A backdoor also known as: TrojanSpy.MSIL.r3 Trojan.Dropper Troj.PSW.MSIL.NetPass Trojan/Clicker.nai TrojanSpy.KeyLogger!3foOCbTDOkQ Spyware.ADH MSIL/TrojanClicker.NAI Trojan.Msil-382 Trojan-Spy.MSIL.KeyLogger.bybj Trojan.Win32.NetPass.dcndda Msil.Trojan-spy.Keylogger.Lhxb Trojan.MulDrop1.48625 Trojan/PSW.MSIL.oy W32/Dx.SUK!tr Trojan[PSW]/MSIL.NetPass Trojan.MSIL.Krypt.1 Trojan/Win32.Infostealer TrojanClicker:MSIL/Lnkhit.A MSIL.TrojanClicker Virus.MSIL Trojan.MSIL.KeyLogger.bybj Win32/Trojan.bee


A backdoor also known as: Win.Trojan.Shell-426 Backdoor:Win32/Sensode.G Trj/GdSda.A Win32/Trojan.75c


The domain was registered on March 8th , 2013 : Registration Service Provided By : SHANGHAI MEICHENG TECHNOLOGY INFORMATION DEVELOPMENT CO. , LTD. Domain Name : DLMDOCUMENTSEXCHANGE.COM Registration Date : 08-Mar-2013 Expiration Date : 08-Mar-2014 Status : LOCKED The domain registration data indicates the following owner : Registrant Contact Details : peng jia peng jia ( bdoufwke123010 @ gmail.com ) beijingshiahiidienquc.d beijingshi beijing,100000 CN Tel .


A backdoor also known as: Trojan/Win32.Poison.C12016


A backdoor also known as: Trojan.Payreen Trojan.Ransom.TechSupportScam Trojan.Win32.Payreen.evwzbn W32/Trojan.JXJF-8565 TR/Payreen.exevx SupportScam:MSIL/Payreen.A Trojan.TechSupportScam Trj/GdSda.A


Python/Agent.F is a worm that spreads via removable media.


This post intends to share the findings of the FortiGuard Lion Team on BlackMoon's prevalence and its latest code updates.


The Trojan may download files from the following remote location: [http://]bit.ly/2k4[REMOVED]


A backdoor also known as: Exploit/W32.CVE-2014-4114.I JS.Swabfex.QZ Exploit.CVE-2014-4114.A Troj.W32.Autoit!c Trojan.PPDropper TROJ_CVE20144114.G Trojan.Win32.Autoit.ezc Trojan.Win32.Autoit.efjbnz PPT.S.Exploit.1116160 TROJ_CVE20144114.G Trojan[Exploit]/OLE.CVE-2014-6352 Win32.Trojan.Autoit.Dwsw Trojan.Win32.BitcoinMiner virus.exp.20144114


Zygote is a daemon whose goal is to launch apps on Android, and injecting code into it allows the malware to intervene in any activity on the device.


This came on Friday 12th May when it was bundled with ransomware called WanaCrypt0r and let loose.


Proofpoint researchers conducted a historical analysis of samples related to this research and uncovered new malware variants and likely origins and methods of infection.


Mitigations Stay protected from mobile malware by taking these precautions : Do not download apps from unfamiliar sites Only install apps from trusted sources Pay close attention to the permissions requested by apps Install a suitable mobile security app , such as SEP Mobile or Norton , to protect your device and data Keep your operating system up to date Make frequent backups of important data Indicators of Compromise ( IoCs ) Package names : anew.football.cup.world.com.worldcup com.coder.glancelove com.winkchat APK SHA2 : 166f3a863bb2b66bda9c76dccf9529d5237f6394721f46635b053870eb2fcc5a b45defca452a640b303288131eb64c485f442aae0682a3c56489d24d59439b47 d9601735d674a9e55546fde0bffde235bc5f2546504b31799d874e8c31d5b6e9 2ce54d93510126fca83031f9521e40cd8460ae564d3d927e17bd63fb4cb20edc 67b1a1e7b505ac510322b9d4f4fc1e8a569d6d644582b588faccfeeaa4922cb7 1664cb343ee830fa94725fed143b119f7e2351307ed0ce04724b23469b9002f2 Loaded DEX SHA2 : afaf446a337bf93301b1d72855ccdd76112595f6e4369d977bea6f9721edf37e Domain/IP : goldncup [ .


Within the past couple years there were several major incidents that cited the use of Windows backdoors being ported to Linux.


Malware authors can sometimes be creative in order to manipulate their human targets on the one hand and to circumvent security products, too.


In regard to the attack lifecycle, development of tools occurs in the weaponization/staging phase that precedes the delivery phase, of which is typically the first opportunity we see the actors' activities as they interact directly with their target.


ThreatTrack Security Labs researchers have confirmed the credential-stealing Trojan Dyre is using a new dropper — and a valid digital certificate — to carry out its dirty work over HTTPS connections.


A backdoor also known as: Trojan.Adclicker.HB Trojan-Dropper/W32.Dapato.114688.C Trojan-Dropper.Win32.Dapato!O Trojan.Adclicker.HB Dropper.Dapato.Win32.9811 Trojan/Dropper.Dapato.axil Trojan.Adclicker.HB TROJ_WEVARM.SM Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_WEVARM.SM Win.Trojan.Dapato-938 TrojanDropper.Dapato Trojan.Win32.Dapato.ctxtcy Trojan.DownLoader6.77 Trojan-Clicker.AXPC TrojanDropper.Dapato.fxa Win32.Troj.Dapato.kcloud TrojanDownloader:Win32/Obvod.K Trojan.Adclicker.HB Trojan.Adclicker.HB Dropper/Win32.Dapato.R27056 Trojan.Adclicker.HB


A backdoor also known as: Backdoor.Damatak Trojan.Heur.JP.EEC131 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Poison.eqxekp Trojan.Chanitor.26 BehavesLike.Win32.Injector.km Backdoor:Win32/Damatak.A Backdoor.W32.Hupigon.kYZB Heur.Trojan.Hlux Trj/CI.A Win32.Trojan.Dlder.Tayr


The email was supposedly sent by the head of a US-based terrorist monitoring group.


A backdoor also known as: BDS/Iroffer.1221.5 Backdoor.Iroffer.AM W32/Iroffer.BC Trojan.Ioffer Backdoor.Win32.Iroffer.1221 Backdoor.Iroffer.1.2.2.1 W32/Iroffer.AM@bd BackDoor.Iroffer.1221 Backdoor.Win32.Iroffer.1221 W32/Iroffer.AM@bd Backdoor.Iroffer.1221.4098 Backdoor:Win32/Iroffer.1_221 Backdoor.Iroffer.1221 Win32/Iroffer.1222 Backdoor.Win32.Iroffer.1221 BackDoor.Iroffer.AD


A backdoor also known as: Trojan.Downloader.LoadAdv.ABW Trojan.Downloader.LoadAdv.ABW Win32.Trojan.WisdomEyes.16070401.9500.9971 Trojan.Downloader.LoadAdv.ABW Trojan.Downloader.LoadAdv.ABW Trojan.Downloader.LoadAdv.ABW Trojan.Packed.359 Trojan:Win32/Piptea.E Email-Worm.Win32.Joleee


Pay-per-infection is an underground business model where criminals are paying other criminals to distribute their malware


A number of tools and previously unknown exploits were discovered in the trove of data posted online.


A backdoor also known as: W32.DesticosLTG.Trojan Worm.Delf.Win32.2144 Worm.Win32.Delf.aai Trojan.Win32.Delf.ejergb Win32.Worm.Delf.Pkqt Trojan.MulDrop6.34757 BehavesLike.Win32.Dropper.vc W32/Trojan.ZKLJ-7196 Worm.Delf.ah Trojan:Win32/Chamolyon.A Trojan.Zusy.D2E11A Worm.Win32.Delf.aai Worm.Delf!YSxowO1fm1s Trojan-Downloader.Win32.Banload Trj/CI.A


Name MD5 Purpose msconf.exe 55fb01048b6287eadcbd9a0f86d21adf Main module , reverse shell network.exe f673bb1d519138ced7659484c0b66c5b Sending exfiltrated data system.exe d3baa45ed342fbc5a56d974d36d5f73f Surrounding sound recording by mic update.exe 395f9f87df728134b5e3c1ca4d48e9fa Keylogging wow.exe 16311b16fd48c1c87c6476a455093e7a Screenshot capturing skype_sync2.exe 6bcc3559d7405f25ea403317353d905f Skype call recording to MP3 All modules , except skype_sync2.exe , are written in Python and packed to binary files via the Py2exe tool .


The loader ’ s anti-debugger code is based on the following three methods : The first call aims to destroy the debugger connection : NOTE : This call completely stops the execution of WinDbg and other debuggers The second call tries to detect the presence of a debugger : The final call tries to destroy the possibility of adding software breakpoint : Finally , if the loader is happy with all the checks done so far , based on the victim operating system ( 32 or 64-bit ) it proceeds to decrypt a set of fake bitmap resources ( stage 2 ) embedded in the executable and prepares the execution of a new layer of VM decoding .


Commodity Remote Access Trojans RATs -- which are designed, productized and sold to the casual and experienced hacker alike -- put powerful remote access capabilities into the hands of criminals.


In advance of any official release, cybercriminals have already released their own Mario-related apps.


This implant was deployed in less than 10 machines only.


This campaign started on July 9, a few days after the Hacking Team announced it was hacked.


Most of the organizations attacked were vendors of industrial automation solutions and system support contractors.


A backdoor also known as: Trojan-PWS/W32.WebGame.18432.Y Trojan-PSW.Win32.Maran!O Trojan/PSW.Maran.ij W32/Pws.QZP Infostealer.Phax TSPY_MARAN.ANC Trojan-PSW.Win32.Maran.sv Trojan.Win32.Maran.jzdr Trojan.Win32.Z.Maran.18432.A Troj.GameThief.W32.OnLineGames.l9d5 TrojWare.Win32.PSW.Maran.NAH Trojan.PWS.Maran.591 Trojan.Win32.6BC1FBA9 TSPY_MARAN.ANC BehavesLike.Win32.SpywareLyndra.lh Trojan/PSW.Maran.ej Trojan[PSW]/Win32.Maran Trojan.Graftor.D18418 Trojan-PSW.Win32.Maran.sv PWS:Win32/Maran.M Trojan/Win32.Magania.C87823 TrojanPSW.Maran Trj/Maran.BK Win32/PSW.Maran.NAH Trojan.PWS.Maran!SDdAAxRuS44 Trojan-GameThief.Win32.OnLineGames W32/MARAN.SV!tr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Win-Trojan/MSILKrypt02.Exp Trj/GdSda.A


Sakula is a well known malware variant linked to several significant targeted intrusion campaigns over the past 2-3 years.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9964 BehavesLike.Win32.Trojan.mz Trojan/Win32.LockScreen.C1515946


Also, the samples analyzed have the ability detect the presence of a virtual machine to ensure it's not being analyzed in a network sandbox.


The current version of the malware allows the operator to steal files, keystrokes, perform screenshots, and execute arbitrary code on the infected host.


A backdoor also known as: Trojan.Razy.D39D3F Trojan.Win32.KillProc.hd Trojan.BtcMine.2050 Trojan/Win32.KillProc TrojanDownloader:MSIL/Taily.A!bit RiskWare.BitCoinMiner Trj/GdSda.A


A backdoor also known as: W32/Trojan.AHSJ-4985 Ransom_HC7.R002C0DAA18 Trojan.Win32.RedCap.ewxmze Virus.Ransom.Pycl.A!c TR/RedCap.qcvri Trojan/Win32.Ransom.C2347549 Trojan.Ransom.PyCL Ransom.FileLocker Trojan.DownLoader! Ransom.Win32 Trojan-Ransom.Crypren Trj/CI.A Win32/Trojan.Ransom.97f


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Infostealer.Limitail Trojan.DownLoader26.6005 BehavesLike.Win32.Trojan.cm Trojan.MSIL.Injector Trojan.MSIL.Bladabindi.1 Trojan/Win32.RatTool.R208188 Trj/GdSda.A MSIL/SpyPSW.AVQ!tr


A backdoor also known as: Trojan.Strictor.D1B6BC BKDR_HPKELIHOS.SM4 Win32.Trojan.WisdomEyes.16070401.9500.9990 BKDR_HPKELIHOS.SM4 BehavesLike.Win32.Expiro.ch Trojan.WPCracker.u Trojan.Win32.Boaxxe W32/Injector.DDXZ!tr


RIG Exploit Kit - May 2015


Compared to other adversary groups, C0d0so0 has shown the use of more sophisticated tactics and tools and has been linked to leveraging zero-day exploits on numerous occasions in combination with watering hole and spear phishing attacks.


Although Unit 42 cannot provide a full picture of the details surrounding the delivery of these samples, we are confident this activity targets Korean language speakers who use Samsung devices.


A backdoor also known as: Trojan/Cosmu.aqmz Trojan.Win32.Cosmu.divg Trojan.Win32.Z.Cosmu.1849214 W32.Dzan.l3Vn Trojan.DownLoader19.64657 Trojan.Cosmu.Win32.7698 Trojan-Dropper.Win32.Injector Trojan/Cosmu.mih Trojan[Downloader]/Win32.Wren Trojan.Win32.Cosmu.divg Trojan.Cosmu Trj/CI.A Win32.Trojan.Cosmu.Dypy W32/Malicious_Behavior.VEX Win32/Worm.15b


The attacks came to light when a bank in Poland discovered previously unknown malware running on a number of its computers.


On each system several tools were used to find, encrypt, and delete the original files as well as any backups.


Unit 42 researchers have uncovered a malware distribution campaign that is delivering the LokiBot information stealer via business email compromise BEC phishing emails


A backdoor also known as: Trojan/W32.Qhost.724992 Trojan.Win32.Qhost!O Trojan.BeeVry Trojan.Qhost Worm.AutoRun.Win32.64118 Win32.Worm.Autorun.ah W32/Trojan2.OFIZ W32.SillyFDC WORM_YAHLOVER.SM Trojan.Win32.Qhost.afes Trojan.Win32.Qhost.boicaq Trojan.Win32.A.Qhost.724992 Trojan.MulDrop3.42831 WORM_YAHLOVER.SM BehavesLike.Win32.Autorun.bt W32/Trojan.RWER-6321 Trojan/Qhost.gez Trojan/Win32.Qhost Troj.W32.Qhost.tn9x Trojan.Win32.Qhost.afes HEUR/Fakon.mwf W32/Autorun.worm.aadm Trojan.Qhost Trojan.Qhost Win32/AutoRun.VB.AVY Trojan.Qhost!hFnYX0CfRwA Worm.Win32.VB


A backdoor also known as: W32.DownloadDAB.Trojan Worm.MSIL.Arcdoor!O Worm.Arcdoor.ae3 Worm.Arcdoor.Win32.1086 Trojan/Arcdoor.ae MSIL.Worm.Arcdoor.b W32/Trojan2.NFSU Backdoor.Trojan Win32/Pontoeb.A BKDR_PONTOEB.SMHA Win.Trojan.Worm-74 Worm.MSIL.Arcdoor.ae Trojan.Win32.Arcdoor.ctsdhw Msil.Worm.Arcdoor.Lknq BKDR_PONTOEB.SMHA Worm.MSIL W32/Trojan.LEEP-1569 Worm.MSIL.fi WORM/MSIL.Arcdo.aea Worm/MSIL.Arcdoor Backdoor:MSIL/Pontoeb.G Trojan.Win32.Z.Arcdoor.26624 Worm.MSIL.Arcdoor.ae Worm/Win32.Arcdoor.R11889 MSIL/Arcdoor.AE MSIL/AntiVM.V!tr Win32/Worm.bed


A backdoor also known as: Trojan.Win32.LoadMoney.eprnxa PUP.LoadMoney/Variant Trojan.LoadMoney.2303 PUA.SearchGo ADWARE/SearchGo.avskt PUP/Win32.Searchgo.R201982 Adware.SearchGo


The widespread use of telnet, along with a list of factory default usernames and passwords, result in botnets with sizes that is beyond imagination.


are designed to resemble tracking e-mails from different post offices around the world.


The first section aims to analyze the malware's capabilities e.g.: c2 connectivity, encoding mechanisms and overall system activity.


This RAT looks new to us; hence we suspected that it may either be a new RAT family or a custom RAT that was developed for a specific attacker hacker


A backdoor also known as: W32.Clod3a9.Trojan.e28b Win32.Trojan.WisdomEyes.16070401.9500.9998 Backdoor.Trojan trojan.win32.skeeyah.a!rfn W32/Trojan.FVPV-5651 TR/Crypt.ZPACK.mwex TrojanDropper:Win32/Barlaiy.A!dha Trojan-Downloader.Win32.FraudLoad Trj/CI.A Win32/Trojan.0e6


This cyber-espionage group was dubbed Rocket Kitten,' and remains active as of this writing, with reported attacks as recent as October 2015.


Late last week Talos researchers noticed a drastic uptick in Angler Exploit Kit activity.


This blog presents our analysis of one of the latest malware variants targeting individuals in Taiwan, which exhibits some interesting characteristics that can be useful for detecting and defending against the threat – including the creation of an obese file, weighing in at 500MB, as part of its execution.


CitizenLab connect the infrastructure used in the campaign to previous malware operations targeting a Tibetan radio station and the Thai government.


A backdoor also known as: Trojan.Zlob.60259 Trojan.NSIS.StartPage.Q Trojan.Zlob.60259 Win32/SillyDl.YHD Win.Trojan.NSIS-38 Trojan-Downloader.Win32.NSIS.io Trojan.Zlob.60259 Riskware.Nsis.Adw.cxexqq Troj.Downloader.W32.Lipler.lkqh Trojan.Zlob.60259 Trojan.Fakealert.26734 BehavesLike.Win32.AdwareSearchProtect.kc TrojanDownloader:Win32/Gabeerf.A Trojan.Zlob.DEB63 Trojan.Win32.Banker.140384 Trojan.Zlob.60259 Trojan/Win32.StartPage.R26935 Trojan.NSIS


A backdoor also known as: W32.AutoRunLUL.Worm Trojan.Downloader.Bredolab.AA Packed.Win32.Tadym!O Trojan.Tadym Downloader-BTR.a Trojan.Downloader.Bredolab.AA TROJ_BREDLAB.SMB Win32.Trojan.WisdomEyes.16070401.9500.9994 TROJ_BREDLAB.SMB Win.Trojan.Bredolab-4616 Packed.Win32.Tadym.b Trojan.Downloader.Bredolab.AA Trojan.Win32.Tadym.deqzho Win32.Packed.Tadym.Pdmb Trojan.Downloader.Bredolab.AA TrojWare.Win32.TrojanDropper.HDrop.B Trojan.Downloader.Bredolab.AA Win32.HLLW.Autoruner.6644 Backdoor.CPEX.Win32.27835 BehavesLike.Win32.RAHack.mc Worm/AutoRun.nlq Trojan[Packed]/Win32.Tadym TrojanDropper:Win32/Emold.C Troj.W32.Vaklik.l3JH Packed.Win32.Tadym.b Trojan.Downloader.Bredolab.AA Trojan.Downloader.Bredolab.AA BScope.Trojan.Ballast Worm.AutoRun!kxuXEtVXF84 Trojan.Win32.Bredolab


InPage is a word processor program that supports languages such as Urdu, Persian, Pashto, and Arabic.


This operation is another example of a threat actor using just enough technical sophistication to exploit a target.


A backdoor also known as: W32.FamVT.ExpiroPC.PE Trojan.Kazy.D765A4 Heur.Corrupt.PE BehavesLike.Win32.PWSGamania.dc HackTool.Win32.QQExplorer HackTool/Win32.QQExplorer HackTool:Win32/QQExplorer.1_26.dam#2 HackTool/Win32.QQExplorer.C1530039 Trj/CI.A Win32/Trojan.dd5


A backdoor also known as: Ransom.Locky.D6 Trojan.Barys.DD3B9 W32.Pilleuz Win32.Trojan-Downloader.Kryptik.ER Trojan.Win32.Inject.ebobum Trojan.Win32.Z.Injector.119812 BackDoor.Andromeda.1478 Dropper.Injector.Win32.77187 BehavesLike.Win32.PWSZbot.ch W32/Trojan.LSBE-5509 TrojanDropper.Injector.bhwe Backdoor:Win32/Wondufi.A TrojanDropper.Injector Trj/GdSda.A Trojan.DR.Injector!1yj9x8ODPcQ W32/Kryptik.FIKL!tr Win32/Trojan.02c


Some of the more interesting commands include : SMS Control Update the address of the C & C server — SMS starting with “ http : // ” Send AES-encrypted SMS message back to sender — SMS starting with “ sms : // ” Update service wake-up interval — “ 2 ” Kill switch — “ 4 ” C & C Control Update the address of the C & C server — “ 1 ” Update service wake-up interval — “ 2 ” Lock the screen — “ 5 ” Display a picture in a WebView from an arbitrary URL — “ 11 ” Send an arbitrary SMS message — “ 8 ” Steal images saved on the device — “ 12 ” and “ 13 ” Use the accessibility service to become the default SMS app — “ 6 ” Enable recording of other apps — “ 15 ” Kill switch — “ 4 ” The Lockdown Screen Most thieves don ’ t want to be caught red-handed as they steal — they want to buy some time to get away with the loot .


Many of these samples have not been discussed publicly and several have very little or no anti-virus coverage.


A backdoor also known as: Backdoor/W32.Lithium.38400 Backdoor.Lithium.F Win32/Lithium.102 Backdoor.Trojan W32/LithBack.1_02 BKDR_LITH.102.A Win32.Lithium.102.a Backdoor.Win32.Lithium.102 Backdoor.Lithium.1.0.2 Backdoor.Win32.Lithium.102!IK Backdoor.Win32.Lithium.102 Backdoor.Lithium.1.0.2 BackDoor.Lithium.102 BDS/Lithium.102.Srv BKDR_LITH.102.A Win32/Lithium.D Backdoor/Lithium.102 Backdoor:Win32/Lithium.1_02 Backdoor.Win32.Lithium_102.38400 Backdoor.Lithium.1.0.2 Win-Trojan/Lithium.38400 Backdoor.Lithium.102 Backdoor.Trojan Backdoor.Lithium.102.b Backdoor.Win32.Lithium.102 W32/Lithium!tr.bdr


A backdoor also known as: TrojanDownloader.Admedia Multi.Threats.InArchive Trojan.Dropper Win32/Donnic.D Win.Downloader.Small-3527 Trojan-Downloader.Win32.QQHelper.va Trojan.Win32.QQHelper.ybwad Troj.Downloader.W32!c Trojan.DownLoader.14343 Backdoor.CPEX.Win32.15449 BehavesLike.Win32.Backdoor.tc Trojan-Downloader.Win32.QQHelper TrojanDownloader.VB.lr TR/Dldr.Harnig.5 Trojan[Downloader]/Win32.QQHelper Trojan:Win32/Zaptusk.A Trojan-Downloader.Win32.QQHelper.va Worm.WhiteIce Trj/Multidropper.BQE Win32.Trojan-downloader.Qqhelper.Dzaq Win32/Trojan.Downloader.c98


After spending more time analyzing the proxy, we realized that the requests we were receiving were not related to ad-fraud activity as we initially suspected but instead appeared to be for some sort of VPN service.


A backdoor also known as: AutoIt.Trojan.Injector.bq Trojan.Autoit W32/Injector.COJ!tr


A backdoor also known as: Trojan.Obfuscated.KU Trojan.Win32.Inject!O Trojan.Inject.Win32.41934 Trojan/Inject.bsb Win32.Trojan.WisdomEyes.16070401.9500.9746 Win.Trojan.Inject-12484 Trojan.Obfuscated.KU Trojan.Obfuscated.KU Trojan.Win32.Inject.cwlvrx AdWare.W32.Cinmus.kYTY Trojan.Obfuscated.KU Trojan.DownLoader1.2110 Trojan.Win32.Malware.a Trojan.Rootkit Trojan/Win32.Inject Win32.Adware.CinmusT.lm.230980 Trojan.Obfuscated.KU Trojan:Win32/Cinmus.K Trojan/Win32.Inject.C140611 Trojan.Obfuscated.KU Trojan.Win32.Malware.a SScope.Trojan.Cinmus.39 Win32.Trojan.Inject.bidk Trojan.Inject!Lqw/iuX+8xA W32/Malware_fam.NB


A backdoor also known as: Trojan.Multi Trojan.Foreign.Win32.57563 Trojan.Johnnie.D12DD3 Trojan-Ransom.Win32.Foreign.nxyh Trojan.Win32.Panda.exmste Trojan.Win32.Z.Johnnie.582144 Trojan.PWS.Panda.12917 BehavesLike.Win32.Backdoor.hc Trojan.Win32.Crypt W32/Trojan.MEZF-9098 TR/AD.PepaBot.pabel TrojanDropper:Win32/Ropest.A Trojan-Ransom.Win32.Foreign.nxyh TrojanPSW.Panda Trj/GdSda.A W32/Kryptik.FQTY!tr Win32/Trojan.acd


Dozens of targets may receive the exact same message.


A backdoor also known as: Trojan/W32.Dialer.10624 Trojan.Dialer.AY Trojan/Dialer.ay Trojan.Dialer.AU1 W32/Qdialer.J Dialer.DialPlatform Win32/SilentCaller.D TROJ_MALQES.A Trojan.Win32.Dialer.ay Trojan.Dialer.AY Trojan.Win32.Dialer.ay!IK TrojWare.Win32.Dialer.NAD Dialer.Silent TR/Drop.Delf.DJ.3 TROJ_MALQES.A Trojan/Dialer.ay Trojan:Win32/Adialer.AX Trojan.Win32.Dialer.10656 Win-AppCare/Dialer.10624 Trojan.Dialer.AY W32/Qdialer.J OScope.Dialer.VL Win32/Dialer.NAD Trojan.Win32.Dialer.ay Dialer.8.AP


A backdoor also known as: Trojan/W32.Inject.68935 Packed.Win32.TDSS!O Trojan/Inject.oc Win32.Trojan.WisdomEyes.16070401.9500.9868 Backdoor.Trojan Trojan.Win32.Inject.oc Trojan.Win32.Inject.wpzg Troj.W32.Inject.oc!c BackDoor.Exte BehavesLike.Win32.Backdoor.kc Net-Worm.Win32.Mofeir Trojan/Inject.amwy Trojan/Win32.Inject Trojan:Win32/Oexsi.A Trojan.Win32.Inject.oc Trojan/Win32.Inject.C27812 Trojan.Inject Trojan.Downloader W32/BanLoader.AAAC!tr


A backdoor also known as: TROJ_KREP.D Trojan.DownLoad3.10695 Trojan.Swisyn.Win32.8140 TROJ_KREP.D Trojan/Swisyn.jnt Trojan:Win32/Trixpi.A Trojan-Downloader.win32.Delf.xoq W32/Mdrop.CQO!tr Trojan.Win32.Trixpi.A


A backdoor also known as: Backdoor/W32.SdBot.25088.Q Backdoor/Afbot.a BKDR_POEBOT.DK Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan BKDR_POEBOT.DK Backdoor.Win32.Afbot.a Trojan.Win32.Afbot.daze Backdoor.Win32.S.Afbot.25088 Backdoor.W32.Afbot.a!c Backdoor.Win32.Afbot.~A BackDoor.IRC.Afbot Backdoor.Afbot.Win32.1 Backdoor/Afbot.a Trojan[Backdoor]/Win32.Afbot Backdoor:Win32/Afbot.A Backdoor.Win32.Afbot.a Backdoor.Afbot Bck/Iroffer.BG Win32.Backdoor.Afbot.Szbp Backdoor.Afbot!ktevPrMqQWw W32/Afbot.A!tr.bdr Win32/Backdoor.BO.3c4


These SQL servers are also used for command and control C2 functionality.


A backdoor also known as: Trojan.Win32.Cosmu!O Worm.NadIote Trojan.Cosmu.Win32.2079 Win32.Worm.VB.pf W32/Risk.BXNI-0011 Win32/VB.AZL Trojan.Win32.Cosmu.ist Trojan.Win32.Cosmu.cojafm Win32.Trojan.Cosmu.Eehn Worm.Win32.Pronny.BL Win32.HLLW.Autoruner.14654 BehavesLike.Win32.VBObfus.fm W32/MalwareS.AKRW Trojan/Cosmu.pri Trojan/Win32.Cosmu Trojan.Win32.Cosmu.315392.A Trojan.Win32.Cosmu.ist HEUR/Fakon.mwf Trojan.VBO.05376 Trojan.Cosmu Win32/AutoRun.Spy.VB.E Trojan.Cosmu!52KOHqBZvHU


A backdoor also known as: Trojan.Mauvaise.SL1 Win32.Trojan.WisdomEyes.16070401.9500.9950 Backdoor.Noknef TSPY_KONNI.A Trojan.Win32.Graftor.eoiwlz Dropper.S.Konni.266752 Trojan.MulDrop7.31720 TSPY_KONNI.A BehavesLike.Win32.Fake.dm W32/Trojan.NPTT-8320 TR/Graftor.266752.17 Trojan:Win32/Konny.A Backdoor.Noknef Backdoor.Win32.Hupigon Malicious_Behavior.SB


A backdoor also known as: Trojan.Heur2.FU.E930ED Backdoor.Trojan Adware.Mutabaha.1206 Trojan:Win32/Winnti.V!dha Trojan.Win32.Z.Svchorse.725184 BScope.Trojan.SvcHorse.01643 PossibleThreat.SB!tr


Wild Neutron hit the spotlight in 2013, when it successfully infected companies such as Apple, Facebook, Twitter and Microsoft.


Triggers ET rules for: RadminRMS, XPCSpyPro, RemoteAdmin.RemoteUtilities.C


A backdoor also known as: Trojan-Dropper.Win32.Mudrop!O Win32.Trojan.WisdomEyes.16070401.9500.9756 Win.Trojan.VB-472 Trojan-Dropper.Win32.Mudrop.bq Trojan.MulDrop.5694 Downloader.VB.Win32.99231 BehavesLike.Win32.RAHack.hh TrojanDropper.Mudrop.dv Trojan[Dropper]/Win32.Mudrop TrojanDropper:Win32/Popuper.N Trojan.Downloader-SysMon Trojan-Dropper.Win32.Mudrop.bq TScope.Malware-Cryptor.SB Trojan-Dropper.Win32.Mudrop


These include domains, file names, Java package names, and Facebook activity.


A backdoor also known as: Trojan.Inject.Win32.243804 Trojan.Win32.Delphi.ewuekh Trojan[Backdoor]/MSIL.NanoBot Trojan/Win32.Injector.R217510 Trojan.Symmi.D14210


A backdoor also known as: Backdoor.Loselove.A Backdoor.Loselove.A Trojan.Win32.Loselove.makvn Backdoor.Trojan BKDR_LOSELOVE.A Win32.Trojan Backdoor.Win32.Loselove Backdoor.Loselove.A Backdoor.Loselove.B Backdoor.Win32.Loselove.765952 Backdoor.Win32.Loselove.10 Backdoor.Loselove.A BackDoor.Loselove BDC/Loselove.1 BKDR_LOSELOVE.A Backdoor/LostLove.Client Win32.Hack.Loselove.kcloud Win-Trojan/Loselove.765952 Backdoor.Loselove.A Backdoor.Trojan Win32/Loselove.10 Backdoor.Win32.Loselove W32/Loselove.A!tr.bdr BackDoor.Loselove.A


Potential infrastructure used to launch phishing attacks against the Macron presidential campaign.


A backdoor also known as: Trojan.DownLoader24.49714 TR/Crypt.Xpack.enmvj Trojan/Win32.Invader Trojan.Graftor.D5A2C5 TrojanDownloader:Win32/Furs.A Trojan.Inject Trj/CI.A Win32/Trojan.223


McAfee Labs has found that the latest Rovnix downloader now comes with the capability to check for the sinkholing of its control servers.


MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call POWERSTATS


A backdoor also known as: Backdoor.Alaveensee Win32.Trojan.WisdomEyes.16070401.9500.9994 W32/Trojan.YNOK-2169 Trojan.DownLoader10.48462 Trojan.Graftor.D1D3B0 Backdoor:Win32/Alaveensee.AC!bit Trojan.DownLoader!


A backdoor also known as: W32.Dellogkbms.Trojan Trojan/W32.Small.40960.JU Trojan.Win32.ShipUp!O Trojan.Shipup.H5 Trojan.ShipUp.Win32.175 Trojan/ShipUp.nak Trojan.Zusy.DAD3 Win32.Trojan.WisdomEyes.16070401.9500.9999 TSPY_SHIPUP_CA080195.TOMC Win.Trojan.Shipup-7 Trojan.Win32.ShipUp.fufz Trojan.Win32.ShipUp.ijffr Win32.Trojan.Shipup.Isq TrojWare.Win32.ShipUp.NAK Trojan.Shipup.192 TSPY_SHIPUP_CA080195.TOMC Trojan.Win32.ShipUp Trojan.ShipUp.ar TR/Offend.46438158 Trojan/Win32.ShipUp Trojan:Win32/Shipup.H Trojan.Win32.A.ShipUp.40960.EO Trojan.Win32.ShipUp.fufz Trojan/Win32.Shipup.R27635 Trojan.ShipUp Trojan.Dropper.FW Trojan.ShipUp!FM//sdnjcwM


A backdoor also known as: Trojan.Zenshirsh.SL7 Trojan.Ursnif Trojan.Ransom.99 Win32.Trojan.WisdomEyes.16070401.9500.9999 Ransom_HPCRYPMIC.SM2 Ransom_HPCRYPMIC.SM2 BehavesLike.Win32.Ransom.cc Trojan.Win32.Filecoder Trojan:Win32/Wirond.A


A backdoor also known as: W32.OnGameJ9KFZDll.Trojan Adware.Heur.E313D2 Win32.Trojan.WisdomEyes.16070401.9500.9834 Trojan.Adclicker ApplicUnwnt.Win32.Adware.Boran._0 Trojan.DownLoad.6111 not-a-virus:AdWare.Win32.Boran Trojan:Win32/Fexacer.A ADSPY/Superid.A Trojan:Win32/Fexacer.A Trojan/Win32.Popwin.R61755 AdWare.Boran Win32/Adware.Boran


Adding in their creative waterholing and poisoned installer tactics, we describe the StrongPity APT as not only determined and well-resourced, but fairly reckless and innovative as well.


A backdoor also known as: W32.eHeur.Virus02 Virus.Win32.Sality!O Trojan.Xorist Ransom_Xorist.R029C0DLN17 Win32.Trojan.Filecoder.p W32/Ransom.GEQX-2455 Ransom_Xorist.R029C0DLN17 Trojan-Ransom.Win32.Xorist.lr Trojan.Win32.Xorist.ewkyne Trojan.Win32.Z.Xorist.3077 Troj.Ransom.W32!c Trojan.Win32.Xorist.b Trojan.Encoder.4210 Trojan.Xorist.Win32.1605 Trojan-Ransom.FileCoder Trojan.Xorist.wdr Trojan-Ransom.Win32.Xorist.lr Trojan:Win32/Eksor.A Worm/Win32.Zhelatin.C112256 Hoax.Xorist Trj/CI.A Win32/Filecoder.NFV W32/Filecoder.NFV!tr Win32/Trojan.Xorist.A


A backdoor also known as: Ransom.Onion.A Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.JIQA-6859 Ransom_.97182692 Trojan.Win32.CZOF.ejtmuo Trojan.Inject2.23490 Ransom_.97182692 BehavesLike.Win32.Ransom.cc TrojanDropper:Win32/Cerber.A Trojan/Win32.Cerber.R182622 Win32/Filecoder.Cerber.B Trojan.Injector!tlnazaf/C8k W32/Injector.DAJC!tr


Security firm ThreatFabric has discovered a new variant of the Xenomorph malware family, which it describes as the most advanced and dangerous Android banking trojans in circulation, and which has new features.


After beginning an investigation into the affiliated malware samples and domains, we quickly came to realization that this group is very likely targeting SCADA-centric victims who are using GE Intelligent Platform's CIMPLICITY HMI solution suite.


In the observed campaign, the attackers abuse a feature in Windows called the Windows Troubleshooting Platform WTP, intended for troubleshooting problems, to socially engineer the recipients into executing malware.


A backdoor also known as: TrojanPWS.Yunsip.A5 W32.Yunsip Win32/Tnega.XWcDLN WORM_YUNSIP.SMR Trojan.Win32.FakeMS.tpd Trojan.PWS.Spy.20716 WORM_YUNSIP.SMR TR/PSW.Yunsip.axyza Trojan.Zusy.D56F7 Trojan.Win32.PSWIGames.191268 PWS:Win32/Yunsip.A Trojan/Win32.Infostealer.R758 TScope.Malware-Cryptor.SB Backdoor.Win32.Inject Trj/CI.A Trojan.Win32.FakeUsp10.B


A backdoor also known as: HW32.Packed.5316 Trojan.Iframeexec Exploit.Html.Iframe.udgq BehavesLike.Win32.Dropper.wc W32/Trojan.MRKD-5424


A backdoor also known as: Trojan.Dynamer.FC.316 MSIL.Backdoor.Orcus.A Trojan.DownLoader24.65022 Win-Trojan/OrcusRAT.Exp


A backdoor also known as: Trojan/W32.Paranoia.240640 Application.Badjoke Riskware.Win32.Paranoia.cckyo JOKE_PARANOIA.A Joke.Paranoia Joke.Paranoia!EAb1BDrutFU Joke.Paranoia Trojan.Win32.E3E61A09 JOKE_PARANOIA.A JOKE/Paranoia.A Win-Trojan/Paranoia.240640 Hacktool.Win32.Paranoia.BA Win32/Joke.13f


A backdoor also known as: Trojan.Mauvaise.SL1 Hacktool.Mimikatz Win64.Riskware.Mimikatz.B Trojan.Win32.Meterpreter.ewppjl Tool.Mimikatz.88 BehavesLike.Win32.Worm.fh HackTool.Win32.Meterpreter HackTool/Win32.Meterpreter Unwanted/Win32.Mimikatz.R175513 Trj/GdSda.A Win32.Hacktool.Meterpreter.Pbfr Win32/Trojan.Hacktool.8d0


It is likely that the analyzed samples were created using the private version, as they are designed to run on modern 64-bit systems, although they could have been built based on sold, leaked or stolen source code.


In this blog, FireEye Labs dissects this new ATM malware that we have dubbed RIPPER due to the project name ATMRIPPER identified in the sample and documents indicators that strongly suggest this piece of malware is the one used to steal from the ATMs at banks in Thailand.


However, beginning on September 22, 2016, we detected the first large-scale email campaign distributing MarsJoke.


Exploit kits often integrate new or zero-day exploits in the hopes of getting a larger number of victims with systems that may not be as up-to-date with their patches.


A backdoor also known as: TjnSpy.Golroted.S1819456 Trojan.Omaneat.Win32.266 Trojan/Injector.dkxl TSPY_FAREIT.SMBD W32/Omaneat.XICE-5093 TSPY_FAREIT.SMBD Trojan-Spy.MSIL.Omaneat.awa Trojan.Win32.Omaneat.eliuzg BehavesLike.Win32.Trojan.tc Trojan.Win32.Injector W32/Omaneat.Y Trojan[Spy]/MSIL.Omaneat TrojanSpy:MSIL/Golroted.B Trojan.Heur.E613EE Trojan-Spy.MSIL.Omaneat.awa Spyware/Win32.Omaneat.R194942 TrojanSpy.MSIL.Omaneat Trojan.Omaneat Win32/VB.OSK TrojanSpy.Omaneat! W32/Injector.DKXL!tr


Following the identification of this campaign, Mandiant responded to multiple UNC2970 intrusions targeting U.S. and European Media organizations through spear-phishing that used a job recruitment theme.


The conditionally injected script redirects to the Afraidgate campaign, which in turns pushes the Neutrino exploit kit.


A recent tweet mentioned that a new banking malware called Nuclear Bot has started to appear for sale on underground marketplaces.


While the sample is a typical memory scraper, it appears to be hand rolled assembly language and comes in at only 5120 bytes.


A backdoor also known as: Application.SMSHoax.DT Hoax.Win32.ArchSMS!O Hoax.ArchSMS Joke-ArchSMS.a Hoax.ArchSMS Win32.Trojan.WisdomEyes.16070401.9500.9996 W32/SMShoax.A Win32/SMSSend.A Win.Trojan.Hoax-12 Hoax.Win32.ArchSMS.hzpg Application.SMSHoax.DT Riskware.Win32.Archsms.fuais Win32.Trojan-psw.Archsms.Wrqa Application.SMSHoax.DT Application.SMSHoax.DT Trojan.SMSSend.146 Trojan.ArchSMS.Win32.13 Joke-ArchSMS.a W32/SMShoax.FGEV-2767 JOKE/ArchSMS.A HackTool[Hoax]/Win32.ArchSMS Application.SMSHoax.DT Hoax.Win32.ArchSMS.hzpg Trojan:Win32/Zipparch.F Adware/Win32.SMSHoax.R15838 Trojan.SMS.23205 Application.SMSHoax.B Hoax.Win32.ArchSMS


In previous instances, Cyble Research and Intelligence Labs CRIL has exposed numerous phishing websites that have been used to steal sensitive data by utilizing a range of malware types, such as stealers, RATs, and bots.


Early last month, a new variant of mobile ransomware SLocker detected by Trend Micro as ANDROIDOS_SLOCKER.OPST was detected, copying the GUI of the now-infamous WannaCry.


The Sundown exploit kit is a recent addition to the field of EKs, and analysis indicates that it is still in development by its creator.


Apart from Banker, there are reports indicating that other banking Trojans, are doing the same thing.


SamSam is manually deployed ransomware.


The exclusive interest in Japanese government, education, and commerce will likely continue into the future as the group is just starting to build and utilize their existing current attack infrastructure.


With a few unsuccessful exceptions, the notion of locking a Mac device and holding its owner to ransom in return for access to the machine and its data has not yet proven an attractive proposition for attackers.


We call the malware PowerSniff.


A backdoor also known as: Win32/Funsoul.A Worm/W32.Funsoul.45568 W32/Funpo.worm I-Worm.Funsoul!LToVDiOSu1I W32.Funsoul@mm WORM_FUNSOUL.A Email-Worm.Win32.Funsoul Trojan.Win32.Funsoul.empb I-Worm.Win32.S.Funsoul.45568[h] Win32.Worm-email.Funsoul.Lizy Worm.Win32.Funpo.A Worm.Funsoul.Win32.1 WORM_FUNSOUL.A W32/Funpo.worm W32/Risk.JJPZ-6561 Worm:Win32/Funsoul.C W32.W.Funsoul!c Trojan/Win32.HDC Worm.Funsoul Win32/Funpo.A W32/Funsoul.A!worm Win32/Worm.724


Toward the end of May, APT19 switched to using macro-enabled Microsoft Excel XLSM documents.


Its main targets are armed forces, the defense industry, news media, politicians, and dissidents.


The Trojan may connect to and send infection reports to the following remote location: [http://]46.45.138.138/pw/gate[REMOVED]


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Downldr2.FRFU Backdoor.Trojan BackDoor.Calla.5 W32/Downloader.KWLG-4153 Backdoor:Win32/Matchaldru.B


ESET detections of Android/AdDisplay.Ashas on Android devices by country Is adware harmful ? Because the real nature of apps containing adware is usually hidden to the user , these apps and their developers should be considered untrustworthy .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 TR/AD.Fogels.hochw Trojan.Kazy.D161B6


The malware is delivered via an innovative and unique technique: a downloader we are calling Carp uses malicious macros in Microsoft Excel documents to compile embedded C# C Sharp Programming Language source code into an executable that in turn is run to deploy the Cardinal RAT malware family.


A backdoor also known as: W32.QuintesLTU.Trojan Win32.Klez.E@mm Worm/W32.Klez.114688 Email-Worm.Win32.Klez!O W32.Klez.E W32/Klez.e@MM Worm.Klez Worm.Klez.Win32.2 Worm.Klez W32/Klez.E@MM Win32.Worm.Klez.a W32/Klez.E@mm W32.Klez.E@mm Win32/Klez.E Win.Worm.Klez-2 Trojan.Win32.Staser.bqjn Win32.Klez.E@mm Trojan.Win32.Klez.gleq Win32.Klez.E@mm Worm.Win32.Klez.E Win32.HLLM.Klez.1 BehavesLike.Win32.Klez.cm Email-Worm.Win32.Klez.E W32/Klez.E@mm Worm/Klez.l W32.Worm.Klez WORM/Klez.E Worm[Email]/Win32.Klez.k Worm:Win32/Klez.E@mm Win32.Klez.EA8AF7 W32.W.Klez.l5N7 Trojan.Win32.Staser.bqjn Win32.Klez.E@mm Win32/Klez.worm.E Win32.Klez.E@mm Win32.HLLW.Klez.e I-Worm.Klez.E Win32/Klez.E I-Worm.Klez!qHFMVAGctoI W32/Klez.F


The RAT, which according to compile timestamps first surfaced in November 2012, has been used in targeted intrusions through 2015.


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G Virus.Virut.Win32.1938 W32.Virut.CF Win32/Virut.17408 PE_VIRUX.R Win.Trojan.VB-48987 Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg W32.Virut.ltLS Win32.Virut.56 PE_VIRUX.R Win32/Virut.bt Virus/Win32.Virut.ce Win32.Virut.dd.368640 Virus.Win32.Virut.ce Win32.Virus.Virut.U Win32/Virut.F Virus.Virut.14 Win32/Virut.NBP Virus.Win32.Virut W32/Sality.AO Virus.Win32.Virut.M


A backdoor also known as: Backdoor.Icefog Backdoor.Trojan Backdoor.Win32.Icefog.as Backdoor.W32.Icefog!c BackDoor.Apper.1 BehavesLike.Win32.Downloader.hh W32/Trojan.KWYX-5577 Backdoor.Icefog.a Trojan[Backdoor]/Win32.Icefog Trojan.Johnnie.D5485 Backdoor.Win32.Icefog.as Trj/GdSda.A Win32.Backdoor.Icefog.Hmrl Win32/Trojan.db2


ESET presented our initial findings based on research into the Win32/Potao malware family in June, in our CCCC 2015 presentation in Copenhagen.


A backdoor also known as: W32/Adware.YVXR-5520 Trojan.Win32.SMSSend.dqubwq Trojan.Win32.Z.Archsms.1443328 Win32.Risk.Hoax.Alsz ApplicUnwnt.Win32.Hoax.ArchSMS.ACW Trojan.SMSSend.4307 Trojan.ArchSMS.Win32.17489 BehavesLike.Win32.PUP.tc Trojan.Win32.Clustinex Trojan/Win32.Unknown Win32.Troj.Undef.kcloud Trojan.Adware.SMSHoax.105 Trojan/Win32.ArchSMS.R77161 Hoax.ArchSMS!QwEIC3yXiN8 W32/ArchSMS.ACL!tr Win32/Trojan.a32


The attackers are using social engineering tactics, such as offering coupon vouchers and free software applications like WhatsApp and Avast antivirus, to lure the end user into downloading and installing the malicious payload.


Floki Bot is a new malware variant that has recently been offered for sale on various darknet markets.


A backdoor also known as: W32.WinfarotLTSAAAM.Adware Trojan.SalityStub.F Heur.Trojan.Win32.Small.1!O Trojan.Peels.A Trojan/Small.aljd Trojan.SalityStub.F Win32.Trojan.Small.a W32.Sality!dam TROJ_SALSTUB.SMA Win.Trojan.Small-13502 Trojan.Win32.Small.cpd Trojan.SalityStub.F Trojan.Win32.SalityNHost.99328 Trojan.SalityStub.F TrojWare.Win32.Salrenmetie.A Trojan.SalityStub.F Win32.Sector TROJ_SALSTUB.SMA BehavesLike.Win32.PWSZbot.nm Trojan/Win32.Small.cpd Trojan:Win32/Salrenmetie.A Troj.W32.Small.mzKi Trojan.Win32.Small.cpd Trojan.SalityStub.F Trojan/Win32.Small.R10023 Trojan.SalityStub.F TrojanSpy.Zbot!8p0pyjPs4nM Trojan.Win32.Salrenmetie Trj/CI.A


A backdoor also known as: Trojan.Logger WS.Reputation.1 Trojan-Spy.MSIL.KeyLogger.qle TrojanSpy.KeyLogger!Do8qrKyq4l4 TrojanSpy.MSIL.gka TrojanSpy:MSIL/Keylogger.O Trojan.Spy.Keylogger!4B6E MSIL/Keylogger.BBA!tr Trj/CI.A


Usually, Android banking malware is spread with the goal to convince users to install it based on the top rated app name and icon such as Super Mario Run Flash Player or WhatsApp


A backdoor also known as: Worm.Win32.Davobevix!O Worm.Wahrecks.A8 Trojan/AutoRun.Delf.et Win32.Worm.Autorun.i Win32/Tnega.BQFWNFC Worm.Win32.AutoRun.gzzs Trojan.Win32.Davobevix.crigwr Worm.Win32.Delf.fc Worm:W32/Autorun.OI Win32.HLLW.Autoruner.26228 Worm/Win32.Davobevix Worm:Win32/Wahrecks.A Worm.Win32.AutoRun.gzzs Worm.Win32.Autorun.aee


Poseidon, also known as FindPOS, is a malware family designed for Windows point-of-sale systems.


Odin comes after a slight dip over the weekend in the number of samples we saw hitting our classifier so perhaps the authors took a break to pull in some changes.


[Warning] infection of new Linux / Mayhem malware via Wordpress attacks


A backdoor also known as: Trojanpws.Qqpass.16554 W32/Risk.TFVJ-6880 BehavesLike.Dropper.dc W32/MalwareF.IAIQ Trojan.Win32.Orsam


A backdoor also known as: W32.W.Burn.loBw Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Backdoor2.DCBA Win32.Botgor.1 BehavesLike.Win32.Backdoor.gz BehavesLike.Win32.ProcessHijack W32/Backdoor.RIAO-7334 Backdoor:Win32/Botgor.B Win32.Virus.Botgor.Pgwk W32/Botgor.C


Also, the executable file is encoded in the Word document as an icon, and when it is executed it infects the system with a malware called ChChes.


This malicious app, a variant of Android/Twitoor.A, can't be found on any official Android app store – it probably spreads by SMS or via malicious URLs. It impersonates a porn player app or MMS application but without having their functionality.


A backdoor also known as: Win32.Trojan-GameThief.Lmir.a Heur:Trojan/PSW.WOW TrojanDownloader:Win32/Catinea.B Trojan.Graftor.D45818 Win32.Trojan.Graftor.Fig Trojan.Graftor!27RnMnK6sVU Trojan-GameThief.Win32.WOW


As of October 29, their technical team identified the problem and addressed the issue.


A backdoor also known as: Trojan/W32.Llac.302593 TrojanPWS.Bropaler Trojan/Delf.opy Win32.Trojan.WisdomEyes.16070401.9500.9990 Trojan.Win32.Llac.kruq Trojan.Win32.Dwn.dzxxnb Troj.W32.Llac!c Trojan.DownLoader14.35508 Trojan.Llac.Win32.55406 BehavesLike.Win32.Worm.dc Trojan.Win32.PSW W32/Trojan.DQFT-9080 Trojan.Llac.bxm Trojan/Win32.Llac Trojan.Inject.2 Trojan.Win32.Llac.kruq PWS:Win32/Bropaler.A!bit Trojan.Llac Trj/GdSda.A Win32.Trojan.Llac.Sudw Trojan.Llac!VJVBvKAFEGg


Proofpoint researchers recently detected a large-scale malvertising attack by the so-called KovCoreG group, best known for distributing Kovter ad fraud malware and sitting atop the affiliate model that distributes Kovter more widely.


Cisco Talos discovered a new malicious campaign from the well known actor Group 74 aka Tsar Team, Sofacy, APT28, Fancy Bear….


It maintained a heavy offensive focus on Myanmar, Vietnam, Singapore, the Philippines, Malaysia, and Laos.


A Chinese advanced persistent threat APT compromised Forbes.com to set up a watering hole style web-based drive-by attack against US Defense and Financial Services firms in late November 2014.


A backdoor also known as: Backdoor:Win64/Warood.A BDoor.FCXN!tr.bdr


This precedent setting legal case would be followed by many Southeast Asian nations, as well as others around the globe.


A backdoor also known as: Uds.Dangerousobject.Multi!c Trojan.Graftor.D3CA6C Trojan.Meciv! Win32/Meciv.G W32/Trojan.PSSM-5626 TR/Meciv.15872 Trojan.Win32.Z.Meciv.15872[h] Win32.Trojan.Strat.Ebgt Trojan.Win32.Meciv W32/Meciv.G!tr Trojan.Win32.Meciv.G


A backdoor also known as: Other.Virus.[Trj]!c Trojan.O97M.Phish


A backdoor also known as: W32.HfsAutoB.F820 Trojan.AVKiller.AW Trojan/W32.Packer.24576.CE Trojan.Pakes Trojan.AVKiller.AW Trojan.AVKiller.AW Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.AVKiller.AW Trojan.Win32.Pakes.blv Trojan.AVKiller.AW Trojan.AVKiller.AW TrojWare.Win32.TrojanSpy.SpyEyes.B Trojan.MulDrop.8347 BehavesLike.Win32.RAHack.mc Backdoor.Win32.Kbot.aq Trojan.Pakes.bgg Trojan/Win32.Pakes Win32.Hack.RCryptor.a.10301 Trojan.Win32.Pakes.blv SScope.Malware-Cryptor.Hlux Trj/CI.A


Cyber criminals continue to use exploit kits to infect victims with ransomware but they also use MALSPAM emails to lure possible victims – a key vector into an enterprise environment that lacks the proper security controls, and one with insufficient information security training for end users.


A backdoor also known as: Trojan-Downloader.Win32.Axload!O TrojanDownloader.Axload Trojan/Downloader.Axload.o TROJ_FRAUDLOA.TT Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Downldr2.DOEJ TROJ_FRAUDLOA.TT Win.Downloader.66976-1 Trojan-Downloader.Win32.Axload.az Trojan.Win32.Axload.vqczl Trojan.Win32.Downloader.134456 TrojWare.Win32.Trojan.DNSChanger.~CRSE Trojan.DownLoader.59074 BehavesLike.Win32.Injector.ch W32/Downloader.HFNI-1674 TrojanDownloader.AxLoad.r SPR/Fake.C Trojan[Downloader]/Win32.Axload Troj.Downloader.W32.Axload.o!c Trojan-Downloader.Win32.Axload.az TrojanDownloader:Win32/Axload.A Trojan.BHORA.012841 Win32.Trojan-downloader.Axload.Dun Trojan.DL.Renos!Exa/gyOk4i0 Trojan-Downloader.Win32.Renos.AQ Win32/Trojan.Downloader.9f3


A backdoor also known as: Application.CoinMiner.S Trojan-Downloader.Win32.SetupFactory!O Trojan.Miner Application.CoinMiner.S Trojan.Win32.Z.Coinminer.938434 Troj.W32.Miner!c Application.CoinMiner.S Application.CoinMiner.S Tool.BtcMine.1149 W32/Trojan.FXQE-8469 Trojan/Win32.Vehidis Trojan:Win64/Stratumine.B Trojan.Vehidis Trj/CI.A Win32.Trojan.Miner.Alsn Win32/Trojan.Ransom.7fc


A backdoor also known as: Trojan.Ransom.Cerber.FA Ransom/W32.Cerber.561843.B Ransom.Cerber.S363870 Trojan.Ransom.Cerber.FA Trojan.Ransom.Cerber.FA Win32.Trojan.Kryptik.bin Ransom_HPCERBER.SMALY5A Win.Ransomware.Cerber-5970079-0 Trojan.Ransom.Cerber.FA Trojan.Ransom.Cerber.FA Trojan.Win32.Kryptik.eljryo Trojan.Ransom.Cerber.FA Trojan.Encoder.7453 Trojan.Kryptik.Win32.998775 Ransom_HPCERBER.SMALY5A BehavesLike.Win32.Ransomware.hh Trojan-Ransom.Cerber Trojan.Zerber.amh TR/Crypt.ZPACK.mblws Trojan[Ransom]/Win32.Zerber Trojan.Menti Ransom.Cerber Trojan.Zerber! Win32/Trojan.e14


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9771 Win.Worm.VBMania-1 Win32.Trojan.Visal.A Trojan.Win32.Swisyn.ajwe TrojWare.Win32.VB.YNB Trojan.MulDrop6.48042 Trojan/Swisyn.kkp Worm:Win32/Visal.A Trojan.Win32.Swisyn.ajwe Virus.Win32.Vbinder


A backdoor also known as: Downloader.VB.Win32.85130 TrojanDownloader.VB Trojan-Downloader.Win32.VB.bkxc Trojan.DownLoader9.27791 TrojanDownloader.VB.dikm TrojanDownloader:Win32/Gurip.A Trojan.Heur.EE8DE0 Trojan-Downloader.Win32.VB.bkxc Trojan.Downloader.VB Trojan.DL.VB!q71Z8AF5llY


The message was sent from an account created under her name on lesser known email provider 1 1's Mail.com, a common tactic in recent months, with a link to a file hosted on Dropbox and an additional credential phishing attempt.


A backdoor also known as: W32.TaskmanMispD.Trojan Worm/W32.Vobfus.217088 Worm.Win32.Vobfus!O Worm.Raideloz.A3 W32/Autorun.worm.aaeh W32/Vobfus.ahox WORM_VOBFUS.SMJA Win32.Worm.Pronny.dn WORM_VOBFUS.SMJA Win.Worm.Vobfus-12049 Worm.Win32.WBNA.ipa Trojan.Win32.Vobfus.cinarv Worm.Win32.A.Vobfus.155648.F WIN.Troj.Vobfus.lEaX Worm.Win32.Vobfus.AJR Win32.HLLW.Autoruner1.29632 BehavesLike.Win32.VBObfus.dm Worm/Vobfus.mos Worm:Win32/Raideloz.A Trojan.Barys.DA54 Worm.Win32.WBNA.ipa Worm/Win32.Vobfus.R43029 Worm.Vobfus Worm.Win32.Raideloz W32/VBObfus.C!tr


This report expands the Mexican investigation and shows how 10 Mexican journalists and human rights defenders, one minor child, and one United States citizen, were targeted with NSO's Exploit Framework.


A backdoor also known as: Trojan.KillAV Worm.Win32.Delf.ag Packed.Win32.Klone.~KE Trojan.DownLoader.origin Trojan-Downloader.Win32.Delf!IK Trojan-Downloader.Win32.Delf W32/PEMask.B!tr


A backdoor also known as: Joke/W32.BadJoke.20500 Hoax.Vb Hoax.Win32.BadJoke.VB.d Riskware.Win32.Anywork.hrys Joke.Miracle Tool.BadJoke.Win32.176 BehavesLike.Win32.PUP.mz Hoax.Win32.BadJoke.VB Hoax.BadJoke.djv HackTool[Hoax]/Win32.VB Win32.Joke.WorkJoke.a.kcloud Hoax.Win32.BadJoke.VB.d Joke:Win32/Small.NAO Unwanted/Win32.Badjoke.R100207 BadJoke.Win32.VB.d Trojan.VBRA.02296 Win32.Trojan-psw.Badjoke.Plui


Fake tax spam leads to malware:


On April 7th 2017 Haifei Li published on the McAfee blog1 about a Critical Office Zero-Day in the wild.


Notice notice the use of the mistaken “ Word ” instead of “ World ” : “ On behalf of all at the Word Uyghur Congress ( WUC ) , the Unrepresented Nations and Peoples Organization ( UNPO ) and the Society for Threatened Peoples ( STP ) , Human Rights in China : Implications for East Turkestan , Tibet and Southern Mongolia In what was an unprecedented coming-together of leading Uyghur , Mongolian , Tibetan and Chinese activists , as well as other leading international experts , we were greatly humbled by the great enthusiasm , contribution and desire from all in attendance to make this occasion something meaningful , the outcome of which produced some concrete , action-orientated solutions to our shared grievances .


In February 2017, we found a new Ebury sample, that introduces a significant number of new features.


We first discussed them in April 2015 when we witnessed them targeting a number of organizations in Japan.


It is important to note that Adobe has released the bulletin APSB15-27 to address this vulnerability; the latest version of Flash 19.0.0.226 is no longer vulnerable.


A backdoor also known as: Trojan/Turla.aj BKDR_TAVDIG.ZGEJ-A Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Wipbot BKDR_TAVDIG.ZGEJ-A Troj.W32.Epiccosplay!c Win32.Backdoor.Wipbot.Ehhy BackDoor.Turla.52 Trojan.Turla.Win32.35 BehavesLike.Win32.Ramnit.cc Trojan.Win32.Turla BDS/WipBot.B.1 Trojan.Kazy.D6CC04 Backdoor:Win32/WipBot.B Trojan/Win32.Tavdig.C561133 Trojan.Turla!36kTMhU81bU


This variation of the Trojan was also mentioned in the 2013 FireEye blogs about the Sunshop campaign 3 and operation ephemeral hydra 4.


A backdoor also known as: Trojan.Downloader.JSLP Trojan.Downloader.JSLP Adware.AdPeak Trojan/Downloader.Rottentu.a Trojan.Downloader.JSLP Win32.Trojan.WisdomEyes.151026.9950.9980 Adware.Crossid Win32/Tnega.LUdScAC not-a-virus:AdWare.Win32.AdPeak.dn Adware.W32.Adpeak!c Trojan.Downloader.JSLP Trojan.Downloader.JSLP Trojan.DownLoader16.16196 backdoor.win32.prorat.ah BehavesLike.Win32.Downloader.tc AdWare/AdPeak.ab GrayWare[AdWare:not-a-virus]/Win32.AdPeak Trojan.Downloader.JSLP TrojanDownloader:Win32/Tordow.A Adware/Win32.AdPeak.N1435735988 AdWare.AdPeak Trojan.Downloader.JSLP


There are several different Locky campaigns going on at the same time, the largest being the one from affiliate ID 3 which comes with malicious ZIP containing .VBS or .JS attachments.


A backdoor also known as: Packed.Win32.TDSS!O RiskWare.Tool.CK Win32.Trojan.WisdomEyes.16070401.9500.9900 W32/PWStealerX.EGK TSPY_RAVEN.A Trojan-PSW.Win32.Raven.b Trojan.Win32.Raven.ewlguc TrojWare.Win32.Patched.KSU BackDoor.Uragan TSPY_RAVEN.A BehavesLike.Win32.Ransomware.nc W32/PWS.PQHC-6858 Trojan/PSW.Ravenpass.a PWS:Win32/Raven.C Trojan-PSW.Win32.Raven.b TrojanPSW.Raven Trojan.PWS.Raven!jl2h2OWvUG8 Trojan-Spy.Win32.Hsow


A backdoor also known as: Trojan.Cendelf.A8 WS.Reputation.1 Delf.PVUB Win32/Tnega.CTAcCXD PE:Malware.Delf!6.F BackDoor.Bulknet.1078 TR/Spy.Browse.14364 Trojan/Win32.Cendelf Trojan-Dropper.Delf W32/Delff.RJH!tr Delf.ALTK


Streamlining development makes financial sense for attackers, so the findings may imply a bigger trend towards industrialization that achieves an economy of scale.


It turned out that they are also atypical by many means.


We've identified 9,215 samples tagged Banload in AutoFocus since December 2013.


Talos has observed a small email campaign leveraging the use of Microsoft Publisher files.


This IOC contains indicators detailed in the whitepaper Hiding in Plain Sight: FireEye and Microsoft Expose Chinese APT Group's Obfuscation Tactic


Stumbled upon another one of the FakeAV's, its called Internet Security


A backdoor also known as: TrojanPWS.Mauthy.g3 Win32.Trojan.WisdomEyes.151026.9950.9998 Heur.AdvML.C Trojan.Win32.DownLoader1.dklsld Trojan.Win32.Z.Kazy.1108582[h] Trojan.DownLoader4.60407 BehavesLike.Win32.SoftPulse.tc Trojan.Kazy.D103DE PWS:MSIL/Mauthy.A Trojan-PWS.MSIL PSW.ILUSpy Trj/CI.A Win32/Trojan.7d3


These .pub files are normally used for the publishing of documents such as newsletters, allowing users to create such documents using familiar office functions such as mail merging.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9869 BackDoor.BlackEnergy.80 Worm:Win32/Phdet.B


By utilizing a completely fileless infection chain, the malware will be more difficult to analyze using a sandbox, making it more difficult for anti-malware engineers to examine.


In cooperation with WeipTech, we have identified 92 samples of a new iOS malware family in the wild.


RetroTetris can be installed in Android versions starting from 2.3 Gingrebread while Brain Test can be installed in versions starting from 2.2 Froyo.


] net/mms.apk to view the message ” Once the APK package is downloaded , potential victims are urged to grant the malicious app a wide range of permissions on their Android device : App permissions SEND_SMS RECEIVE_BOOT_COMPLETED INTERNET SYSTEM_ALERT_WINDOW WRITE_SMS ACCESS_NETWORK_STATE WAKE_LOCK GET_TASKS CALL_PHONE RECEIVE_SMS READ_PHONE_STATE READ_SMS ERASE_PHONE Once installed , MazarBOT downloads a copy of Tor onto users ’ Android smartphones and uses it to connect anonymously to the net before sending a text message containing the victim ’ s location to an Iranian mobile phone number .


The malware mostly targets European users.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9988 Trojan.Win32.Geratid.dklqgw Trojan.Msil Backdoor:MSIL/Geratid.A!dll


It was discovered in early 2014 and was named after a debug string, BlackMoon that was present in its code.


Volexity recently identified a breach to the website of a well regarded media outlet in the country of Georgia.


From the latter half of May until June 10, there was a relative lull in TorrentLocker-related emails.


This technique is being used to allow the attackers to conceal their secondary payloads, bypassing different AV products.


A backdoor also known as: Backdoor.Nuclear Win32.Trojan.WisdomEyes.16070401.9500.9871 Trojan.Win32.Nuclear.baxsh Backdoor.Win32.Nuclear.182272 Backdoor.Win32.Nuclear.CU BackDoor.Nuclearat.452 Backdoor.Nuclear.Win32.1045 Backdoor.Win32.Nuclear Backdoor/Nuclear.yt Trojan[Backdoor]/Win32.Nuclear Backdoor.Nuclear Trojan.Zusy.Elzob.493 Win32/Nuclear.CU Backdoor.Nuclear!tPH0Q8Q37CQ


A backdoor also known as: Viking.GY TrojWare.Win32.Magania.~AD Trojan/Win32.Hupigon Trojan-PWS.Win32.Hangame.cl


Most recently, we observed several relatively large email campaigns distributing the Kronos banking Trojan.


This domain has been previously reported as an lSMAgent C2.


A backdoor also known as: Backdoor/W32.CommInet.70741 Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Exdis Trojan.Win32.Small.dqjffo MalCrypt.Indus! BackDoor.HangUp.44052 BehavesLike.Win32.Backdoor.kh Trojan[Backdoor]/Win32.CommInet Win32.Hack.Small.ak.kcloud Backdoor:Win32/Easydor.D Bck/CommInet.V Win32.Backdoor.Comminet.dbwh Backdoor.Win32.CommInet Exdis.A!tr.bdr


A backdoor also known as: Trojan.RevengeRat.2 TROJ_REVETRAT.SM Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Revetrat TROJ_REVETRAT.SM Win.Trojan.RevengeRat-6344273-0 BackDoor.RevetRat.2 BehavesLike.Win32.Trojan.lm W32/Trojan.VQKC-8396 Backdoor:MSIL/Revetrat.A!bit Backdoor.RevetRat Trj/GdSda.A Win32/Trojan.961


A backdoor also known as: Trojan/W32.StartPage.87040.B Trojan.Searmapxp.FC.384 Trojan.StartPage.MSIL Win32.Trojan.StartPage.ck Win.Trojan.Startpage-6834 Trojan.Win32.Startpage.fsfn Trojan.Win32.StartPage.dztahb Trojan.Win32.Z.Startpage.87040.FS Troj.W32.Startpage!c Win32.Trojan.Startpage.Szvb TrojWare.Win32.Startpage.KAX Trojan.Click3.12428 Trojan/StartPage.qbi Pua.Secure.Installer ADWARE/IERedirector.87040 Trojan/Win32.Startpage Trojan:Win32/Searmapxp.A!bit Trojan.Win32.Startpage.fsfn Adware/Win32.StartPage.R160955 Trojan.StartPage Trj/CI.A Trojan.Click!GCNxubkcTZg AdWare.IERedirector MSIL/StartPage.MI!tr Win32/Virus.Adware.007


A backdoor also known as: W32.VBOverlayD.PE Trojan.Win32.Swisyn!O Trojan.Mofksys.A W32/Swisyn.ag Trojan/Swisyn.bner PE_MOFKSYS.A W32.Gosys Win32/VB.BOP PE_MOFKSYS.A Win.Virus.Sality:1-6335700-1 Troj.W32.Swisyn.tnEM Trojan/Swisyn.rmj Trojan/Win32.Swisyn.bner Trojan.Win32.Swisyn.bner Trojan/Win32.Swisyn.R1452 Trojan.Swisyn Trojan.Win32.VB


The targets of these attacks appear to primarily be companies in the video games industry, although other targets may exist outside of our telemetry.


Unit 42 has observed a new version of Hworm or Houdini being used within multiple attacks.


A backdoor also known as: HEUR:Trojan.AndroidOS.Piom.dzu Trojan.Android.Piom.expmgs a.privacy.dingwe Android.Spy.422.origin ANDROID/Piom.otvgv Trojan/Android.Piom HEUR:Trojan.AndroidOS.Piom.dzu Trojan.AndroidOS.Spy.D Trojan.AndroidOS.Dingwe Android/Fyec.DZS!tr


Samples and command and control hosts associated with the Imminent Monitor RAT


This strange behavior consisted of a large amount of peculiar files being written into sensitive system directories.


A backdoor also known as: W32.CoinMinerSimY.Worm Trojan.Multi Backdoor.Graybird TROJ_COINMINE.THAOIO Trojan.Win32.Miner.tidx Trojan.Win32.Miner.exakqc Trojan.Win32.S.CoinMiner.1312256 Uds.Dangerousobject.Multi!c Trojan.BtcMine.2100 TROJ_COINMINE.THAOIO BehavesLike.Win32.MultiPlug.tc PUA.EnigmaProtector Trojan.Miner.axs W32.Miner.Smominru TR/Crypt.Xpack.vknzu Trojan.Win32.Miner.tidx Trojan:Win32/Smominru.A Unwanted/Win32.BitCoinMiner.C2352839 Misc.Riskware.MoneroMiner Trojan.Miner RiskWare.BitCoinMiner Trj/CI.A Win32/CoinMiner.ALB Win32.Trojan.Miner.Dxct W32/CoinMiner.ALB!tr


A backdoor also known as: TrojanClicker.MSIL Trojan.Win32.Clicker!BT TrojWare.MSIL.TrojanClicker.Lasdoma.NRJ Trojan.Click3.24925 Trojan.MSIL.TrojanClicker TrojanClicker.MSIL.mr TR/ATRAPS.hsvhb Trojan.Johnnie.DE2DE TrojanClicker:MSIL/Lasdoma.A!bit Win-Trojan/ADM01.Exp Trojan.Win32.Clicker!BT


A backdoor also known as: Trojan.Pakes Trojan/Pakes.cxg Trojan.Heur.EAB04F Win32.Trojan.WisdomEyes.16070401.9500.9965 W32/Trojan2.BBCZ Win.Trojan.Pakes-1891 Trojan.Win32.Pakes.cxg Trojan.Win32.Pakes.buyldp Troj.W32.Pakes.cxg!c Trojan.DownLoader.61691 Trojan.Pakes.Win32.5440 BehavesLike.Win32.Dropper.lc Trojan.Win32.Crypt W32/Trojan.VJUA-2101 Trojan/Pakes.bvs Trojan/Win32.Pakes Win32.Troj.Unknown.kcloud Trojan.Win32.Pakes.cxg BScope.Trojan.MTA.01233 Trj/Pakes.EB Win32.Trojan.Pakes.Dygy Trojan.Pakes!elDwpuVaGqk


W32.Futurax is a worm that spreads via removable drives and network shares.


A backdoor also known as: Win.Trojan.Dapato-413 Trojan.Win32.Dapato.bewyzt BackDoor.Cool.362 TR/Spy.289792.56 Win32.Troj.Undef.kcloud Dropper/Win32.Dapato Trojan-Downloader.win32.Delf.xoq Trojan-Dropper.Dapato.bauk Win32/Delf.OJW Trojan-Dropper.Win32.Dapato Delf.AJUR


A backdoor also known as: W32.eHeur.Virus02 Virus.Win32.Sality!O BehavesLike.Win32.BadFile.fc Trojan-Spy.Win32.AutoHK TR/Dldr.AutoHK.rguvg TrojanDownloader:MSIL/AutoHK.B!bit TrojanSpy.AutoHK Win32/TrojanDownloader.AutoHK.BC


Pony will infect the victim computer and download an additional malware.


A backdoor also known as: Trojan.Chekafe.A TROJ_DLOADR.SMOK Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Donloz.AQU TROJ_DLOADR.SMOK Trojan.Win32.Downloader.14836 Trojan.DownLoad2.12418 BehavesLike.Win32.Backdoor.lm Trojan-Downloader.Win32.Chekafe Win32.TrojDownloader.tb.kcloud TrojanDownloader:Win32/Chekafe.C BScope.Trojan.SvcHorse.01643


A backdoor also known as: HW32.Packed.4102 TrojWare.Win32.CoinMiner.IEGT W32/Trojan.QGMZ-7351 Trojan.Heur.FU.EE0BC8


A backdoor also known as: Virus.Win32.Sality!O W32/Trojan.HAUX-5531 Trojan.Win32.Fsysna.erxi Variant.Symmi.mCm9 BehavesLike.Win32.Downloader.tc Trojan/Blocker.idi TR/IRCBot.hjsna Trojan.Barys.DE0A3 Trojan.Win32.Z.Ircbot.1304576 Trojan.Win32.Fsysna.erxi Trojan:Win32/Fenibot.A Trojan/Win32.Inject.C860331 Win32/IRCBot.NIM Trojan.Kazy W32/IRCBot.NIM!tr Trj/CI.A Win32/Trojan.2d1


A backdoor also known as: TrojanPWS.Fareit.FC.2719 Trojan.Zusy.D33BC8 Win32.Trojan.WisdomEyes.16070401.9500.9992 BehavesLike.Win32.Trojan.vc Trojan/Win32.Inject.C1663733 Trj/GdSda.A


By pivoting off of the infrastructure we learned that it is related to Winnti, a Chinese threat actor that is mostly targeting the gaming industry.


A backdoor also known as: W32.MyDoomI.Kr Win32/Mydoom.BT W32.Dozer Win32/Lyzapo.A WORM_MYDOOM.EA Win.Trojan.Dozer-1 Trojan.Dozer.1 WORM_MYDOOM.EA BehavesLike.Win32.Mydoom.fc W32/Backdoor.VQLJ-7986 Win32.Troj.Undef.kcloud TrojanDropper:Win32/Lyzapo.A Dropper/Win32.DDoS.N19798743 W32/Mydoom.cf Trojan.DR.Lyzapo!rpJ9Iphh7tw W32/Dozzer.A!tr W32/MyDoom.HN.worm


A backdoor also known as: Trojan.Downloader Trojan.DownLoader6.50414 BehavesLike.Win32.Trojan.tm TR/Dldr.Megone.cwqt Trj/CI.A Win32/Trojan.9b4


A backdoor also known as: Trojan-PWS/W32.WebGame.123904.BJ Trojan-GameThief.Win32.Magania!O Backdoor.Zegost.29476 Trojan/Magania.gxtv Trojan.Zusy.Elzob.DD23 Win32.Trojan.Farfli.ai HV_MAGANIA_CA22396F.TOMC Win.Trojan.Magania-15913 Trojan.Win32.Magania.thvzy Troj.GameThief.W32.Magania.l8gE Trojan.KeyLogger.13111 Trojan.Magania.Win32.50884 BehavesLike.Win32.Dropper.ch P2P-Worm.Win32.Palevo Trojan[GameThief]/Win32.Magania Win32.Troj.Transport.b.kcloud Trojan:DOS/Killmbr.dr Trojan.Win32.A.PSW-Magania.285696.A Trojan/Win32.Magania.R41109 BScope.P2P-Worm.Palevo Trojan.Farfli!+e4pBtKCbqs


Their targets have spanned all across the world, with a focus on government, defense organizations and various Eastern European governments.


JS/Nemucod is a JavaScript downloader trojan that targets users through malware spam campaigns.


This same attacker is also reported to have targeted various military installations in Central Asia in the past


A backdoor also known as: HW32.Packed.F222 Backdoor.Bedep.10384 BKDR_BEDEP.SMX Win32.Trojan.WisdomEyes.16070401.9500.9999 BKDR_BEDEP.SMX Trojan.Win32.Yakes.dsmtzi Trojan.Bedep.62 BehavesLike.Win32.Spyware.cc Trojan.Win32.Crypt Backdoor/Bedep.v TR/Crypt.ZPACK.147808 Trojan[Backdoor]/Win32.Bedep Trojan.Kazy.D9859B Backdoor/Win32.Bedep.R154894 Backdoor.Bedep! W32/Bedep.D!tr Win32/Trojan.a60


The Lazarus group is tied to the 2014 attack on Sony Pictures Entertainment and the 2013 DarkSeoul attacks.


The Callisto Group is an advanced threat actor whose known targets include military personnel, government officials, think tanks, and journalists in Europe and the South Caucasus.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9901 TROJ_GRAFTOR_GG3102DA.UVPM TrojWare.Win32.TrojanDownloader.Stantinko.CB Trojan.Kbdmai.83 TROJ_GRAFTOR_GG3102DA.UVPM TR/Downloader.amdkv TrojanDownloader:Win32/Stantinko.A!bit Trj/GdSda.A


A backdoor also known as: W32.Virut.low6 Trojan.Graftor.D295ED Win32.Trojan.WisdomEyes.16070401.9500.9753 Win.Adware.Downware-564 Trojan/Win32.Unknown Trojan:Win32/Vercuser.A Worm/Win32.VB.R47661 Backdoor.Bot Trj/CI.A I-Worm.Vercuser.A


Over the course of 2016 — and particularly intensifying towards the end of the year — several individuals known to Amnesty International were approached via email and through social media by Safeena Malik seemingly an enthusiastic activist with a strong interest in human rights.


As Talos is constantly monitoring changes across the threat landscape to ensure that our customers remain protected as threats continue to evolve, we took a deep dive into this malware variant to determine the technical capabilities and characteristics of Floki Bot.


A backdoor also known as: Trojan.Win32.Malware.1 Win32.HEURCrypted Trojan.DownLoad.31887 TR/Spy.197632.C Heuristic.BehavesLike.Win32.Packed.C W32/Tibs.WA!tr


According to the public information, cfm.com.ua domain belongs to the «Crystal Finance Millennium» software developer.


Quick Sunday morning blog post, analysis of an unknown rtf file.


A backdoor also known as: Trojan.Heur.JP.E5BA68 Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan Trojan.Win32.9728.ikjtj Trojan.DownLoader3.22821 Trojan.Win32.Swisyn TR/Dldr.Quillo.A Trojan/Win32.Unknown TrojanDownloader:Win32/Quillo.A Trojan/Win32.HDC.C3028 Trojan.DL.Quillo!tw5+WNEhU5A W32/Downloader_x.FYF!tr


A backdoor also known as: Trojan.Blouiroet Trojan.Win32.Blouiroet.dx Trojan.Win32.Strictor.ewsjhc Troj.W32.Blouiroet!c Trojan.Blouiroet.Win32.43 BehavesLike.Win32.DlHelper.tc Trojan.Blouiroet.an TR/Blouiroet.shppj Trojan/Win32.Blouiroet Trojan.Zusy.D3860E Trojan.Win32.Z.Zusy.1282560 Trojan.Win32.Blouiroet.dx Trojan.Win32.Delf Trj/CI.A Win32/Trojan.c62


A backdoor also known as: Worm/W32.Lebreat.18944 Worm.Lebreat.Win32.18 W32/Lebreat.l Trojan.Win32.Lebreat.emyp W32/Breatle.L@mm W32.Spybot.Worm Win32/Lebreat.R Worm.Lebreat.D Net-Worm.Win32.Lebreat.l W32.W.Lebreat.l!c Worm.Win32.Lebreat.R Win32.HLLW.Breat BehavesLike.Win32.Backdoor.lc W32/Breatle.VJCM-5821 I-Worm/Lebreat.a DcomRpc.G!exploit Worm[Net]/Win32.Lebreat Win32/Lebreat.worm.18944.B Worm:Win32/Reatle.L@mm Worm.Lebreat Win32.Worm-net.Lebreat.Hugg Worm.Win32.Lebreat.l


They range from the recreational apps like games, skins, and themes to phone optimization boosters.


The AlienVault team has researched and added more IOC s found in the OTX portal.


A backdoor also known as: Trojan-Spy/W32.Teamspy.34816.C TrojanSpy.Skeeyah Win32.Trojan.WisdomEyes.16070401.9500.9565 Backdoor.Noknef TSPY_KONNI.A Trojan-Spy.Win32.Teamspy.jb Trojan.Win32.Teamspy.eojkym Troj.Spy.W32!c Trojan.DownLoader25.6499 TSPY_KONNI.A W32/Trojan.TMQM-1890 TrojanSpy.Teamspy.al TR/Taranis.4651 Trojan[Spy]/Win32.TeamSpy Trojan-Spy.Win32.Teamspy.jb Backdoor:Win32/Konny.A Spyware.Infostealer.86016 TrojanSpy.Teamspy Trojan.PasswordStealer Win32.Trojan-spy.Teamspy.Phgj TrojanSpy.Teamspy!7hsJ3qOc7gU Trojan.Taranis Trj/GdSda.A Win32/Trojan.6af


In mid-2022, Mandiant, in collaboration with Fortinet, investigated the exploitation and deployment of malware across multiple Fortinet solutions including FortiGate firewall, FortiManager centralized management solution, and FortiAnalyzer log management, analytics, and reporting platform.


This malware can intercept the user's personal data, such as SMS messages, MMS messages, and USSD requests.


A backdoor also known as: Backdoor.Supermm.1.0.B Backdoor/W32.SuperMM.251764 Backdoor.Win32.SuperMM.10!O BackDoor-ACL.dll Backdoor/SuperMM.10.b W32/Backdoor.MRCA-2263 Backdoor.Trojan Backdoor.Supermm.1.0.B Backdoor.Win32.SuperMM.10.b Backdoor.Supermm.1.0.B Trojan.Win32.SuperMM-10.gtre Backdoor.Win32.Z.Supermm.251764 Backdoor.W32.Supermm!c Backdoor.Supermm.1.0.B Backdoor.Win32.SuperMM.10.B Backdoor.Supermm.1.0.B BackDoor.SuperMM.10 Backdoor.SuperMM.Win32.7 BackDoor-ACL.dll Trojan/PSW.Oicqmm98.Dll Trojan[Backdoor]/Win32.SuperMM Backdoor.Supermm.1.0.B Backdoor.Win32.SuperMM.10.b Backdoor:Win32/SuperMM.B Backdoor.Supermm.1.0.B Backdoor.SuperMM Win32/SuperMM.10.B Win32.Backdoor.Supermm.Tayo Trojan.Win32.Supermm BDoor.ACL!tr.bdr Win32/Backdoor.831


A backdoor also known as: Backdoor.Truvasys TSPY_LIMITAIL.XXUDN Trojan.Win32.StrongPity.ekmtaw Troj.W32.Strongpity!c TSPY_LIMITAIL.XXUDN Trojan.StrongPity.j TR/StrongPity.vtcv Trojan/Win32.StrongPity Backdoor:Win32/Truvasys.A!dha PUP/Win32.DealPly.C2030575 Trojan.StrongPity! Trojan.StrongPity Trj/GdSda.A


The adware Trojan in fact potentially allows full remote access to the infected device.


A backdoor also known as: Trojan.Win32.Bublik!O Trojan.Bublik.Win32.6109 W32.W.AutoRun.l0qv Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.VB.xswue BehavesLike.Win32.Emotet.dh Trojan/Bublik.ccj Trojan/Win32.Bublik Trojan.Barys.D7D1 Trojan:Win32/Klovbot.B Trojan/Win32.VBNA.R146461 Trj/CI.A Trojan.Bublik!ZPZ98Vxhajk W32/VBKrypt.CFFF!tr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9995 Backdoor.Win32.Androm.oyzg Trojan.Win32.Androm.exrcqp Trojan.DownLoader26.14208 BehavesLike.Win32.Trojan.cc Trojan.MSIL.Crypt TR/Dropper.MSIL.ruzhp Backdoor.Win32.Androm.oyzg Trj/GdSda.A Win32.Backdoor.Androm.Ajls MSIL/Kryptik.BLU!tr


A backdoor also known as: Trojanspy.Enkalogs TSPY_KEYLOG.AUSJOZ Win32.Trojan.WisdomEyes.16070401.9500.9994 TSPY_KEYLOG.AUSJOZ Trojan.Win32.Keylogger.evqveo Trojan.Win32.Z.Kazy.30722 W32/Application.BPVK-3177 Trojan.Kazy.D8E58F TrojanSpy:MSIL/Enkalogs.A Trj/GdSda.A MSIL/Keylogger.II!tr.spy Win32/Trojan.40d


CyberX has discovered a new, large-scale cyber-reconnaissance operation targeting a broad range of targets in the Ukraine.


Since the plugin development pattern is generic and the plugin SDK can be easily embedded, the plugin architecture could be a trend among Android malware in the future.


A commercially available RAT.


A backdoor also known as: Trojan.Downloader.JPIS Trojan.Downloader.JPIS Trojan.Downloader.JPIS TROJ_DALBOT.SMRR Win32.Trojan.WisdomEyes.16070401.9500.9750 TROJ_DALBOT.SMRR Win.Trojan.Leepload-1 Trojan.Downloader.JPIS Trojan.Downloader.JPIS Trojan.Win32.DloadrDOI.sxvve Trojan.Win32.A.Downloader.73728.ABY Trojan.Downloader.JPIS Trojan.DownLoader6.34186 W32/Trojan.USUV-7153 Trojan/Win32.Unknown TrojanDownloader:Win32/Dalbot.A Win-Trojan/Dalbot.73728 Win32/Trojan.b77


We have reported the bug to Adobe who assigned it CVE-2017-11292 and released a patch earlier today


This particular application is signed with a fake certificate : Owner : CN=Unknown , OU=Unknown , O=Unknown , L=Unknown , ST=Unknown , C=Unknown Issuer CN=Unknown , OU=Unknown , O=Unknown , L=Unknown , ST=Unknown , C=Unknown Serial : 1c9157d7 Validity : 11/02/2017 00:16:46 03/20/2045 00:16:46 MD5 Hash : A8:55:46:32:15 : A9 : D5:95 : A9:91 : C2:91:77:5D:30 : F6 SHA1 Hash : 32:17 : E9:7E:06 : FE:5D:84 : BE:7C:14:0C : C6:2B:12:85 : E7:03:9A:5F The app requests extensive permissions during installation that enable a range of activities supported by the malware .


A backdoor also known as: Win32.Worm.Autorun.VX Trojan/W32.Cosmu.214528.B Trojan.Win32.Cosmu!O Worm.Nenebra.AP8 Win32.Worm.Delf.ca W32/Cosmu.C W32.SillyFDC Win32/Cosmu.AO Win.Trojan.Cosmu-268 Win32.Worm.Autorun.VX Trojan-Ransom.Win32.Blocker.iwkz Win32.Worm.Autorun.VX Trojan.Win32.Cosmu.vifkp Trojan.Win32.A.Cosmu.212480[UPX] Win32.Trojan.Blocker.Wnme Win32.Worm.Autorun.VX Win32.Worm.Autorun.VX Win32.HLLW.Autoruner.57682 Trojan.Cosmu.Win32.9114 W32/Cosmu.KVSE-8775 Trojan/Cosmu.gje WORM/Nenebra.A Trojan/Win32.Cosmu Win32.Worm.Autorun.VX Troj.Ransom.W32.Blocker!c Worm:Win32/Nenebra.A Win32.Worm.Autorun.VX TScope.Trojan.Delf Worm.AutoRun Trojan.Cosmu Win32/AutoRun.Delf.HF Trojan.Cosmu!gKBhUwtv5Oc Trojan-Downloader.Win32.Banload W32/Cosmu.XXS!tr W32/Autorun.JYX Win32/Worm.00b


A backdoor also known as: Trojan.Razy.D2ECF0 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.DownLoader26.14415 BehavesLike.Win32.Trojan.cc W32/Trojan.UDBU-2080 TR/Crypt.Xpack.dmslo Backdoor/Win32.Androm.C2026756 Trj/GdSda.A Trojan.Win32.Injector Win32/Trojan.bd4


A backdoor also known as: Trojan.Runner.T Trojan/W32.Runner.2560.C Trojan.Win32.Runner!O Trojan.Runner.T W32/Runner.A Trojan.Runner.T Trojan.Win32.Runner.s Trojan.Runner.T Trojan.Runner.T Trojan.Win32.Runner W32/Runner.A Trojan/PSW.Almat.xs Trojan:Win32/Runner.D Troj.Dropper.W32.Small.kZ2V Trojan.Win32.Runner.s Trojan/Win32.Runner.C82211 Trojan.Runner.T HEUR/QVM39.1.CC7B.Trojan.Win32.Runner


A backdoor also known as: Trojan.MSIL.FC.6901 Trojan.Zusy.D1C473 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win64.Miner.re Trojan.Win32.Diztakun.dbjduc Trojan.Win32.Z.Zusy.37376.CM BehavesLike.Win32.PWSZbot.nm Trojan.Win32.Diztakun Trojan/Win64.Miner TrojanSpy:MSIL/Logstel.A Trojan.Win64.Miner.re Trj/GdSda.A Win64.Trojan.Miner.Dxwy Win32/Trojan.Spy.8ab


A backdoor also known as: Backdoor.Hamaetot.A3 Trojan.Razy.D176F BKDR_HAMAETOT.SM Win32.Trojan.WisdomEyes.16070401.9500.9999 BKDR_HAMAETOT.SM Win.Trojan.Stainz-1 Trojan.DownLoader9.62446 BehavesLike.Win32.Trojan.mm Backdoor/MSIL.vh Trojan/Win32.MSILBot Backdoor:MSIL/Hamaetot.A Win32.Outbreak


A backdoor also known as: Trojan.Win32.Small.eftzxb TrojWare.MSIL.Tiny.HA Trojan.PWS.Stealer.18264 Trojan.MSIL.Small PWS:MSIL/OnLineGames.NW!bit


A backdoor also known as: HW32.Packed.90AF Win32.Trojan.WisdomEyes.16070401.9500.9998 Packed.Win32.Katusha.o Trojan.Win32.Waledac Trojan.Heur.TDss.EF7F42 Packed.Win32.Katusha.o BScope.Trojan.MTA.0795


A backdoor also known as: Trojan.Win32.VBKrypt!O VBObfus.m Trojan/VBKrypt.cyuv Trojan.VBKrypt.55 Win32.Worm.Autorun.l W32.Changeup WORM_VOBFUS.SMHF Win.Trojan.Changeup-6169544-0 Worm.Win32.WBNA.ipa Trojan.Win32.WBNA.dxinid Troj.PSW32.W.VB.lPYN Win32.HLLW.Autoruner.49334 WORM_VOBFUS.SMHF BehavesLike.Win32.VBObfus.dm TR/VBKrypt.cyuv.30 Worm:Win32/Vbnoet.A Trojan.Win32.A.VBKrypt.258048 Worm.Win32.WBNA.ipa Trojan/Win32.VBKrypt.R5059 Trojan-Dropper.Krumkach.11521


A backdoor also known as: TrojanDownloader.MSIL Trojan.Win32.Z.Razy.20992.AYN Troj.Downloader.Msil!c Trojan.DownLoader25.50379 W32/Trojan.SKRD-4085 TrojanDownloader.MSIL.pxb Trojan.Razy.D361CA Backdoor:MSIL/Quasarat.A!bit Trj/GdSda.A Trojan.FOIG!tr Win32/Trojan.116


A backdoor also known as: Trojan.MSIL Ransom.FileCryptor Troj.Ransom.Msil!c Win32.Trojan.WisdomEyes.16070401.9500.9811 W32/Ransom.TAAZ-2840 Trojan.Win32.Ransom.ewmfpk Trojan.Encoder.5035 BehavesLike.Win32.Trojan.pc Trojan-Ransom.FileCoder Trojan.MSIL.hyys TR/Ransom.cgaxa Trj/GdSda.A Win32.Trojan.Raas.Auto MSIL/Filecoder.AC!tr Win32/Trojan.Ransom.568


Moroever, the vawtrak sample we got downloads a new memory scraping malware that scans for credit card data in memory.


A backdoor also known as: Trojanpws.Cosratu TrojWare.MSIL.Cosratu.QOA Trojan.PWS.Stealer.20141 TR/Downloader.aymho PWS:MSIL/Cosratu.A!bit Trj/GdSda.A Trojan.Razy.D36F19 Trojan.MSIL.PSW Win32/Trojan.480


A backdoor also known as: Trojannotifier.Phinot Trojan/Phinot.120 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Backdoor.HHE Backdoor.Trojan Win32/Small.BX TROJ_PHINOT.A Trojan-Notifier.Win32.Phinot.120 Trojan.Win32.Phinot.hkgh Trojan.Popon Trojan.Phinot.Win32.1 Trojan.Win32.DNSChanger W32/Backdoor.HEXL-8738 Trojan/Delf.Phinot.a Trojan[Notifier]/Win32.Phinot Win32.Troj.Phinot.12.kcloud Trojan.Heur.GZ.E38D33 Troj.Notifier.W32.Phinot.120!c Trojan-Notifier.Win32.Phinot.120 Win32.Trojan.Phinot.Wstw Trojan.Phinot!Cq2wyKHab1w W32/Phinot.120!tr


Evidence suggests that the tool is being used as part of a very targeted campaign, focused on Chinese nationals in commercial organizations.


Reports emerged just over a week ago of a new cyber-enabled bank heist in Asia.


These attacks are highly targeted, appear to re-purpose legitimate content in decoy documents, and had very low antivirus AV detection rates at the time they were deployed.


A backdoor also known as: Backdoor/W32.Hupigon.516096.L Downloader.Small.11945 Win32.Trojan.WisdomEyes.16070401.9500.9812 Win32/Citeary.B HV_DOWN.98AC8B50 Win.Trojan.Small-20870 Trojan-Dropper.Win32.Small.hms Trojan.Win32.Small.dlprwb Trojan.DownLoader3.7934 TrojanDropper.Small.fam Trojan[Downloader]/Win32.Small Trojan-Dropper.Win32.Small.hms Win32/TrojanDownloader.Small.PJP Win32.Trojan-dropper.Small.Taow Trojan.DR.Small!DUb+rE11TVI W32/Small.HMS!tr


We have named this Ransomware KeRanger. The only previous ransomware for OS X we are aware of is FileCoder, discovered by Kaspersky Lab in 2014.


A backdoor also known as: Trojan.BhoSearcher.B Trojan.BhoSearcher.B Trojan.BhoSearcher.B Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_DURSG.A Trojan.BhoSearcher.B Trojan.BhoSearcher.B Trojan.BhoSearcher.B Trojan.BhoSearcher.10 TROJ_DURSG.A BehavesLike.Win32.Injector.nt Trojan-Downloader.Win32.ConHook Trojan:Win32/Dursg.A Trojan/Win32.ConHook.C286311 Trojan.Dursg!2KwSbji4syo


A backdoor also known as: W32.HfsAutoB.7E63 Trojan.Win32.Patched!O Trojan.Patched.LI Win32.Trojan.WisdomEyes.16070401.9500.9933 Troj.W32.Patched.lm1y Virus.Win32.Loader.q Trojan.Patched.Win32.43121 Possible_HackToolPatched.UNP BehavesLike.Win32.NGVCK.dh Win32/PatchFile.gc TR/Patched.LI.1 HackTool:Win32/Patched.Y Win-Trojan/Patched.4095 Trojan.Win32.Patched W32/Patched.AW Win32/Trojan.bc4


It is under constant development, with several updated versions appearing since the original samples were observed in June 2017.


FireEye has observed Office documents exploiting CVE-2017-0199 that download and execute malware payloads from different well-known malware families.


A backdoor also known as: Ransom_Foreign.R002C0DKO17 W32/Trojan.ZJNJ-1589 Ransom_Foreign.R002C0DKO17 Trojan-Ransom.Win32.Foreign.nhnn Trojan.Win32.Kovter.ehmnac Trojan.ForeignCRTD.Win32.4896 W32/Trojan3.XSL Trojan.Adware.a TR/Crypt.ZPACK.gnual Trojan[Ransom]/Win32.Foreign Trojan-Ransom.Win32.Foreign.nhnn Trojan/Win32.Foreign.C1610813 BScope.Trojan-Banker.Buhtrap Trj/CI.A Trojan.Foreign Win32/TrojanDownloader.Small.ASE Win32.Trojan.Foreign.Lknk Trojan.Foreign!RxgoGgLK0WM PUA.Adstantinko W32/Small.ASE!tr Win32/Trojan.f8a


A backdoor also known as: Trojan/W32.Nuker.216576 Tool.WinNuke.Win32.3 Trojan/WinNuke.a Exploit.Win32.Nuker-WinNuke.htmy W32/TrojanX.ACD Nuker.IE Exploit.Win32.Nuker.WinNuke.a Win32.Exploit.Nuker.bhro TrojWare.Win32.Nuker.WinNuke Nuke.WinNuke W32/Trojan.GJZE-2894 Nuke/WinNuke.a TR/WinNuke.A Trojan[Exploit]/Win32.Nuker Win32.Hack.WinNuke.a.kcloud Trojan:Win16/WinNuke.A Win-Trojan/Winnuke.216576 Nuker.WinNuke Win32/Nuker.WinNuke Nuker.Win32.WinNuke W32/WinNuke.A!tr Nuker.DL Win32/Trojan.750


A backdoor also known as: Backdoor.Small Trojan.Graftor.D1F62C BKDR_ZIYANG.A Backdoor.Trojan.B BKDR_ZIYANG.A Backdoor.Win32.Small.liq Trojan.Win32.Small.cusdaj Backdoor.W32.Small!c Trojan[Backdoor]/Win32.Small HackTool:Win32/Dlhs.B Backdoor.Win32.Small.liq Trj/Ziyang.A Backdoor.Win32.Small W32/BackDoor.A!tr Win32/Backdoor.d0c


A backdoor also known as: Trojan.Uztuby.5 Script.Trojan.Malautoit.E Trojan.Uztuby.5 Trojan.Uztuby.5 Trojan.Uztuby.5 W32/ObfusInjectBot.a Zum.Ciusky.3 Trojan/Win32.Zbot.C311341 Trojan.Uztuby.5 W32/MalitRar.B!tr


A backdoor also known as: TrojanDownloader.Small.xpm TrojanDownloader:Win32/Sagnusnagta.A


A backdoor also known as: TrojanAPT.Infostealer.H4 Win32.Trojan.WisdomEyes.16070401.9500.9983 Trojan.Win32.ke3chang.f TrojWare.Win32.PSW.Delf.~JHN Trojan.DownLoader9.45552 BehavesLike.Win32.BadFile.gz Trojan.Win32.ke3chang.f Trojan/Win32.Infostealer.R91040


A backdoor also known as: W32/AutoRun.dqkk TROJ_SPNR.35CC13 Worm.Autorun-6695 Worm.Win32.AutoRun.eemt Trojan.Win32.Cromptui.bbwocj Worm.Win32.A.AutoRun.32768.Y[h] PE:Worm.VBInjectEx!1.99E6[F1] Trojan.DownLoader4.54145 TROJ_SPNR.35CC13 BehavesLike.Win32.Dropper.nm W32/Trojan.MOJM-1187 Worm/AutoRun.aboz TR/Spy.100048 Trojan.Heur.EF62DD Trojan/Win32.HDC TrojanDownloader:Win32/Kimiki.A Worm.AutoRun Win32.Worm.Autorun.Edef Trojan-Downloader.Win32.Kimiki Worm.Win32.AutoRun.eemt


In one case, the content of the email appeared to be a legitimate email conversation between several employees, even containing contact details of employees from several banks.


A backdoor also known as: W32.QueryexXM.Worm HackTool.Wpakill HackTool.WpaKill W32/Risk.JBSX-2163 Trojan.ADH.2 Win.Trojan.Swrort-5988 Crack-WindowsWGA.a HackTool.Win32.Wpakill W32/MalwareF.XIWY Trojan/Win32.Buzus HackTool:MSIL/Wpakill.A Crack-WindowsWGA.a HackTool.Wpakill!EXR6p6S0Jr0


Xavier's impact has been widespread.


But I know your email for sure it's not that one.


A backdoor also known as: Worm/W32.Raleka.14880.C Worm.Raleka.e.n3 W32/Raleka.worm Worm.Raleka.Win32.17 W32/Raleka.worm Worm.Raleka!sd8qYJWRVVk W32/Raleka.E W32.HLLW.Raleka Raleka.E Win32/Raleka.D Net-Worm.Win32.Raleka.e Trojan.Win32.Raleka.enog Worm.Win32.Raleka.H BehavesLike.Win32.Downloader.lc W32/Raleka.RXXM-3755 Worm/Raleka.k Worm/Raleka.E.2 Worm[Net]/Win32.Raleka Worm.Raleka.e.kcloud Worm:Win32/Raleka.G Trojan/Win32.Downloader Worm.Raleka W32/Kelar.B Win32/Raleka.H Win32.Worm-net.Raleka.Egog Net-Worm.Win32.Raleka.e W32/Raleka.B!worm Worm/Raleka.D Worm.Win32.Raleka.aTW


A backdoor also known as: Hoax.Win32.ArchSMS!O Trojan/ArchSMS.hqni TROJ_FAKEALERT_CD1031EC.RDXN Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Tnega.BTJDDdC TROJ_FAKEALERT_CD1031EC.RDXN Trojan.Win32.SMSSend.bddqwl Trojan.SMSSend.517 Tool.ArchSMS.Win32.277 Hoax.Win32.ArchSMS Hoax.ArchSMS.mn HackTool[Hoax]/Win32.ArchSMS Win32.Troj.Hoax.kcloud Trojan:Win32/Ninunarch.A Trojan/Win32.ArchSMS.R68018 Hoax.ArchSMS.hq Win32/Hoax.ArchSMS.JS Trojan.ArchSMS!V0Eag+i949w


Spora got some hype of being a ransomware that can encrypt files offline.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan-Downloader.Win32.Sysdrop.lm Trojan.Win32.Sysdrop.esnrws Downloader.Sysdrop.Win32.33 TR/Zusy.ugkcf Trojan.Zusy.D3C19C Trojan-Downloader.Win32.Sysdrop.lm Downloader/Win32.Sysdrop.C2035975 TrojanDownloader.Sysdrop Trj/GdSda.A Trojan.DL.Sysdrop! Trojan-Downloader.Win32.Sysdrop


Herein we release our analysis of a previously undocumented backdoor that has been targetedagainst embassies and consulates around the world leads us to attribute it, with high confidence,to the Turla group.


A backdoor also known as: Trojan.Tiny.S40745 Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Win32.Tiny.elmbme MalCrypt.Indus! BehavesLike.Win32.Backdoor.zz TR/Tiny.lsfum Trojan.Zusy.D32039 Trj/GdSda.A


Turla is a notorious group that has been targeting governments, government officials and diplomats for years.


TrendMicro first discovered MalumPoS, a new attack tool that threat actors can reconfigure to breach any PoS system they wish to target.


A backdoor also known as: Trojan-Ransom.Win32.Seftad!O Trojan.Seftad Trojan.MBRlock.Win32.1 Trojan/Seftad.a Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Risk.HXYU-7341 Trojan.Bootlock Win32/RansomSeftad.A Trojan-Ransom.Win32.Seftad.a Trojan.Win32.Seftad.bsiwp Troj.Ransom.W32.Seftad.tn9Q Trojan.MBRlock.1 Trojan-Ransom.Win32.Seftad W32/MalwareF.RQPA Trojan/Seftad.a BOO/Seftad.A Trojan[Ransom]/Win32.Seftad Trojan:Win32/Seftad.A Trojan-Ransom.Win32.Seftad.a Trojan/Win32.Seftad.R111206 Trojan-Ransom.Seftad Win32/MBRlock.A Trojan.Seftad!+WmSfnLYKGo W32/Seftad.A!tr Trj/SeftadMBR.A.Crypt


Unknown threats may evade signature-based detection, but can be blocked by other detection tools which identify malicious behavior.


Regin is a multi-purpose data collection tool which dates back several years.


A backdoor also known as: W32.Clod4c3.Trojan.53a7 Win32.P2P.Mua.E@mm Win32.P2P.Mua.E@mm Worm.Mua.Win32.3 W32/Mua.e Worm.P2P.Mua!6PD7raLqpvw W32.HLLW.Mua Win32/Mua.B BKDR_BRABOT.B P2P-Worm.Win32.Mua.e Win32.P2P.Mua.E@mm Trojan.Win32.Mua.hfob Worm.Win32.A.P2P-Mua.15147 Win32.P2P.Mua.E@mm Win32.P2P.Mua.E@mm BKDR_BRABOT.B BehavesLike.Win32.Sality.lh W32/Risk.FPWU-1321 Worm[P2P]/Win32.Mua Worm.Mua.e.kcloud Worm:Win32/Mua.C Win32.P2P.Mua.E@mm Win32/Mua.worm.15152.C Worm.Mua Worm.Win32.Mua.AhDz Win32/Mua.E Win32.Worm-P2P.Mua.dopm P2P-Worm.Win32.Mua.c W32/Shower.L Worm/Mua.E Win32/Trojan.bfd


I had found very few examples of non-targeted malspam using this RAT.


We recently spotted Neutrino being used to deliver a zero-detection Zeus variant and are sharing some brief indicators here.


Reaver is also somewhat unique in the fact that its final payload is in the form of a Control panel item, or CPL file.


The Turla group is known to target government, military, technology, energy and commercial organisations.


This report aims to uncover at least some undertakings of that group and to connect different attacks across the globe.


A backdoor also known as: Trojan.Mauvaise.SL1 Adware.RuKomaCRTD.Win32.4797 PUP.LoadMoney/Variant Trojan.Adware.Rukometa.Mikey.8 HT_RUKOMA_GA2700D5.UVPM HT_RUKOMA_GA2700D5.UVPM Trojan.Win32.Dwn.ehjpxo Trojan.DownLoader22.51269 Trojan.Scar.hqw Adware/Win32.Updater.C1575400 Adware.Zusy PUA.RuKoma! PUA.RuKoma


In February 2016, Check Point researchers first discovered HummingBad, a malware that establishes a persistent rootkit on Android devices, generates fraudulent ad revenue, and installs additional fraudulent apps.


A backdoor also known as: Trojan.Winsecsrv Trojan.Winsecsrv.Win64.325 Trojan.Win64.Winsecsrv TR/Winsecsrv.imeno Trojan:Win64/Winsecsrv.B!bit Trj/CI.A


A backdoor also known as: Trojan/W32.Yakes.303104 Trojan.Win32.Yakes!O Ransom.Tobfy.S5080 Trojan.Yakes.Win32.7333 Trojan/Yakes.bitd Trojan.Symmi.D1319B Win32.Trojan.VB.kf Trojan.Ransomlock.K Ransom_TOBFY.SM Win.Trojan.Yakes-628 Trojan.Win32.Yakes.bitd Trojan.Win32.Yakes.cojazo TrojWare.Win32.Injector.XFR Ransom_TOBFY.SM BehavesLike.Win32.PWSZbot.dt Trojan/Yakes.kjh Trojan/Win32.Yakes Trojan.Win32.A.Yakes.303104.D Trojan.Win32.Yakes.bitd Trojan/Win32.VBKrypt.R40134 Trojan.Yakes Trojan.Injector Win32/VB.QMS Trojan.Win32.Tobfy W32/Injector.YWH!tr


The malicious attachment, which offered salacious spoilers and video clips, attempted to install a 9002 remote access Trojan RAT historically used by state-sponsored actors.


A backdoor also known as: Trojan.Barys.DD949 Win32.Trojan.WisdomEyes.16070401.9500.9860 Trojan:Win32/Grenam.B!inf Trj/GdSda.A


A backdoor also known as: Trojan.Win32.Malware.1 Trojan.Rootkit.GGA Backdoor:W32/PcClient.ALE BACKDOOR.Trojan Backdoor:Win32/Xinia.C Trojan.Rootkit.GGA RootKit.Win32.Undef.ru W32/Rootkit.A SHeur.CPFS


Hancitor also known as Tordal and Chanitor and Ruckguv have reappeared in campaigns distributing Pony and Vawtrak with significant updates and increased functionality.


A backdoor also known as: Trojan.Flooder.MSN.Chiller.A Trojan/W32.Flooder.135168.E Trojan.Flooder.MSN.Chiller.A Tool.Chiller.Win32.1 Trojan.Flooder.MSN.Chiller.A Flooder.Chiller!cPnYwu6r4qI Win32/Flooder.MSN.Chiller.10 TROJ_MSN.CHILLER IM-Flooder.Win32.Chiller Trojan.Win32.Chiller.ddka IM-Flooder.W32.Chiller!c Trojan.Flooder.MSN.Chiller.A TrojWare.Win32.Flooder.MSN.10 Trojan.Flooder.MSN.Chiller.A FDOS.Children TROJ_MSN.CHILLER W32/Risk.BSWW-2789 Flooder.MSN.Chiller HackTool[Flooder]/Win32.Chiller Trojan.Flooder.MSN.Chiller.A IMFlooder.Chiller Flooder.MSN.Chiller IM-Flooder.Win32.Chiller Trojan.Flooder.MSN.Chiller.A Flooder.AZF Trojan.Win32.IMFlooder.aa Win32/Trojan.Flooder.cc8


A backdoor also known as: VB:Trojan.VBA.Downloader.R VB:Trojan.VBA.Downloader.R VBA.Trojan.Obfuscated.at VBA/Obfuscated.P Doc.Macro.Obfuscation-6360615-0 VB:Trojan.VBA.Downloader.R VB:Trojan.VBA.Downloader.R Trojan.Script.MLW.ehjqnz VB:Trojan.VBA.Downloader.R VB:Trojan.VBA.Downloader.R W97M/Downloader.bkw HEUR.VBA.Trojan.e TrojanDownloader:O97M/Shelmock.A!dha W97M/Downloader.bkw Trojan.VBA.Obfuscated heur.macro.powershell.x


This relatively new technique makes it difficult to detect the malware—especially on behavior-based malware detection systems.


A backdoor also known as: Trojan.Mehm.B Trojan/W32.CGIScan.333312 Aplicacion/CGIScan.40 Trojan.Mehm.B Trojan.Cgiscan!ODpuR5Z5bgo W32/HackTool.CNH Hacktool.Flooder Win.Trojan.Cgiscan not-a-virus:NetTool.Win32.CGIScan.40 Riskware.Win32.CGIScan.byaea NetTool.CGIScan.333312[h] Trojan.Mehm.B Trojan.Mehm.B Trojan.DownLoader.9414 Tool.CGIScan.Win32.1 W32/Tool.MGCU-4799 TR/Mehm.B W32/Cgiscan.A!tr Trojan.Mehm.B Win-Trojan/Mehm.333312 Trojan:Win32/Cgiscan.A Trojan.Mehm.B Hacktool.Win32.CGIScan.40 Win32.Trojan.Spnr.Wqmq not-a-virus:NetTool.Win32.CGIScan Trojan.Mehm.B HackTool/CgiScan.A Win32/Virus.NetTool.902


We will refer to the gang behind the malware as TeleBots.


They then distribute the trojanized application using their own, Russian-language-targeted Android Application sites.


A backdoor also known as: Trojanpws.Qqpass.20916 Trojan.Adware.Graftor.D9426 Win32.Trojan.WisdomEyes.16070401.9500.9999 Infostealer.Onlinegame TSPY_ONLINEG.JW Win.Spyware.28080-1 Trojan-GameThief.Win32.OnLineGames.akyyi Trojan.Win32.Nilage.bstxe Trojan.PWS.Gamania.8978 TSPY_ONLINEG.JW BehavesLike.Win32.RAHack.dc Trojan/PSW.OnLineGames.xyc Trojan[GameThief]/Win32.WOW.gic Trojan:Win32/Ordpea.A Trojan-GameThief.Win32.OnLineGames.akyyi MalwareScope.Trojan-PSW.Game.7 Trj/Lineage.HKT Trojan.Win32.OnlineGames.pjf Trojan.PWS.OnlineGames.GFA Trojan-GameThief.Win32.OnLineGames


We observed several high-volume FormBook malware distribution campaigns primarily taking aim at Aerospace, Defense Contractor, and Manufacturing sectors within the U.S. and South Korea during the past few months.


A backdoor also known as: Trojanspy.Coinsteal TROJ_GE.0352184D Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_GE.0352184D Trojan.MSIL.PSW TrojanSpy:MSIL/CoinSteal.B!bit Spyware/Win32.Quasar.C2001029 Trojan.FakeMS Trj/CI.A


This post opens the lock up and takes a look inside.


With email subject lines such as, bank account record annual report and company database we believe that attackers are possibly targeting companies.


Gary Warners's blog also reported on this and similar campaigns, indicating that a well-known botnet, Kelihos, is responsible for distributing this spam.


However, not to be out done, APT attackers have also started leveraging the exploit in targeted spear phishing attacks as well.


A backdoor also known as: HW32.Packed.1490 Trojan.Heur.RP.E99DCA WORM_FLYSTUDI.B Win32.Trojan.WisdomEyes.16070401.9500.9998 WORM_FLYSTUDI.B Win.Worm.FlyStudio-34 Trojan.MulDrop6.9267 Trojan.Black.Win32.8293 BehavesLike.Win32.Autorun.vc TrojanDropper.Flystud Win32.Trojan.Ecode.Wwel Trojan.Win32.FlyStudio


n the past, we have seen such occurrences with Magecart threat actors for example in the breach of the Umbro website.


A backdoor also known as: Trojan.Win32.Maesorn!O Trojan/Maesorn.g Backdoor.Graybird Win.Trojan.OnlineGames-1999 Trojan.Win32.Maesorn.innuf Trojan.Win32.A.Maesorn.563216[ASPack] Trojan.PWS.Panda.980 BehavesLike.Win32.MultiPlug.hc Trojan/Maesorn.a TR/Maesorn.psa Trojan/Win32.Unknown Trojan.Maesorn.1 Trojan:Win32/Maesorn.A Trojan/Win32.Maesorn.C288249 TScope.Malware-Cryptor.SB Win32.Trojan.Maesorn.Lmax Trojan.Maesorn!i+tWu8HStQI Win32/Trojan.227


WE WILL UNLOCK THE MOBILE DEVICE AND DELETE ALL YOUR DATA FROM OUR SERVER ! TURNING OFF YOUR PHONE IS MEANINGLESS , ALL YOUR DATA IS ALREADY STORED ON OUR SERVERS ! WE STILL CAN SELLING IT FOR SPAM , FAKE , BANK CRIME etc… We collect and download all of your personal data .


Unlike most ransomware, SamSam is not launched via user focused attack vectors, such as phishing campaigns and exploit kits.


In April 2017, in collaboration with Clearsky, Palo Alto Networks Unit 42 published an article about our research into targeted attacks in the Middle East.


A backdoor also known as: HW32.Packed.85E5 Downloader.Small.Win32.16916 Trojan/Downloader.Small.eqn Win32.Trojan.WisdomEyes.16070401.9500.9998 Win32/Matcash.AQ TROJ_DLOADER.KGM Win.Downloader.12076-1 Trojan-Downloader.Win32.Small.eqn Trojan.Win32.Small.pnkq Trojan.Win32.Downloader.9806 TrojWare.Win32.TrojanDownloader.Small.AP Trojan.DownLoader.26881 TROJ_DLOADER.KGM BehavesLike.Win32.Backdoor.zh TrojanDownloader.Small.cgx Trojan[Downloader]/Win32.Small TrojanDownloader:Win32/Matcash.A Trojan/Win32.Downloader.R162197 Trj/Downloader.PNC Win32.Trojan-downloader.Small.Agut Trojan.DL.Small!SbF3EFAX1gY Trojan-Downloader.Win32.Small


A backdoor also known as: HW32.Packed.3D2A Trojan.Razy.DF5C4 Win32.Trojan.WisdomEyes.16070401.9500.9773 not-a-virus:RiskTool.Win32.Gamehack.zae Trojan.PWS.Banker1.20175 Trojan.Win32.PSW W32/Trojan.WGYB-0329 RiskTool.Gamehack.iw TR/Taranis.2867 not-a-virus:RiskTool.Win32.Gamehack.zae MalwareScope.Trojan-PSW.Game.16 Riskware.Gamehack! Win32/Trojan.fe9


However, minimal code change to Ploutus-D would greatly expand its ATM vendor targets since Kalignite Platform runs on 40 different ATM vendors in 80 countries.


A backdoor also known as: Troj.Dropper.Msil!c Trojan.Zusy.D3F4E2 Win32.Trojan.WisdomEyes.16070401.9500.9901 Trojan.Coinbitminer TROJ_COINMINER_HA220058.UVPM Trojan.DownLoader25.65376 Trojan.CoinMiner.Win32.6726 TROJ_COINMINER_HA220058.UVPM Trojan:MSIL/CoinMiner.KA!bit Trojan/Win32.Tiggre.R218036 Misc.Riskware.BitCoinMiner Trj/GdSda.A Trojan.MinerBot Win32/Trojan.Dropper.bc3


A backdoor also known as: TrojanDownloader.Jiwerks.A8 Trojan/Downloader.Delf.quc Trojan.Graftor.D451A Trojan.Win32.Dwn.wpldc Win32.Worm.Qqshare.crbf TrojWare.Win32.TrojanDownloader.Delf.QUC Trojan.DownLoader6.2772 Trojan-Ransom.Win32.Foreign Trojan/Win32.Unknown TrojanDownloader:Win32/Jiwerks.C Trojan/Win32.Banload.R28382 Trojan.DL.Delf!amQyVfM1aVU


During this time it has managed to avoid scrutiny by the security community.


In separate isolated incidents,we also noticed the deployment of MajikPOS via PsExec, a command-line tool that can be used to remotely execute processes on other systems.


The attacks point to extensive knowledge of the targets' activities, and share infrastructure and tactics with campaigns previously linked to Iranian threat actors.


We have observed this team utilizing .cim and .bcl files as attack vectors, both of which file types are used by the CIMPLICITY software.


A backdoor also known as: Trojan.Dynamer.FC.1842 W32/Msil.AOXS-4373 TSPY_HPCUBESTLR.SM Win.Packed.Confuser-6042561-0 not-a-virus:PSWTool.Win32.MessengerPass.n Trojan.Win32.Stealer.emdjaa Troj.W32.Jorik.Shakblades.lBRs Packed:MSIL/SmartIL.A Trojan.PWS.Stealer.13008 TSPY_HPCUBESTLR.SM BehavesLike.Win32.CryptDoma.fc HackTool.Win32.BrowserPassview W32/Msil.O TrojanSpy.MSIL.ewm Win32.Troj.Undef.kcloud Trj/CI.A Win32/Trojan.cb4


A backdoor also known as: Backdoor.G.Door.C Backdoor/W32.GDoor.334848 Backdoor.G.Door.C BKDR_DOOR.LG W32/Backdoor2.DZPI Backdoor.Trojan BKDR_DOOR.LG Win.Trojan.GGDoor-4 Backdoor.G.Door.C Backdoor.Win32.G_Door.c Backdoor.G.Door.C Trojan.Win32.GDoor.beknpm Backdoor.Win32.G_Door.334848 Backdoor.W32.G_Door.c!c Backdoor.G.Door.C Backdoor.G.Door.C Trojan.MulDrop.141 BehavesLike.Win32.Trojan.fc Backdoor/G_Door.c Backdoor.Win32.G_Door.C W32/Backdoor.VMMA-7325 Backdoor/G_Door.c BDS/G_door.C.17 Trojan[Backdoor]/Win32.G_Door Backdoor:Win32/G_Door.C Backdoor.Win32.G_Door.c Backdoor.G.Door.C Backdoor.G_Door Bck/Ggdoor.I Win32/G_Door.C Win32.Backdoor.G_door.Svhk Backdoor.G_Door!JC6xcbYSKHg Win32/Backdoor.b76


The original version of Nokoyawa ransomware was introduced in February 2022 and written in the C programming language.


A backdoor also known as: Trojan.Heur.FU.EF8E10 Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Risk.CCTW-9250 Trojan.Win32.Jascript.cvmxnk Dropper.Jascript.Win32.59 Trojan-Ransom.Win32.Gimemo W32/MalwareF.OGBH TrojanDropper.Jascript.ao TR/Drop.Jascript.bbo Trojan:Win32/Thetatic.A Dropper/Win32.Xema.C95872 Win32.Trojan-dropper.Jascript.Syrq Trojan.DR.Jascript!LiiZWXoHPPQ W32/Jascript.BBO!tr


A backdoor also known as: W32.FamVT.DebrisB.Worm Trojan/W32.Csyr.3584.C Worm.Win32.Debris!O W32/Csyr.A!Eldorado Win32/Tnega.FeZbcZD WORM_GAMARUE.SMB Win.Adware.Downware-239 Worm.Win32.Debris.p Trojan.Win32.Drop.brprwz Worm.Win32.Bundpil.T Trojan.MulDrop4.25343 WORM_GAMARUE.SMB BehavesLike.Win32.Worm.zz W32/Csyr.A!Eldorado Trojan/Csyr.a TR/Zusy.358421 Trojan/Win32.Csyr Trojan.Zusy.DA717 Worm.Gamarue Worm.Win32.Debris.p Trojan:Win32/Topini.A Worm/Win32.Bundpil.R63957 Worm.Gamarue Trj/Zbot.M Trojan.Win32.Csyr.A W32/Bundpil.T!worm Worm.Win32.Gamarue.E


A backdoor also known as: RemoteAdmin.Win32.eSurveiller!O Trojan.VB.Win32.68501 Trojan/VB.nqz TSPY_ESURVEILLER_DC07000D.UVPA Spyware.ESurveiller TSPY_ESURVEILLER_DC07000D.UVPA Win.Trojan.Infostealer-5 Backdoor.Win32.VB.ppb Trojan.Win32.Dwn.ssuio Trojan.Win32.VB.1452000 Troj.Infostealer.lDrj Trojan.DownLoader1.64229 not-a-virus:RemoteAdmin.Win32.eSurveiller Trojan.Strictor.D2473 Backdoor.Win32.VB.ppb Unwanted/Win32.Radmin.R25253 Backdoor.VB Trj/CI.A Trojan.Infostealer Win32.Backdoor.Vb.Lnns Trojan.DownLoader!


A backdoor also known as: Trojan.Delf.Inject.Z Trojan-Dropper.Win32.Mudrop!O Hacktool.Passview Trojan.Delf.Inject.Z Trojan/Dropper.Mudrop.ew TROJ_DROPPER.HVW Win32.Worm.AutoRun.ij W32/Risk.BDUN-6545 TROJ_DROPPER.HVW Win.Trojan.Delf-3744 Trojan.Delf.Inject.Z Trojan-Dropper.Win32.Mudrop.ew Trojan.Delf.Inject.Z Trojan.Win32.Mudrop.crqisw Trojan.Win32.MulDrop.1431634 Trojan.Delf.Inject.Z TrojWare.Win32.TrojanDropper.Mudrop.~RA Trojan.Delf.Inject.Z Trojan.MulDrop.12722 Dropper.Mudrop.Win32.77 BehavesLike.Win32.PUP.tc W32/Dropper.GWJ TrojanDropper.Mudrop.fy TR/Spy.Ftput.C Trojan[PSW]/Win32.LdPinch Trojan.Delf.Inject.Z Trojan-Dropper.Win32.Mudrop.ew PWS:Win32/Sounli.A Dropper/Win32.Mudrop.C138252 TrojanPSW.Pinch Trojan.PWS.LdPinch!Csxdj/6mZgk Trojan-Dropper.Win32.Mudrop


RedLine Stealer's evasive spear-phishing campaign targets the hospitality industry.


Web application vulnerabilities are like doorways: you never know who or what will walk through.


Threat actors with strategic interest in the affairs of other governments and civil society organizations have been launching targeted exploitation campaigns for years.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9984 TR/AD.Corinrat.sejyy Trojan.Application.MSILPerseus.D535 Ransom:MSIL/PentagonRat.A Trj/GdSda.A Win32/Application.478


A backdoor also known as: Heur.Win32.VBKrypt.3!O Trojan.Vbot.S15507 Downloader.VB.Win32.107566 Trojan/AntiAV.out Win32.Trojan.WisdomEyes.16070401.9500.9933 Trojan.Win32.AntiAV.cqff Trojan.Win32.AntiAV.bbnaxd Trojan.MulDrop3.35749 Trojan.AntiAV.abe TR/Offend.7084277.1 Trojan:Win32/Vbot.T Trojan.Win32.AntiAV.cqff Downloader/Win32.VB.C136965 Trojan.AntiAV Win32.Trojan.Antiav.Wmiq Trojan.AntiAV!kRLKkhVQepY


A backdoor also known as: W32.FamVT.RazyNHmA.Trojan Trojan.Waldek Trojan.Symmi.D100C4 WORM_HPKASIDET.SM0 Win32.Trojan.Kryptik.aio WORM_HPKASIDET.SM0 Win.Trojan.Betabot-5 Trojan.Win32.NgrBot.evigbp BackDoor.IRC.NgrBot.566 BehavesLike.Win32.MultiPlug.cm W32/Trojan.HZWF-1490 TR/Crypt.Xpack.tsufk Trojan:Win32/Radonskra.B Trojan/Win32.Upbot.C1483736 Trj/GdSda.A Trojan-Ransom.Raa W32/Kryptik.FACF!tr Win32/Trojan.a93


Attackers are continually trying to find new ways to target users with malware sent via email.


A backdoor also known as: Trojan.Multi Win32.Trojan.WisdomEyes.16070401.9500.9999 Zum.Rastarby.4 Trojan.Win32.Miner.tfkd Zum.Rastarby.4 Riskware.Win64.BtcMine.dugwfh Uds.Dangerousobject.Multi!c Win32.Trojan.Miner.Dux BehavesLike.Win32.AdwareLinkury.tc Zum.Rastarby.4 Trojan.Win32.Miner.tfkd Trojan:Win64/HelaMiner.A Trojan.Miner BAT/CoinMiner.YJ Trj/CI.A Win32/Trojan.769


A backdoor also known as: Backdoor.ZXShell BKDR_ZXSHELL.D Backdoor.Win32.ZXShell.v Backdoor.W32.Zxshell!c BKDR_ZXSHELL.D BDS/ZXShell.999712 W32/ZxShell.D!tr Trojan.Kazy.DB0C8D Backdoor:Win32/Zxshell.A!dha Backdoor/Win32.ZXShell.N1663696022 Win32.Backdoor.Zxshell.Pfjm Trojan.Win32.Zxshell Win32/Backdoor.6e4


the worm was back, and it was both more and less effective.


A backdoor also known as: Trojan.BitCoinMiner Riskware.Win32.BtcMine.exrhsn Trojan.Win32.Z.Strictor.1934848 Win32.Trojan.Strictor.Akpc Tool.BtcMine.982 BehavesLike.Win32.BadFile.tc Trojan.Win32.CoinMiner TR/CoinMiner.vctqx Trojan.Strictor.D2613C Trojan.Win64.BitCoinMiner W32/CoinMiner.AZU!tr


The use of DDE with PowerShell allows an attacker to execute arbitrary code on a victim's system regardless whether macros are enabled.


In addition to Chipotle, the hackers appears to be targeting national restaurant franchises Baja Fresh and Ruby Tuesday, according to malware samples and other evidence CyberScoop obtained.


ThreatLabz has determined that Nevada shares significant code with the Rust-based variant of Nokoyawa.


This past week, our team has identified a group of malware samples that matched behavioral heuristics for multiple known malware families.


A backdoor also known as: W32.ShellKillUnixOSPtv.Worm Trojan.Script.BXM Trojan.VBS.Kofornix.A Trojan.KillDisk.MBR Troj.W32.EraseMBR.d!c Trojan.Jokra Win32/DarkSeoul.AA UNIX_KILLMBR.A Trojan.Win32.EraseMBR.d Trojan.Script.BXM Trojan.Script.EraseMBR.bxxrlr Trojan.Script.BXM Trojan.Script.BXM Trojan.KillMBR.168 BASH/Kast.A!tr Trojan.Script.BXM Trojan.Win32.EraseMBR.d Trojan:SH/Kofornix.A Trojan.SH.KilMBR Win32.Trojan.Erasembr.Wtnk Trojan.Win32.EraseMBR Trojan.Script.BXM Win32/Trojan.6f6


A backdoor also known as: I-Worm.Plesa.r3 Trojan/Plesa.a IRC-Worm.Plesa!VraGnsrR3Es W32/Plesa.A@p2p W32.SillyP2P IRC/Plesa.A WORM_PLESA.B Worm.IRC.Plesa.A IRC-Worm.Win32.Plesa.a Trojan.Win32.Plesa.fuyf Worm.Win32.A.IRC-Plesa.34304[h] Worm.IRC.Plesa.A Win32.HLLW.Plesa Worm.Plesa.Win32.1 WORM_PLESA.B BehavesLike.Win32.Sality.nc W32/Plesa.BXPQ-5568 I-Worm/Plesa.a WORM/Irc.Plesa.A.2 W32/Plesa.A!worm.irc Worm[IRC]/Win32.Plesa W32.W.Plesa.a!c Win32/Plesa.worm.34304 Worm:Win32/Plesa.A Win32.Worm-irc.Plesa.Svqx IRC-Worm/Plesa.A Worm.Win32.Plesa.a


A backdoor also known as: W32.Spybot.Worm W32/Packed_Packman.A Virus.Win32.Heur.c Backdoor.Rbot!IK Win32.HLLW.MyBot.based Backdoor.Rbot BackDoor.RBot.IA


In mid-July, Palo Alto Networks Unit 42 identified a small targeted phishing campaign aimed at a government organization.


What lied beneath this facade was a well-engineered campaign of phishing attacks designed to steal credentials and spy on the activity of dozens of journalists, human rights defenders, trade unions and labour rights activists, many of whom are seemingly involved in the issue of migrants' rights in Qatar and Nepal.


A backdoor also known as: Trojan.PWS.Coced.2.4.6 Trojan.PWS.Coced.2.4.6 Trojan.PWS.Coced.2.4.6 Trojan.Win32.Coced.bhwfkh Hacktool.PWSteal Naebi.246 Trojan-PSW.Win32.Coced.246 Trojan.PWS.Coced!FBVVvUBVA1M Trojan.PWS.Coced.2.4.6 TrojWare.Win32.PSW.Coced.246 Trojan.PWS.Coced.2.4.6 Trojan.PWS.Coced.246 Trojan.Coced.Win32.158 W32/Risk.HJYL-5906 Trojan/PSW.Coced.246 TR/PSW.Coced.246 Trojan[PSW]/Win32.Coced Win32.PSWTroj.Coced.kcloud PWS:Win32/Coced.2_46 Win-Trojan/Coced.19456 Trojan.PWS.Coced.2.4.6 Trojan.PWS.Coced.2.4.6 TrojanPSW.Coced Win32/PSW.Coced.246 Win32.Init.QQRob.dkwv W32/Coced.246!tr.pws PSW.Coced Trojan.Win32.InfoStealer.AYJO


Some of the new 2014-2015 Duqu infections are linked to the P5+1 events and venues related to the negotiations with Iran about a nuclear deal.


This latest attack potentially materially impacts one of the primary countermeasures employed against wiper attacks: Virtual Desktop Interface snapshots.


One is CVE-2012-1856, reinvigorated with a novel ROP chain to bypass ASLR and deliver the uWarrior payload.