A backdoor also known as: Backdoor.Ares.A Backdoor/W32.Aresdor.15872 Backdoor/Aresdor.13 Backdoor.Ares.A W32/Risk.WUTO-4007 Backdoor.Trojan Win32/Aresdor.13.C BKDR_ARESDOR.A Backdoor.Win32.Aresdor.13 Trojan.Win32.Aresdor.dblp Backdoor.Win32.Z.Aresdor.15872[h] Backdoor.W32.Aresdor.13!c Backdoor.Ares.A Backdoor.Win32.Aresdor.13.C Backdoor.Ares.A BackDoor.Ares.13 Backdoor.Aresdor.Win32.3 BKDR_ARESDOR.A Backdoor/Aresdor.a BDC/Aresdor.13.1.A W32/Ares.C!tr.bdr Trojan[Backdoor]/Win32.Aresdor Backdoor.Ares.A Win-Trojan/Aresdor.15872 Backdoor:Win32/Ares.A Backdoor.Ares.A Backdoor.Aresdor Win32.Backdoor.Aresdor.Wpte Backdoor.Aresdor!SN6VLScBnkQ Trojan.Win32.Aresdor Backdoor.Ares.A BackDoor.Aresdor.C Backdoor.Win32.Aresdor.13 Win32/Backdoor.a98


A backdoor also known as: W97M.Dropper.E W97M/DownldExe.A W97M.Downloader W97M/DownldExe.A W2000M/Dldr.Jetoypt.A W97M/Dloader.NCN!tr HEUR.VBA.Trojan Heur.MSWord.Downloader.b Trojan-Downloader.W97M.Small Macro.Trojan-Downloader.Broxoff.B heur.macro.download.e


It highlights the analysis flow using two of our flagship products, Security Analytics SA and the Enterprise Compromise Assessment Tool ECAT, for an Advance Persistent Threat APT intrusion investigation.


A backdoor also known as: Trojan.Perkesh.B TrojanDropper.Perkesh.C2 Trojan.Perkesh.B Trojan/Downloader.Fiegi.ar TROJ_PERKESH.SMF TROJ_PERKESH.SMF Trojan.Perkesh.B Trojan.Perkesh.B Trojan.Win32.Downloader.44032.DO TrojWare.Win32.Downloader.Small.ai43 Trojan.MulDrop.34331 TrojanDropper:Win32/Perkesh.C Trojan.Perkesh.B BScope.Trojan.SvcHorse.01643 Trojan.Perkesh.B Trj/Murlo.P Win32/TrojanDownloader.Perkesh.F Trojan-Downloader.Win32.Perkesh


MalwareBytes recently came across a campaign targeting a Saudi Arabia Government entity via a malicious Word document which at first reminded us of an attack we had previously described on this blog.


We have been monitoring a new campaign specifically targeting WordPress sites, using hundreds of them for SEO spam distribution.


A backdoor also known as: Backdoor/VB.auv BKDR_VB.GXX Win32.Trojan.WisdomEyes.16070401.9500.9813 W32/Backdoor2.EBKN Backdoor.Trojan BKDR_VB.GXX Backdoor.Win32.VB.apw Trojan.Win32.VB.ehzv Backdoor.Win32.S.VB.1007657.A Backdoor.W32.VB.apw!c Backdoor.Win32.VB.~UU Backdoor.VB.Win32.2378 BehavesLike.Win32.Trojan.dm W32/Backdoor.LCBL-3812 BDS/VB.A.109 Trojan[Backdoor]/Win32.VB Backdoor.Win32.VB.apw Trojan/Win32.Xema.C44642 BScope.Trojan-Dropper.Injector Trj/SpyMaster.C Win32/VB.AUV Win32.Backdoor.Vb.srv Backdoor.VB!xTNIvgAXzis Backdoor.Win32.VB W32/VB.0F07!tr Win32/Backdoor.8f4


The last time I wrote about poker-related malware, it was about PokerAgent, a trojan propagating through Facebook that was used to steal Facebook users' logon credentials, credit card information and the level of Zynga poker credit.


A backdoor also known as: Joke/W32.BadJoke.230912 Hoax.Fakedel JokeTool.RJLSoftware Aplicacion/FakeDel.c W32/Joke.BE Joke.FakeDel JOKE_FAKEDEL.C Win.Joke.FakeDelete-1 Hoax.Win32.BadJoke.FakeDel.c Riskware.Win32.FakeDel.hsrd Hoax.W32.BadJoke.FakeDel.c!c Joke.Fakedel Tool.BadJoke.Win32.441 JOKE_FAKEDEL.C not-a-virus:BadJoke.Win32.FakeDel.b W32/Joke.HLOW-7548 Hoax.BadJoke.FakeDel.a Joke:Win32/Fakedel.C JOKE/FakeDel.C HackTool[Hoax]/Win32.FakeDel Joke:Win32/Fakedel.C Hoax.Win32.BadJoke.FakeDel.c BadJoke.Win32.FakeDel.c Joke/Fakedel.D Win32.Trojan-psw.Badjoke.Svrk Trojan.BadJoke!Ig2iP/M1kgM Win32/Joke.309


A backdoor also known as: HW32.Packed.921B Trojan.Win32.VBKrypt!O Trojan.VBKrypt Trojan.Heur.E6E8D0 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.VBKrypt.hrqc Trojan.Win32.Drop.bccyya Trojan.Win32.Z.Vbkrypt.602112.J Trojan.MulDrop2.63923 BehavesLike.Win32.Trojan.hc Trojan.Win32.VB Trojan/VBKrypt.gkpp Trojan/Win32.VBKrypt Trojan:Win32/Msposer.A Trojan.Win32.VBKrypt.hrqc Trojan.VBKrypt Win32.Trojan.Vbkrypt.Phrb W32/Refroso.AGEA!tr Win32/Trojan.169


A backdoor also known as: Troj.W32.Autoit!c TROJ_FILPOR.AI Backdoor.Enfourks TROJ_FILPOR.AI Trojan.Win32.Autoit.ezc Trojan.Win32.Autoit.ecevvi Trojan.DownLoader21.32598 Trojan.Autoit.Win32.30656 BehavesLike.Win32.Autorun.hc TR/Autoit.qhpu Trojan.Win32.Autoit.ezc Trojan:Win32/Filpor.A Win32.Trojan.Autoit.Pepf Trojan.Win32.Autoit W32/Autoit.EZC!tr


A backdoor also known as: W32.DropperHQc.Trojan Trojan.Dropper.UUW Trojan.Dynamer.A4 W32/Trojan.YSAI-0703 Win32/Tnega.ARWO Trojan-Spy.MSIL.KeyLogger.cssc Trojan.Dropper.UUW Trojan.Win32.Drop.ewucrk Uds.Dangerousobject.Multi!c Trojan.Dropper.UUW Trojan.DownLoader1.49310 BehavesLike.Win32.Shodi.cc Trojan.Dropper.UUW Trojan.Win32.Z.Dropper.833273 Trojan-Spy.MSIL.KeyLogger.cssc TrojanDropper:Win32/FakeFlexnet.A Trojan.Dropper.UUW Trojan.Dropper.UUW Hoax.Win32.BadJoke Trj/CI.A Win32/Trojan.BO.19d


A backdoor also known as: Ransom/W32.Blocker.3262976 Trojan.MSIL.FC.4195 Win32.Trojan.WisdomEyes.16070401.9500.9943 W32/Trojan.RPCY-7702 Ransom_Blocker.R038C0DAH18 Trojan-Ransom.Win32.Blocker.juiv Trojan.Win32.Blocker.etmtcp Trojan.Win32.Z.Blocker.3262976.X Troj.Ransom.W32.Blocker!c Trojan.MulDrop7.48467 Ransom_Blocker.R038C0DAH18 Trojan[Ransom]/Win32.Blocker Trojan.MSILPerseus.D107B2 Trojan-Ransom.Win32.Blocker.juiv TrojanSpy:MSIL/Reven.A!bit Trojan/Win32.Blocker.R203232 Ransom.FileCryptor Trj/CI.A Win32.Trojan.Blocker.Aiip Trojan.MSIL.Spy Win32/Trojan.Ransom.df0


A few weeks ago Cisco Talos became interested in just such a campaign with a smaller number of circulating email messages.


As FileCoder was incomplete at the time of its discovery, we believe KeRanger is the first fully functional ransomware seen on the OS X platform.


A backdoor also known as: BehavesLike:Win32.Malware DLOADER.Trojan SHeur.CDXP Heuristic.Malware


Banking trojans are among some of the biggest threats to everyday users as they directly impact the user in terms of financial loss.


Remsec is a stealthy tool that appears to be primarily designed for spying purposes.


A backdoor also known as: Flooder.Napsterokoz!ZeoO3ZzZXAQ PUA.Win32.Packer.NetExecutable-1 Flooder.Win32.Napsterokoz.a Trojan.DownLoader5.2173 Trojan-PWS.Win32.Fignotok!IK Flooder.Napsterokoz.a Flooder.Napsterokoz.a Trojan-PWS.Win32.Fignotok Flooder.IJJ


A backdoor also known as: Trojan.Mdropper TROJ_MDROPPR.CA Win32.Mdropper TROJ_MDROPPR.CA Trojan.Mdropper


A backdoor also known as: W32.HackerAu3.Worm Win32.Worm.Autoit.Q Backdoor.Win32.Shark.axz!O Worm.Autoit.i Win32.Worm.Autoit.Q Worm.AutoIt.Win32.2 W32/AutoRun.fjx WORM_UTOTI.RC Win32.Worm.Sohanad.br W32/Downloader.AEEC-3989 W32.SillyDC Win32/Vishawon.A WORM_UTOTI.RC Worm.Win32.AutoIt.i Win32.Worm.Autoit.Q Trojan.Script.AutoIt.delira Worm.Win32.Autorun.215552.B Win32.Virus.Alman.Svhc Win32.Worm.Autoit.Q Worm.Win32.AutoIt.~MT Win32.HLLW.Autoruner.1483 W32/Downldr2.AICJ Worm/AutoRun.jsl W32/Almanahe.C Win32.Worm.Autoit.Q W32.W.AutoRun.lbrr Worm.Win32.AutoIt.i Win32.Worm.Autoit.Q Trojan/Win32.AutoRun.C97057 Worm.AutoRun.FLD I-Worm.Autoit.AC Win32/Autoit.BA Worm.AutoIT.V Worm.Win32.AutoIt W32/AutoIt.I!worm Win32/Worm.c3b


A backdoor also known as: W32.FakeuserinitQC.Trojan TrojanDownloader.Paglst.B4 Trojan.Ursu.D206A Backdoor.Graybird Win32/Adload.NOU Win.Trojan.Adload-2949 Trojan-Downloader.Win32.Adload.cfms Trojan.Win32.Adload.rhwua Trojan.Win32.A.Downloader.6381568 Adware.Win32.AdLoader.a TrojWare.Win32.Downloader.AdLoad.CFMS Trojan.DownLoad2.64118 Downloader.Adload.Win32.13800 TrojanDownloader.Adload.oqx TR/Adload.V Trojan[Downloader]/Win32.Adload.cfms TrojanDownloader:Win32/Paglst.B Troj.Downloader.W32.Adload.toiw Trojan-Downloader.Win32.Adload.cfms Downloader/Win32.Adload.R32544 TScope.Malware-Cryptor.SB Win32/TrojanDownloader.Adload.NJM Trojan-Downloader.Win32.Adload W32/Adload.CFMS!tr.dldr Trojan.PSW.Win32.QQPass.DT


A backdoor also known as: W32.Clod6d6.Trojan.587c Trojan.Downloader.JMWD Trojan.Downloader.JMWD Trojan.Boupke.A6 Trojan.Downloader.JMWD Trojan.Win32.S.Downloader.196096.A Trojan.Downloader.JMWD Trojan.Downloader.JMWD DDoS.5686 Trojan:Win32/Doschald.A Trojan.Downloader.JMWD Trj/Downloader.MDW Trojan.Win32.Downloader.au Win32/Trojan.Downloader.001


A backdoor also known as: W32.Letbetom.Trojan Trojan-Spy.MSIL.Redator!O Trojan/Redator.a Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/MalwareF.LRAK Win.Trojan.Keylogger-796 Trojan-Spy.MSIL.Redator.a Trojan.Win32.Redator.cwfoqm Trojan.Win32.Z.Redator.186456 Backdoor.PePatch.Win32.36732 W32/Risk.TYVS-3062 TrojanSpy.MSIL.dwl System.Monitor.Stealthddos Trojan[Spy]/MSIL.Redator Trojan.MSIL.Krypt.2 Troj.Spy.MSIL.KeyLogger.ljvI Trojan-Spy.MSIL.Redator.a Trojan/Win32.Keylogger.R4155 TrojanSpy.MSIL.Redator Trj/CI.A MSIL/Spy.Keylogger.AK Msil.Trojan-spy.Redator.Pgcw W32/Mdrop.CRV!tr Win32/Trojan.Spy.17f


It is this second webshell that enabled the threat actor to run a variety of commands on the compromised server.


Not long ago, news appeared online of a younger sibling for the sensational vulnerability EternalBlue.


At the time of writing this article, the Joao downloader was being distributed via the anime-themed MMORPG Grand Fantasia offered on gf.ignitgames[.]to.


DDoS tools developed by this organization use SSH weak passwords and server vulnerabilities to control many Linux chickens.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9848 BehavesLike.Win64.BadFile.lm Backdoor:Win64/Syscon.A Trj/CI.A


A backdoor also known as: Trojan.Flooder.ICQ.Raptof.01 Trojan/W32.Flooder.223744 Flooder.Raptof.ra Trojan.Flooder.ICQ.Raptof.01 IM-Flooder.W32.Raptof.01!c Trojan.Flooder.ICQ.Raptof.01 Flooder.Raptof!8im4oqjQSco Hacktool.Flooder Win32/Flooder.ICQ.Raptof.01 Win.Trojan.Raptof IM-Flooder.Win32.Raptof.01 Trojan.Win32.Raptof.dlvc Spyware.IM-Flooder.Raptof.223744[h] Trojan.Flooder.ICQ.Raptof.01 TrojWare.Win32.Flooder.ICQ.01 Trojan.Flooder.ICQ.Raptof.01 FDOS.Raptof Tool.Raptof.Win32.1 BehavesLike.Win32.Malware.dc W32/Risk.YFGX-8652 Flooder.ICQ.Raptof.01 HackTool[Flooder]/Win32.Raptof Win-Trojan/Raptof.223744 Trojan.Flooder.ICQ.Raptof.01 IMFlooder.Raptof Win32.Trojan.Raptof.Eflc Malware_fam.gw Flooder.BBR Trojan.Win32.ICQ.Raptof Win32/Trojan.Flood.be5


This suggests that multiple actors may be using similar source code, or the malware is being customized as a service for targeted campaigns.


A backdoor also known as: W32.QuastihusLTG.Trojan Worm.Jenxcus.A4 Trojan/Autoit.jh Trojan.Heur.AutoIT.10 W32/Trojan2.OIEK Win.Trojan.Autoit-581 W32.Sality.mCD7 Worm.AutoIT.Win32 BehavesLike.Win32.Dropper.jh W32/Trojan.WAFR-6845 TrojanDropper.Sysn.fg Trojan:AutoIt/Nateqj.B Trojan/Win32.Zapchast.R114120 Worm.AutoIt Trj/CI.A I-Worm.Autoit.JH Win32/Autoit.JH Win32.Worm.Autoit.Wofs Win32/Trojan.5a2


A backdoor also known as: Trojan-Dropper/W32.Keylogger.2292572 RiskWare.WinActivator MSIL.Riskware.Hacktool.B Tool.Wpakill.13 Trojan.Keylogger.Win32.50652 HackTool.Win32.Wpakill W32.Hack.Tool Trojan[Spy]/MSIL.Keylogger HackTool/Win32.Wpakill.C2293432 TrojanSpy.MSIL.Keylogger TrojanSpy.Keylogger!axHWqO6gDEY


The attackers invested significant effort in attempting to hide the tool by changing the source code of the RAT and the RAT server, and by using an obfuscator and packer.


A backdoor also known as: W32.Cloddf4.Trojan.f747 Win32.Worm.P2p.Reur.P I-Worm.Reur.l.n2 W32/Reur.worm!p2p Worm.Reur.Win32.19 W32/Reur.p Worm.P2P.Reur!QrOO3e6Ele8 W32/Reur.YOAP-3596 W32.HLLW.Reur Win32/Reur.J P2P-Worm.Win32.Reur.p Win32.Worm.P2p.Reur.P Trojan.Win32.Reur.inko Win32.Worm.P2p.Reur.P Worm.Win32.Reur.S Win32.Worm.P2p.Reur.P BehavesLike.Win32.Dropper.gc W32/Reur.K Worm/Sramota.afo Worm[P2P]/Win32.Reur Worm.Reur.p.kcloud Worm:Win32/Reur.S Win32.Worm.P2p.Reur.P Trojan/Win32.HDC Worm.Reur Win32/Reur.S W32/Reur.K!worm.p2p Worm/Reur.V Worm.Win32.Reur.alHx Win32/Worm.226


Its main job is to send spam, but it is able to do other tasks as well.


The actors attempted to exploit CVE-2014-6332 using a slightly modified version of the proof-of-concept POC code to install a Trojan called Emissary, which is related to the Operation Lotus Blossom campaign.


A combination of factors made this pattern effective and successful, explaining why ITG08 has remained operational for so long.


Ploutus is one of the most advanced ATM malware families we've seen in the last few years.


A backdoor also known as: Win.HLLP.Sector.C Win.HLLP.Sector.C Win.HLLP.Sector.C Win.HLLP.Sector Win/HLLP.Sector.C NE_HLLP_SECTOR.C Win.HLLP.Sector.C Win.HLLP.Sector.C Trojan.Win16.HLLP.exkzou Win.Hllp.Sector!c Win.HLLP.Sector.C Win.HLLP.Sector.C Win.HLLP.Sector.18864 NE_HLLP_SECTOR.C W16/TNT.a W16/HLLP.Sector.C Backdoor:Win16/Sector.C W16/TNT.a Win32.Virus.Hllp.Akes Virus.Win.Hllp


Per its advertisements it is an infostealer that steals form data from various web browsers and other applications.


A backdoor also known as: WS.Reputation.1 WORM_DUPTWU.SMIA Worm.Autorun-6650 Backdoor.Win32.LolBot.dyk Trojan.Downloader.JNUS Backdoor.Win32.LolBot!IK Trojan.Downloader.JNUS WORM_DUPTWU.SMIA Worm:Win32/Duptwux.A Trojan.Downloader.JNUS Backdoor/Win32.LolBot Backdoor.LolBot.ju Worm.Win32.FakeFolder.t Backdoor.Win32.LolBot W32/LolBot.DYK!tr.bdr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Scarpnex-1 Trojan.MulDrop4.61017 Trojan[Spy]/MSIL.KeyLogger Trojan:MSIL/Scarpnex.A Trojan.Zusy.D9B94 TrojanSpy.KeyLogger!icGvcsfSy6M Trj/CI.A


A backdoor also known as: Backdoor.Msxrat Trojan.Win32.Z.Msxrat.522564 TR/Crypt.Xpack.wccie Trj/CI.A


The LOCKBIT ransomware group is one of the most notorious cyber-thieves in the world, targeting companies across Europe, the United States, India, and the Middle East in a series of attacks that began in December 2022.


It is unknown what is the intent behind the campaign as of this writing, however, the profile of the targets resembles those that are common targets of Advanced Persistent Threat APT actors.


We investigated further and found that this campaign is specifically targeted to Korean sites and Korean banks.


The latest Petya-like outbreak has gathered a lot of attention from the media.


A backdoor also known as: Trojan-Ransom.Win32.Gimemo!O Trojan.PornoAsset.Win32.9310 Trojan/Gimemo.aunq Trojan.Symmi.D1B0C Trojan.Winlock.7482 BehavesLike.Win32.BadFile.ch Trojan/PornoAsset.ooo Trojan[Ransom]/Win32.Gimemo Trojan:Win32/Fsblock.A TScope.Trojan.VB Trojan-Dropper.Win32.Injector W32/Injector.CLTY!tr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9520 Win32.Trojan.Razy.Hsjc BehavesLike.Win32.BadFile.mz TR/Razy.anyu Trojan:Win32/Rekilc.C Trojan.Razy.D822B


A backdoor also known as: Backdoor.Degrub Trojan-Spy.Win32.Delf.avce Trojan.Win32.Symmi.daxrzp Trojan.Win32.Z.Delf.731648 Troj.Spy.W32.Delf!c Trojan.Delf.Win32.64416 BehavesLike.Win32.Dropper.bh Trojan-Spy.Win32.Delf TrojanSpy.Delf.iwz TR/Spy.Delf.agiu Backdoor:Win32/Degrub.A Trojan-Spy.Win32.Delf.avce TScope.Trojan.Delf Trj/Chgt.A Win32.Trojan-spy.Delf.Akpg TrojanSpy.Delf!bLkOUU0IMLc W32/Delf.AFB!tr Win32/Trojan.Keylog.e29


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9995 Trojan.Win32.Mlw.ewygwi Backdoor.W32.Androm.mfVY Trojan.Injector.Win32.586108 TR/Dropper.MSIL.xejse Trojan.MSIL.Inject Trj/GdSda.A Win32/Trojan.e6d


A backdoor also known as: VB:Trojan.Valyria.401 Vb.Troj.Valyria!c Trojan.GQXF-6 VB:Trojan.Valyria.401 Trojan.Ole2.Vbs-heuristic.druvzi VB:Trojan.Valyria.401 VB:Trojan.Valyria.401 HEUR_VBA.E HEUR.VBA.Trojan.d TrojanDropper:O97M/SilverMob.A!dha VB:Trojan.Valyria.401 Macro.Trojan.Dropperd.Auto Trojan.VB.Valyria VB:Trojan.Valyria.401 virus.office.obfuscated.1


A backdoor also known as: Troj.GameThief.W32.Magania.lhJV Win32.Trojan-PSW.OLGames.ck TSPY_ONLINEG.VBY Win.Spyware.18411-2 Trojan-GameThief.Win32.OnLineGames.hmv Trojan.Win32.OnLineGames.bjsgmk TrojWare.Win32.Magania.~I Trojan.PWS.Wsgame.4325 TSPY_ONLINEG.VBY Trojan-GameThief.Win32.OnLineGames TR/CrashSystem.C Trojan[GameThief]/Win32.OnLineGames Win32.Troj.OnLimeGamesT.gs.73779 Trojan-GameThief.Win32.OnLineGames.hmv Trojan/Win32.OnlineGameHack.R96963 Trojan.Graftor.Elzob.D370C Trojan.PWS.OnLineGames!SkDSyFiZd8U


A backdoor also known as: Trojan.ProxyChanger Trojan.Banload Trojan/ProxyChanger.ik TROJ_BANLOAD.HVU W32/Trojan2.NXCH Win32/Tnega.ASRL Trojan.ProxyChanger.IK TROJ_BANLOAD.HVU Win.Trojan.Dealply-6391261-0 Trojan.DownLoad3.29408 BehavesLike.Win32.Dropper.gh W32/Trojan.YDHZ-1016 TR/ProxyChanger.H.1 Trojan/Win32.Unknown Trojan:Win32/ProxyChanger.H Trojan/Win32.ChePro.R102488 TScope.Trojan.Delf Win32/ProxyChanger.IK Trojan.ProxyChanger!NBBwWIBks/E Trojan.Crypt W32/Banloa.NX!tr Win32/Trojan.e6d


A backdoor also known as: Trojan.Win32.Gaobot.iawc W32/Joke.OA Joke.Rosenu TROJ_SPNR.03D111 Backdoor.Pasur!NYY0BVh8dz8 TrojWare.Win32.Trojan.Chifrax.~A TROJ_SPNR.03D111 W32/Joke.ERJK-0662 Joke.Rosenu Win32/Joke.ScreenRoses Trojan.Win32.Inject Trj/CI.A


A family of ransomware Trojans that encrypts files and adds the extensions .xtbl and .ytbl emerged in late 2014/early 2015, and quickly established itself among the top three most widespread encryptors in Russia along with Trojan-Ransom.Win32.Cryakl and Trojan-Ransom.BAT.Scatter.


Morphick is tracking this malware under the name ScanPOS due to the build string present in the malware.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9673 Trojan.PWS.Zhui BehavesLike.Win32.VTFlooder.mh Win32.Troj.Wow.q.kcloud Trj/QQFile.D Win32.Trojan-qqpass.Qqrob.Akon Trojan.SystemHijack!vG9DZPEgkqo


A backdoor also known as: Trojandownloader.Halnine Trojan.Zusy.D2FDB Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Win32.DlrSysWrtbased!M.bdazop Trojan.Win32.Z.Zusy.15872.DI TrojanDownloader:Win32/Halnine.A Win32.Trojan.Spy.Swve


A backdoor also known as: BehavesLike.Win64.Fake.jh Trojan.Win32.Crypt Trojan.PSW.Mimikatz.un TR/AD.Trier.sqhjh Joke:VBS/Trier.A Trj/CI.A VBS/BadJoke.AL Win32/Trojan.7be


A backdoor also known as: Trojan.FakeAV.NRC Trojan.Bampeass.B5 Trojan.FakeAV.NRC TROJ64_BAMPEASS.SM Win.Trojan.Fakeav-103064 Trojan.FakeAV.NRC Trojan.Win32.Wakme.c Trojan.FakeAV.NRC Variant.Kazy.mAdQ Trojan.FakeAV.NRC Trojan.FakeAV.Win32.316028 TROJ64_BAMPEASS.SM W64/Trojan.CZHS-5421 Trojan.Fakeav.bg TR/Bampeass.abd Trojan.FakeAV.NRC PUP.BrowseFox/Variant Trojan.Win32.Wakme.c Trojan:Win64/Bampeass.C Trojan.FakeAV.NRC Trj/CI.A Win32.Trojan.Wakme.Akew Win32/Trojan.d9f


Forcepoint Security Labs™ recently investigated a trojanized RTF document which we tied to the Carbank criminal gang.


A backdoor also known as: TrojanDownloader:PowerShell/Hipolel.A Trojan.Win32.Swrort Win32/Trojan.Downloader.c1c


Doc with Macro that downloads Dridex


A backdoor also known as: Trojan-Downloader/W32.Small.8704.HT TrojanDownloader.Tooki Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan Win32/Tydpec.A TROJ_DLOADER.OXH Win.Downloader.16819-1 Trojan-Spy.Win32.KeyLogger.aszl Trojan.DownLoader8.62321 TROJ_DLOADER.OXH TrojanDownloader:Win32/Tooki.A Trojan-Spy.Win32.KeyLogger.aszl Win32.Trojan-spy.Keylogger.Lpbj


A backdoor also known as: Trojan/W32.Small.16896.DU Trojan-Spy.Win32.Zbot!O Backdoor.Small.D10 Trojan.Spy.Zbot W32.Spacefam Win32/Zbot.EUI TSPY_FIFESOCK_BK082A3D.TOMC Win.Trojan.Zbot-13661 Trojan.Win32.Zbot.curnd Trojan.Win32.A.Zbot.16896 Trojan.Proxy.18997 TSPY_FIFESOCK_BK082A3D.TOMC TrojanSpy.Zbot.awmw TR/Spy.ZBot.axcq.3 Trojan[Spy]/Win32.Zbot Trojan.Razy.D7DC8 Backdoor.W32.IRCBot.liBA Spyware/Win32.Zbot.R2503 SScope.Trojan.Zbot.01428


Using DGA Domain Generation Algorithm to find the C C Command and Control server


We discovered a new variant of a Brazilian-made ransomware, Trojan-Ransom.Win32.Xpan, that is being used to infect local companies and hospitals, directly affecting innocent people, encrypting their files using the extension .___xratteamLucked and asking to pay the ransom.


These investigations took place during mid-to-late 2017, and each bank compromise resulted in a significant amount of stolen funds.


A backdoor also known as: Trojan.Molock Win32.Trojan.WisdomEyes.16070401.9500.9974 TR/Molock.nylne Trojan.Mikey.DD047 PUA.BlackMoon Win32/Trojan.2ce


In March 2016, Symantec published a blog on Suckfly, an advanced cyberespionage group that conducted attacks against a number of South Korean organizations to steal digital certificates.


A backdoor also known as: W32.RansomCryakl.Trojan Trojan.Cryakl Trojan.Ransom.Cryakl Ransom_CRYPICH.SMA Win32.Trojan.WisdomEyes.16070401.9500.9790 W32/Trojan.GTXF-0130 Ransom_CRYPICH.SMA Trojan-Ransom.Win32.Cryakl.sw Trojan.Win32.Cryakl.drogeo Trojan.Win32.Z.Filecoder.626656 Win32.Trojan.Cryakl.Ahys Trojan.Encoder.1041 Trojan.Cryakl.Win32.53 Trojan-PWS.Win32.Delf Trojan/Cryakl.ap W32.Cryakl TR/FileCoder.bikix Trojan[Ransom]/Win32.Cryakl Trojan-Ransom.Win32.Cryakl.sw Trojan/Win32.Xema.C2455 Trojan-Ransom.Cryakl Ransom.TeslaCrypt.OL Trojan.Cryakl! W32/Filecoder.EQ!tr Win32/Trojan.c28


A backdoor also known as: Dropped:Backdoor.Rootodor.H Backdoor.W32.SdBot.aop!c Backdoor/SdBot.aop Backdoor.Rootodor.H Backdoor.Sdbot Win.Trojan.SdBot-8443 Dropped:Backdoor.Rootodor.H Backdoor.Win32.SdBot.aop Dropped:Backdoor.Rootodor.H Trojan.Win32.SdBot.fptq Dropped:Backdoor.Rootodor.H Dropped:Backdoor.Rootodor.H BackDoor.Rtkit.12 Backdoor.SDBot BehavesLike.Win32.Downloader.dc Backdoor/SdBot.cr WORM/SdBot.298496.1 Win32.Hack.SdBot.kcloud TrojanDropper:Win32/Srvdrop.A Backdoor.Win32.SdBot.aop Dropped:Backdoor.Rootodor.H Backdoor.SDBot Backdoor.SdBot Win32.Backdoor.Sdbot.Wrgb Worm.SdBot!0ktHNidYgyk Backdoor.Win32.SdBot W32/SDBot.AOP!tr.bdr


A backdoor also known as: Pua.Cpush W32/Trojan.VJJX-8459 not-a-virus:AdWare.Win32.Cpush.a Adware.Cpush.Win32.21 BehavesLike.Win32.Downloader.fc Trojan.Zusy.D2AB1B not-a-virus:AdWare.Win32.Cpush.a AdWare.Cpush Trj/CI.A Win32/VB.NYC Win32.Adware.Cpush.Dwjc Adware.Cpush!ybdhrKQu3UY Trojan-Dropper.Win32.VB W32/VB.NYC!tr


A backdoor also known as: Trojan.NSIS.Androm.7 Ransom.Onion.A Win32.Trojan.WisdomEyes.16070401.9500.9984 Packed.NSISPacker!g6 Ransom_.97182692 Trojan.NSIS.Androm.7 Trojan.Win32.Graftor.evkohe Trojan:W32/Gamarue.E Trojan.Inject2.64079 Ransom_.97182692 BehavesLike.Win32.Ransom.cc Trojan.Win32.Injector W32/Trojan.HJUO-7930 Trojan.Graftor.D6B214 Ransom.Cerber/Variant Ransom:Win32/Malasypt.A Trojan/Win32.Miuref.R183155 Trj/CI.A Trojan.Injector!s1rN7kKLdpI W32/Injector.DDGJ!tr Win32/Trojan.5c1


Vectra Threat Labs researchers have uncovered the activities of a group of individuals currently engaged in targeted attacks against entities in the Middle East.


These websites, and the hosted programs, were designed to entice visitors to download and install the programs.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.DownLoader23.44275 Trojan.Graftor.D69D4B Trojan:Win32/Seepeed.A Trj/CI.A Win32.Trojan.Atraps.Pgmx W32/Kryptik.DNGA!tr


A backdoor also known as: Trojan-PSW.Win32.QQPass!O Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Spyware.59892-2 Trojan-PSW.Win32.QQPass.sso Trojan.Win32.QQPass.bcshgi Trojan.Win32.Downloader.75264.M TrojWare.Win32.PSW.QQPass.~Sso Backdoor.PePatch.Win32.16970 Trojan[PSW]/Win32.QQPass Troj.PSW32.W.QQPass.toI3 Trojan-PSW.Win32.QQPass.sso PWS:Win32/Stealer.M


ESET detects the games that install the Trojan as Android/TrojanDropper.Mapin and the Trojan itself as Android/Mapin.


Malware Seen In The Middle East Region Domains used by APT28.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Downloader-39183 Trojan.Win32.Dwn.whgnl Trojan.Win32.A.Downloader.28672.AMZ Trojan.DownLoader6.15686 BehavesLike.Win32.BadFile.mm Trojan[Downloader]/Win32.Tobor Trojan.Graftor.D45EB TrojanDownloader:Win32/Tobor.A TrojanDownloader.Tobor Win32/Trojan.e6d


A backdoor also known as: Trojan.Graftor.Elzob.D2B30 BehavesLike.Win32.BadFile.qm HackTool:Win32/WMIShell.A Trj/CI.A


A backdoor also known as: Trojan.Sefnit.Win32.13226 Trojan.Win32.Sefnit.ekkxqe Trojan.DownLoader23.50639 Trojan.Sefnit.pj Trojan/Win32.Sefnit TrojanDownloader:Win32/Trulop.A Trj/GdSda.A Win32/RA-based.NFG Trojan.Sefnit!apDWbcANJlc


BankBot is a family of Trojan malware targeting Android devices that surfaced in the second half of 2016.


Let ’ s compare examples of traffic from Smaps and Asacub — an initializing request to the C & C server with information about the infected device and a response from the server with a command for execution : Smaps request Asacub request Decrypted data from Asacub traffic : { “ id ” : ” 532bf15a-b784-47e5-92fa-72198a2929f5″ , ” type ” : ” get ” , ” info ” : ” imei:365548770159066 , country : PL , cell : Tele2 , android:4.2.2 , model : GT-N5100 , phonenumber : +486679225120 , sim:6337076348906359089f , app : null , ver:5.0.2″ } Data sent to the server [ { “ command ” : ” sent & & & ” , ” params ” : { “ to ” : ” +79262000900″ , ” body ” : ” \u0410\u0412\u0422\u041e\u041f\u041b\u0410\u0422\u0415\u0416 1000 50″ , ” timestamp ” : ” 1452272572″ } } , { “ command ” : ” sent & & & ” , ” params ” : { “ to ” : ” +79262000900″ , ” body ” : ” BALANCE ” , ” timestamp ” : ” 1452272573″ } } ] Instructions received from the server A comparison can also be made of the format in which Asacub and Smaps forward incoming SMS ( encoded with the base64 algorithm ) from the device to the C & C server : Smaps format Asacub format Decrypted data from Asacub traffic : { “ data ” : ” 2015:10:14_02:41:15″ , ” id ” : ” 532bf15a-b784-47e5-92fa-72198a2929f5″ , ” text ” : ” SSB0aG91Z2h0IHdlIGdvdCBwYXN0IHRoaXMhISBJJ20gbm90IGh1bmdyeSBhbmQgbmU= ” , ” number ” : ” 1790″ , ” type ” : ” load ” } Propagation The banking Trojan is propagated via phishing SMS containing a link and an offer to view a photo or MMS .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9972 Infostealer.Tarno.B TrojWare.Win32.GhostDEL.~A Trojan.MulDrop4.8101 BehavesLike.Win32.Virut.qc Backdoor/Huigezi.2007.aqzf TrojanDownloader:Win32/Ksare.A Trj/CI.A Win32/Trojan.66a


Recent weeks have seen the outing of two new additions to the Duke group's toolset, SeaDuke and CloudDuke.


A backdoor also known as: Trojan.Graftor.D20DA2 TrojWare.Win32.TrojanDownloader.Delf.SAD BehavesLike.Win32.Dropper.dc TR/Dldr.Vifuls.pwiho TrojanDownloader:Win32/Vifuls.A TScope.Trojan.Delf Win32.Trojan.Badur.Eddg Win32/Trojan.fd8


Several bots relied heavily, if not exclusively, on systems with weak and/or default passwords to spread.


In other words, the attack targeted organizations that design, build and support industrial solutions for critical infrastructure.


While revisiting a Flokibot campaign that was targeting point of sale PoS systems in Brazil earlier this year, we discovered something interesting.


A backdoor also known as: Backdoor/W32.Finfish.11008 Backdoor.Win32.Finfish!O Backdoor.Finfish.r6 Backdoor.Finfish.Win32.1 Backdoor.W32.Finfish.b!c Backdoor/Finfish.b Backdoor.Finfish!WTL5ZVLbFgg Backdoor.Finfish Win32/Belesak.D TROJ_FINSPY.A Backdoor.Win32.Finfish.b Trojan.Win32.Finfish.wbhuj Trojan.Win32.Z.Finfish.11008[h] Backdoor.Win32.Finfish.B Trojan:W32/FinSpy.B Trojan.NtRootKit.14434 TROJ_FINSPY.A W32/Backdoor.CLPB-2084 Backdoor/Finfish.a W32/Belesak.D Trojan:WinNT/Spinfy.A Backdoor.Finfish Backdoor.Win32.Finfish.b Win32.Backdoor.Finfish.Iso Backdoor.Win32.Finfish


But an investigation now suggests the attack was in fact carried out by a group of Russian hackers.


A backdoor also known as: Worm.Win32.Luder!O Worm.Polkayam.A3 Worm.Luder Trojan/Spy.VB.nub TROJ_SPNR.15GB13 Backdoor.Trojan Win32/Tnega.VHcOIY TROJ_SPNR.15GB13 Win.Trojan.Luder-83 Trojan.Win32.Luder.crcdfm W32.W.WBNA.lJLh Worm.Luder.Win32.197 Worm/Luder.chm TR/Dynamer.dtc.9853 Worm/Win32.Luder Worm:Win32/Polkayam.A Worm/Win32.Luder.C169426 Worm.Luder Worm.Luder!PF0ilQ/gy98 Worm.Win32.Luder W32/Luder.BQPT!tr Win32/Trojan.cfc


In this post we will show links to a recently publicized PoS malware campaign, and describe possible threat motivations behind this or other POS vendor exploitation campaign.


A backdoor also known as: Win32.Worm.TUD Trojan/W32.Hesv.372736.B Worm.Folxrun Win32.Worm.TUD Win32.Worm.TUD Win32.Trojan.VB.ja W32.Rasith Win32/Rasith.A TROJ_FSYSNA_FB120272.UVPM Win32.Worm.TUD Trojan.Win32.Hesv.bjrj Win32.Worm.TUD Trojan.Win32.Autoruner2.ewcqfg Troj.W32.Hesv!c Win32.Worm.TUD Win32.Worm.TUD Win32.HLLW.Autoruner2.29691 Trojan.Fsysna.Win32.4334 BehavesLike.Win32.Vesenlosow.fm Worm.Win32.Rasith W32/Trojan.SHGP-6241 Trojan/Fsysna.atg Trojan/Win32.Fsysna Worm:Win32/Folxrun.A Trojan/Win32.Injector.R167793 Trojan.Win32.Hesv.bjrj Trojan.Fsysna Trj/CI.A Win32.Trojan.Hesv.Lkdf Trojan.Fsysna! Win32/Worm.4c0


Novetta has collected and shares within this report evidence that suggests multiple actors,


This botnet is responsible for the majority of Locky and Dridex activity.


The tool has been used in global phishing attacks and its use has been implicated in a number of notable attacks.


In this case I spent more time analyzing the campaign than I initially planned.


A backdoor also known as: W32.HfsAutoB.9E06 Win32.Trojan.WisdomEyes.16070401.9500.9767 Spyware.Perfect Win32/Gamepass.QHH Trojan-Dropper.Win32.Dorgam.xfl Win32.TenThief.QQPsw_def.fvg Trojan.PWS.Wsgame.36114 BehavesLike.Win32.Ransomware.dc Trojan.Win32.QQpass TrojanSpy.FlyStudio.cx TR/QQpass.E.4 Trojan-Dropper.Win32.Dorgam.xfl Win32/PSW.QQPass.OHY Win32/Trojan.884


The malware waits for victims to open the Google Play store and then displays a fake html overlay page asking for credit card information.


On July 14, FireEye researchers discovered attacks exploiting the Adobe Flash vulnerability CVE-2015-5122, just four days after Adobe released a patch.


A backdoor also known as: Trojan.Dynamer.S239831 Trojan.RA.Win32.52 Trojan.Win32.Reconyc.ejtcsm BehavesLike.Win32.Dropper.vc TR/RemoteAdmin.romkw Trojan/Win32.Scar Trojan.Zusy.D258ED Trojan.Banload Trojan.Win32.ChePro


The source code appears to have been picked by one or more threat actors and was used to conduct DDoS attacks against Georgia in 2008.


A backdoor also known as: TrojanAPT.Moudoor.A8 TROJ_BANLOAD.GDV Backdoor.Moudoor TROJ_BANLOAD.GDV Win.Trojan.Downloader-27596 Trojan.DownLoader6.13038 Trojan-Downloader.Win32.Banload W32/Trojan.MQRX-7833 W32.Malware.Heur Trojan[Downloader]/Win32.Unknown Win32.Troj.Undef.kcloud Trojan.Downloader.cmGfaSmx9Rpb TrojanDownloader:Win32/Moudoor.A Win-Trojan/Downloader.46592.GU Trojan.Downloader.46592 Win32/TrojanDownloader.Moudoor.A W32/Downloader_a.BWT!tr Win32/RootKit.Rootkit.7e5


A backdoor also known as: Trojan.PWS.OnlineGames.KDPO TrojanPWS.Dozmot.D4 Infostealer.Gampass W32/Magania.GZ TROJ_GAMEHTI.SMI Trojan.Spy-73883 Trojan-GameThief.Win32.OnLineGames.bnkb Trojan.PWS.OnlineGames.KDPO Trojan.PWS.Magania!Tq/DAk7oVGo Virus.Win32.Part.a TrojWare.Win32.PSW.OnlineGames.~BNKB Trojan-PSW:W32/OnlineGames.UBO Trojan.PWS.Gamania.30052 TROJ_GAMEHTI.SMI Trojan-GameThief.Win32.WOW!IK Trojan/PSW.OnLineGames.bton Win32.PSWTroj.OnLineGames.kcloud PWS:Win32/Dozmot.D Trojan.Win32.PSWIGames.27176.E Trojan.PWS.OnlineGames.KDPO Trojan/Win32.OnlineGameHack BScope.Trojan.OnlineGames.0825 Trojan-PSW.Gampass Win32/PSW.WOW.NQS Trojan.Win32.FakeKsUsr.a Trojan-GameThief.Win32.WOW W32/Onlinegames.OST!tr.pws Trj/Lineage.LNC


A backdoor also known as: Backdoor.Bedep Trojan.Zusy.D3CF93 Backdoor.Win32.Bedep.lls Win32.Backdoor.Bedep.Lnob BDS/Bedep.ghjmg Trojan[Backdoor]/Win32.Bedep Backdoor.Win32.Bedep.lls Win-Trojan/Bmdoor.100864 Backdoor.Win32.Bedep


Tofsee is a multi-purpose malware with wide array of capabilities – it can mine bitcoins, send emails, steal credentials, perform DDoS attacks, and more.


These are detected within Alienvault USM by looking for Excel launching Cmd.exe.


In that research we discussed two new malware families we named KASPERAGENT and MICROPSIA.


A backdoor also known as: Trojan.FakeAV Trojan.FakeSysDef.Win32.707 Trojan/Kryptik.ahre Win32.Trojan.WisdomEyes.16070401.9500.9999 TrojWare.Win32.Spy.Zbot.HEUB Trojan.DownLoader5.64514 BehavesLike.Win32.Downloader.dc Trojan/SmartFixer.gv W32.Trojan.Fakesysdef TR/FakeSysdef.aqwrb Trojan.Zbot.76 Trojan/Win32.FakeAV.R28472 FakeAlert-SysDef.ae TrojanFakeAV.FakeSysDef Trojan.Zbot


Taiwan has been a regular target of cyber espionage threat actors for a number of years.


A backdoor also known as: Backdoor.Nekozillot Win32.Trojan.WisdomEyes.16070401.9500.9656 Trojan.DownLoader25.61646 W32/Trojan.RZHM-5084 BDS/RedCap.gyswy Trojan.MSILPerseus.D21311 Backdoor:MSIL/Nekozillot.A!bit Trj/GdSda.A


It seems to be that the actors behind these campaigns are back now and launching again massive spam attacks.


and launch the new activity as the payload.


A backdoor also known as: Trojan.Win32.Quby.b


So far, these campaigns have targeted countries including Germany, Austria, and the United Kingdom.


This includes,among others, Poland, Australia, United Kingdom and Spain.


A backdoor also known as: W32.Roron.F Worm.Roron.Win32.28 WORM_OROR.Q Win32.Trojan.WisdomEyes.16070401.9500.9941 W32/Roro.AA@mm W32.HLLW.Oror.C@mm Win32/Oror.U WORM_OROR.Q Win.Trojan.Oror-3 Trojan.Win32.IRCBot.dvpnyt W32.W.Envid.l6rk Win32.Backdoor.Ircbot.Lned Worm.Win32.Roron.51 Win32.HLLM.RoRo BehavesLike.Win32.Backdoor.cc W32/Roro.AA@mm Backdoor/IRCBot.rdt WORM/Roron.51 Worm[Email]/Win32.Roron Win32.Hack.IRCBot.g.kcloud I-Worm.Win32.Roron.82954 Worm:Win32/Roron.Z@mm Win32/Roron.worm.81925 Worm.Roron Win32/Roron.51 IRC.Roron.G Email-Worm.Win32.Roron W32/Roron.B!worm


The Kaspersky Anti-Ransom team decrypted the Xpan Trojan, allowing them to rescue the files of a Hospital in Brazil that had fallen victim to this Ransomware family.


A backdoor also known as: Trojan.DL.BHO.UDE W32/DLoader.AIYY Trojan.Downloader-70412 TrojWare.Win32.Bho.yme Trojan.Win32.Bho.yme Trojan.MulDrop.origin Heuristic.BehavesLike.Win32.Dropper.K TrojanDropper.Softfy.cn Trojan:Win32/Gedanjo.A Trojan-Downloader.Win32.BHO.lff Trojan.Clicker.Win32.Undef.mi


The JHUHUGIT implant became a relatively popular first stage for the Sofacy attacks and was used again with a Java zero-day CVE-2015-2590 in July 2015.


These spam campaigns feature a multi-stage infection chain including a PDF file, a malicious Microsoft Office document, and finally, the Jaff ransomware loader.


Indicators of the malware used in two bank heist against Tienphong Commercial Bank in Vietnam and the Bangladesh central bank.


A backdoor also known as: RiskWare.Tool.CK Win32.Trojan.WisdomEyes.16070401.9500.9947 Trojan.Win32.Clicker.8989 TrojWare.Win32.Patched.KSU Trojan.DownLoader.5848 BehavesLike.Win32.Ramnit.xc TR/Dldr.Hup.UH.15.B Win32.Troj.download.kcloud Trojan.Dropper/Packed


The delivery document also saved the post-exploitation credential harvesting tool known as Mimikatz, which we believe the threat actors will use to gather account credentials from the compromised system.


A backdoor also known as: Trojan.Standardtest.17104 Win32.Trojan.WisdomEyes.16070401.9500.9983 Win32/Tnega.FJZCPHC Win.Trojan.Standardtest-1 Trojan.Win32.StandardTest.cthmar Win32.Trojan.Standardtest.Dvpy TrojWare.Win32.StandardTest.A Trojan.Win32.StandardTest TR/StandardTest.0 Trojan.Razy.D1D493 Trojan:Win32/StandardTest.0 Trojan/Win32.Kazy.C224799 Trojan.Kazy!M40EV8PiuTc Win32/Trojan.b42


A backdoor also known as: Trojan.MalPack Ransom_Blocker.R011C0RB618 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.FakeAV Win.Trojan.Emotet-6441079-0 Trojan-Ransom.Win32.Blocker.krar Trojan.Win32.Encoder.exomzo Trojan.Win32.Z.Zusy.183296.BS TrojWare.Win32.Ransom.GandCrypt.A Trojan.Encoder.24475 BehavesLike.Win32.PWSZbot.cc Trojan.Win32.Crypt Trojan.Blocker.ier TR/Crypt.ZPACK.hwjhn Trojan.Zusy.D42FEC Trojan-Ransom.Win32.Blocker.krar TrojanProxy:Win32/Bunitu.Q!bit Trojan/Win32.Magniber.R219494 W32/Injector.DVHR!tr Win32/Trojan.ff4


The FireEye as a Service team detected independent phishing campaigns conducted by two Chinese advanced persistent threat APT groups that we track, APT3 and APT18.


A backdoor also known as: W32.FamVT.HllpHQc.Trojan Win32.HLLP.DeTroie.A HLLP.DeTroie Win32.HLLP.DeTroie.A Virus.DeTroie.Win32.8 W32/HLLP.DeTroie.a Win32.HLLP.DeTroie.A Win32.Worm.DeTroie.b W32/HLLP.Detroie.A W32.HLLP.DeTroie Win32/DeTroie.D WORM_DETROIE.A Win.Trojan.DeTroie-1 Virus.Win32.HLLP.DeTroie Win32.HLLP.DeTroie.A Virus.Win32.DeTroie.bbxbrd W32.HLLP.DeTroie.tnqA Virus.Win32.Hllp.aad Win32.HLLP.DeTroie.A Virus.Win32.HLLP.DeTroie.E Win32.HLLP.Cheval WORM_DETROIE.A BehavesLike.Win32.Cheval.tz W32/HLLP.Detroie.A Win32/HLLP.DeTroie W32.Hllp.Detroie Virus/Win32.HLLP.DeTroie Worm:Win32/Cheval.D Win32.Detroie.A Virus.Win32.HLLP.DeTroie Win32.HLLP.DeTroie.A Win32/HLLP.Detroie.D W32/Cheval.dr Virus.Win32.HLLP.DeTroie Win32/HLLP.DeTroie Win32.HLLP.DeTroie.C Virus.Win32.HLLP.DeTroie W95/HLLP.Detroie.E


A backdoor also known as: HW32.Packed.E0AE Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Yakes.vphb Trojan.Win32.Yakes.exslpy Trojan.Encoder.3976 BehavesLike.Win32.Downloader.kc Trojan.Win32.Crypt Trojan.Yakes.yvz TR/Crypt.ZPACK.rwser Trojan.Win32.Yakes.vphb Trojan:Win32/Godzilia.B!bit Trj/GdSda.A W32/Kryptik.EYKI!tr


A backdoor also known as: W32.Spybot.Worm Win32.Stration Win32.HLLW.SpyBot Worm/Spyboter.44064 P2P-Worm.Win32.SpyBot.gl!IK P2P-Worm.Win32.SpyBot.eu


Visiting the main page hosted at www.president-office.gov[.]mm triggered the malicious content, as the threat actors injected an inline frame IFRAME into a JavaScript file used by Drupal for the site's theme.


This campaign started in April 2017, using a spear phishing campaign to deliver the MICROPSIA payload in order to remotely control infected systems.


A backdoor also known as: W32.OngameJFT.Trojan Application.Hacktool.CX Worm/W32.AutoRun.11656 RiskTool.Win32.Tcpz!O Risktool.Tcpz W32/AutoRun.ezt W32/Spybot.QYN Hacktool.Rootkit Win32/Tcpz.A Win.Trojan.B-285 Application.Hacktool.CX not-a-virus:RiskTool.Win32.Tcpz.a Application.Hacktool.CX Trojan.Win32.SdBot.hjuf Application.Hacktool.CX TrojWare.Win32.Trojan.TCPZ.~A Rootkit:W32/Tcpz.A Tool.TcpZ Backdoor.IRCBot.Win32.17564 Backdoor.Win32.IRCBot W32/Spybot.XPIF-6513 W32.Hack.Tool Application.Hacktool.CX Worm.AutoRun/Variant not-a-virus:RiskTool.Win32.Tcpz.a HackTool:WinNT/Tcpz.A Trojan/Win32.Rootkit.C53179 Rootkit.Win32.Drucker Hacktool/Tcpz.A HackTool.Tcpz!rBSvpdUKEZI W32/Tcpz.A!tr Win32/Worm.AutoRun.750


This report records the analysis and tracing process of the entire incident.


A backdoor also known as: W32.FakeW7Folder.Fam.Trojan Trojan.Win32.Scar!O Trojan.Scar Troj.W32.Scar.toQM Win32.Trojan.VB.ac WORM_OTORUN.SM0 Trojan.Win32.Scar.lpco Trojan.Win32.Scar.crgjex TrojWare.Win32.WBNA.THR Trojan.MulDrop3.10901 WORM_OTORUN.SM0 BehavesLike.Win32.VBObfus.lt Worm.Win32.VB Worm/WBNA.hgwu Trojan/Win32.Scar Win32.Troj.Scar.fw.kcloud Trojan.Symmi.DFA6A Trojan.Win32.Scar.lpco Trojan:Win32/Tookibe.B!bit HEUR/Fakon.mwf TScope.Trojan.VB Trj/GdSda.A Win32/VB.OGG Win32.Trojan.Scar.Wqms W32/VB.QHS!tr Win32/Trojan.e82


Casinos and resort hotels are the most recent victims of an attack that used RawPOS, an old POS malware, to steal customer data.


Since mid-July 2015, I've noticed an increase in malicious spam malspam caught by my employer's spam filters with java archive .jar file attachments.


A backdoor also known as: Trojan.Staget.bz W32/Trojan2.NIBK Trojan.Startpage W32/Staqet.B Win32.TRCrypt.Fkm Win.Trojan.Staget-7 Trojan.Win32.Staget.bz Trojan.Staget!Y7ZdgRV9k0Q TrojanBanker.Banker.tx TrojanDownloader:Win32/Kotibu.A Trojan/Win32.VB W32/Trojan2.NIBK Trojan.Staget.bz Trojan.Startpage!rem Win32/VB.PBM Trojan.Kotibu!447E Trojan.Win32.Staget W32/VB.ABBL!tr.dldr Trj/StartPage.DAW


In total, it appears this threat may have impacted users from 18 countries including China, France, Russia, Japan, United Kingdom, United States, Canada, Germany, Australia, Israel, Italy, Spain, Singapore, and South Korea.


A backdoor also known as: Trojan.Win32.DownLoad1.dddutq TrojWare.Win32.Downloader.Delf.frgf Trojan.DownLoad1.22694 Downloader.Delf.Win32.47996 BehavesLike.Win32.Dropper.bm Trojan-Dropper.Delf TrojanDownloader:Win32/Parkchicers.C Trojan.Graftor.D35402


They are interested in users of remote banking systems RBS, mainly in Russia and neighbouring countries.


This blog post describes an attack campaign where NIC National Informatics Centre Cyber Security themed spear phishing email was used to possibly target Indian government organizations.


Instead of the normal modus operandi phishing attacks or drive-by downloads that lead to automatic execution of ransomware, the attackers gained persistent access to the victim's network through vulnerability exploitation and spread their access to any connected systems that they could.


Duuzer is a well-designed threat that gives attackers remote access to the compromised computer, downloads additional files, and steals data.


A backdoor also known as: Backdoor.PePatch.Win32.12525 Win32.Trojan.WisdomEyes.16070401.9500.9959 TROJ_PINCAV.SME Trojan.Win32.Pincav.bbbvr Trojan.Packed.149 TROJ_PINCAV.SME BehavesLike.Win32.VirRansom.cc Worm/Kapucen.ce TrojanDropper:Win32/Bablo.B Worm/Win32.Drefir.R30526 Trojan.DR.Bablo!ESXrt1Se74g Trojan-Dropper.Win32.Bablo W32/Packcav.PLK!tr


It is notable that NetWire was also used as a payload in that campaign.


CVE-2017-0199 Used as Zero Day to Distribute FINSPY Espionage Malware and LATENTBOT Cyber Crime Malware


A backdoor also known as: W32.FamVT.WinSecND.Trojan Trojan.Win32.Winsecsrv.h Trojan.Win32.Winsecsrv.ebicpl TrojWare.Win32.Winsecsrv.B Trojan.Win32.Winsecsrv Trojan.Winsecsrv.ll TR/Taranis.2428 Trojan/Win32.Winsecsrv.h Trojan:Win32/Winexert.C!bit Trojan.Winsecsrv.1 Trojan.Win32.Winsecsrv.h Trojan/Win32.Dynamer.R176993 Win32.Trojan.Winsecsrv.Wwoi


A backdoor also known as: Trojan.Graftor.D48EFA Trojan.DownLoader25.1955 W32/Trojan.HNMY-5442 TrojanSpy:MSIL/Hoetou.AC Trj/GdSda.A Win32/Trojan.efe


A backdoor also known as: TrojWare.Win32.Hadoc.AS BehavesLike.Win32.Dropper.dh Trojan.Win32.Rimecud TrojanSpy.AutoHK.a Trojan:Win32/Hadoc.A Trojan/Win32.Asprox.R130565 TrojanSpy.AutoHK Win32/Spy.AHK.E Win32/Trojan.bc3


A backdoor also known as: W32.FamVT.VBCloneAATTc.Worm Trojan.VBClone.S500460 Trojan/VBClone.b Win32.Adware.Kryptik.h Trojan.Dropper Trojan.Win32.VB.cuvt Trojan.Win32.VB.dwthyt TrojWare.Win32.VBClone.CUV Trojan.VbCrypt.250 BehavesLike.Win32.VBObfus.qz Trojan.Crypt Trojan/VB.czdk Trojan/Win32.VB.cuvt Troj.W32.VB.tnqI Trojan.Win32.VB.cuvt TScope.Trojan.VB Win32/VBClone.B


A backdoor also known as: Trojan.Small.15973 Win32.Trojan.WisdomEyes.16070401.9500.9775 Trojan.Dropper TROJ_MICROJOIN.W Trojan.Win32.Small.dpzper TrojWare.Win32.TrojanProxy.Puma.jsjk Trojan.Celln TROJ_MICROJOIN.W Trojan-Proxy.Win32.Puma Trojan:Win32/Ditul.B Trojan.Heur.RP.ciWfayCj9ogb Trojan/Win32.Xema.C32762


A backdoor also known as: TrojanDownloader.Iterign.B3 Trojan.Win32.FAUL.exlexh Packed:MSIL/SmartIL.A BehavesLike.Win32.Trojan.dc TR/Dropper.MSIL.hxupg Trojan.Razy.D1E910 TrojanDownloader:MSIL/Iterign.B Trojan/Win32.ZBot.R139607 Trj/GdSda.A


A backdoor also known as: Trojan.Win32.Disabler!O WORM_DISABLER.SM Win32.Trojan.WisdomEyes.16070401.9500.9981 W32.Glupzy.A WORM_DISABLER.SM Win.Trojan.Disabler-3 Trojan.Win32.Disabler.i Trojan.Win32.Disabler.beace TrojWare.Win32.Disabler.~A Trojan.Flashy BehavesLike.Win32.Downloader.qz Trojan/Win32.Disabler Troj.W32.Disabler.tnvR Trojan.Win32.Disabler.i Worm/Win32.IRCBot.R53504 Trojan.Disabler Win32/Disabler.I Trj/Flashy.B


In order to support network defenders,Fidelis Cybersecurity is offering a new, free data feed of verified indicators to support thedetection and mitigation of Pushdo.


The sample discussed was found during an incident response engagement in March 2017.


A backdoor also known as: Trojan.Lowzones.A6 Trojan.Zzinfor.1 Trojan.Win32.Dwn.dndeiz TrojWare.Win32.Zzinfor.KQ Trojan.DownLoader12.14740 Trojan.Win32.Spy Adware.Zzinfor/Variant Dropper/Win32.Injector.C189960


A backdoor also known as: Trojan.PWS.ZER Troj.Pws.Zer!c Trojan.PWS.ZER Win32.Trojan.WisdomEyes.16070401.9500.9954 Trojan.Bitterbug Trojan.PWS.ZER Trojan.PWS.ZER Trojan.PWS.ZER BehavesLike.Win32.Dropper.ch TR/PSW.ZER Backdoor:Win32/Saluchtra.B!dha Spyware.Infostealer.FakeMS Win32.Trojan.Psw.Liqs Trojan.Bitterbug! Trojan.Win32.Bitterbug Trojan.PWS.ZER


One would think that this would result in widespread use, but instead it has only been found in limited areas.


This malvertising attack preyed on visitors to sketchy websites offering anything from torrents of copyrighted movies, live streams of the latest flicks, or pirated software.


Very active, we can now see ~ 50k live scanner IPs daily.


Android ransomware that claims it has detected forbidden pornographic pictures on your device, says it has reported it to the FBI and asks you to pay a fine of $500.


A backdoor also known as: TrojanDropper.Gepys.A Trojan.Kryptik.Win32.524542 Trojan/Kryptik.banx Win32.Trojan.Kryptik.eg Trojan.Win32.Redirect.ctxvfh TrojWare.Win32.Kryptik.BANN Trojan.Redirect.147 Trojan/ShipUp.km Trojan/Win32.Unknown Trojan:Win32/Gepys.A Trojan.Zusy.D404B9 Trojan/Win32.Shipup.R65212 Trojan-Downloader.Win32.Dofoil


A backdoor also known as: HW32.Packed.BCC5 W32.Virut.G Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Foreign-502 Trojan.DownLoader11.60294 BehavesLike.Win32.Sality.cc Win32.Virut.eb.368640 Trojan/Win32.Foreign.R131573 Trojan-Ransom.Win32.Foreign


A backdoor also known as: Trojan.Strictor.D2148 Win32.Trojan.WisdomEyes.16070401.9500.9567 Trojan-Downloader.Win32.Perkesh HackTool[VirTool]/Win32.Unknown


The exploit was delivered through a Microsoft Office document and the final payload was the latest version of FinSpy malware.


A backdoor also known as: W32.DomytnxASAAAC.Trojan Trojan.Locky.Win32.658 Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Trojan.KGRA-2902 Ransom_HPLOCKY.SM4 Trojan-Ransom.Win32.Locky.aoc Trojan.Win32.Encoder.eemdlz Trojan.Win32.Locky.288947 Troj.Ransom.W32.Locky!c Trojan.Encoder.3976 Ransom_HPLOCKY.SM4 BehavesLike.Win32.MultiPlug.cc Trojan.Locky.aqx Trojan[Ransom]/Win32.Locky Trojan.Mikey.DC99C Trojan-Ransom.Win32.Locky.aoc TrojanDownloader:Win32/Terdot.A Trojan/Win32.Locky.C1503881 Trojan-Ransom.Locky Trj/CI.A W32/Bebloh.K!tr Win32/Trojan.Ransom.2d2


MalwareBytes have been monitoring a malvertising campaign very closely as it really soared during the past week.


With this information, an attacker can access a user's Google account data like Google Play, Google Photos, Gmail, Google Drive, and G Suite.


A backdoor also known as: VBA/PowerShell.A Win.Trojan.PowerShell-8 Trojan.Ole2.Vbs-heuristic.druvzi TrojanDownloader:O97M/Poseket.A HEUR.VBA.Trojan.e heur.macro.powershell.a


A backdoor also known as: TR/Spammer.Z Trojan.Win32.Spammer.BZ Trojan.SpamTool SpamTool.KEM Trj/CI.A Win32/Trojan.Spammer.4de


The Executive Yuan Council evaluates statutory and budgetary bills and bills concerning martial law, amnesty, declaration of war, conclusion of peace and treaties, and other important affairs.


Recently, we've seen information indicating that the scope of targets can be wider and is no longer limited to the entertainment business.


This blog will discuss and uncover additional details regarding a recent campaign targeting entities in the Middle East.


A backdoor also known as: HackTool.Inject!QFG7kQRUHDk Trojan.VBInject!4947 Malware_fam.NB Skodna.GameHack.CXD Trj/CI.A


A backdoor also known as: W32.FOverND.PE Virus.Win32.Sality!O W32.Sivis.A3 Backdoor.Poison.Win32.87654 Trojan/Kryptik.gace W32.Suviapen Packed.Win32.Krap.jc Trojan.Win32.Kespo.evacni Win32.HLLP.Kespo.4 BehavesLike.Win32.Trojan.vh Packed.Krap.fzmh Trojan[Packed]/Win32.Krap Packed.Win32.Krap.jc Trojan-Ransom.Rokku RAT.Sakula


A backdoor also known as: Trojan.Arande.A3 Win32.Worm.VB.nr Trojan.Win32.VB.dibs Win32.Trojan.Vb.Wnwj Trojan.VB.Win32.116507 Trojan/VB.cujo W32.Heuristic.Dkvt TR/Taranis.2367 Trojan.Heur.E914A2 Trojan.Win32.VB.dibs Trojan/Win32.VBKrypt.C956342 Trojan.VB!SXP1KraqrZw Trojan.VB2


A backdoor also known as: Trojan.Trupto TROJ_INJECTR.BUSZ Trojan.Win32.Buzus.yhkt Trojan.Win32.Buzus.ewiofb TROJ_INJECTR.BUSZ Trojan.Win32.Crypt W32/Trojan.ALBD-0280 Trojan.Buzus.cni Trojan:Win32/Trupto.A Trojan.Win32.Buzus.yhkt Trj/CI.A Win32.Trojan.Inject.Auto


To distribute the Trojan, cybercriminals log in to the vulnerable devices via the SSH protocol.


Proofpoint researchers originally spotted the MarsJoke ransomware in late August by trawling through our repository of unknown malware.


A backdoor also known as: W32.ReplaceMiKsLT.Fam.RSF Trojan-PWS/W32.Frethoq.34461.C Trojan-GameThief.Win32.Frethoq!O TrojanPWS.Lolyda.BF5 Troj.GameThief.W32.OnLineGames.lnFT Trojan/OnLineGames.qbf TROJ_RVERSE.SMI Win32.Trojan-PSW.OLGames.i TROJ_RVERSE.SMI Win32.Trojan-Spy.Lolyda.A Trojan-GameThief.Win32.OnLineGames.ajqgf Trojan.Win32.Gamania.thvvt Trojan.Win32.A.Zbot.34461 Trojan.PWS.Gamania.36445 BehavesLike.Win32.PWSOnlineGames.nh TR/PSW.Lolyda.bfmna Trojan[GameThief]/Win32.Frethoq PWS:Win32/Lolyda.BF Trojan-GameThief.Win32.OnLineGames.ajqgf Trojan/Win32.OnlineGameHack.R21894 BScope.Trojan.OLGames.4521 Trojan.Zusy.DBE3 Win32/PSW.OnLineGames.QBF Trojan.PSW.Win32.GamePass.a Trojan.PWS.OnLineGames!V9usvrFPqu0 Trojan-PWS.Win32.Lolyda W32/OnLineGames.REV!tr Trojan.PSW.Win32.GameOnline.CO


The group is known to use custom malware called Daserf, but also employs multiple commodity and custom tools, exploit vulnerabilities, and use social engineering techniques.


Its targets include the military organizations and governments of countries with national interests in the South China Sea, including some within the U.S. defense industrial base.


A backdoor also known as: Trojan.Noancooe MSIL.Backdoor.Bladabindi.AM TR/Nanocore.dfari Trojan:MSIL/Noancooe.D!bit Trj/CI.A Worm.Win32.Ainslot


A backdoor also known as: Trojan/W32.Sasfis.4023296 Trojan/Sasfis.bnyn Trojan.Strictor.DEB1C Win32.Trojan.WisdomEyes.16070401.9500.9554 Backdoor.Graybird Win.Trojan.Yobdam-4 Trojan-Dropper.Win32.Dapato.bwsw Trojan.Win32.Sasfis.diovf Trojan.MulDrop2.58470 Backdoor.Yobdam.Win32.845 BehavesLike.Win32.BadFile.wc Trojan/Buzus.awfr Trojan/Win32.Sasfis Trojan-Dropper.Win32.Dapato.bwsw Trojan/Win32.Injector.C1773 SScope.Trojan.MBRLock.2121 Trojan.Sasfis!aSW+l8me7nU


YOUR FILES WERE ENCRYPTED.


A backdoor also known as: Infostealer.Lineage Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Nilage.XS Infostealer.Lineage Trojan-GameThief.Win32.Nilage.bdm W32.W.Bagle.kZt7 Trojan.PWS.Lineage.9841 BehavesLike.Win32.Pate.pc Trojan-PWS.Win32.Delf W32/Nilage.KWZM-6493 Trojan/PSW.Nilage.auz Trojan[GameThief]/Win32.Magania Trojan-GameThief.Win32.Nilage.bdm Trojan/Win32.OnlineGameHack.R24518 PWS-Gamania.dll Infostealer.Lineage MalwareScope.Trojan-PSW.Game.13 Trojan.PWS.Nilage!v/lUmVrQ3Ac


According to X-Force research, the new banking Trojan emerged in the wild in September 2017, when its first test campaigns were launched.


The focus of this blog post is MiKey, a little-known and poorly detected keylogger.


This post will use the PlugX malware as an example PlugX is well known and has had its various iterations analyzed many times, due in part to its ongoing activity and will focus on leveraging metadata from VirusTotal due to it being publicly accessible.


A backdoor also known as: HW32.Packed.5FA3 Trojan.Glox Infostealer.Gampass Packed.Win32.MUPACK.~KW BehavesLike.Win32.Spybot.dc Trojan/Win32.ADH Trj/Pupack.A Win32.Trojan.Xed.Dzkj


Maktub Locker is another ransomware that comes with a beautifully designed GUI and few interesting features.


A backdoor also known as: Packed.Win32.CPEX-based!O Trojan.Delfinject.16926 PWS-LDPinch.a!hv Trojan.Buzus.Win32.2199 Trojan/Buzus.rrb TROJ_FAM_0001199.TOMA Win32.Trojan.WisdomEyes.16070401.9500.9967 Win32/Lunibot.B TROJ_FAM_0001199.TOMA Win.Trojan.Buzus-2288 Packed.Win32.CPEX-based.eq Trojan.Win32.CPEXbased.bejytp Trojan.Win32.Buzus.374868 Win32.Trojan.Dovqplay.clht TrojWare.Win32.TrojanDropper.Binder.G BackDoor.Poison.61 BehavesLike.Win32.SoftPulse.tc Virus.Win32.DelfInject W32/Trojan2.CYTZ Trojan/Buzus.puv Trojan[Packed]/Win32.CPEX-based Backdoor:Win32/Mielit.A Packed.Win32.CPEX-based.eq Trojan/Win32.Xema.R44960 BScope.Binder.Buzus.er W32/Buzus.BZ.worm VirTool.DelfInject!GapcEdmyxw8 W32/Injector.fam!tr


A backdoor also known as: W32.XinarilD.Trojan Trojan.Zusy.D26766 Trojan.Win32.Zusy.exkztw W32/Trojan.HJTJ-8943 Trojan/Scar.bmgw TR/Zusy.2726400 Trojan:Win64/SvcMiner.A Trojan.Win32.Z.Zusy.2726400.CY Backdoor.Bot Trj/CI.A Trojan.Scar!zCrXbtgxLOk Win32/Trojan.e88


In this post, we will focus on the mobile part of their operation and discuss in detail several Android and BlackBerry apps they are using.


Unit 42 researchers identified a new OS X Trojan associated with the Sofacy group that we are now tracking with the Komplex' tag using the Palo Alto Networks AutoFocus threat intelligence platform.


We are accustomed to seeing this gate operate directly from typical' compromised websites, but not so much from ad serving ones.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9959 Trojan.Win32.Yuzi.euhfho Backdoor.Yuzi W32/Trojan.UPLJ-0202 BDS/Yuzi.lbwpa Trojan.Win32.Z.Ursu.91648 Backdoor:MSIL/Yuzi.A Trj/GdSda.A Win32/Trojan.fd2


In addition to Russia, targeted regions include neighboring countries such as Mongolia, Belarus, and other European countries.


A backdoor also known as: Trojan.Klevate.S3 Trojan.Webprefix.Win32.62419 Trojan.Dropper.104 Win32.Trojan.Webprefix.a W32/WebPrefix.A Trojan.Win32.Webprefix.crgiyt Backdoor.W32.Androm.mCpQ TrojWare.Win32.Sisron.C BackDoor.Bulknet.1328 BehavesLike.Win32.Trojan.cc W32/Application.KRYM-8973 TrojanDownloader.Klevate.a Win32.Trojan-Dropper.Dlpro.A Trojan/Win32.Zbot.R94414 Win32/Webprefix.D W32/Webprefix.B!tr Trj/CI.A


It is therefore impossible to decode the communication if one wasn't listening right from its beginning.


A backdoor also known as: Trojan-Banker.Win32.BHO!O Win32.Trojan.WisdomEyes.16070401.9500.9988 Backdoor.Ratenjay Trojan-Downloader.Win32.VB.ifws Trojan.DownLoader5.54023 Trojan.Kazy.DE581 Trojan-Downloader.Win32.VB.ifws Downloader/Win32.Banload.C62226 Trojan-Downloader.Win32.Bancos


So , what can you do to protect yourself from this stealthy beast ? 1 .


A backdoor also known as: W32/HLLW.Std.B Worm/STD.B W32/Std.18437 Win32/HLLP.Std.B Worm.STD.A I-Worm.STD.B.nw5 Email-Worm.Win32.STD.B I-Worm/STD.b Email-Worm.Win32.Std.B W32/HLLW.Std.B


The end payload that was installed is the HttpBrowser RAT, known to be used by the Chinese group in previous targeted attacks against governments.


This Trojan is interesting due to its ability to steal logins, passwords, and other confidential data by displaying fraudulent authentication forms on top of any applications.


It appears the purpose of the new Disttrack samples were solely focused on destruction, as the samples were configured with a non-operational C2 server to report to and were set to begin wiping data exactly on 2016/11/17 20:45.


Kazuar includes a highly functional command set, which includes the ability to remotely load additional plugins to increase the Trojan's capabilities.


A backdoor also known as: W32.FakeSvchostsysLnrA.Trojan Win32.Trojan.WisdomEyes.16070401.9500.9849 Trojan.Win32.Downloader.40960.TR Trojan.Win32.Swisyn W32/Trojan.UTND-0495 Downloader/Win32.OnlineGameHack.R3893 Trj/CI.A


However, many of these malware are fileless only while entering a user's system, as they eventually reveal themselves when they execute their payload.


A backdoor also known as: Trojan.Skeeyah.9109 Trojan.Injector BKDR_RMTSVC.V W32/Trojan.FQOB-6520 BKDR_RMTSVC.V Trojan.Win32.Pincav.darg Trojan.Win32.Pincav.dmwojx Troj.W32.Pincav!c Trojan.Inject1.50635 Trojan.Pincav.Win32.24903 BehavesLike.Win32.Dropper.gc Trojan.Pincav.um Trojan.Win32.Pincav.darg Backdoor:Win32/Rmtsvc.C!bit Trojan.Pincav Win32.Trojan.Pincav.Akpm Trojan.Pincav!MRbJOfrjW/0 Backdoor.Win32.RmtSvc W32/Pincav.B!tr Win32/Trojan.84c


A backdoor also known as: Backdoor.Hupigon.Win32.133953 Win32.Trojan.WisdomEyes.16070401.9500.9985 W32/QQRob.LP Trojan.PWS.QQPass Win32/AdClicker.UB Backdoor.Win32.Hupigon.olbg Trojan.Win32.Hupigon.eajxbh Trojan.PWS.Qqrobber.155 trojan.win32.dorv.a PWS-Gamania.dll W32/QQRob.TWJB-5358 Trojan/PSW.QQRobber.iu DR/PSW.QQRob.V.2 Trojan[Backdoor]/Win32.Hupigon Trojan.Heur.PT.E044E0 Trojan/Win32.Pwstealer.C63180 PWS-Gamania.dll Win32/PSW.QQRob.NAH Backdoor.Win32.Hupigon Win32/Cekar.G Trj/CI.A


As spotted by FireEye on 2015-04-17, Angler EK is now taking advantage of a vulnerability patched with the last version of Flash Player 17.0.0.169


In the first of our series on the dark web, Cyble uncovered a new strain of InfoStealer malware targeting Cryptocurrency users via phishing sites and YouTube channels, as well as the source code and GitHub repository.


In April 2017, the Cisco Talos team disclosed the Scarcruft group's proprietary tool, ROKRAT, a malware that has been continuously modified and used by the group to this day.


Its malicious code is located in a Mach-O object file that was repackaged into some versions of Xcode installers.


A backdoor also known as: Backdoor.Win32.VB!O TROJ_GE.C2A90427 Multi.Threats.InArchive W32/Rewdulon.A TROJ_GE.C2A90427 Win.Trojan.Dentenspy-1 Trojan.Win32.VB.pbucu Trojan.WinSpy.1721 Trojan.VB.Win32.74988 W32/Rewdulon.RWFU-0950 TrojanSpy.VB.eqx TR/Proxy.VB.mm Trojan[Proxy]/Win32.VB Backdoor:Win32/Rewdulon.A Trojan.Heur.VP2.EA6021 Trojan/Win32.Winspy.R17397 TrojanProxy.VB Win32/Spy.VB.NPF Trojan.PR.VB!L9iJM/+WFQY Trojan-Proxy.Win32.VB Trj/CI.A


A backdoor also known as: Android.Trojan.FakeInst.L Android.FakeNotify.A Android.Trojan.FakeInst.L Android.Trojan.FakeInst.L HEUR:Trojan-SMS.AndroidOS.Opfake.bo A.H.Pay.Emugo.L Trojan.Android.Opfake.dtqjss Android.Malware.Trojan Trojan:Android/FakeNotify.A Trojan[SMS]/Android.Opfake Android.Trojan.FakeInst.L HEUR:Trojan-SMS.AndroidOS.Opfake.bo Android-Trojan/SmsSend.837f Trojan.AndroidOS.FakeInst.D Trojan.AndroidOS.MalCrypt


A new spear phishing campaign is targeting Saudi Arabia governmental organizations.


A backdoor also known as: Trojan.Graftor.D25EAD Win32.Trojan.WisdomEyes.16070401.9500.9841 Backdoor.Trojan BKDR_SMALL.W Win.Trojan.Coreshell-1 Trojan.Win32.Metlar.hmosd Trojan.Click2.7627 BKDR_SMALL.W BDS/Metlar.A Backdoor:Win32/Metlar.A W32/Small.W!tr.bdr


A backdoor also known as: W32.Blackmail.Worm Win32.Worm.Killav.GR Worm/W32.Nyxem.65024.B Email-Worm.Win32.Nyxem!O Worm.Nyxem W32/MyWife.d@MM!M24 W32/VB.bi WORM_NYXEM.E Win32.Worm.VB.sy W32/Kapser.A@mm W32.Blackmal.E@mm Win32/Blackmal.F!CME24 WORM_NYXEM.E Win.Worm.Nyxem-7 Email-Worm.Win32.Nyxem.e Win32.Worm.Killav.GR Trojan.Win32.Nyxem.wcrgf W32.W.Nyxem.lNe6 Win32.Worm-email.Nyxem.Syhr Win32.Worm.Killav.GR Worm.Win32.VB.NEI Email-Worm:W32/Nyxem.E BehavesLike.Win32.Worm.kc W32/Kapser.KOCX-1196 I-Worm/VB.g WORM/KillAV.GR Worm[Email]/Win32.Nyxem Worm:Win32/Mywife.E@mm!CME24 Win32.Worm.Killav.GR I-Worm.Win32.Nyxem.E Win32.Worm.Killav.GR Worm/Win32.Nyxem.R67250 Win32.Worm.Killav.GR Email-Worm.VB Win32/VB.NEI Worm.P2P.VB.CIL!CME-24 Win32.Worm.Killav.GR W32/Nyxem.E@mm W32/Tearec.A.worm!CME-24 Trojan.Win32.KillAV.AG


A backdoor also known as: AIT:Trojan.Nymeria.219 Trojan.Fsysna AIT:Trojan.Nymeria.219 W32/Trojan.KHZX-2886 Trojan.Win32.Fsysna.epqb AIT:Trojan.Nymeria.219 Trojan.Win32.Fsysna.eusaby AIT:Trojan.Nymeria.219 AIT:Trojan.Nymeria.219 Trojan.Fsysna.Win32.15287 Trojan.Win32.Autoit TR/Fsysna.vdzaj AIT:Trojan.Nymeria.219 Trojan.Win32.Fsysna.epqb Trojan:Win32/Enotdap.A Trojan/Win32.Fsysna.C2239375 Trj/CI.A Win32.Trojan.Fsysna.Iiu W32/Autoit.CK!tr.spy Win32/Trojan.623


In April, the new Infostealer family of Spanish origin was first noted targeting users in the U.S. and Mexico.


The operation uses known and patched exploits to deliver a custom backdoor known as KeyBoy.


The variant is highly targeted, digitally signed, and exfiltrates stolen payment card data over DNS.


A backdoor also known as: Trojan.Dropper.Snuff.A Win32.TrojanDropper.Snuff.A.2 Trojan/Dropper.FC.a Trojan.DR.FC!ID4WOR5KQxg Win32/TrojanDropper.FC.A Backdoor.Trojan.dr W32/FC.Y Win32/TrojanRunner.I TROJ_DROPPER.ACU Win32.TRFC.A Trojan-Dropper.Win32.FC.a Trojan.Dropper.Snuff.A Virus.Win32.Trojano.421!IK TrojWare.Win32.TrojanDropper.FC.A Trojan.Dropper.Snuff.A BackDoor.Bifrost.14965 TR/FC.A TROJ_DROPPER.ACU TrojanDropper.Win32.FC TrojanDropper:Win32/Snuff.A Trojan.Win32.FC.21040 Trojan.Dropper.Snuff.A Dropper/FC.4096 Trojan-Dropper.Win32.FC.a Backdoor.Trojan Harm.SysCrash Virus.Win32.Trojano.421 W32/Fc.A!tr Dropper.Tiny.K Trj/MultiDrp.AF


A backdoor also known as: Trojan.Mauvaise.SL1 Trojan.Zusy.D3A031 Trojan.Kwampirs TROJ_KWAMPIRS.SMJK Trojan.Win32.Bedep.az TROJ_KWAMPIRS.SMJK BehavesLike.Win32.BadFile.dm Trojan.Win32.Kwampirs Trojan.Bedep.u TR/Crypt.ZPACK.sfqtf Trojan.Win32.Bedep.az Trojan/Win32.Bedep.R199961 Trojan.Bedep Trojan.Injector Trj/GdSda.A


From these reports, we know that the group uses an abundance of tools and tactics, ranging across zero-day exploits targeting common applications such as Java or Microsoft Office, heavy use of spear-phishing attacks, compromising legitimate websites to stage watering-hole attacks, and targeting over a variety of operating systems – Windows, OSX, Linux, even mobile iOS.


A backdoor also known as: W32.HfsAutoB.4D03 Trojan.Zenshirsh.SL7 Win32.Trojan.WisdomEyes.16070401.9500.9639 Trojan.Win32.TPM.eslggg BehavesLike.Win32.PWSZbot.cc Trojan.Heur.RP.ZyWaayyb2wki Trojan.Win32.Z.Ircbot.839168.A Win32.Trojan.Crypt.Hqux Trojan.Themida! Trojan-PWS.OnlineGames Trj/CI.A


A backdoor also known as: Trojan-Downloader.Win32.Gamarue.2!O Win32.Trojan.WisdomEyes.16070401.9500.9999 BKDR_PROTUX.SMZKEB-G Trojan.Win32.RedCap.exxfqg Trojan.Win32.Z.Zusy.8916480 Trojan.MulDrop7.62734 Trojan.Banbra.Win32.27829 BKDR_PROTUX.SMZKEB-G W32/Trojan.CPEN-4136 TR/RedCap.xslwz Trojan.Symmi.D1461E Trojan/Win32.Comnie.R209069 Trojan.Drnohell Trj/CI.A


A backdoor also known as: Trojan/W32.Bublik.274432.B Backdoor.Win32.Caphaw Trojan.Symmi.D1465 Win32.Trojan.WisdomEyes.16070401.9500.9995 W32/Trojan.ELRU-2307 Trojan.Win32.Caphaw.exkhwo Trojan.Win32.A.Bublik.274432.D BackDoor.Caphaw.2 BehavesLike.Win32.PWSZbot.dh Trojan.Win32.Bublik Trojan/Bublik.ank Backdoor:Win32/Caphaw.D Trojan/Win32.Bublik.R46085 Backdoor.Win32.Caphaw SScope.Backdoor.Caphaw.A Win32/Trojan.144


A backdoor also known as: Trojan.Fifesock W32.W.Otwycal.l4av Net-Worm.Win32.Koobface Spammer:Win32/Fifesock.B Win32/RiskWare.PEMalform.E Win32/Trojan.c9e


A backdoor also known as: W32.RansomGimemoB.Trojan Trojan.Win32.Kazy!O Trojan.Qhost.Win32.6280 Trojan.Kazy.D7BDE9 Win32.Trojan.WisdomEyes.16070401.9500.9903 Win32/Ternanu.C HV_ZYX_BG26035C.TOMC Trojan.Win32.Inject.sbpf Trojan.Win32.DownLoad2.brqxff Packer.W32.Krap.ldx7 Trojan.DownLoad2.39110 BehavesLike.Win32.Virus.dh Trojan-Ransom.Win32.Gimemo Trojan/Qhost.cty W32.Gimemo Trojan[Backdoor]/Win32.Delf Trojan/Win32.FakeAV.R10033 Trojan-Dropper.11705 Ransom.FileCryptor W32/Injector.HVQ!tr Trj/CI.A


We are not including the IP addresses from the C2 infrastructure since it is compromised infrastructure that is not longer in use


A backdoor also known as: Trojan.Dynamer.S488527 Trojan.Smallprox Trojan.Win32.Zusy.elolmi Trojan.Proxy2.577 TR/Proxy.mzyhy Trojan.Symmi.D11AD5 Win32/Trojan.1ff


A backdoor also known as: Trojan/W32.HackTool.18432.M Win32.Trojan.WisdomEyes.16070401.9500.9952 Hacktool.Notahproxy HackTool:Win32/Onaht.A Riskware.HackTool!NeLzDaI7P40 Malware_fam.NB Win32/Trojan.Hacktool.4e9


Examples included fake commercial suppliers or shipping companies sending an updated price list, banks asking customers to validate banking information, or confirmation of equipment delivery.


A backdoor also known as: Heur.Adware.FC.529 Trojan.Razy.D2449C Win32.Trojan.WisdomEyes.16070401.9500.9898 Riskware.Win32.Dotdo.ewnrxt Adware.Dotdo.25 Trojan.MSIL.Trojanproxy TR/Proxy.ulkkx Trojan:MSIL/Faikdal.A PUP.DotDo/Variant Adware.DotDo.DotPrx Trj/GdSda.A


A backdoor also known as: W32.OpaservA.Worm Net-Worm.Win32.Opasoft!O W32.OpaServ.A W32/Opaserv.worm.a WORM_OPASERV.A Win32.Worm.Opaserv.e W32/Opaserv.worm.A W32.Opaserv.Worm Win32/Opaserv.A WORM_OPASERV.A Win.Worm.OpaSoft-3 Net-Worm.Win32.Opasoft.a Trojan.Win32.Opasoft.wglh Worm.Win32.Opaserv Win32.Worm-net.Opasoft.Eeqs Win32.Opasoft Trojan.OpaKill.Win32.1 W32/Opaserv.worm.a Worm.Win32.Opasoft.A W32/Opaserv.worm.A Worm/Opasoft.a Worm[Net]/Win32.Opasoft Worm.Opasoft Net-Worm.Win32.Opasoft.a Worm:Win32/Opaserv.A Win32/Opasoft.worm.28672 Worm.Opaserv.AT W32/Opaserv.fam


The threat actors are reusing tools, techniques, and procedures which overlap throughout these operations with little variance.


This attack highlights how macro malware in Microsoft Office files is fast becoming a big threat to businesses and organizations.


A backdoor also known as: Heur.Corrupt.PE Trojan[Exploit]/Win32.CCProxyOver Exploit:Win32/Prix.A.dam#2


As reported, the source of the attack appears to have been the website of the Polish financial regulator.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9996 Trojan:MSIL/Bogoclak.A Trojan.MSIL.Lynx.3 Trj/GdSda.A Backdoor.MSIL MSIL/Stealors.NET!tr


Signing the malware with a stolen and subsequently publicly leaked code-signing certificate is sloppy even for well-known CN-APT groups.


Through correlation of technical indicators and command and control infrastructure, FireEye assess that APT28 is probably responsible for this activity.


A backdoor also known as: W32.Chiko.Worm Trojan/W32.StartPage.377856 Trojan.Win32.StartPage!O Worm.AutoRun W32.W.Fearso.kYUv WORM_SILLY.ICA Win32.Worm.Delf.cg W32.SillyFDC Win32/Chike.A Worm.Win32.AutoRun.ihn Trojan.Win32.StartPage.yqro Trojan.Win32.StartPage.377856 Trojan.StartPage.52501 Trojan.StartPage.Win32.1 Virus.Win32.Alman Trojan/StartPage.de TR/Delf.AKP Trojan/Win32.StartPage Win32.Virut.ce.57344 Trojan.Heur.ED91C9 Worm.Win32.AutoRun.ihn Worm:Win32/Chiki.A HEUR/Fakon.mwf TScope.Trojan.Delf W32/Chike.C.worm Win32/Delf.NFT Win32.Worm.Autorun.Pavh Trojan.StartPage!orHv1sw9Olo W32/StartPage.AJH!tr


A backdoor also known as: Backdoor.W32.Nethief.l7ro TrojWare.Win32.Packed.PNC BehavesLike.Win32.Backdoor.kc Trojan.Krypt.19 Trojan-Dropper.Delf Trj/CI.A Win32/Trojan.8cd


A backdoor also known as: Trojan.Inject.ASP Trojan.Inject.ASP Trojan.Inject.ASP Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Inject.ASP Trojan.Inject.ASP Trojan.Win32.Kryptik.evmmfw Trojan.Win32.Z.Inject.49664 Trojan.Inject.ASP Trojan.Inject.ASP Trojan.Crypt3 W32/Trojan.HLQX-0378 Backdoor:Win32/Deselia.B!dha Trojan/Win32.Kryptik.R153606 W32/ESILE.C!tr Script/Trojan.b13


Longhorn, which we internally refer to as The Lamberts first came to the attention of the ITSec community in 2014, when our colleagues from FireEye discovered an attack using a zero day vulnerability CVE-2014-4148.


A backdoor also known as: Trojan.Zusy.D2E557 Trj/GdSda.A


It is hardly surprising that there is an element of overlap, considering both actors have for years mined victims in the South China Sea area, apparently in search of geo-political intelligence.


BEBLOH always came up with new defensive measures to avoid AV products, and this time is no different.


A backdoor also known as: Trojan/Downloader.Banload.reo Win32.Trojan.WisdomEyes.16070401.9500.9590 Win.Trojan.Graftor-2494 Trojan.Win32.Graftor.cuifrv Trojan.Banker.Win32.94901 TR/Graftor.6930.12 Trojan.Graftor.D17FC TrojanDownloader:Win32/Bangkgrob.A Trj/CI.A TrojanSpy.Banker!0zttYTGMFlo Trojan-Downloader.Win32.Banload W32/Banker.ZZN!tr


That number is likely inflated, mainly because of dynamic IP allocation and historic records not being removed promptly.


A backdoor also known as: Trojan.Malruze Trojan.Win32.Z.Malruze.113664 Trojan:Win32/Malruze.A!gfc


A backdoor also known as: Trojan-Ransom.Win32.Birele!O Win32.Trojan.WisdomEyes.16070401.9500.9907 W32/Miner.UKCL-7487 W32/Miner.B Trojan.Win32.CoinMiner.pmp Trojan/Win32.Miner.C2255099


Recently, the Threat Monitoring System of QiAnXin Threat Intelligence Center monitored that a botnet written in GO language was spreading through multiple vulnerabilities.


The site is redirecting users to rgdotfoldersasapdotcom which is a RIG EK landing page that serves a malicious flash file and a malicious binary.


A backdoor also known as: W32.WintaskLTH.Trojan Worm.Psyokym.A3 W32.SillyFDC WORM_PSYOKYM.SM23 Trojan-Dropper.Win32.Sysn.bqcc Trojan.Win32.WBNA.ctgbxm Trojan.DownLoader5.33626 WORM_PSYOKYM.SM23 Worm.Win32.Psyokym WORM/Psyokym.A.34 Worm:Win32/Psyokym.A Trojan.Zusy.D393D Trojan.Win32.Downloader.189952.AV Trojan-Dropper.Win32.Sysn.bqcc HEUR/Fakon.mwf Worm.AutoRun!angV1RJQRlk W32/Virut.CE


For over half a decade, the Naikon APT waged multiple attack campaigns on sensitive targets throughout South-eastern Asia and around the South China Sea.


A backdoor also known as: Trojan.Zusy.D14EB5 Win32/Oflwr.A!crypt Win.Downloader.Boltolog-223 Win32.Application.PUPStudio.A Worm.Win32.Dropper.RA Trojan:W32/DelfInject.R BackDoor.BlackHole.20244 TR/Graftor.123479.4 Trojan:Win32/Semsubim.A Trojan.Wecod Win32/Trojan.Clicker.4d5


A backdoor also known as: HW32.Packed.CED3 Trojan.Zenshirsh.SL7 Trojan.Zusy.D13E0F Win32.Trojan.Kryptik.av Trojan.Win32.Emager.ngb Trojan.Win32.FKM.dsobxk Trojan.Win32.Z.Zusy.159744.AME Backdoor.W32.Hupigon.le6i TrojWare.Win32.BHO.NJYY Trojan.Packed.26400 BehavesLike.Win32.Backdoor.cc Trojan.Win32.Spy Trojan.Emager.ly W32.Infostealer.Zeus Win32.Troj.Undef.kcloud Trojan.Win32.Emager.ngb Trojan/Win32.Small.C10819 TScope.Malware-Cryptor.SB Trojan.Win32.Dropper.abe Trojan.Emager!


Unit 42 researchers at Palo Alto Networks have discovered new attack activity targeting individuals involved with United States defense contractors.


However, it should be noted that this was not an isolated incident: this is the latest in a series of similar attacks in Ukraine.


At the time, it was being distributed via both targeted email campaigns and exploit kits EKs.


A backdoor also known as: TrojanDropper.RAR W32/Trojan.WAHH-7616 Trojan.Win32.RAR.crvcdy Trojan.Win32.Z.Dropper.1318323 Trojan:MSIL/Ainslot.A Win32/PSW.Tibia.NGP


A backdoor also known as: Trojan.BypassUAC Exploit.Win32.BypassUAC.ihb Trojan.Win32.Tordev.exuhxz Exploit.W32.Bypassuac!c BackDoor.Tordev.976 Exploit.BypassUAC.Win32.1119 BehavesLike.Win32.Dropper.bc Trojan.Win32.Ekstak Exploit.BypassUAC.amp TR/Injector.otvkc Trojan[Exploit]/Win32.BypassUAC Trojan.Graftor.D71C73 Exploit.Win32.BypassUAC.ihb Backdoor:Win32/Rescoms.B Trojan/Win32.BypassUAC.C2399731 Exploit.BypassUAC Trj/CI.A Win32.Trojan.Inject.Auto Win32/Trojan.852


A backdoor also known as: TrojanDownloader.VB.z4 Trojan.VB.Win32.155172 Trojan/Dropper.StartPage.dzs Win32.Trojan.WisdomEyes.16070401.9500.9663 Trojan.Win32.VBKrypt TrojanDownloader:Win32/Swity.C Trojan.VB!g1fz4qjxDzc W32/VB.NTK!tr


A backdoor also known as: Trojan.SmokeLdr.A3 Trojan.Ransom.GlobeImposter Trojan.Injector TROJ_INJECT.AUSPTF Win32.Trojan.Injector.MH Trojan.Win32.Khalesi.bjm Trojan.Win32.Khalesi.exdymq Trojan.Win32.Z.Razy.286720.EN Trojan.Encoder.11539 TROJ_INJECT.AUSPTF BehavesLike.Win32.PWSZbot.dm Trojan-Ransom.GlobeImposter W32/Trojan.BXWF-8222 Trojan.Khalesi.jz TR/Kryptik.nopxu Trojan/Win32.Khalesi Trojan.Razy.D3C133 Trojan.Win32.Khalesi.bjm Trojan/Win32.VBKrypt.C2374802 Trojan.Khalesi Trj/GdSda.A Win32.Trojan.Khalesi.Swkj Win32/Trojan.674


It is an old threat and was well-described by Symantec back in 2009.


A nubmer of downloaders installing further malware from http://mondaynightfundarts[.]com/images/Nu48djdi.zip


It's a trojan spy which is installed as service called RCSU.


A backdoor also known as: W32.Clodeac.Trojan.9edf Trojan.PlugX.A4 BKDR_PLUGX.DUKH Win32.Trojan.WisdomEyes.16070401.9500.9975 BKDR_PLUGX.DUKH Trojan-Spy.Win32.Lurk.vtx Trojan.Win32.Datufly.ebtzfj Trojan.Win32.Z.Injector.9728.AR[h] Uds.Dangerousobject.Multi!c Trojan.Injector.Win32.378784 worm.win32.gamarue.z TrojanSpy.Lurk.ep TR/Datufly.hmoo W32/Injector.CXAC!tr Trojan.Graftor.D429AC Trojan:Win32/Datufly.B!dha Trojan/Win32.Datufly.R184100 TrojanSpy.Lurk Win32.Trojan-spy.Lurk.Amck TrojanSpy.Lurk!fV54mUiVDuY Trojan.Win32.Injector Inject3.AMFK Trj/GdSda.A


A backdoor also known as: Backdoor.Irc.Mimic.C Trojan.Glitch.A BKDR_IRCMIMIC.C IRC/Mimic.C Hacktool.Flooder BKDR_IRCMIMIC.C Win.Trojan.Soldier-7 Backdoor.IRC.Mimic.c Backdoor.Irc.Mimic.C DoS.W32.LifeWare!c Backdoor.Irc.Mimic.C DDoS.LifeWire BehavesLike.Win32.PWSZbot.bc Trojan.Win32.DoS IRC/Mimic.C IRC/Mimic.8 HackTool[DoS]/Win32.LifeWare DDoS:Win32/LifeWire.A Backdoor.IRC.Mimic.c DoS.LifeWare Trojan.HideWindows Bck/Iroffer.BG Irc.Backdoor.Mimic.Htmt VBS.Flood.L W32/LifeWare.A!dos Win32/Virus.IRC.f2c


Using the Dynamic Threat Intelligence Cloud DTI, FireEye researchers detected a pattern of attacks beginning on April 13th, 2015.


Just recently, we found a new spam campaign of Hancitor with some notable developments that may have been in the previous variants, but were not discussed in any other reports.


A backdoor also known as: Backdoor/W32.Fadedoor.287744 Email-Worm.Win32.GOPworm.196 Trojan.Heur.rGWarTuQ32piy Win32.Trojan.WisdomEyes.16070401.9500.9787 W32/Backdoor.MAW Backdoor.Trojan Backdoor.Win32.Fadedoor.a Trojan.Win32.Fadedoor.frpv Backdoor.Win32.Fadedoor.287744 Backdoor.W32.Fadedoor.a!c Backdoor.Win32.Fadedoor.10 BackDoor.Fade.10 Backdoor.Fadedoor.Win32.22 W32/Backdoor.THLZ-3240 Backdoor/Fadedoor.i BDS/Fade.10.Srv1 Trojan[Backdoor]/Win32.Fadedoor Win32.Hack.Fadedoor.a.kcloud Backdoor:Win32/Fakedoor.B Backdoor.Win32.Fadedoor.a Worm/Win32.IRCBot.R67641 Email-Worm.Win32.GOPworm.196 TScope.Trojan.Delf Bck/Fadedoor.A Win32.Backdoor.Fadedoor.Efue Backdoor.Fadedoor!nYSsZcqQ6hQ W32/Fadedoor.A!tr Win32/Trojan.fd1


A backdoor also known as: Trojan/Downloader.VB.lvv W32/Downldr2.FUOC DLoader.APBLQ TROJ_SPNR.07L611 Win32.HEURCrypted Trojan.Downloader-71476 Trojan-Downloader.Win32.VB.lwz Trojan.DL.VB!n7YxP+4/z6k Trojan.Win32.Downloader.94208.EO Virus.Win32.Heur.k TrojWare.Win32.Trojan.VB.~BVZ Trojan.DownLoad1.50365 TROJ_SPNR.0CA512 TrojanDownloader.VB.rbu Win32.TrojDownloader.VB.kcloud W32/Downloader.RCLB-8389 Win-Trojan/Xema.variant TrojanDownloader.VB Trojan-Downloader.Win32.VB W32/VB.LVV!tr.dldr Trj/Downloader.VVG


AsyncRAT is a popular malware commodity and tools used by attackers to gain access to targeted hosts or networks, including those using Microsoft's OneNote email address.


A backdoor also known as: Trojan.Razy.D1D44E


JPCERT / CC confirms that a targeted mail with a ZIP file containing an executable file has been sent to domestic organizations around October 2016.


Recently, we have discovered 132 Android apps on Google Play infected with tiny hidden IFrames that link to malicious domains in their local HTML pages, with the most popular one having more than 10,000 installs alone.


The threat actors target a wide range of organizations: CTU researchers have observed TG-3390 actors obtaining confidential data on defense manufacturing projects, but also targeting other industry verticals and attacking organizations involved in international relations.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9607 Trojan.Win32.DownLoad4.exjknn Trojan.DownLoad4.114 Trojan/Win32.Cerber.R219560 Trojan.BitCoinMiner Trojan.Zusy.D42D87 Trj/CI.A Win32/Trojan.5a2


The attackers used compromised websites or watering holes to infect pre-selected targets with previously unknown malware.


A backdoor also known as: Trojan/Downloader.Kather.e Win32.Trojan.WisdomEyes.16070401.9500.9855 W32/Downldr2.ANMO Backdoor.Trojan WORM_POSAM.A Win.Trojan.Kather-1 Trojan-Downloader.Win32.Kather.e Trojan.Win32.Kather.dips Win32.Trojan-downloader.Kather.Tdfl TrojWare.Win32.TrojanDownloader.Kather.E Trojan.Kather.43661 Downloader.Kather.Win32.6 WORM_POSAM.A W32/Downloader.KXIZ-5728 Trojan/Kather.i TR/Dldr.Kather.E Trojan[Downloader]/Win32.Kather Win32.TrojDownloader.Kather.e.kcloud Troj.Downloader.W32.Kather.e!c Trojan-Downloader.Win32.Kather.e TrojanDownloader:Win32/Kather.E Win32/TrojanDownloader.Kather.E Trojan.DL.Kather!WhdeU9hib+w W32/Kather.A!tr.dldr Win32/Trojan.b64


A backdoor also known as: W32.VBTipocadLTJ.Trojan Trojan/W32.Reconyc.95744 Trojan.Reconyc Trojan.Win32.Reconyc.ghqx Trojan.Win64.Reconyc.ewbtpt Troj.W32.Reconyc.tnqK BehavesLike.Win64.Downloader.nh Trojan.Win32.Reconyc TR/Dropper.onknt TrojanDownloader:Win32/Reconyc.B!bit Trojan.Win32.Reconyc.ghqx Trojan/Win64.Reconyc.C1746256 Trojan.Reconyc Trojan.Reconyc Trj/CI.A VBS/Kryptik.D Win32.Trojan.Reconyc.Hwdh Trojan.Reconyc! Win32/Trojan.658


We discovered this China-based third-party iOS app store aggressively promoting their repackaged apps in social network channels—YouTube, Facebook, Google+, and Twitter—banking on the popularity of games and apps such as Minecraft, Terraria, and Instagram to lure users into downloading them.


A backdoor also known as: Trojan.Sirefef.A Trojan.CoinMiner.Win32.474 Trojan.Kazy.D54A3A Win32.Trojan.WisdomEyes.16070401.9500.9999 Infostealer.Limitail Trojan.Win32.Yakes.cvappu Troj.W32.Yakes.egne!c Trojan.BtcMine.148 BehavesLike.Win32.Downloader.fh Trojan.Win32.CoinMiner W32/Trojan.XYUN-7891 Trojan/Yakes.mzh TR/Rogue.1594174 Trojan/Win32.Yakes Trojan:Win32/Kraziomel.D Trojan/Win32.Yakes.C284072 Trojan.TDSS.01414 Win32/CoinMiner.CF Trojan.Yakes!WgDSy6aOE8s W32/Kryptik.EXA!tr


A backdoor also known as: Trojan.NSIS.Androm.8 Troj.Nsis.Androm!c Win32.Trojan.WisdomEyes.16070401.9500.9791 Ransom.Rokku Ransom_.97182692 Zum.Ransom.NSIS.Cerber.1 Trojan-Ransom.Win32.Zcryptor.g Trojan.NSIS.Androm.8 Trojan.Win32.Inject.evkooj Trojan.Win32.Z.Injector.697990 Ransom_.97182692 BehavesLike.Win32.Ransom.jc Trojan.Win32.Injector Ransom:Win32/ZCryptor.A Trojan-Ransom.Win32.Zcryptor.g Trojan-Ransom.Zcryptor Trj/CI.A Zum.Ransom.NSIS.Cerber.1 Win32.Trojan.Zcryptor.Lndy Win32/Trojan.Ransom.a9f


Slowly putting the pieces together, the global picture began to take shape, exposing a massive adware campaign affecting approximately half a million users.


A backdoor also known as: Android.Trojan.Banker.DF Android.Trojan.Banker.DF Other:Android.Reputation.2 Infostealer.Bancos Android.Trojan.Banker.DF HEUR:Trojan-Banker.AndroidOS.Svpeng.q A.H.Pri.SvPeng.E Trojan.Android.Banker.egowei Trojan:Android/InfoStealer.CM Android.Banker.70.origin ZIP/Trojan.IGVK-5 Android.Trojan.Banker.DF Android-Trojan/Svpeng.3becd HEUR:Trojan-Banker.AndroidOS.Svpeng.q Trojan.AndroidOS.Banker.A a.expense.fakeinstall.b Trojan-Banker.AndroidOS.Svpeng


A backdoor also known as: Backdoor.MSIL Trojan.SpamThru Trojan.DownLoader25.28452 BehavesLike.Win32.Trojan.wm TR/Dropper.MSIL.qtean Backdoor:VBS/Sisbot.A Trojan.MSIL.Androm.9 Trojan/Win32.Sisbot.R216242 Trj/GdSda.A MSIL/Dropper.XXX!tr Win32/Trojan.b5b


A backdoor also known as: W32.HfsAutoB.A728 Trojan.PWS.OnlineGames.AADX Trojan-GameThief.Win32.OnLineGames!O Trojan.PWS.OnlineGames.AADX Trojan/OnLineGames.snrt Win32.Trojan.WisdomEyes.16070401.9500.9990 Infostealer.Gampass TROJ_SYSTEMHI.IM Win.Spyware.50098-2 Trojan-GameThief.Win32.OnLineGames.snrt Trojan.PWS.OnlineGames.AADX Trojan.Win32.Drop.bbdxzx Trojan.PWS.OnlineGames.AADX Trojan.PWS.OnlineGames.AADX Trojan.MulDrop.21159 TROJ_SYSTEMHI.IM Backdoor/Bifrose.jhl Trojan[GameThief]/Win32.OnLineGames Trojan.PWS.OnlineGames.AADX Trojan.Win32.PSWIGames.21508 Trojan-GameThief.Win32.OnLineGames.snrt Trojan.PWS.OnlineGames.AADX Trojan/Win32.OnlineGameHack.R10533 Win32.Trojan-GameThief.Onlinegames.cruv Trojan-PWS.LDPinch


A backdoor also known as: Backdoor.Androm.A5 Win32.Trojan.WisdomEyes.16070401.9500.9994 Virus.W32.Rootkit!c Trojan.Inject2.30717 Trojan.Kryptik.Win32.1154178 Trojan.Win32.Crypt Trojan.Scarsi.ait Trojan/Win32.Scarsi Trojan.Win32.Z.Kryptik.563972 W32/Dorkbot.B!tr Win32/RootKit.Rootkit.7e5


Microsoft refers to this family of malware as Sarvdap, however it must be noted that the detection appears somewhat generic.


FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015.


The set of permissions required by Marcher according to the manifest is as follows : ∗ android.permission.CHANGE_NETWORK_STATE ( change network connectivity state ) ∗ android.permission.SEND_SMS ( send SMS messages ) ∗ android.permission.USES_POLICY_FORCE_LOCK ( lock the device ) ∗ android.permission.RECEIVE_BOOT_COMPLETED ( start malware when device boots ) ∗ android.permission.INTERNET ( communicate with the internet ) ∗ android.permission.VIBRATE ( control the vibrator ) ∗ android.permission.ACCESS_WIFI_STATE ( view information about the status of Wi-Fi ) ∗ android.permission.WRITE_SMS ( edit/delete SMS ) ∗ android.permission.ACCESS_NETWORK_STATE ( view the status of all networks ) ∗ android.permission.WAKE_LOCK ( prevent the phone from going to sleep ) ∗ android.permission.GET_TASKS ( retrieve running applications ) ∗ android.permission.CALL_PHONE ( call phone numbers ) ∗ android.permission.WRITE_SETTINGS ( read/write global system settings ) ∗ android.permission.RECEIVE_SMS ( intercept SMS messages ) ∗ android.permission.READ_PHONE_STATE ( read phone details of the device such as phone number and serial number ) ∗ android.permission.CHANGE_WIFI_STATE ( connect to and disconnect from Wi-Fi networks and make changes to configured networks ) ∗ android.permission.READ_CONTACTS ( read all contact data ) * android.permission.READ_SMS ( read SMS messages ) Obviously a fairly significant list of permissions of which many are suspicious , especially when combined .


In December 2015, Chinese users reported they were infected by this malware.


We took a look at the malware specifically in the INOCNATION campaign to analyze what was new and different about the techniques used by the threat actor.


New nodes are continually added as new victims are enlisted, and they are unpublished outside of the Terracotta user-base.


With the prevalence of Google Android smartphones and the popularity of feature-rich apps, more and more people rely on smartphones to store and handle kinds of personal and business information which attracts adversaries who want to steal that information.


A backdoor also known as: TrojanPWS.Zbot.VA3 Trojan.Tofsee Trojan/Injector.ccfi TROJ_HPVB.SM6 Win32.Trojan.WisdomEyes.16070401.9500.9999 Ransom.Kovter TROJ_HPVB.SM6 Trojan.Win32.Inject.wlzt Trojan.Win32.Inject.dwzyvq Troj.W32.Inject.tnFQ Trojan.Kovter.69 Trojan.Inject.Win32.168460 Trojan.Win32.Injector Trojan/Inject.baac Trojan/Win32.Inject Trojan.Symmi.DCC5C Trojan.Win32.Inject.wlzt Trojan/Win32.Kovter.R153629 Trojan.Inject Trojan.Inject!3ypDMCpDv7Y W32/Injector.CEEO!tr Win32/Trojan.Dropper.43b


A backdoor also known as: Worm.Mytob Win32.Trojan.WisdomEyes.16070401.9500.9860 W32/Trojan.DMPW-1529 Net-Worm.Win32.Mytob.lsk Trojan.Win32.Win32.dchvpv Trojan.Win32.Z.Mytob.27648 Net.Worm.W32.Mytob!c Trojan.Win32.Clicker!BT Worm/Mytob.als TR/Clicker.ofeiu Worm[Net]/Win32.Mytob Net-Worm.Win32.Mytob.lsk TrojanClicker:MSIL/Doviali.A Worm/Win32.Mytob.C84872 Trojan.Win32.Clicker!BT Net-Worm.Mytob Trojan.MSIL.TrojanClicker W32/MyTob.A!tr


Trend Micro detects this as ANDROIDOS_SOCKSBOT.A and has found at least 3,000 Trojanized apps.


This post analyzes targeted malware attacks against groups in the Tibetan diaspora and pro-democracy groups in Hong Kong.


In October 2015 the Callisto Group targeted a handful of individuals with phishing emails that attempted to obtain the target's webmail credentials.


On January 27, 2016 Cyphort Labs discovered a site infected with Angler EK leading to a fileless Gootkit a.k.a. XswKit malware.


A backdoor also known as: Trojan.Foosace Trojan.Sofacy.C TSPY_SEDNIT.A Trojan.Win32.Z.Graftor.81408.L TSPY_SEDNIT.A W32/Trojan.GBLK-5942 Trojan:Win32/Foosace.K!dha Trojan/Win32.Sednit.R155481 Win32/Sednit.C Win32/Trojan.e6d


Two prominent lawyers representing the families of three slain Mexican women were sent infection attempts with NSO Group's Pegasus spyware


htpRAT, uncovered by RiskIQ cyber investigators, is the newest weapon in Chinese cyberattackers' campaign against Association of Southeast Asian Nations ASEAN.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9998 PWS:MSIL/Logbro.A Trojan/Win32.Skeeyah.R207512 MSIL.Backdoor.SRat.A


A backdoor also known as: Trojan.Heur.DP.ED408E Ransom_Delcryset.R055C0DAF18 Trojan-Ransom.Win32.Matrix.qt Trojan.Win32.Matrix.ewhoom Trojan.DownLoader26.4261 Ransom_Delcryset.R055C0DAF18 BehavesLike.Win32.BadFile.dh W32/Trojan.YJSB-6810 TR/AD.RansomHeur.ulxhr Ransom:Win32/Delcryset.A Trojan-Ransom.Win32.Matrix.qt Trj/GdSda.A W32/Filecoder_LockedFile.D!tr


These tools include: HKTL_MIMIKATZ, HKTL_FGDUMP, and HKTL_VNCPASSVIEW.


FIN7 is a financially-motivated threat actor targeting large organizations that process payment card data or have a significant point of sale environment.


This dissimilarity only grew with the further enumeration of other targets, describing a broad targeting across the Middle East without wholly implicating any particular interest, despite clear political intent.


A backdoor also known as: HW32.Packed.B82E Trojan.Nsis.Dwn.ewrrol BehavesLike.Win32.Vopak.cc Trojan.Inject.acan TrojanDownloader:Win32/Tanske.A!bit


The malware is responsible for encrypting files on a victim's machine and demanding a ransom via the Bitcoin cryptocurrency.


A backdoor also known as: Trojan.Ekidoa.FC.2847 Trojan.MSILPerseus.D1EE89 Win32.Trojan.WisdomEyes.16070401.9500.9998 TrojWare.MSIL.Ekidoa.A BackDoor.Bladabindi.13678 Trojan.MSIL.Crypt TR/Dropper.MSIL.hoclc MSIL/Kryptik.FDF!tr Trojan:MSIL/Ekidoa.A!bit Trojan/Win32.Skeeyah.R194563 Backdoor.MSIL.SpyGate Backdoor.Bladabindi Backdoor.SpyGate!


A backdoor also known as: Trojan/FlyStudio.atk Win.Trojan.7691310-1 Trojan-Dropper.Win32.Dinwod.vqz Trojan.Win32.FlyStudio.zlxrd Trojan.PWS.Wsgame.36294 BehavesLike.Win32.Ipamor.fc Trojan/FlyStudio.dpn Trojan/Win32.FlyStudio Trojan:Win32/Derunsex.A Troj.W32.FlyStudio.atk!c Trojan-Dropper.Win32.Dinwod.vqz Trj/CI.A Win32.Trojan.Flystudio.dbsu Trojan.Crypt W32/FlyStudio.ATK!tr Win32/Trojan.0e3


On March 29, 2023, reports circulating about a potential supply chain compromise for 3CXDesktopApp — a softphone application from 3CX.


Distribution via trojanized updates to MeDoc users


A backdoor also known as: Trojan.Ransom.Crypren.11 Ransom_Denisca.R011C0DLD17 Ransom_Denisca.R011C0DLD17 Trojan.Win32.Crypren.emfrxs Trojan.MulDrop7.20062 BehavesLike.Win32.PWSZbot.dc Trojan.Win32.Crypt W32/Trojan.HSTQ-8964 TR/AD.Ergop.ipwuu Trj/CI.A Trojan.Crypren!pGn+9M0dsUI W32/Kryptik.FPNC!tr Win32/Trojan.Ransom.a8a


This included altering the icon of the executable to appear as other file types as well as decoy documents to trick users into thinking they had opened a legitimate file.


What do I need to do ? It is extremely unlikely you or someone you know was affected by Chrysaor malware .


A backdoor also known as: Win32.Risk.Deceptor.Lmla Program.Unwanted.2594 Trojan:Win32/Spideepri.A PUP/Win32.SpeedItUpFree.R211310 Trojan.Spideepri


A backdoor also known as: Trojan.Mimikatz.Win32.268 Win32.Trojan.WisdomEyes.16070401.9500.9999 Hacktool.Mimikatz Trojan.Win32.Mimikatz.ergkpd Application.Win32.HackTool.Mimikatz.DC Tool.PassView.1872 HackTool.Inject.ew Trojan[PSW]/Win32.Mimikatz Trojan/Win32.Mimikatz.R202679 TrojanPSW.Mimikatz HackTool.Mimikatz Trj/CI.A Trojan.Application.Hacktool.Mimikatz.1 Win32.Trojan-qqpass.Qqrob.Tclv HackTool.Mimikatz hacktool.mimikatz Win32/Trojan.PSW.c71


A backdoor also known as: Worm.Olufus.A3 WORM_VB_FB25010D.UVPM Win32.Worm.VB.rb WORM_VB_FB25010D.UVPM Trojan.Win32.Cosmu.dipp Trojan.Win32.Crypt.dsqpuq Trojan.MulDrop5.34309 Net-Worm.Win32.Cynic Worm:Win32/Olufus.A Trojan.Heur.E2E727 W32.Virut.low6 Trojan.Win32.Cosmu.dipp Trojan/Win32.Bredolab.R151314 TScope.Trojan.VB Win32/VB.OKI


A backdoor also known as: W32.KlassTT.Trojan Backdoor.Sdbot.6331 Troj.Dropper.W32.Sysn!c Win32.Trojan.WisdomEyes.16070401.9500.9991 Backdoor.Trojan Trojan-Dropper.Win32.Sysn.brns Backdoor.Win32.IRCBot.60928.J BackDoor.IRC.Huxor.59 BehavesLike.Win32.Backdoor.qh Backdoor.Win32.SdBot Trojan[Backdoor]/Win32.IRCBot Trojan.Kazy.D14BCA Trojan-Dropper.Win32.Sysn.brns Backdoor:Win32/Arwobot.B Worm/Win32.IRCBot.R4516 Win32.Trojan-dropper.Sysn.Lmuh Win32/Trojan.8b1


These embedded OLE Word documents then contain embedded Adobe Flash .SWF files that are designed to exploit Abode Flash vulnerabilities.


Iranian threat agent OilRig has been targeting multiple organisations in Israel and other countries in the Middle East since the end of 2015.


In the course of this tactical hunt for unidentified code, RSA discovered a sophisticated attack on a software supply-chain involving a Trojan inserted in otherwise legitimate software; software that is typically used by enterprise system administrators.


Neuron and Nautilus are malicious tools designed to operate on Microsoft Windows platforms, primarily targeting mail servers and web servers.


A backdoor also known as: W32.FamVT.MambaAHQc.Trojan Trojan.Python.Win32.34 Trojan/Mamba.g Win32.Trojan.WisdomEyes.16070401.9500.9555 BehavesLike.Win32.Trojan.vh Python/Blakamba.A!tr


The attack compromised their devices and exfiltrated data to the attackers' command and control server.


The earliest we observed this spreader variant pushing Mirai downloaders was January 2017.


In late 2013–early 2014, a compromised FTP client dubbed StealZilla, based off the open source FileZilla FTP client was discovered.


This particular APT is targeting organizations that include weapons manufacturers, human rights activists, and pro-democracy groups, among others.


A backdoor also known as: Trojan.Danmec.E.iw5 Trojan.Asprox W32/Danmec.R TROJ_DANMEC.SM Trojan.Win32.Danmec!IK TrojWare.Win32.Kryptik.CG Trojan.DownLoad2.37322 TR/Spy.Web.H TROJ_DANMEC.SM Worm/Aspxor.ey Trojan/Win32.Danmec Trojan.Danmec Trojan.Asprox!rem Trojan.Win32.Danmec W32/Danmec.C!tr Trj/Damnec.A


The ART team at Fortinet has discovered a new malware named Proteus, a multifunctional botnet written in .NET that appears to be a proxy, coin miner, e-commerce merchant account checker, and keylogger.


From the Nymaim malware, it leverages the dropper's stealth and persistence; the Gozi ISFB parts add the banking Trojan's capabilities to facilitate fraud via infected Internet browsers.


Backdoor that installs itself at %Application Data%\remcos


Based on strings found in the samples we analyzed, we have named this backdoor Gazer


It spreads via unusual means, including the hijacking of traffic from nationwide ISPs, an SNS worm on Windows, and an offline app installation and community promotion.


A backdoor also known as: Trojan.Dynamer Win32.Trojan.WisdomEyes.16070401.9500.9986 Trojan.Win32.Dwn.efyiis Trojan.DownLoader22.7328 BehavesLike.Win32.PUPXAA.kc Trojan:MSIL/Watam.A Trojan.MSIL.Spy


The payload we got also specifically targets Korean banks by modifying the infected systems hosts file to redirect traffic from Korean banks to its controlled server.


This particular peice of malware uses a open source VB6 peice of malware called vnLoader'.


This group has been active since 2010. We dub this operation Shrouded Crossbow, after a mutex in a backdoor the group developed.


A backdoor also known as: Android.Trojan.Boxer.as HEUR:Trojan-SMS.AndroidOS.FakeInst.a HEUR:Trojan-SMS.AndroidOS.FakeInst.a


A backdoor also known as: Trojan.Dynamer.FC.314 Win32.Trojan.WisdomEyes.16070401.9500.9959 Trojan.Win32.Inject.aexnv Trojan.DownLoader24.51009 TR/AD.NETCryptor.dneew Trojan/Win32.Inject Backdoor:MSIL/Omaneat.B Trojan.MSILPerseus.D17E4F Trojan/Win32.Fsysna.C1935209 Trojan.Win32.Inject.aexnv Trj/GdSda.A Win32.Trojan.Inject.Fsc


FireEye Labs recently discovered a previously unknown variant of the APT backdoor XSLCmd – OSX.XSLCmd – which is designed to compromise Apple OS X systems.


A backdoor also known as: Trojan.PWS.Kukel.A Trojan-PWS/W32.Kukel.14116 Trojan.PWS.Kukel.A Trojan/PSW.Kukel Trojan.PWS.Kukel.A Win32.Trojan.WisdomEyes.16070401.9500.9985 TROJ_KUKEL.A Trojan.PWS.Kukel.A Trojan-PSW.Win32.Kukel Trojan.PWS.Kukel.A Trojan.Win32.Kukel.hjwe Trojan.Win32.PSWKukel.14116 Troj.PSW32.W.Kukel!c Trojan.PWS.Kukel.A TrojWare.Win32.PSW.Kukel Trojan.PWS.Kukel.A Trojan.PWS.Kukel Trojan.Kukel.Win32.4 TROJ_KUKEL.A W32/Risk.QXSE-2226 Trojan/PSW.Kukel TR/PSW.Kukel.1 Trojan-PSW.Win32.Kukel TrojanPSW.Kukel Win32/PSW.Kukel Win32.Trojan-qqpass.Qqrob.Wsko Trojan.PWS.Kukel!uom8kUpytHQ W32/Kukel.A!tr.pws


This entry is to explain features of Datper, malware used for targeted attacks against Japanese organisations and how to detect it from the logs.


A backdoor also known as: Trojan.Tvt Trojan.Korplug.Win32.309 Trojan.Zusy.D41CD9 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Tvt.ll Trojan.KeyLogger.27522 Backdoor:Win32/Sogu.A!dha Trojan.Win32.Tvt.ll Backdoor/Win32.Etso.R17333 Trojan.Win32.Korplug


Detected as ANDROIDOS_SLOCKER.OPSCB, this new SLocker mobile ransomware variant features new routines that utilize features of the Chinese social network QQ, along with persistent screen-locking capabilities.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9984 Trojan-Banker.Win32.Metel.cai Trojan.Win32.Metel.edlvqj Troj.Banker.W32.Metel!c Trojan.Bayanker.42 BehavesLike.Win32.FakeAlertSecurityTool.dc Trojan.Banker.Metel.ys TR/Kryptik.rfzx Trojan:Win32/Exgectow.A Trojan-Banker.Win32.Metel.cai Trojan/Win32.Dorv.R166106 Trj/CI.A Win32/Corkow.AI Win32.Outbreak Win32/Trojan.9df


Recent new reporting was released on the DragonOK group which unveiled the many versions of the Sysget backdoor as well as the IsSpace backdoor.


A backdoor also known as: Trojan.Vehidis Trojan.Win32.Vehidis.wpm Trojan.Win32.Crypted.dodbbd Trojan.Win32.Z.Vehidis.24576.K Troj.W32.Vehidis!c Trojan.Vehidis.Win32.1902 Trojan.Vehidis.hd BDS/Sakkair.ebcng Backdoor:Win32/Sakkair.A Trojan.Win32.Vehidis.wpm Trojan/Win32.Farfli.R115053 Trojan.Vehidis Trj/CI.A Win32.Trojan.Vehidis.Hquw


A backdoor also known as: Trojan.MSIL Win32.Trojan.WisdomEyes.16070401.9500.9655 Infostealer.Limitail Trojan.Win32.Z.Limitail.303616 Trojan.DownLoader19.57204 BehavesLike.Win32.PUPXAG.dc TR/Dropper.MSIL.lrzyl Trojan.MSILPerseus.D234A0 TrojanSpy:MSIL/Plimrost.B Trojan/Win32.Kryptik.C2400864 Trj/GdSda.A


Standing out because of its prevalence and its sophistication, Stantinko turned out to be quite a puzzle to solve.


This utility does several interesting things to evade antivirus detection.


A backdoor also known as: Android.Adware.Airpush.55AE Android.Adware.Plankton.A Android.Adware.Plankton.A Android.Trojan.Plankton.k AndroidOS/Plankton.B A.H.Pri.Afoynq.F Trojan.Android.Airpush.djpqsd Adware.MultiAds!1.9D9E Android.Adware.Plankton.A Android.Adware.Plankton Adware.Airpush.3.origin AndroidOS/Plankton.B Android.Adware.Plankton.A Android.Adware.Plankton!c Android-PUP/Airpush.2ac1 Android.Adware.Plankton.A Adware.AndroidOS.AirPush.a AdWare.AndroidOS.Apperhand


Successful exploitation seems to be possible on all currently supported versions of MS Office up and including the MS15-022 patch.


Proofpoint researchers have observed a well-known Russian-speaking APT actor usually referred to as Turla using a new .NET/MSIL dropper for an existing backdoor called JS/KopiLuwak.


The malware itself is a fully featured RAT, which uses a compressed, optionally encrypted, raw TCP socket and binary message protocol for command and control communications.


This time, however, attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan, which in turn downloaded the PlugX Remote Access Trojan RAT.


A backdoor also known as: Trojan.Banker.Win32.89325 Trojan/Spy.Banker.yss Trojan.Win32.Z.Banker.5002130 Trojan.DownLoader13.22038 Trojan/Win32.Scar Win32.Troj.Undef.kcloud PWS:Win32/Mujormel.A TScope.Trojan.Delf


Within the last week, the now infamous man-in-the-browser MITB banking malware Dyreza appears to have significantly expanded its target set of entities from which to steal credentials.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9989 W32/Trojan2.KJRE Infostealer.Bancos Win.Spyware.Banker-3740 Trojan.Win32.Banker.brismu Troj.Spy.W32.Delf.gmb!c Trojan.PWS.Spy.281 Trojan.Banker.Win32.115104 BehavesLike.Win32.Ramnit.cc W32/Trojan.FKOH-7228 TrojanSpy.Delf.efw W32.InfoStealer.Bancos Win32.Troj.Delf.kcloud Trojan/Win32.Xema.C140526 Trj/CI.A Win32.Trojan.Spy.Edyh TrojanSpy.Delf!R/OQYQsjYN8 Trojan-Spy.Win32.Bancos W32/DelpBanc.A!tr Win32/Trojan.Spy.1ee


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G Virus.Virut.Win32.1939 W32.Virut.CF Win32/Virut.17408 PE_VIRUX.S-3 Win.Worm.Taz-1 Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg PE_VIRUX.S-3 Win32/Virut.bt Virus/Win32.Virut.ce Trojan:Win32/VBloader.B Virus.Win32.Virut.ce Win32/Virut.F Virus.Virut.14 Win32/Virut.NBP Trojan-Banker.Win32.Bancos W32/Sality.AO Virus.Win32.VirutChangeEntry.A


A backdoor also known as: W32.MiadheardLTM.Trojan Backdoor.Mask.E Trojan/W32.Mask.17920 Trojan.Seedna Trojan.SGH.Win32.1 Troj.W32.SGH.o!c Backdoor.Mask.E W32/Mask.C Backdoor.Weevil.B BKDR_CARETO.A Backdoor.Mask.E Trojan.Win32.SGH.o Backdoor.Mask.E Trojan.Win32.SGH.ctugql Backdoor.Mask.E Backdoor:W32/Mask.A BKDR_CARETO.A Backdoor.Mask W32/Mask.NPPK-3802 Trojan.Win32.a W32.Trojan.Careto TR/Heap.A.4 Trojan/Win32.SGH Trojan:Win32/Seedna.A Trojan.Win32.SGH.o Trojan/Win32.Careto.R97388 Backdoor.Mask Trj/Careto.A Win32/Appetite.C Win32.Trojan.Sgh.Srmy W32/Themas.G!tr Win32/Trojan.aa5


A backdoor also known as: Backdoor.Ptakks.217 Backdoor.Ptakks.217 Backdoor.Win32.Ptakks!O Trojan.Win32.Ptakks.bdqil Backdoor.Trojan Win32/Ptakks.C BKDR_PTAKKS.B Trojan.Ptakks.216 Backdoor.Win32.Ptakks.217 Backdoor.Ptakks.217 Backdoor.Ptakks.217!9LO95ovp5Xo Backdoor.Win32.Ptakks_217.Svr Backdoor.Ptakks.217 Backdoor.Win32.Ptakks.2_17 Backdoor.Ptakks.217 BackDoor.Ptakks.217 BDS/Ptakks.2 BKDR_PTAKKS.B Backdoor/Ptakks.217 Win32.Hack.Ptakks217.kcloud Backdoor:Win32/Ptakks.2_17 Backdoor.Ptakks.217 W32/Risk.CITI-5061 Trojan/Win32.HDC Backdoor.Ptakks Bck/Ptakks.217 Win32/Ptakks.2_17 PE:Trojan.Ptakks.217!1073777762 Backdoor.Win32.Ptakks W32/Ptakks.217!tr.bdr BackDoor.Ptakks Backdoor.Win32.Ptakks.AY


It is extremely popular and is currently ranked #10 under Top free Android apps.


A backdoor also known as: W32.Clod22a.Trojan.8281 TrojanDownloader.Bunabom Trojan.Delf.Win32.72720 Trojan/Delf.qzl TROJ_SPNR.0BKS13 TROJ_SPNR.0BKS13 Troj.Delf.Sjr!c trojandownloader.win32.bunabom.a TR/Delf.sjr.1 TrojanDownloader:Win32/Bunabom.A Trojan.Delf!fsmGjeXPdPQ Trojan-Dropper.Delf Win32/Trojan.4da


A backdoor also known as: Exploit/W97.CVE-2012-0158 Exp.OLE.CVE-2012-0158.AA Exploit.Ole2.Toolbar!c Win32.Exploit.ShellCode.b Trojan.Mdropper TROJ_CVE20120158.MEVP Win.Trojan.TerminatorRat-2 Exploit.OLE2.Toolbar.a Exploit.ComObj.CVE-2012-0158.hzuf TROJ_CVE20120158.MEVP Trojan.DJPK-4 Exploit.CVE-2012-0158.f MSWord/Toolbar.A!exploit Trojan[Exploit]/MSWord.CVE-2012-0158.di DOC.S.CVE-2012-0158.1106567 Exploit.OLE2.Toolbar.a Exploit.CVE-2012-0158 Exploit.WORD.CVE-2012-0158.A Exploit.CVE-2012-0158 virus.exp.20120158


HtpRAT, a newly discovered Remote Access Trojan RAT extends the capabilities of traditional RATs by providing complete remote execution of custom commands and programming.


The library includes such operations as : Get address of cybercriminal C & C server Get configuration file with web injects from C & C , as well as default list of injects Scan for app package names that generated AccessibilityEvent events in the list of known banking/antivirus/other popular apps Set malware as default SMS app Get address of the phishing page that opens when the app runs , and others getStartWebUrl function – get address of phishing page The configuration file contains a list of injects for mobile banking apps – links to phishing pages matching the mobile banking app used by the user .