Proxy.Wopla.Q TSPY_WOPLA.Q BehavesLike.Win32.Downloader.mc W32/Trojan.AXS TrojanProxy.Wopla.d TR/Proxy.Wopla.Q.4 Win32.Troj.Wopla.q.kcloud Trojan.Proxy.Wopla.Q Win-Trojan/Wopla.20992 TrojanProxy.Wopla Trj/Alpiok.A Trojan-Proxy.Win32.Wopla.Q Multidr.J!tr Proxy.BKA.dropper Trojan.Win32.Wopla.AdJ


We rapidly determined that this spam campaign was attempting to broadly deliver TeslaCrypt 4.1A to individuals.


FireEye Threat Intelligence analysts identified a spear phishing campaign carried out in August 2015 targeting Hong Kong-based media organizations.


A backdoor also known as: DoS.Small W32/VirTool.OH Bloodhound.W32.EP DoS.Win32.Small.e Trojan.Win32.Small.dosb Flooder.Upsend W32/Tool.GNXW-3960 DoS.Small.c HackTool[DoS]/Win32.Small DoS:Win32/Small.E DoS.Win32.Small.e DoS.Small Win32.Trojan.Small.Lnoh DoS.Win32.Small W32/Small.E!dos


A backdoor also known as: W32.UsernameReimuatH.Trojan Worm/W32.WBNA.294912.AU Trojan.Win32.Diple!O Trojan.Beebone.D Trojan/VBObfus.fz Win32.Worm.Pronny.d Win32/VB.KXfdHDB WORM_VOBFUS.SM37 Win.Packer.VBCrypt-5731517-0 Worm.Win32.Vobfus.erof Trojan.Win32.Vobfus.enwdjc Win32.Worm.Vobfus.Wvay Win32.HLLW.Autoruner2.18084 WORM_VOBFUS.SM37 BehavesLike.Win32.Autorun.dh Win32.Virut.ce.57344 Trojan.Symmi.D13A73 Trojan.Win32.A.Diple.299008.BAT Worm.Win32.Vobfus.erof Worm/Win32.WBNA.R108353 TScope.Trojan.VB Worm.Win32.Vobfus


Once OSX/Dok infection is complete, the attackers gain complete access to all victim communication, including communication encrypted by SSL.


Once in the live session, if there is a file in /var/lib/man.cy, then this is an infected ISO.


At a high level, Romberik is a complex piece of malware that is designed to hook into the user's browser to read credentials and other sensitive information for exfiltration to an attacker controlled server, similar to Dyre.


A backdoor also known as: Trojan-PWS/W32.Avisa.69632 Trojan-PSW.Win32!O W32/Inttest.worm PWS-Inttest.B TROJ_AVISA.B Win32.Trojan.WisdomEyes.16070401.9500.9757 W32/Risk.CNKX-3667 Infostealer.Avisa Win32/PSW.Cript.B Trojan-PSW.Win32.Deintel Trojan.Win32.Avisa-Psw.fdrj Trojan.Win32.Avisa.69632 Trojan.Avisa.Win32.2 BehavesLike.Win32.PJTbinder.km Worm.Pws.Inttest Trojan/PSW.Avisa Trojan[PSW]/Win32.Deintel Trojan-PSW.Win32.Deintel Trojan/Win32.HDC.C89238 TrojanPSW.Deintel Trj/PSW.Intetest Win32/PSW.Avisa.A Win32.Trojan-qqpass.Qqrob.Sxoe Trojan.PSW.Avisa W32/Avisa.A!tr


Related insfrastructure shows another suspicious looking domain that mimics the Court of Arbitration for Sport


Their primary interest appears to be gathering intelligence related to foreign and security policy in the Eastern Europe and South Caucasus regions.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9998 Backdoor.Bifrose Trojan.Win32.Small.cup Trojan.Win32.Buzus.rbpz Trojan.Win32.Buzus.86895 Trojan.MulDrop.18143 BehavesLike.Win32.Backdoor.hc Trojan/Buzus.fcx Virus.Trojan.Win32.Buzus.acj W32/Trojan2.AGMZ Trojan/Buzus.cf TrojanDropper:Win32/Buzus.B W32.W.Ridnu.ls5O Trojan.Win32.Small.cup Trojan/Win32.Buzus.C71809 Trojan.Buzus W32/Kryptix.KZB!tr Win32/Trojan.6a2


A backdoor also known as: HW32.Packed.771B Ransom.Cerber.A4 Ransom.Cerber Trojan.Symmi.D13E52 Ransom_HPCERBER.SM3 Win32.Trojan.Kryptik.avs Ransom_HPCERBER.SM3 Trojan-Ransom.Win32.Rack.hly Trojan.Win32.Rack.evkhfe Trojan.Encoder.761 BehavesLike.Win32.Ransomware.gh Ransom.Win32.Teerac Trojan.Rack.dk Trojan-Ransom.Win32.Rack.hly Trojan.Menti Trj/GdSda.A W32/Kryptik.FSUS!tr Win32/Trojan.Ransom.7c1


A backdoor also known as: TrojanDownloader.Yafive.A.mue Win32.Trojan.WisdomEyes.16070401.9500.9991 Trojan-Downloader.Win32.QQHelper.air Troj.Spy.W32.Zbot.kYVW TrojWare.Win32.TrojanDownloader.Tiny.~CA BackDoor.Update.293 Win32.Hack.XComp.a.410674 TrojanDownloader:Win32/Yafive.A Trojan-Downloader.Win32.QQHelper.air TrojanDownloader.QQHelper Trojan-Downloader.Win32.QQHelper


It recently resurfaced in November 2016 W32.Disttrack.B, again attacking targets in Saudi Arabia.


A backdoor also known as: Win32.Yodo.A@mm Worm/W32.Yodo.1273856 W32/Yodo.a Win32.Yodo.E90817 WORM_YODO.F W32.Yodo@mm Win32/Yodo.D WORM_YODO.F Win32.Yodo.A@mm Email-Worm.Win32.Yodo.a Win32.Yodo.A@mm Trojan.Win32.Yodo.bdnumu W32.W.Yodo.a!c Win32.Yodo.A@mm Worm.Win32.Yodo.B.Dropper Win32.Yodo.A@mm Trojan.MulDrop.572 Worm.Yodo.Win32.1 BehavesLike.Win32.VBObfus.tm W32/Risk.OQBD-6759 Worm/Yodo.b Worm:Win32/Yodo.B.dr WORM/Yodo.A.1 Worm[Email]/Win32.Yodo Worm.Yodo.a.kcloud Worm:Win32/Yodo.B.dr Email-Worm.Win32.Yodo.a Worm.Yodo Win32/Yodo.B.Dropper Win32.Worm-email.Yodo.Eddu I-Worm.Yodo!uEen0717POE W32/Yodo.A!worm Win32/Worm.bde


We don't have the statistics of devices vulnerable to both issues at the same time.


A backdoor also known as: Trojan.Krypt.8 TROJ_TDSS.SMA Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_TDSS.SMA Packed.Win32.TDSS.aa Trojan.Win32.Tdss.btyvr Win32.PkdTdss Trojan.Packed.2936 BehavesLike.Win32.Adware.kc TrojanDropper:Win32/Sudiet.A Packer.W32.Tdss!c Packed.Win32.TDSS.aa Trojan/Win32.ADH.R21764 Trojan.TDSS.01414 Win32.Packed.Tdss.Akox Packer.Win32.Tdss W32/PackTDss.K!tr Win32/Trojan.5b8


A backdoor also known as: Win32.Worm.Bundpil.d Win32.Worm.Resparc.B Trojan:Win32/Lodbak.A Trojan/Win32.Lodbak.R151670 Trj/Gamarue.A


Intrusions began as early as 1996.


A backdoor also known as: Trojan.Win32.Scrop.exbmlp BehavesLike.Win32.AdwareConvertAd.fh W32/Trojan.YEZU-6096 TrojanDropper.Scrop.ns Trojan[Dropper]/Win32.Scrop Backdoor:Win32/Blopod.A!bit Trojan.Symmi.D13661 Dropper/Win32.Scrop.C2319178 TrojanDropper.Scrop Trj/GdSda.A


A backdoor also known as: Trojan.Netstop.A Backdoor.Padmin Backdoor.W32.Padmin.08!c Trojan/wGet.d Backdoor.Padmin.0.8 W32/Risk.LANR-3940 Win.Trojan.Padmin-2 Backdoor.Padmin.0.8 Trojan.Netstop.A Trojan.Win32.Padmin.dyyica Backdoor.Win32.Padmin.08 Trojan.Netstop.A BackDoor-ATM.dr Backdoor/Padmin.08.Install DR/Padmin.08 BackDoor-ATM.dr Backdoor.Padmin Bck/Iroffer.BG Win32/Padmin.08.A.dropper W32/Padmin.A!tr.bdr


A backdoor also known as: Adware.Heur.cmSfNKMeS5mk WORM_AMBLER.SMI Win32.Trojan.WisdomEyes.16070401.9500.9938 WORM_AMBLER.SMI Trojan.Win32.BHO.bmciwr Trojan.PWS.Finanz.origin W32/Ambler.dll TrojanDownloader:Win32/BHO.A TrojanDownloader.BHO Trj/CI.A Win32.Trojan.Spy.Hrza TrojanSpy.Banker!l0YgZsorMww Trojan-Spy.Finanz.J W32/Ambler.A!tr


This new report is an updated dissection of the group's attacks and methodologies—something to help organizations gain a more comprehensive and current view of these processes and what can be done to defend against them.


The email messages used in the attacks leverage themes related to economic development and politics in Burma, which is relevant to the work of the NGO.


A backdoor also known as: Trojan:Win32/Vareids.A Trojan.FakeAV


A backdoor also known as: Trojan.Win32.VBKrypt!O Worm.Rebhip.B3 Troj.W32.Scar!c Trojan/Injector.eyu Trojan.Win32.Scar.odxb Trojan.Win32.VBKrypt.ecjqdh Trojan.Win32.A.VBKrypt.200710 TrojWare.Win32.VBKrypt.cjb Trojan.Inject.27856 Trojan.VBKrypt.Win32.39868 BehavesLike.Win32.PWSSpyeye.cc W32/Trojan.FNVH-2986 Trojan/VBKrypt.bgwm Trojan/Win32.VBKrypt Trojan.ManBat.1 Trojan.Win32.Scar.odxb Trojan/Win32.VBKrypt.C66955 PWS-Spyeye.el SScope.Malware-Cryptor.VBCR.1841 Win32.Trojan.Scar.Tccd Trojan.VBKrypt!joEshOiwspo Win32/Trojan.00c


A backdoor also known as: Trojan/VB.qtt Backdoor.Win32.Sdbot.aeua Trojan.Win32.Nifclop.bbwtga Trojan.DownLoader6.34031 TR/Nifclop.A.6 Trojan:Win32/Nifclop.A Backdoor.Win32.Sdbot.aeua Win32/VB.QTT Trojan.Win32.Nifclop Win32/Trojan.fdb


During the last few days, we have observed a campaign redirecting visitors from large websites to the Angler EK.


A backdoor also known as: Trojan-Downloader.Win32.Gamarue.2!O TrojanDropper.Dexel.A5 Trojan.Blocker.Win32.18819 WORM_DEXEL.SM Win32.Trojan.WisdomEyes.16070401.9500.9869 W32/Autorun.LWDQ-2252 W32.SillyFDC Win32/Dapato.AY WORM_DEXEL.SM Trojan.Win32.Blocker.dbnfux Troj.Dropper.W32.FrauDrop.tnsr BehavesLike.Win32.Trojan.fh W32/Autorun.ABG TrojanDropper.Dapato.pgs Trojan[Dropper]/Win32.Dapato TrojanDropper:Win32/Dexel.A Trojan.Zusy.D26D16 Win32.Trojan.Dapato.B HEUR/Fakon.mwf TrojanDropper.FrauDrop Trj/CI.A


A backdoor also known as: W32.SvchostVS.Trojan Worm.Moarider Trojan/Autoit.nlq Win32.Trojan.AutoIt.a Bloodhound.Malautoit WORM_SOHANAD_EH110001.UVPC Trojan.Win32.Autoit.aza Trojan.Script.AutoIt.dbycya Troj.W32.Autoit.lWNh TrojWare.Win32.Autoit.AZA Trojan.DownLoader19.27399 WORM_SOHANAD_EH110001.UVPC BehavesLike.Win32.Comame.fc Trojan.Win32.Autoit TR/BAS.Samca.1188111 Trojan:Win32/Svhoder.A Trojan.Heur.E6CE86 Trojan.Win32.Autoit.aza HEUR/Fakon.mwf Trojan.Autoit.Wirus Trojan.Autoit.NLQ Win32/Autoit.NLQ W32/Autoit.NLQ!tr W32/Sality.AH


This infection is based on previously reported Gozi ISFB/Ursnif activity from March 6, 2023.


A backdoor also known as: PUP.Optional.BrSoftware Trojan.ADH Trojan-Banker.Win32.Lohmys.a Application.Win32.Midia.BR MalSign.Skodna.BRS Adware.Win32.Midia.B


It is designed to steal money from unsuspecting victims right off their bank accounts without them even noticing.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9866 W32/Trojan.IKAJ-5854 Infostealer.Banker.C Win32/Kollah.MWH Trojan.JarDrop.1 W32.Trojan.Dropper TR/Spy.ZBot.aww TrojanDropper:Win32/Jazuz.A Win32/Trojan.Spy.d85


Indicators about some panels hosting the DDoS Blue Botnet


The utility can be installed on smartphones and tablets as a program named Insta Plus, Profile Checker, and Cleaner Pro.


A backdoor also known as: Trojan.Minnerchek Trojan.Win32.S.Downloader.31046816 Trojan.Win32.Minnerchek Adware.Installcore Trojan:Win32/Minnerchek.A Dropper/Win32.CoinMiner.C2322242 Trj/Downloader.MEP


A backdoor also known as: W32.HfsAdware.689E PUP.Firseria/Variant Trojan.Application.Bundler.Morstar.30 Trojan.Dropper Win32/Tnega.ZRdFDZD Win.Adware.Morstar-136 not-a-virus:Downloader.Win32.Morstar.dhp Trojan.Win32.Morstar.dmuxrd Adware.Win32.Firseria.b Trojan.DownLoader11.57090 AdWare/Solimba.h RiskWare[Downloader]/Win32.Morstar TrojanDropper:Win32/Sventore.C not-a-virus:Downloader.Win32.Morstar.dhp Win32.Application.Morstar.E PUP/Win32.Solimba.R133806 PUP.Optional.Firseria PUA.Downloader! AdWare.BundleApp Win32/Application.164


A backdoor also known as: Trojan.Kazy.D4E7E3 Win32.Trojan.WisdomEyes.16070401.9500.9858 Trojan.Win32.CFI.eurnzt Trojan.Win32.Z.Kazy.253952.EN TrojWare.Win32.FraudPack.P Trojan.Click2.54806 W32/Trojan.JQCG-7679 PWS:Win32/Reteged.B TrojanSpy.Dibik Trojan-Spy.Reteged Adware/Win32.180solutions.BM


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Mlw.ewmnqj W32/Trojan.MKOX-6072 TR/Dropper.MSIL.citga Trj/CI.A Win32/Trojan.5e4


A backdoor also known as: Backdoor/W32.Cyn.18944.B Backdoor.Cyn Email-Worm.Win32.GOPworm.196 BKDR_CYN.C Backdoor.Trojan BKDR_CYN.C Backdoor.Win32.Cyn.12.a Trojan.Win32.Cyn.dotopq Backdoor.Win32.Cyn_12.EditSvr BackDoor.Cyn.12 Trojan.Cyn.Win32.1 BehavesLike.Win32.Trojan.lh W32/Risk.EBIW-7264 Backdoor/Cyn.f BDC/Cyn.12.A.EdS Backdoor:Win32/Cyn.1_02 Backdoor.Win32.Cyn.12.a Win-Trojan/Cyn_v12.18944 Email-Worm.Win32.GOPworm.196 SScope.Trojan.VBRA.3344 Bck/Cyn.12 Win32/Cyn.12 Backdoor.Cyn!pLjU0MDAXWM W32/Cyn.12!tr.bdr Win32/Backdoor.ac7


A backdoor also known as: Ransom.Exxroute.A3 Ransom.Cerber Win32.Trojan.Kryptik.bjk Ransom_CERBER.SM37 Win.Ransomware.Cerber-6162277-0 Trojan.Win32.Zerber.eltxmx Troj.Ransom.W32.Zerber.toho Trojan.DownLoader23.53130 Trojan.Kryptik.Win32.1113485 Ransom_CERBER.SM37 BehavesLike.Win32.Ransom.kh Trojan.Zerber.atr Backdoor:Win32/Crugup.B W32/Kryptik.FOLJ!tr


Typically, these campaigns leverage spear phishing as the delivery vector and often include malicious attachments designed to bypass typical detection controls.


A backdoor also known as: W32.BackdoorKasidetAF.Trojan Backdoor/W32.Kasidet.87040 Trojan.Dynamer.20568 Backdoor.W32.Kasidet.tnrA BKDR_NEUTRINO.SM Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Kasidet.J BKDR_NEUTRINO.SM Backdoor.Win32.Kasidet.bgo Trojan.Win32.Kasidet.dpmgpp Worm.Win32.Kasidet.CAK BackDoor.Neutrino.19 Backdoor.Kasidet.Win32.519 BehavesLike.Win32.TrojanShifu.mh Worm.Win32.Kasidet W32/Kasidet.INNN-8495 Backdoor/Kasidet.by TR/Hijacker.ldiu Trojan[Backdoor]/Win32.Kasidet Backdoor:Win32/Kasidet.C Backdoor.Win32.Kasidet.bgo Trojan/Win32.Dynamer.R156738 Backdoor.Kasidet Spyware.PasswordStealer Win32/Kasidet.AB Win32.Backdoor.Kasidet.Phgi Win32/Trojan.cd8


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9978 Trojan.Win32.Infospy.everjh Trojan.Infospy.13 BehavesLike.Win32.FakeAlert.lh Trojan-Dropper.Win32.Jscrpt W32.Trojan.Emotet TrojanDropper:Win32/Jscrpt.A!bit Trj/CI.A Win32/Trojan.f75


He matched both PDB paths as wel as behaviour to these samples, this blog describes the changed made to CryptoApp as well as the active campaign.


A backdoor also known as: Trojanpws.Tepfer Trojan-PSW.Win32.Tepfer.psxgjz Troj.Psw.W32.Tepfer!c Trojan.MSIL.Crypt TR/Dropper.MSIL.273998 Trojan-PSW.Win32.Tepfer.psxgjz Trojan:Win32/Matta.A!gfc TrojanPSW.Tepfer Trj/GdSda.A Win32.Trojan.Falsesign.Agbe MSIL/Injector.ONL!tr Win32/Trojan.Dropper.28b


A backdoor also known as: PowerShell/Rozena.AF BehavesLike.Win64.Dropper.cc Trojan/Scar.bmid


A backdoor also known as: Backdoor.RSM.2.0 Backdoor/W32.RSM.204800 Backdoor.RSM Backdoor.RSM.2.0 Backdoor.RSM.2.0 Backdoor.Trojan Backdoor.RSM.2.0 Backdoor.Win32.RSM.20 Backdoor.RSM.2.0 Trojan.Win32.RSM.dmmg Backdoor.Win32.Z.Rsm.204800 Backdoor.W32.RSM.20!c Backdoor.RSM.2.0 Backdoor.RSM.2.0 BackDoor.RMS.20 Backdoor.RSM.Win32.4 BehavesLike.Win32.Dropper.dc Backdoor.Win32.Intruder W32/Risk.WUUC-5425 Backdoor/RSM.28.b BDS/RSM.20.2 Backdoor:Win32/RSM.2_0 Backdoor.Win32.RSM.20 Backdoor.RSM Win32/RSM.20 Win32.Backdoor.Rsm.Sysb Backdoor.RSM!gcfh+QxIfXE W32/RSM.20!tr.bdr


Security researchers have discovered that Cl0p is now targeting Linux systems, using a new variant specifically designed for this operating system.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9951 Worm.BAT.Autorun.ex TrojWare.Win32.StartPage.~AO Win32.HLLW.Autoruner2.11336 Worm.AutoRun.Win32.42154 BehavesLike.Win32.Virus.cz Trojan-Dropper.Win32.Autorun Worm.BAT.al Win32.HeurC.KVM007.a.kcloud Worm.BAT.Autorun.ex TrojanDropper:Win32/Autorun.AC Worm/Win32.AutoRun.R74164 TScope.Trojan.Delf Trj/CI.A BAT/Autorun.BK Bat.Worm.Autorun.Aihw BAT/Autorun.EX!worm


Nonetheless, we can obtain targeting information and insight into tactics from the spearphish messages used by the threat actors.


A recent campaign compromised Taiwan and Hong Kong sites to deliver Flash exploits related to Hacking Team and eventually download PoisonIvy and other payloads in user systems.


This trojanized version of PuTTY harvests credentials and relays the information back to a collection server in the same way too.


A backdoor also known as: W32.SysAntiH.Worm Worm.Win32.AutoRun!O Worm.Yeltminky.A2 Win32.Trojan.KillAV.y W32.SillyFDC Win32/SillyAutorun.BBA Trojan.Win32.AntiAV.ciuz Trojan.Win32.AutoRun.btmkp Worm.Win32.Autorun.70144.E Trojan.Win32.KillAV.tco Win32.HLLW.Autoruner.25125 BehavesLike.Win32.Backdoor.lc Trojan-PWS.Win32.Lmir Worm/AutoRun.inq Virus/Win32.Virut.ce Worm:Win32/Yeltminky.A Trojan.Win32.AntiAV.ciuz Trojan/Win32.Hupigon.C73726 MalwareScope.Trojan-PSW.Game.7 RiskWare.Tool.CK Worm.AutoRun!snJYP2M4Pvg W32/QQPass.BTC Win32/Trojan.2ff


Ransomware has been responsible for many millions of dollars in damages, and CryptoWall is one of the most lucrative ransomware families in use today.


In March 2017, FireEye observed both nation state and financially motivated actors using EPS zero day exploits assigned as CVE-2017-0261 and CVE-2017-0262, prior to Microsoft disabling EPS rendering in its Office products with an update in April 2017.


A backdoor also known as: Trojan.Coantor.11 Win.Trojan.Cuegoe-6336261-0 BehavesLike.Win32.Dropper.vc Trojan:Win32/Salgorea.C!dha


In a story which reminds us of the Bangladesh Bank case – the culprits had compromised the bank's system connected to the SWIFT network and used this to perform the transfers.


A backdoor also known as: W32.Clodcaf.Trojan.0256 Worm/W32.Opanki.176640 W32.Allim W32/Funmov.a Win32.Trojan.WisdomEyes.151026.9950.9984 W32.Allim Win32/Opanki.R WORM_OPANKI.Q Backdoor.Win32.Aimbot.d Trojan.Win32.Aimbot.fujn Win32.Backdoor.Aimbot.Syse Worm.Win32.Opanki.R BackDoor.Oscar Worm.Opanki.Win32.38 WORM_OPANKI.Q BehavesLike.Win32.Sdbot.cc W32/Risk.ZUMS-8015 I-Worm/Opanki.b W32/Opanki.A1D5!worm Trojan[Backdoor]/Win32.Aimbot Backdoor.W32.Aimbot.d!c Win32/Funmov.worm.176640 Worm:Win32/Funmov.A Win32/Trykid.Y W32/Opanki.worm W32.Allim Bck/Sdbot.JED.worm Worm.Funmov!UUJQui2L6no Backdoor.Win32.Aimbot Worm/Opanki.N Backdoor.Win32.Aimbot.aLdg


During the past few weeks, we have received information about a new campaign of targeted ransomware attacks.


A backdoor also known as: W32.HfsAutoA.DAEE W32.Virut.G W32.Virut.CF Trojan.Win32.Crypt.dzf Virus.Win32.Virut.CE BehavesLike.Win32.BadFile.pt W32/Trojan.UBPC-4784 Trojan.Crypt.cm Trojan/Win32.Crypt TrojanDownloader:Win32/Dothemt.A Trojan.Win32.Crypt.dzf Trojan.Crypt W32/Sality.AO Win32/Virut.NBP Virus.Win32.Virut.ug W32/Virut.CE Virus.Win32.VirutChangeEntry.A


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9962 Trojan.Win32.Graftor.dcgcrd TrojWare.Win32.Kryptik.~NT Trojan-Downloader.Win32.Banload Trojan:Win32/BrobanAda.A TScope.Trojan.Delf


A backdoor also known as: Trojan.Win32.BadApp!O TrojanDownloader.Small.AGT4 PWS-Mmorpg.e TSPY_RUNAE.SM Infostealer.Gampass Win32/AdClicker.DZX Win.Trojan.Toopu-1 Trojan.Win32.Dwn.bxzwi Backdoor.Win32.A.Rbot.65536 TrojWare.Win32.TrojanDownloader.Nirava.~clj Trojan.DownLoader1.38650 Adware.FloodAd.Win32.2 PWS-Mmorpg.e Trojan/Win32.Unknown Win32.Troj.Undef.kcloud TrojanClicker:Win32/Runae.A Trojan/Win32.OnlineGameHack.R1804 Adware.FloodAd Win32/Adware.FloodAd.AA Trojan.Win32.Clicker.sa W32/FLOODAD.SM!tr


These have been highly active in the Middle East region and unveiled ongoing targeted attacks in multiple regions.


One of Strider's targets had also previously been infected by Regin.


A backdoor also known as: Trojan.Dyname TROJ_WOONIKY.B TROJ_WOONIKY.B W32/Trojan.TZVR-6635 TR/Kazy.196035.1 Trojan.MSIL.Krypt.2 Trj/CI.A


A backdoor also known as: W32.KowinPC.Worm Win32.Trojan.WisdomEyes.16070401.9500.9820 W32.Kaxela.A Win32/Pipown.KJ Win.Worm.Autorun-2398 Worm.Win32.AutoRun.zt Trojan.Win32.ARSleep.gcbz W32.W.AutoRun.yo!c TrojWare.Win32.Magania.~L Trojan.Popwin.651 Worm.AutoRun.Win32.11126 BehavesLike.Win32.Dropper.lc Trojan/DiskAutorun.px BDS/Exaal.45056 Worm/Win32.AutoRun Win32.Troj.OnlineGames.w.kcloud Trojan.Win32.Autorun.21043 Worm.Win32.AutoRun.zt Trojan:Win32/Malamiko.A Worm.AutoRun Trojan/Win32.lssj.2cc.rgrk


A backdoor also known as: Worm/W32.SdBoter.28496 I-Worm.SdBoter.r2 Worm.SdBoter!97XSxLq3xLE W32/Sdbot.GFWC-1787 Win32/SdBoter.J WORM_SDBOTER.J Worm.W32.SdBoter.J Net-Worm.Win32.SdBoter.j Trojan.Win32.SdBoter.oxfz W32.W.SdBoter.j!c Win32.Worm-net.Sdboter.Star Worm.Win32.SdBoter.J BackDoor.IRC.Sdbot Worm.SdBoter.Win32.7 WORM_SDBOTER.J BehavesLike.Win32.Worm.mc W32/Sdbot.DMQ WORM/NetBot.A.2 W32/KWBOT.H Worm[Net]/Win32.SdBoter Win32/IRCBot.worm.28496 Worm:Win32/Sdboter.J W32/Sdbot.XT.worm Net-Worm.Win32.SdBoter.I IRC/BackDoor.SdBot.24.AC


During our investigation we found several backdoors that the HDRoot bootkit used for infecting operating systems.


One of the top targets is the Japan Pension Service, but the list of targeted industries includes government and government agencies, local governments, public interest groups, universities, banks, financial services, energy, communication, heavy industry, chemical, automotive, electrical, news media, information services sector, health care, real estate, food, semiconductor, robotics, construction, insurance, transportation and so on.


A backdoor also known as: Email-Flooder.Win32.DaMailer!O Win32.Trojan.WisdomEyes.16070401.9500.9998 Win.Trojan.Damailer-4 Email-Flooder.Win32.DaMailer.119 TrojWare.Win32.Flooder.DarkMail Flooder.Damail Tool.DaMailer.Win32.2 BehavesLike.Win32.BadFile.th Email-Flooder.DaMailer.d Email-Flooder.Win32.DaMailer.119 Trojan/Win32.HDC.C123509 EmailFlooder.DaMailer Trj/CI.A Win32/Flooder.DarkMail Win32.Trojan.Damailer.Htwm Flooder.DaMailer!LiHdaVOdIDQ Email-Flooder.Win32.DaMailer


A backdoor also known as: Win32/Hamer.B!utility Trojan-Dropper/W32.Hamer_Packed.700928 Dropper.Hamer.Win32.41 Trojan/Dropper.Hamer.20 Trojan.DR.Hammer!WTBuq6wvib0 W32/Hamer.B@tool Backdoor.Beasty.Family Win32/TrojanDropper.Hamer.20 TROJ_HAMER.R Trojan.Downloader.Small-12 Trojan-Dropper.Win32.Hamer.20 Trojan.Win32.Hamer.dztpdb Dropper.A.Hamer.700928[h] Troj.Dropper.W32.Hamer.20!c TrojWare.Win32.TrojanDropper.Hamer.20 Trojan.DownLoader.225 Backdoor.Beasty.Family TROJ_HAMER.R BehavesLike.Win32.Dropper.jc W32/Hamer.PMZI-8206 TrojanDropper.Hammer.20 TR/Drop.Hamer.20 W32/Hamer.20!tr Trojan[Dropper]/Win32.Hamer Dropper/Hamer.700928 Backdoor.Beasty.Family TrojanDropper.Hamer Trojan.Win32.Dropper.20 Win32.Trojan-dropper.Hamer.Pkra Trojan-Dropper.Win32.Delf Dropper.Hamer.B Win32/Trojan.ece


We covered this attack in detail in our blog titled Shamoon 2: Return of the Disttrack Wiper, which targeted a single organization in Saudi Arabia and was set to wipe systems on November 17, 2016.


A backdoor also known as: Backdoor.Win32.Zombam!O Win32.Backdoor.Zombam.b W32/Zombam.BWLR-3283 Backdoor.Zombam.B Win.Trojan.Small-4082 Backdoor.Win32.Zombam.m Trojan.Win32.Zombam.mpym Backdoor.Win32.Zombam.M BackDoor.Httprat.2 Backdoor.Zombam.Win32.32 BehavesLike.Win32.Rontokbro.nc Backdoor.Win32.Zombam.m W32/Zombam.N@bd Backdoor/Zombam.m BDS/Zombam.L.1 Trojan[Backdoor]/Win32.Zombam Backdoor:Win32/Zombam.L Backdoor.Win32.Zombam.31444 Backdoor.Win32.Zombam.m Backdoor.Zombam Win32/Zombam.M Backdoor.Zombam!rqjS+1zkQfU W32/Zombam.M!tr.bdr Win32/Backdoor.009


In this case, though, running the troubleshooter leads to the installation of LatentBot, a well-documented modular bot used for surveillance, information stealing, and remote access.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9705 Trojan.Win32.SchoolBoy.bhk Troj.Banker.W32.Qadars.mtwx Win32.Trojan.Schoolboy.Hvtb Trojan.MulDrop4.3547 BehavesLike.Win32.RAHack.nc Trojan.Heur.GM.D439A5C Trojan.Win32.SchoolBoy.bhk Trojan.Win32.PSW W32/SchoolBoy.BHK!tr Trj/CI.A


Bookworm's functional code is radically different from PlugX and has a rather unique modular architecture that warranted additional analysis by Unit 42.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9973 Backdoor.Truebot Win.Trojan.Silence-6367671-0 W32/Trojan.JFGA-0175 Backdoor:Win32/Truebot.A Trj/GdSda.A


A backdoor also known as: Trojan.Win32.Antilam.gzgw Backdoor.Trojan Antilam.FE BKDR_ANTILAM.A Backdoor.Win32.Antilam.20.b Backdoor.Antilam!vJ4jD43D2/o NORMAL:Trojan.SERVER_3!27802 Backdoor.Win32.Antilam.dfer BackDoor.AntiLame.23 BKDR_ANTILAM.A BehavesLike.Win32.Backdoor.cc W32/Risk.BTKH-4955 Backdoor/Antilam.20.ao BDS/Antilam.20.C Trojan[Backdoor]/Win32.Antilam Backdoor:Win32/Antilam.20.B Trojan/Win32.Xema Backdoor.AntiLamer Win32/Antilam.20.B Backdoor.Win32.Antilam W32/Antilam.B!tr.bdr


FortiGuard Labs decided to analyze some of them, and in this report, I will discuss its evolution over the past 10 months.


A backdoor also known as: Win32.Exploit.ShellCode.a Trojan.Mdropper.C TROJ_SAMSA.H Trojan-Dropper.MSWord.1Table.ai Exploit.OleMacroPrj.CVE-2003-0347.cezzve DOC.Z.CVE-2003-0347.75864 Win32.Trojan-Dropper.1table.swy BackDoor.Mask TROJ_SAMSA.H Troj.Dropper.Msword!c Trojan-Dropper.MSWord.1Table.ai Trojan-Dropper.MSWord.1Table.ai possible-Threat.Embedded.ExeInOffice


The cyberattacks against the Ukrainian electric power industry continue.


Researchers from the IBM X-Force Incident Response and Intelligence Services IRIS team identified a missing link in the operations of a threat actor involved in recent Shamoon malware attacks against Gulf state organizations.


We recently noted the non-linear growth of ransomware variants and now a new type has emerged, dubbed MarsJoke.


It has a very low volume in this two-year period, totaling roughly 27 total samples.


A backdoor also known as: Trojan.Win32.Scar!O Trojan.Scar Win32.Trojan.WisdomEyes.16070401.9500.9982 Trojan.Win32.Scar.bwre Trojan.Win32.VB.etyztu Trojan.Win32.Z.Scar.3042496 Troj.Downloader.W32.VB.l4ji Trojan.DownLoader25.47210 Trojan.Scar.Win32.27021 BehavesLike.Win32.Autorun.vm Trojan.Heur.VB.EDB7EC Trojan.Win32.Scar.bwre Worm:Win32/Sowndegg.B Trojan/Win32.VB.C16539 Trojan.Scar Trj/CI.A Win32/VB.SNU Win32.Trojan.Scar.Pgcp Trojan.Scar!yxP8tXFqxTQ Trojan-Downloader.Win32.VB W32/VB.SNU!tr Win32/Trojan.1c6


The objective of this blog is to highlight some of the capabilities of this new RAT family and the impact seen so far.


Since mid-2014, the Kudelski Security Cyber Fusion Center has been monitoring and investigating Sphinx Moth.


Espionage and Asymmetric Operation Targeting


SWC campaign impacted global aerospace, government, and technology organizations Uses .via extension


A backdoor also known as: W32.HfsAutoB.17AD Trojan/W32.KRDDoS.950784 TROJ_DIDKR.A Win32.Trojan.WisdomEyes.16070401.9500.9770 Downloader.Castov TROJ_DIDKR.A Trojan.DownLoader9.34810 trojan.win32.miuref.c BehavesLike.Win32.Miuref.dc Trojan.Spy TR/Spy.950784.12 W32/KRDNSDDoS.A!tr TrojanDownloader:Win32/Simkor.A Win-Trojan/Ddkr.950784 Trj/CI.A Win32.Trojan.Spy.Hrpb


The Trojan named Linux.PNScan.1 can infect devices with ARM, MIPS, or PowerPC architectures.


We have investigated the malware to identify how it spreads, the techniques it uses and its impact.


A backdoor also known as: Backdoor.Win32.R2D2!O Backdoor.R2d2 Backdoor.R2D2 BKDR_R2D2.SMR Backdoor.Win32.R2D2.a Trojan.Win32.R2D2.esyktw Backdoor.Win32.R2D2.360448[UPX] Backdoor.W32.R2D2!c Backdoor.Win32.R2D2.~B1 BackDoor.RTwoDTwo.1 BKDR_R2D2.SMR BehavesLike.Win32.Fake.cc Backdoor.Win32.R2D2 Backdoor/R2D2.b TR/GruenFink.1 Backdoor.Win32.R2D2.a Backdoor:Win32/R2d2.A Trj/Bundestrojaner.A Win32/R2D2.A Win32.Backdoor.R2d2.Sudy Backdoor.R2D2!w/vENfl9bd8 W32/R2D2.A!tr.bdr Win32/Trojan.fd5


The name Carbanak comes from Carberp, a banking Trojan whose source code was leaked, and Anunak, a custom Trojan that has evolved over the years.


A backdoor also known as: W32.OverlayUPXDPM.PE W32.Lamer.FG8 PE_SILLY.T Win32.Virus.Lamer.f W32/SillyP2P.BO W32.SillyP2P Win32/Xolxo.A PE_SILLY.T Win.Worm.Delf-13898 Virus.Win32.Lamer.fg Trojan.Win32.Delf.oxkq Win32.BagarBubba.A W32.W.AutoRun.kYNN TrojWare.Win32.Pincav.AV Win32.HLLP.Bagar Worm.Delf.Win32.340 BehavesLike.Win32.Fesber.tm W32/Delf.aj W32/P2P_Worm.WULF-7526 Worm/Delf.vm Worm:Win32/Xolxo.A Virus.Win32.Lamer.fg W32/HLLP.11042 Worm.Delf Win32/Delf.NAY Virus.Win32.Lamer.fg Worm.SillyP2P!Dqe8+ZFutPA P2P-Worm.Win32.Delf.aj Virus.Win32.Viking.LG


A backdoor also known as: Trojan.Downloader.Shutit.A Trojandownloader.Shutit Trojan.Downloader.Shutit.A Downloader.Shutit.Win32.4 Troj.Downloader.W32.Shutit.10!c Trojan/Downloader.Shutit.10 Trojan.Downloader.Shutit.A Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Risk.EKPI-0804 Win32/DlShut.A TROJ_SHUTIT.10.A Win.Trojan.Revell-1 Trojan.Downloader.Shutit.A Trojan-Downloader.Win32.Shutit.10 Trojan.Downloader.Shutit.A Trojan.Win32.Shutit.vmoy Trojan.Downloader.Shutit.A Trojan.Aphex.10 TROJ_SHUTIT.10.A BehavesLike.Win32.Downloader.zt Trojan-Downloader.Win32.Aphex TrojanDownloader.Shutit.10 TR/Shutit.10.A Trojan[Downloader]/Win32.Shutit Win32.Troj.Downloader.b.kcloud TrojanDownloader:Win32/Shutit.1_0 Trojan-Downloader.Win32.Shutit.10 TrojanDownloader.Shutit Trj/Dwn.Shutit.10 Win32/TrojanDownloader.Shutit.10 Win32.Trojan-downloader.Shutit.Ahxq Trojan.DL.Small!IxJNSrLVynM


However, Bookworm expands on its capabilities through its ability to load additional modules directly from its command and control C2 server.


A backdoor also known as: Trojan.FakeMS Trojan.Win32.XPACK.bdmoql WS.Reputation.1 W32/Swisyn.CB Packed.Win32.Cryptcf.A Trojan.DownLoader7.26386 Packed.Multi.dlw Win32.Hack.Packed.f.kcloud Backdoor:Win32/Racdr.A BScope.Trojan.SvcHorse.01643 Backdoor.Win32.BlackHole W32/Multi.E!tr Trj/CI.A


A backdoor also known as: JS:Trojan.JS.Likejack.A JS.Faceliker.NC JS/Faceliker.a JS/Faceliker.A!Eldorado JS:Trojan.JS.Likejack.A JS:Trojan.JS.Likejack.A TrojWare.JS.TrojanClicker.FbLiker.A JS:Trojan.JS.Likejack.A JS/Faceliker.a JS/Faceliker.A!Eldorado JS/FBJack.I!tr JS:Trojan.JS.Likejack.A TrojanClicker:JS/Faceliker.S Trojan-Clicker.JS.Faceliker Script.Trojan.JSClicker.A trojan.js.likejack.a


The report details how many seemingly unrelated cyber attacks may, in fact, be part of a broader offensive fueled by a shared development and logistics infrastructure — a finding that suggests some targets are facing a more organized menace than they realize.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9997 HT_GM_GL290013.UVPM Trojan.Heur.Win32.10174 HT_GM_GL290013.UVPM BehavesLike.Win32.Trojan.vh Trojan.Heur.GM.D5FC4D76 Trojan/Win32.Buzus.R1005 Trojan.Win32.Tiggre


We refer to these attacks as MuddyWater due to the confusion in attributing these attacks.


A backdoor also known as: Backdoor.Bot Packed.Win32.Klone.bn TrojWare.Win32.VB.oks Win32.Hack.Klone.bn.kcloud Backdoor:Win32/Blohi.B Packed/Win32.Klone Backdoor.Win32.Blohi W32/VB.QIK!tr Trj/CI.A


Unit 42 has collected multiple spear phishing emails, weaponized document files, and payloads all targeting various offices of the Mongolian government and deployed between August 2015 and February 2016.


A backdoor also known as: Backdoor.Miancha.r5 Trojan.PR.Preshin!uX45uZVdtBM Backdoor.Readomesa Backdoor.Win32.Miancha.f Trojan.Win32.Miancha.dfftbq Trojan.Starter.3690 Backdoor.Miancha.Win32.5 Backdoor/Miancha.c TR/Cudofows.A.1 W32/Miancha.F!tr.bdr Trojan[Backdoor]/Win32.Miancha Trojan.Inject.28 Trojan:Win32/Cudofows.A Backdoor.Miancha Trj/CI.A Backdoor.Win32.Miancha Proxy.BEPF Win32/Trojan.b2e


Recently, we came across an email exploit attempt, aimed at a European Point of Sales POS vendor.


The Bergard Trojan and the C0d0so group that made it famous with the November 2014 watering hole attack via Forbes.com have received renewed attention recently, with other researchers potentially linking emerging tools and recent attacks to the group.


A backdoor also known as: Trojan-PWS/W32.Mist.111104 Troj.PSW32.W.Mist.a!c Win32.Trojan.WisdomEyes.16070401.9500.9977 Trojan-PSW.Win32.Mist.a Trojan.Win32.Mist.dboecq Trojan.DownLoad3.33938 Trojan-PSW.Win32.Mist W32.Malware.Heur PWS:Win32/Steam.J Trojan-PSW.Win32.Mist.a TrojanPSW.Mist Win32.Trojan-qqpass.Qqrob.Ajli Trojan.PWS.Mist! W32/Mist.A!tr.pws Win32/Trojan.PSW.db7


Recently, Palo Alto Networks Unit 42 reported on a new exploitation platform that we called DealersChoice in use by the Sofacy group AKA APT28, Fancy Bear, STRONTIUM, Pawn Storm, Sednit.


A backdoor also known as: Trojan.Collti Adware.ShandaAdd!DlXR6+5TT0o WS.Reputation.1 TR/Collti.A.24 Heuristic.BehavesLike.Win32.ModifiedUPX.C Trojan:Win32/Collti.A Trojan.Win32.Collti Trj/CI.A


TrendMicro recently came across a variant of the BIFROSE malware that has been rewritten for UNIX and UNIX-like systems.


A backdoor also known as: Banker/W32.Banbra.186368 Trojan/ProxyChanger.g Win32.Trojan.WisdomEyes.16070401.9500.9844 Trojan-Banker.Win32.Banbra.tnul Win32.Trojan-banker.Banbra.Wtxw Trojan-Downloader.Win32.Murlo W32/Trojan.IUVC-7922 TR/StealthProxy.B.11 Trojan[Downloader]/Win32.Banload Win32.Troj.Undef.kcloud Trojan-Banker.Win32.Banbra.tnul Trojan:Win32/StealthProxy.B Trojan/Win32.Scar.R17882 Trojan.ProxyChanger!31A84p0+A4o W32/ProxyChanger.NM!tr Trj/CI.A Win32/Trojan.Proxy.d23


A backdoor also known as: Backdoor.Win32.Aebot!O Backdoor.GTbot.Win32.124 Trojan/Aebot.k Win32.Backdoor.Aebot.f Win.Trojan.Sdbot-2505 Backdoor.Aebot Backdoor.Win32.GTbot.c Trojan.Win32.GTbot.craqxn TrojWare.Win32.Aebot.EF BackDoor.IRC.Sdbot.based BehavesLike.Win32.Ipamor.gz Backdoor/GTbot.bj Backdoor.Win32.GTbot.c Win32/Aebot.K Backdoor.Aebot!dwOGgEtXe1I Backdoor.Win32.Aebot.K W32/Aebot.K!tr


Derkziel info stealer Steam, Opera, Yandex, ...


What are Google authorization tokens ? A Google authorization token is a way to access the Google account and the related services of a user .


A backdoor also known as: Trojan.Mdropper TROJ_ARTIEF.CR Exploit.MSWord.CVE-2010-3333.ci Exploit.Rtf.CVE-2010-3333.hzts Exploit.Rtf.based TROJ_ARTIEF.CR TrojanDropper.RTF.b NORMAL:Hack.Exploit.Script.CVE-2010-3333.a!1609827 Data/CVE20103333.A!exploit Luhe.Exploit.RTF.CVE-2010-3333.A


In December 2015, several researchers reported that websites hosting the Rig Exploit Kit were serving an updated version of Qbot.3 4 5 Then in January 2016, over 500 devices at a large public organisation wereinfected with Qbot.


A backdoor also known as: W32.SpamlesEI1.Trojan Rootkit.KillAv.B Trojan/W32.Rootkit.3712.K Trojan.Kapa.A Rootkit.W32.Small.to6t Trojan/AutoRun.AntiAV.r Rootkit.KillAv.B RTKT_SMALL.SMB Hacktool.Rootkit Win32/SillyAutorun.DCA RTKT_SMALL.SMB Rootkit.KillAv.B Rootkit.Win32.Small.sfn Rootkit.KillAv.B Trojan.Win32.NtRootKit.chvyyx Rootkit.KillAv.B TrojWare.Win32.Rootkit.Small.AA Trojan.NtRootKit.10455 Trojan:Winnt/Kapa.A Trojan:WinNT/Kapa.A Rootkit.Win32.Small.sfn Backdoor/Win32.Rootkit.R1193 Rootkit.KillAv.B Trojan.Win32.KillAV.af Worm.Orbina!Ypp8YqYGicY Trojan.WinNT.Kapa RootKit.Win32.KillAV.B


A backdoor also known as: W32.eHeur.Malware03 Trojanspy.Banker.16710 Win32/Tnega.EcVXcGD Trojan.Win32.Small.csf Troj.W32.Small.mfSA Trojan.Starter.3499 Trojan.Small.Win32.24377 Trojan/Small.paq TR/Rogue.30781 Trojan/Win32.Small Trojan:Win32/Meicater.A!bit Trojan.Strictor.D240AB Trojan.Win32.Small.csf Trojan.Small Trojan.Small!+nCz0Wnah68 Trojan.Win32.Small


A backdoor also known as: Trojan.Win32.Mahato!O Backdoor.Bifrose.F8 Trojan/Mahato.caj Win32.Trojan.WisdomEyes.16070401.9500.9964 TROJ_CALYPS.SMUJ Win.Trojan.Mahato-1 Trojan.Win32.Mahato.caj Trojan.Win32.Mahato.ijlmo Trojan.Win32.Scar.118272[UPX] TrojWare.Win32.Mahato.A BehavesLike.Win32.Sytro.cc Trojan/Mahato.ob W32.Backdoor.Apocalypse Trojan/Win32.Mahato Win32.Troj.Scar.15.kcloud Trojan.Zusy.DAAC W32.W.AutoRun.lkXC Trojan.Win32.Mahato.caj Trojan:Win32/Lypsacop.A Trojan/Win32.Mahato.R2854 Backdoor.Bifrose Virus.Win32.Delf Trojan.Mahato


A backdoor also known as: W32.eHeur.Malware10 Trojan.Mauvaise.SL1 TROJ_NITOL.SMD Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/Trojan2.PAML TROJ_NITOL.SMD Win32.Trojan-DDoS.Yoddos.A Trojan-Dropper.Win32.Dinwod.wkn Trojan.Win32.Staser.demkhd Troj.Dropper.W32.Dinwod.toj0 TrojWare.Win32.Nitol.KA DDoS.Attack.384 Trojan.Staser.Win32.2253 BehavesLike.Win32.Downloader.nm Trojan.Win32.Yoddos W32/Trojan.QEFN-2077 Trojan/Staser.le TR/Dropper.cgytn Trojan-Dropper.Win32.Dinwod.wkn Trojan:Win32/Wepiall.A Backdoor/Win32.Farfli.R119148 Trojan.Staser Trj/CI.A Win32/Yoddos.BW Trojan.Win32.Staser.anbya W32/Yoddos.BW!tr


A backdoor also known as: VB:Trojan.Valyria.1167 O97M.Downloader.4967 VB:Trojan.Valyria.1167 VB:Trojan.Valyria.1167 Trojan.Ole2.Vbs-heuristic.druvzi VB:Trojan.Valyria.1167 VB:Trojan.Valyria.1167 HEUR.VBA.Trojan.e W97M.Downloader.GOX virus.office.qexvmc.1085


A backdoor targetting Linux also known as: Backdoor.Linux.Tsunami.A Linux.Backdoor.Kaiten ELF_KAITEN.SM HEUR:Backdoor.Linux.Tsunami.bh Trojan.Tsunami.exnldy Backdoor.Linux.Tsunami!c Linux.BackDoor.Tsunami.761 ELF_KAITEN.SM ELF/Backdoor.EWHJ- Backdoor.Linux.aego LINUX/Tsunami.bkdwv Trojan[Backdoor]/Linux.Tsunami.bh Trojan.Backdoor.Linux.Tsunami.1 HEUR:Backdoor.Linux.Tsunami.bh Backdoor.Linux.Tsunami.b Trojan.Linux.Tsunami ELF/Tsunami.NBV!tr Win32/Trojan.fba


Recently we detected a more sophisticated technique that a handful of countries across Asia are actively using to infect systems with RATs. This new technique ensures that the payload/file remains in memory through its execution, never touching the disk in a de-encrypted state.


A backdoor also known as: Trojan.Win32.Cossta!O Trojan.Cossta Trojan.Win32.Cossta.vjk Trojan.Win32.Drop.dxlfgu Trojan.Win32.Cossta.49152 Trojan.KillFiles.18641 Trojan/Cossta.ett Trojan/Win32.Cossta Worm:Win32/Vobirue.A W32.W.AutoRun.l6mI Trojan.Win32.Cossta.vjk HEUR/Fakon.mwf Win32/VB.OPD


With this latest report, we have now identified at least 21 cases in Mexico of abusive, improper targeting with NSO Group's Pegasus spyware


A backdoor also known as: Trojan.FakeAlert.TK Rootkit.Win32.Clbd!O Trojan/Clbd.dt Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.FakeAlert.TK Trojan.FakeAlert.TK Trojan.Win32.Clbd.oyzd Trojan.Win32.Z.Clbd.68100 Trojan.FakeAlert.TK Trojan.FakeAlert.TK Rootkit.Clbd.Win32.6 BehavesLike.Win32.VirRansom.kc Trojan.Win32.Waledac Rootkit.Clbd.av Trojan.FakeAlert.TK TrojanDropper:Win32/Pasich.A Trojan/Win32.Bredlab.R17 Trojan.FakeAlert.TK MalwareScope.Worm.Nuwar-Glowa.1 Rootkit.Clbd!+/k5iv7h7q8 Win32/Trojan.df3


A backdoor also known as: Trojan.Veil.5 W32/Trojan.UYPJ-5875 Ruby/Rozena.H Trojan.Win32.Ruby.emhncx Trojan.SkypeSpam.11018 TR/AD.Rozena.uidpc Trojan.Win32.Z.Veil.654486.A Trojan.SkypeSpam! Trojan.Ruby.Rozena Win32/Trojan.34d


Apart from infecting systems with it, we also spotted instances where common lateral movement tools were detected around the same time they were actively compromising the endpoint with MajikPOS.


The malicious code only makes for a small part of the app, making it difficult to detect.


A backdoor also known as: Android.Trojan.FakeInst.BD Android.Opfake.E Android.Trojan.FakeInst.BD AndroidOS/Opfake.AR ANDROIDOS_SMSUPDATE.C Andr.Trojan.Opfake-4 Android.Trojan.FakeInst.BD HEUR:Trojan-SMS.AndroidOS.Opfake.a A.H.Pay.ApuAte Trojan.Android.Opfake.emekxt Trojan:Android/Fakeinst.CG Android.SmsSend.2293 ANDROIDOS_SMSUPDATE.C AndroidOS/Opfake.AR Trojan/AndroidOS.r Trojan[SMS]/Android.Opfake Android.Troj.Opfake.b.kcloud Android.Trojan.FakeInst.BD HEUR:Trojan-SMS.AndroidOS.Opfake.a Android-Trojan/FakeInst.1b13 Trojan.AndroidOS.Opfake.A Trojan.Android.FakeInstall.p Trojan-SMS.AndroidOS.Opfake


They only compromise specific high-value targets and once inside the company networks, move laterally to hosts that can be monetized.


We've recently discussed Corebot malware and its possible ties to btcshop.cc, a site selling stolen data.


The Makop ransomware gang is still using the same tools used in their first operations in 2020, according to a recent investigation by Lifars security team, which has identified four of the gang's tools.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9531 Win.Trojan.AutoIT-6333854-0 AutoIt/injector.E AutoIt/injector.E Win32/Injector.Autoit.DFJ Trojan.Win32.Injector


This file contained embedded macro code that executed a commonly observed PowerShell command to download and execute a file.


MONSOON is the name given to the Forcepoint Security Labs


Myanmar is a country currently engaged in an important political process.


The attackers involved in these email campaigns leveraged a variety of distribution mechanisms to deliver the information stealing FormBook malware, including:


CryptoWall is a type of malware known as ransomware, which encrypts a victim's files and subsequently demands payment in exchange for the decryption key.


A backdoor also known as: Exploit.Win32.MS04-028!O Trojan.Diztakun W32.W.Ridnu.ls5O Trojan/Exploit.MS04-028.g Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/HideinPic.A Win.Trojan.Ag-1 Trojan.Win32.Diztakun.xnd Exploit.Win32.MS04028.lhyh Trojan.MulDrop3.32325 Exploit.MS04.Win32.105 BehavesLike.Win32.Vilsel.qc Trojan-Banker.Win32.Bancos Exploit.MS04-028.h Trojan[Exploit]/Win32.MS04-028 Trojan:Win32/Greener.A Trojan.Win32.Diztakun.xnd Trojan/Win32.Xema.C6210 Exploit.MS04028 Trojan.Heur.dmHfrf5Ccil Win32/Greener.A Win32.Virus.Greener.Pdct Worm.Kilada.A W32/Greener.A!tr Win32/Trojan.cae


In fact, this concept is nothing novel – we already saw many ransomware families that can do the same.


This malware has the capability to overwrite a victim host's master boot record MBR and all data files.


A backdoor also known as: Trojan.Barys.DD90F Trojan:Win32/Rozena.D!bit Trojan.PowerShell.Rozena


Pro PoS is simple-to-use PoS malware that is available for purchase, enabling multiple threat actors to easily take advantage of this malware to target businesses.


For many years, one of the go-to families of malware used by both less-skilled and advanced actors has been the Poison Ivy aka PIVY RAT.


Following discovery, we alerted our customers and began working with Microsoft through the responsible disclosure process.


On July 8, 2015, Unit 42 used the AutoFocus Threat Intelligence service to locate and investigate activity consistent with a spear-phishing attack targeting the US Government.


A backdoor also known as: Banker/W32.Alreay.639100 TrojanSpy.Banker.SW4 Trojan.Banswift Win.Trojan.BBSwift-4 Trojan-Banker.Win32.Alreay.b Trojan.Win32.Alreay.eigudw Win32.Trojan-banker.Alreay.Edxl Trojan.Swifter.1 Trojan.Banker.Alreay.f W32/Alreay.ADAQ!tr Troj.Banker.W32!c Trojan-Banker.Win32.Alreay.b Trojan:Win32/Tokser.A Trojan/Win32.Alreay.C1768016 Spyware.Banker.Alreay TrojanBanker.Alreay Win32/Spy.Banker.ADAQ Trj/GdSda.A Win32/Trojan.c8b


A backdoor also known as: Infostealer.Gampass Trojan.DownLoad1.59715 Trojan-Downloader.Win32.Adload!IK Trojan/Win32.Adload Trojan-Spy.Win32.Filka.ld Trojan-PSW.Gampass Trojan-Downloader.Win32.Adload Trj/Lineage.BZE


A backdoor also known as: Trojan/Clicker.BHO.ncs Win32.Trojan.WisdomEyes.16070401.9500.9639 Win32/TrojanClicker.BHO.NCS Win32.Trojan.Spnr.Pfjg TrojWare.Win32.TrojanClicker.BHO.NCS Dropper.BHO.Win32.500 TrojanDropper.BHO.pj TR/Rogue.kdv.655157 Trojan[Dropper]/Win32.BHO Trojan.Zusy.Elzob.D1C26 TrojanDropper:Win32/Hufysk.A Dropper/Win32.BHO.R25331 TrojanDropper.BHO Trojan-Dropper.Win32.Hufysk W32/TrojanClicker_BHO.NCS Trj/CI.A Win32/Trojan.a73


A backdoor also known as: Trojan.Downloader.Msil.H Trojan-Downloader.Win32.FraudLoad!O Win32/SillyDl.YBL Win.Downloader.134626-1 Trojan.Downloader.Msil.H Trojan-Downloader.Win32.FraudLoad.iei Trojan.Downloader.Msil.H Trojan.Win32.A.Downloader.229376.FL Trojan.Downloader.Msil.H Win32.HLLW.Myscan.1 BehavesLike.Win32.BadFile.pm Trojan[Downloader]/Win32.FraudLoad TrojanDownloader:Win32/Hesto.A Trojan-Downloader.Win32.FraudLoad.iei Trojan.Downloader.Msil.H TrojanDownloader.FraudLoad Trojan.Downloader.Msil.H


A backdoor also known as: Packed.Win32.TDSS!O Win32.Trojan.WisdomEyes.16070401.9500.9885 Trojan.Win32.Drop.dajhso Trojan.MulDrop5.32960 Trojan/PSW.LdPinch.adoe Backdoor:Win32/Nosrawec.A Trojan.Delf.279 Backdoor.W32.Beastdoor.l7a6 Trojan/Win32.Nosrawec.R198886 RiskWare.Tool.CK


A backdoor also known as: W32.SasfisQKC.Fam.Trojan Trojan/W32.PornoBlocker.60928.F TrojanDropper.Bamital.I3 Trojan/PornoBlocker.hhu TROJ_BAMITAL.SM2 Win32.Trojan.Kryptik.ct TROJ_BAMITAL.SM2 Win.Trojan.Ransom-740 Trojan-Ransom.Win32.PornoBlocker.hts Trojan.Win32.PornoBlocker.bwvwe Trojan.Hottrend Trojan.PornoBlocker.Win32.1248 Trojan/PornoBlocker.axt TR/Qhost.60928 Trojan[Ransom]/Win32.PornoBlocker Trojan.VIZ.1 Trojan:Win32/Bamital.I Trojan.SB.01742 Bck/Qbot.AO Win32/Bamital.FA Win32.Trojan.Pornoblocker.Lkxy Trojan.PornoBlocker!v14Do0CXdgA Win32/Trojan.3c3


ATM malware is not new, back in 2013 and 2014 threats like Ploutus or PadPin Tyupkin were used to empty ATMs in Mexico, Russia and other countries, but SUCEFUL offers a new twist by targeting the cardholders.


As an active threat under development, we decided to take a closer look at this RAT to understand some of its inner workings and capabilities.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9980 Trojan.Win32.Zusy.rjrdd TrojWare.Win32.TrojanDownloader.Murlo.~JH2 Trojan.Sasfis.Win32.30609 Trojan/Sasfis.xqr TR/Zusy.3171.28 Trojan/Win32.Sasfis Trojan.Zusy.DC63 Backdoor:Win32/Usinec.A Trojan/Win32.Sasfis.C97816 Trojan.Sasfis Trojan.Sasfis!LKZhl2Eyglg Trojan.Win32.Sasfis


Although state-sponsored attacks against the United States by Chinese threat actors have decreased dramatically since the signing of the US-China Cyber Agreement in 2016, Proofpoint researchers have continued to observe advanced persistent threat APT activity associated with Chinese actors targeting other regions.


Over the past year or so, we have seen numerous techniques and tactics employed by this campaign, such as the use of an iOS espionage app, and the inclusion of new targets like the White House.


Cknife is a Chinese cross-platform compatible Java web shell framework — that operates more like a RAT for web servers — based on China Chopper.


A backdoor also known as: Trojan/W32.Menti.184320.T Trojan.Graftor.D557F Win32.Trojan.Farfli.ai Trojan.DownLoader6.3217 BehavesLike.Win32.BadFile.cm Trojan.Win32.MMM Trojan/Win32.Menti PWS:Win32/Quopax.A!dll Trojan.Win32.A.Menti.184320.YN BScope.Trojan.SvcHorse.01643 Backdoor.Win32.Gh0st.EB


For the entry point, this Locky variant uses spam emails with .ZIP file attachments that contain WSF files.


In late August, WildFire Locker disappeared after the organizations behind NoMoreRansom.org were able to seize control of the ransomware s Command Control servers.


A backdoor also known as: Trojanspy.Smetsb.FC.4036 Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.MSIL.Krypt.4 Trojan/Win32.ZBot.R155926 Trojan.InfoStealer.KL


This version masquerades as CryptoWall.


Tick's most recent attacks have concentrated on the technology, aquatic engineering, and broadcasting sectors in Japan.


A backdoor also known as: Backdoor.OnionDuke W32/Trojan3.XZO Trojan.Cozer.B BKDR_COZER.LP Backdoor.Win32.MiniDuke.cb Trojan.Win32.AD.ekdqnf Win32.Backdoor.Miniduke.Lplm BackDoor.CozyDuke.49 BehavesLike.Win32.RansomwareLocky.gh W32/Trojan.QFCN-8527 Backdoor.MiniDuke.av TR/AD.OnionDuke.trltr Backdoor.Win32.MiniDuke.cb Backdoor.MiniDuke


FIN4 is a financially motivated threat actor which has consistently targeted this population.


The newly discovered campaign targets the Indian Ministry of Defense using malicious documents as lures


A backdoor also known as: Worm.Recyl Trojan.Injector.Win32.557110 Worm.Win32.Recyl.afr BehavesLike.Win32.Dropper.rc Worm.Recyl.v TrojanDropper:Win32/Injector.D Worm.Win32.Recyl.afr Worm/Win32.Recyl.R213857 MalwareScope.Trojan-PSW.Game.16 Worm.Recyl!


A backdoor also known as: Trojan.Uztuby.11 Trojan.Uztuby.11 Trojan.Uztuby.11 Trojan.Uztuby.11 Trojan.Win32.Delphi.elmrxd Trojan.Uztuby.11 Trojan.Uztuby.11 backdoor.win32.fynloski.a Backdoor/Win32.fynloski.pwi Trojan.GUSX-6 TR/AD.AVKiller.reish Win32/Remtasu.AI Backdoor.NanoBot! Trojan.Win32.Remtasu Trj/CI.A


A backdoor also known as: Trojan.Win32.Small!O Hacktool.Hashenfill Trojan.Small.Win32.19365 Trojan.Win32.Small.cpa Trojan.Win32.Small.cwxrxw Troj.W32.Small.cpa!c Trojan.Hooker.21682 BehavesLike.Win32.FakeAlert.xh Trojan/Small.ouz HackTool:Win32/Hashenfill.A Trojan.Win32.Small.cpa Trojan/Win32.Connapts.C256359 Trojan.Small Win32.Trojan.Small.Dxcs Trojan.Small!tZ/zbi7RotE Win32/Trojan.d54


It appears the entity behind this campaign took steps to make reverse engineering more difficult and chose the use of Cisco's AnyConnect Client as a lure to trick victims into installing the malware.


A new stealer with keylogging and clipper capabilities is making the rounds on cybercrime forums, according to research by Uptycs threat research team and Shilpesh Trivedi and Tejaswini Sandapolla.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9828 Trojan.Win32.Fsysna.csibjc Trojan.DownLoader9.58423 BehavesLike.Win32.BadFile.mh Trojan/Fsysna.anj TR/Terzib.wrdas Trojan:Win32/Terzib.A Worm/Win32.Stration.R523 Trj/GdSda.A


El Machete is one of these threats that was first publicly disclosed and named by Kaspersky.


A backdoor also known as: W32.Lamer.K8 Trojan.Kryptik.Win32.801927 Trojan/Delf.nlr Win32.Trojan.WisdomEyes.16070401.9500.9998 WORM_GATE_GE2300D6.UVPA Win.Trojan.Fileinfector-76 Trojan.Win32.Delphi.danila Worm.Win32.Delf.DA WORM_GATE_GE2300D6.UVPA BehavesLike.Win32.Gate.tc W32.Infector Worm/Win32.Unknown Worm:Win32/Gate.A W32.Lamer.lwJ1 Spyware/Win32.Delf.C43787 W32/Gate.worm Trojan.Cosmu Win32/Delf.NLR Worm.Delf!2LR1nmaG85k Trojan-PWS.Win32.Delf


On May 12, at the onset of the WannaCry attack, Cyphort Labs researchers have seen a similar SMB attack to one of our honeypot servers.


A backdoor also known as: Win32.Mramak.A W32.Mkar.A4 Win32.Mramak.A Win32.Mramak.A Win32.Trojan.WisdomEyes.16070401.9500.9981 W32/Mkar.PJKY-3509 W32.Marak Win.Trojan.Mkar-3 Win32.Mramak.A Virus.Win32.Mkar.b Win32.Mramak.A Virus.Win32.Packed.deljve Win32.Mrak.A Win32.Mramak.A Win32.HLLP.Mrak.10 BehavesLike.Win32.Dropper.mc W32/Mkar.L W32/Mkar.b.Dropper Worm:Win32/Mkar.B Virus.Win32.Mkar.b Malware/Win32.Mkar.C408081 Win32/Mkar.B Win32.Virus.Mkar.Agle


The attack has been active for more than a year and is ongoing elsewhere, but this particular infection pathway was shut down when the site operator and ad network were notified of the activity.


A backdoor also known as: JS:Trojan.JS.Downloader.HZQ Trojan.JS.Downloader.2455.A JS/Nemucod.tm JS/Downldr.HX2!Eldorado JS.Downloader JS/TrojanDownloader.Nemucod.DFV JS_NEMUCOD.ELDSAUHG JS:Trojan.JS.Downloader.HZQ JS:Trojan.JS.Downloader.HZQ Trojan.Script.Heuristic-js.iacgm JS.S.Downloader.1658 JS:Trojan.JS.Downloader.HZQ JS:Trojan.JS.Downloader.HZQ Trojan.DownLoader25.3813 JS_NEMUCOD.ELDSAUHG JS/Nemucod.tm JS/Downldr.HX2!Eldorado Trojan[Downloader]/JS.Nemucod.dfv JS:Trojan.JS.Downloader.HZQ JS/Obfus.S237 Trojan-Dowloader.JS.Nemucod JS/Nemucod.DFV!tr.dldr Win32/Trojan.Downloader.50a


MITRE TAGS Action Tag ID App auto-start at device boot T1402 Input prompt T1411 Capture SMS messages T1412 Application discovery T1418 Capture audio T1429 Location tracking T1430 Access contact list T1432 Access call log T1433 Commonly used port T1436 Standard application layer protocol T1437 Masquerage as legitimate application T1444 Suppress application icon T1508 Capture camera T1512 Screen capture T1513 Foreground persistence T1541 DualToy : New Windows Trojan Sideloads Risky Apps to Android and iOS Devices By Claud Xiao September 13 , 2016 at 5:00 AM Over the past two years , we ’ ve observed many cases of Microsoft Windows and Apple iOS malware designed to attack mobile devices .


A backdoor also known as: Trojan.MSILInject.A4 TROJ_NECURS.SMJ6 Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan Win32/Inject.fcAMLbC TROJ_NECURS.SMJ6 Trojan.MSIL.Inject.aqjr Trojan.Win32.Inject.ddhqep Troj.Dropper.W32.Injector.m7mC TrojWare.Win32.Zusy.XYN Trojan.Inject1.44093 Trojan.Win32.Inject TR/Zusy.xynynabm Trojan/Win32.Inject Trojan.Zusy.D1889E Trojan.MSIL.Inject.aqjr Trojan:MSIL/Injector.P Dropper/Win32.Necurs.R121870 Trojan.Inject Trojan.Injector Trojan.Injector!AbCu/r2al/E MSIL/Injector.ERR!tr Win32/Trojan.304


This targeting is also consistent with previous attacker TTPs; Ke3chang historically targeted the Ministry of Affairs, and also conducted several prior campaigns against India.


A backdoor also known as: Trojan.Pws.Gadu.L Trojan-PSW.Win32.Gadu!O TrojanPWS.Gadu Trojan/PSW.Gadu.l W32/PWStealer.FCG Backdoor.Trojan Win.Spyware.8306-2 Trojan.Pws.Gadu.L Trojan-PSW.Win32.Gadu.l Trojan.Pws.Gadu.L Trojan.Win32.Gadu.wwgc Trojan.Win32.PSWGadu.197820 Troj.Psw.W32!c Trojan.Pws.Gadu.L Trojan.PWS.Gadu Trojan.Gadu.Win32.1 BehavesLike.Win32.Trojan.cc W32/PWS.FWUF-5609 Trojan/PSW.Gadu.a Trojan[PSW]/Win32.Gadu Win32.PSWTroj.Gadu.g.kcloud Trojan.Pws.Gadu.L Trojan-PSW.Win32.Gadu.l PWS:Win32/Gadu.H Trojan/Win32.Xema.C89273 TrojanPSW.Gadu Trojan.Pws.Gadu.L Trojan.Pws.Gadu.L Bck/Gadu.Q Win32/PSW.Delf.OQP Win32.Trojan-qqpass.Qqrob.Wxrk Trojan.PWS.Gadu!8+g7gjB8P1Q Trojan-PWS.Win32.Gadu W32/Gadu.L!tr.pws Win32/Trojan.3ea


A backdoor also known as: MSIL/Filecoder.EO Trojan-Ransom.FileCoder MSIL/Filecoder.EO!tr Trojan.Ransom.MSIL.1 Trojan.Ransom.SureRansom MSIL.Trojan-Ransom.SureRansom.A Win32/Trojan.Ransom.935


A backdoor also known as: Backdoor.Win32.Hupigon!O Win32.Trojan.WisdomEyes.16070401.9500.9960 Trojan.Malcol Win32/Tnega.bcLXSH Trojan.Win32.Slym.cufsch Troj.Rogue.lC4c Backdoor.Win32.Hupigon.rgqw Trojan.DownLoader11.11699 BehavesLike.Win32.Backdoor.vh TR/Rogue.kdv.679349 Packed.Win32.MalPackedSN Win32.Application.PUPStudio.A Unwanted/Win32.HackTool.R40115 Spyware.OnlineGames


A backdoor also known as: W32.FamVT.ShizNHm.Trojan Ransom.TeslaCrypt.WR4 Trojan/Spy.Shiz.nct Ransom_HPLOCKY.SM1 Win32.Trojan.WisdomEyes.16070401.9500.9998 Ransom_HPLOCKY.SM1 Win.Trojan.Blocker-380 Trojan.Win32.Shifu.jt Trojan.Win32.Blocker.dxvhyb Packer.W32.Tpyn.toCt Trojan.DownLoader17.27888 Trojan.Blocker.Win32.32151 BehavesLike.Win32.Ransomware.hz Trojan.Win32.Pariham Trojan.Blocker.iv TR/Crypt.Xpack.whza Trojan[Ransom]/Win32.Blocker Ransom.Locky/Variant Trojan.Win32.Shifu.jt Trojan:Win32/Pariham.A Hoax.Blocker Trojan.Shifu Win32/Spy.Shiz.NCT Win32.Trojan.Shifu.Eehh Trojan.Blocker!epDzUGNGGeo W32/Kryptik.EFAD!tr Win32/Trojan.ff4


A backdoor also known as: Trojan.Rackcrypt Trojan.Graftor.D5D262 Ransom_Rackcrypt.R002C0DKE17 Trojan.Win32.Z.Graftor.1886447 Ransom_Rackcrypt.R002C0DKE17 BehavesLike.Win32.FakeAlertSecurityTool.tc Virus.Win32.Vundo Trojan[Spy]/Win32.KeyLogger.dwl Ransom:Win32/Rackcrypt.A Trj/CI.A Win32.Trojan.Dropper.Wsjz


JS/Nemucod usually arrives on an infected machine through malicious spam emails with .zip extensions.


Although it claims to be using asymmetric RSA-2048 to encrypt files, it is making use of symmetric AES instead.


The malware performs malicious activities such as reading login credentials, accessing files, keylogging, remote desktop control, and remote control of compromised machines.


A backdoor also known as: W32.Clod14e.Trojan.9d88 Irc.Worm.Golember.V Worm/W32.Golember.34816 I-Worm.Golember.v.n3 Worm.Golember.Win32.8 Trojan/Golember.v Worm.Golember!SM/OEFSeEEs W32/Golember.P IRC-Worm.Win32.Golember.v Irc.Worm.Golember.V Trojan.Win32.Golember.furx Irc.Worm.Golember.V Worm.Win32.Golember.V Irc.Worm.Golember.V BehavesLike.Win32.Dropper.nc W32/Golember.YQQU-9034 I-Worm/Golember.e Worm/Irc.Golember.V Worm[IRC]/Win32.Golember Worm.Golember.v.kcloud Worm:Win32/Flip.A Irc.Worm.Golember.V Win32/Golember.worm.34816 IRCWorm.Golember Win32/Golember.V Win32.Worm-irc.Golember.Aojg IRC/ROSYA.V!worm IRC-Worm/Golember.O Worm.Win32.Golember.AxNU


A backdoor also known as: HEUR_PDF.D2 PDF/Trojan.SHCJ-8 possible-Threat.PDF.Acmd


A backdoor also known as: Worm/W32.Mintal.309248 W32/Mintal.003 Trojan.Win32.Mintal.hgbj W32.Mintal.Worm Win32/Howeem.A Email-Worm.Win32.Mintal.003 I-Worm.Mintal!SHAyifSwe/s I-Worm.Win32.A.Mintal.309248[h] Worm.Win32.Howeem.A Win32.HLLM.Hwm.3 Worm.Mintal.Win32.1 W32/Howeem.worm W32/Risk.CCZK-5590 I-Worm/Mintal.003 WORM/Mintal.003.A Worm[Email]/Win32.Mintal W32.W.Mintal.003!c Win32/Mintal.worm.309248 Worm:Win32/Mintal.A@mm W32/Howeem.worm Worm.Mintal Worm.Win32.Mintal.Ao Win32.Worm-email.Mintal.Hxqd


A backdoor also known as: Backdoor.Lizarbot.FC.2716 Backdoor.IRCBot BKDR_LIZARBOT.SMVJ18 Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Trojan.QJOG-5659 Backdoor.IRC.Bot BKDR_LIZARBOT.SMVJ18 Win.Trojan.Lizarbot-1 MSIL.Trojan.IRCBot.I Trojan.DownLoader24.64862 Trojan.Zusy.D3A924 Backdoor:MSIL/Lizarbot.A Trojan/Win32.Bladabindi.C230655 Trj/CI.A Trojan.MSIL.IRCBot Win32/Trojan.158


A backdoor also known as: W32.HfsAutoB.FA61 Trojan.Zonidel Win32.Trojan.WisdomEyes.16070401.9500.9990 Backdoor.Trojan Win32/TrojanDownloader.Wauchos.CY BKDR_ANDROM.YYSMQH Trojan.Win32.Zonidel.bko Trojan.Win32.Wauchos.eujxed Win32.Trojan.Zonidel.Agux Trojan.DownLoader25.48331 BehavesLike.Win32.Backdoor.fm W32/Trojan.EGNB-8448 Malicious_Behavior.SB Trojan/Win32.Zonidel Trojan.Win32.Zonidel.bko Trojan:Win32/Koneqzu.A Trojan/Win32.Zonidel.C2210520 Trojan.PasswordStealer Trj/CI.A


Bart has a payment screen like Locky but encrypts files without first connecting to a command and control C C server.


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G Virus.Virut.Win32.27 Win32.Trojan.WisdomEyes.16070401.9500.9997 W32.Virut.CF Win32/Virut.17408 PE_VIRUX.A Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg PE_VIRUX.A BehavesLike.Win32.AdwareYTBlock.mh Trojan-Downloader.Win32.Dldwp Win32/Virut.bn Virus/Win32.Virut.ce Win32.Virut.nf.53248 Virus.Win32.Virut.ce Win32/Virut.F Virus.Virut.06 Win32.Virut.E Virus.Win32.Virut.tt W32/Virut.CE W32/Sality.AO Virus.Win32.VirutChangeEntry.A


A backdoor also known as: W32/Risk.VHAX-4717 Backdoor.NetBus.svr Win.Trojan.NBSpy-2 Backdoor.Win32.NBSpy.b Trojan.Win32.Inject.cwlwfo Backdoor.W32.NBSpy.b!c BackDoor.NetBus Backdoor.Win32.Netbus BDS/Netbus.20.F Trojan[Backdoor]/Win32.NBSpy Backdoor:Win32/Netbus.C Backdoor.Win32.NBSpy.b TrojanDropper.Injector Trj/CI.A Win32/Netbus.20.C W32/Netbus.20C!tr Win32/Backdoor.55f


While there have been several Suckfly campaigns that infected organizations with the group's custom malware Backdoor.Nidiran, the Indian targets show a greater amount of post-infection activity than targets in other regions.


EITest: HoeflerText Popups Targeting Google Chrome Users Now Push RAT Malware


A backdoor also known as: Backdoor/ZAccess.zmv Win.Trojan.Autoit-452 Trojan.Win32.Inject.eyew Trojan.Packed.23726 Trojan.Win32.Inject.eyew Win32/Injector.Autoit.DG W32/Autoit.DG!tr


Happy belated birthday to RIG exploit kit! First seen around April 2014, RIG has been in the news several times over the past year.


As recorded in several other Ursnif campaigns reported since April 2017, this Word document contains several obfuscated VBS files which load malicious DLLs through WMI.


A backdoor also known as: W32.VidroKDI.Worm Trojan-Dropper.Win32.Vidro!O Trojan.Vidro.S978560 Dropper.Vedro.Win32.4 Trojan/Dropper.Vidro.aei TROJ_KRYPTIK.SM Win32.Trojan-Downloader.Small.e W32/Trojan2.NPXJ Win32/Vidro.A TROJ_KRYPTIK.SM Win.Trojan.Vidro-11 Trojan.Win32.Vidro.bcqjb Trojan.Win32.Inject.dc Trojan.Inject.8798 BehavesLike.Win32.PWSZbot.qh Trojan-Dropper.Win32.Vidro W32/Trojan.SIZW-6937 TrojanDropper.Vidro.ko Trojan/Win32.Diple TrojanDropper:Win32/Vidro.C Trojan.Heur.ED30AD Dropper.Vidro.32768 Win-Trojan/Vidro.60416.B Trojan.Ahent.0322 Trojan.Vidro Trojan.Vidro Win32/TrojanDownloader.Small.OXH Trojan.Diple!gc4cFvq58+U W32/P2PWorm.HO.worm Backdoor.Win32.Vidro.A


We recently observed a new sample Detected by Trend Micro as TROJ_CVE20170199.JVU exploiting CVE-2017-0199 using a new method that abuses PowerPoint Slide Show—the first time we have seen this approach used in the wild before.


A backdoor also known as: Trojan/W32.Starter.49160 Trojan.Win32.Starter!O Trojan.Mauvaise.SL1 Trojan/Starter.ast Win32.Trojan.FakeMicro.d Win32/Chekafe.N TROJ_STRTER.SMUK Win.Trojan.Starter-293 Trojan.Win32.Starter.trq Trojan.Win32.Starter.brvob Trojan.Win32.Starter.65536.C TrojWare.Win32.Starter.clj Trojan.Starter.1524 Trojan.Starter.Win32.261 TROJ_STRTER.SMUK Trojan/Starter.fd TR/Starter.TV Trojan/Win32.Starter Trojan.Starter.1 Trojan.Win32.Starter.trq Trojan:Win32/Chekafev.C Trojan/Win32.Starter.R1734 Trojan.Starter Win32/Spy.Chekafev.AA Trojan.Starter!lzYxQhoD/t8 Trojan.Win32.Starter


A backdoor also known as: Trojan.Dropper Waledac.M Win32.Waledac.b Trojan.Win32.Meredrop!IK Win32/Xema.worm.31232.I Trojan.Win32.Meredrop W32/Waledac.B!tr Injector.CD Trj/Downloader.MDW


A backdoor also known as: Ransom.Crowti.MUE.A6 Ransom.Cerber Trojan.Zusy.D3175D Ransom.CryptXXX!g17 Ransom_HPCRYPMIC.SM4 Trojan.Win32.Z.Zusy.92672.FP Trojan.Encoder.5047 Ransom_HPCRYPMIC.SM4 TR/Crypt.Xpack.pzdls Ransom:Win32/Tovicrypt.A Trojan/Win32.CryptXXX.R185958 Trojan-Ransom.Locky Win32/Trojan.f15


A backdoor also known as: Trojan.Multi Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan Uds.Dangerousobject.Multi!c W32/Trojan.YSQI-3970 Trojan.Symmi.D3C9A Backdoor:Win32/Touasper.A Win32.Trojan.Spy.Efvi W32/Injector.AQM!tr


A backdoor also known as: Trojan.Razy.D3C7E6 Win32.Trojan.WisdomEyes.16070401.9500.9953 BehavesLike.Win32.Trojan.jm Trojan:Win32/Ceatrg.A Trojan/Win32.RemoteAdmin.C2229526 Trojan.MSIL.Bladabindi Trj/CI.A


The attackers compromised the website of the Evangelical Lutheran Church of Hong Kong and modified it to host a malicious iFrame which redirected visitors to another website hosting an exploit of the Internet Explorer Microsoft Internet Explorer Remote Memory Corruption Vulnerability CVE-2015-2502.


Detected as TROJ_WERDLOD, this new malware has been causing problems in the country since December 2014 with more than 400 confirmed victims.