A backdoor also known as: Trojan-Dropper.Win32.Joiner!O Worm.Rebhip.A8 Trojan/Dropper.Joiner.k TROJ_MULTIDROP.Q W32/Dropper.ANIA Backdoor.Colfusion Win32/TheJoiner.15x.C TROJ_MULTIDROP.Q Trojan-Dropper.Win32.Joiner.k Trojan.Win32.Joiner.epmz Trojan.Win32.Z.Joiner.417292 Backdoor.W32.l8Tn TrojWare.Win32.TrojanDropper.Joiner.K Trojan.MulDrop.32 Dropper.Joiner.Win32.430 BehavesLike.Win32.Downloader.gc Trojan-Dropper.Win32.Joiner W32/Risk.SFJA-2732 TrojanDropper.Win32.Joiner.k Trojan/Win32.Llac.cxsz Trojan-Dropper.Win32.Joiner.k Trojan.Llac Trj/Runner.Joiner.K Win32/TrojanDropper.Joiner.K Win32.Trojan-dropper.Joiner.Lkdg Trojan.DR.Joiner!ZtouwF9CQqA RAT.CyberGate W32/SkyRat.DLE!tr


A backdoor also known as: Trojan.Flood.Vb.DN Trojan/W32.Flooder.20992.B Trojan.Flood.Vb.DN Trojan/VB.dn Trojan.Flood.Vb.DN W32/VirTool.GZ Hacktool.Flooder Win32/Flooder.VB.DN Win.Trojan.Nudgema-1 IM-Flooder.Win32.VB.dn Trojan.Win32.VB.mdnh Win32.Trojan.Vb.Wrhd Trojan.Flood.Vb.DN TrojWare.Win32.Flooder.VB.DN Trojan.Flood.Vb.DN FDOS.IM.451 Tool.VB.Win32.1591 BehavesLike.Win32.Trojan.mh W32/Tool.QSEE-8541 IM-Flooder.VB.fg TR/Flood.VB.DN.1 HackTool[Flooder]/Win32.VB HackTool:Win32/Aflooder.D Trojan.Flood.Vb.DN IM-Flooder.W32.VB.dn!c Trojan.Flood.Vb.DN Trojan/Win32.Xema.N61964869 IMFlooder.VB Trojan-PWS.Win32.Executant.d Malware_fam.gw Flooder.LZ Flooder/Nudge.B


In mid-October 2016, he received an unexpected phone call.


A backdoor also known as: W32.MoonLight.Trojan Win32.Emailworm.LW Worm.Lightmoon.MF.213 Win32.Emailworm.LW Worm.VB.Win32.314 W32/VB.by Win32.Emailworm.LW Win32.Worm.VB.a W32/Worm.CIPA-1476 W32.Rontokbro@mm Win32/Lightmoon.D WORM_VB.VV Email-Worm.Win32.VB.by Trojan.Win32.VB.dyztaz I-Worm.Win32.VB.35176 W32.W.VBNA.mhOD Worm.Win32.NoonLight.F BehavesLike.Win32.Trojan.nc W32/EmailWorm.LW Worm.VB.gi TR/BAS.Samca.12113913 Worm:Win32/Lightmoon.H Win32.Emailworm.LW Email-Worm.Win32.VB.by Win32.Emailworm.LW HEUR/Fakon.mwf Win32.Emailworm.LW W32/Moonlight.B.worm I-Worm.NoonLight.F Win32/NoonLight.F Win32.Worm-email.Vb.Hssm I-Worm.VB.WEI


One of those binaries was initially thought to be a new variant of the Padpin ATM malware family.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9786 TROJ_ONKODS.SMFF Trojan.DownLoader13.29927 TROJ_ONKODS.SMFF TrojanDownloader:Win32/Cerber.A Trojan.Zbot.188 Trojan/Win32.Fakeavlock.R144660 Trojan-Downloader.Win32.Tiny


These solutions are typical in enterprise environments.


The ransomware is designed to infect Microsoft Windows computers.


A backdoor also known as: Win32.Worm.Delf.NGA Worm.Win32.Delf!O Worm.Delf Win32.Worm.Delf.NGA Win32.Worm.Delf.bd W32/Trojan2.MIZZ W32.Screentief Win32/Screentief.A WORM_AUTORUN.GKP Worm.Win32.Delf.vn Win32.Worm.Delf.NGA Win32.Worm.Delf.clov Win32.Worm.Delf.NGA TrojWare.Win32.PSW.OnLineGames.~LDK Win32.Worm.Delf.NGA Trojan.DownLoader4.55571 WORM_AUTORUN.GKP W32/Trojan.DZCT-6244 Worm:Win32/Screenthif.A Worm/Win32.Delf Worm:Win32/ScreenThif.A Win32.Worm.Delf.NGA Trojan.Win32.Scar.702464 Worm.Win32.Delf.vn Win32.Worm.Delf.NGA HEUR/Fakon.mwf Win32.Delf Win32/Delf.NQC W32/Delf.NQC!worm


A backdoor also known as: W32.DontovoF.Trojan Trojan.Hacktool.Httptunnel.A Trojan/W32.HackTool.36864.I Trojan.Hacktool.Httptunnel.A Tool.HTTPTunnel.Win32.1 Trojan/Hacktool.HTTPTunnel Trojan.Hacktool.Httptunnel.A Trojan.Hacktool.Httptunnel.A W32/Tool.UFFD-0015 TROJ_HTTPTUNE.A Trojan.Hacktool.Httptunnel.A HackTool.Win32.HTTPTunnel Riskware.Win32.HTTPTunnel.hskj HackTool.W32.HTTPTunnel!c Trojan.Hacktool.Httptunnel.A Application.Win32.HackTool.HTTPTunnel BehavesLike.Win32.PUP.nz W32/HackTool.EG Hacktool.HttpTunnel W32.Hack.Tool HackTool/Win32.HTTPTunnel HackTool.Win32.HTTPTunnel Win32/HackTool.HTTPTunnel Win32.Hacktool.Httptunnel.Ljul


A backdoor also known as: W32/Trojan.KGEI-2537 Trojan-Spy.Win32.Alinaos.as Trojan.Win32.Z.Zusy.575488.M BehavesLike.Win32.Trojan.hc Trojan.MSIL.Krypt Trojan.Zusy.D3371D Trojan/Win32.Inject.C1647442 Trojan-Spy.Win32.Alinaos.as Trojan:MSIL/Proseus.A!bit Trj/CI.A Msil.Trojan.Dropper.Sxdx Win32/Trojan.Dropper.6f6


These attacks caused significant financial impact for major cryptocurrency markets, with one cryptocurrency cloud provider losing over $12 million in assets, allegedly to ITG03.


A backdoor also known as: Virus.Win32.Delf!O Worm.Zorin W32.Looked.P Win32/Looked.C PE_LEOX.A Worm.Win32.Zorin.a Trojan.Win32.Zorin.wmfe W32.W.Viking.l3Va Virus.Win32.Zorin.a Win32.HLLW.Looked Virus.Delf.Win32.16 PE_LEOX.A BehavesLike.Win32.Backdoor.lh Worm.Win32.Viking W32/Zorin.A Worm/Zorin.a Virus/Win32.Delf.dpee Worm.Logo.f.67072 Worm:Win32/Zorin.A Worm.Win32.A.Zorin.67072 Worm.Win32.Zorin.a Win32/Zorin.67072 Trojan.Delf.62976 Win32/Viking.NAI Worm.Zorin.A W32/Zorin.A.worm Win32/Worm.Zorin.A


The focus of the Android banking malware in Google Play is different from any other Android malware we have investigated.


Actually, this is not the first ransomware to come out of Brazil.


A backdoor also known as: Trojan-PWS/W32.WebGame.12356.C TrojanPSW.OnLineGames.gyv Trojan.DL.Hover!hoKEWysDbsk W32/Packed_Upack.A Trojan.Onlinegames-2021 Trojan-Downloader.Win32.Hover.ae Heur.Packed.Unknown Trojan.AVKill.425 TR/CHover.AE Trojan/PSW.OnLineGames.aogk TrojanDownloader:Win32/Idicaf.C Win-Trojan/OnlineGameHack.12356.D Trojan-PSW.Win32.OnLineGames.alse HeurEngine.ZeroDayThreat W32/OnLineGames.ALSE!tr.pws PSW.OnlineGames.ATXK Trj/Lineage.KMQ


A backdoor also known as: Trojan.Win32.Nsis.hgnwk TROJ_SPNR.07JB11 Trj/CI.A Win32.Troj.DeepScan.x.kcloud Trojan:Win32/Sinis.C W32/Bfr.CV!tr


Unit 42 has uncovered a new campaign from the CozyDuke threat actors, aka CozyCar leveraging malware that appears to be related to the Seaduke malware described earlier this week by Symantec.


It leaves a ransom note with the following filename: !!! how to decrypt files !!!.txt


A backdoor also known as: Trojan-Downloader/W32.Mutant.32128 TrojanDownloader.Mutant.aim Trojan.DR.Wigon.K Win32/Wigon.CK W32/Trojan3.GG Trojan.Pandex W32/DLoader.JDXM Trojan.Downloader-55828 Trojan-Downloader.Win32.Mutant.aim Trojan.Downloader.Wigon.A TrojWare.Win32.Wigon.CK Trojan-Downloader.Win32.Mutant.aim Trojan.Rntm.10 Win32/Wigon.CK W32/Trojan3.GG TrojanDropper:Win32/Cutwail.AG Trojan.Downloader.Wigon.A Trojan.Pandex.ILG Trojan.Win32.Undef.qqp Trojan-Dropper.Cutwail BackDoor.Ntrootkit Trj/BedeTres.R


A backdoor also known as: Dropped:Trojan.Spy.Delf.PY Backdoor.Win32.Swz!O Backdoor/Swz.c Trojan.Spy.Delf.PY Win32.Trojan.WisdomEyes.16070401.9500.9990 W32/Trojan.XFMU-4902 TSPY_DELF.EGM Win.Spyware.3595-2 Backdoor.Win32.Swz.c Dropped:Trojan.Spy.Delf.PY Trojan.Win32.Swz.bcbdrt Dropped:Trojan.Spy.Delf.PY TrojWare.Win32.Dialer.LA Dropped:Trojan.Spy.Delf.PY Trojan.DownLoader.18593 TSPY_DELF.EGM BehavesLike.Win32.HLLP.dh Trojan-Dropper.Delf W32/Trojan.YLD Backdoor/Delf.sn Trojan[Backdoor]/Win32.Swz Backdoor.Win32.Hupigon.159240 Backdoor.Win32.Swz.c Dropped:Trojan.Spy.Delf.PY Trojan/Win32.Llac.R36500 Dropped:Trojan.Spy.Delf.PY Backdoor.Win32.Hupigon.axbc TrojanSpy.Delf!ehn0gq0J77k


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9955 BKDR_ZEGOST.SM17 Trojan.Win32.FBOK.exmdmr TR/Crypt.Xpack.drajw Trojan.Johnnie.D15B42 Trojan:Win32/Redosdru.AB Trj/GdSda.A Win32/Backdoor.d55


A Mumblehard infected server opens a backdoor for the cybercriminals that allows them full control of the system by running arbitrary code.


A backdoor also known as: Trojan.Skeeyah Worm.EternalRocks Win32.Trojan.WisdomEyes.16070401.9500.9972 W32.Eternalrocks Win.Trojan.EternalRocks-6320096-0 Worm.EternalRocks.t Trojan/Win32.Fsysna Trojan:Win32/Eterock.A Win-Trojan/MDA.630F094C Trojan.Fsysna Worm.DoomsDay W32/Eterocks.B!tr


In addition to the commoditized EKs, this exploit code has been leveraged in numerous one-shot and gated web-exploitation campaigns, delivered through a mix of the usual malvertising networks and compromised websites.


A backdoor also known as: Trojan.Skeeyah.8391 Trojan.Win32.Drop.bbwlfj Trojan.MulDrop4.627 TR/MiniMal.A.120 Trojan.Graftor.D4750 W32/Redosdru.BED!tr


A backdoor also known as: TrojanDownloader.Tinyloader Trojan.Zusy.D258DB Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Tiny.dztpub Trojan.Win32.Tiny TrojanDownloader:Win32/Tinyloader.D Trj/CI.A Win32.Trojan.Crypt.Wrqf


A backdoor also known as: Trojan.Orbus.S11689 Trojan.Zusy.DE453 W32/Trojan2.OGNI Backdoor.Salgorea Win32/Tnega.WCBBKMB TROJ_CUEGOE.SM Win.Trojan.Cuegoe-6336261-0 Application.Win32.Amonetize.NE TROJ_CUEGOE.SM W32/Trojan.WOEU-3966 TR/Zusy.htd.1 Trojan.Dropper Trojan.Zusy!G5SenpWt4dI W32/Salgorea.C!tr Backdoor.Win32.OceanLotus.X


A backdoor also known as: TrojanPWS.AutoIt.Zbot.S Win32.Trojan.WisdomEyes.16070401.9500.9823 W32/Trojan.FKJB-3819 Trojan.Win32.Autoit.abnef BehavesLike.Win32.Dropper.bh DR/Autoit.dhgia TrojanDownloader:VBS/Banload.BEP Trojan.Win32.Autoit.abnef Trj/CI.A W32/Injector.DMUI!tr Win32/Trojan.3cd


A backdoor also known as: MSIL.Trojan.Injector.q TrojWare.MSIL.Injector.AB Trojan.Starter.4871 BehavesLike.Win32.Ransomware.ch W32/Trojan.QQTT-3117 Trojan:MSIL/Ranos.A Trojan.Msil Win32/Trojan.ead


A backdoor also known as: Trojan.Zusy.D1BC52 Win32.Trojan.WisdomEyes.16070401.9500.9998 Backdoor.Memsyl Trojan.Win32.Inject1.dkmaoo Trojan.Inject1.45689 Trojan.Injector.Win32.256336 Trojan.MSIL.Inject Trojan[Dropper]/Win32.Injector Dropper/Win32.Necurs.R121870 Trojan.JobLaunch.ODB Trj/CI.A Trojan.Injector!pUXRB6SMd/g


Alibaba researchers then posted an analysis report on the malware, giving it the name XcodeGhost.


A backdoor also known as: Win32.Trojan.Bayrob.c W32/Trojan.RXRB-1881 Trojan.Win32.Dwn.eeedhz Trojan.Win32.Z.Bayrob.1075712.R Trojan.DownLoader22.1800 BehavesLike.Win32.Trojan.tc TR/Nivdort.knzgo Trojan:Win32/Nivdort.A Trojan.Kazy.DC0934 Trojan/Win32.Nivdort.C1321145 Trojan.Win32.Bayrob W32/Bayrob.BL!tr Win32/Trojan.f19


FireEye believes that two actors – Turla and an unknown financially motivated actor – were using the first EPS zero-day CVE-2017-0261, and APT28 was using the second EPS zero-day CVE-2017-0262 along with a new Escalation of Privilege EOP zero-day CVE-2017-0263.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9946 Trojan.Win32.Shifu.aoc Packed.Win32.TDSS.~AA Packed:W32/PeCan.A FDOS.Chalcol BehavesLike.Win32.Virut.cc Dos.Chalcol.a DoS:Win32/Chalcol.A Trojan.Win32.Shifu.aoc DoS.Chalcol Win32/DoS.Chalcol.A Win32.Trojan.Chalcol.Wpsv DoS.Win32.Chalcol Win32/Trojan.DoS.0cc


This vulnerability allows an attacker to escape the Internet Explorer sandbox with a VBScript script and execute an arbitrary binary file downloaded from the Internet.


Since first writing about the discovery of HDDCryptor back in September, we have been tracking this ransomware closely as it has evolved.


While there are many distinct malware families that scrape unencrypted process memory to obtain cards, some of these malware capabilities overlap with generic information stealing trojans such as Flokibot that obtain and exfiltrate HTTPS GET and POST data and other materials from compromised machines.


Magnitude EK is notorious for distributing the Cerber ransomware specifically to certain geolocations, and in particular South Korea, via its own gate, called Magnigate.


A backdoor also known as: Trojan.Bepush.H3 Dropper.Dapato.Win32.26115 Win32.Trojan.WisdomEyes.16070401.9500.9850 TROJ_BEPUSH_EK040412.UVPM Trojan.Win32.Dapato.dzszpp Trojan.Win32.Z.Bepush.943616.C Trojan.DownLoader14.14903 TROJ_BEPUSH_EK040412.UVPM BehavesLike.Win32.Backdoor.dh Trojan.Win32.Bepush TR/Dropper.A.7849 MSIL/Dropper.UTIT!tr Trojan[Dropper]/Win32.Dapato Trojan.Zusy.D262FF Trojan:MSIL/Bepush.H TrojanDropper.Dapato Win32.Trojan-dropper.Dapato.Hsik Trojan.DR.Dapato!MYHy5uvhZGg Trj/CI.A


Talos first analyzed this threat in our 2020 blog post, highlighting its large repertoire of modules, multiple methods of spreading, and continuous development.


In this situation, the threat actors decided to take advantage of this behavior by using Search Engine Optimization SEO to make their malicious links more prevalent in the search results, enabling them to target users with the Zeus Panda banking Trojan.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9976 Trojan.Farfli Win32/Covesmer.AT TROJ_FARFLI.XM Html.Trojan.RootkitVimponey-1 TrojanDownloader:Win32/Vimponey.A Trojan.Win32.Downloader.56320.BV Trojan.NtRootKit.2772 TROJ_FARFLI.XM Trojan.Graftor.D2B9F3 TScope.Malware-Cryptor.SB Win32/Trojan.d21


In the end, I bring considerations and reflections on OTP Tokens effectiveness as a second factor authentication solution.


A backdoor also known as: Trojan.Dropper.Interlac.1.0.B Trojan-Dropper.Win32.Interlac.10!O TrojanDropper.Interlac Dropper.Interlac.Win32.61 Trojan/Dropper.Interlac.10.b TROJ_INTERLAC.B W32/Trojan.PMPA-6139 Win32/Interlaced.10.B Win.Dropper.Delf-619 Backdoor.Bifrose Backdoor.Win32.Bifrose.te Trojan.Dropper.Interlac.1.0.B Trojan.Win32.Delf.hitv Backdoor.Win32.Bifrose.23040.R TrojWare.Win32.TrojanDropper.Interlac.B Trojan.KillFiles Trojan-Dropper.Win32.Interlac.B W32/Trojan.FIF TrojanDropper.Interlac.10.b TR/Drop.Inte.10.b.3 Trojan[Backdoor]/MSIL.Bladabindi.as TrojanDropper:Win32/Interlac.B Trojan.Dropper.Interlac.1.0.B Backdoor.Win32.Bifrose.te Trojan.Dropper.Interlac.1.0.B Trojan/Win32.KillFiles.C37985 Trojan.Dropper.Interlac.1.0.B Trojan.Dropper.Interlac.1.0.B Trj/Interlac.A Win32/TrojanDropper.Interlac.10.B


A backdoor also known as: W32.Rycii.Worm Worm/W32.Nency.229376 Worm.Win32.VB!O Worm.VB.Win32.295 Trojan.Heur.EE8D5F Win32.Trojan.WisdomEyes.16070401.9500.9987 Win32/Shur.A WORM_VB.FNX Worm.Win32.VB.cj Trojan.Win32.VB.ntmf Worm.Win32.VB.229376.D Worm.Win32.VB.~FF Win32.HLLW.Brontok WORM_VB.FNX BehavesLike.Win32.Vilsel.dm Worm.Win32.VB Worm/VB.ca WORM/Bugus.A Worm/Win32.VB.cj Worm.VB.cj.kcloud Trojan:Win32/Brontok.A Worm.Win32.VB.cj Trojan.VBRA.08344 I-Worm.VB.CJ Win32.Worm.Vb.Pkhb


Changes include an increase in the quantity of injection varieties, as well as payloads deviating from the standard SocGholish Fake Update JavaScript packages.


In addition we were also able to resolve the hosting IP 212.192.14.3 as well as the ASN AS39144 located in the United Kingdom to all registered domains.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9526 Win.Worm.VB-698 BehavesLike.Win32.Autorun.dt W32.W.Otwycal.l4av Win32/RiskWare.PEMalform.E Trojan-Banker.Win32.Bancos


A backdoor also known as: W32/Opanki.worm Backdoor.SDBot W32.W.Pakes!c Win32.Trojan.WisdomEyes.16070401.9500.9915 W32/Opanki.AY Backdoor.Sdbot Win.Trojan.Pakes-927 Backdoor.Win32.IRCBot.cq Trojan.Win32.Pakes.flbf Worm.Win32.IM-Pakes.150528 Worm.Win32.Oscarbot.BL BackDoor.IRC.Sdbot.170 Worm.Pakes.Win32.1 BehavesLike.Win32.Sdbot.cc W32/Opanki.NEXW-4186 Backdoor/IRCBot.etu WORM/Pakes.A Worm.Pakes.kcloud Backdoor.Win32.IRCBot.cq Worm/Win32.IRCBot.C2420 SScope.Backdoor.Sdbot Backdoor.SDBot Trj/Pakes.EB Win32/Oscarbot.BL Win32.Worm-im.Pakes.Aexo Worm.IRCBot!NcS/fGqoMio Backdoor.Win32.Aimbot W32/Opanki!worm.im


At the time of that discovery, the latest versions we had seen were 1.5.x, months before.


A backdoor also known as: Trojan/PSW.Sagic.15.d Win32/PSW.Sagic.15.D W32/Packed_Mew.C TSPY_SAGIC.X Win32.Stration Trojan.Spy-6657 TrojWare.Win32.PSW.Sagic.D Trojan.DownLoader.5739 TR/PSW.Sagic.F Win32/Sagic.F PWS:Win32/Sagic.F Trojan.PSW.Sagic.15.e W32/Sagic.D!tr.pws Trj/Sagic.L


This is the first time that we have seen Cerber distributed via the use of WSFs.


A backdoor also known as: Backdoor.Goicu.A BackDoor-ANF.cli BKDR_NETTROJAN.A BKDR_NETTROJAN.A Win.Trojan.Nettrojan-1 Backdoor.Goicu.A Backdoor.Win32.NetTrojan Backdoor.Goicu.A Trojan.Win32.NetTrojan.bhgtue Backdoor.Win32.NetTrojan.518144 Backdoor.W32.NetTroj!c Backdoor.Goicu.A Backdoor.Win32.DNetTrojan.A Backdoor.Goicu.A Backdoor.NetTrojan.Win32.4 BackDoor-ANF.cli W32/Risk.VTVG-6810 Trojan/NetTrojan.c BDC/NetTrojan.Cli Trojan[Backdoor]/Win32.NetTrojan Backdoor.Goicu.A Backdoor.Win32.NetTrojan Backdoor.Goicu.A Win32/DNetTrojan.A Win32.Backdoor.Nettrojan.Tcmd Backdoor.ANF.A W32/BDoor.NetTrojan!tr


A backdoor also known as: Trojan.Zusy.D36A22 Win32.Trojan.WisdomEyes.16070401.9500.9942 Backdoor:MSIL/Draliz.A Trj/GdSda.A PUA.MSIL.NetSeal


A backdoor also known as: W32.KotispaLTL.Trojan Trojan/Glupteba.ao W32/Trojan2.PAMI HT_GLUPTEBA_GA310456.UVPM Win32.Trojan-Downloader.Glupteba.A Trojan.Win32.Glupteba.egxnjb Trojan.Glupteba.Win32.3453 HT_GLUPTEBA_GA310456.UVPM W32/Trojan.NEJE-6779 TrojanProxy.Glupteba.vg TR/ATRAPS.hbngn Trojan[Proxy]/Win32.Glupteba Trojan.Zusy.D33746 Trojan/Win32.Glupteba.C1592487 TrojanProxy.Glupteba Trj/GdSda.A Trojan.PR.Glupteba! Trojan.Win32.Glupteba W32/Glupteba.AO!tr


A backdoor also known as: Trojan.Sabresac.A5 Adware.Elex Trojan.Sabres.Win32.1 Troj.W32.Excalibur.tnrv Trojan/Sabresac.a Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Win32.Sabres.h TrojWare.Win32.Excalibur.A BehavesLike.Win32.Adware.fm Adware.Elex/Variant Trojan.Win32.Sabres.h Trojan.Excalibur Trj/GdSda.A Trojan.Zusy.D2E5F4 Win32.Trojan.Sabres.Aenw Trojan.Win32.Sabresac Win32/Trojan.6a0


As the development phase supposedly ended, malware started spreading from India, the United States and Israel to other countries around the globe.


In recent years, the AgentTesla secret-stealing Trojan has continued to be active, and Antiy CERT has repeatedly monitored attacks targeting domestic government, enterprise institutions, and colleges and universities to deliver this secret-stealing Trojan.


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G Virus.Virut.Win32.1938 W32.Virut.CF Win32/Virut.17408 PE_VIRUX.Q Win.Trojan.Virut-377 Virus.Win32.Virut.q Virus.Win32.Virut.hpeg W32.Virut.l5he Virus.Win32.Virut.Ce Win32.Virut.5 PE_VIRUX.Q Win32/Virut.bn Virus/Win32.Virut.ce Win32.Virut.cr.61440 Virus:Win32/Virut.BN Virus.Win32.Virut.q Win32/Virut.F Virus.Virut.13 Win32/Virut.NBP Backdoor.Win32.DsBot W32/Virut.CE W32/Sality.AO Win32/Virus.VirutChangeEntry.H


A backdoor also known as: W32.MspassHDK.Trojan Abuse-Worry/W32.Messen.64000 PSWTool.Win32.Messen!O Trojan.Passviewc Win32.Trojan.WisdomEyes.16070401.9500.9571 W32/Trojan.RJEU-3073 not-a-virus:HEUR:PSWTool.Win32.PassView.c Riskware.Win32.Messen.wcor Trojan.Inject1.34913 Tool.Messen.Win32.113 W32/Trojan2.GXAC TrojanDropper.Injector.bilf Trojan[PSWTool]/Win32.Messen Application.Heur.ED65B4 Trojan.Win32.PSWIMMultiPass.61996 not-a-virus:HEUR:PSWTool.Win32.PassView.c Unwanted/Win32.Messenpass.R46038 PUP.Optional.MessenPass Riskware.PSWTool! Win32/Application.BO.08a


A backdoor also known as: W32.OnGamesLT031012KGHN.Worm Worm.Win32.AutoRun!O Trojan.Finodes.BB5 W32/Autorun.worm.ht Worm.AutoRun Worm.AutoRun.Win32.46218 Trojan.Strictor.DEE4 W32.SillyFDC Win.Worm.Autorun-10000 Worm.Win32.AutoRun.cxps Trojan.Win32.AutoRun.rfaml Worm.Win32.A.AutoRun.117760.W Trojan.Win32.FakeFolder.bbc Win32.HLLW.Autoruner1.889 BehavesLike.Win32.PWSZbot.dz Worm/AutoRun.ahpl TR/Finodes.B.406 Worm/Win32.AutoRun Trojan:Win32/Finodes.B Worm.Win32.AutoRun.cxps Worm/Win32.AutoRun.R22156 Worm.AutoRun Trojan.Zusy Worm.AutoRun!7DcK6jk8E7A Worm.Win32.AutoRun W32/Autorun.CXP!tr


A backdoor also known as: Win32.Worm.P2P.Tibick.D W32/Tibick.d Worm.P2P.Tibick!vdEsmQVVXQU W32/Tibick.C@p2p W32.Tibick W32/Tibick.C Win32/Tibick.E WORM_TIBICK.F P2P-Worm.Win32.Tibick.d Win32.Worm.P2P.Tibick.D Worm.Win32.Tibick.36222 Worm.Win32.Tibick.D Win32.Worm.P2P.Tibick.D Win32.HLLW.Tibic Worm/Tibick.d WORM_TIBICK.F P2P-Worm.Win32.Tibick.D!IK Worm/P2P.Tibick.c Worm:Win32/Tibick.D Win32.Worm.P2P.Tibick.D W32/Tibick.C@p2p Win32/Tibick.worm.36248 Win32/Tibick.D Worm.P2p.Tibick.f P2P-Worm.Win32.Tibick.D W32/Tibick.C!worm.p2p Worm/Tibick.E W32/Tibick.B.worm


A backdoor also known as: W32.OnlineGameWRAL.Trojan Win32.Trojan.WisdomEyes.16070401.9500.9976 W32/Trojan.PUJS-2392 Win32/Cropo.A Win.Trojan.Small-7581 Trojan.KillProc.1539 W32/Trojan.BXFW Trj/SmallProxy.AB


This email was then forwarded to several people, with the malicious Excel file attached.


A backdoor also known as: HW32.Packed.CB0B Backdoor.RCServ Backdoor.RCServ.Win32.44 Backdoor.W32.Rcserv!c Backdoor/RCServ.c Backdoor.RCServ Win.Trojan.RCServ-1 Backdoor.RCServ Backdoor.Win32.RCServ.c Trojan.Win32.RCServ.dmhw Backdoor.Win32.A.RCServ.404480[UPX] BackDoor.RC BehavesLike.Win32.Downloader.cc Backdoor:Win32/RCServ.C Backdoor.Win32.RCServ.c Bck/RCServ.L Win32.Backdoor.Rcserv.Lohl Backdoor.RCServ!QJAExtCJ+QQ


A backdoor also known as: Exploit.PDF.AC Exp.SWF.CVE-2012-0754 Exploit.PDF.AC Trojan.Pidief SWF/Exploit.CVE-2011-0611.C TROJ_PIDIEF.SMBD Exploit.JS.Pdfka.dqw Exploit.PDF.AC PDF.Z.CVE-2011-0611.411562.A[h] Exploit.SWF.CVE-2011-0611.t Exploit.PDF.AC Exploit.PDF.AC Exploit.PDF.2177 HEUR_SWFEXP.W Exploit.CVE-2011-0611.g EXP/CVE-2011-0611.F Trojan[Exploit]/SWF.CVE-2011-0611.s Exploit:SWF/CVE-2011-0611.I Exploit.JS.Pdfka.dqw!c Exploit.JS.Pdfka.dqw Exploit.PDF.AC Exploit.PDF.AC Exploit.CVE2011-0611 Exploit.JS.Pdfka SWF/CVE20110611.fam!exploit Exploit_c.UAO


Dyre is configured to defraud the customers of more than 1,000 banks and other companies worldwide.


We previously outlined a spam campaign that delivered FAKEGLOBE and CERBER ransomwares.


It is likely the vulnerability will be documented in full detail over the coming days.


Back in February, the ThreatConnect team conducted an in-depth independent analysis of the Anthem breach, finding connections to amorphous Chinese APT activity.


Haima exactly does that, and more.


This study on an active campaign delves into the structure, goals, and requirements of the organizations involved, and provides an opportunity to conduct wider intelligence analysis and insights in the development of effective countermeasures.


A backdoor also known as: Trojan-Downloader.Win32.Small!O TrojanDownloader.Tearsp.AA2 Trojan/Downloader.Small.ahu Win32/Startpage.MF TROJ_SMALL_00000cc.TOMA Win.Trojan.Startpage-37 Trojan-Notifier.Win32.Small.a Trojan.Win32.Small.vkiie Trojan.Win32.A.Downloader.56724 TrojWare.Win32.TrojanDownloader.Small.AHU Trojan.MulDrop2.15120 Downloader.Small.Win32.40751 BehavesLike.Win32.Downloader.qt TrojanDownloader.Small.mmb W32.Trojan.Downloader.Small TR/StartPage.sc Trojan[Downloader]/Win32.Small Trojan:Win32/Symesta.B Downloader/Win32.Small.R5459 Trojan.Win32.Small.102210 Trj/Downloader.ABR Win32/TrojanDownloader.Small.AHU W32/Small.AHU!tr.dldr


A backdoor also known as: Backdoor/W32.Bandok.61952 Backdoor.Trojan Win32/Banbot.A Trojan.Bandook Backdoor.Win32.Bandok.h Backdoor.Win32.Bandok!IK Backdoor.Win32.Bandok.H Trojan.DownLoader.4293 Backdoor/Bandok.d Backdoor:Win32/Bandok.E Win-Trojan/Bandok.61952 Win32/Bandok.H Backdoor.Win32.Bandok.h Backdoor.Win32.Bandok W32/Bandok.H!tr.bdr BackDoor.Bandok.F Bck/Bandok.R


VENOM features similar mechanisms to the tools used during the Freenode intrusion in 2014 external link.


A backdoor also known as: W32.FamVT.ExpiroPC.PE Win32.Trojan.WisdomEyes.16070401.9500.9932 Trojan.MulDrop.2729 BehavesLike.Win32.Worm.dc TrojanDropper.Delf.cge TrojanBanker.Banker Trojan-Downloader.Win32.Delf W32/Banker.AFJ!tr Win32/Trojan.6cc


A backdoor also known as: W32.SoaloaE.Trojan Trojan/W32.Buzus.239324 Trojan.VBCrypt.MF.75 Trojan/Injector.bggr Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.SUAD-6922 Trojan.Win32.Buzus.osiq Trojan.Win32.Buzus.ebkods Win32.Trojan.Buzus.Lneb Trojan.PWS.Panda.4624 Trojan.Buzus.Win32.120917 BehavesLike.Win32.PWSZbot.dc Trojan/Buzus.bopu TR/Dropper.VB.ssypj W32/Injector.BJHT!tr Trojan/Win32.Buzus Trojan.Ransom.28 Trojan.Win32.Buzus.osiq Dropper/Win32.Necurs.R110132 Trojan.Crypt.NKN Trojan.Buzus!+gYkRxVVqlQ Trojan.Win32.Scarsi Trojan.Buzus


These backdoors are described in this part of the article.


A backdoor also known as: Trojan/Regiskazi.a TROJ_SPNR.11AG15 Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_SPNR.11AG15 Trojan.Win32.Regiskazi.dmdtgx Trojan.DownLoader12.16045 BehavesLike.Win32.Worm.hh Trojan.Heur2.JP.E61E47 Backdoor:Win32/Regiskazi.A Trojan/Win32.Downloader.C45921 Trj/CI.A Trojan.Regiskazi! Trojan.Win32.Regiskazi W32/Regiskazi.A!tr


Currently this banker only have targets in Poland.


A backdoor also known as: Exploit.CVE-2014-1761.C Exp.RTF.CVE-2012-0158.A Exploit-CVE2012-0158.n Win32.Exploit.CVE-2012-0158.i Trojan.ZHPA-6 Trojan.Mdropper TROJ_ARTIEF.UK Exploit.CVE-2014-1761.C Exploit.Win32.CVE-2012-0158.j Exploit.CVE-2014-1761.C Exploit.Rtf.Heuristic-rtf.dinbqn Exploit.S.CVE-2012-1761.619765 Exploit.MSWord.CVE-2014-1761.k!c Exploit.CVE-2014-1761.C Exploit.CVE-2014-1761.7 Exploit.CVE.MacroWord.257 TROJ_ARTIEF.UK Exploit-CVE2012-0158.n Exploit.CVE-2012-0158.c EXP/CVE-2014-1761.C.619765 Trojan[Exploit]/Office.CVE-2012-0158 Exploit.CVE-2014-1761.C Exploit.CVE-2014-1761.C Word.Exploit.Cve-2014-1761.Dwsn Trojan.Exploit


Unit 42 for the past three months has been tracking a banking Trojan targeting victims in Brazil and the United States.


A backdoor also known as: W32.TsagaaSAJ.Trojan Worm.AutoRun.FLD Trojan/AutoRun.VB.bfc Trojan.Heur.E08AD6 Win32.Worm.AutoRun.bz W32.SillyFDC Worm.Win32.AutoRun.HMT Win32.HLLW.Autoruner2.18557 Worm.Win32.AutoRun TR/Razy.xdwer HackTool:Win32/Virledi.A Trojan/Win32.Zbot.C401270 W32/VB.BFC!worm


A backdoor also known as: W32.CpqEasyBttn.Worm Dropped:Win32.Worm.VB.NRV Email-Worm.Win32.VB!O Worm.Flewon.S349523 Win32.Worm.VB.ji Hacktool.Spammer Win32/Flewon.E WORM_VB.DHQ Win.Worm.Liamo-1 Dropped:Win32.Worm.VB.NRV Email-Worm.Win32.VB.cb Dropped:Win32.Worm.VB.NRV Trojan.Win32.VB.hpnv W32.W.AutoRun.l6mI Win32.Worm-email.Vb.Wqda Dropped:Win32.Worm.VB.NRV Dropped:Win32.Worm.VB.NRV Trojan.PWS.Asterie Worm.VB.Win32.303 WORM_VB.DHQ BehavesLike.Win32.VBObfus.ch TrojanClicker.Qihai.aq TR/Spy.Vwealer.KZ.33 Worm[Email]/Win32.VB Win32.Worm.VB.NRV I-Worm.Win32.VB.94208.E Email-Worm.Win32.VB.cb Worm:Win32/Flewon.A HEUR/Fakon.mwf Dropped:Win32.Worm.VB.NRV Trojan.VBRA.010583 Win32/VB.NGN I-Worm.VB.XYH Email-Worm.Win32.VB.cb W32/VB.CB@mm W32/MadCoffee.B.worm Win32/Trojan.Spy.bc3


A backdoor also known as: W32.eHeur.Malware08 Backdoor.Lecna.Q5 Trojan.SelfDelete Win32.Worm.ShipUp.h W32/Trojan-Gypikon-based.DM2!Ma Trojan.Win32.CFI.ddcdum TrojWare.Win32.ShipUp.AR Trojan.KillFiles.16512 BehavesLike.Win32.MultiPlug.dz W32/Trojan-Gypikon-based.DM2!Ma BDS/Taranis.4032 Backdoor:Win32/Lecna.Q!dha W32.W.AutoRun.m652 Trojan/Win32.Cossta.R120893 Win32/ShipUp.B Worm.Win32.ShipUp


A backdoor also known as: Trojan/Soul.ag Trojan.Heur.EEED6D Win32.Trojan.WisdomEyes.16070401.9500.9993 Win.Trojan.Crypted-3 Trojan.Win32.Pincav.bqfmw Trojan.Win32.Invader.blqtgb Win32.Trojan.Pincav.Dygr Trojan.Xispy Trojan.Xispy Trojan.Small.gr TR/Xispy.E.8 Troj.W32.Pincav.bqfmw!c Trojan.Win32.Pincav.bqfmw Trojan/Win32.IRCBot.C221390 Trojan.Soul!ykk6w7k8W/s Trj/Soul.I Win32/Trojan.Spy.620


It is by no means a new threat, but it is still actively used and developed and worthy of a breakdown in an effort to defend against it.


In this article we will describe the process of extracting the final payload out of it's cover.


Since March 2016, the group has appeared to mostly focus on organizations in Hong Kong, sending malicious emails to targets as recently as August 4, and attempting to spread within compromised networks in order to steal information.


Linux Trojan is designed to set up a SOCKS5 proxy server on the infected computer on the basis of the freeware source codes of the Satanic Socks Server.


Since HackingTeam implants are built on-demand for each target, we wanted to take a closer look: to see how it works and what its functionality reveals about the possible interest of the attackers behind this latest Backdoor.


A backdoor also known as: PUA.Remadmin.S141625 Win32.Trojan.WisdomEyes.16070401.9500.9757 not-a-virus:RemoteAdmin.Win32.RMS.pr Trojan.Win32.RemoteAdmin.ekeqcb Trojan.MulDrop7.11923 BehavesLike.Win32.BadFile.th Trojan.Win32.RA W32/Trojan.BHMN-7604 W32.Rms.Pr TR/AD.RATBackdoor.fustx RiskWare[RemoteAdmin]/Win32.RMS.nd not-a-virus:RemoteAdmin.Win32.RMS.pr Backdoor.RMS Win32/RA-based.NFV Riskware.RemoteAdmin.DJ Trj/CI.A


A backdoor also known as: W32.MiadheardLTS.Trojan Rootkit.Mask.A Trojan.Seedna Backdoor.Weevil.B BKDR_CARETO.A Rootkit.Mask.A Trojan.Win32.SGH.ay Rootkit.Mask.A Trojan.Win32.Heap.ctohpz Troj.W32.SGH.ay!c Win32.Trojan.Sgh.Pbpi Rootkit.Mask.A Backdoor:W32/Mask.A Trojan.SGH.Win32.2 BKDR_CARETO.A Backdoor.Mask W32/Backdoor.TAHG-4259 Trojan.Win32.c W32.Trojan.Careto TR/Heap.A.3 Trojan/Win32.SGH Rootkit.Mask.A Trojan.Win32.SGH.ay Trojan:WinNT/Seedna.A Trojan/Win32.Careto.R97384 Backdoor.Mask Trj/CI.A Win32/Appetite.C Trojan.SGH! Win32/Trojan.fa7


A backdoor also known as: I-Worm.Naked.A Worm/W32.Naked.73728 Email-Worm.Win32!O W32.Naked I-Worm.Naked.A Worm.Naked.Win32.1 I-Worm.Naked.A W32/Nakedwife.A@mm W32.Naked@mm WORM_NAKED.A Win.Worm.Naked-1 I-Worm.Naked.A Email-Worm.Win32.Naked I-Worm.Naked.A Trojan.Win32.Naked.hbai I-Worm.Win32.Naked I-Worm.Naked.A Win32.HLLW.Naked WORM_NAKED.A Worm.Win32.Naked W32/Nakedwife.A@mm Worm:Win32/Naked.B@mm Email-Worm.Win32.Naked Worm.Naked Win32.Worm-email.Naked.Pdmp I-Worm.Naked.A Win32/Trojan.fc6


A backdoor also known as: Trojan.Flystudio.100458 Win32.Trojan.FlyStudio.oj Win.Worm.Bingd-1 Trojan.Win32.Vilsel.dfmi Trojan.Win32.Winlock.c Worm.Win32.Dropper.RA BackDoor.Pigeon.64233 Packed.Vemply.aph TR/Ransom.MBRLock.usvpx Trojan.Win32.Vilsel.dfmi Backdoor.Hupigon Win32.Outbreak W32/MBRlock.AQ!tr Trojan.Win32.Made.J


A backdoor targetting Linux also known as: TrojanDropper.Linux.Elknot.Y Backdoor.Linux.Mayday!c Linux/Elknot.A Backdoor.Linux.Mayday.g Trojan.Unix.DDoS.dncljq Linux.DDoS.7 Downloader.OpenConnection.JS.96932 ELF/Trojan.CNXM-8 Backdoor/Linux.hx LINUX/Elknot.iyani Linux/Mayday.1128800.E Backdoor.Linux.Mayday.g backdoor.linux.mayday.g Backdoor.Linux.Mayday


The group extensively uses long-running strategic web compromises SWCs, and relies on whitelists to deliver payloads to select victims.


A backdoor also known as: Dropped:Trojan.Zapchas.F IRC/Flood.ev IRC.Zapchast.AQ REG/Zapchast.A W32/Zapchast.CS IRC.Zapchast Backdoor.IRC.Zapchast Dropped:Trojan.Zapchas.F Application.Win32.RiskWare.mIRC.~BAAA Trojan.Zapchas.F IRC.Flood SPR/mIRC-1790464.A.5 REG_ZAPCHAST.BV Riskware.Client-IRC.Win32.mIRC!IK Trojan.IRC.ah Backdoor/IRC.IRC Dropped:Trojan.Zapchas.F REG/Zapchast.A Backdoor.IRC.Zapchast.a IRC/Cloner.AT not-a-virus:Client-IRC.Win32.mIRC REG/Zapchast.4D53!tr.bdr IRC/BackDoor.Flood Bck/MIRCBased.BI


Throughout an attack campaign, actors will continue to develop their tools in an attempt to remain undetected and to carry out multiple attacks without having to completely retool.


With North Korea becoming increasingly isolated from the world economy the likelihood that it will use its cyber capabilities for financial gain grows.


This campaign seems to be old but still running although my infection wasn't being manually controlled at the time.


A backdoor also known as: Spam-Mailbot.m Trojan.Banker.Win32.7151 Backdoor.Trojan Win.Trojan.Banker-16870 Trojan.Packed.515 Trojan/Banker.xd Trojan.ZPACK!RjBLf3GsBZY


A backdoor also known as: Downloader.a!bm3 Trojan/Downloader.Hacyayu.ahz Trojan.DL.Hacyayu!hNU/seEqyqU W32/Shiz.AK TROJ_SHIZ.SMP6 Trojan-Downloader.Win32.Hacyayu.alt Trojan.Packed.20771 TROJ_SHIZ.SMP6 Downloader.a!bm3 TrojanDownloader.Hacyayu.t Win32.TrojDownloader.Hacyayu.kcloud TrojanDownloader:Win32/Hacyayu.A Trojan.Win32.A.Downloader.39157 W32/Shiz.AK TrojanDownloader.Hacyayu.afi Trojan-Downloader.Win32.Hacyayu W32/Shiz.NCF!tr


Recently, Antiy CERT has captured a batch of active hoze mining Trojan horse samples through the wind-catching honeypot system.


The Trend Micro Forward Looking Threat Research team recently obtained samples of a new rootkit family from one of our trusted partners.


Files Description CMDS * .txt Text files with commands to execute supersu.apk SuperSU ( eu.chainfire.supersu , https : //play.google.com/store/apps/details ? id=eu.chainfire.supersu ) tool 246.us us.x SuperSU ELF binaries supersu.cfg supersu.cfg.ju supersu.cfg.old SuperSU configs with spyware implant mention bb.txt BusyBox v1.26.2 ELF file bdata.xml Config file for excluding malware components from Android battery saver feature Doze bdatas.apk Main implant module com.android.network.irc.apk Start implant module MobileManagerService.apk ASUS firmware system component ( clean ) mobilemanager.apk Corrupted archive privapp.txt Looks like a list of system applications ( including spyware components ) from the infected device run-as.x run-as.y Run-as tool ELF file SuperSU config fragment for implant components and the busybox tool supersu.cfg : This config allows the implant to use all root features silently .


The primary samples examined appear in the wild with filenames mimicking that of Adobe s Content Management System and offers a range of commands typical of Remote Access Tools: file upload, file download, file execution, and command execution.


On May 18, the authors of XData ransomware ran the massive attack against Ukrainian users supposedly leveraging the EternalBlue exploit as well as an ordinary spearphishing email delivery method.


Dubsmash is a mobile app to create short selfie videos dubbed with famous sounds.


A backdoor also known as: Heur.Win32.VBKrypt.1!O Trojan/Dropper.VB.nxw Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Pws.BCWZ Win.Spyware.47661-2 Trojan-Dropper.Win32.Dorifel.atjn Win32.Trojan-dropper.Dorifel.Akos TrojWare.Win32.VB.fmmu Trojan.DownLoader9.62284 BehavesLike.Win32.Trojan.gh Trojan-Dropper.Win32.Duon W32/PWS.IDDR-8868 Trojan.Heur.E019B0 Trojan-Dropper.Win32.Dorifel.atjn Malware-Dropper.VB.WLCrypt


A backdoor also known as: Script.SWF.Cxx+.C173 SWF.Kit.Angler.G Exploit-SWF.x Bloodhound.Flash.31 SWF/Exploit.CVE-2015-3090.A SWF_EKSPLOYT.ED Swf.Packer.Angle-1 Script.SWF.Cxx+.C173 Script.SWF.Cxx+.C173 Script.SWF.Cxx+.C173 Script.SWF.Cxx+.C173 Exploit.SWF.438 SWF_EKSPLOYT.ED BehavesLike.Flash.Exploit.kb EXP/CVE-2015-3090.AU Exploit:SWF/Netis.B Script.SWF.Cxx+.C173 Script.SWF.Cxx+.C173 SWF.Win32.Script.800529 Exploit.SWF SWF/ExKit.AQ!exploit


This article will discuss the malware delivered from that exploit kit.


A backdoor also known as: Worm.Win32.VBNA.bvts Trojan.Win32.VB.exmtrp Win32.Worm.Vbna.Wqdi Trojan.MSILPerseus.D2341B Worm.Win32.VBNA.bvts Worm:Win32/Esfury.T TScope.Trojan.MSIL Trj/CI.A Win32/Trojan.Dropper.6ac


An old banking Trojan has been operating in Europe on a low level has spiked in activity after migrating to Japan.


This article revolves around the macro tricks it uses to stall analysts, and new commands that it utilizes to better persist on infected devices.


Recently we were able to observe these actors making modifications to their ClaySlide delivery documents in an attempt to evade antivirus detection.


Within this blog post, a payload containing a function named forkmeiamfamous' was mentioned.


A backdoor also known as: Win32.Lewor.B@mm Win32.Lewor.B@mm Worm.Lewor.Win32.28 W32/Lewor.b Win32.Lewor.E2C45E Win32.Trojan.WisdomEyes.16070401.9500.9944 W32.HLLW.Leox Win32.Lewor.B@mm Win32.Lewor.B@mm Trojan.Win32.Lewor.gptp W32.W.Lewor.b!c Win32.Lewor.B@mm Win32.Lewor.B@mm Trojan.PWS.Legmir BehavesLike.Win32.Pykse.kc I-Worm/Lewor.b Worm:Win32/Lewor.B@mm W32/Lewor.AP.worm Worm.Lewor!B42TpjAm9iw Trojan-Banker.Win32.Banker W32/GamePSW.B@mm


The exploit has since been added into the Angler Exploit Kit and integrated into Metasploit.


A backdoor also known as: Trojandownloader.Kagayab Trojan.Razy.D18A59 Win32.Trojan.WisdomEyes.16070401.9500.9998 BehavesLike.Win32.Dropper.mm W32/Trojan.GGCJ-3154 TrojanDownloader:Win32/Kagayab.A Trj/GdSda.A Win32/Trojan.a98


A backdoor also known as: W32.HfsAutoB.12BD Trojanspy.Babar Trojan.Badbar Win32.Trojan.Babar.A Trojan-Spy.Win32.Babar.a Trojan.Win32.Babar.dqhfcx Troj.Spy.W32!c Trojan.Babar.1 Trojan.Babar.Win32.3 BehavesLike.Win32.Trojan.fc TrojanSpy.Babar.c TR/AD.Babar.royis Trojan.Zusy.D42EE8 PWS:Win32/Babar.A!dha Trj/GdSda.A Win32.Trojan-spy.Babar.Dwsy Win32/Trojan.Spy.8fc


A backdoor also known as: W32.DaltetoD.Trojan Trojan/Fbphotofake.b Win32.Trojan.WisdomEyes.16070401.9500.9992 HV_CARDPAY_CA222928.TOMC Win.Trojan.Ag-4254306-1 Trojan-Dropper.Win32.FrauDrop.cth Trojan.Win32.Drop.mssht TrojWare.Win32.Downloader.Fraudload.AB Trojan.AVKill.14860 Dropper.FrauDrop.Win32.3001 BehavesLike.Win32.PWSZbot.fc Trojan.Win32.Fifesock W32.Malware.Downloader Trojan[Dropper]/Win32.FrauDrop Trojan-Dropper.Win32.FrauDrop.cth Trojan/Win32.CardPay.R21713 TrojanDropper.FrauDrop


A backdoor also known as: Trojan.Mauvaise.SL1 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Ddosaz.elmrbx TrojWare.Win32.ServStart.DQ Trojan.DownLoader23.31518 BehavesLike.Win32.Backdoor.kh Trojan.Graftor.D53379 Trojan:Win32/Ddosaz.A BScope.TrojanDDoS.Macri Trj/GdSda.A


Palo Alto Networks has observed a recent high-threat spam campaign that is serving malicious macro documents used to execute PowerShell scripts which injects malware similar to the Ursnif family directly into memory.


A backdoor also known as: W32.WintaskLTE.Trojan Win32/Bancos.ABHY Trojan.Phisher.G Trojan.Dynamer.D9 Trojan.Phisher.G Troj.PSW.PHP.AccPhish.lstI Win32.Trojan.WisdomEyes.16070401.9500.9987 PHP/PSW.Phishack.AT Trojan.Phisher.G Trojan.Phisher.G Trojan.PWS.Stealer.895 BehavesLike.Win32.PWSMmorpg.vc Trojan/PSW.VKont.pq TR/Spy.PHP.psb Trojan[PSW]/PHP.AccPhish.rr Trojan.Phisher.G Trojan:Win32/Phishacco.A Trojan.Phisher.G Trj/CI.A Php.Trojan-qqpass.Qqrob.Sxxq Trojan.PHP.PSW W32/AccPhish.EU!tr.pws Win32/Trojan.d71


A backdoor also known as: W32.TenoesaASN.Trojan Worm/W32.WBNA.102405 Win32.Trojan.WisdomEyes.16070401.9500.9978 Worm.Win32.WBNA.oaw Downloader.VB.Win32.98815 BehavesLike.Win32.Downloader.cm Win32.Sality TR/AD.Maywidmzi.brqly TrojanDownloader:Win32/Maywidmzi.A Worm.Win32.WBNA.oaw Worm/Win32.WBNA.C1716518 Worm.WBNA Trj/GdSda.A Win32/TrojanDownloader.VB.QXP Win32.Worm.Wbna.Ects Trojan.DL.VB!tTzkeI6oupQ


Login details are sent to attackers using an HTTP GET connection ONLY once.


A backdoor also known as: Trojan.Lodap Trojan/Exploit.CVE-2010-2568.f TROJ_STUXNET.DX W32.Stuxnet TROJ_STUXNET.DX Win.Trojan.Stuxnet-36 Exploit.Win32.CVE-2010-2568.b Exploit.Win32.CVE20102568f.bkuia Exploit.W32.CVE-2010-2568.f!c Win32.Exploit.Cve-2010-2568.Wopr Exploit.CVE.Win32.14 Trojan.Win32.Exploit Trojan[Exploit]/Win32.CVE-2010-2568 Exploit.Win32.CVE-2010-2568.b Exploit.Stuxnet Trj/ChymineLNK.A Win32/Exploit.CVE-2010-2568 Win32/Trojan.Exploit.406


MrWhite can profile the victim systems for the presence of running POS software before dropping further POS payloads.


A backdoor also known as: HW32.Packed.48F3 Trojan.Kazy.D8696E Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_CRYPCTB.SME Troj.Downloader.W32.FraudLoad.kYSC TROJ_CRYPCTB.SME BehavesLike.Win32.Upatre.tc Trojan:Win32/Triflearch.B Trojan.FakeAV.01657 Win32.Trojan.Crypt.Dzag Trojan.Win32.Crypt Win32/Trojan.8cf


Malicious code identified, simple UDP DDoS attacks recorded.


It steals sensitive information, such as cryptocurrency wallet data, from different applications and uses a file grabber for collecting a predefined list of file types, then exfiltrates them via Telegram.


Forcepoint Security Labs™ have observed today a major malicious email campaign from the Necurs botnet spreading a new ransomware which appears to call itself Jaff peaking within our telemetry at nearly 5m emails per hour.


A backdoor also known as: Trojan/Downloader.Dapato.cjt Trojan.Kryptik!UYVcX29KF20 W32/Krypt.DZ Trojan.Win32.Cleaman!IK TrojWare.Win32.Kryptik.ZLB Trojan.DownLoad2.49842 TR/FakeAV.bzqra TrojanDownloader.Dapato.ace TrojanDownloader:Win32/Cred.B Trojan/Win32.Menti TrojanDownloader.Dapato.cfq Trojan.Win32.Cleaman W32/Kryptik.ACD!tr


PwC's cyber security practice has worked closely with BAE Systems and other members of the security community, along with the UK's National Cyber Security Centre NCSC, to uncover and disrupt what is thought to be one of the largest ever sustained global cyber espionage campaigns in an operation referred to as Operation Cloud Hopper'.


If some malware samples remain simple see my previous diary, others try to install malicious files in a smooth way to the victim computers.


A backdoor also known as: Trojan.Kazy.D55679 Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Win32.Starter.cuyepr Trojan.Starter.2890 BehavesLike.Win32.Trojan.vm Trojan.Dropper MSIL/Injector.WSX!tr Win32/Trojan.e6d


Among their most notable presumed targets are the American Democratic National Committee, the German parliament and the French television network TV5Monde.


BlackEnergy is a Trojan that was created by a hacker known as Cr4sh.


A backdoor also known as: Backdoor.Sylavriu BKDR_SYLAVRIU.SM Win32.Trojan.WisdomEyes.16070401.9500.9996 Trojan.Zbot BKDR_SYLAVRIU.SM Win.Trojan.Torct-1 W32.Trojan.Torct Trojan/MSIL.Crypt Trojan.MSIL.Krypt.2 Backdoor:MSIL/Sylavriu.A Dropper/Win32.Adminuser.R118179 Trojan.MSIL.Crypt Trojan.Crypt!ZlAnMaNuAFw Trj/CI.A


A backdoor also known as: Backdoor.Win32.Redsip!O Trojandropper.Redsip Backdoor.Redsip.k Backdoor.Redsip.Win32.8 Backdoor/Redsip.k Win32.Trojan.WisdomEyes.16070401.9500.9970 W32/Backdoor2.HIOH Hacktool.Keylogger Win32/Redsip.A Backdoor.Win32.Redsip.a Trojan.Win32.Redsip.dcevd Backdoor.Win32.A.Redsip.159744 Backdoor.W32.Redsip.k!c BehavesLike.Win32.Ramnit.ct W32/Backdoor.VDXS-0842 BDS/Redsip.B W32/Redsip.A!tr Trojan[Backdoor]/Win32.Redsip Backdoor.Win32.Redsip.a TrojanDropper:Win32/Redsip.B Trojan/Win32.Redsip.C245513 Backdoor.Redsip Win32/Redsip.AA Win32.Backdoor.Redsip.Amvr Backdoor.Win32.Redsip


Phony Tech Support Scams Now Target Macs


A backdoor also known as: Trojan.Win32.Hexzone.bdlvxl Adware.Margoc MalCrypt.Indus! VirTool.Win32.Obfuscator.a Trojan:Win32/Procesemes.A.dll Trojan/Win32.Xema Adware.Margoc!rem


A backdoor also known as: Ransom.Urausy.E4 Ransom_Urausy.R038C0CB418 Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Ransomlock.Q Ransom_Urausy.R038C0CB418 Trojan.Win32.Winlock.crahoz TrojWare.Win32.FakeAv.ASC Trojan.Winlock.9260 Trojan/Foreign.shn Ransom:Win32/Urausy.E Trojan.Zusy.D10991 Trojan/Win32.Foreign.R84961 SScope.Malware-Cryptor.Hlux Win32/LockScreen.AQD Trojan.Win32.Urausy


In addition, HummingBad installs fraudulent apps to increase the revenue stream for the fraudster.


A backdoor also known as: Win32/SillyDl.XXJ!packed Trojan-Dropper.Win32.Dorifel.acvt Trojan.DownLoader1.46415 BehavesLike.Win32.Adware.cc TrojanDownloader:Win32/Plingky.A Trojan.Heur.EDD31E Trojan-Dropper.Win32.Dorifel.acvt Trojan-Downloader.Win32.Small W32/Dorifel.ACVT!tr


A backdoor also known as: Trojan/Clicker.BHO.ncx Trojan.Zbot Win32/TrojanClicker.BHO.NCX TROJ_SPNR.30BB13 Trojan.Win32.Starter.amcr Trojan.Win32.Starter.dzdloa Win32.Trojan.Starter.Suef TROJ_SPNR.30BB13 BehavesLike.Win32.Downloader.gh TR/Lickore.B.7 W32/TrojanClicker_BHO.NCX PUP/Win32.Msbuyn.N640533768 Trojan:Win32/Lickore.B Win32/Lickore.B Trojan-Clicker.BAHK Clicker.BAHK


The command and control C&C communications for new variants use the same AES256 encryption for any traffic to the attacker's server; in previous variants, only Base64 encoding was used.


Disttrack is a multipurpose tool that exhibits worm-like behavior by attempting to spread to other systems on a local network using stolen administrator credentials.


Since the beginning of January 2017, the BSI, as the national cyber security agency, has been in close contact with the German Bundestag, due to the network traffic of the German Bundestag.


Additionally, when we searched for the decoded string value we found a single search engine result that pointed to a Pastebin page.


First, Winnti uses Cobalt Strike to collect credentials and move laterally.


At the time of investigation this malware was not correctly detected by any existing antivirus engines, and domains / IP s were not found in any commercial threat intelligence feeds.


A backdoor also known as: Trojan.Razy.D31A9 Win32.Trojan.WisdomEyes.16070401.9500.9960 TROJ_HOYGUNER.SM Trojan.Win32.Drop.dhxynu TROJ_HOYGUNER.SM Virus.MSIL W32.Trojan.Dropper Trojan:MSIL/Hoygunver.B


A backdoor also known as: W32.DeadBeef.Worm Worm/W32.AutoRun.175104 Worm.Win32.AutoRun!O Worm.AutoRun.Win32.8121 W32/AutoRun.pv W32.SillyFDC Win32/Wainlas.A WORM_AUTORUN_000002c.TOMA Win.Worm.Autorun-1414 Worm.Win32.AutoRun.pv Trojan.Win32.AutoRun.ltul Win32.Worm.Autorun.Tbim Worm.Win32.AutoRun.~MAA Win32.HLLW.Autoruner.748 WORM_AUTORUN_000002c.TOMA Worm/AutoRun.bhu TR/Drop.AutoRun.BM Worm/Win32.AutoRun Worm.Win32.Autorun.12728 Worm.Win32.AutoRun.pv Worm/Win32.AutoRun.R16694 Worm.AutoRun Worm.Win32.AutoRun W32/AutoRun.NTQ!worm Trj/Debat.A Trojan.PSW.Win32.QQPass.CF


During the WannaCry pandemic attack, CyphortLabs discovered that other threat actors have been using the same EternalBlue exploit to deliver other malware.


Although bitcoin miners have been used by cybercriminals before as a way to monetize their malicious activities, this recent sample MD5: 522f8ba8b2dec299cc64c0ccf5a68000 caught our attention because it is unusually heavy, persistent, and obfuscated.


A backdoor also known as: W32.kowinHA.Worm Backdoor.Win32.Popwin!O Trojan.Heur.amuaxSBiYpji Win32.Trojan.WisdomEyes.16070401.9500.9769 W32.Popwin Win32/Pipown.NW TROJ_NSPAK.A Trojan.Win32.Popwin.jgms Constructor.W32.VB.lgxd Backdoor.Win32.Popwin.~IQ Trojan.Popwin TROJ_NSPAK.A BehavesLike.Win32.Downloader.lc Trojan/PSW.GamePass.pjs Worm:Win32/Winko.A Backdoor.Popwin Worm.Win32.AutoRun W32/Winko.A!tr


The two 0-days in question targeted Adobe Flash and were subsequently labeled CVE-2015-5119 and CVE-2015-5122.


A backdoor also known as: Backdoor.Fakedos.A Backdoor.Fakedos!ktjmxmN20Kc W32/Backdoor.MDB Backdoor.Trojan BKDR_BACKDOOR4.B Backdoor.Win32.Fakedos.a Backdoor.Fakedos.A Backdoor.Fakedos.A Backdoor.Fakedos.A Email-Worm.Win32.GOPworm.196 BDS/Fakedos.A.1 BKDR_BACKDOOR4.B Win32.Hack.Fakedos.a.kcloud Backdoor.Fakedos.A W32/Backdoor.CVVK-7742 Win-Trojan/Fakedos.94208 TScope.Trojan.VB PE:Backdoor.Fakedos.a!1073830334 BackDoor.Fakedos.C


A backdoor also known as: W32.HfsAutoB.44AD Win32.Virus.Downloader.Aojh Trojan-Downloader.Win32.Cekar W32/Noia.B Trj/CI.A Win32/Trojan.dd1


Used in Pawn Storm to target certain foreign affairs ministries, the vulnerability identified as CVE-2015-7645 represents a significant change in tactics from previous exploits.


A backdoor also known as: HW32.Packed.D995 Virus.Win32.Sality!O Backdoor.PMax Trojan.Win32.PMax.deplgs Backdoor.Win32.PMax.atcf MULDROP.Trojan BehavesLike.Win32.Downloader.mc W32/Poweliks.A!tr Trojan.Zusy.D19DC7 Trojan/Win32.VBKrypt Trojan:Win32/Powessere.A Backdoor.PMax Trojan.Poweliks Trojan.Win32.Poweliks.B


Over the past few months, the tr1adx team has been tracking a Threat Actor which we codenamed TelePort Crew.


The infection vector was a drive-by download attack, and the Check Points Threat-Cloud indicates some adult content sites served the malicious payload.


A backdoor also known as: Backdoor.Motd.A Backdoor.Motd.A Trojan.Win32.Malware.a Backdoor.Trojan Backdoor.Motd.A Backdoor.Win32.MOTD Backdoor.Motd.A Trojan.Win32.MOTD.glgl Troj.Spy.W32.Delf.mczC Backdoor.Motd.A Backdoor.Motd.A BackDoor.Motd Backdoor.MOTD.Win32.1 BehavesLike.Win32.Ipamor.hh Backdoor.Win32.Y3KRat Trojan[Backdoor]/Win32.MOTD Backdoor.Motd.A Backdoor.Win32.MOTD Trojan.Win32.Malware.a Backdoor.MOTD


CloudDuke also greatly expands on the Duke group's usage of cloud storage services, specifically Microsoft's OneDrive, as a channel for both command and control as well as the exfiltration of stolen data.


A backdoor also known as: Trojan.Crypt.CG Downloader.Vidlo.Win32.11 Backdoor.W32.IRCBot.mA1F Trojan.Crypt.CG Win32.Trojan.WisdomEyes.16070401.9500.9959 W32/Downloader.PQKB-6890 Win32/InjectDown.B TROJ_DLOADER.JR Win.Downloader.Small-886 Trojan-Downloader.Win32.Vidlo.k Trojan.Crypt.CG Trojan.Crypt.CG TrojWare.Win32.TrojanDownloader.Vidlo.K Trojan.Crypt.CG Trojan.DownLoader.3548 TROJ_DLOADER.JR Packer.Win32.Mondera W32/Downloader.BEC TrojanDownloader.Small.zu TR/Dldr.Vidlo.K Trojan[Downloader]/Win32.Vidlo Win32.Troj.Vidlo.k.kcloud TrojanDownloader:Win32/Vidlo.I Trojan.Win32.A.Downloader.3584.CB Trojan-Downloader.Win32.Vidlo.k Trojan.Crypt.CG Trojan.Crypt.CG TScope.Malware-Cryptor.SB Win32/TrojanDownloader.Vidlo.K


All the text is then copied and - again hidden in the background - sent to a foreign server.


A backdoor also known as: Trojan.Black.r5 Trojan.Win32.Black.deckbe Backdoor.Vinself.C Win32/Leouncia.D TROJ_ORCARAT.A Packed.Win32.Black.d Packed.Win32.Aspack.AB Trojan.DownLoader11.40855 Trojan.Packed.Win32.43496 TROJ_ORCARAT.A BehavesLike.Win32.Dropper.fc W32/Trojan.QUXL-7354 Packed.Black.ahku W32/Black.D!tr Trojan.Heur.wuXa774c9jj Packer.W32.Black.d!c VirTool:Win32/Obfuscator.XY Win32.Packed.Black.Ebzx Trojan-Downloader.Win32.Banload Trojan.Win32.Black.d


Upon successful exploitation, a new process is created with the PE file embedded in the uploadpref.dat file.


A backdoor also known as: Trojan.ScriptKD.6648 Trojan.Tiggre Trojan.ScriptKD.6648 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan-Downloader.VBS.Small.l Trojan.Script.Small.dczplj Trojan.ScriptKD.6648 Tool.BtcMine.1036 BehavesLike.Win32.AdwareLinkury.hc W32/Trojan.LHYZ-8303 Trojan[Downloader]/Win32.Betload TrojanDownloader:Win32/Streamto.A Zum.BitCoinMiner.1 Trojan-Downloader.VBS.Small.l Zum.BitCoinMiner.1 Trojan.ScriptKD.6648 Trojan.ScriptKD.6648 Trj/CI.A Trojan.Bitcoinminer Vbs.Trojan-downloader.Small.Stty Trojan-Downloader.VBS.Small.L Win32/Trojan.f11


A backdoor also known as: Backdoor/Bifrose.sxu Win32.Trojan.WisdomEyes.16070401.9500.9583 W32/Backdoor.BVIJ-4494 BKDR_BIFROSE_0000025.TOMA Win.Trojan.Bifrose-3481 Trojan.Win32.Bifrose.isow Backdoor.Win32.A.Bifrose.51712.B[h] Trojan.MulDrop.16295 Backdoor.Bifrose.Win32.79774 W32/Backdoor2.BVUS Backdoor/SdBot.ees WORM/IrcBot.353792 Trojan[Backdoor]/Win32.Bifrose Trojan:Win32/Mdrop.A Backdoor/Win32.Bifrose.C64544 Backdoor.Bifrose!Gi2ynDtXmII Backdoor.Win32.Bifrose


A backdoor also known as: Trojan.PDF.Phishing.UX Trojan.PDF.Phish.ve Trojan.PDF.Phishing.UX Trojan.PDF.Phishing.UX EXP/Pidief.EB.523 Trojan.PDF.Phishing.UX Trojan.PDF.Phish.ve Trojan.PDF.Phishing.UX Trojan.PDF.Phishing.UX


A backdoor also known as: W32.FamVT.ExpiroPC.PE Worm/W32.Small.6084.H Email-Worm.Win32.Zhelatin!O Email-Worm.Win32.Zhelatin.h W32.W.Zhelatin.l03u TrojWare.Win32.Small.DBY Worm.Zhelatin.Win32.4001 Downloader-BAI.dam Worm/Zhelatin.ok TR/Small.DBY.Y Worm[Email]/Win32.Zhelatin Email-Worm.Win32.Zhelatin.h Win32/Luder.O Downloader-BAI.dam Email-Worm.Win32.Zhelatin W32/DldBAI.H!dam Trj/Alanchum.PH


The Locky ransomware has been very active since its return which we documented in a previous blog post.


About two-thirds of these apps show some kind of malicious behavior, including displaying ads and downloading apps without the user's consent.


However, we just recently found new Sage samples that, while they appear to still be Sage 2.2, now have added tricks focused on anti-analysis and privilege escalation.


A backdoor also known as: W32/Spamtool.Y Trojan.Dropper Win32/Mendrem.A Win.Trojan.Proxy-4705 Troj.Proxy.W32!c Trojan.MulDrop.4012 BehavesLike.Win32.Backdoor.cm Trojan-Downloader.Win32.LoadAdv W32/Spamtool.LPPN-6055 Spammer:Win32/Kukunefo.A TScope.Malware-Cryptor.SB Trj/CI.A


When the files are encrypted they DO NOT change file name or extensions and appear normal to the victim until you try to open them.


A backdoor also known as: Trojan/W32.NForwarded.401408.F Trojan.Beaugrit.A.mue Trojan/Spy.Banhguo.a Win32.Trojan-Spy.Banhguo.a Trojan.Win32.KillFiles.dmlrmm Trojan.Win32.PSWIGames.401408.J TrojWare.Win32.Lmir.RL Trojan.KillFiles.17459 Backdoor.PePatch.Win32.55641 BehavesLike.Win32.Dropper.fc TR/Banhguo.aone Trojan.Symmi.DBA11 Trojan/Win32.OnLineGames.R127640 W32/Banhguo.A!tr


A backdoor also known as: W32.FamVT.ExpiroPC.PE Virus.W32.Hupigon.Fqm!c BehavesLike.Win32.RAHack.fc KIT/Mac.Walrus.121 HackTool[Constructor]/Win32.Walrus Constructor:W97M/Walrus.1_21.dam#2 Trj/CI.A Win32/Trojan.488


A backdoor also known as: Uds.Dangerousobject.Multi!c Win32.Trojan.WisdomEyes.151026.9950.9988 Heur.AdvML.C Trojan.Win32.MulDrop5.dbmdce BehavesLike.Win32.BrowseFox.nh W32/CoinMiner.QR!tr Trojan.Zusy.D17C80 PUP/Win32.BitCoinMiner.C350160 Trojan:Win32/Figyek.A Win32.Trojan.Adware.Wnmi Trojan.CoinMiner CoinMiner.BLK Trojan.Win32.CoinMiner.QR Win32/Trojan.713


A backdoor also known as: Win32.Packed.Krap.b.3 Packer.Malware.NSAnti.1 Trojan:Win32/Inhoo.A Packer.Malware.NSAnti.1 Trojan-GameThief.Win32.Magania.aigw


A backdoor also known as: Trojan.Dropper.Axesoft.A Trojan-Dropper/W32.Axesoft.800094 Trojandropper.Axesoft Trojan.Dropper.Axesoft.A Trojan/Dropper.Axesoft TROJ_AXESOFT.A TROJ_AXESOFT.A Trojan.Dropper.Axesoft.A Trojan-Dropper.Win32.Axesoft Trojan.Dropper.Axesoft.A Trojan.Win32.Axesoft-Drp.fdro Troj.Dropper.W32.Axesoft!c Trojan.Dropper.Axesoft.A Trojan.Dropper.Axesoft.A Trojan.MulDrop.216 Dropper.Axesoft.Win32.2 BehavesLike.Win32.Dropper.bc Trojan-PWS.Win32.QQPass W32/Trojan.RHJF-8903 TrojanDropper.Axesoft W32.Trojan.Dropper-AxeSoft BDS/GWGirl.12.C Trojan.Dropper.Axesoft.A Trojan-Dropper.Win32.Axesoft BackDoor-SP.dr TrojanDropper.Axesoft Win32/TrojanDropper.Axesoft Win32.Trojan-dropper.Axesoft.Apde Trojan.DR.Axesoft!crjcgQTkDRg W32/Bdoor.SP!tr Win32/Trojan.Dropper.d68


Initial reports of a new variant of ransomware called LockCrypt started in June of this year.


But the 3rd ASEAN-United States Summit on 21 November 2015 did not disappoint.


A backdoor also known as: W32.OnGamesLT180912HKGHAAI.Trojan Trojan-Downloader.Win32.Losabel!O Downloader.Losabel.Win32.540 Trojan/Downloader.Losabel.nx Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Popwin BehavesLike.Win32.Trojan.fh TrojanDownloader.Losabel.cx Trojan[Downloader]/Win32.Losabel TrojanDropper:Win32/Idicaf.A Trojan/Win32.OnlineGameHack.C187141 Trojan.DL.Losabel!C2fG9tSV6gk Trj/Pupack.A


It appears to be run by a Russian-speaking group of hackers.


A backdoor also known as: Trojan.Kazy.D54BC4 Win32.Trojan.WisdomEyes.16070401.9500.9993 Tool.PassView.859 Trojan/Blocker.jhq Win32.Troj.Foxhiex.a.kcloud Trojan/Win32.Zbot.C284570 Trojan.MSIL.CryptoObfuscator Trj/GdSda.A


A backdoor also known as: P2P-Worm.Win32.Krepper!O Worm.Krepper.A.mue Worm.Krepper.Win32.1 W32/Krepper.c W32.IRCBot Win32/Sndc.A WORM_SHAREBOT.A Win.Worm.Poom-1 P2P-Worm.Win32.Krepper.c Trojan.Win32.Krepper.dqeaqt Troj.GameThief.W32.OnLineGames.lgKp Win32.Worm-p2p.Krepper.Ljjq Worm.Win32.Krepper.C Win32.HLLW.Krepper WORM_SHAREBOT.A BehavesLike.Win32.PUPXAX.lz W32/Pcbot.A@p2p Trojan/Krepper.ad WORM/Krepper.C Worm[P2P]/Win32.Krepper Worm:Win32/Krepper.B Trojan.Win32.Krepper.11808 P2P-Worm.Win32.Krepper.c Worm.Krepper I-Worm.Krepper.C Win32/Krepper.C Worm.P2P.Krepper!dcAWP425Bzk P2P-Worm.Win32.Krepper W32/Krepper.C!worm


Through our on-going investigation and monitoring of this targeted attack campaign, we found suspicious URLs that hosted a newly discovered zero-day exploit in Java now identified by Oracle as CVE-2015-2590.


The campaign was identified starting with the registration on 2023-04-05 16:04:51 up to the latest registration on 2023-04-10 08:33:28.


It has been attacking Iranian users.


A backdoor also known as: Trojan/W32.Makecall.20484 Trojan.Makecall Trojan.Makecall.Win32.5 TROJ_MAKECALL.A W32/MalwareF.VJTB W32.Makecall.Trojan TROJ_MAKECALL.A Trojan.Win32.Makecall.a Trojan.Win32.Makecall.fkdu Trojan.Win32.S.Makecall.20484 Troj.W32.Makecall.a!c Trojan.MulDrop.717 BehavesLike.Win32.VBObfus.mz W32/Risk.QDBN-9051 Trojan/MakeCall.d TR/Makecall.a Trojan/Win32.Makecall Trojan:Win32/Makecall.A Trojan.Win32.Makecall.a Trojan/Win32.Makecall.R109087 SScope.Trojan.VBRA.3284 Win32/Makecall.A Win32.Trojan.Makecall.Ecul Trojan.Makecall!Hu8pme7fStI Trojan.Win32.Makecall W32/Makecall.A!tr


A backdoor also known as: Win32/Sipay.ADV Trojan.Crypt.GU Trojan/W32.Small.15872.S Trojan.Small.Win32.4658 Trojan/Small.xut Trojan.Win32.Small.glefu Win32/TrojanDownloader.FakeAlert.JI WORM_SMALL.MDA Trojan.Small-8598 Trojan.Crypt.GU Trojan.Crypt.GU Trojan.Small!AZKO6qCeQTg Trojan.Win32.Small.15872.Q[h] Trojan.Dropper/AdobeFake Trojan.Crypt.GU TrojWare.Win32.Small.~YE Trojan.Crypt.GU Trojan.DownLoader10.48865 WORM_SMALL.MDA W32/Trojan2.EQHY Trojan/Small.fnb Trojan/Win32.Small Win32.Troj.Small.kcloud Trojan.Crypt.GU Win-Trojan/Downloader.15872.GU TrojanDownloader:Win32/Bofang.C Trojan.Crypt.GU Trojan.Small Trojan-Downloader.HG W32/FakeAlert.JI!tr.dldr


In addition, Xbot will steal all SMS messages and contact information, intercept certain SMS messages, and parse SMS messages for mTANs Mobile Transaction Authentication Number from banks.


Using both the Elknot and BillGates DDoS malware, these attackers have continued to infect vulnerable Elasticsearch servers in order to enhance their DDoS capabilities.


A backdoor also known as: Trojan/KillAV.a TROJ_SPNR.38J614 Backdoor.Trojan TROJ_SPNR.38J614 Uds.Dangerousobject.Multi!c Trojan.Patched.Win64.2566 W64/Trojan.HLJR-4976 Trojan.KillAV!apRF/prfUvc Trojan.Win64.Killav W64/KillAV.A!tr Trj/CI.A


It now appears to be in the league of full-blown banking trojans such as Dyreza, Neverquest/Vawtrak, Zeus, etc.


DIMNIE is a modular information stealer profiled earlier this year by security researchers at PaloAlto s Unit 42, who found the malware in targeted phishing attacks against open-source developers.


A backdoor also known as: W32.UserinitWininit.Trojan Trojan.Delf.QEO Trojan.Bancteian.CB4 Trojan.Delf.QEO Trojan/Spy.Delf.qgs Trojan.Delf.QEO Win32.Virus.Delf.c W32/Delf.UD TROJ_BANCTEIAN.SM Win.Trojan.Bancteian-0-6418983-0 Trojan.Delf.QEO Trojan.Delf.QEO Trojan.Win32.Delf.3301398 Trojan.Delf.QEO Backdoor.Win32.Delf.~DD Trojan.Delf.QEO Adware.BrowseFox.Win32.220566 TROJ_BANCTEIAN.SM BehavesLike.Win32.Trojan.wh Trojan.Win32.Bancteian W32/Delf.CERT-0413 Trojan.Reconyc.apf W32.Trojan.Delf TR/BAS.Samca.lsswh Trojan/Win32.Delf.nbw Trojan:Win32/Bancteian.B Trojan/Win32.Bancteian.R174475 Trojan.Reconyc Trojan.Win32.Delf.qgs W32/Delf.QGS!tr.spy


In one of our previous blog entries, we covered how the threat actor known as Winnti was using GitHub to spread malware – a development that shows how the group is starting to evolve and use new attack methods beyond their previous tactics involving targeted attacks against gaming, pharmaceutical, and telecommunications companies.


A backdoor also known as: Trojan.MSIL.Downloader.AD Trojan.MSIL.Downloader.AD Trojan.MSIL.Downloader.AD Trojan.MSIL.Downloader.AD Trojan.Win32.Inject.ewmdhe Troj.MSIL.Disfa.mCrY Trojan.MSIL.Downloader.AD TrojWare.MSIL.Inject.TEQ Trojan.MSIL.Downloader.AD TR/Inject.xbeihg TrojanDownloader:MSIL/Datsup.A Trojan.MSIL.Downloader.AD Trj/CI.A MSIL/Dloader.AWE!tr Win32/Trojan.cd2


A backdoor also known as: Exp.RTF.CVE-2017-8759.D Trojan.Mdropper Win32/Exploit.CVE-2017-8759.A TROJ_ARTIEF.JEJOWP Rtf.Downloader.CVE_2017-6336326-3 Exploit.MSOffice.CVE-2017-8759.a Exploit.Ole2.CVE-2017-8759.estduh RTF.S.Exploit.44738 Exploit.Msoffice.Cve!c Exploit.CVE-2017-8759.5 TROJ_ARTIEF.JEJOWP RTF/Trojan.BGKX-2 HEUR:Exploit.MSOffice.CVE-2017-8759.a Exploit.CVE-2017-8759 Office.Exploit.Cve-2017-8759.Ajle Trojan.Win32.Exploit Malicious_Behavior.SB Win32/Trojan.Exploit.024


A backdoor also known as: Trojan.Downloader.Farfly.L Multi.Threats.InArchive W32/Risk.NCBB-0700 Trojan.Farfli Win.Trojan.Downloader-2275 Trojan.Downloader.Farfly.L Trojan.Downloader.Farfly.L Trojan.Win32.Crypted.dkwpfn Trojan.Win32.Z.Downloader.266845 Trojan.Downloader.Farfly.L Trojan.DownLoader4.59614 Downloader.Selvice.Win32.747 TROJ_DLOADR.SMQ Trojan-Downloader.Win32.Selvice W32/MalwareS.ASNW Trojan.Downloader.Farfly.L TrojanDownloader:Win32/Caxnet.B Worm.WhiteIce Trojan.Downloader.Farfly.L Trojan.Downloader.Farfly.L Trojan.DL.Selvice!qQfZyIPcdpU Win32/Trojan.Downloader.6fb


A backdoor also known as: Trojan.Win32.Hijacker.kvdpi TROJ_DYER.BMC Trojan.Enfal-7 HEUR:Trojan.Win32.Invader Trojan.Hijacker!h2YIjU+BiQU Trojan.DownLoader7.14277 TROJ_DYER.BMC Trojan/Invader.exe W32/Bfr.2!tr Trojan[:HEUR]/Win32.Invader Win-Trojan/Inject.16896.IT Win32.Trojan.Hijacker.Ebqw Trojan.Win32.Sanpec Win32/Trojan.1da


The attacks we attribute to Scarlet Mimic have primarily targeted Uyghur and Tibetan activists as well as those who are interested in their causes.


This new threat also uses a macro to infect the target's computer, but rather than retrieving a binary payload, it relies on various scripts to maintain its presence and to communicate via hacked websites, acting as proxies for the command and control server.


A backdoor also known as: Downloader.Myxa.Win32.113 Trojan/Downloader.Myxa.cit Trojan.Kazy.D6034 TROJ_MONKIF.SMKP Win32.Trojan.WisdomEyes.16070401.9500.9999 Downloader.Monkif TROJ_MONKIF.SMKP Win.Downloader.100478-1 Trojan.Win32.Myxa.bqhvc Trojan.Win32.A.Downloader.22672.B Trojan.DownLoad3.32720 Trojan-Downloader.Win32.Myxa TrojanDownloader.Myxa.cx TrojanDownloader:Win32/Monkif.T Downloader/Win32.Monkif.R1925 TrojanDownloader.Myxa Trj/Myxa.A Trojan.DL.Myxa!oB3ehXmv9m8


When we talk about the attackers, there is this misconception that they are these super villains who can only do evil, but keep in mind they are humans too.


This macro comes into users' systems through a spam email with subjects such as My Resume, Openings, Internship, etc.


A backdoor also known as: Android.FakeToken.B A.H.Pay.Erop.YG Android.Trojan.SMSBot.B AndroidOS/FakeToken.B HEUR:Trojan-Banker.AndroidOS.Faketoken.a Android.Trojan.SMSBot.B Trojan.Android.SMSBot.b Android.Malware.Trojan Trojan:Android/SmsSpy.K Android.SmsSend.419.origin AndroidOS/FakeToken.B Trojan[Banker]/Android.Faketoken Android.Troj.at_Stealer.g.kcloud HEUR:Trojan-Banker.AndroidOS.Faketoken.a Android.Trojan.SMSBot.B Trojan.AndroidOS.SendSMS Android/FkToken.B


Android malware creators have recently been mixing business with play.


DNS is an ideal fit for frequently exporting small chunks of custom encoded data i.e. credit card track 1 and track 2 data to an external, remote location.


We have recently encountered very aggressive jabber spam campaign, advertising the Philadelphia ransomware.


A backdoor also known as: Trojan.Zusy.D39A16 Win32.Trojan.WisdomEyes.16070401.9500.9800 Backdoor.Trojan TSPY_REALTIME.A Trojan.RealSpy TSPY_REALTIME.A W32/Risk.KQTT-6320 Trojan/Win32.HDC.C24097


A backdoor also known as: Trojan/Downloader.Delf.quw Win32.Trojan.WisdomEyes.16070401.9500.9770 Win.Trojan.Downloader-57555 Trojan.DownLoad2.37645 BehavesLike.Win32.PUPXAS.ch Trojan.Graftor.D1EFD7 TrojanDownloader:Win32/Blortios.C Trojan/Win32.Downloader.R18903 Win32/Trojan.88b


In recent weeks, Unit 42 has been analyzing delivery documents used in spear-phishing attacks that drop a custom downloader used in cyber espionage attacks.


But over the past week, while performing research using Palo Alto Networks AutoFocus, we noticed a large uptick in the delivery of the Hancitor malware family as they shifted away from H1N1 to distribute Pony and Vawtrak executables.


Ransomware sure has had an uptick the past years; more and more variants appear while some have been leading the pack for the past years.


A backdoor also known as: Trojan/Clicker.Small.ht Win32/TrojanClicker.Small.HT W32/TrojanX.MXY Smalltroj.BDN Win32.Small.ht Trojan-Clicker.Win32.Small.ht Trojan.Clicker.Small.HT TrojWare.Win32.TrojanClicker.Small.HT Trojan-Clicker.Win32.Small.ht Win32/TrojanClicker.Small.HT TR/Click.Small.HT W32/TrojanX.MXY Trojan-Downloader.Win32.Small!IK Trojan.Click.Small.HT TrojanClicker:Win32/Small.BB Trojan.Clicker.Small.HT Win-Trojan/Downloader.120895 Trojan-Clicker.Win32.Small.ht Trojan-Clicker.Small.HT Trojan-Clicker.Small.HT Trojan.Clicker.Autoit Trojan-Downloader.Win32.Small W32/Small.HT!tr Trj/Downloader.MDW


A backdoor also known as: Trojan.Win32.Badur!O Win32.Trojan.WisdomEyes.16070401.9500.9996 TR/Rogue.1517892 Trojan/Win32.Badur TrojanDownloader:MSIL/Balamid.A Trojan.Zusy.D13D03 Trojan.Badur Trojan.Badur!


The company later released a whitepaper which described Qbot version 910 in great detail.


The investigation found a supply chain-focused attack at M.E.Doc software that delivered a destructive payload disguised as ransomware.


There were several things that struck us as both interesting and concerning about the details; a threat actor known to operate in South East Asia is now using secure sockets layer SSL encryption in their malware.


A backdoor also known as: Downloader.Banload.10000 Trojan.Banker Win32.Trojan.WisdomEyes.16070401.9500.9955 Trojan.DownLoader13.22599 W32/Banker.ABCU!tr


A backdoor also known as: Trojan.Downloader.Braidupdate.C Trojan.Downloader.Braidupdate.C Trojan.Win32.Braidupdate.frhy W32/Downloader.AAJ Adware.BrowserAid Win32/TrojanDownloader.Braidupdate.C TROJ_BRAIDUPDT.C Worm.WinUpToDate Trojan-Downloader.Win32.Braidupdate.c Trojan.Downloader.Braidupdate.C Trojan.DL.Braidupdate!ucpSRQWfQfk Win32.Trojan-downloader.Braidupdate.Tayo Trojan.Downloader.Braidupdate.C TrojWare.Win32.TrojanDownloader.Braidupdate.C Trojan.Downloader.Braidupdate.C Trojan.Braid Downloader.Braidupdate.Win32.3 TROJ_BRAIDUPDT.C W32/Downloader.IZKY-4160 TR/Dldr.Braidupda.C W32/Braidupdate.C!tr.dldr Trojan[Downloader]/Win32.Braidupdate Trojan.Downloader.Braidupdate.C Troj.Downloader.W32.Braidupdate.c!c Trojan/Win32.Braidupdate TrojanDownloader:Win32/Braidupdate.C Trojan.Downloader.Braidupdate.C TrojanDownloader.Braidupdate not-a-virus:AdWare.Win32.Cash Trojan.Downloader.Braidupdate.C Downloader.Braidupdate.C Win32/Trojan.Downloader.2d9


The Angler Exploti Kit has integrated CVE-2015-5119 leaked from HackingTeam.


Gafgyt botnet attacking Netcore routers


During our continued research on Sofacy's Komplex Trojan, we have found a sample of a backdoor Trojan that we believe the Sofacy group uses when targeting individuals running macOS systems.


There are two variations of the emails: one is an order confirmation from a Japanese equipment supplier and the other pretends to come from a local printing company.


This post will start to explore some of these obfuscations to get a better understanding of how FormBook works.


[Zscaler] has covered Dridex Banking Trojan being delivered via various campaigns involving Office documents with malicious VBA macros in the past.


A backdoor also known as: Trojan-GameThief.Win32.OnLineGames!O Win32.Trojan.WisdomEyes.16070401.9500.9987 Trojan.Drondog Win.Downloader.29758-2 Worm.Win32.Downloader.bldi Trojan.Win32.MLW.xzlu W32.W.Downloader.hq!c Trojan.MulDrop.15154 Trojan.Win32.KillAV Worm/Downloader.fd TR/Sorri.O Worm/Win32.Downloader Win32.Troj.DownLoaderT.hu.147456 Trojan:Win32/Wiessy.A Worm/Win32.Downloader.R2522


The malware is able to control banking transactions conducted using Internet Explorer, and harvest email credentials, which are in turn used to spread the malware further.


A backdoor also known as: Trojan.DownLoader4.13271


A backdoor also known as: Trojan.DelfiDelfi.Win32.301 Trojan.Win32.DelfiDelfi.cho Trojan.Win32.DelfiDelfi.etgljb W32/Trojan.AITA-6805 Trojan.Win32.DelfiDelfi.cho TrojanDownloader:Win32/Banavkill.A Trj/GdSda.A Trojan.DelfiDelfi! W32/Banker.AEAY!tr.spy Win32/Trojan.af4


A backdoor also known as: Trojan-PWS/W32.WebGame.37860.B Trojan-PSW.Win32.Yahu.YPager!O Trojan/PSW.Yahu.YPager.r Trojan.Kazy.D15AC9 Win32.Trojan.WisdomEyes.16070401.9500.9973 W32/Pws.BHSA Win32/YPager.D Trojan.Win32.Scar.kjpu Troj.W32.Scar!c TrojWare.Win32.PSW.YahooPager.R0 Trojan.DownLoader6.48717 Trojan.Yahoo.Win32.38 BehavesLike.Win32.Virus.nt Trojan-PWS.Win32.Yahoo W32/PWS.TYKP-7651 Trojan/PSW.Yahu.y Trojan[PSW]/Win32.Yahu Trojan.Win32.Scar.kjpu Trojan/Win32.Jorik.C1078 Win32/PSW.Yahoo.YPager.R Win32.Trojan.Scar.Pfsz W32/Yahoo_YPager.R!tr.pws


The samples we identified target the ATM vendor Diebold.


A backdoor also known as: Trojan-Dropper.Win32.Taob.ag Trojan.DR.Taob!NlMVsECgQGE Trojan.MulDrop4.3634 TR/PSW.OnlineGames.wtog TrojanDropper.Taob.o Win32.Troj.Taob.ag.kcloud Trojan:Win32/Cortheaper.A Trojan-GameThief.Win32.OnLineGames


At the time it was removed, the plugin was installed on more than 200,00 sites, albeit we cannot be sure how many of these were updated to a version that included the malicious behavior.


Finished ! * * * End translation * * * Referring again to bit.ly , we can see click statistics for this campaign ( Figure 6 ) .


Twitter user @hkashfi posted a Tweet saying that one of his friends received a file US Travel Docs Information.jar from someone posing as USTRAVELDOCS.COM support personnel using the Skype account ustravelidocs-switzerland notice the i between travel and docs .


Successful exploitation typically results in malware calling back to one or more Uyghur themed domain names.


Banking Trojans continue to evolve and threat actors are using them in new ways, even as the massive Dridex campaigns of 2015 have given way to ransomware and other payloads.


A backdoor also known as: Trojan.Vburses Trojan.Win32.Vburses


During the operation, the malware was used to dox 400,000 members of Vietnam Airlines.


The Trojan deletes Volume Shadow Copies.


The MuddyWater attacks are primarily against Middle Eastern nations.


Elirks, less widely known than PlugX, is a basic backdoor Trojan, first discovered in 2010, that is primarily used to steal information from compromised systems.


Through our research on the Windows KLRD keylogger from the Odinaff report, we were able to discover several new keyloggers.


A backdoor also known as: Hacktool.Mapiget W32/MalwareF.HUIZ Trojan.Badname HackTool.Win32.MapiGet.a Trojan.Win32.MapiGet.cwwjwt Hacktool.W32.Mapiget!c Trojan.KeyLogger.28306 Tool.MapiGet.Win32.1 W32/Risk.LFSI-6446 HackTool.MapiGet.a Misc.HackTool.MailLogger TR/Spy.Mail.G HackTool/Win32.MapiGet Trojan.Graftor.D3C87F HackTool.Win32.MapiGet.a Win32.Hacktool.Mapiget.Iso TrojanSpy.Mail!RGqYbEAheeQ HackTool.Win32.MapiGet Win32/Trojan.Hacktool.eb5


A backdoor also known as: BackDoor-FHS.dr Trojan/Witthy.a Trojan.Win32.Clicker.crbxjx Trojan.Click2.48783 BehavesLike.Win32.VirRansom.cc Trojan.Win32.Merlos TR/Rogue.7786243 Trj/CI.A Win32/Witthy.A W32/Witthy.A!tr.bdr


Recent samples of the malware have now included the ability to use Google services for command-and-control C&C communication.


A backdoor also known as: TROJ_RAMDO.SM0 Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_RAMDO.SM0 BehavesLike.Win32.Virut.fh Trojan.Win32.Ramdo Trojan.Ramdo.1 Trojan:Win32/Ramdo.H Backdoor/Win32.Necurs.R100690 Malware-Cryptor.Limpopo Trj/Dtcontx.K Win32/Redyms.AF


A backdoor also known as: HW32.Packed.3AEC Win32.Trojan.WisdomEyes.16070401.9500.9901 Trojan.Win32.Inject.ctprfv W32.Sality.l8GK Trojan.KillProc.28723 Trojan/Nimnul.b Trojan[Ransom]/Win32.PornoAsset Ransom:Win32/Dircrypt.C Trojan.Graftor.D199D8 Trojan.Crypt Trojan.Win32.VB Trj/Dtcontx.G


A backdoor also known as: Trojan.Crypt.Delf.AL Trojan-Downloader.Win32.Banload!O Downloader.Banload.Win32.27568 TROJ_DELF.NOR Win32.Trojan.WisdomEyes.16070401.9500.9934 W32/Downldr2.ATJF Backdoor.Trojan Win32/Pigeon.AYDG Win.Downloader.20057-1 Trojan.Crypt.Delf.AL Trojan-Downloader.Win32.Banload.evb Trojan.Crypt.Delf.AL Trojan.Win32.Drop.dzdiyr Trojan.Win32.A.Downloader.214016.H Troj.Downloader.W32.Banload!c Trojan.Crypt.Delf.AL Backdoor.Win32.Remote.~N Trojan.Crypt.Delf.AL Trojan.MulDrop.12358 BehavesLike.Win32.Worm.dc Trojan/Downloader.Banload.evb TrojanDownloader.Banload.jwv TR/Delf.18944 Trojan[Backdoor]/Win32.Ceckno Trojan.Crypt.Delf.AL Trojan-Downloader.Win32.Banload.evb Trojan.Crypt.Delf.AL TrojanDownloader.Delf Bck/Hupigon.KPG Win32/Delf.NXK Win32.Trojan-downloader.Banload.Dxnj Backdoor.Ceckno!iv4t9tSa5f0 Trojan-Dropper.Delf W32/Delf.NIP!tr.bdr Win32/Trojan.823


Bitter APT is a South Asian threat group that commonly targets energy and government sectors; they have been known to target Pakistan, China, Bangladesh, and Saudi Arabia.


A backdoor also known as: Joke.Melter.A Win32.Trojan.WisdomEyes.16070401.9500.9752 W32/Joke.SXAT-7954 Joke.Melter.A Joke.Melter.A Joke.Melter.A Heur.Corrupt.PE Joke.Melter.A Joke.Finger.5 not-a-virus:BadJoke.Win32.Melter W32/Joke.BY Joke.Melter.A Joke:Win32/Melter.dam#4 Joke.Melter.A Trj/CI.A


Prometei, a highly modular botnet with worm-like capabilities that primarily deploys the Monero cryptocurrency miner, has been continuously improved and updated since it was first seen in 2016, posing a persistent threat to organizations.


A backdoor targetting Linux also known as: Possible_BASHLITE.SMLBN1 Unix.Trojan.Mirai-5607483-0 Linux.Trojan.Gafgyt.A HEUR:Backdoor.Linux.Gafgyt.y Trojan.Unix.Gafgyt.eikqfj Backdoor.Linux.Gafgyt!c Linux.BackDoor.Fgt.44 Possible_BASHLITE.SMLBN1 Backdoor.Linux.hxx LINUX/Gafgyt.klnbe Trojan.Backdoor.Linux.Gafgyt.1 HEUR:Backdoor.Linux.Gafgyt.y backdoor.linux.gafgyt.y Trojan.Linux.Gafgyt ELF/Gafgyt.WN!tr.bdr Win32/Backdoor.3e0


A backdoor also known as: Trojan/W32.Feedel.28672 Trojan.Feedel Troj.W32.Feedel!c Trojan.Feedel.f TR/RedCap.ocnbv Trojan/Win32.Feedel Trj/CI.A Win32.Trojan.Feedel.Ecjy Win32/Trojan.ada


A backdoor also known as: W32.OscoleF.Trojan Trojan.AutoIT.Injector.AP Trojan/W32.Cossta.95232.B Trojan.Napolar.A1 Trojan.Cossta.Win32.8040 Win32.Trojan.Napolar.b Infostealer.Napolar Win32/Tnega.dYPTOW BKDR_NAPOLAR.SM0 Win32.Backdoor.Napolar.B Trojan.AutoIT.Injector.AP Trojan.Win32.Cossta.cqikyo Trojan.AutoIT.Injector.AP TrojWare.Win32.Kryptik.BLGK Trojan:W32/Napolar.A Trojan.Hottrend.355 BKDR_NAPOLAR.SM0 BehavesLike.Win32.Trojan.nh Trojan.Win32.Napolar TrojanDropper.Dapato.nxc TR/BAS.Zusy.2144567 Trojan/Win32.Cossta Trojan.AutoIT.Injector.AP Trojan:Win32/Napolar.A Trojan/Win32.Cossta.C211827 Trojan.AutoIT.Injector.AP TScope.Malware-Cryptor.SB Trojan.Napolar Trj/Napolar.A Win32/Napolar.A Trojan.Win32.Cossta.a W32/Cossta.A!tr Win32/Trojan.235


A longstanding cyberespionage campaign has been targeting mainly Japanese organizations with its own, custom-developed, malware Backdoor.Daserf.


JPCERT/CC has been observing malicious shortcut files that are sent as email attachments to a limited range of organisations since around October 2015.


Devices infected by these malicious programs usually form a kind of advertising botnet via which advertising Trojans distribute each other as well as the advertised apps.


We have named this tool that generates these documents DealersChoice.


As it continues to evolve and develop, Proofpoint researchers have detected it distributing a new remote access Trojan RAT.


This blog dives into the specifics of the ransomware used by the gang, as well as some information regarding their victim naming and shaming website, filled with non-paying victims and stolen data.


Qakbot has been around for years, but it's nothing to be complacent about.


In 2019, Cl0p Ransomware surfaced as a Ransomware-as-a-Service RaaS model and became notorious due to its advanced techniques.


These indicator include the use of the same infrastructure for the attacks, similar Tactics, Techniques and Procedures TTPs, the targeting of demographically similar victims and operating geographically within the Indian Subcontinent


A backdoor also known as: W32.VAsidBackup.Worm Worm.Win32.AutoRun!O Worm.Hupigon Win32.Trojan.WisdomEyes.16070401.9500.9977 Worm.Win32.AutoRun.hht Backdoor.W32.IRCBot.lebE Trojan.Packed.650 Trojan.Sasfis.Win32.3750 Backdoor.Win32.Hupigon Worm/AutoRun.kwf Worm/Win32.AutoRun Win32.Virut.ce.57344 Worm.Win32.AutoRun.hht Worm:Win32/Hupigon.D HEUR/Fakon.mwf TScope.Malware-Cryptor.SB W32/Sohanat.JC Win32/AutoRun.Hupigon.L Win32.Worm.Autorun.Dxcn Worm.AutoRun!oW5oVN0v9nU W32/Packed.2D18!tr Win32/Trojan.ce1


A backdoor also known as: W32.AutorunSubot.Worm HackTool.Hoylecann Win.Trojan.HackTool-55 HackTool:Win32/Hoylecann.B Trojan/Win32.HackTool.C178639 Trj/CI.A


A backdoor also known as: Trojan.Mbro Ransom_Molock.R004C0DAU18 Ransom_Molock.R004C0DAU18 Trojan-Ransom.Win32.Mbro.bbjy Trojan.Win32.Wecod.eoemqo Trojan.Win32.Z.Wecod.2575498 Win32.Trojan.Mbro.Wnwf BackDoor.Bifrost.30406 Trojan.Magania.Win32.70995 PUA.DRMSoft Trojan.Inject.zdn TR/Ransom.Molock.dkaaw Trojan/Win32.Wecod Ransom:Win32/Molock.A!bit Trojan-Ransom.Win32.Mbro.bbjy Trojan/Win32.Mbro.C2386226 TScope.Trojan.Delf Trojan.PWS.Magania!koUXbeUVt9s


A backdoor also known as: Trojan/W32.Maudi.41880 Trojan.Maudi.ahd Trojan/Maudi.ahd Trojan.Win32.Obfuscated.bbgart Celesign.A Trojan.Win32.Maudi.ahi Trojan.Win32.A.Maudi.41880 Trojan.Obfuscated.based.1 TR/Maudi.C Trojan/Maudi.f Trojan:Win32/Tusmed.A Trojan/Win32.Maudi Trojan.Maudi Trojan.Win32.Tusmed W32/Maudi.AHD!tr


A backdoor also known as: Trojan.Barkiofork Trojan/Barkiofork.b Trojan.Zusy.D14CE BKDR_INJECT.SMA Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Barkiofork BKDR_INJECT.SMA BackDoor.WebDor.55 TR/Barkiofork.A.28 Trojan:Win32/Barkiofork.A Trojan/Win32.Dllbot.R92635


These malicious Excel files use a number of different lures, providing evidence of what attackers are using to entice victims into executing them.


A backdoor also known as: Trojan.Razy.D3DB80 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Ursu.exohow BehavesLike.Win32.Backdoor.jm TR/Dropper.MSIL.hfzet Trojan:MSIL/CeeInject.AE!bit Win-Trojan/MSILKrypt02.Exp Trj/GdSda.A Win32.Trojan.Inject.Auto Trojan.MSIL.Injector MSIL/Injector.QGP!tr


A backdoor also known as: W32.Clod8eb.Trojan.3030 Trojan.Downloader.Clisser.B Trojan.Downloader.Clisser.B Downloader.Clisser.Win32.1 Trojan/Downloader.Clisser.b Win32.Trojan.WisdomEyes.151026.9950.9999 W32/Downldr2.BOY Heur.AdvML.C Win32/TrojanDownloader.Clisser.B Trojan-Downloader.Win32.Clisser.b Trojan.Downloader.Clisser.B Trojan.Win32.Clisser.ddmj Trojan.Win32.Downloader.54784.AO[h] Troj.Downloader.W32.Clisser.b!c Trojan.Downloader.Clisser.B TrojWare.Win32.TrojanDownloader.Clisser.B Trojan.Downloader.Clisser.B BehavesLike.Win32.AdwareTopMoxie.qh W32/Downloader.TUUE-5046 TrojanDownloader.Clisser.b TR/Dldr.Clisser.B.1 W32/Clisser.B!tr.dldr Trojan[Downloader]/Win32.Clisser Trojan.Downloader.Clisser.B Trojan/Win32.Clisser.N2115772 TrojanDownloader:Win32/Clisser.B Trojan.Downloader.Clisser.B TrojanDownloader.Clisser Win32.Trojan-downloader.Clisser.Sxeg Trojan.DL.Clisser!glWq8gdbz3E Trojan-Downloader.Win32.Clisser Trojan.Downloader.Clisser.B Downloader.Clisser.A


The Italian language email had a weird attachment: ordine_065.js it would be Order Form in English which appeared quite malicious to me.


The malware may download and execute other binaries.


A backdoor also known as: NetTool.Tor Backdoor.Bot Tool.Tor.Win32.4 Win32.Trojan.WisdomEyes.16070401.9500.9989 Backdoor.Trojan not-a-virus:NetTool.Win32.Tor.f Trojan.Win32.MLW.dbcsxd Trojan.DownLoader8.56801 Sefnit.ag W32/Trojan.OTFO-7506 HackTool[NetTool]/Win32.Tor TrojanDropper:Win32/Sefnit.A not-a-virus:NetTool.Win32.Tor.f TrojanDropper.Sefnit Riskware.NetTool! Win32/Trojan.07c


A backdoor also known as: Win32.Floxif.A W32.Pioneer.CZ1 Virus.W32.Pioneer!c PE_FLOXIF.E Win32.Virus.Floxif.a W32/Floxif.B W32.Fixflo.B!inf Win32.Floxif.F PE_FLOXIF.E Win32.Floxif.A Virus.Win32.Pioneer.cz Win32.Floxif.A Virus.Win32.Pioneer.bvrqhu Win32.Floxif.A Virus.Win32.Floxif.A Win32.FloodFix.7 Virus.Floxif.Win32.1 W32/Floxif.B Win32/Pioneer.l Virus/Win32.Pioneer.cz TrojanDropper:Win32/Floxif.A Virus.Win32.Pioneer.cz Win32.Floxif.A Virus.Pioneer.4129 W32/Floxif.A Win32.Floxif.A Win32/Floxif.H Virus.Win32.Pionner.tt W32/Pioneer.CZ!tr Virus.Win32.Pioneer.C


A backdoor also known as: W32.eHeur.Malware11 Trojan.Inject.Small.C Hacktool.Radinject Trojan.Inject.Small.C Trojan.Inject.Small.C Win32.Trojan.WisdomEyes.16070401.9500.9926 Trojan.Inject.Small.C W32.Cabanas.lmfo Trojan.Inject.Small.C W32/Trojan2.MAPI Trojan/Win32.Inject.R14211 Trojan.Inject.Small.C Trj/CI.A Trojan.Hijacker Win32/Trojan.913


A backdoor also known as: Trojan/W32.Morkus.73728 Trojan.Gambee.BB3 Trojan.Kazy.D13FF6 Trojan.Win32.Morkus.bcz Win32.Trojan.Morkus.Tayq TrojWare.Win32.TrojanClicker.VB.IDP Trojan.DownLoader5.64540 BehavesLike.Win32.Trojan.lt TR/VB.Click.idpmnua Win32.Troj.Undef.kcloud TrojanDownloader:Win32/Gambee.A Trojan.Win32.Morkus.bcz Trojan/Win32.OnlineGameHack.R30007 Win32/TrojanClicker.VB.NYI Trojan-Clicker.Win32.VB W32/VBClicker.NY!tr


This ransomware is currently being spread by a social engineering exploit kit to trick the user in downloading a malicious executable.


The group's activities show that foreign and domestic espionage and influence on geopolitics are the group's main motives, and not financial gain.


Recently Bedep has been observed as the payload dropped by the Anger EK in a series of malvertising campaigns.


A backdoor also known as: Joke.Kokegift JOKE_GESCHENK.A W32/Trojan4.EDF Joke.Geschenk JOKE_GESCHENK.A Win.Joke.CokeGift-2 Riskware.Win32.Geschenk.bdflz Joke.Geschenk BehavesLike.Win32.FakeAlertSecurityTool.cc Trojan-Spy.Win32.Zbot W32/Trojan.OREK-1496 JOKE/CokeGift.1 Joke:Win32/Kokegift.A Joke.Geschenk Win32.Trojan.Geschenk.Wvkp Win32/Trojan.2ff


A recently disclosed data breach suffered by Mexican fast food restaurant Chipotle was carried out by hackers linked to a group known as FIN7 or Carbanak Group, CyberScoop has learned.


A backdoor also known as: W32.IEPassVH.Trojan Tool.NetPass.Win32.6782 not-a-virus:PSWTool.Win32.NetPass.wkh Riskware.Win32.NetPass.sphcx Win32.PSWTool.NetPass.~BAAD Program.PwdFind.5 Packed.PePatch.uw Trojan[PSWTool]/Win32.NetPass Application.Heur.cmKfbOVNU5lO not-a-virus:PSWTool.Win32.NetPass.wkh Riskware.PSWTool! not-a-virus:PSWTool.Win32.NetPass


Recently we detected new samples and Infrastructure of ISMAgent, a trojan in use by Iranian Threat Group GreenBug.


Searching its name or one of its aliases Bebloh or Shiotob reveals a good deal of press from that time period along with a few technical analyses in 2009 2012 and 2013


This posting is a follow-up of my previous work on this subject in Pulling Back the Curtains on EncodedCommand PowerShell Attacks


It also includes SSL certificate checking aka SSL pinning, allowing it to evade scenarios in which an SSL man-in-the-middle is present.


ThreatLabZ has been keeping an eye on RIG and in this post we will cover an example of a full RIG infection cycle.


The Check Point research team identified a new mobile malware targeting millions of Android users.


The target is CERT in the military domain.


We have found evidence that the actors use a combination of legitimate tools and batch scripts to deploy the Disttrack payload to hostnames known to the attackers to exist in the targeted network.


A backdoor also known as: Trojan.Downloader.JSTL TrojanDownloader.Mabjet Trojan.Downloader.JSTL Backdoor.W32.PcClient.lpjJ Trojan/Downloader.FlyStudio.az Trojan.Downloader.JSTL Win.Trojan.Flystudio-2191 Trojan.Downloader.JSTL Trojan.Downloader.JSTL Trojan.Win32.FlyStudio.cxpswl Trojan.Downloader.JSTL Adware.Downware.4022 Downloader.FlyStudio.Win32.2885 Trojan-Downloader.Flystudio TR/Dldr.FlyStudio.AZ Win32.Trojan.Fakeapp.Dvfy Win32/Trojan.51f


A backdoor also known as: Trojan.Emotet.CD Trojan/W32.Dovs.159744.B Win32.Malware!Drop Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.KZPI-4363 Trojan.Emotet TSPY_EMOTET.THAOIAL Win.Trojan.Emotet-6421984-0 Trojan.Win32.Dovs.frh Trojan.Emotet.CD Trojan.Win32.Dovs.exinig Win32.Trojan.Dovs.Wwnx Trojan.Emotet.CD Trojan.Emotet.CD TSPY_EMOTET.THAOIAL BehavesLike.Win32.Upatre.ch Trojan.Dovs.bke TR/Crypt.ZPACK.blsak W32/Kryptik.GBTT!tr Trojan.Emotet.CD Trojan.Win32.Z.Emotet.159744.B Trojan.Win32.Dovs.frh Trojan/Win32.Dovs.C2353482 Trojan.Emotet.CD Win32.Malware!Drop Trojan.Emotet Win32/Emotet.AZ Trojan-Banker.Emotet PE.Heur.InvalidSig Win32.Trojan-Spy.Emotet.KA Trj/RnkBend.A


While we monitor phishing campaigns used to distribute threats such as Dridex, Upatre, and Cryptowall, targeted phishing attacks are more convincing because the format of the message is personalized to the targeted user.


A backdoor also known as: HW32.Packed.AB1B MemScan:Trojan.Spy.Togfer.S Trojan-Dropper/W32.Small.45568.F TrojanDropper.Small Dropper.Small.Win32.1780 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Wingua.B Backdoor.Trojan MemScan:Trojan.Spy.Togfer.S Trojan-Dropper.Win32.Small.ep MemScan:Trojan.Spy.Togfer.S Trojan.Win32.Small.unzq Trojan.Win32.Z.Small.45568.Z Troj.Dropper.W32.Small.ep!c MemScan:Trojan.Spy.Togfer.S TrojWare.Win32.TrojanDropper.Small.EP MemScan:Trojan.Spy.Togfer.S Trojan.MulDrop.752 TROJ_SMALL.EP BehavesLike.Win32.Sdbot.pc Trojan/Dropper.Small.ep Worm.Win32.Randex.a W32/Wingua.TBPD-6936 Packed.Morphine.a DR/Small.EP.1 Trojan[Dropper]/Win32.Small Trojan.Spy.Togfer.S Trojan-Dropper.Win32.Small.ep MemScan:Trojan.Spy.Togfer.S TrojanSpy.Tofger Trj/Small.A Win32/TrojanDropper.Small.EP Win32.Trojan-dropper.Small.Amvx Trojan.DR.Small!QLjE4qGURJY W32/Small.EP!tr


A backdoor also known as: Trojan.Delf.Win32.49957 Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Adclicker Trojan-Spy.Win32.Delf.tr TrojWare.Win32.PSW.QQPass.~HYJ Trojan.DownLoader.origin BehavesLike.Win32.Dropper.lc Trojan-Dropper.Delf Trojan[Spy]/Win32.Delf Trojan-Spy.Win32.Delf.tr Trojan/Win32.OnlineGameHack.R233 Trojan.PWS.Ceekat!HLFjv+sb6fY


Researchers with Tencent Security recently disclosed details about Swearing Trojan, a mobile banking malware that attacked users in China.


A backdoor also known as: Backdoor.Dolan.fam Backdoor/W32.Dolan.20480.D Backdoor.Dolan.fam Backdoor.Aoldoor Dolan.AA BKDR_AOLDOOR.A Backdoor.Win32.Dolan Backdoor.Dolan.G Backdoor.Win32.A.Dolan.20480[h] PE:Backdoor.Dolan.b!1173745952 Backdoor.Dolan.fam Backdoor.Win32.Dolan Backdoor.Dolan.fam BackDoor.Dolan Backdoor.Dolan.Win32.52 BKDR_AOLDOOR.A W32/Risk.PEXC-1723 BDS/Dolan.A.27 Trojan[Backdoor]/Win32.Dolan Backdoor.Dolan.fam Win-Trojan/Dolan.20480.D Backdoor.Dolan.fam Trojan.VBRA.01573 Backdoor.Win32.Dolan W32/Bdoor.ARY!tr.bdr BackDoor.Dolan.S Backdoor.Win32.Dolan.Alrb


A backdoor also known as: Trojan.PWS.AlLight.1.0.A Trojan-PWS/W32.AlLight.140800 PWS-LamLite.cfg Trojan.AlLight.Win32.34 Trojan/PSW.AlLight.10.a TROJ_LAMLITE.A TROJ_LAMLITE.A Trojan.PWS.AlLight.1.0.A Trojan-PSW.Win32.AlLight.10.a Trojan.PWS.AlLight.1.0.A Trojan.Win32.AlLight.dbgt Trojan.Win32.PSWAlLight.140800 Troj.PSW32.W.AlLight.10.a!c Trojan.PWS.AlLight.1.0.A TrojWare.Win32.PSW.AlLight.A Trojan.PWS.AlLight.1.0.A BackDoor.AntiLame.10 BehavesLike.Win32.Dropper.cc W32/Risk.CXII-8326 Backdoor/Antilam.10 W32.Trojan.Phisher-LamLite TR/PSW.AlLight.10.A Trojan[PSW]/Win32.AlLight Trojan.PWS.AlLight.1.0.A Trojan-PSW.Win32.AlLight.10.a PWS:Win32/LammerLight.B Backdoor.RAT.AntiLamer TrojanPSW.AlLight Win32/PSW.AlLight.10.A Win32.Trojan-qqpass.Qqrob.Pjxn Trojan.PWS.AlLight!3dq9kq5oal8 Backdoor.Win32.Antilam W32/EQSteal.A!tr


A backdoor also known as: Trojan.FlyStudio.Win32.14198 Trojan/FlyStudio.onh Win32/Oflwr.A!crypt Win32.Trojan.FlyStudio.F Riskware.Win32.ProcPatcher.djqzww Trojan.Win32.Z.Zusy.1400832.C Trojan.NtRootKit.18405 W32/Trojan.VHRL-9383 Variant.Zusy.hm RiskWare[RiskTool]/Win32.ProcPatcher.a Trojan.Zusy.D1CA4C TrojanDownloader:Win32/Nefhop.A Trj/CI.A Riskware.ProcPatcher! Win32/Trojan.Spy.6da


The Dyre financial Trojan has emerged over the past year to become one of the most potent financial fraud tools in operation.


For all registered domains we could identify NameCheap, Inc. as the registrar based in the United States.


The timestamp seems valid and close to the documented infection timeline.


A backdoor also known as: TR/Dropper.MSIL.fdxny PWS:MSIL/Stimilina.R!bit Trojan/Win32.Bladabindi.R203992 Spyware.PasswordStealer Trojan.MSIL.Spy


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9986 BackDoor.Msft.1 BehavesLike.Win32.SoftPulse.dc Virus.Win32.Virut Trojan.Zusy.D2EADF Worm:Win32/Chir.D@mm


A backdoor also known as: Trojan-PSW.Win32.Dybalom!O Trojan/Downloader.Small.almj W32/Downldr2.GCMU Win32/SillyPWS.T Win.Downloader.74007-1 Trojan-PSW.Win32.Dybalom.g Trojan.Win32.Small.vtda Trojan.Win32.Downloader.20992.MH TrojWare.Win32.TrojanDownloader.Small.~ZBL Trojan.DownLoad.41539 Downloader.Small.Win32.13741 W32/Downloader.UMUW-8666 TR/Dldr.Small.almk Trojan[PSW]/Win32.Dybalom Trojan-PSW.Win32.Dybalom.g PWS:Win32/Strpasseal.B Trojan/Win32.Downloader.R17920 TrojanPSW.Dybalom Win32.Trojan-qqpass.Qqrob.Pcsc Trojan.PWS.Strpasseal.P Trojan-Downloader.Win32.Small W32/Dybalom.SMA!tr Win32/Trojan.PSW.99c


A backdoor also known as: HW32.Packed.9AE7 Trojan.Regrun TROJ_DDOS.SMA Win.Trojan.VBDos-1 Trojan.Win32.Regrun.zft Trojan.Win32.Regrun.ewhpgb Trojan.DownLoader5.32190 TROJ_DDOS.SMA BehavesLike.Win32.Adware.dc Trojan.Regrun.aj Trojan/Win32.Regrun Trojan:Win32/Tocofob.A Trojan.Win32.Regrun.zft Trojan/Win32.Buzus.C23616 SScope.Trojan.VBRA.11870 Trojan.Heur.VP2.E3BBE8 Trojan.Win32.VB


As such, FastPOS's update does not come as a surprise—in time for the oncoming retail season to boot.


From what I can tell its still under development, this article will tell the story of this ransomware.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Bloodhound.Morphine BehavesLike.Win32.RAHack.qc Trojan.Win32.Hrup Packed.Morphine.a Backdoor:Win32/Wurdux.A.dll Trj/CI.A Packed/Morphine.B


The Postal Group is active since at least 2013 and was responsible for multiple different malware


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9995 W32/Trojan.OTQR-6881 Backdoor.Win32.Elirks.o Trojan.Win32.Elirks.evicnk Trojan.Win32.Z.Zbot.5650944 Trojan.DownLoader25.56963 Backdoor.Elirks.Win32.6 Trojan.Zbot.7 Backdoor.Win32.Elirks.o Trojan:Win32/Ralminey.A Backdoor.Elirks Win32/Trojan.BO.56e


This blogpost reveals many details about the Diskcoder.C aka ExPetr, PetrWrap, Petya, or NotPetya outbreak and related information about previously unpublished attacks.


The group has access to zero-day exploits, most likely obtained through the Elderwood framework, and uses custom-developed back door malware.


The group behind this operation has been launching targeted and possibly politically-motivated attacks to spy on individuals.


In October 2016 Forcepoint Security Labs™ discovered new versions of the MM Core backdoor being used in targeted attacks.


These samples all displayed their typical respective malware characteristics and contacted known command and control C2 servers from those families.


Back in July 2015, a new ransomware as a service named Encryptor RaaS detected by Trend Micro as RANSOM_CRYPRAAS.SM entered the threat scene, rivaling or at least expecting to succeed the likes of similar get-rich-quick schemes from Tox and ORX Locker.


A backdoor also known as: Banker/W32.Bancos.688128 Trojan.Bancos W32/Trojan.VUPB-6515 Trojan-Banker.Win32.Bancos.vdfd W32.Virut.mACM Win32.HLLW.Autoruner2.26648 Dropper.Daws.Win32.12598 Trojan.Banker.Bancos.sn Trojan[Dropper]/Win32.Daws Trojan-Banker.Win32.Bancos.vdfd Trj/CI.A Trojan.Daws Win32.Worm.Autorun.Pepg Trojan.DR.Daws!WW+h/Y0MkUk Worm.Win32.WBNA Win32/Trojan.355


A backdoor also known as: Webtoolbar.Dealply Trojan.FakeAV not-a-virus:HEUR:WebToolbar.Win32.DealPly.heur Riskware.Win32.Estapa.ewzewu Trojan.Win32.Z.Dealply.1110121 Trojan.MulDrop7.57701 BehavesLike.Win32.BadFile.tc ADWARE/DealPly.rlhsh Ransom:MSIL/Hasadcrypt.A not-a-virus:HEUR:WebToolbar.Win32.Estapa.heur Trojan/Win32.Fakeav.C939114 BScope.Trojan.DiskWriter Trj/GdSda.A Trojan-Downloader.Win32.IstBar


A backdoor also known as: Worm.Win32.AutoRun!O Worm.Wofopey.A4 Trojan.Bodegun.1 TSPY_AUTORUN_CD1027DD.RDXN Win32.Worm.AutoRun.ek W32/Worm.BLGL W32.SillyDC TSPY_AUTORUN_CD1027DD.RDXN Win.Trojan.Clicker-4047 Trojan.Win32.Fsysna.dilg Trojan.Win32.AutoRun.buecr Worm.Win32.A.AutoRun.329559 W32.W.AutoRun.lnZm Win32.HLLW.Autoruner.57463 BehavesLike.Win32.Virut.cz W32/Worm.PEBZ-4739 Worm/Win32.AutoRun Worm:Win32/Wofopey.A Trojan.Win32.Fsysna.dilg Worm/Win32.AutoRun.R1864 Trojan-Dropper.Serv.21221 W32/Autorun.KBE Win32/AutoRun.AEZ Win32.Trojan.Fsysna.Wqmj Worm.AutoRun!UZZkfeUh6N8 Win32/Trojan.c29


The document contains a malicious macro, which attempts to download the same executable file 65g3f4.exe from multiple remote locations.


The group has quietly deployed zero-day in the past, effectively spearphished targets, and maintains a modular toolset.


A backdoor also known as: Backdoor.Sdbot.AE4 RDN/Sdbot.worm!cc Backdoor.SDBot Win32.Trojan.WisdomEyes.16070401.9500.9979 RDN/Sdbot.worm!cc Trojan[Backdoor]/Win32.Sdbot Trojan.Zusy.D1B318 Backdoor:MSIL/Getob.D Backdoor.SDBot Msil.Worm.Arcdoor.Pgda Worm.MSIL.Arcdoor W32/SDBot.DPZ!tr


A backdoor also known as: Win32.Malware.Bucaspys.A W32.Malware.Bucaspys!c Trojan.PWS.Banker1.23491 BehavesLike.Win32.BadFile.rh W32/Trojan.MCYT-4284 Trojan:Win32/Bypass.D!bit Trj/GdSda.A W32/Banker.ADYA!tr.spy


A backdoor also known as: Exploit.Win32.Nuker!O W32/Trojan.Divine Win.Trojan.Nuker-3 Exploit.Win32.Nuker.Divine Exploit.Win32.Nuker.htqe Trojan.Divine Exploit.Nuker.Win32.284 W32/Trojan.Divine TR/Nuker.Divine Trojan[Exploit]/Win32.Nuker Exploit.Win32.Nuker.Divine Exploit.Nuker Nuker.Win32.Divine W32/Divine.3AD2!tr


PassiveTotal New discovered infrastructure from the Satellite Turla actor.


A backdoor also known as: Trojan.VBCrypt.MF.66 Trojan.Razy.D15523 Win32.Trojan.VB.iw W32/VBTrojan.Downloader.1D!Maxi Troj.Dropper.W32.Dinwod.mmkC TrojWare.Win32.Rimod.JO Trojan.MulDrop4.62548 Trojan.Win32.Scar W32/VBTrojan.Downloader.1D!Maxi Trojan:Win32/Bewter.A HEUR/Fakon.mwf Win32/VB.RBU Win32/Trojan.741


A backdoor also known as: Spyware.Zbot.ED WS.Reputation.1 Krypt.GB TROJ_SIGEKAF.SM Trojan:W32/Kamala.A Trojan:Win32/Hilasy.B BScope.TrojanPSW.Zbot.2716 Trojan.Win32.Hilasy W32/ZBOT.HL!tr Trj/CI.A


This iteration is targeted towards victims in Vietnam and still maintains extremely low AV detection almost a year after it was first discovered.


A backdoor also known as: W32.Sality.PE Win32.Sality.3 Virus/W32.Sality.D Worm.Win32.AutoIt!O W32.Sality.U W32/Autorun.worm.bcb Win32.Sality.3 PE_SALITY.RL W32/Autorun.TX W32.Harakit Win32/Sality.AA PE_SALITY.RL Win.Trojan.Autoit-150 Worm.Win32.AutoIt.aei Win32.Sality.3 Virus.Win32.Sality.beygb Trojan.Win32.FakeFolder.avr Win32.Sality.3 Win32.Sector.30 Virus.Sality.Win32.25 BehavesLike.Win32.Evasion.jc W32/Autorun.OHSM-3021 Win32/HLLP.Kuku.poly2 W32/Sality.AT Worm:Win32/Katar.A W32.Virut.lns0 Worm.Win32.AutoIt.aei Win32.Virus.Sality.A HEUR/Fakon.mwf Win32.Sality.3 Virus.Win32.Sality.bakc Win32/Sality.NBA Win32.Sality.BL Worm.Win32.Passma W32/Sality.AA Virus.Win32.Sality.I


We assess it is highly likely that these attacks were conducted by a Chinese cyberespionage actor related to the Operation Soft Cell campaign.


A backdoor also known as: Riskware.Win32.MyBeeSearch.euqqpm Adware.Mybeesearch.17920 Adware.MyBeeSearch.Win32.35 W32/Trojan.ZETF-8401 ADWARE/MyBeeSearch.yttss Adware.BeeSearch/Variant Trj/GdSda.A Msil.Adware.Mybeesearch.Ednu PUA.MyBeeSearch! AdWare.MSIL.Mybeesearch


Exploitation is being attempted via the usual tactic of spear phishing containing malicious attachments to targets.


It spreads within networks through PsExec and WMIC commands, using credentials stolen by a tool similiar to Mimikatz.


The installer files contained custom action commands which used PowerShell to download and execute payloads Redline Stealer, Ursnif, etc. hosted on legitimate websites.


A backdoor also known as: Trojan.Win32.Dropper.Zyon.1 Trojan.Win32.Dropper.Zyon.1 TROJ_ZYON.A TROJ_ZYON.A Trojan-Dropper.Win32.Zyon Trojan.Win32.Dropper.Zyon.1 Trojan.Win32.Zyon.hmat Troj.Dropper.W32.Zyon!c Trojan.Win32.Dropper.Zyon.1 TrojWare.Win32.Runner.Zyon Trojan.Win32.Dropper.Zyon.1 Trojan.MulDrop.103 Dropper.Zyon.Win32.4 BehavesLike.Win32.Dropper.dc W32/Trojan.AJWD-0098 TrojanDropper.Win32.Zyon W32/Zyon.A!tr Trojan[Dropper]/Win32.Zyon Trojan.Win32.Dropper.Zyon.1 Constructor/Zyon.261120 MultiDropper.cfg Win32/Runner.Zyon Win32.Trojan-dropper.Zyon.Lhdl Trojan.DR.Zyon!KwrmMz3+t6M Trojan.Win32.Runner Trojan.Win32.Dropper.Zyon.1 Dropper.Zyon.C Win32/Trojan.769


A backdoor also known as: Exp.SWF.DC Exp.Flash.Pubenush.E!c Trojan.Swifi SWF/Exploit.ExKit.A Swf.Exploit.Angler-6 Exploit.Swf.CVE20130634.efwsmo Exploit.SWF.1232 HEUR_SWFDEC.SC2 BehavesLike.Flash.Exploit.nb Trojan[Exploit]/SWF.Neclu Exploit.SWF Win32/Trojan.a4a


It is an email with the subject of Copy of Invoice 79898702coming or pretending to come from noreply@random email addresses with a semi-random named zip attachment in the format of 79898702.zip random 8 digits The zip matches the subject.


The .js file in the email attachment is a PowerShell script and there are no other files involved.


Malware, or CHM, disguised as a North Korea-related questionnaire is being distributed by the Kimsuky group, which is believed to have created and distributed the same type of malware.


The authors were probably trying to make a joke by referencing the act of getting infected with ransomware, hinting that it is uninvited and unavoidable, just like fate.


A backdoor also known as: Backdoor.Win32.Poison!IK W32/Smallworm.EEA BKDR_POISON.OM W32.SillyFDC Backdoor.Win32.Poison Dropper.VB.3.AX


A backdoor also known as: Trojan.Sisproc.A Trojan.Sisproc Adware.Antivirus2008.Win32.13 Trojan/Jorik.Vobfus.fodz Win32.Trojan.Kryptik.gz Trojan.Malcol Win32/Tnega.cTBOJZC TROJ_REDONC_EK030008.UVPM Trojan.Win32.Antivirus2008.babyvq Trojan.DownLoader6.50299 TROJ_REDONC_EK030008.UVPM BehavesLike.Win32.Downloader.qc Trojan/Jorik.esyb Trojan/Win32.Vobfus TrojanDownloader:Win32/Redonc.D Trojan.Heur.D.E8DF45 Adware.Antivirus2008!VhbgDcClaWU


A backdoor also known as: Trojan/W64.Crypt.785568 Trojan.YarripCS.S244731 Trojan/Kryptik.bbq TROJ_KRYPTIK_FF070297.UVPM Win32.Trojan.WisdomEyes.16070401.9500.9998 TROJ_KRYPTIK_FF070297.UVPM Trojan.Win64.Crypt.gp Trojan.Win64.Kryptik.euskem Trojan.Win32.Z.Crypt.785568 Troj.Win64.Crypt!c Trojan.Crypt.Win64.20 Trojan.Crypt.ld Trojan.Win64.Crypt.gp Trojan.Bedep Trj/CI.A Win64.Trojan.Crypt.Wnms Trojan.Crypt!D766Elbq30w Trojan.Win64.Bedep


An Android backdoor also known as: Trojan.MAC.Dok.E MacOS/Aptordoc.A HEUR:Trojan-Spy.OSX.Aptordoc.b Trojan.MAC.Dok.E Trojan.Mac.Mlw.eowttl Troj.Spy.Osx!c Win32.Trojan-spy.Aptordoc.Syhr Trojan.MAC.Dok.E Mac.BackDoor.Dok.5 Trojan.Aptordoc.OSX.7 MacOS/Aptordoc.A OSX/Spy.Aptordoc.jlgtm HEUR:Trojan-Spy.OSX.Aptordoc.b Trojan.MAC.Dok.E OSX/Spy.Dok.A Trojan-Banker.OSX.Aptordoc


Talos has discovered an unknown Remote Administration Tool that we believe has been in use for over 3 years.


In this respect, Vawtrak now has a 2-tier C2 discovery infrastructure.


A backdoor also known as: Trojanproxy.Hioles.19337 Trojan.Graftor.D4C0E TSPY_PROXY_BK082A47.TOMC Win32.Trojan.WisdomEyes.16070401.9500.9968 TSPY_PROXY_BK082A47.TOMC Trojan.Proxy.23012 TrojanProxy:Win32/Hioles.B Troj.W32.Scar.lrnw Win32/TrojanProxy.Hioles.AA


In the beginning of April 2016, we found evidence that the attacks against Israel have been renewed as well.


The Turla group use a range of tools and techniques, many of which are custom.


A backdoor also known as: Trojan.Kazy.D64E1 Win32.Trojan.WisdomEyes.16070401.9500.9929 Adware.Iefeats Trojan.Win32.Yabector.ddsrdc Adware.Yabector/Variant Heur.Packed.Unknown Adware.Adon Trj/CI.A Win32.Trojan.Kazy.Alij Trojan.CL.Yabector!M4hXuPydivM Win32/Trojan.e93


A backdoor also known as: Trojan.Sicil.AA3 Win32.Trojan.WisdomEyes.151026.9950.9999 W32/Sicil.A TROJ_SICIL_0000009.TOMA Trojan-Dropper.MSIL.Smaba.sg Trojan.Win32.Click1.ctoram BehavesLike.Win32.Dropper.zt W32/Sicil.YGNC-5779 W32/Malware_fam.NB Trojan.Buzy.D8E9 Trojan:MSIL/Sicil.A Trojan.Msil PSW.ILUSpy Trj/CI.A Win32/Trojan.132


A backdoor also known as: Trojan.Win32.Z.Shellcode.403968 Troj.W32.Tpyn!c BehavesLike.Win32.PWSZbot.fh Backdoor.Win32.Kbotrep W32/Trojan.FHRX-8606 Trojan.Heur.LP.E7F983 Backdoor:Win32/Kbotrep.A Trj/CI.A Win32.Trojan.Hijacker.Hzj Win32/Trojan.e04