A backdoor also known as: HW32.Packed.4CE7 Backdoor/W32.Tropoly.C Backdoor.CPEX.Win32.21496 Trojan/Inject.aisx Trojan.Heur.E7B492 Trojan.Win32.A.Inject.48640.F TrojWare.Win32.Pincav.N Trojan.PWS.Reggin.91 BehavesLike.Win32.Ramnit.pc Trojan.Win32.Inject Trojan/Inject.hnq Troj.W32.Inject.aisx!c Trojan/Win32.OnlineGameHack.R2669 PWS-OnlineGames.ge BScope.TrojanPSW.Magania.1314 Trojan.Inject!H2RbMIi2jvQ Trj/Inject.IR Win32/Trojan.65a


A backdoor also known as: W32.Tregwihc.Trojan Trojan.Inject.GK Worm/W32.AutoRun.114688 W32/Autorun.worm.dw W32/AutoRun.lrf TROJ_FAM_0000e93.TOMA Win32.Trojan.WisdomEyes.16070401.9500.9992 W32/Worm.FWLR-5025 Trojan.Minit Win32/Milsni.D TROJ_FAM_0000e93.TOMA Win.Worm.Autorun-376 Win32.Rootkit.Uroburos.C Trojan.Inject.GK Trojan.Win32.AutoRun.ftwn Worm.Win32.Autorun.114688.I W32.W.AutoRun.lrf!c Trojan.Inject.GK Worm.Win32.AutoRun.COB Trojan.Inject.GK Win32.HLLW.Autoruner.5122 Worm.AutoRun.Win32.35 W32/Autorun.worm.dw W32/Worm.AKXJ Worm/AutoRun.fma Worm:Win32/Yacspeel.A.dll WORM/Autorun.Byt.34 Worm/Win32.AutoRun Worm:Win32/Yacspeel.A.dll Worm/Win32.AutoRun.R1836 Trojan.Inject.GK Worm.Win32.AutoRun.byt Trj/Autorun.RN Win32/AutoRun.COB Win32.Worm.Autorun.Lohz Virus.Win32.AutoRun.sd W32/AutoRun.BDJ!tr


A backdoor also known as: LNK.Trojan.3171 LNK/Trojan.TPJW-5 LNK_ARGULONG.SMLNK HEUR:Trojan.WinLNK.Powecod.a LNK_ARGULONG.SMLNK LNK/Trojan.TPJW-5 HEUR:Trojan.WinLNK.Powecod.a Trojan.LNK virus.lnk.powershell.a


A backdoor also known as: W32.SasfisB.Worm Win32.Worm.Wukill.D Email-Worm.Win32.Rays!O Worm.WuKill Worm.Rays.Win32.1 Worm.Wukill Win32.Worm-Email.Rays.a W32.Wullik@mm Win.Worm.Rays-1 Email-Worm.Win32.Rays.d Win32.Worm.Wukill.D Trojan.Win32.Rays.cvmxdt W32.W.Basun.lwAE Trojan.Win32.FakeFolder.wid Win32.Worm.Wukill.D Win32.Worm.Wukill.D Win32.HLLM.Xgray Email-Worm.Win32.Rays Worm.Rays.d.49152 Win32.Worm.Wukill.D I-Worm.Win32.Rays.49152 Email-Worm.Win32.Rays.d Win32.Trojan.Wukill.B Win32/Rays.worm.15024 Win32.Worm.Wukill.D SScope.Trojan.VBRA.4977 I-Worm.Wukill.B W32/Fawkes.A!worm


The document contains an encoded Visual Basic Script VBScript typical of previous Carbanak malware.


A backdoor also known as: W32/Fynloski.H Win32.Trojan Trojan.MSIL.Crypt.cxp Trojan.Inject.54745 TR/PSW.Fignotok.LW Trojan-Dropper.Small!IK Trojan/Jorik.ovo TrojanDownloader:Win32/Batosecu.A Trojan/Win32.Jorik Trojan.Jorik.Fynloski.ft Trojan-Dropper.Small Trj/CI.A


A backdoor also known as: Joke.Jepruss Hoax.Win32.BadJoke!O Joke.Russianjep Joke.Jepruss Joke.Jepruss W32/Joke.NX Joke.JepRuss JOKE_ONLYGAME.A Win.Joke.Jep-1 Joke.Jepruss Hoax.Win32.BadJoke.JepRuss Joke.Jepruss Riskware.Win32.JepRuss.hybz Joke.Win32.FakeScreen Hoax.W32.BadJoke.JepRuss!c Joke.Jepruss Joke.Win32.Jep.Russ Joke.Jepruss Joke.Justgame Tool.BadJoke.Win32.23 JOKE_ONLYGAME.A W32/Joke.TMKA-5158 not-virus:Joke.Win32.JepRuss HackTool[Hoax]/Win32.JepRuss Win32.Joke.JepRuss.kcloud Hoax.Win32.BadJoke.JepRuss Win-Joke/Delete_Game.916512 Win32/Jep.Russ Win32.Trojan-psw.Badjoke.Lmkt Trojan.Jep!7Qg0TmyJLB0 Joke.Win32.RussianJep


A backdoor also known as: Trojan.Seimon.G Trojan.Seimon.G Trojan.Seimon.G Trojan.Seimon!4f7JwSpV94c Trojan.Seimon.G TrojWare.Win32.Trojan.Seimon.G0 Trojan.Seimon.G Trojan.DownLoad.3195 BehavesLike.Win32.PWSGamania.lh W32/PhishExe.B!tr.dldr Trojan[:HEUR]/Win32.Unknown Trojan.Seimon.G Trojan/Win32.Casino BScope.Trojan-Downloader.ILoveLanch.pj Virus.Win32.Cloaker Trojan.Seimon.G


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9563 W32/Application.THZK-5586 BehavesLike.Win32.BadFile.rc Trojan.Win32.PSW Trojan.Application.Zusy.D3D00C Trj/GdSda.A


A backdoor also known as: Trojan.Win32.KillFiles!O Trojan.Birele Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Risk.GBTW-1754 Ransom_Birele.R038C0DLB17 Trojan-Ransom.Win32.Birele.gss Trojan.Win32.Dropper.rpje Trojan.Win32.Scar.56320.B Troj.Ransom.W32.Birele!c Worm.Win32.Autorun.GVIT Trojan.MulDrop1.6138 Trojan.Birele.Win32.7887 BehavesLike.Win32.Ransom.fc Virus.Win32.VBInject W32/MalwareS.BBSH Trojan/Scar.pgv Trojan/Win32.KillFiles PWS:Win32/Kiction.A Trojan.Zusy.DAEF Trojan/Win32.Scar.R18936 Trojan-Ransom.Win32.Birele.gss Worm.Spreader Worm.AutoRun Win32.Trojan.Birele.Pgda W32/KillFiles.GMU!tr Win32/Trojan.Ransom.f31


Here is a command and control protocol fragment : Commands from C2 server parsing In total , the malicious APK handles 16 different commands : Command Endpoint Description 1 reqsmscal.php Send specified SMS message 2 reqsmscal.php Call specified number 3 reqsmscal.php Exfiltrate device info , such as phone model and OS version 4 reqsmscal.php Exfiltrate a list of all installed applications 5 reqsmscal.php Exfiltrate default browser history ( limited to a given date ) 6 reqsmscal.php Exfiltrate Chrome browser history ( limited to a given date ) 7 reqsmscal.php Exfiltrate memory card file structure 8 reqsmscal.php Record surrounding sound for 80 seconds 1 reqcalllog.php Exfiltrate all call logs 2 reqcalllog.php Exfiltrate all SMS messages 3 reqcalllog.php Upload specified file from the device to the C2 4 reqcalllog.php Download file from specified URL and save on device 5 reqcalllog.php Delete specified file 6,7,8 reqcalllog.php Commands not yet implemented 9 reqcalllog.php Take photo ( muted audio ) with rear camera , send to C2 10 reqcalllog.php Take photo ( muted audio ) with front camera , send to C2 All observed samples with Smali injections were signed by the same debug certificate ( 0x936eacbe07f201df ) .


A backdoor also known as: Trojan.Jacard Win32.Trojan.WisdomEyes.16070401.9500.9987 W32/Trojan.YDYO-6019 Trojan-Banker.BestaFera Trojan-Banker.Win32.BestaFera.amyc Trojan.Win32.Banker.euxhdn Trojan.Win32.Z.Jacard.2528768 BehavesLike.Win32.BadFile.vh TR/Spy.Banker.vvhlz Trojan[Banker]/Win32.BestaFera TrojanDownloader:Win32/Qulkonwi.A Trojan.Jacard.D8CA Trojan-Banker.Win32.BestaFera.amyc Trj/GdSda.A Win32.Trojan-banker.Bestafera.Wmsm W32/Banker.ADUT!tr.spy Win32/Trojan.252


Recently the Mobile Malware Research Team of Intel Security found on Google Play a new campaign of Android/Clicker.G in dozens of published malicious apps.


AlienVault Labs has extracted related samples and located the infrastructure used by attackers


A backdoor also known as: Trojan.Brackash.C Trojan.Brackash.C Win32.Trojan.WisdomEyes.16070401.9500.9774 Trojan.Win32.Sadenav.b Trojan.Brackash.C Trojan.Brackash.C Brackash.dll Virus.Trojan.Win32.Sadenav Trojan/Sadenav.aic W32.Trojan.Brackash.C TR/Brackash.C100.2 Trojan/Win32.Sadenav Trojan.Brackash.C Trojan.Win32.Sadenav.b Trojan/Win32.Sadenav.R1894 Brackash.dll Trojan.Brackash.C


One of the most common ways to do this is by displaying advertisements to users or by offering in-app purchases IAPs.


This blog post outlines the details about the campaign that we discovered.


A new CC infrastructure consisting of a climbing club website.


A backdoor also known as: O97M.Dropper.BR W97M.Downloader W2000M/Dldr.Rogue.aipbta HEUR.VBA.Trojan.e virus.office.qexvmc.1095


A backdoor also known as: W32.BackdoorSlingup.Trojan Trojan/W32.Fsysna.77824.F Heur.Win32.VBKrypt.3!O Backdoor.Slingup.MF.150 Win32.Worm.VB.rt W32/Trojan.XMLD-4299 W32.Difobot BKDR_GORYNYCH.SM Trojan.Win32.Fsysna.ccit Trojan.Win32.Fsysna.dwujaf Troj.W32.Fsysna.tnPd Trojan.DownLoader14.15241 Trojan.Fsysna.Win32.7242 BKDR_GORYNYCH.SM BehavesLike.Win32.Backdoor.lt Worm.Win32.VB W32/Trojan3.TRB Trojan/Fsysna.dgo Trojan/Win32.Fsysna Trojan.Win32.Fsysna.ccit Trojan/Win32.VBInject.R158763 Trojan.Fsysna Trojan.Reconyc Win32/VB.OOB Win32.Trojan.Fsysna.Phgj


A backdoor also known as: Backdoor:MSIL/Hulpob.A


A backdoor also known as: Trojan.Fsysna Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.HAEY-9385 Trojan.Bisonal Trojan.Win32.Fsysna.ccap Troj.W32.Fsysna!c Trojan.DownLoad3.19183 BehavesLike.Win32.Dropper.vz Trojan.Win32.Fsysna.ccap Trojan:Win32/Korlia.C Win-Trojan/Biscon.3140 Trj/CI.A Win32.Trojan.Fsysna.Tayn W32/Fsysna.CCAP!tr Win32/Trojan.732


In addition, the compromised devices were pushed Trojan updates, which allowed the attackers to extend their capabilities.


In February 2016 one of the largest cyber heists was committed and subsequently disclosed.


Cyber espionage actors, now designated by FireEye as APT32 OceanLotus Group, are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists.


The infected apps in this campaign were downloaded several million times by unsuspecting users.


A backdoor also known as: Backdoor.Bot.MSIL Trojan.Win32.StartPage.czmqzt Trojan.DownLoader12.20620 BehavesLike.Win32.Backdoor.ch TR/Dropper.MSIL.47116 MSIL/StartPage.AI!tr Trj/CI.A Msil.Trojan.Dropper.Hqll Trojan.MSIL.StartPage MSIL3.BCNZ Trojan.MSIL.StartPage.AI


Primarily targets users in Brazil with fake attatchments, for example: Auto_De_Infracao_e_Sua_Notificacao_493275324.exe


This is named Red Leaves after strings found in the malware.


The malware first discovery was after a highly Libyan influential Telegram account compromised via web


Recently, we saw an app that leads to a third-party app store being offered on the official iOS App Store.


This paper presents ESET's findings about Operation Groundbait based on our research into the Prikormka malware family.


A backdoor also known as: Worm.Win32.AutoRun!O Worm.AutoRun.13924 W32.W.Fearso.kYUv HT_STARTPAGE_FB090419.UVPM Win32.Trojan.Delf.it HT_STARTPAGE_FB090419.UVPM Win.Trojan.Delf-1006 Trojan.Win32.Fsysna.digg TrojWare.Win32.Magania.~AD Worm.Delf.Win32.1099 Trojan[GameThief]/Win32.Nilage Trojan.Jacard.D150AA Trojan.Win32.Fsysna.digg HackTool.Win32.InjectDll.a Trojan.Crypt


In the course of our research we uncovered the activity of a hacking group which has Chinese origins.


A backdoor also known as: Win32/Darby.N Win32.Worm.P2p.Darby.N Worm/W32.Darby.140470 W32.W.Darby.n!c Win32.Worm.P2p.Darby.N Worm.P2P.Darby!NxHEqfnePM8 W32/Darby.M W32.HLLW.Darby Win32/Darby.N P2P-Worm.Win32.Darby.n Trojan.Win32.Darby.epif Worm.Win32.Darby.140470.B[h] Win32.Worm.P2p.Darby.N Worm.Win32.Darby.N Win32.Worm.P2p.Darby.N BehavesLike.Win32.MultiDropper.cc W32/Darby.KOEV-0225 Worm/Darby.f WORM/Darby.N W32/Darby.N!tr Worm[P2P]/Win32.Darby Win32.Worm.P2p.Darby.N Win32/Darby.worm.140470 Worm:Win32/Darby.N Virus.Win32.Heur.p Win32.Worm-p2p.Darby.Pdwh P2P-Worm.Win32.Darby Win32.Worm.P2p.Darby.N Worm/Darby.P


Yesterday, Microsoft patched CVE-2015-2424, a vulnerability in Microsoft Office discovered by iSIGHT Partners while monitoring the Russian cyber espionage team we call Tsar Team.


A backdoor also known as: W32.HfsIemusi.2209 W32/Trojan.GCQE-8180 DDOS_HPNITOL.SM Trojan.Boht Trojan.Win32.DownLoad.bfqxfq Troj.W32.Vilsel.lmbl Trojan.DownLoad3.40817 BehavesLike.Win32.HLLPPhilis.lc Backdoor:Win32/Bezigate.B Trj/CI.A Win32/Delf.AJG Backdoor.Win32.PcClient W32/Inject.VXTT!tr


During an incident response engagement in September 2016, SecureWorks® incident response analysts observed payment card data being collected by a generic remote access trojan RAT rather than typical memory-scraping malware.


The said attackers, who showed familiarity and in-depth knowledge of their agencies' network topology, tools, and software, were able to gain access to their targeted servers and install malware.


That attack was spearheaded by the malware ESET products detect as Diskcoder.C aka ExPetr, PetrWrap, Petya, or NotPetya.


Early September, Skycure Research Labs detected a fake app within one of our customer's organizations, identified through our crowd-sourced intelligence policies whereby anyone running the Skycure mobile app acts as a threat detecting sensor.


A backdoor also known as: Udsdangerousobject.Multi Trojan.Scar.Win32.107576 Uds.Dangerousobject.Multi!c Trojan.Win32.Scar.qiea Trojan.Win32.Scar.eujcfc BehavesLike.Win32.Downloader.vc Trojan.Win32.Scar W32/Trojan.TSAL-4013 Trojan.Scar.kdh TR/Scar.xdjbi Trojan/Win32.Scar Trojan.Win32.Scar.qiea TrojanDropper:Win32/NukeSped.V Trojan/Win32.Scar.C2237182 Trojan.Scar Trj/GdSda.A Win32.Trojan.Scar.Hnkz Trojan.Scar!JEdUZG9Z4dw Win32/Trojan.6bc


BlackSnake Ransomware is a new strain of malware that encrypts files and demands a ransom from victims, and is capable of performing clipper operations aimed at cryptocurrency users, according to Cyble Research and Intelligence Labs.


For bogus applications to be profitable, they should be able to entice users into installing them.


The group is highly selective in its approach and only appears to deploy its full range of tools once it establishes that the compromised organization is an intended target.


It relies on spear-phishing emails sent to specific and strategic companies to conduct its campaigns.


VXRLcredit contacted us regarding an APT phishing email that included a download link to a malware being hosted on a Geocities website.


The group's activities have gained attention due to their ongoing use of DLL hijacking via Microsoft Distributed Transaction Coordinator MSDTC to extract and launch ransomware payloads.


A backdoor also known as: BKDR_KONUS.N Trojan.DownLoader24.32510 BKDR_KONUS.N BehavesLike.Win32.Trojan.fc Trojan.Razy.D27268 Trojan.Win32.Z.Razy.308742 Backdoor:Win32/Konus.A TScope.Malware-Cryptor.SB Trj/GdSda.A Win32/Trojan.797


A backdoor also known as: HW32.Packed.91D0 RiskWare.GameHack Win32.Trojan.WisdomEyes.16070401.9500.9693 Trojan.Adylkuzz Win32.Application.PUPStudio.B Trojan.Win32.PUPStudio.expchr BehavesLike.Win32.Downloader.rc Trojan.Win32.VMProtect TR/AvKill.fkiqo Trojan:Win32/Avkill.E Trj/CI.A


A backdoor also known as: Exp.OLE.CVE-2013-1331.A Exploit.OLE2.CVE-2013-1331.a!c Trojan.Mdropper Win32/Exploit.CVE-2013-1331.A TROJ_MDROPPR.ZMA Doc.Exploit.CVE_2013_1331-1 Exploit.OLE2.CVE-2013-1331.a Trojan.Dos.CVE-2013-1331.dftbiw DOC.S.CVE-2013-1331.115712 Win32.Exploit.Msoffice.Auto Exploit:W32/CVE-2013-1331.A TROJ_MDROPPR.ZMA EXP/CVE-2013-1331.A Exploit.OLE2.CVE-2013-1331.a Exploit.OLE2 MSWord/ScriptBridge.NT!exploit.CVE20131331 Win32/Trojan.Exploit.124


By utilizing stolen credentials, the actor was able to manipulate the update server for M.E.Doc to proxy connections to an actor-controlled server.


A backdoor also known as: W32.FamVT.BrontokTiwiHV.Worm Worm/W32.Brontok.87061 Email-Worm.Win32.Brontok!O Worm.Rahiwi.A3 W32/Brontok.am Trojan.Heur.fmMfr5EYVjjib Win32.Trojan.VB.bb W32.Rahiwi.A Win32/Tnega.OPKOELC WORM_BRONTOK.SMB Email-Worm.Win32.Brontok.am Trojan.Win32.Brontok.dmfkjc I-Worm.Win32.A.Brontok.58368[UPX] Worm.Brontok.Win32.1133 WORM_BRONTOK.SMB BehavesLike.Win32.YahLover.mt Email-Worm.Win32.Brontok Worm.Brontok.bt W32.Worm.Rahiwi WORM/Brontok.AM.15 Worm[Email]/Win32.Brontok W32.W.Brontok.mjGp Email-Worm.Win32.Brontok.am Worm:Win32/Rahiwi.A Worm/Win32.Brontok.C47526 Worm.Brontok I-Worm.VB.ET Worm.Win32.Brontok.aab I-Worm.Brontok!pJaU4TE3gZk W32/AutoRun.RPV!worm


Traditionally, the group attacked organizations in the US as well as other targets.


Last month at the CERT-EU Conference in Brussels, Belgium, Volexity gave a presentation on a recent evolution in how attackers are maintaining persistence within victim networks.


A backdoor also known as: Trojandownloader.Tedekeh BehavesLike.Win32.AdwareDealPly.tc TrojanDownloader:Win32/Tedekeh.A PUP.Optional.BundleInstaller Trj/CI.A


MalwareBytes recently encountered an atypical case of Sundown EK in the wild – usually the landing page is obfuscated, but in this case there was plain JavaScript.


We have observed this group targeting defense, aerospace, and legal sector companies.


A backdoor also known as: Trojan/W32.Small.32256.ACD Trojan/PSW.Ruftar.pmc BAT/LockScreen.EB Virus.BAT.Disabler


A backdoor also known as: Trojan.PasswordStealer Trojan.Zusy.D40C66 Win32.Trojan.WisdomEyes.16070401.9500.9505 Trojan.Win32.Steam.exnrza Trojan.Win32.Z.Zusy.517120.A W32.W.AutoRun.lmJt Trojan.PWS.Steam.14964 BehavesLike.Win32.Dropper.hh Trojan.Win32.PSW W32/Trojan.OYNU-3017 PWS:Win32/PWSteal.R!bit Trj/CI.A W32/Delf.ORF!tr.pws


In recent weeks we've discovered that the group have been actively updating their Clayslide delivery documents, as well as the Helminth backdoor used against victims.


These attacks involved ITG03 actors inserting malware between an ATM and its home bank network, and likely required advanced knowledge of the ATM's network path or prior access to a bank's network.


A backdoor also known as: HackTool.Sileco.IM3 Worm.Palevo.Win32.123726 Trojan/Downloader.Small.aolo Win32.Trojan.Shellcode2EXE.a P2P-Worm.Win32.Palevo.fiqf Trojan.Win32.Palevo.etybtm TrojWare.Win32.TrojanDownloader.Small.aolo0 Trojan:W32/Shell2Exe.A Win32/PatchFile.gk Worm[P2P]/Win32.Palevo TrojanDownloader:Win32/Sileco.A P2P-Worm.Win32.Palevo.fiqf Downloader/Win32.Small.R3049 Worm.Palevo Trojan.Silvana Win32.Trojan.Manualpatched.Dkq Trojan-Downloader.Win32.Sileco Trj/CI.A Win32/Worm.P2P-Worm.fb5


The actors typically steal from financial institutions using targeted malware.


A backdoor also known as: Trojan.Nubuler.D Downloader.Small.Win32.102411 Win32.Trojan-Downloader.Small.cj TROJ_NEBULER.SMF Trojan.MulDrop.origin TROJ_NEBULER.SMF BehavesLike.Win32.PWSOnlineGames.kc BDS/WinO.A Trojan:Win32/Nebuler.D Trojan.Nebuler.1 Trojan/Win32.CSon.R566 Nebuler.b Trojan.Win32.Nebuler


How does Chrysaor work ? To install Chrysaor , we believe an attacker coaxed specifically targeted individuals to download the malicious software onto their device .


This is due to the fact that the exploit has been integrated into several exploit kits and many end users have not yet patched their machines.


This research note outlines what we know about the use of Hacking Team's Remote Control System RCS by South Korea's National Intelligence Service NIS.


The goal of this paper is to provide some updates to our previous FTA on AlienSpy, the predecessor of JSocket, and to discuss its Android capabilities in detail.


The first malware program belonging to this family was spotted in May 2016 and was dubbed Linux.DDoS.87.


A backdoor also known as: Trojan.Vbiframe Trojan/Refroso.cwic Trojan.Strictor.D1D61 TROJ_CLICKER.CAQ Win32.Trojan.WisdomEyes.16070401.9500.9939 TROJ_CLICKER.CAQ Win.Trojan.Clicker-3888 Trojan-Clicker.Win32.VBiframe.fgl Virus.Win32.Sality.bgiylc Trojan.Win32.A.Refroso.110901 Troj.Clicker.W32.Vbiframe!c TrojWare.Win32.Downloader.VBIFrame.IK Trojan.Click.25308 Trojan.VBiframe.Win32.382 BehavesLike.Win32.BadFile.cc Trojan-Clicker.Win32.VBiframe TrojanClicker.VBiframe.vg Trojan/Win32.Refroso Trojan:Win32/Punad.G Trojan-Clicker.Win32.VBiframe.fgl Trojan/Win32.Clicker.R3068 SScope.Trojan.VBRA.3659 Trj/Clicker.ARC Trojan.DL.Pacoheir!0uqYAwP2RQg Win32/Trojan.Clicker.bd6


This powerful corporate espionage threat is specifically designed to target large enterprises in the technology, pharma, commodities and legal sectors, penetrating their security and exfiltrating commercially sensitive information.


A backdoor also known as: W32.ConfickerIOC.Worm Win32.Worm.Conficker.A Worm/W32.Kido.12304 Net-Worm.Win32.Kido!O Worm.Kido.11922 Trojan/Conficker.dam Win32.Worm.Conficker.m W32/Conficker.G W32.Downadup Win32/Conficker.B Win.Trojan.Rootkit-58 Win32.Worm.Conficker.A Net-Worm.Win32.Kido.jq Win32.Worm.Conficker.A Trojan.Win32.Kido.ghbd Worm.Win32.Conficker.4096 Win32.Worm.Conficker.A Trojan:W32/Downadup.AL Win32.HLLW.Autoruner.5555 Worm.Conficker.Win32.405 Net-Worm.Win32.Kido W32/Conficker.UCIE-3981 Worm/Kido.hw Worm[Net]/Win32.Kido Win32.Worm.Conficker.A Net-Worm.Win32.Kido.jq Trojan:WinNT/Conficker.B Win32/Conficker.worm.4096 Win32.Worm.Conficker.A Net-Worm.Kido Rootkit/Conficker.C Win32/Conficker.AA Trojan.Win32.Conficker.dd Worm.Conficker!L/CdK4RT60g Win32/RootKit.Conficker.A


Over the past seven months, Unit 42 has been investigating a series of attacks we attribute to a group we have code named Scarlet Mimic. The attacks began over four years ago and their targeting pattern suggests that this adversary's primary mission is to gather information about minority rights activists.


Recently McAfee labs came across a point-of-sale POS malware that spreads through malicious macros inside a doc file.


In October 2014, Kaspersky Lab started to research Blue Termite an Advanced Persistent Threat APT targeting Japan.


Just in May, we pointed out how it had gone through six separate versions with various differences in its routines.


A backdoor also known as: Trojan/Spy.Bancos.if Trojan.Heur.EED312 TROJ_BANKER.BTB Win32.Trojan.Bancos.a Infostealer.Bancos TROJ_BANKER.BTB Win.Trojan.Bancos-122 Trojan-Banker.Win32.Bancos.if Trojan.Win32.Bancos.gaxc Troj.Banker.W32.Bancos.if!c TrojWare.Win32.Spy.Bancos.U Trojan.Bancos.Win32.1340 Trojan:Win32/Vlight.A TR/Spy.Bancos.IF Trojan[Banker]/Win32.Bancos Win32.Troj.Bancos.if.kcloud Trojan:Win32/Vlight.A Trojan-Banker.Win32.Bancos.if Win32.Trojan-banker.Bancos.Eehf Trojan.PWS.Bancos.OGQ Trojan-Banker.Win32.Bancos W32/Bancos.NJN!tr


A backdoor also known as: Trojan.Dynamer.AP3 TROJ_VBNA.SMD Win32.Trojan.Paskod.a TROJ_VBNA.SMD Trojan.Win32.Dynamer.lpd Trojan.Win32.Dynamer.exrxxx Trojan.Win32.Z.Paskod.114692.A Troj.W32.Dynamer.mqvJ TrojWare.Win32.Paskod.D Trojan.DownLoader11.38900 Trojan.Dynamer.Win32.5199 Trojan.Win32.Paskod Trojan/Dynamer.cli TrojanDownloader:Win32/Tinub.A Trojan.Heur.VB.E4CDDB Trojan.Win32.Dynamer.lpd Trojan/Win32.VBCrypt.R122576 BScope.Trojan.Diple Trj/GdSda.A Win32.Trojan.Dynamer.Tcbz W32/Paskod.E!tr Win32/Trojan.ff1


One malware family seen in such attacks is known as SamSa', Samas', samsam', or most recently, MOKOPONI'.


It seems to be part of a larger campaign, known as Pawn Storm


Windows malware, also detected as: Trojan.Autoit, Trojan.Symmi.D10095, Trojan.Win32.Autoit.exnvng, Trojan.Win32.Z.Autoit.1079042, Troj.W32.Autoit!c, Trojan.Inject1.38999, Trojan.AutoIt.Win32.7, BehavesLike.Win32.Trojan.th, Trojan.Win32.Eupuds, Trojan.Autoit.ixi, Trojan:Win32/BrobanEup.A, Trojan.Autoit.Banker, Win32.Trojan.Autoit.Szbl, W32/Autoit.AAV!tr, Win32/Trojan.839,


The campaign has many stages of the infection chain and all needed to be unraveled before the final payload level was reached.


A backdoor also known as: W32.InterneC.Worm Trojan.Downloader.VB.VRF Trojan-PWS/W32.WebGame.24576.IS Trojan.VB.Win32.91134 Troj.GameThief.W32.OnLineGames.tqmr!c Trojan/VB.nti TROJ_DLOAD.FH W32/Worm.AUBX TROJ_DLOAD.FH Win.Spyware.56255-2 Trojan.Downloader.VB.VRF Trojan.Downloader.VB.VRF Trojan.Win32.OnLineGames.tibz Trojan.Win32.PSWIGames.24576.GZ Trojan.Downloader.VB.VRF Trojan.Downloader.VB.VRF Trojan.DownLoader.55879 BehavesLike.Win32.Trojan.mz W32/Worm.EUBY-4599 Trojan/PSW.OnLineGames.asrj TR/PSW.OnlineGames.tqmr Trojan[GameThief]/Win32.OnLineGames Trojan.Downloader.VB.VRF Trojan/Win32.OnlineGameHack.C140754 Trojan.Downloader.VB.VRF TrojanPSW.OnLineGames.a Win32.Trojan-GameThief.Onlinegames.inv Trojan.Mansund!mgpvcbFSAhU Trojan-GameThief.Win32.OnLineGames


Indicators of Compromise ( IoCs ) SHA256 Detection e394e53e53cd9047d6cff184ac333ef7698a34b777ae3aac82c2c669ef661dfe AndroidOS_SpyAgent.HRXB e8d4713e43241ab09d40c2ae8814302f77de76650ccf3e7db83b3ac8ad41f9fa AndroidOS_ProjectSpy.HRX 29b0d86ae68d83f9578c3f36041df943195bc55a7f3f1d45a9c23f145d75af9d AndroidOS_ProjectSpy.HRX 3a15e7b8f4e35e006329811a6a2bf291d449884a120332f24c7e3ca58d0fbbdb IOS_ProjectSpy.A URLs cashnow [ .


A backdoor also known as: Trojan.Downloader Win32/Tnega.CfCAeIB Win.Trojan.Downloader-64707 Application.Win32.Kuaiba.BC Trojan.DownLoader10.13268 BehavesLike.Win32.Downloader.tc Win32.Trojan-Downloader.GMUnpackerInstaller.B


Though there were multiple waves of messages following a similar tactic, each one carried the same malicious .doc file as an attachment SHA256: 6b9af3290723f081e090cd29113c8755696dca88f06d072dd75bf5560ca9408e.


The actor has used several notable techniques in these incidents such as sniffing passwords from Wi-Fi traffic, poisoning the NetBIOS Name Service, and spreading laterally via the EternalBlue exploit.


A backdoor also known as: Win32.Troj.Undef.kcloud Win32/Trojan.e6d


During our analysis, we determined that Komplex was used in a previous attack campaign targeting individuals running OS X that exploited a vulnerability in the MacKeeper antivirus application to deliver Komplex as a payload.


A backdoor also known as: W64/Risk.SHRD-0827 Riskware.Win64.Pwdump.bjsgmx Tool.Pwdump.80 W64/MalwareF.NVZY SPR/Tool.174080.1 Trojan[PSWTool]/Win32.CacheDump PUP.Optional.PasswordDump Trj/CI.A Riskware.Pwdump! not-a-virus:PSWTool.Win32.PWDump


A backdoor also known as: TROJ_DROPER.SMIA Win32.Trojan-Dropper.Delf.ay W32/Backdoor.WJXY-0415 Win32/Tnega.IX TROJ_DROPER.SMIA Trojan.Win32.Delf.cvuwsq Backdoor.Win32.ProRat.~O Trojan.Inject.5089 W32/Backdoor2.DVXL TrojanDropper:Win32/Amighelo.A Trojan.Heur.ED7518 Trojan.Win32.PSWIGames.1110528 Trojan.Amighelo Win32/TrojanDropper.Delf.NOD Trojan-Dropper.Win32.OnLineGames


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9770 Trojan.FakeAV.13061 Worm:Win32/Gnoewin.A W32.W.Otwycal.l4av Win32/RiskWare.PEMalform.E


A backdoor also known as: Trojan.BitMiner Trojan.Zusy.D41F53 Tool.BtcMine.1195 Backdoor.PePatch.Win32.108542 BehavesLike.Win32.Backdoor.th PUA.CoinMiner RiskTool.BitMiner.au RiskWare[RiskTool]/Win32.BitCoinMiner Trojan:Win32/Optiminz.A Unwanted/Win32.BitCoinMiner.R215923 Trj/CI.A Win32/Virus.RiskTool.435


The malware checks for sinkholing of its control servers before each network communication session and does not initiate its malicious activities—such as downloading and running the malicious payloads—if it thinks the Domain Name Service DNS records have been sinkholed.


However, the recent activity caught our attention due to a change to the URL structure of the landing pages.


When running, the Kronos payload will download several other pieces of malware, but the one that caught our eye is a new credit card dumper with very low detection.


A backdoor also known as: Trojan.Ursnif.100315 Trojan.Filecoder.Win32.1880 Uds.Dangerousobject.Multi!c TROJ_HPROVNIX.SM Win32.Trojan.WisdomEyes.16070401.9500.9985 Ransom.Cryptolocker TROJ_HPROVNIX.SM Trojan-Ransom.Win32.Snocry.dmd Trojan.Win32.Encoder.eaaxms Trojan.Win32.Z.Razy.262660 Trojan.Encoder.3689 BehavesLike.Win32.VirRansom.dh W32/Trojan.RVGU-3177 Trojan.Cryptolocker.c TR/WinPlock.262656 Trojan[Ransom]/Win32.Cryptolocker Ransom:Win32/WinPlock.A Trojan.Razy.D2A0E Trojan-Ransom.Win32.Snocry.dmd Trojan/Win32.CryptoWall.R173903 Trojan.Ransom.cryptolocker Ransom.FileCryptor Trj/GdSda.A Win32/Filecoder.NFJ Win32.Trojan.Filecoder.Wncw Trojan.Cryptolocker! Trojan.Win32.Filecoder W32/HPROVNIX.SM!tr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9960 Virus.Win32.Virut W32.Dropper.Dunik


However, the malware is flexible enough to grant access to all the resources in the victim's computer.


A backdoor also known as: Trojan/W32.Hexzone.352256 Trojan-Ransom.Win32.Hexzone.1!O Trojan.Hexzone Win32.Trojan.WisdomEyes.16070401.9500.9952 Trojan.Hexzone Ransom_Hexzone.R002C0DAD18 Trojan.Win32.Hexzone.ewziqv Trojan.Win32.Hexzone.352256 Troj.Ransom.W32.Hexzone!c TrojWare.Win32.Ransom.Hexzone.~jap3 Trojan.Blackmailer.454 Ransom_Hexzone.R002C0DAD18 Trojan-Ransom.Win32.Hexzone Trojan.Hexzone.q Trojan[Ransom]/Win32.Hexzone Adware.Heur.E6B8C4 Adware.Vundo/Variant-LIB Trojan:Win32/Hexzone.A!dll Trojan/Win32.Hexzone.R6919 Win32/Hexzone.I Trojan.Hexzone!FZcXjlI3fIw


Further investigation of GhostPush revealed more recent variants, which, unlike older ones, employ the following routines that make them harder to remove and detect:


A backdoor also known as: Trojan/Downloader.Intexp.c Win32.Trojan.WisdomEyes.16070401.9500.9782 W32/Downloader.AJWJ Adware.IEPlugin Win.Downloader.64050-1 Trojan-Downloader.Win32.Intexp.c Trojan.Win32.Intexp.didb Trojan.Win32.Downloader.33280.AKE Troj.Downloader.W32.Intexp.c!c Win32.Trojan-downloader.Intexp.Alsx TrojWare.Win32.TrojanDownloader.Intexp.C Trojan.DownLoader.2369 Downloader.Intexp.Win32.13 BehavesLike.Win32.Koobface.nc Trojan-Downloader.Win32.OneClickNetSearch W32/Downloader.XUJA-4048 TrojanDownloader.Intexp.c W32.Malware.Downloader TR/Dldr.Intexp.B Trojan[Downloader]/Win32.Intexp Win32.TrojDownloader.Intexp.c.kcloud Trojan.Graftor.Elzob.DF6F Trojan-Downloader.Win32.Intexp.c TrojanDownloader:Win32/Intexp.C Trojan/Win32.HDC.C83257 TrojanDownloader.Intexp Win32/TrojanDownloader.Intexp.C Trojan.DL.Intexp!uQMofoaT248 W32/Malware_fam.NB


A backdoor also known as: Trojan.Multi Trojan.Win32.VB.dmoq Trojan.Win32.VB.ewrjie Trojan.Win32.Z.Camec.51712 Uds.Dangerousobject.Multi!c Win32.Trojan.Vb.Llgx BehavesLike.Win32.Trojan.qc Trojan/Win32.VB Trojan.Win32.VB.dmoq Trojan:Win32/Camec.B Trj/GdSda.A Trojan.Win32.Camec Win32/Trojan.7b5


A backdoor also known as: Trojan.Delf.Win32.27191 Trojan/Delf.ahzk Trojan.Zusy.D3A909 Win32.Backdoor.Lukicsel.c Win32/Bifrose.AAB Win.Spyware.80655-2 W32.Lamer.lwJ1 TrojWare.Win32.Trojan.Lukicsel.~Q Trojan.MulDrop1.48720 BehavesLike.Win32.Eggnog.fc Trojan/Delf.qyz Trojan/Win32.Delf TrojanDropper:Win32/Lukicsel.B Trojan.Win32.Delf.364544.B Trojan.Delf Win32/Lukicsel.Q W32/Crypt.NTAB!tr


The use of adult-themed content echoes the one-click billing fraud app we've covered a few years back.


SHA256 Package Name App Name a6c7351b09a733a1b3ff8a0901c5bde fdc3b566bfcedcdf5a338c3a97c9f249b com.android.henbox 备份 ( Backup ) Table 3 HenBox variant used in description Once this variant of HenBox is installed on the victim ’ s device , the app can be executed in two different ways : One method for executing HenBox is for the victim to launch the malicious app ( named “ Backup ” , in this instance ) from the launcher view on their device , as shown in Figure 3 below .


A backdoor also known as: Backdoor.MSIL Backdoor.Telebot BKDR_TELEBOT.VBV Win.Trojan.Nyetya-6332125-0 Backdoor.Msil.Teledoor!c Win32.Trojan.Telebot.Acxl BackDoor.Medoc.2 Trojan.TeleDoor.Win32.2 BKDR_TELEBOT.VBV Backdoor.Teledoor W32/Trojan.RZZO-3107 Backdoor.MSIL.ojt W32.Backdoor.Medoc TR/TeleDoor.ME.1 Trojan[Backdoor]/MSIL.TeleDoor Trojan/Win32.TeleDoor.C2029730 Backdoor.MSIL.Telebot Bck/Teledoors.A Trojan.TeleDoor!


A backdoor also known as: Trojan.BitMin.Win32.519 Trojan.Strictor.D1BA5D Trojan.Script.AutoIt.emewzp Trojan.BtcMine.1084 BehavesLike.Win32.BadFile.wc TR/BitCoinMiner.zzzlc Trojan/Win32.BitMin.C1728272 Trojan.Win32.Autoit Trj/CI.A


A backdoor also known as: Win32/PSWSpider.E Backdoor.Bancodor.M Backdoor.Bancodor.M Backdoor.Bancodor.M Backdoor/Bancodor.m Backdoor.Bancodor.M W32/Bancodor.T@bd Backdoor.Badcodor Win32/Bancodor.M BKDR_BANCODOR.M Win.Trojan.Bancodor-27 Backdoor.Win32.Bancodor.m Trojan.Win32.Bancodor.dbrs Backdoor.Win32.Bancodor.513024[h] Backdoor.W32.Bancodor.m!c Backdoor.Bancodor.M Backdoor.Win32.Bancodor.~O Backdoor.Bancodor.M Trojan.Bancdo Backdoor.Bancodor.Win32.40 BKDR_BANCODOR.M W32/Bancodor.UWGT-1776 Backdoor/Bancodor.ak BDS/Bancodor.M.1 Trojan[Backdoor]/Win32.Bancodor Backdoor.Bancodor.M Backdoor:Win32/Bancodor.M Win-Trojan/Bancodor.513024.C Backdoor.Bancodor Bck/Bancodor.E Win32.Backdoor.Bancodor.Oyep Backdoor.Bancodor!IZl0vEMNH4U Backdoor.Win32.Bancodor Backdoor.Bancodor.M BackDoor.Bancodor.AS Backdoor.Win32.Bancodor.m


A backdoor also known as: Trojan.Dropper.GreenStuff.1.7 Win32.Trojan.WisdomEyes.16070401.9500.9688 Trojan.Dropper Win32/Pasorot.D Win.Trojan.Greenstuff-3 Trojan.Dropper.GreenStuff.1.7 Trojan-Dropper.Win32.GreenStuff.17 Trojan.Dropper.GreenStuff.1.7 Troj.Dropper.W32.GreenStuff.17!c Win32.Trojan-dropper.Greenstuff.Ebgv Trojan.Dropper.GreenStuff.1.7 TrojWare.Win32.TrojanDropper.GreenStuff.17 Trojan.Dropper.GreenStuff.1.7 Trojan.MulDrop.365 Dropper.GreenStuff.Win32.14 BehavesLike.Win32.Trojan.dc W32/Trojan.KLUP-2808 TrojanDropper.Exebinder TR/Pasorot.g Trojan[PSW]/Win32.Pasorot Trojan.Dropper.GreenStuff.1.7 Trojan-Dropper.Win32.GreenStuff.17 TrojanDropper:Win32/GreenStuff.1_7 Trojan/Win32.Downloader.C112567 TScope.Malware-Cryptor.SB Trj/Dropper.WF Win32/TrojanDropper.GreenStuff.17 W32/GreenSt.B!tr.dr


A backdoor also known as: MemScan:Trojan.Downloader.Modgof.A MemScan:Trojan.Downloader.Modgof.A Trojan.Scar.daok Trojan.Win32.Scar.tlmwj TROJ_AZAH.A Trojan.Win32.Scar.daok MemScan:Trojan.Downloader.Modgof.A Trojan.Scar!ZI1ghG8RGXc MemScan:Trojan.Downloader.Modgof.A Trojan.MulDrop1.43719 TROJ_AZAH.A Win32.Troj.Scar.kcloud Trojan.Win32.A.Downloader.120320.DL MemScan:Trojan.Downloader.Modgof.A Worm.Win32.FakeFolder.b W32/AZAH.A!tr


A backdoor also known as: Trojan.FakeGina.X Trojan.Fakegina Trojan.FakeGina.X Trojan/FakeGina.b TROJ_FAKEGINA.AA Win32.Trojan.FakeGina.b W32/Risk.LOJP-2889 Trojan.Fakegina TROJ_FAKEGINA.AA Trojan.FakeGina.X Trojan.FakeGina.X Trojan.FakeGina.X TrojWare.Win32.FakeGina.~B Trojan.FakeGina.X Trojan.FakeGina.Win32.121 Trojan.Win32.FakeGina W32/MalwareF.NCOX Trojan/Win32.FakeGina Trojan.FakeGina.X Trojan:Win32/Fakegina.T Trojan/Win32.FakeGina.R77324 Win32/FakeGina.B Win32.Trojan.Fakegina.Wmst W32/FakeGina.AA!tr


The campaign targeted Japanese organizations by using at least two legitimate Japanese websites to host a strategic web compromise SWC, where victims ultimately downloaded a variant of the SOGU malware.


It connects to a certain URL, likely controlled by the attacker, using a specific Go user-agent:


The first phase is receiving malspam from a botnet.


A backdoor also known as: Trojan.Graftor.D49E51 W32/Trojan.ULWD-7621 Trojan.Win32.Drop.elkhrw BehavesLike.Win32.Sivis.kh Trojan-Dropper.Win32.Rubat W32/Win.G Trojan.SchoolGirl.er TR/Drop.Rubat.qlzld TrojanDropper:Win32/Rubat.A!bit Trojan.SchoolGirl


A backdoor also known as: W32.CominateU.Adware Trojan-GameThief.Win32.OnLineGames!O TrojanGameThief.OnLineGames Trojan.OnLineGames.Win32.78851 Trojan/OnLineGames.boaj Trojan.Zusy.Elzob.D484 W32/Risk.ADYI-1535 TSPY_ONLIN.SMUM Win.Spyware.82985-2 Trojan-GameThief.Win32.OnLineGames.boaj Trojan.Win32.OnLineGames.cptyo BackDoor.Sturf.170 TSPY_ONLIN.SMUM W32/MalwareF.AEIUQ Trojan/PSW.OnLineGames.cedq TR/Spy.671314 Trojan[GameThief]/Win32.OnLineGames Trojan-GameThief.Win32.OnLineGames.boaj Trojan/Win32.OnlineGameHack.R11892 TrojanPSW.OnLineGames.bo Win32/PSW.OnLineGames.QDP Trojan.PWS.OnLineGames!mLCnhslfoqM Trojan-GameThief.Win32.OnLineGames W32/Onlinegames.BOJI!tr.pws


A backdoor also known as: Trojan/W32.Timer.55808.B Trojan-Ransom.Win32.Timer!O Trojan/Kryptik.sot Trojan.Boigy.4 TROJ_RANSOM.SMMJ Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Ransom.GED TROJ_RANSOM.SMMJ Trojan-Ransom.Win32.Timer.icg Trojan.Win32.Timer.dqvge Trojan.Win32.A.Timer.55808 Trojan.Winlock.4005 Trojan/Timer.cnd TR/Ramson.TR TrojanDropper:Win32/Dinome.A Trojan-Ransom.Win32.Timer.icg Trojan/Win32.Ransomlock.R11433 BScope.Trojan.Winlock.01505 Trj/Hexas.HEU Trojan-Downloader.Win32.Karagany


A backdoor also known as: Ransom/W32.Foreign.409600.C Trojan.Foreign Ransom_Foreign.R002C0DB418 Trojan-Ransom.Win32.Foreign.nxzy Trojan.Win32.Spambot.exqsne Trojan.Win32.Z.Trubsil.409600 Troj.Ransom.W32.Foreign!c Trojan.Spambot.15075 Ransom_Foreign.R002C0DB418 BehavesLike.Win32.Ransom.gc TR/Crypt.ZPACK.lpngp Backdoor:Win32/Trubsil.C Trojan-Ransom.Win32.Foreign.nxzy Trojan/Win32.Foreign.C2394896 TrojanRansom.Foreign Trj/GdSda.A W32/Kryptik.FRKA!tr


A backdoor also known as: W32.DakusarDRAX.Trojan Trojan.Floxif Win32.Trojan.WisdomEyes.16070401.9500.9948 Win32/Flofix.D TROJ_FLOXIF_EK040354.UVPM Trojan.Win32.Floxif.cqjmcu Win32.FloodFix Trojan.Floxif.Win32.2 TROJ_FLOXIF_EK040354.UVPM TR/Spy.69337 Trojan:Win32/Floxif.E Virus/Win32.Fixflo.R204310 Trojan.Sly Win32/Floxif.E W32/Floxif.E


] com Malicious Twitter accounts : https : //twitter.com/lucky88755 https : //twitter.com/lucky98745 https : //twitter.com/lucky876543 https : //twitter.com/luckyone1232 https : //twitter.com/sadwqewqeqw https : //twitter.com/gyugyu87418490 https : //twitter.com/fdgoer343 https : //twitter.com/sdfghuio342 https : //twitter.com/asdqweqweqeqw https : //twitter.com/ukenivor3 Malicious Instagram account : https : //www.instagram.com/freedomguidepeople1830/ Malicious Tumblr accounts : https : //mainsheetgyam.tumblr.com/ https : //hormonaljgrj.tumblr.com/ https : //globalanab.tumblr.com/ C & C addresses : 104 [ .


Unit 42 discovered new activity that appears related to an adversary group previously called C0d0so0 or Codoso


We have observed download attempts from the following domains:


In 2022, they updated SysUpdate, one of their custom malware families, to include new features and add malware infection support for the Linux platform.


A backdoor also known as: HW32.Packed.3797 JS.Nemucod.LK VBS/DropExe.A!Camelot Trojan.Script.MLW.eafugn VBS.Dropper.102 TrojanDropper.VBS.aq TrojanDropper:VBS/Twexag.A


East Asian government agencies came under siege when attackers targeted several servers within their networks.


A backdoor also known as: W32/AutoRun.autv W32/Sohanad.G WORM_SOHANAD.DX Virus.Worm.AutoRun!IK Win32.HLLW.Autoruner.8327 WORM_SOHANAD.DX W32/Sohanad.G Worm/AutoRun.mky Malware.Imaut Virus.Worm.AutoRun SHeur.CIAA Trj/CI.A


A backdoor also known as: Trojan.RansomKD.6014218 Ransom.Chicrypt Ransom.Chimera Trojan/Kryptik.edes Trojan.RansomKD.D5BC50A Ransom_Chicrypt.R002C0DIL17 W32/Ransom.IF Trojan-Ransom.Win32.Chimera.q Trojan.RansomKD.6014218 Trojan.Win32.Encoder.esuyoq Troj.Ransom.W32!c Win32.Trojan.Chimera.Edei Trojan.RansomKD.6014218 Trojan.RansomKD.6014218 Trojan.Encoder.2774 W32/Ransom.KXVS-1328 W32.Ransom.Chimera Trojan[Ransom]/Win32.Chimera Ransom:Win32/Chicrypt.A Trojan.Win32.Z.Ransom.647242 Trojan-Ransom.Win32.Chimera.q Win32.Trojan-Ransom.Chimera.D Trojan/Win32.Chimera.C1182585 Trojan.RansomKD.6014218 Hoax.Chimera Trojan.Kryptik!1o3s7Z7mkiE W32/Chimera.EDES!tr Win32/Trojan.37c


A backdoor also known as: W32.ClickerAybn.Trojan Trojan-Spy.Win32.VB!O Trojan.Puzlice.A3 Win32.Trojan-Clicker.VB.c Win32/TrojanClicker.VB.NUE Win.Trojan.7640471-1 Worm.Win32.Autorun.gxay Trojan.Win32.VB2.cnioik Trojan.Win32.A.VB.55040 W32.Virut.lQTU TrojWare.Win32.Spy.VB.FRG Trojan.VbCrypt.68 Trojan.VB.Win32.83289 BehavesLike.Win32.Malware.nc Virus.Win32.Virut TrojanSpy.VB.cxx Trojan[Spy]/Win32.VB Worm.Win32.Autorun.gxay Trojan:Win32/Puzlice.A Win32/VB.BXL TScope.Trojan.VB Trojan.Vilsel TrojanSpy.VB!jmRymi1V2Tw W32/VBClicker.NUE!tr


A pro-democracy reform took place in 2011 which has helped the government create an atmopshere conducive to investor interest.


A backdoor also known as: Backdoor.Turla.B5 BKDR64_TURLA.NUS Trojan.Turla BKDR64_TURLA.NUS Win64.Rootkit.Uroburos.A Backdoor.Win64.Turla.c Trojan.Win64.Turla.dflvhj BackDoor.Turla.17 Trojan.Turla.Win64.1 BDS/Turla.fech Backdoor.Win64.Turla.c Backdoor:Win64/Turla.B!dha Trojan/Win64.Turla.C560438 Backdoor.Turla Trj/CI.A Win64/Turla.A Win32.Trojan.Url.Fdjm Trojan.Turla!2u6AW7YKCfw


A backdoor also known as: Trojan.Japik.6 TROJ_IKYTOK.SMI Win32.Trojan.WisdomEyes.16070401.9500.9979 Trojan.Ransomlock TROJ_IKYTOK.SMI Trojan.Packed.2232 Trojan.Kryptik.Win32.166130 BehavesLike.Win32.VTFlooder.fc Trojan-Downloader.Win32.Karagany TrojanDropper.Mudrop.cmh TrojanDropper:Win32/Sinmis.B Trojan/Win32.Menti.R9584 BScope.Malware-Cryptor.Tip


A backdoor also known as: Trojan.Dynamer.S23079 Win32.Trojan.Kryptik.bil Win.Malware.Zusy-5689799-0 Trojan.Inject2.38898 Trojan.Kryptik.Win32.992532 BehavesLike.Win32.PWSZbot.cm Trojan.Win32.Extenbro Backdoor.Androm.mnb TR/Crypt.ZPACK.pwvcr Trojan.Symmi.D10FCD Trojan/Win32.Androm.R192120


A backdoor also known as: PDF/Phish.ECM Win32.Exploit.Pidief.Aexw PDF/Phish.ECM EXP/Pidief.EB.494 Exp.Pidief.Eb!c Trojan.PDF.Phishing Win32/Trojan.Exploit.ec6


A backdoor also known as: HackTool.TSGrinder Trojan/Hacktool.TSGrinder.a W32/Tool.JPZP-4469 Crackin.0AC64262 HackTool.Win32.TSGrinder.a Trojan.Win32.TSGrinder.scgl HackTool.TSGrinder.192570 Hacktool.W32.Tsgrinder!c ApplicUnsaf.Win32.HackTool.TSGrinder.a Tool.TSGrinder W32/VirTool.AYV W32.Hack.Tool HackTool/Win32.TSGrinder HackTool.Win32.TSGrinder.a HackTool:Win32/Tsgrinder.A Win32.Hacktool.Tsgrinder.Stkm HackTool.TSGrinder!LpD0k7ExEpE HackTool.Win32.TSGrinder.a


A backdoor also known as: TrojanDownloader.Lorozoad.A3 Trojan.Razy.D2614 Win32.Trojan.WisdomEyes.16070401.9500.9997 Win.Trojan.Lorozoad-1 Trojan.MSIL.Disfa.mcnf Trojan.Win32.Tiny.etgbky Trojan.Win32.Z.Razy.4608.CD Troj.Msil.Disfa!c TrojWare.MSIL.TrojanDownloader.Tiny.MXA BehavesLike.Win32.Trojan.xz TR/Dropper.MSIL.nsnpx Trojan.MSIL.Disfa.mcnf Trj/GdSda.A Msil.Trojan.Disfa.Pctb Trojan.Disfa!3Wzl0Mq4C1c Trojan-Downloader.MSIL.Tiny MSIL/Tiny.MX!tr.dldr Win32/Trojan.85b


A backdoor also known as: W32.DownloadPdzLnrA.Trojan Worm.Win32.WBNA!O W32/WBNA.asj Win32.Trojan.WisdomEyes.16070401.9500.9988 Win.Trojan.Wbna-299 Worm.WBNA.Win32.2209 BehavesLike.Win32.VBObfus.qt W32/VB.PID!tr.dldr Worm/Win32.WBNA Worm.WBNA Win32/TrojanDownloader.VB.PID Trojan-Downloader.Win32.VB Win32/Trojan.c6e


A backdoor also known as: W32/Trojan.LNJS-3256 Trojan.Win32.Mazel.dsuwke BehavesLike.Win32.Sytro.lc TR/AD.Lentrigy.ejnsf RiskWare[Downloader]/NSIS.Mazel Trojan.Jaiko.851 TrojanDownloader:Win32/Rolkator.A Trj/CI.A Trojan.Win32.IRCBot Win32/Trojan.698


We have not identified any other public names for this malware, so rather than introduce a new name to the industry we'll refer to this family as Sarvdap.


This information may be useful to any incident responder or blue team looking to defend an organisation.


In addition , at this stage the app can process one of these commands : • Collect device info • Install app • Is online ? • Change server domain Out of these , the most interesting command is the “ install app ” command that downloads an encrypted zip file containing the second phase dex file , unpacks and loads it .


Infostealer.Banprox.B is a Trojan horse that may steal information from the compromised computer.


The incident used a Microsoft Excel file containing malicious macros which wrote a malicious executable and associated files to the victim machine.


A backdoor also known as: Trojan.Ransom.Locky.20 Win32.Trojan.WisdomEyes.16070401.9500.9879 Ransom_Falock.R002C0DAI18 Trojan.Win32.Z.Ransom.1819072 Ransom_Falock.R002C0DAI18 BehavesLike.Win32.Trojan.th W32/Trojan.CXBD-0386 Ransom:MSIL/Falock.A Trj/GdSda.A Trojan.MSIL.Crypt Win32/Trojan.Ransom.d73


In addition, unlike many cyber attacks, an actual physical person was present money mule to pick up the money from affected ATM machines.


A backdoor also known as: Trojan.Spammer.Mail.Norin.A Trojan/W32.Spammer.606720 Email-Flooder.W32.Norin.30!c TROJ_NORIN.30 Hacktool.Spammer TROJ_NORIN.30 Trojan.Spammer.Mail.Norin.A Email-Flooder.Win32.Norin.30 Trojan.Spammer.Mail.Norin.A Trojan.Win32.Norin.dkrt Spyware.Email-Flooder.Norin.606720 Trojan.Spammer.Mail.Norin.A Win32.Spammer.Mail.Norin.30 Trojan.Spammer.Mail.Norin.A Trojan.PWS.Wmhack Tool.Norin.Win32.1 Virus.Win32.Spammer W32/Risk.SGYO-3478 Spammer.Mail.Norin.30 TR/Flood.Norin.30 HackTool[Flooder]/Win32.Norin Win32.Hack.Norin.kcloud Trojan.Spammer.Mail.Norin.A Email-Flooder.Win32.Norin.30 Trojan.Spammer.Mail.Norin.A EmailFlooder.Norin Win32/Spammer.Mail.Norin.30 Win32.Virus.Spammer.Syhs Flooder.Norin!cC98wqxpE9A W32/Spam_Norin.30!tr Win32/Trojan.Flooder.81a


This attack might also originate from China.


A backdoor also known as: W32.HfsAutoB.186B Worm.Dorkbot.A Backdoor.W32.Padodor.kZnr Trojan/Spy.qukart Win32.Trojan-Spy.Quart.a Backdoor.Berbew!g1 Win32/Webber.W Win32.Qukart BKDR_BERBEW.SMA Win.Trojan.Crypted-36 Trojan-Proxy.Win32.Qukart.vjh Trojan.Win32.Qukart.etuxeg Worm.Win32.Qukart.K BackDoor.HangUp.43784 BKDR_BERBEW.SMA BehavesLike.Win32.Backdoor.cc Trojan.Win32.Senta TrojanProxy.Qukart.tsk Trojan-Proxy.Win32.Qukart.vjh Win-Trojan/Berbew.51712 TrojanProxy.Qukart Trojan-Ransom.Win32.Pornoasset.a


A backdoor also known as: W32.FamVT.ExpiroPC.PE Heur.Corrupt.PE Tool.BtcMine.30 Backdoor.Win32.Cycbot


Using this SSH brute-forcing network, it took the attackers only a few days to gain root access and full control of the targeted server.


A backdoor also known as: Trojan/Cosmu.ajmd Trojan.Win32.Cosmu.cptjv Trojan.Win32.Cosmu.ajmd Win32.HLLW.Zebra.2 TR/PSW.Facepass.oina Trojan/Cosmu.fqh PWS:Win32/Facepass.B Trojan.Win32.A.Cosmu.436714 Trojan.Cosmu W32/Cosmu.AJMD!tr Trj/CI.A


When we first discovered the OilRig attack campaign in May 2016, we believed at the time it was a unique attack campaign likely operated by a known, existing threat group.


Sundown is something of an outlier from typical exploit kits.


The failure of Silicon Valley Bank SVB is a good opportunity for scammers to make a buck out of the crisis, warns the SANS™ Internet Storm Center ISS in Washington DC.


For example, one version of the Shade cryptor checks victim computers for signs of accounting activity; if it finds any, it doesn't encrypt the files, but instead installs remote control tools in the infected system.


This post intends to share the results of our research.


A backdoor also known as: Trojan-Spy/W32.KeyLogger.464896.C TrojanSpy.KeyLogger!s9RPvqhksKk Infostealer.Gampass Win32.BDSBackdoor Trojan-Spy.Win32.KeyLogger.gds BackDoor.Cyber Virus.Win32.Delf.DTW!IK TrojanSpy.KeyLogger.cquv Win-Trojan/Keylogger.464896.G Trojan.Win32.Scar.cmim Trojan-PSW.Gampass Virus.Win32.Delf.DTW W32/KeyLogger.GDS!tr PSW.Keylog.AE Trj/CI.A


The appearance of such forms is generated on cybercriminals' command.


CVE-2017-11882 Exploit 8b212ee2d65c4da033c39aebaf59cc51ade45f32f4d91d1daa0bd367889f934d is a Microsoft Word RTF document that exploits `CVE-2017-11882` stack buffer overflow vulnerability in the Microsoft Equation Editor`EQNEDT32.EXE`.


This IOC contains indicators for the BLACKCOFFEE malware family that is attributed to APT17.


A backdoor also known as: Trojan.Neloweg TR/Drop.Elms.A PWS:Win32/Reder.B Trojan.Neloweg Trj/CI.A


A backdoor also known as: Trojan.Win32.Inject.cvmjon Trojan.Taidoor TROJ_DROPPE.FS Trojan-Dropper.Win32.Injector.jmli Virus.Win32.Part.a TROJ_DROPPE.FS BehavesLike.Win32.Downloader.qm TrojanDropper.Injector.bmtq Trojan[Dropper]/Win32.Injector Win32.Troj.Injector.JM.kcloud Dropper/Win32.Injector TrojanDropper.Injector W32/Injector.JMLI!tr Trojan.Win32.Injector.aJX


So we don't have a sensational hop from Linux Mirai to Windows Mirai just yet, that's just a silly statement.


A Trojan for Linux written in Go programming language.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Dropper.ALCD Win32/Rimecud.CU TROJ_DROPPR.SMF Win32.Worm.Peerfrag.Aojj Win32.HLLW.Lime.18 Worm.Palevo.Win32.18245 TROJ_DROPPR.SMF BehavesLike.Win32.Madangel.cc W32/Risk.KNKR-8810 Trojan.Zusy.D421A9 Win32/Peerfrag.DI P2P-Worm.Win32.Palevo


This variant, which we call MULTIGRAIN consists largely of a subset of slightly modified code from NewPosThings.


Whether this is a permanent return to locky or a one off, I don't know at this stage, but Locky have vanished for while before returned.


A backdoor also known as: Trojan.Win32.SamDump.emgukv Uds.Dangerousobject.Multi!c Tool.SamDump.Win32.1 W32/Trojan.PXMQ-2326 TR/Rogue.9140774 PUP/Win32.SamDump.C241237 Riskware.HackTool!GhRtS0e2yEc Win32/Trojan.f29


A backdoor also known as: Trojan.Win32.Dwn.ewbodt Trojan.Win32.Z.Starter.4103380 Trojan.DownLoader26.1573 BehavesLike.Win32.Dropper.wc Trojan.Win32.Chifrax W32/Trojan.BMGR-3693 Exploit:Win32/CplLnk.B Win32/Trojan.9b2


Because of the recent outbreak of the Locky ransomware, Dridex has become synonymous with the distribution of ransomware more generally.


PhotoMiner features a unique infection mechanism, reaching endpoints by infecting websites hosted on FTP servers while making money by mining Monero.


It includes recent incidents as well as older ones that have not been publicly reported; new malware; exploitation, delivery and command and control infrastructure; and the group s modus operandi.


That domain, electronicfrontierfoundation.org, is designed to trick users into a false sense of trust and it appears to have been used in a spear phishing attack, though it is unclear who the intended targets were.


Last week, Unit 42 came across new Disttrack samples that appear to have been used in an updated attack campaign.


For instance, its JHUHUGIT implant was delivered through a Flash zero-day and used a Windows EoP exploit to break out of the sandbox.


The group is well resourced, capable of infiltrating multiple targets simultaneously and will often operate outside the working hours of targeted organizations in order to maintain a low profile.


A backdoor also known as: TROJ_BREDLAB.SMD Trojan-Spy.Win32.Spenir.as Application.Win32.BlkIC.IMG TROJ_BREDLAB.SMD Backdoor/SdBot.prb HeurEngine.ZeroDayThreat Trojan.Win32.ProcessHijack


It continues to spread across small and medium-sized businesses across the globe, using the modular Gorynych/Diamond Fox botnet to exfiltrate stolen data.


A backdoor also known as: Hoax.Win32.ArchSMS!O Trojan.Mobsularch Trojan.ArchSMS.Win32.7426 Trojan/ArchSMS.nkit Win32.Trojan.WisdomEyes.16070401.9500.9644 TROJ_MALICIOUS_BK083028.TOMC Win.Trojan.Archsms-4649 Riskware.Win32.ArchSMS.cqmlwf TrojWare.Win32.Zusy.AJ Trojan.Fraudster.336 Trojan-Banker.Win32.Banbra Hoax.ArchSMS.jho HackTool[Hoax]/Win32.ArchSMS Win32.Troj.Hoax.kcloud Trojan:Win32/Mobsularch.A Trojan.Strictor.548 Win32.Trojan.ArchSMS.D Hoax.ArchSMS.nk Trojan.ArchSMS!pTXIElAMXBk W32/ArchSMS.VU!tr


Palo Alto Networks has collected over 20 samples of this particular malware family, and we have identified over $70,000 USD in Bitcoin payments to the attacker Cisco Talos yesterday reported this figure to be closer to $115,000 USD.


A backdoor also known as: Trojan.Pitit.A3 HV_ABTITU_CG093139.RDXN TR/Barys.2445.24 Win32.Troj.Undef.kcloud Trojan.Kazy Trojan.Win32.Loader.L


A collection of domains registered by Pawn Storm/Sofacy/APT28/Fancy Bear to target organisations


A backdoor also known as: W32.CoinMiner.A4 PUP.Optional.ChinAd W32.XiaobaMiner Win32/Oflwr.A!crypt Win.Trojan.Qhost-160 Trojan.Win32.BtcMine.exddfs Tool.BtcMine.1051 BehavesLike.Win32.Ransomware.th W32.Trojan.Qhost RiskWare/Win32.BitMiner.h Trojan.Forcud


While it has become common to see new ransomware variants being distributed daily, it is not as common to find new ransomware infections being distributed via exploit kits.


A backdoor also known as: HW32.Packed.1FBC Win32.Trojan.WisdomEyes.16070401.9500.9950 Win.Exploit.Countdown-1 BackDoor.Meterpreter.37 Troj.W32.Jorik.Skor.lrUS Trojan:Win64/Meterpreter.A Trojan/Win32.Swrort.C695042


We previously highlighted the dangers of installing apps that enable IAPs using SMS messages, as these apps typically have access to all SMS messages sent to the phone.


U.S. Allies and Rivals Digest Trump's Victory - Carnegie Endowment for International Peace.docm


During the course of our research, it became evident that this actor had not built uWarrior from scratch, but rather opted to borrow components from several off-the-shelf tools.


Hackers made a modified Linux Mint ISO, with a backdoor in it, and managed to hack the Linux Mint website to point to it.


A backdoor also known as: Trojan-Dropper.Win32.BindFile!O Trojan/Dropper.BindFile.a W32/Dropper.LIP Trojan.Spy-681 Trojan-Dropper.Win32.BindFile.e Trojan.Win32.BindFile.dcyo Trojan.Win32.BindFile.188416 PE:Dropper.BindFile.h!1173781522 TrojWare.Win32.TrojanDropper.BindFile.A Trojan.Progress.10 TrojanDropper.ExeBind.Mfc2 Dropper/Bindfile.496648 W32/Risk.SLHR-7237 Win32/TrojanDropper.BindFile.A Trojan-Dropper.Win32.BindFile W32/BindFile.A!tr Trojan.Win32.BindFile.bA


A backdoor also known as: Trojan/Kryptik.aspo JAVA_EXPLOIT.TCC JAVA_EXPLOIT.TCC Win.Trojan.Hydraq-219 Exploit.Java.CVE20131493.cqvzpg Java.S.EX-CVE-2013-1493.206981 Exploit.Java.509 EXP/Java.HLP.JM W32/Kryptik.ASPO Trojan.Graftor.D13511 Exploit.Java.CVE-2013-1493 Java/Exploit.CVE-2013-1493.AL Unk.Win32.Script.400440 Trojan.Plugax!dr/f2r5A7aY Exploit.Java.HLP virus.java.cve-2013-1493.c


We have seen Angler to be using bedep as its payload but adding vawtrak in its arsenal is something we haven't seen in the past until recently.


Attackers have been able to successfully implant JavaScript code on the login pages that enables them to surreptitiously steal employee credentials as they login to access internal corporate resources.


A backdoor also known as: Trojan.Dropper BKDR_QBOT.SM Win32.Trojan-Dropper.Small.s Win32/Qakbot.KR BKDR_QBOT.SM Trojan.Win32.Gamania.tghgw Trojan.Win32.A.Mbro.191488 Trojan.PWS.Gamania.36525 W32/Trojan.XMWQ-0223 Trojan[Backdoor]/Win32.QBot TrojanDropper:Win32/Qakbot.A Dropper/Win32.Injector.R30051 Win32/TrojanDropper.Small.NMS Trojan.Kryptik!nABTr99RVjs Backdoor.Win32.Qakbot W32/Dropper.NMS!tr Win32/Trojan.a58


As of September 17th Dyreza now counts an additional twenty organizations directly involved in Fulfillment and Warehousing; four software companies that support Fulfillment and Warehousing; five Wholesale Computer Distributors; and its credential theft triggers include Apple, Iron Mountain, OtterBox and Badge Graphics Systems and many other well-known consumer- and business-facing technology and service brands.


This malware possesses the ability to Collect information about an infected computer and transfer it to the command and control server.


Malware isn't usually thought to be old, but a recent phishing campaign using the MyDoom worm has shown that old tools can still be used to lure users into malware.


SSL is typically used to encrypt data between the client and the server, thus making the content unreadable by any systems sitting between the two end points, and significantly raising the cost of defence.


A backdoor also known as: Trojan/W32.Zapchast.113152 Backdoor.KeyBoy Trojan.Zapchast.Win32.29227 Trojan.Heur.LP.EDDB38 Win32.Trojan.WisdomEyes.151026.9950.9999 Backdoor.Kboy Trojan.Win32.Zapchast.afhn Trojan.Win32.Zapchast.cjltha Win32.Trojan.Zapchast.Htcu BehavesLike.Win32.GameVance.ch Trojan/Zapchast.iik TR/Spy.113152.29 Trojan/Win32.Zapchast Backdoor.Win32.KeyBoy.113152[h] Win-Trojan/Keyboy.113152 Trojan.Win32.Zapchast.afhn Trojan.Zapchast!0ThicNhZU3g Trojan.Win32.Zapchast W32/Zapchast.AFHN!tr Win32/Trojan.020


Bot communicates with the botmaster using non-standard protocol built on top of TCP.


A backdoor also known as: Trojan/W32.QQKiller.183808 Trojan.Qqkiller.A Trojan.QQKiller.Win32.2 Trojan.Qqkiller.A Trojan/QQKiller.a Trojan.QQKiller!Y2SikmBtqEk Win32/QQKiller.A TROJ_QQKILLER.A Trojan.Win32.QQKiller.a Trojan.Win32.QQKiller.erxn Trojan.Win32.A.QQKiller.183808[h] Trojan.Qqkiller.A TrojWare.Win32.QQKiller.A Trojan.Qqkiller.A Trojan.Nudeq TROJ_QQKILLER.A BehavesLike.Win32.HLLPPhilis.cc W32/Trojan.ELFE-7308 Trojan/Win32.QQKiller TR/QQKiller.2 W32/GWGhost.A!tr Trojan/Win32.QQKiller Trojan.Qqkiller.A Troj.W32.QQKiller.a!c Win-Trojan/QQKiller.183808 Trojan.QQKiller Win32.Trojan.Qqkiller.Szkz Trojan.Win32.QQKiller Trojan.Qqkiller.A Trojan.Win32.QQKiller.a


A backdoor also known as: Trojan/W32.Duqu.24960.B Trojan.Win32.Duqu!O Trojan/Duqu.a Trojan.Duqu.1 Win32.Trojan.WisdomEyes.16070401.9500.9896 W32/Duqu.C W32.Duqu Win32/Duqu.A RTKT_DUQU.SME Win.Trojan.Duqu-7 Trojan.Win32.Duqu.a Trojan.Win32.Duqu.eorzg Trojan.Win32.Duqu.24960 TrojWare.Win32.Duqu.A Trojan.Duqu.2 Trojan.Duqu.Win32.2 RTKT_DUQU.SME W32/Duqu.BOQU-9196 Trojan/Duqu.b TR/Duqu.A.1 Trojan/Win32.Duqu Trojan:WinNT/Duqu.B Troj.W32.Duqu.a!c Trojan.Win32.Duqu.a Trojan/Win32.Duqu.R13984 Trojan.Duqu.2102 Win32/Duqu.A Win32.Trojan.Duqu.Pjnh Trojan.Duqu!o6SU6/Pq/F4 Trojan.Win32.Duqu W32/Duqu.A!tr


The malware takes these steps : Check if the system master boot record ( MBR ) contains an infection marker ( 0xD289C989C089 8-bytes value at offset 0x2C ) , and , if so , terminate itself Check again if the process is attached to a debugger ( using the techniques described previously ) Read , decrypt , and map the stage 5 malware ( written in the previous stage in msvcr90.dll ) Open winlogon.exe process Load user32.dll system library and read the KernelCallbackTable pointer from its own process environment block ( PEB ) ( Note : The KernelCallbackTable points to an array of graphic functions used by Win32 kernel subsystem module win32k.sys as call-back into user-mode .


A backdoor also known as: Trojan-Downloader.Win32.Gamarue.2!O Trojan.Shamoon.1 trojan.win32.skeeyah.a!bit Win32.Trojan.WisdomEyes.16070401.9500.9991 W32.Disttrack.B WORM_DISTTRACK.SMC Win.Dropper.DistTrack-5744784-0 Backdoor.Win32.RemoteConnection.d Trojan.Win32.RemoteConnection.ekxrsg WORM_DISTTRACK.SMC Backdoor.RemoteConnection.a Trojan[Backdoor]/Win32.RemoteConnection Trojan:Win32/Depriz.E!dha Backdoor/Win32.RemoteConnection.C1761738 Backdoor.RemoteConnection!lEVCTonUnuw Trojan.Win32.Depriz Trj/GdSda.A


A backdoor also known as: Trojan.Winsy Trojan.Win32.Winsy Trojan.Winsy Trojan.Winsy W32/Trojan.MBSD-8108 Trojan.Winsy Trojan.Win32.Winsy Trojan.Winsy Trj/CI.A


The DGA hosted site further serves up a list of domains that are cycled through for C2.


Today's blog reviews recent activity from these EITest HoeflerText popups on August 30, 2017 to discover more about this recent change.


A backdoor also known as: Trojan.Exploit.DebPloit.A Trojan-Exploit/W32.DebPloit.45056 Exploit.DebPloit.Win32.4 Trojan/Exploit.DebPloit Trojan.Exploit.DebPloit.A Trojan.Exploit.DebPloit.A Exploit.DebPloit!VRtQm5q2mnY TROJ_DEPLOIT.A Exploit.Win32.DebPloit Exploit.Win32.DebPloit.yfoid Exploit.DebPloit.45056[h] Trojan.Exploit.DebPloit.A TrojWare.Win32.Exploit.DebPloit Trojan.Exploit.DebPloit.A BackDoor.Bifrost.634 TROJ_DEPLOIT.A W32/Risk.CTWU-4612 Exploit.WinNT.DebPloit Trojan[Exploit]/Win32.DebPloit WinNT.Hack.DebPloit.kcloud Win-Trojan/Debploit.45056.B Trojan.Exploit.DebPloit.A Trojan.Exploit.DebPloit.A Win32/Exploit.DebPloit Win32.Exploit.Debploit.Wptu W32/Debploit.B!tr Exploit.OY Trojan.Win32.DebPloit.aa Win32/Trojan.Exploit.672


Around New Year, the Emsisoft Lab team was alerted to the presence of a new Globe variant, Globe3, which was infecting users using a new mode of operation.


The DNS protocol is unlikely to be blocked allowing free communications out of the network and its use is unlikely to raise suspicion among network defenders.


Phishing targeting Google Docs


A backdoor also known as: Backdoor/W32.Shiz.102400.S Backdoor.Win32.Shiz!O Backdoor/Shiz.fhrr Win32.Trojan.WisdomEyes.16070401.9500.9971 Win.Trojan.Shiz-787 Trojan.Win32.Shiz.whgln Trojan.KeyLogger.14845 Backdoor.Shiz.Win32.3116 BehavesLike.Win32.BadFile.cm Backdoor.Win32.Shiz Backdoor/Shiz.edz TR/Rogue.kdz.957021 Trojan[Backdoor]/Win32.Shiz Trojan.Zusy.D419A Trojan:Win32/Nahip.A Backdoor/Win32.Shiz.R34442 Win32/Spy.KeyLogger.NWE W32/KeyLogger.AFN!tr Backdoor.Shiz Win32/Trojan.460


In one case, the casino website was a direct gateway to Angler EK.


A backdoor also known as: Trojan.JS.Redirector.xb Js.Trojan.Redirector.Amwl JS/BlacoleRef.CZ.26 Trojan/JS.Redirector.xb Trojan.JS.Redirector.xb Exploit.JS.Blacole JS/Iframe.WOR!tr


A backdoor also known as: Backdoor.Aphexdoor.Litesock.A Backdoor/W32.Aphexdoor.23040 Trojan.Suckspro Backdoor.Aphexdoor.Win32.24 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Backdoor.YGRL-7760 Backdoor.Trojan Win32/Porsux.A Win.Trojan.Aphexdoor-8 Backdoor.Aphexdoor.Litesock.A Backdoor.Win32.Aphexdoor.LiteSock Backdoor.Aphexdoor.Litesock.A Trojan.Win32.Aphexdoor.ebrvay Backdoor.W32.Aphexdoor.LiteSock!c Backdoor.Aphexdoor.Litesock.A Backdoor.Aphexdoor.Litesock.A BackDoor.LiteSock BehavesLike.Win32.Downloader.mm Backdoor.Win32.Aphexdoor.LiteSock W32/Backdoor2.EYIV Backdoor/Aphexdoor.LiteSock Trojan[Backdoor]/Win32.Aphexdoor Backdoor.Aphexdoor.Litesock.A Backdoor.Win32.Aphexdoor.LiteSock Worm/Win32.Fesber.C58465 Backdoor.Aphexdoor.Litesock.A BScope.Trojan.RSP Bck/Corsbot.B Win32.Backdoor.Aphexdoor.Airh Trojan.Suckspro!fID1dcqse2s W32/Aphexdoor.LITESOCK!tr.bdr


A backdoor also known as: Worm.Win32.Chiviper!O Worm.AutoRun.14759 W32/AutoRun.sdc Win32.Trojan.WisdomEyes.16070401.9500.9975 WORM_OTORUN.SMIF Win.Trojan.Qhost-160 Worm.Win32.Chiviper.gk Trojan.Win32.AutoRun.onby Trojan.AVKill.11726 Worm.AutoRun.Win32.23223 WORM_OTORUN.SMIF BehavesLike.Win32.Ipamor.qt Worm.Win32.AutoRun WORM/Autorun.rmr win32.troj.onlinegamest.bc.kcloud Worm.Win32.Chiviper.gk Trojan/Win32.CSon.R2002 Worm.Chiviper Worm.AutoRun!t3rz8tcZQ1A W32/Chiviper.GK!worm


A backdoor also known as: Trojan.Zbot.7 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Kazy-50 Trojan.Win32.Pamela.hnatv Trojan.Win32.A.Inject.75189 DDoS.Pamela Trojan.Inject.Win32.17142 BehavesLike.Win32.Dropper.pc Trojan.Win32.Inject Trojan/Inject.mra Trojan/Win32.Inject Trojan:Win32/Pucodex.A Trojan-Injector.191245


A backdoor also known as: Worm/W32.Sober.135968 Packed.Win32.TDSS!O Worm.Sober.Win32.7 WORM_SOBER.AM Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/Sober.DVXC-4063 W32.Sober.W@mm Win32/Sober.T WORM_SOBER.AM Win.Worm.Sober-43 Email-Worm.Win32.Sober.x Trojan.Win32.Sober.fxvm I-Worm.Win32.Sober.T Packer.W32.Tibs.l4Hz Worm.Win32.Sober.V Win32.HLLM.Sober BehavesLike.Win32.Autorun.cc Trojan.Win32.Pasta W32/Sober.V@mm I-Worm/Sober.p DR/Sober.T Worm[Email]/Win32.Sober Worm.Sober.t.kcloud Worm:Win32/Sober.Y@mm.dr Email-Worm.Win32.Sober.x Dropper/Win32.Sober.R86508 W32/Sober.s.dr TScope.Trojan.VB W32/Sober.AE.worm Win32/Sober.V Win32.Worm-email.Sober.Akew I-Worm.Sober.AF1 W32/Sober.T@mm


Proofpoint is tracking this attacker, believed to operate out of China, as TA459


360 Network Security Research Lab recently discovered a new botnet that is scanning the entire Internet on a large scale.


The malware has existed since at least 2012, with threat actors using it for mass-spreading malware campaigns and for ongoing targeted attacks.


A backdoor also known as: Win32.Trojan.CareFree.a Win32/Tnega.TaRMRTC Trojan.Win32.Graftor.dogten Trojan.KillFiles.21059 BehavesLike.Win32.Downloader.mc TR/Graftor.cpoyxe Trojan.Ursu.D2DC2 Trojan/Win32.StartPage.R131400 Win32/Trojan.e36


This group has been active since at least 2014 and uses spear-phishing campaigns to target enterprises.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9992 Trojan-Spy.MSIL.KeyLogger.ctnb Trojan.Win32.Z.Keylogger.91136.M Msil.Trojan-spy.Keylogger.Wqde Trojan.DownLoader9.24657 TrojanSpy.MSIL.vlt TR/Downloader.gldnp Trojan[Spy]/MSIL.KeyLogger Trojan.MSILPerseus.D9E17 Trojan-Spy.MSIL.KeyLogger.ctnb Backdoor:MSIL/Cooatut.A TrojanSpy.MSIL.KeyLogger Trj/CI.A MSIL/Troob.AA Trojan.MSIL.Troob MSIL/Troob.AA!tr Win32/Trojan.Spy.144


Instead, MacDownloader is a simple exfiltration agent, with broader ambitions.


Throughout 2016, Proofpoint researchers tracked a cyber-espionage campaign targeting victims in Russia and neighboring countries.


This threat actor has been very active in February and March 2023 targeting individuals in various South Korean organizations.


The Trojan is delivered in emails that mostly target corporate users.


We can trace activities of Pawn Storm back to 20041 and before our initial report in 2014 there wasn't much published about this actor group.


Backdoor.Win32.Denis uses DNS tunneling for communication


A few days before the Kuala Lumpur summit, a subdomain under asean.org for the ASEAN Secretariat Resource Centre ARC was compromised.


A backdoor also known as: Flooder.MailSpam.AnonMail.A Email-Flooder.Win32.AnonMail!O Win32.Trojan.Anonmail.Agkt Flooder.MailSpam.AnonMail.A W32/Backdoor.SPH Hacktool.Flooder Win.Tool.MailSpam-3 Email-Flooder.Win32.AnonMail.a Flooder.MailSpam.AnonMail.A Trojan.Win32.AnonMail.dbio TrojWare.Win32.Spammer.AnonMail Trojan.AnMail Tool.AnonMail.Win32.14 Email-Flooder.Win32.AnonMail.A W32/Backdoor.CDAV-2869 Spammer.Mail.AnonMail TR/Nuker.AnonMail HackTool[Flooder]/Win32.AnonMail Email-Flooder.Win32.AnonMail.a Flooder.MailSpam.AnonMail.A Spammer.AnonMail Flooder.MailSpam.AnonMail.A Flooder.MailSpam.AnonMail.A Trj/CI.A Win32/Spammer.AnonMail


the type of operation they are carrying out.


A backdoor also known as: Trojan.Win32.Mlw.eweujb Win32.Trojan.Inject.Auto BehavesLike.Win32.Trojan.hh TR/Dropper.MSIL.fkvxc Spyware.InfoStealer Trojan.MSIL.Inject MSIL/Injector.SZD!tr Trj/GdSda.A


Little has been published on the threat actors responsible for Operation Ke3chang since the report was released more than two years ago.


A backdoor also known as: PUP.Optional.VideiPlayer Trojan.ExtenBro! TROJ_SPNR.06HH14 Trojan-Downloader.MSIL.ExtInstall.o Trojan.Win32.Kivat.dfxucy TROJ_SPNR.06HH14 BehavesLike.Win32.Trojan.nt W32/Trojan.JMSU-4938 Variant.Kazy.doi W32/ExtenBro.E!tr Trojan.Kazy.D683A9 Uds.Dangerousobject.Multi!c TrojanDownloader:MSIL/Kivat.B Trojan.ExtenBro! Trj/Chgt.B Win32/Trojan.Multi.daf


Hashes of samples Type Package name SHA256 digest Custom ads com.targetshoot.zombieapocalypse.sniper.zombieshootinggame 5d98d8a7a012a858f0fa4cf8d2ed3d5a82937b1a98ea2703d440307c63c6c928 Click fraud com.counterterrorist.cs.elite.combat.shootinggame 84672fb2f228ec749d3c3c1cb168a1c31f544970fd29136bea2a5b2cefac6d04 Rooting trojan com.android.world.news bd233c1f5c477b0cc15d7f84392dab3a7a598243efa3154304327ff4580ae213 Zen trojan com.lmt.register eb12cd65589cbc6f9d3563576c304273cb6a78072b0c20a155a0951370476d8d Mobile Campaign ‘ Bouncing Golf ’ Affects Middle East We uncovered a cyberespionage campaign targeting Middle Eastern countries .


A backdoor also known as: Win32.Trojan.Kolweb.a.2.Pack Trojan/Delf.cf W32/Trojan.ORX Trojan.Kolweb.A W32/Startpage.AHU Win32/Startpage.LM TROJ_DOWNLOAD.E Trojan.Win32.Kolweb.a Trojan.Win32.Kolweb.A!IK TrojWare.Win32.Kolweb.A Trojan.DownLoader.1317 TROJ_DOWNLOAD.E Trojan/PSW.Almat.coi Adware:Win32/Adtomi.B Win-Spyware/Xema.171008 W32/Trojan.ORX Trojan.Win32.Kolweb.a Win32/Kolweb.A Trojan.Win32.Kolweb.A


A backdoor also known as: Trojan.Crypt.ES Trojan.Crypt.ES Win32.Trojan.WisdomEyes.16070401.9500.9996 Trojan.Crypt.ES Trojan.Win32.Crypt.ewgrry Trojan.Crypt.ES Trojan.Crypt.ES BehavesLike.Win32.BadFile.lm Backdoor:Win32/Huceqoo.A Trojan.Win32.Z.Crypt.73728.BQ Trojan/Win32.Scar.C8074 Trojan.Crypt.ES BScope.Trojan.Dropper.we Trj/GdSda.A Trojan.Crypt.ES Win32/Trojan.b63


However, this also leaves the C C traffic open for monitoring by others, including security researchers.


A backdoor also known as: Trojan.Pws.Watcher.A Trojan-PSW.Win32.Watcher!O Trojan.Pws.Watcher.A Trojan.Pws.Watcher.A Trojan.Pws.Watcher.A Trojan.Win32.Watcher.ejkr Trojan.Win32.A.PSW-Watcher.492035 Troj.PSW32.W.Watcher.a!c Trojan.Pws.Watcher.A Trojan.Pws.Watcher.A Trojan.PWS.Watcher Trojan.Watcher.Win32.8 Trojan-PWS.Win32.Watcher.i Trojan/PSW.Watcher.a TR/PSW.Watcher.B PWS:Win32/Watcher.A Trojan.Pws.Watcher.A TrojanPSW.Watcher Win32/PSW.Watcher.A Win32.Trojan-qqpass.Qqrob.Wqwh W32/PSWAtcher.A!tr


A backdoor also known as: Trojan.PSW.Barok.10 Trojan/W32.Barok.1056825 Trojan.Win32.Barok.bcusy W32/Pws.ZDD WS.Reputation.1 Barok.1_0 TROJ_BAROK.10 Trojan.Spy-11230 Trojan-PSW.Win32.Barok.10 Trojan.PSW.Barok.10 Trojan.PWS.Barok!QhmYol9M94M TrojWare.Win32.PSW.Barok.10 Trojan.PSW.Barok.10 TR/Barok.PSW.10 TROJ_BAROK.10 Trojan/PSW.Barok.10 Win32.Troj.Barok.kcloud PWS:Win32/Barok.1_0 Trojan.Win32.Barok_10.Setup Trojan.PSW.Barok.10 W32/Pws.ZDD Win-Trojan/Barok.Client.v10 PSW.Barok.A Hack.PSWbarok.10 Trojan-PWS.Win32.Barok.10 W32/Barok.10!tr.pws Trj/PSW.Barok.10


While the idea of malware as a service isn't a new one, with players such as Tox and Shark in the game, but it can be said that MacSpy is one of the first seen for the OS X platform.


A backdoor also known as: PUP.Optional.OpenCandy WS.Reputation.1 Trojan.DownLoader9.52502 TR/Dropper.A.23950 Win32.Troj.Undef.kcloud PE:PUF.OpenCandy!1.9DE5 Win32/Trojan.ca7


A backdoor also known as: W32.FamVT.Kykymber.P.Trojan Trojan.PWS.Onlinegames.KEGA Trojan-PWS.Win32.Kykymber.1!O PWS-OnlineGames.ke Trojan/PSW.Kykymber.kyz Win32.Trojan-PSW.OLGames.ay Infostealer.Gampass Win32/Gamepass.OQU Win.Spyware.79683-2 Trojan-PSW.Win32.Kykymber.kyz Trojan.PWS.Onlinegames.KEGA Trojan.Win32.OnLineGames.bkxdd Troj.PSW32.W.Kykymber.kyz!c Trojan.PSW.Win32.MiBao.a TrojWare.Win32.PSW.GamePass.A Trojan.PWS.Onlinegames.KEGA BehavesLike.Win32.PWSOnlineGames.pm TR/PSW.Kykymber.CD Trojan.Win32.A.PSW-Kykymber.43452[UPX] Trojan-PSW.Win32.Kykymber.kyz Trojan.PWS.Onlinegames.KEGA Trojan.PWS.Onlinegames.KEGA Win32/PSW.OnLineGames.QLR Trojan.PWS.Kykymber!KKmGLDbdY4I W32/OnLineGames.KY!tr.pws Trj/Kykymber.A Trojan.PSW.Win32.GameOnline.CP


Recently, in our never-ending quest to protect the world from malware, we found a misbehaving Android trojan.


A backdoor also known as: Backdoor:Win32/Binanen.A


The stolen parameters follow : ID IMSI IMEI Phone number Operator AID Model Brand Version Build Battery percentage Wi-Fi connection state Wake time Are logs enabled ? Is the malware already set as the default SMS application ? [ True/False ] Signal strength Screen active [ True/False ] Orientation Was accessibility permission granted ? [ True/False ] Screen size List of the installed applications SMS messages saved on the device It is not uncommon for banking malware to harvest extensive amounts of data from the victim ’ s device .


A backdoor also known as: W32.Clod912.Trojan.1f28 Win32.Trojan.WisdomEyes.16070401.9500.9823 Trojan.Munidub TROJ64_ASRUEX.A Trojan.Win64.MLW.eelpql TROJ64_ASRUEX.A BehavesLike.Win64.CrossRider.tm W64/Trojan.MCVO-8253 Trojan/Win32.Zapchast Trojan:Win64/Asruex.A!dha Trojan.Zapchast.pk Trj/CI.A


POS malware refers to malicious software that extracts payment card information from memory and usually uploads that data to a command and control CnC server.


A backdoor also known as: Trojan.Graftor.DD2BF Trojan.DownLoader.18943 BehavesLike.Win32.Msposer.nm Trj/Lozyt.A


A backdoor also known as: Trojan.Ransom.ANU Trojan.Enrume Ransom_Enrume.R00EC0DKG17 Trojan.Ransom.ANU Trojan.Ransom.ANU Trojan.Win32.Z.Ransom.6967658 Troj.Ransom.Anu!c Trojan.Ransom.ANU Trojan.Ransom.ANU Ransom_Enrume.R00EC0DKG17 BehavesLike.Win32.PUPXBC.vc TR/FileCoder.jtxjg Trojan.Ransom.ANU Trojan.Ransom.ANU Trj/CI.A Win32/Trojan.Ransom.2a7


A backdoor also known as: W32.SapinH.Trojan Trojan-Dropper.Win32.Injector!O Trojan.Mauvaise.SL1 Trojan.Chad Trojan.Packed.Win32.29983 Trojan.Application.Symmi.D73F9 Win32/Gamepass.HKIaME Trojan-Dropper.Win32.Injector.palw Trojan.Win32.KillProc.brmetk Troj.Dropper.W32.Injector.toQt Adware.Win32.Dropper.aaa Application.Win32.Kuaiba.BC Trojan.KillProc.22109 BehavesLike.Win32.VirRansom.fh TrojanDropper.Injector.ayai Trojan:Win32/Scoreem.A Trojan-Dropper.Win32.Injector.palw Dropper/Win32.Injector.R68328 TrojanDropper.Injector Trojan.DR.Injector!UEnRNWldneo Trojan.Win32.Senta W32/Injector.RREW!tr


A backdoor also known as: W32.SumanyaQZA.Worm Worm.AutoRun W32/Autorun.worm.j Worm.AutoRun.Win32.2713 TROJ_FAM_0001c56.TOMA Win32.Worm.AutoRun.d W32.SillyDC Win32/SillyFDC.CD TROJ_FAM_0001c56.TOMA Worm.Win32.AutoRun.beh Trojan.Win32.AutoRun.uvsfh Worm.Win32.Autorun.204800 Trojan.Copier.8 BehavesLike.Win32.VBObfus.dm Worm.Win32.VB Worm/AutoRun.ahnn Worm:Win32/Manyasu.A Worm/Win32.AutoRun Worm:Win32/Manyasu.A Trojan.Heur.E08BA4 Worm.Win32.AutoRun.beh Worm/Win32.AutoRun.R18800 Trojan.VBO.012000 Trj/Manyasu.A Win32/AutoRun.VB.IY Trojan.Win32.VB.mct Worm.AutoRun!WxdQD2QNztM


The ongoing attacks attempt to circumvent the extra protections conferred by two-factor authentication in Gmail, and rely heavily on phone-call based phishing and real time login attempts by the attackers.


A backdoor also known as: Backdoor.Win32.Stub!O Backdoor/Stub.j Win32.Worm.Delf.a Backdoor.Trojan Win32/Bosbot.D BKDR_STUB.G Backdoor.Win32.Stub.j Trojan.Win32.Stub.bbeaok Backdoor.Win32.A.Stub.114843[UPX] BackDoor.Stfu Backdoor.Stub.Win32.24 BKDR_STUB.G BehavesLike.Win32.Backdoor.cm Virus.Win32.Imponex Backdoor/Stub.n W32/Sality.Patched Trojan/Win32.Unknown Backdoor:Win32/Stub.P W32.W.Bagle.kZt7 Backdoor.Win32.Stub.j Win32.Worm.Imponex.A Trojan/Win32.Stub.C408823 BScope.Malware-Cryptor.Hlux W32/DelpDldr.A!tr.bdr W32/Knase.C


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Java.Adwind.dkmdei Java.Adwind.2 Trojan.Java.Adwind Trojan.Java.o JAVA/RemoteAd.dld Trojan:Java/Adwind.G Trj/CI.A


A backdoor also known as: Trojan.Patched.FR Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Sheedash Win32/Sfcpatched.A TROJ_PATCH.SMLD Win.Trojan.Sfcpatch-10 Trojan.Win32.Patched.fr Trojan.Win32.Patched.cwsyqv W32.W.AutoRun.kYRk Trojan.WinSpy.921 Trojan.Patched.Win32.27797 TROJ_PATCH.SMLD Trojan.Win32.Patched Trojan/Win32.Patched Trojan.Patched.1 Trojan.Win32.Patched.fr Trojan:Win32/Parchood.A Trojan/Win32.Patched.R3621 BScope.Trojan.Crex Trojan.Win32.Patched.f Trojan.Patched!j5lr5VQfEwA Win32/Trojan.2c9


The group has been operating since 2012 and became particularly active in Q2 2015.


SpyNote is similar to OmniRat and DroidJack, which are RATs remote administration tools that allow malware owners to gain remote administrative control of an Android device.


As predicted following the leak of Hacking Team exploit codes covered here, the Zscaler security research team has recently started seeing a Chinese cyber espionage group weaponizing malware payloads using the 0-day exploits found in the leaked Hacking Team archives.


The World Anti-Doping Agency WADA has alerted their stakeholders that email phishing scams are being reported in connection with WADA and therefore asks its recipients to be careful.


Attackers create accounts on those services and post encoded IP addresses or the domain names of real C2 servers in advance of distributing the backdoor.


A backdoor also known as: P2P-Worm.Win32.Delf!O Worm.Delf.9767 W32/Delf.ao WORM_YOOHOO.D Win32.Worm.Delf.a W32/SillyP2P.BR W32.HLLW.Yoohoo WORM_YOOHOO.D Win.Trojan.Delf-1033 P2P-Worm.Win32.Delf.ao Trojan.Win32.Delf.bojqna Win32.Worm-p2p.Delf.Lnfa Win32.HLLW.Woofka Worm.Delf.Win32.191 BehavesLike.Win32.Backdoor.ch Worm/Delf.ot Worm[P2P]/Win32.Delf Worm.Win32.A.P2P-Delf.70675[UPX] P2P-Worm.Win32.Delf.ao Win32/P2PDelf.worm.45056 Worm.Delf Win32/Delf.AO Worm.P2P.Delf.AAF!AU P2P-Worm.Win32.Delf W32/Delf.AO!worm.p2p W32/Spybot.TN.worm


In February 2017, we observed an evolution of the Infy malware that we're calling Foudre lightning in French.


IOC's related to a new version of Citadel that hit the streets on November 2015


In July 2015, Check Point's Incident Response team was contacted by a customer after they noticed strange file system activities in one of their Linux-based DNS BIND servers.


This new version CryptoWall includes multiple updates, such as a more streamlined network communication channel, modified ransom message, and the encryption of filenames.


They can also be installed by other malware, or by exploiting software vulnerabilities.


A backdoor also known as: BackdoorAPT.Hikit.MD6 BKDR64_GOALMAY.SM BKDR64_GOALMAY.SM Win.Trojan.HiKit-41 Trojan.Hikit.Win64.4 BehavesLike.Win64.PdfCrypt.cc Trojan.Dropper Backdoor:Win64/Hikiti.N!dha Trojan/Win32.HDC.C1382826 Trj/CI.A


These attacks occurred in several different countries, but our investigation revealed that the primary targets were individuals and organizations primarily located in India.


A backdoor also known as: W32.FamVT.ExpiroPC.PE Trojan.Win32.ServStart.exsakp Trojan.Win32.Z.Servstart.15876.A Trojan.DownLoader9.26576 Trojan.Win32.Rozena TR/ServStart.dplva TrojanDownloader:Win32/Yemrok.A W32/Parite.dam W32/ServStart.DV!tr Win32/Trojan.849


A backdoor also known as: W32/VB.l Trojan.Heur.EC3E8C WORM_ZAKA.AD W32/VB.UQEY-1535 W32.HLLW.Asterz.intd WORM_ZAKA.AD Win.Worm.VB-29 P2P-Worm.Win32.VB.l Trojan.Win32.VB.hxbs Worm.Win32.P2P-VB.24576.D W32.W.VB.l!c Win32.VB.L Win32.HLLW.Kirk.24576 Worm.VB.Win32.51 BehavesLike.Win32.Virus.mz Trojan-Banker.Win32.Bancos W32/VB.KA@p2p Worm/VB.qvg Worm:Win32/Icasur.Q WORM/VB.A Worm[P2P]/Win32.VB Worm.P2PVB.a.kcloud Worm:Win32/Icasur.Q P2P-Worm.Win32.VB.l Worm.VB Win32/VB.L Win32.Virus.Vb.Lkdy Worm.P2P.Zaka.R W32/VB.L!worm.p2p


Throughout 2015, Symantec.cloud has been detecting a stream of emails that have the Xtreme remote access Trojan RAT, which we detect as W32.Extrat, as an attachment.


In November 2016, we observed the reemergence of destructive attacks associated with the 2012 Shamoon attack campaign.


This malware masquerades as typical ransomware: it encrypts the data on the computer and demands $300 bitcoins for recovery.


TREASUREHUNT enumerates running processes, extracts payment card information from memory, and then transmits this information to a command and control server.


A backdoor also known as: Backdoor.Androm Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Trojan.CFAT-3750 Trojan.MulDrop7.39399 Backdoor.Androm.tas Trojan[Backdoor]/Win32.Androm Trojan:Win32/Lamooc.A Trojan/Win32.Androm.C2185535 Backdoor.Androm Trj/GdSda.A Backdoor.Androm!dAFAsy80jho


A backdoor also known as: Trojan/Comfoo.a Backdoor.Vinself TROJ_COMFOO.AI Trojan.PWS.DPD.14 TROJ_COMFOO.AI Trojan[Dropper]/Win32.Injector Backdoor:Win32/Comfoo.C Win-Trojan/Comfoo.114688 Backdoor.Win32.Comfoo W32/PWS_y.AI!tr Win32/Trojan.3fc


In October we saw an increase in infections.


TeslaCrypt/AlphaCrypt uses AES256 encryption.


The principles of this bootkit's work, named HDRoot, have been described in the first part of our article.


A backdoor also known as: Win32.Stepaik.A Worm.Stepaik Win32.Stepaik.A W32/Trojan.ILKV-7384 Win32.Stepaik.A Email-Worm.Win32.Stepaik.c Win32.Stepaik.A Email.Worm.W32!c Win32.Stepaik.A Win32.Stepaik.A Trojan.Inject3.836 BehavesLike.Win32.Virut.mh Worm[Email]/Win32.Stepaik Email-Worm.Win32.Stepaik.c Win32.Stepaik.A Trj/CI.A Win32.Worm-email.Stepaik.Day Worm.Win32.Stepar W32/Stepaik.C@mm Win32/Trojan.7ee


We setup a system with weak and default passwords to capture any and all malware spread in this fashion.


A backdoor also known as: W32.HfsAutoB.5B9D Packer.Malware.NSAnti.A Packer.Malware.NSAnti.A Trojan.MalPack.NSPack Trojan/PornoBlocker.afxh Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Packed.NsAnti Packer.Malware.NSAnti.A Packed.Win32.NSAnti.r Packer.Malware.NSAnti.A Trojan.Win32.NSAnti.fthc Packer.Malware.NSAnti.A BackDoor.Singu Packed.NSAnti.frd Packer.Malware.NSAnti.A Packed.Win32.NSAnti.r Trojan:Win32/Vanti.B.dll Trojan/Win32.Hupigon.C134220 TScope.Malware-Cryptor.SB Rootkit.Win32.Vanti.D


The ransomware makes this connection presumably to report that your computer has been compromised.


This attack took advantage of a Java zero-day exploit and used hacked forums as watering holes.


A backdoor also known as: W32.FamVT.QPassHV.Trojan Trojan.Zenshirsh.SL7 Trojan/QQPass.owd Win32.Trojan-PSW.QQPass.af Win32/Oflwr.A!crypt Trojan.Win32.Scar.oetk Trojan.Win32.DangerousObject.dnizrq Win32.Trojan.Scar.Wsts TrojWare.Win32.PWS.QQPass.AZF Trojan.DownLoader12.31656 Trojan.QQPass.Win32.24405 BehavesLike.Win32.Trojan.nc TR/PSW.QQSteal.boeu Trojan.Win32.Z.Qqpass.100934 Trojan.Scar Win32/PSW.QQPass.OWD Win32/Worm.Scar.B


Throughout the year, Bankbot has been distributed as benign apps, some of which made their way onto popular app stores.


In June 2022, Mandiant Managed Defense detected and responded to an UNC2970 phishing campaign targeting a U.S.-based technology company.


A backdoor also known as: Trojan.NSIS.Androm.7 Ransom.Onion.A Win32.Trojan.Injector.je Packed.NSISPacker!g7 Win32/Injector.CXKV TROJ_GE.F5258674 Zum.Ransom.NSIS.Cerber.1 Trojan.NSIS.Androm.7 Trojan.Win32.CXKV.ecdllh Trojan.Kovter.118 BehavesLike.Win32.Ransom.dc Trojan.Win32.Injector Trojan/Win32.Injector.cxkv Zum.Ransom.NSIS.Cerber.1 Trojan/Win32.Cerber.R180093 Trojan.Injector!M8gUkRYeGG8 W32/Injector.CXKV!tr


It appears the same actor developed both the Komplex and XAgentOSX tools, based on similarities within the following project paths found within the tools.


The construction of the webshell was interesting by itself, as it was actually two separate webshells: an initial webshell that was responsible for saving and loading the second fully functional webshell.


A backdoor also known as: Hacktool.Flystudio.16558 Trojan.DownLoader12.49203 Trojan-Downloader.Win32.Raykmerd Trojan/Badur.jao TR/Dldr.Raykmerd.amotd TrojanDownloader:Win32/Raykmerd.A Trojan.Badur


On September 18, 2015, we saw an activity on koreatimes.com where we captured a malicious binary.


These innovations included two significant changes in Dyre behavior:


A backdoor also known as: W32.FlameF.Worm Trojan.Flame.B Worm.Win32.Flame!O Worm.Flamea Worm.Win32.Flame.a Trojan/Flamer.a Win32.Trojan.WisdomEyes.16070401.9500.9790 W32/Flamer.A W32.Flamer Win32/Flame.A WORM_FLAMER.A Win.Worm.Flame-9 Trojan.Flame.B Worm.Win32.Flame.a Trojan.Flame.B Trojan.Win32.Flame.sbruw W32.W.Flame.a!c Win32.Worm.Flame.Wpjf Worm.Win32.Flame.a Trojan.Flame.B Win32.HLLW.Flame.1 Worm.Flame.Win32.3 WORM_FLAMER.A W32/Flamer.OWIT-2039 Worm/Flame.f W32.Worm.Flame TR/Flamer.A.1 Worm/Win32.Flame Trojan.Flame.B Worm.Win32.Flame.1721856 Worm.Win32.Flame.a Win-Trojan/Flamer.1721856 Worm.Flame Worm.Win32.Flame.a Trojan.Flame.B Win32/Flamer.A Trojan.Flame.A Worm.Win32.Flame W32/Flame.A!worm Trojan.Flame.3535 W32/Flamer.A.worm


A backdoor also known as: Trojandropper.Exebundle2X Worm.WBNA.Win32.421402 Win.Worm.Drefir-14 Trojan.Win32.ExeBundle.exrqtj Trojan.Win32.Z.Exebundle.8609956 Trojan.MulDrop.1611 W32/Trojan.EGST-2925 TR/ExeBundle.272 Trojan[Downloader]/Win32.Small TrojanDropper:Win32/ExeBundle_2x.A Trojan.MulDrop Trj/CI.A Trojan.Dropper W32/Multidr.FD!tr Win32/Trojan.852


Our friends over at Bellingcat, which conducts open source investigations and writes extensively on Russia-related issues, recently shared a new tranche of spear-phishing emails they had received.


A backdoor also known as: TrojWare.Win32.ChePro.RHZ TrojanDownloader:Win32/Hormelex.B Trojan/Win32.ChePro Trojan.Win32.Delf.PQD


A backdoor also known as: Trojan.Startsurf not-a-virus:AdWare.Win32.StartSurf.azas Riskware.Win32.StartSurf.expyou Adware.StartSurf.Win32.40359 BehavesLike.Win32.Dropper.jc TR/Drop.Kaymundler.bldbf Trojan.Application.Strictor.D1C262 Trojan.Win32.Z.Strictor.687398 not-a-virus:AdWare.Win32.StartSurf.azas TrojanDropper:Win32/Kaymundler.C PUP/Win32.OutBrowse.R215127 Adware.StartSurf RiskWare.Patcher Trj/CI.A Win32.Adware.Startsurf.Llhl PUA.StartSurf! Trojan-Dropper.Kaymundler Win32/Application.064


The attacks employed PlugX, a Remote Access Trojan RAT widely used in targeted attacks.


AdWind, also known as Frutas, UNRECOM, AlienSpy, and JSocket, is a Java-based RAT.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9537 BehavesLike.Win32.AdwareWajam.rc Trojan:Win32/WebHijack.A!dll


On March 4, we detected that the Transmission BitTorrent ailient installer for OS X was infected with ransomware, just a few hours after installers were initially posted.


The ransom payment is typically collected using a form of crypto-currency, such as Bitcoin.


Whilst we would prefer to disassociate ourselves with APT attacks against Governments our interest was piqued by a particular blog written by our friends over at TrendMicro


Since January 2016, a financially motivated threat actor whom Proofpoint has been tracking as TA530 has been targeting executives and other high-level employees, often through campaigns focused exclusively on a particular vertical.


A backdoor also known as: Trojan.Injector.Win32.85625 Trojan/Injector.oqf Win32.Trojan.WisdomEyes.16070401.9500.9619 TSPY_INJECTOR_BL210174.TOMC Trojan.Win32.Inject.efoq Trojan.Win32.Inject.dzombd Trojan.Win32.A.Inject.172053 TSPY_INJECTOR_BL210174.TOMC BehavesLike.Win32.Injector.cc Win32.Malware Trojan/Inject.amig TR/Injector.10.12 Trojan/Win32.Inject Trojan:Win32/Meteit.D Trojan.Win32.Inject.efoq Trojan/Win32.VBKrypt.R27475 Trojan.Inject Win32.Trojan.Inject.Htma


IoCs C & C 100.51.100.00 108.62.118.131 172.81.134.165 172.86.120.207 185.212.128.152 185.212.128.192 185.61.000.108 185.61.138.108 185.61.138.37 188.209.52.101 5.206.225.57 alr992.date avito-app.pw backfround2.pw background1.xyz blacksolider93.com blass9g087.com brekelter2.com broplar3hf.xyz buy-youla.ru cd78cg210xy0.com copsoiteess.com farmatefc93.org firstclinsop.com holebrhuhh3.com holebrhuhh45.com karambga3j.net le22999a.pw leboncoin-bk.top leboncoin-buy.pw leboncoin-cz.info leboncoin-f.pw leboncoin-jp.info leboncoin-kp.top leboncoin-ny.info leboncoin-ql.top leboncoin-tr.info myyoula.ru sell-avito.ru sell-youla.ru sentel8ju67.com subito-li.pw subitop.pw web-gumtree.com whitehousejosh.com whitekalgoy3.com youlaprotect.ru Examples of malware 0497b6000a7a23e9e9b97472bc2d3799caf49cbbea1627ad4d87ae6e0b7e2a98 417fc112cd0610cc8c402742b0baab0a086b5c4164230009e11d34fdeee7d3fa 54594edbe9055517da2836199600f682dee07e6b405c6fe4b476627e8d184bfe 6e995d68c724f121d43ec2ff59bc4e536192360afa3beaec5646f01094f0b745 bbc268ca63eeb27e424fec1b3976bab550da304de18e29faff94d9057b1fa25a dc3dd9d75120934333496d0a4100252b419ee8fcdab5d74cf343bcb0306c9811 e3f77ff093f322e139940b33994c5a57ae010b66668668dc4945142a81bcc049 ebd0a8043434edac261cb25b94f417188a5c0d62b5dd4033f156b890d150a4c5 f51a27163cb0ddd08caa29d865b9f238848118ba2589626af711330481b352df Tracking down the developer of Android adware affecting millions of users 24 Oct 2019 - 11:30AM We detected a large adware campaign running for about a year , with the involved apps installed eight million times from Google Play alone .


The campaign was able to steal large amounts of data despite using relatively simple malware because it used clever social engineering tactics against its targets.


It may also download potentially malicious files.


A backdoor also known as: Trojan/Kryptik.byz Trojan.Win32.Malware.1 Trojan.Kryptik.HFN Packed:W32/RoxorCrypt.A Trojan.DownLoad.35818 TROJ_RENOS.BHAM


To that end, we are elevating the OilRig attack campaign to be known as the OilRig group.


We believe the espionage factor and political context make their attacks unique and very different from traditional targeted attacks.


In particular, the focus was on Italian and Belgian users, but the StrongPity watering holes affected systems in far more locations than just those two.


A backdoor also known as: W32.MiadheardLTO.Trojan Trojan/W32.Mask.348264 Trojandropper.Seedna Troj.W32.Careto!c Trojan/Appetite.c BKDR_CARETO.A W32/Mask.B Backdoor.Weevil.B BKDR_CARETO.A Trojan.Win32.Careto.au Trojan.Win32.Careto.dtnkyq Backdoor:W32/Mask.A W32/Mask.JDVW-6006 Trojan/SGH.c W32.Trojan.Careto Trojan/Win32.SGH Trojan.Mask.3 Trojan.Win32.Careto.au TrojanDropper:Win32/Seedna.A Trojan/Win32.Careto.C258082 Backdoor.Mask Win32/Appetite.C Win32.Trojan.Careto.Tcvo Trojan.SGH! Backdoor.Mask W32/Careto.AU!tr Win32/Trojan.d4e


Symantec believes that the attackers behind the Anthem breach are part of a highly resourceful cyberespionage group called Black Vine.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9998 BehavesLike.Win32.Multiplug.ch Trojan:Win32/Autophyte.A!dha Backdoor/Win32.Akdoor.R198284


The information is ideal for security professionals who investigate suspicious network activity in an Active Directory AD environment.


A backdoor also known as: Backdoor/W32.Visel.249856 Win32.Trojan.WisdomEyes.16070401.9500.9992 W32/Downldr2.DGSB BKDR_VISEL.DEN Win.Trojan.Visel-58 Trojan.Win32.Kebot.wbjcg Trojan.Win32.Downloader.249856.G Backdoor.Win32.Visel.~C BackDoor.Pigeon.12692 BKDR_VISEL.DEN W32/Downloader.STUZ-5379 Trojan[Backdoor]/Win32.Visel Backdoor:Win32/Visel.C Trojan/Win32.Xema.C45221 Backdoor.Visel Backdoor.Visel!uQ/Wu3cIR5E Bck/Pigeon.FK


This is not the first time the country has been a victim of an APT.


A backdoor also known as: Trojan.Droma.S60541 TrojWare.Win32.Sventore.A Trojan.MulDrop7.3471 W32/Trojan.IGFK-3098 TR/Aenjaris.ofeiu Trojan[Dropper]/Win32.Injector Trojan:Win32/Aenjaris.AI!bit Trojan.Zusy.D3FD29 Dropper/Win32.Injector.C1617864 BScope.Trojan.SvcHorse.01643


The use of the obfuscation techniques was novel and this advisory discusses those in detail, along with how we detected them.


DiamondFox list of panels.


It tends to reuse old exploits and doesn't make an effort to disguise their activity.


Its main target was larger organizations with an annual income of USD 5 million or higher.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Downloader.Quanader TROJ_PLISKAL.SM Trojan.Win32.Pliskal.etapgz Trojan.DownLoader25.64837 Trojan.Pliskal.Win32.48 TROJ_PLISKAL.SM Trojan.Win32.Pliskal Trojan.Zusy.D3EBDA Trojan/Win32.Pliskal.C1788294 Trojan.QuantLoader W32/Vilsel.CYCY!tr.dldr Trj/GdSda.A


A new threat actor group from Europe is selling malware, including the Typhon Stealer, RootFinder Miner, and the Cryptonic Crypter, according to CYFIRMA research team.


A backdoor also known as: Trojan.Buzy.D9C9 Downloader.Pelfpoi TROJ_PELPOI.SMIA Trojan.Win32.Snojan.bxtm TROJ_PELPOI.SMIA BehavesLike.Win32.PUPXAQ.wc Worm/Win32.AutoRun TrojanDownloader:Win32/Pelfpoi.L Trojan.Win32.Snojan.bxtm Downloader/Win32.Korad.R3803 W32/TrojanDldr.QJW!tr


A backdoor also known as: Trojan.Phrovon.A TROJ_DLOADER.ZZT TROJ_DLOADER.ZZT Trojan.Win32.VB.euylta TrojWare.Win32.TrojanDownloader.VB.PMEA Trojan.DownLoader6.39644 BehavesLike.Win32.VBObfus.nz W32.Malware.Downloader TR/Dldr.VB.WNE TrojanDownloader:Win32/Phrovon.A Trojan.DL.Phrovon!yEJ5Hieu3rA Trojan-Downloader.Win32.Phrovon W32/VB.CWZ!tr.dldr


There is a new malware called Rurktar.


A backdoor also known as: Worm.Win32.VBNA!O Trojan.VB.Win32.37651 Trojan.Heur.VP.E1E33B Win32.Trojan.WisdomEyes.16070401.9500.9951 Win.Trojan.VB-23833 Worm.Win32.VBNA.b Trojan.Win32.VB.etozpu W32.W.VBNA.lrnh Win32.Worm.Vbna.Sxew Trojan.DownLoader5.9157 Trojan.Win32.Doxiss W32/Trojan.DVWP-9373 Worm.VBNA.ahfg Worm/Win32.VBNA Trojan:Win32/Doxiss.A Worm.Win32.A.VBNA.147456.BA Worm.Win32.VBNA.b Worm/Win32.VBNA.C118872 TScope.Trojan.VB Win32/Spy.VB.NXN TrojanSpy.VB!5WGwmuBMWXM


A backdoor also known as: Trojan.Crypt.i Trojan/Crypt.i Win32/TrojanProxy.Lager.F W32/Lager.AI Trojan.Abwiz.D Klone.R Trojan.Crypt Trojan-Proxy.Win32.Lager.q Trojan.Proxy.Lager.Q Trojan-Proxy.Win32.Lager!IK TrojWare.Win32.TrojanProxy.Lager.F Trojan.Proxy.Lager.Q Trojan.Lopata TR/Drop.Abwiz TROJ_LAGER.F Trojan/Crypt.bh Trojan.Proxy.Lager.Q W32/Lager.AI Win-Dropper/Small.agq Trojan-Proxy.Win32.Lager.f Trojan-Proxy.Lager.f Trojan-Proxy.Win32.Lager Proxy.NM Bck/Galapoper.HP


This is an interesting attack of the infamous Syrian Electronic Army SEA.


Many of the targets are involved in litigation with the government of Kazakhstan in European and American courts whose substance ranges from attempts by the government of Kazakhstan to unmask the administrators behind an anonymous website that publishes leaks alleging government corruption Kazaword to allegations of kidnapping.


ESET researchers have since analyzed samples of malware, detected by ESET as Win32/Industroyer, capable of performing exactly that type of attack.


To infect a Windows computer, the user has to execute the malware by double-clicking on the .jar file.


ServStart is primarily used by attackers located in China, in a mix of targeted and opportunistic attacks.


FireEye recently observed a FIN7 spear phishing campaign targeting personnel involved with United States Securities and Exchange Commission SEC filings at various organizations.


A backdoor also known as: Backdoor.Win32.Hupigon!O Win32.Trojan.WisdomEyes.16070401.9500.9976 Backdoor.Win32.Hupigon.pjz BackDoor.Klj.25 BehavesLike.Win32.PWSGamania.fc Backdoor.Win32.Hupigon Trojan.Zilix.1 Backdoor.Win32.Hupigon.pjz Trojan/Win32.Hupigon.C127321 TScope.Trojan.Delf Win32.Backdoor.Hupigon.dgrz


A backdoor also known as: Trojan.Ursu.D15C9E Win32.Trojan.WisdomEyes.16070401.9500.9977 Backdoor.Trojan BKDR_ZEGOST.SM44 Trojan.Win32.Farfli.extksh Trojan.Win32.Z.Zegost.671744.A TrojWare.Win32.AntiAV.~D BKDR_ZEGOST.SM44 BehavesLike.Win32.Dropper.jm W32/Trojan.VXKT-0024 BDS/Zegost.pmxfd Trj/GdSda.A Win32.Trojan-gamethief.Onlinegames.Dvgf Backdoor.Win32.Dedipros Win32/Trojan.6ef


By mid-1998 the FBI and Department of Defense investigators had forensic evidence pointing to Russian ISPs.


A backdoor also known as: Trojan.Win32.Diple!O Worm.Yames W32/VBTrojan.9!Maximus WORM_YAMES.A WORM_YAMES.A Worm.Win32.VB W32/VBTrojan.9!Maximus Worm:Win32/Yames.A Trj/CI.A Win32/VB.ODO Win32.Worm.Vb.Sxeo W32/Vb.A!worm


Regin has a wide range of standard capabilities, particularly around monitoring targets and stealing data.


Due to the violation of the integrity and availability of the web resources of a number of state organizations, the Government Computer Emergency Response Team of Ukraine CERT-UA is taking measures to investigate the circumstances of the incident on February 23, 2023.


A backdoor also known as: HackTool.Mimikatz.S1196261 Tool.Mimikatz.Win32.409 W32/Petya.S Ransom.Petya Win.Trojan.Mimikatz-6331391-0 Riskware.Win32.Mimikatz.eqnxjb Troj.PSW32.W.WinCred.tp7F Win32.Trojan.Mimipet.Aiin Trojan:W32/Petya.H Tool.Mimikatz.64 W32/Petya.VKHI-2239 Trojan.Petya.e TR/Mimipet.airfqba Trojan[PSW]/Win32.WinCred Trojan:Win32/Petya.B!rsm Win32.Riskware.Mimikatz.A Trojan/Win32.Petya.R203330 Trojan.Ransom.Petya BScope.Trojan-Dropper.Injector Trojan.Petya Win32/RiskWare.Mimikatz.U Trojan.PWS.WinCred! hacktool.mimikatz W32/Petya.A!tr.ransom Trj/CryptoPetya.B


A backdoor also known as: W32.BitcodeN.Trojan Trojan.Dropper.VRM Trojan.FakeAV Trojan.Dropper.VRM TSPY_VBKEYLOG.SM Win32.Trojan.WisdomEyes.16070401.9500.9793 Win32/Tnega.ASRH TSPY_VBKEYLOG.SM Trojan.Dropper.VRM Trojan.Dropper.VRM Trojan.Dropper.VRM BehavesLike.Win32.Downloader.bh TR/Spy.jyiej Trojan:Win32/Glod.B Trojan.Dropper.VRM Trojan.Dropper.VRM Trojan.KeyLogger.OEU Win32/Spy.KeyLogger.OEU Backdoor.Win32.Xtrat


Since then, we've encountered more samples in the wild.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan2.GJUE Hacktool.Rootkit Win32/Fuzfle.BZ Trojan.Win32.Sentinel.cquvjc Trojan.Sentinel.based Trojan.Spammer W32/Trojan.UUTE-6344 Trojan/Win32.Unknown Spammer:WinNT/Srizbi.A Trj/CI.A


A backdoor also known as: W32.FamVT.RazyNHmA.Trojan Trojan.Kryptik.Win32.1323308 Win32.Trojan.Kryptik.aio Ransom.TeslaCrypt!g6 WORM_HPKASIDET.SM0 Trojan.Win32.Kryptik.evtvij Trojan.DownLoader25.63634 WORM_HPKASIDET.SM0 BehavesLike.Win32.Downloader.cc Trojan-Downloader.Win32.Wauchos Worm.Ngrbot.aeb TR/Crypt.ZPACK.avthl Backdoor:Win32/Pigskarb.A Trojan.Symmi.D104A4 Trojan/Win32.Upbot.C1489911 W32/Kryptik.FXQD!tr


At the request of the German Bundestag the BSI analyzed these problems in network traffic.


A backdoor also known as: VB:Trojan.Valyria.335 W97M.Downloader.AFY W97M/Downloader.bxd VB:Trojan.Valyria.335 W97M.Downloader Win32/DarkNeuron.A W2KM_DARKNEURON.A VB:Trojan.Valyria.335 Trojan.Ole2.Vbs-heuristic.druvzi Heur:Trojan.Script.Downloader.7020638.0 VB:Trojan.Valyria.335 W2KM_DARKNEURON.A W97M/Downloader.bxd TrojanDropper:O97M/DarkNeuron.A!dha VB:Trojan.Valyria.335 virus.office.qexvmc.1100


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Exploit.Win32.BypassUAC.gmk Trojan.MulDrop7.677 BehavesLike.Win32.BadFile.ch Trojan-Downloader.MSIL.Tiny W32/Trojan.RVEW-7367 Exploit.Win32.BypassUAC.gmk TrojanDownloader:MSIL/BrobanDel.C!bit Win32.Trojan.Downloader.Phqh MSIL/Tiny.QK!tr.dldr


A backdoor also known as: W32.DowlodN.Trojan W32/Downldr2.BCPJ Win.Downloader.24666-2 Trojan.Spambot.3004 BehavesLike.Win32.MoonLight.mc W32/Downloader.EITQ-0059 Trojan:Win32/Pramro.A Trojan.Win32.Downloader.28160.AO Trojan/Win32.CSon.R2002 Virus.Win32.Sality Bck/Spambot.G


Ovidiy Stealer is priced at 450-750 Rubles ~$7-13 USD for one build, a price that includes a precompiled executable that is also crypted to thwart analysis and detection.


A backdoor also known as: TrojanPWS.Sekur.14236 Win32.Trojan.WisdomEyes.16070401.9500.9974 Trojan.Win32.Z.Sirefef.150528 Win32.Trojan.Crypt.Ligd BackDoor.Anunak.8 W32/Trojan.RFBB-7838 Trojan.Sirefef.181 PWS:Win32/Sekur.A Trj/GdSda.A Win32/Trojan.0c8


Once they have access to the network they proceed to encrypt multiple Windows systems using SamSam.


A backdoor also known as: Trojan.Bladabindi.FC.2865 Trojan/Bladabindi.u TROJ_SPNR.0BGN14 Win32.Trojan.WisdomEyes.16070401.9500.9994 Win32/Tnega.MAGYUTC TROJ_SPNR.0BGN14 MSIL.Backdoor.Bladabindi.AX BackDoor.NJRat.355 HackTool.MSIL W32/Trojan.UVRI-0473 Trojan/MSIL.fiv W32.Hack.Tool HackTool:MSIL/Jaktinier.A!plugin HackTool.Jaktinier Trj/CI.A MSIL/Bladabindi.U Win32/Trojan.b0d


ITG03 actors stole money from multiple international banks via the compromise of the interbank funds transfer system SWIFT in 2016.


This appears to be an attack campaign focused on espionage.


A backdoor also known as: Trojan.Symmi.DC2FF Win32.Trojan.WisdomEyes.16070401.9500.9877 Trojan.Win32.VB.ctxv Troj.W32.VB.mgqM Win32.Trojan.Vb.Ahyc TrojWare.Win32.Injector.DSTF Trojan:W32/Bepush.B Trojan.Blocker.Win32.25483 BehavesLike.Win32.Dropper.jh Trojan/VB.cxjy TR/Crypt.cfi.besd Trojan.Win32.VB.ctxv Trojan/Win32.Asprox.R132179 Win32/VB.RTN Trojan.VB!fKAQ4AnWSUA Trojan.Crypt W32/ExtenBro.AK!tr Win32/Trojan.682


A backdoor also known as: TrojanPWS.Zbot.A4 Backdoor.Bot Troj.Dropper.W32.Dapato!c Win32.Trojan.WisdomEyes.16070401.9500.9991 Trojan.Zbot Win32.Trojan.Injector.CZ Trojan-Dropper.Win32.Dapato.ezng Trojan.Win32.Dapato.driscq Trojan.Emotet.63 BehavesLike.Win32.VirRansom.cc Trojan.Win32.Injector Trojan/Yakes.tsq Trojan/Win32.Deshacop Spammer:Win32/Emotet.G Trojan-Dropper.Win32.Dapato.ezng Trojan/Win32.Injector.R140545 BScope.Malware-Cryptor.Hlux Trj/PasswordStealer.BT W32/Injector.BYFS!tr


The attack targeted at least one organization in Saudi Arabia, which aligns with the targeting of the initial Shamoon attacks.


A backdoor also known as: TROJ_RUCE.C Win32.Trojan.WisdomEyes.16070401.9500.9969 TROJ_RUCE.C W32/Trojan.UCZC-3562 TR/Ruce.44544A Trojan.Hiloti.2 Trojan/Win32.Ruce.C1864771 Trj/CI.A


A backdoor also known as: Trojan-Dropper/W32.Dapato.59904.C Trojan.Foidan Spyware.Zbot.ED TROJ_SPNR.11EJ13 Win32.Trojan.WisdomEyes.16070401.9500.9898 Trojan.Zbot TROJ_SPNR.11EJ13 Trojan-Dropper.Win32.Dapato.cdtt Trojan.Win32.Dapato.cqljwd Troj.Dropper.W32.Dapato.cdtt!c TrojWare.Win32.Kryptik.BAXK Trojan.Inject1.21866 Dropper.Dapato.Win32.27589 Trojan-Spy.Win32.Zbot W32/Trojan.JZAQ-0520 TrojanDropper.Dapato.sad TR/Drop.Dapato.cdtt Trojan[Dropper]/Win32.Dapato Trojan.Zusy.DD28A Trojan-Dropper.Win32.Dapato.cdtt Trojan:Win32/Foidan.A TrojanDropper.Dapato Win32.Trojan-dropper.Dapato.Pgng Trojan.DR.Dapato!3ZrfcO/CUjc W32/ZAccess.Y!tr


A backdoor also known as: Trojan.NSIS Troj.Nsis.Decryptor!c Trojan.Win32.Z.Decryptor.478934 Trojan.Inject1.52881 Trojan.Inject3 W32/Trojan.SALD-6852 Win32/Injector.BQWC Trojan.NSIS.Decryptor.m TrojanDropper:Win32/Bondat.A Trojan.Decryptor!


A backdoor also known as: W32.DepanserX.Trojan Backdoor/W32.Prorat.351276.AA Backdoor.Win32.Prorat!O Backdoor.Prorat.A8 Backdoor.Prorat.Win32.7 Backdoor/Prorat.b Win32.Trojan.WisdomEyes.16070401.9500.9886 W32/ProratP.L Backdoor.Prorat Win32/ProRat.I BKDR_PRORAT.F Win.Trojan.Prorat-9 Backdoor.Win32.Prorat.b Trojan.Win32.Prorat.fzuk Backdoor.W32.Prorat.l70O BackDoor.ProRat.1736 BKDR_PRORAT.F BehavesLike.Win32.Backdoor.fc W32/ProratP.L Backdoor/Prorat.cm BDS/Prorat.AC Trojan[Backdoor]/Win32.Prorat.f Backdoor:Win32/Prorat.N Backdoor.Win32.Prorat.351276.B Backdoor.Win32.Prorat.b Win32.Backdoor.Prorat.A Trojan/Win32.Prorat.R1757 MalwareScope.Trojan-PSW.Pinch.1 Backdoor.Prorat.AJ Backdoor.Win32.Prorat W32/Prorat.I!tr.bdr


As it turns out, the downloaded file is an HTA HTML Application file, a format that is becoming more and more common as a malware launch point.


This blog entry will introduce the details of Asruex.


A backdoor also known as: Backdoor.Rockse.Win32.2 BKDR_ROCKSE.A Backdoor.Rockse BKDR_ROCKSE.A Backdoor.Win32.Rockse Trojan.Win32.Rockse.hkwa Backdoor.Win32.Rockse BackDoor.Rockse BehavesLike.Win32.Dropper.gc Trojan.Win32.Rockse W32/Risk.RDKH-7511 BDS/Rockse.2 Trojan[Backdoor]/Win32.Rockse Win32.Hack.Rockse.kcloud Backdoor.W32.Rockse!c Backdoor.Win32.Rockse Backdoor.Rockse Win32.Backdoor.Rockse.Wkbu Backdoor.Rockse!5s6/g9tFaiQ W32/Rockse.A!tr.bdr


A backdoor also known as: Trojan.Win32.Z.Notsocial.240128 Trojan.EmailSpy.origin BehavesLike.Win32.BadFile.dc Downloader/Win32.Mdm.R1834 Trojan.Win32.SpamTool


These countries are linked by a trade agreement as well as a cooperation on a range of non-financial matters.