Today RSA is reporting GlassRAT, a previously undetectable Remote Access Tool RAT which was discovered by the RSA Incident Response Team and investigated by RSA Research during an engagement with a multi-national enterprise.


A backdoor also known as: Worm.Nanspy Worm.Nanspy.Win32.9 Win32.Trojan.WisdomEyes.16070401.9500.9990 W32/Nanspy.TXTE-7172 W32.Kassbot.B Win.Worm.Nanspy-1 Net-Worm.Win32.Nanspy.e Trojan.Win32.Nanspy.fwie W32.W.Bagle.kZt7 Heur.Packed.MultiPacked BackDoor.Pyev BehavesLike.Win32.HLLPPhilis.nc Trojan-Dropper.Delf W32/Nanspy.O I-Worm/Nanspy.d WORM/Nanspy.E Backdoor:Win32/Nanspy.D Worm.Win32.Net-Nanspy.34368.B Trojan/Win32.Lydra.R96925 Net-Worm.Win32.Nanspy.e Worm.Nanspy


As such, this new attack represents a dangerous new hybrid combining the work of a notorious cyber criminal gang with Chinese cyber espionage group to attack a financial services firm.


FireEye recently discovered a new variant of a point of sale POS malware family known as NewPosThings.


A backdoor also known as: Trojan/W32.Imiserv.245760 Trojan.Imiserv.c Trojan/Imiserv.c Trojan.Win32.Malware.1 Win32/Imiserv.C Adware.IEPlugin Trojan.Win32.Imiserv.c Trojan.Win32.Imiserv.B TrojWare.Win32.Imiserv.C Trojan.Win32.Imiserv.c TROJ_IMISERVER.A Trojan.Win32.Imiserv!IK Trojan.Win32.Imiserv.B Win-Trojan/Imiserv.245760 Trojan.Win32.Imiserv.c Trojan.Imiserv.G Trojan.Win32.Imiserv W32/Imiserv.C!tr Trj/Imiserv.M


A backdoor also known as: Trojan-Clicker.Win32.VB!O Trojan.VB.al3 Trojan.VB.Win32.56708 W32/Clicker.VB.fli TROJ_LNKIEB.SMI Win32/VB.BHE TROJ_LNKIEB.SMI Win.Trojan.Clicker-4258 Trojan-Clicker.Win32.VB.fli Trojan.Win32.VB.cnwqrx Trojan.Win32.A.Clicker.36892 Win32.Trojan.Vb.Angm TrojWare.Win32.Injector.AMXL TrojanClicker.VB.ffy TR/Lnkiebes.A.6 Trojan[Clicker]/Win32.VB Trojan.Buzy.D6DC Trojan-Clicker.Win32.VB.fli Trojan:Win32/Lnkiebes.A Trojan/Win32.VB.R5515 Trojan.VBRA.03765 Win32/Spy.Chekafev.AD Trojan.CL.VB!fBU5Dy6sJXo Trojan-Clicker.Win32.VB W32/VB.F!tr


A backdoor also known as: Trojan-Spy/W32.Small.9216.J Trojan/TopAntiSpyware.i TROJ_ANTISPY.B Win32.Trojan.WisdomEyes.16070401.9500.9859 W32/Trojan.QAS Adware.Topantispyware Win32/DlExaw.E TROJ_ANTISPY.B Html.Trojan.ClickerSmall-71 Trojan.Win32.TopAntiSpyware.j Trojan.Win32.TopAntiSpyware.ehkl Troj.W32.TopAntiSpyware.j!c Win32.Trojan.Topantispyware.Wsju TrojWare.Win32.TopAntiSpyware.~BAAB Trojan.DownLoader.2049 BehavesLike.Win32.Virut.zh Trojan.Win32.TopAntiSpyware.J W32/Trojan.MSMO-2253 Trojan/TopAntiSpyware.c Trojan/Win32.TopAntiSpyware Trojan:Win32/TopAntiSpyware.J Trojan.Win32.TopAntiSpyware.j Trojan/Win32.Adload.C82279 Adware.WarSpy.G


Locky .diablo6 campaign


A backdoor also known as: Trojan.Injector.FC.81 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Dwn.dzugvc TrojWare.MSIL.Disfa.B Trojan.DownLoader17.15248 BehavesLike.Win32.Trojan.fc Trojan.MSIL.Crypt Trojan.Razy.D1AD5 Spyware.Imminent MSIL/Kryptik.EAN!tr Win32/Trojan.982


Using this and other dangerous applications uploaded by Linux.PNScan.1 to the compromised device, cybercriminals can hack administrative control panel of PHPMyAdmin, which is used to manage relational databases, and brute-force authentication credentials to get unauthorized access to various devices and servers via the SSH protocol.


During our analysis of this malware we uncovered interesting code paths and other artifacts that may indicate a Mac or Unix variant of this same tool also exists.


Aside from this campaign's motivation, what grabbed our attention was the way it utilizes pCloud, a free cloud service, for data storage and communication.


In this third part of Unit 42's Cybercrime Underground blog series, we're taking a slightly different approach.


These deceptive sites are carefully crafted to trick unsuspecting users into downloading and executing malware, which can result in stealing the victim's sensitive data.


A backdoor also known as: Trojan-PSW.Win32.QQPass!O Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/QQPass.ZQ Trojan-PSW.Win32.QQPass.gkd Trojan.Win32.QQPass.vwban Backdoor.W32.DsBot.l5eP Trojan.PWS.Lineage.10130 BehavesLike.Win32.RAHack.cm Trojan/PSW.QQPass.fng Trojan[GameThief]/Win32.Lmir Win32.Troj.QQPswT.bs.116858 Trojan.Graftor.Elzob.D486F Trojan.Tencent/Variant Trojan-PSW.Win32.QQPass.gkd SScope.Trojan-PSW.Win32.Delf.bav Worm.Win32.AutoRun


In May and June 2017, FireEye observed a phishing campaign targeting at least seven global law and investment firms.


A backdoor also known as: Trojan.Injector Trojan.Win32.Dwn.edybnj Trojan.Win32.Z.Razy.328168 Win32.Trojan.Falsesign.Phqf Trojan.DownLoader21.41335 Trojan.MSIL.Crypt TR/Dropper.MSIL.inryd Trojan.Razy.D11CB7 Trojan:Win32/Censer.A Trj/CI.A MSIL/Kryptik.GLN!tr Win32/Trojan.Dropper.32d


A strong relationship between previously identified malware samples attributed to these campaigns and the newly discovered samples examined in this report.


We have already seen large campaigns targeting Europe and other parts of the world in 2014 and 2015.


A backdoor also known as: Worm/W32.Chet.20484 W32/Chet.c@MM W32/Chet.e Trojan.Win32.Chet.emgc W32.Chet@mm Win32/Chet.E Email-Worm.Win32.Chet.e I-Worm.Chet!g52sFTlFeyo I-Worm.Win32.Chet.20484.C[h] Worm.Win32.Chet.E Win32.HLLM.Otchet.20484 Worm.Chet.Win32.4 W32/Chet.c@MM W32/Risk.ZNRZ-7753 I-Worm/Chet.a W32/Chet.E!worm Worm[Email]/Win32.Chet W32.W.Chet.e!c Win32/Chet.worm.20484.C Worm:Win32/Chet.E@mm Win32/Chet.E Worm.Chet Win32.Worm-email.Chet.Szlk Email-Worm.Win32.Chet I-Worm/Chet.C Worm.Win32.Chet.e


A backdoor also known as: Downloader.Small.Win32.7020 Trojan/Downloader.Small.bdc Win32.Trojan.WisdomEyes.16070401.9500.9963 W32/Downloader.DXO TROJ_TENGADL.A Win.Downloader.Tenga-1 Trojan-Downloader.Win32.Small.bdc Trojan.Win32.Small.glqe Trojan.Win32.Downloader.3072.B Troj.Downloader.W32.Small.bdc!c TrojWare.Win32.TrojanDownloader.Small.BDC Trojan.DownLoader.3449 TROJ_TENGADL.A W32/Downloader.GWIH-8231 TrojanDownloader.Small.bqb W32.Malware.Downloader TR/Dldr.Small.bdc.2 Trojan[Downloader]/Win32.Small TrojanDownloader:Win32/Gael.A Trojan-Downloader.Win32.Small.bdc Trojan/Win32.Downloader.C22709 Trojan-Downloader.Win32.Utenti Trj/Downloader.DNX Win32/TrojanDownloader.Small.BDC Win32.Trojan-downloader.Small.Wrpx Trojan.DL.Small!rnjf8eX9OeE Trojan-Downloader.Win32.Small W32/Small.BDC!tr


In order to infect the victims, the attackers distributed spear-phishing email, which purports to have been sent from NIC's Incident response team, the attackers spoofed an email id that is associated with Indian Ministry of Defence to send out email to the victims.


A backdoor also known as: Trojan.Paramcud TROJ_UMPER.SMSE Backdoor.Win32.3Para.e TROJ_UMPER.SMSE W32/Adware.KYIR-6825 Trojan.Adware.Symmi.D781 Trojan:Win32/Umper.A


A backdoor also known as: Trojan/IllNotifier.d TROJ_ILLNOTIF.D Win32.Trojan.WisdomEyes.16070401.9500.9964 TROJ_ILLNOTIF.D Trojan-Notifier.Win32.IllNotifier.d Trojan.Win32.IllNotifier.diak Trojan.Win32.IllNotifier.4096 Troj.Notifier.W32.IllNotifier.d!c Win32.TrojanNotifier.IllNotif.D Trojan.Illnot TrojanNotifier.IllNotifier.b TR/IllNotifier.D.1 Trojan-Notifier.Win32.IllNotifier.d Trojan:Win32/IllNotif.D TrojanNotifier.IllNotifier Trj/Notifier.C Win32/TrojanNotifier.IllNotif.D Trojan.IllNotifier!nSHIqsfdJ3I W32/IllNotifier.D!tr


A backdoor also known as: W32.IrcbotFamTMS.Worm W32/CubsPewt.worm Backdoor.RBot.Win32.1857 Trojan.Heur.VP2.Cy2aaWGg!Jbi WORM_CUBSPEW.SMD Win32.Trojan.WisdomEyes.16070401.9500.9943 W32/Worm.ATKB W32.SillyFDC Win32/Cubspewt.E WORM_CUBSPEW.SMD Win.Trojan.Mybot-11593 Trojan.Win32.Rbot.baglt Win32.Worm.Autorun.Wqwe Win32.HLLW.Autoruner.7400 BehavesLike.Win32.Dropper.gc W32/Worm.ZJYN-5347 Backdoor/RBot.jco Trojan[Backdoor]/Win32.Rbot Worm:Win32/Cubspewt.A Backdoor.Win32.IRCBot.425984.C Worm/Win32.IRCBot.R7984 Backdoor.Rbot Backdoor.Rbot


Threat actors are now using this previously unseen executable, created by Samsung, to load variants of the PlugX Trojan.


Poison Ivy has a convenient graphical user interface GUI for managing compromised hosts and provides easy access to a rich suite of post-compromise tools.


A direct trail was established over a period of years that would lead competent researchers to finger CN operators as responsible for this new activity as well.


A backdoor also known as: Dropped:Trojan.Downloader.JKFJ Dropped:Trojan.Downloader.JKFJ Trojan.Downloader.JKFJ Trojan.DownLoad.6115 Dropped:Trojan.Downloader.JKFJ Trj/Downloader.MDW


A backdoor also known as: Trojan.Llac BKDR_COMDAR.SMI Win32.Trojan.WisdomEyes.16070401.9500.9967 BKDR_COMDAR.SMI Win.Trojan.Killav-107 Trojan.Win32.Llac.dpis Trojan.Win32.Hupigon.bjsvj Trojan.Win32.Z.Hupigon.631808 Troj.W32.Llac!c Backdoor.Win32.Amtar.~dkc1 BackDoor.Comet.345 Backdoor.Hupigon.Win32.87925 BehavesLike.Win32.Dropper.jh Trojan/Scar.bmme Trojan[Backdoor]/Win32.Hupigon TrojanDownloader:Win32/Hupigon.C Trojan.Win32.Llac.dpis Trojan/Win32.Hupigon.C98989 TScope.Trojan.Delf Win32.Trojan.Llac.Swuk Virus.Win32.Delf.DTW Win32/Trojan.713


A backdoor also known as: Dropped:Backdoor.SchoolBus.C Backdoor.Schoolbus BackDoor-BL.dr Backdoor.W32.Schoolbus!c W32/Backdoor2.XLL Backdoor.Trojan BKDR_SCHOOLBUS.C Dropped:Backdoor.SchoolBus.C Backdoor.Win32.SchoolBus.15 Dropped:Backdoor.SchoolBus.C Backdoor.Win32.Z.Schoolbus.257515 Dropped:Backdoor.SchoolBus.C Dropped:Backdoor.SchoolBus.C BackDoor.SchoolBus Email-Worm.Win32.GOPworm.196 BKDR_SCHOOLBUS.C BehavesLike.Win32.Dropper.dc W32/Backdoor.CDSN-7186 BDS/SchoolBus.C.DR.8 Backdoor:Win32/Schoolbus.C.dr Backdoor.Win32.SchoolBus.15 Backdoor/Win32.Trojan.C197204 Dropped:Backdoor.SchoolBus.C Email-Worm.Win32.GOPworm.196 Backdoor.Schoolbus Bck/Iroffer.BG Backdoor.SchoolBus.C Win32/SchoolBus.C Win32.Backdoor.Schoolbus.pfo Backdoor.SchoolBus.C Win32/Trojan.374


A backdoor also known as: Trojan.Downloader.JKVR Backdoor.Pingbed Trojan.Downloader.JKVR Win32.Trojan.WisdomEyes.16070401.9500.9987 W32/Backdoor2.HAEI BKDR_PINGBED.A Trojan.Downloader.JKVR Trojan.Downloader.JKVR Trojan.Downloader.JKVR Trojan.Downloader.JKVR BKDR_PINGBED.A BehavesLike.Win32.PWSOnlineGames.pt W32/Backdoor.DODB-2037 Backdoor:Win32/Pingbed.A Trojan/Win32.Dllbot.R15525 Trojan.Downloader.JKVR Win32/Trojan.Downloader.d4d


Mad Max is a targeted trojan that uses a domain generation algorithm DGA


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9987 Win.Trojan.Enfal-36 DLOADER.Trojan BehavesLike.Win32.BadFile.qt Trojan.Heur.EED22D0 Backdoor.Win32.PcClient


A backdoor also known as: W32.PgxviewI.Trojan Win32.Worm.Donked.b Win32/Donked.A Win.Worm.Autorun-7941 Win32.Worm.Donked.A Trojan.Disabler.64 W32/Autorun.worm.he Worm:Win32/Donked.A Win32/Autorun.worm.40960.DM W32/Autorun.worm.he I-Worm.Donked.A Win32/Donked.A Worm.Donked!DgcwScp6hHo W32/Donked.BB!tr Win32/Trojan.88a


A backdoor also known as: Trojan.MulDrop7.11292 Trojan.Injector.Win32.494093 Trojan.Fsysna.guw TR/AD.NETCryptor.xslwu Trojan.MSILPerseus.D15D13 Trojan/Win32.MSILKrypt.R210547 Trj/GdSda.A Trojan.Injector!cLW3TSG0Mi8


A backdoor also known as: W32.Flashy.Trojan Packed.Win32.TDSS!O Trojan.Disabler.Win32.3 Trojan/Disabler.i WORM_FLASHY.SM Win32.Trojan.WisdomEyes.16070401.9500.9999 W32.Glupzy.A Win32/Glupzy.A WORM_FLASHY.SM Win.Trojan.Disabler-3 Trojan.Win32.Disabler.i Trojan.Win32.Disabler.reit Trojan.Win32.Disabler.21185 Win32.Trojan.Fakedoc.Auto Trojan.Flashy BehavesLike.Win32.Dropper.cz Trojan/Disabler.al TR/Disabler.I Trojan/Win32.Disabler Worm:Win32/Glupzy.A W32.W.VB.kZz1 Trojan.Win32.Disabler.i Trojan/Win32.HDC.C51559 Trojan.Flasher.2913 RiskWare.Tool.CK Win32/Disabler.I Trojan.Disabler!sfd9qm983h8 Virus.Win32.Virut W32/Disabler.I!tr Trj/Flashy.A


A backdoor also known as: BehavesLike.Win32.Conficker.mc Trojan.Razy.D1B4E2


A backdoor also known as: Android.Trojan.Gamex.A Android.FakeUpdate.B Android.Trojan.Gamex.A Android.Trojan.Gamex.e AndroidOS/Gamex.A Android.Mobigapp A.H.Rog.Gamex.B Trojan:Android/Gamex.C Android.DownLoader.1561 AndroidOS/Gamex.A ANDROID/Mobigapp.A Android.Trojan.Gamex.A Android-Trojan/Gamex.1cbc Trojan.AndroidOS.FakeSite.A Android.Trojan.Gamex.A


The ransomeware also leaves the notes README_HOW_TO_UNLOCK.html and README_HOW_TO_UNLOCK.txt throughout the system.


A backdoor also known as: Trojan.Win32.Jorik.Banker!O Trojan.Zusy.D689D Win32.Trojan.WisdomEyes.16070401.9500.9545 W32/Trojan.WDRL-5915 Trojan-Banker.Win32.TuaiBR.edq Trojan.Win32.Zusy.dckfkl Troj.W32.Jorik.Banker.dnz!c Win32.Trojan-banker.Tuaibr.Wlfg Trojan.Jorik.Win32.164763 TR/Spy.Banker.UV Trojan/Win32.Banker TrojanProxy:MSIL/Banker.G Trojan-Banker.Win32.TuaiBR.edq Trojan/Win32.Proxy.C910983 MSIL/Banker.AK!tr.spy


A backdoor also known as: Trojan.Boaxxe.E Win32.Trojan.WisdomEyes.16070401.9500.9985 TROJ_ZBOT.SMUI Packed.Win32.Krap.iu Win32.Trojan.Falsesign.Dvgf TrojWare.Win32.Kryptik.ZLB Trojan.DownLoad3.832 TROJ_ZBOT.SMUI Trojan.Win32.Cleaman Trojan/Menti.sbs Trojan[Packed]/Win32.Krap Trojan:Win32/Cleaman.B Packed.Win32.Krap.iu Trojan/Win32.Menti.R20809 SScope.Malware-Cryptor.SB.01798 Bck/Qbot.AO Trojan.Conjar.8 Trojan.Kryptik!pGFdk5FNPhE Win32/Trojan.0ce


A backdoor also known as: SMSFraud.d Win32/Hoax.ArchSMS.KC Hoax.Win32.ArchSMS.hsgx Trojan.SMSSend.520 SMSFraud.d Hoax/Win32.ArchSMS Program:Win32/Pameseg.U Hoax.Win32.ArchSMS


A backdoor also known as: W32.ShitOverVBx.PE Trojan.Win32.Cosmu!O W32.Lamer.EL3 Trojan.Downloader Downloader.VB.Win32.9689 Troj.Downloader.W32.VB.l4ji Trojan/Downloader.VB.eex TROJ_DLOADR.SMM Win32.Virus.VBbind.a W32/Worm.BAOX W32.Besverit Win32/VB.P TROJ_DLOADR.SMM Virus.Win32.Lamer.el Trojan.Win32.VB.csnpye Worm.Win32.VB.kp Win32.HLLW.Autoruner.6014 BehavesLike.Win32.Dropper.rh W32/Worm.EMYS-2108 Trojan/VB.kro WORM/VB.NVA Virus/Win32.Lamer.el Trojan:Win32/Dorv.A Trojan.Win32.Downloader.90650.B Virus.Win32.Lamer.el Win32.Application.Unwanted.B Dropper/Win32.Cosmu.R14017 SIM.Trojan.VBO.0859 Trojan.Cosmu Win32/AutoRun.VB.JP Worm.VB.FMYJ Worm.Win32 W32/OverDoom.A Worm.Win32.VB.C


Starting on October 28, we found that these two vulnerabilities were being targeted by the Angler and Nuclear exploit kits.


Unfortunately, the attack is still active and the number of victims has been increasing.


An email with the subject of UK Fuels Collection pretending to come from invoices@ebillinvoice.com with a malicious word doc attachment delivers some sort of malware.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9805 Trojan.MulDrop7.45925 BehavesLike.Win32.Trojan.hc W32/Trojan.OQZZ-1308 TR/Ransom.JigsawLocker.dneeo Trojan.MSILPerseus.D1E5AF Ransom:MSIL/JigsawLocker.A Ransom.Jigsaw Trj/GdSda.A


A backdoor also known as: WS.Reputation.1 TROJ_SPNR.08JS11 TROJ_SPNR.08JS11 Trojan:MSIL/Reploxar.A Trj/CI.A


A backdoor also known as: W97M.Downloader.EAC O97M.Downloader.GQ W97M.Downloader.EAC W2KM_FAREIT.YYSVN W97M.Downloader.EAC W97M.Downloader.EAC Trojan.Script.MLW.egddty W97M.Downloader.EAC W97M.Downloader.EAC W2KM_FAREIT.YYSVN W97M/Downloader.bhi HEUR/Macro.Downloader Trojan:O97M/Macrobe.D W97M.Downloader.EAC W97M/Downloader.bhi virus.office.obfuscated.1


This group is known to have targeted U.S. government agencies, defense contractors, aerospace firms and foreign militaries since 2009.


Unfortunately, at any given point in time, there are thousands of sites that allow users to illegally stream pirated content, and they often manage to devise strategies that allow them to monetize their illegally sourced content with programmatic advertising.


A backdoor also known as: Downloader.Small.Win32.7325 Dialer.DialerPlatformLimited Win32.Trojan.WisdomEyes.16070401.9500.9994 W32/Downloader.AULY Trojan.Packed.14 Win32/TrojanDownloader.Small.CXG TROJ_OBFUSCAT.EY Win.Trojan.Dialer-266 Trojan.Win32.Busky.cvqace TrojWare.Win32.TrojanDownloader.Small.CXG Trojan.DownLoader.based Trojan-Downloader.Win32.Busky W32/Downloader.MCGP-7971 Trojan[Downloader]/Win32.Busky TrojanDownloader:Win32/Beenut.A Win32/SillyDl.PW MalwareScope.Trojan-Downloader.Obfuscated.1


A backdoor also known as: Trojan.Potential.A Trojan/DownloaderKrap.ii Trojan.Zbot.6 Win32.Trojan.Kryptik.b W32.Priter Win32/SillyDl.YFM Packed.Win32.Krap.ii Virus.Win32.CrazyPrier.lrspi Packer.W32.Krap!c TrojWare.Win32.PkdKrap.II BehavesLike.Win32.HLLPPhilis.nh Packed.Krap.dqky Win32.Troj.fo.40176 TrojanDownloader:Win32/Potentialdownloader.A Packed.Win32.Krap.ii Trojan/Win32.Downloader.R3327 Trojan.Win32.Small.pck Trojan.Win32.Crazyman1649.A


A backdoor also known as: Win32.Lassab.A@mm Email-Worm.Win32!O W32/Lassa.b Worm.Lassorm.Win32.1 W32/Lassa.B Win32.Lassab.E90817 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Lassie.B Win.Worm.Lassorm-1 Win32.Lassab.A@mm Email-Worm.Win32.Lassorm Win32.Lassab.A@mm Trojan.Win32.Lassorm.emyb Win32.Lassab.A@mm Win32.Lassab.A@mm W32/Lassa.b Email-Worm.Win32.Lassorm Worm[Email]/Win32.Lassorm Worm:Win32/Lassab.A@mm Email-Worm.Win32.Lassorm Worm/Win32.Lassorm.C1532344 Win32.Lassab.A@mm Worm.Lassorm


A backdoor also known as: W32.HfsAutoB.DF97 Win32.Zafi.B@mm W32/Zafi.b@MM W32.W.Otwycal.l4av Win32.Zafi.B@mm Win32.Zafi.E2C45E Win32.Trojan.WisdomEyes.16070401.9500.9999 W32.Erkez.B@mm Email-Worm.Win32.Zafi.b Trojan.Win32.Zafi.icie Win32.Zafi.B@mm Win32.Hazafi.30720 BehavesLike.Win32.RAHack.mm I-Worm/Zafi.b Worm[Email]/Win32.Zafi Worm:Win32/Zafi.B@mm Email-Worm.Win32.Zafi.b Win32.Zafi.B@mm Win32.Zafi.B@mm W32/Zafi.B.worm Win32/Zafi.B


TA569 is a prolific threat actor primarily known for its deployment of website injections leading to a JavaScript payload known as SocGholish.


Here is a nice example that my spam trap captured a few days ago.


A backdoor also known as: Trojan.Bebloh.Win32.427 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Injector.CMX TROJ_HPISDA.SM2 Trojan.Win32.NaKocTb.eiktob Trojan.Win32.Inject.213504 Troj.W32.Inject.tn8S BackDoor.Bebloh.272 TROJ_HPISDA.SM2 BehavesLike.Win32.Downloader.ch W32/Injector.UCTI-2382 Trojan.Inject.tpn Trojan/Win32.Inject Trojan.Strictor.D1C966 Backdoor:Win32/Carrotime.A Trojan/Win32.Inject.C1667127 Trj/RansomCrypt.J W32/Kryptik.FJVT!tr


A backdoor also known as: Worm.Downloader Worm.Downloader.Win32.3750 Win32.Trojan.WisdomEyes.16070401.9500.9984 Trojan.Dropper Win.Exploit.Fnstenv_mov-1 Worm.Win32.Downloader.am Trojan.Win32.Rubbish.evjgzp Trojan.Win32.Z.Downloader.135168.A Troj.GameThief.W32.OnLineGames.kZce Worm.Win32.Jalous.K Win32.HLLW.Rubbish BehavesLike.Win32.Downloader.ct Trojan.Win32.KillAV Worm/Downloader.ays EXP/Flash.EB.625 Worm/Win32.Downloader Win32.Troj.DwonLoaderT.xy.133203 Trojan:Win32/Elfapault.A Worm.Win32.Downloader.am Worm/Win32.Downloader.R2522 Win32/Jalous.K Win32.Worm.Downloader.Szlf


This can be anywhere from using the same strings, to weak obfuscation routines, or re-using the same snippet of code.


In July 2017 we discovered a malicious email sample delivering a new variant of Ursnif, attached within an encrypted Word document with the plaintext password within the email body.


A backdoor also known as: Trojan.Maener.A5 Trojan/CoinMiner.uy Trojan.Zusy.D19BD4 Win32/Tnega.AHKfcVD Win.Trojan.Maener-1 Trojan.Win32.BitCoinMiner.dfdxgr TrojWare.Win32.Graftor.PQIF Trojan.DownLoader11.43085 BehavesLike.Win32.AdwareLinkury.dm Trojan.Win32.CoinMiner Trojan:Win32/Maener.C!bit Trojan.BitCoinMiner Trojan.CoinMiner!oi2LJpWWJQU W32/CoinMiner.TY!tr Win32/Trojan.9e3


Recently, the Winnti group, a threat actor with a past of traditional cybercrime -particularly with financial fraud, has been seen abusing GitHub by turning it into a conduit for the command and control C and C communications of their seemingly new backdoor detected by Trend Micro as BKDR64_WINNTI.ONM.


A backdoor also known as: Backdoor.Vinself.B Trojan.Vinself Trojan.PWS.DPD.8 BehavesLike.Win32.VTFlooder.ch Trojan.Symmi.DA32B Backdoor:Win32/Wakbot.B Trj/CI.A


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Win32.Banker.evqhye BehavesLike.Win32.Dropper.ph W32/Trojan.SNBX-9361 TR/Spy.Banker.fyxgc Trojan.Symmi.DC916 Trj/GdSda.A Win32/Trojan.e6d


A backdoor also known as: W32.eHeur.Virus02 Win32.Trojan.WisdomEyes.16070401.9500.9888 Trojan.Giku.Win32.37 BehavesLike.Win32.Ransomware.fc TrojanDownloader:Win32/Gladgerown.B Trojan-Proxy.AOSK


While Panda Banker has become more prevalent in recent weeks, we have been tracking a large campaign this week targeting banks in Europe and Australia and, interestingly, UK online casinos and international online payment systems.


A backdoor also known as: Trojan.Zusy.D22B33 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Hijacker.evkwtm Trojan.DownLoader25.54001 Trojan.Win32.Pastraw Trojan:Win32/Nibagem.A Trojan/Win32.Asprox.C718808 SScope.Backdoor.Sdbot W32/Pastraw.A!tr Win32/Trojan.d54


A backdoor also known as: Trojan.YakesCS.S1573857 Trojan.Ransom.Sage Trojan.Filecoder.Win32.6418 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.HXTV-7683 Ransom.Cry!g2 Trojan.Win32.Filecoder.etsgeu TrojWare.Win32.Filecoder.GT Trojan.DownLoader25.46287 BehavesLike.Win32.Downloader.gc Trojan.Yakes.xat TR/Crypt.ZPACK.hzbag Trojan.Win32.Sage.442368 Trojan.Yakes Ransom.FileCryptor Win32/Filecoder.NHQ Trojan.Yakes!0Hl2Fx4Uudk


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9912 Backdoor:Win32/Ptiger.A


A backdoor also known as: Trojan.Vreikstadi Trojan.Win32.Inject.evlgqj Trojan.Win32.Injector W32/Trojan.HMUN-3172 TR/Injector.avgqa Trj/GdSda.A


A backdoor also known as: W32.LogoOneR.PE Worm.Win32.Viking!O W32/HLLP.Philis.ba Worm.Viking.Win32.8 Trojan/PSW.Delf.qo Win32.Worm.Viking.a W32/PWStealer.AOC W32.Looked.P PE_LOOKED.FX Win.Spyware.11941-2 Worm.Win32.Viking.mi Trojan.Win32.Viking.btggzy Worm.Win32.Viking.49152 Worm.Win32.Viking.ae Win32.Viking.AT~clean Win32.HLLW.Gavir.93 PE_LOOKED.FX BehavesLike.Win32.HLLPPhilis.dz Worm.Win32.Viking Worm/Viking.el Worm/Win32.Viking.mi Win32.Viking.av.49152 Virus:Win32/Viking.JB Backdoor.W32.Bifrose.lz9q Worm.Win32.Viking.mi MalwareScope.Worm.Viking.4 Win32/Viking.AT Worm.Viking.FP W32/Viking.WH.worm


A backdoor also known as: Trojan.Downloader.Sherlol.A Trojan-Downloader/W32.Sherlol.4608 Trojan/StartPage.cj Trojan.Downloader.Sherlol.A Trojan.DL.Sherlol!c8F6ghXOM0o Win32/TrojanDownloader.Sherlol Trojan-Downloader.Win32.Sherlol Trojan.Win32.Sherlol.dngr Trojan.Win32.Downloader.4608.EN[h] Trojan.Downloader.Sherlol.A TrojWare.Win32.TrojanDownloader.Sherlol Trojan.Downloader.Sherlol.A Trojan.DownLoader.4608 Downloader.Sherlol.Win32.3 BehavesLike.Win32.Downloader.xt TrojanDownloader.Satray.k TR/Dldr.Sherlol W32/Sherlol.CJ!tr Trojan[Downloader]/Win32.Sherlol Trojan.Downloader.Sherlol.A Troj.Downloader.W32.Sherlol!c Win-Trojan/Sherlol.4608 Win32/Startpage.CJ!downloader Trojan.Downloader.Sherlol.A Trj/Downloader.CET Trojan.Win32.StartPage Trojan.Downloader.Sherlol.A Downloader.Sherlol.B


A backdoor also known as: Trojan.Sirefef.FR Trojan.Sirefef.FR Win32.Trojan.Sirefef.b Trojan.Sirefef.FR Trojan.Sirefef.FR BackDoor.Maxplus.5220 BehavesLike.Win64.Ramnit.pt Trojan.Win64 Trojan[Backdoor]/Win64.ZAccess Trojan.Sirefef.FR Trojan:Win64/Sirefef.F Trojan.Sirefef.FR Win64/Sirefef.W


A backdoor also known as: Trojan.BAT.Starter.bn Bat.Trojan.Starter.Aliq Backdoor:Win32/Teldoor.C Trojan.BAT.Starter.bn Trojan/Win32.Dropper.C406140 Trojan.Horst.0315 Trj/GdSda.A


A backdoor also known as: Trojan.Symmi.D2391 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Neshgaig-1 BehavesLike.Win32.Worm.gc W32/Trojan.MVJF-1155 Heur:Trojan/PSW.Dnf TrojanDownloader:Win32/Somex.B TrojanSpy.TravNet Trj/GdSda.A


The operation remains active at the time of writing this post, with attacks reported as recently as February 2017.


The malware authors are currently targeting users of Mexico s second largest bank, Banamex, but it is capable of updating the configuration file to include more financial institutions.


A backdoor targetting Linux also known as: Trojan.Linux.ChinaZ.D Trojan-DDoS.Linux.Znaich.A Trojan.Linux.ChinaZ.D ELF_ZANICH.SMB Trojan.Linux.ChinaZ.D HEUR:Trojan-DDoS.Linux.Znaich.a Trojan.Linux.ChinaZ.D Trojan.Znaich.exfzmb Troj.Ddos.Linux!c Trojan.Linux.ChinaZ.D Trojan.Linux.ChinaZ.D Linux.DDoS.73 Trojan.ChinaZ.Linux.14 ELF_ZANICH.SMB Linux/DDoS-Flood.B ELF/Trojan.ULZK-7 TrojanDDoS.Linux.ax LINUX/ChinaZ.eevfy Trojan[DDoS]/Linux.Znaich.a Trojan.Linux.ChinaZ.D Linux/Ddos.1806356 HEUR:Trojan-DDoS.Linux.Znaich.a Linux/DDoS-Flood.B Trojan.Linux.Znaich.aaac DDOS.Linux.CinaZ Win32/Trojan.9b6


Bartalex is a name that continues to appear in a cyberthief's arsenal as one of the most popular mechanisms for distributing banking Trojans, ransomware, RATs, and other malware.


It is no surprise it's now being used against pro-democracy organizations and supporters in Hong Kong that have long been a target of advanced attack campaigns.


A backdoor also known as: W32.OnGameBTP.Worm Trojan-PWS/W32.WebGame.34816.CL Trojan-GameThief.Win32.OnLineGames!O Trojan.Downloader.E9C186 Win32.Trojan.WisdomEyes.16070401.9500.9991 W32/Pws.AHAF Trojan.Win32.OnLineGames.cwndth Trojan.Win32.Z.Onlinegames.34816.AS Trojan.PWS.Gamania.10257 Trojan.OnLineGames.Win32.121510 Trojan-GameThief.Win32.OnLineGames Trojan/PSW.OnLineGames.aibk Trojan[GameThief]/Win32.OnLineGames Win32.Troj.Downloader.gy.kcloud Trojan/Win32.OnlineGameHack.C55967 W32/OnlineGames.SOI!tr.pws Win32/Trojan.2ff


Version 2, also referred to as Globe2, appeared two months later, in October, but both versions were no match for Emsisoft's team, who released free decrypters for both variants shortly after Globe and Globe2 started hitting users.


A backdoor also known as: JS:Trojan.JS.Redirector.BS JS.Redirector.DE JS:Trojan.JS.Redirector.BS JS/Redir.WI Trojan.Malscript!html JS:Trojan.JS.Redirector.BS JS:Trojan.JS.Redirector.BS Trojan.Script.Expack.drqfka JS:Trojan.JS.Redirector.BS JS:Trojan.JS.Redirector.BS BehavesLike.PDF.Trojan.db JS/Redir.WI TrojanDownloader.JS.aufd JS/Redirector.OA.1 JS:Trojan.JS.Redirector.BS


A backdoor also known as: TSPY_WHITEICE_BK22015F.TOMC Win32.Worm.WhiteIce.a TSPY_WHITEICE_BK22015F.TOMC Trojan.Win32.WhiteIce.cyctb Win32.Virus.Whiteice.Tcvt Win32.HLLW.Bice.8 BehavesLike.Win32.Trojan.jh Virus.Win32.Whiteice WORM/Darksnow.37953.2 Worm/Win32.WhiteIce.R35142 Worm.WhiteIce Win32/Whiteice.B Worm.WhiteIce!tYiT3Eh27BE Trj/CI.A Virus.Win32.BlackIce.C


A backdoor also known as: JS/ProxyJack.C1!Eldorado JS.Downloader JS/ProxyChanger.BF BehavesLike.JS.Exploit.mm JS/ProxyJack.C1!Eldorado TrojanProxy:JS/Kovonionz.A JS/Nemucod.io Trojan.JS.ProxyChanger JS/ProxyChanger.BF!tr


The Trojan uses the Windows Management Instrumentation Command-line WMIC to start processes remotely on other Windows computers.


New OSX_DOK.C variant performing MiTM.


A backdoor also known as: W32.SwenA.Worm Worm/W32.Swen.151552 Email-Worm.Win32!O W32.Swen.A W32.W.Swen!c Win32.Trojan.WisdomEyes.16070401.9500.9969 W32/Swen.A@mm W32.Swen.A@mm Win32/Swen.A Win.Worm.Gibe-4 Trojan.Win32.Scar.fcci Trojan.Win32.Swen.gicl I-Worm.Win32.Swen.106496 Win32.Trojan.Scar.Wofg Worm.Win32.Swen.A Win32.HLLM.Gibe.2 Worm.Swen.Win32.3 Email-Worm.Win32.Swen W32/Swen.A@mm Trojan/Win32.Scar Trojan.Win32.Scar.fcci Worm:Win32/Swen.A@mm Email-Worm.Win32.Swen W32/Gibe.C.worm I-Worm.Swen.A Win32/Swen.A I-Worm.Swen.A1 W32/Swen.A@mm


A backdoor also known as: W32.GekasiK.Trojan Worm.Foler.E5 WORM_SILLY.WXXZLDR Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Hangove WORM_SILLY.WXXZLDR Virus.Win32.Renamer.u ApplicUnwnt.Win32.ArchSMS.DRPA Worm.Renamer.Win32.2 BehavesLike.Win32.Virus.gm Trojan.Win32.Webprefix Virus/Win32.Renamer.u Trojan.Zusy.D15B99 Virus.Win32.Renamer.u Worm:Win32/Foler.C Worm.Win32.Foler.a W32/Foler.A!worm Win32/Worm.b18


Looking closer at the structure of this attack, we were surprised when we realized this was the infamous Blackhole.


In May we also observed an Office 365 credential phishing attack leading to iSpy Keylogger but the combination of OWA with this infection chain takes a different approach.


New activity from NewPOSThings and the You Chung actor.


A backdoor also known as: W32.OnlineGameNAKSD.Trojan Trojan-Downloader.Win32.VB!O Trojan.VBCrypt.MF.90 Downloader.VB.Win32.66970 Trojan/Downloader.VB.zqs Trojan.Heur.ZGY.5 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan3.BYE Backdoor.Trojan Win32/Axespec.C TSPY_ZBOT.BVV Trojan-Downloader.Win32.VB.zqs Trojan.Win32.VB.bcwli Trojan.Win32.Downloader.71680.CE Trojan.Oficla.59 TSPY_ZBOT.BVV BehavesLike.Win32.PWSAxespec.wc Trojan-Ransom.Win32.PornoBlocker TrojanDownloader.VB.dfho PWS:Win32/Axespec.C Troj.Downloader.W32.VB.tnTN Trojan-Downloader.Win32.VB.zqs Trojan/Win32.FakeAV.R51073 PWS-Axespec.f SScope.Trojan.VB.0862 Trojan.Dropper.VB Trojan.Injector.SOC W32/Injector.VOX!tr


A backdoor also known as: Trojan.VB.bjci Trojan.Win32.VB.bkqmep VBTroj.MYNR Trojan.Win32.VB.bjci Trojan.DL.VB!OZxgAC/E/K8 Trojan.Win32.A.VB.1289216[ASPack] TrojWare.Win32.VB.baur Trojan.DownLoader5.27404 Trojan/Win32.VB W32/Trojan.SXSN-1674 Trojan.VB Trojan-Downloader.VB Downloader.VB.7.BG Trj/CI.A


A backdoor also known as: Heur.Corrupt.PE BehavesLike.Win32.Rontokbro.nc TrojanDownloader.Femad.at HackTool[Constructor]/Win32.Bom Constructor:Win32/Bom.7_0.dam#2


Unit 42 has discovered a new malware family we've named Reaver with ties to attackers who use SunOrcal malware.


This article will walk through an incident where Tomcat is used and what critical artifacts you should collect.


Check Point Research's new report on Chinese cyber-espionage attacks against Southeast Asian government entities shows that a previously undisclosed toolset used by an APT group has been linked to a new family of malware.


A backdoor also known as: WORM_RBOT.AS Win32.Trojan.WisdomEyes.16070401.9500.9761 W32/Backdoor2.DNGR Win32/SillyAutorun.AIH WORM_RBOT.AS Packed.Win32.CPEX-based.ht Trojan.Win32.CPEXbased.bregf Trojan.MulDrop.23017 W32/Backdoor.MVUH-2689 Backdoor/VB.nkv Packed.Win32.CPEX-based.ht Trojan/Win32.Xema.R61630


The actors involved seem to be the same as the ones behind the self sufficient Flash malverts/exploits we've documented before and also reported by security researcher Kafeine Spartan EK.


A backdoor also known as: Trojan.NSIS.Miner.SD Trojan.Strictor.D1B5F4 Multi.Threats.InArchive W32/Trojan.RYKP-1781 WORM_CO.331300D2 Win.Trojan.Virtob-1633 Trojan.Win32.CoinMiner.bn Trojan.Win32.BitCoinMiner.ddjqfi AdWare.W32.OneInstaller.lZ9E Win32.Trojan.Miner.Wwen Trojan.BtcMine.1033 WORM_CO.331300D2 BehavesLike.Win32.TrojanCoinMiner.vc Trojan.NSIS.Coinminer W32/Trojan2.OZCV Trojan/PSW.Tepfer.cbjx Trojan/Win32.Miner.ayf Trojan:Win32/CoinMiner.AQ Trojan.Win32.CoinMiner.bn Trojan/Win32.BitCoinMiner.C931392 RiskWare.BitCoinMiner NSIS/CoinMiner.N W32/Miner.AYF!tr Trj/CI.A


A backdoor also known as: W32.OnlinegameXMQB.Trojan Trojan.FlyStudio.UJ W32/AutoRun.soq Win32.Trojan.FlyStudio.hd W32.SillyFDC Win32/Nuj.AD WORM_FLYSTUDI.B Win.Worm.FlyStudio-23 Trojan.Win32.Crypted.wjgrc Worm.Win32.Autorun.175133 W32.W.AutoRun.l8Zk Trojan.Click2.51706 Worm.AutoRun.Win32.2576 WORM_FLYSTUDI.B BehavesLike.Win32.Autorun.bc Trojan.Win32.FlyStudio Worm/AutoRun.fpz Worm/Win32.FlyStudio Worm:Win32/Regul.B Worm.FlyStudio Trj/FlyStudio.CR Trojan.FlyStudio.NAQ Win32/FlyStudio.NAQ Trojan.Win32.FakeFolder.t


In this blog entry, we will introduce and analyze the other tools and malware used by Earth Preta.


This IP address has been observed attempting to bruteforce SSH server credentials, SSH, which stands for Secure Shell, is a [network protocol]https://null-byte.wonderhowto.com/how-to/networking-basics/ that allows for encrypted communication over an insecure network.


A backdoor also known as: W32.FakeDirC.Worm Win32.Tyhos.A Virus.Win32.Tyhos!O Trojan.Malex.F2 Virus.Tyhos.Win32.4 Win32.Tyhos.A W32.Virut.CF Win32/Tyhos.A Virus.Win32.Tyhos.a Win32.Tyhos.A Trojan.Win32.Tyhos.bdclx Packer.W32.Tibs.l4Hz Trojan.Win32.FakeFolder.mgge Win32.Tyhos.A Win32.Tyhos.A Trojan.Styho BehavesLike.Win32.VirRansom.ph Win32/Virut.bv Virus/Win32.Tyhos.a Worm:Win32/Nestog.A Virus.Win32.Tyhos.a Win32.Tyhos.A HEUR/Fakon.mwf Win32.Tyhos.A Win32.Virut.NAB Win32/Virut.NBP Virus.Win32.Tyhos Trj/Tyghos.A Win32/Virus.4bd


A backdoor also known as: Trojan.Tapslix RDN/Autorun.worm!e Win32.Trojan.WisdomEyes.16070401.9500.9995 W32/Trojan.PONZ-7153 Trojan.DownLoader5.52616 RDN/Autorun.worm!e Trojan/Win32.Unknown Trojan.Strictor.D4F65 Trojan:Win32/Tapslix.A HEUR/Fakon.mwf Win32.Trojan.Fakedoc.Auto Trojan.CFI!dl5uaEh6TdQ W32/Yoddos.AG!tr


Operation Black Atlas has already spread to a multi-state healthcare provider, dental clinics, a machine manufacturer, a technology company focusing on insurance services, a gas station that has a multi-state presence, and a beauty supply shop.


Within the framework of the analyzes, however, the BSI has not discovered any malicious software; infections are also not known to the BSI.


A backdoor also known as: Backdoor/W32.Death_Packed.439808 BackDoor-FP.cli Backdoor.Death!/0dScPy2Eok Win32/Death.23 W32/Death.C Backdoor.Trojan W32/Death.2_3 Trojan.Win32.Heur.089 Win32.Death.23 Backdoor.Win32.Death.23 Backdoor.Death.23 Backdoor.Win32.Death.23 Backdoor.Death.23 BackDoor.Death.23 TR/Dearh.23.Cli Backdoor.Win32.Death!IK Backdoor/Death.23 Backdoor/Win32.Death Backdoor.Win32.Death_23.Client Backdoor.Death.23 W32/Death.C Win-Trojan/Death.439808 Backdoor.Trojan Backdoor.Win32.Death W32/Backdoor.LamersDeath-FP BackDoor.Death Bck/Death.23.I


A backdoor also known as: Trojan.Fareit W32/Injector.GFG Trojan.Win32.Stealer.ewulwv Trojan.Win32.Z.Injector.999936 Trojan.PWS.Stealer.20566 Trojan.Win32.Injector W32/Injector.NZPO-0886 DR/Delphi.pzjjj Trojan[Backdoor]/Win32.Androm Trojan/Win32.Inject.R217517 Backdoor.Androm Trj/CI.A Win32.Trojan.Delf.Swaz W32/Injector.DVFA!tr Win32/Trojan.986


A backdoor also known as: Backdoor.Temratanam Trojan.MaskedTeamViewer Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.SCHM-2542 TROJ_GE.52AE4DE2 Backdoor.Win32.TeamBot.cq Trojan.Win32.TeamBot.eutqba BackDoor.TeamViewer.45 TROJ_GE.52AE4DE2 BehavesLike.Win32.Backdoor.tc Backdoor:Win32/Temratanam.A Backdoor.Win32.TeamBot.cq PUP/Win32.StartSurf.R196040 Backdoor.TeamBot Trj/GdSda.A


A backdoor also known as: W32.RugoAd.Fam.Trojan TrojanDropper.Purgodoor.A5 TROJ_DROPR.SMD1 Adware.Rugo TROJ_DROPR.SMD1 AdWare.W32.BHO.lhD4 ApplicUnsaf.Win32.AdWare.BHO.AM Trojan.MulDrop1.42303 BehavesLike.Win32.Downloader.gc Adware/MsLock.akh GrayWare[AdWare]/Win32.BHO TrojanDropper:Win32/Purgodoor.A Dropper/Win32.Cadro.R1482 Adware-Rugo.f AdWare.BHO Trj/CI.A Win32.Trojan.Obfuscator.Ajla not-a-virus:AdWare.Win32.BHO Win32/Trojan.b5d


A backdoor also known as: Backdoor/W32.InfecDoor.746584 Backdoor.InfecDoor!stFv1Z+nlTE Win32/Infector.20.A Backdoor.Surgeon BKDR_INFDOOR20.A Win32.InfecDoor.20.a Trojan.Infector-17 Backdoor.Win32.InfecDoor.20.a Backdoor.Win32.InfecDoor!IK Backdoor.Win32.Infector.20.A BackDoor.Infector.20 BDS/Infect.20.Srv2 BKDR_INFDOOR20.A Win32/Theinf.20.B Backdoor/Infector.20.a Backdoor:Win32/Infector.2_0 Backdoor.Win32.InfecDoor_20 Win-Trojan/Infecdoor.746584 Backdoor.Surgeon Backdoor.Win32.InfecDoor BackDoor.Infector Bck/Infector.20


We believe the threat actors behind the attack don't use exploit kits and automated installers to instantly compromise and infect victims.


A backdoor also known as: Win32.Trojan-Downloader.Small.alkd.3.Pack W32/Downldr3.EY Trojan-Downloader.Win32.Small.aowd Trojan.DownLoad1.37207 TROJ_DOWGAV.SMF Win32/SillyDl.NUS W32/Downldr3.EY TrojanDownloader.Small.aqlm Trojan-Downloader.Win32.Small!IK TrojanDownloader:Win32/Dowgav.A Trojan-Downloader.Win32.Small.aowd Trojan-Downloader.Win32.Small Trj/CI.A


Using their advanced toolkit, the Turla group compromise networks for the purposes of intelligence collection.


A backdoor also known as: Trojan.Zenshirsh.SL7 Packer.W32.Krap.lFn4 Win32.Trojan.WisdomEyes.16070401.9500.9995 TSPY_EMOTET.SMD12 Trojan.Win32.Gozi.euritn BackDoor.Gozi.135 TrojanSpy.Ursnif.afo TR/Crypt.Xpack.ekgur Trojan:Win32/Trriloa.A Trj/CI.A Trojan.Win32.Krypt Win32/Trojan.8ad


The infection vector is a Hangul Word Processor document HWP, a popular alternative to Microsoft Office for South Korean users developed by Hancom.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 BehavesLike.Win32.Trojan.cc TR/Crypt.ZPACK.oltlq Trojan.Barys.DD8C9 HackTool:Win64/Mimikatz.A Win-Trojan/MSILKrypt02.Exp Trojan.MSIL.Inject MSIL/Injector.QOT!tr Trj/GdSda.A


This document likely marks the first observed use of this technique by APT28.


The adversaries appear to have evolved their tactics and techniques throughout the tracked time-period, iterating through a diverse toolset across different waves of attacks.


A day before the controversial United States Presidential elections, an email was distributed to inform the recipients of a possible attack during election day as mentioned in a manifesto, allegedly from the ISIS terrorist group, entitled The Murtadd Vote


The C2 backend url looks like this : https : //evilhost/c2folder/njs2/ ? fields [ ] .


A backdoor also known as: Rootkit.Win32.Stuxnet!O Trojan/Stuxnet.a Win32/PcClient.ACH RTKT_STUXNET.SMA Win.Worm.Stuxnet-10 Rootkit.Win32.Stuxnet.a Trojan.Win32.Stuxnet.ioljg Trojan.Win32.Stuxnet.19968 Rootkit.W32.Stuxnet!c Win32.Rootkit.Stuxnet.Hxqi Trojan:W32/Stuxnet.A Trojan.Stuxnet.1 Rootkit.Stuxnet.Win32.5 RTKT_STUXNET.SMA Rootkit.Stuxnet.b W32.Stuxnet Trojan[Rootkit]/Win32.Stuxnet Win32.Troj.LnkExploit.aa.26616 Trojan.Graftor.DB580 Rootkit.Win32.Stuxnet.a Trojan:WinNT/Stuxnet.A Win-Trojan/Stuxnet.26872 SScope.Rootkit.TmpHider.2 Rootkit.Stuxnet.Z Rootkit.Win32.Stuxnet W32/Stuxnet.A!tr.rkit Win32/RootKit.Rootkit.f73


A backdoor also known as: Trojan/Fleercivet.aa Win.Trojan.Fleercivet-3 BackDoor.Fleercivet.42 Trojan.Fleercivet.Win32.81 Trojan:Win64/Fleercivet.A Win64/Fleercivet.AA Trojan.Fleercivet!


The threat group amassed a significant amount of data, from Skype account databases to planning documents and spreadsheets to photos.


A backdoor also known as: Trojan.Spinfy.A4 Trojan/Injector.uni TROJ_FINSPY.A Win32.Trojan.WisdomEyes.16070401.9500.9985 W32/FinFish.ZBVH-2442 Backdoor.Finfish TROJ_FINSPY.A Win.Trojan.FinFisher-1 Backdoor.Win32.Finfish.a Backdoor.W32.Finfish.a!c TrojWare.Win32.FinSpy.A Trojan.MulDrop3.31380 Backdoor.Finfish.Win32.3 W32/FinFish.A Trojan[Backdoor]/Win32.Finfish Trojan:Win32/Spinfy.A Trojan.FinFisher.1 Backdoor.Win32.Finfish.a Backdoor/Win32.Finfish.C198683 Trj/CI.A Win32.Backdoor.Finfish.Eeri Backdoor.Finfish!glcRlW9Rsiw Trojan.Win32.Finspy W32/Finfish.A!tr.bdr Win32/Trojan.5ec


Philadelphia has many features, including the ability to generate PDF reports and charts of victims to track the campaigns, as well as the ability to plot victims around the world using Google Maps.


Is UrlZone still a threat and if so, how has it changed?


JPCERT/CC has been observing attacks using Datper since around June 2016.


A backdoor also known as: TrojanDropper.Dapato.S8172 TROJ_INDIGOROSE_FC140186.UVPM TROJ_INDIGOROSE_FC140186.UVPM Trojan.Win32.IndigoRose.eujbip Trojan.Win32.Z.Indigorose.2334813 Trojan.DownLoader21.23836 BehavesLike.Win32.BadFile.vh TR/Dldr.IndigoRose.xrkh TrojanDownloader:Win32/Inros.A Downloader.AdLoad Trj/CI.A Win32/TrojanDownloader.IndigoRose.AI Trojan-Downloader.Win32.Indigorose Win32/Trojan.b3d


A backdoor also known as: VB:Trojan.Valyria.1019 O97M.Dropper.BS VB:Trojan.Valyria.1019 VB:Trojan.Valyria.1019 Trojan.Ole2.Vbs-heuristic.druvzi VB:Trojan.Valyria.1019 VB:Trojan.Valyria.1019 HEUR_VBA.D TrojanDownloader:O97M/Crosspim.A VB:Trojan.Valyria.D3FB VB:Trojan.Valyria.1019 VBA/TrojanDownloader.DZN!tr virus.office.qexvmc.1075


Unit 42 has recently discovered a new keylogger, named NexusLogger, being used in attempted unsuccessful attacks against Palo Alto Networks customers.


They seem to use the same technique of mimicking a website associated with well-known software like Notepad++ and Blender 3D.


A backdoor also known as: Trojan.Razy.D39F0E Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.DownLoader25.65030 BehavesLike.Win32.Trojan.bh TrojanDropper:MSIL/Muldalun.A!bit


In May 2017, Palo Alto Networks Unit 42 identified a limited spear phishing campaign targeting various individuals across the world.


A backdoor also known as: Trojan.Win32.Androm.drayhs Trojan.DownLoader18.10874 Downloader.Banload.Win32.64034 Trojan/Inject.axyw TrojanDownloader:Win32/BrobanLaw.A Trojan.Strictor.D15B7B Trojan/Win32.MDA.R160449 Trojan.Banker.IGF


A backdoor also known as: W32.LibarokI.Trojan Trojan/Scar.ejki Win32.Trojan.WisdomEyes.16070401.9500.9609 Trojan.Badlib Win.Downloader.Delf-12262 Trojan.Win32.Scar.256000.B Trojan.DownLoader4.22959 Trojan.Scar.Win32.50666 Backdoor.Win32.Bafruz Backdoor:Win32/Bafruz.C Trojan.Delf.01357 Bck/Koobface.AA


A backdoor also known as: Trojan.Bagsu.S31234 Trojan/IRCBot.nhr BKDR_IRCBOT.SMB Backdoor.IRC.Bot BKDR_IRCBOT.SMB BehavesLike.Win32.Dropper.cm Backdoor.Win32.Ursap Backdoor.Athena Win32/IRCBot.NHR


It is mainly an information stealer and malware downloader network which installs other malware on infected machines.


A backdoor also known as: Trojan.PSW.FakeAIM.C Trojan.PSW.FakeAIM.C Trojan.PSW.FakeAIM.C W32/PWS.BXQR-8711 Infostealer.Snatch Trojan.PSW.FakeAIM.C Trojan-PSW.Win32.FakeAIM.d Trojan.PSW.FakeAIM.C Trojan.Win32.FakeAIM.dgtt Trojan.Win32.PSWFakeAIM.78848 Troj.PSW32.W.FakeAIM.c!c Trojan.PSW.FakeAIM.C TrojWare.Win32.PSW.FakeAIM.D Trojan.PSW.FakeAIM.C Trojan.PWS.Fakeaim Trojan.FakeAIM.Win32.6 BehavesLike.Win32.Trojan.lc W32/Pws.TXC Trojan/PSW.FakeAIM.c TR/PSW.FakeAIM.C.1 Trojan[PSW]/Win32.FakeAIM PWS:Win32/FakeAIM.C Trojan-PSW.Win32.FakeAIM.d Trojan/Win32.Xema.R89227 TScope.Trojan.VB Win32/PSW.FakeAIM.D W32/AIMFake.C!tr.pws Win32/Trojan.PSW.ee5


On March 9 2016, Cyphort Labs discovered an infection on a porn site keng94dotcom redirecting visitors to an exploit kit and installing a Ransom Locker.


One good thing about having a lot of Facebook friends is that you simply act as a honey pot when your friends click on malicious things.


The malicious script fingerprints the victim's machine and can receive any command that will run via PowerShell.


Instead, an accurate assessment is that a previously active Windows botnet is spreading a Mirai bot variant.


ESET researchers analyzed a preference file that was used to compromise the system when Uploader! is launched.


These campaigns not only represent an uptick in our observed instances of Kronos banker but also a new application of the malware that was first introduced in June 2014 and that we most recently described in relation to campaigns targeting Canada.


The Anthem attack is only one of multiple campaigns that Symantec has attributed to this group.


This blog post describes details that we discovered during our analysis of malware that focuses on a specific country — Libya.


This Zscaler ThreatLabz research article investigates the latest malware campaign of DBatLoader, which is being used by threat actors to target various businesses in European countries with Remcos RAT and Formbook.


A backdoor also known as: VBA.Trojan.Obfuscated.af W2KM_DLOADR.YYSQK Trojan.Ole2.Vbs-heuristic.druvzi W2KM_DLOADR.YYSQK Trojan:X97M/ShellHide.C virus.office.obfuscated.1


A backdoor also known as: W32.HfsAutoB.F21F W32/Trojan2.MVJQ Trojan.Win32.Ace.cxham Win32.Backdoor.Ace.ciih Trojan.DownLoader1.8121 Backdoor.Ace.Win32.86 BehavesLike.Win32.Dropper.hh W32/Trojan.QDLI-0337 Trojan[Backdoor]/ASP.Ace TrojanDownloader:Win32/Pluzoks.A Backdoor/Win32.Ace.C78643 Backdoor.ASP.Ace Adware.Ezipop Win32/Adware.AdTrigger W32/ASP_Ace.MF!tr.bdr


A backdoor also known as: Worm/W32.Rahima.28672 Win32.Trojan.WisdomEyes.16070401.9500.9607 W32/Rahima.QDHZ-4096 W32.Fourseman.B@mm P2P-Worm.Win32.Rahima Trojan.Win32.Rahima.enoe Worm.Win32.P2P-Rahima.28672 W32.W.Rahima!c Worm.Rahima W32/Rahima.A I-Worm/Himera.i WORM/Rahima.A Worm[P2P]/Win32.Rahima P2P-Worm.Win32.Rahima Worm.Rahima Win32.Worm-p2p.Rahima.Pefs Worm.P2P.Rahima W32/Himera.J!worm.p2p Win32/Worm.IM.a16


The use of Lua modules, which we'll discuss later, is a technique that has previously been used by Flamer.


In August 2012, an attack campaign known as Shamoon targeted a Saudi Arabian energy company to deliver a malware called Disttrack.


A backdoor also known as: Trojan-Downloader.Win32.Geral!O TrojanDownloader.Begseabug.A5 Trojan/Downloader.Geral.aazb Trojan.Graftor.D540C W32.SillyDC Win.Trojan.Downloader-22789 Trojan-Downloader.Win32.Geral.aazb Trojan.Win32.Geral.dkhaf Trojan.Win32.A.Downloader.50176.GE Troj.Downloader.W32.Geral.aazb!c Trojan.Swizzor.18871 Downloader.Geral.Win32.7037 BehavesLike.Win32.Backdoor.ph Trojan-Downloader.Win32.Geral TrojanDownloader.Geral.cjc TrojanDownloader:Win32/Begseabug.A Trojan-Downloader.Win32.Geral.aazb Trojan/Win32.Scar.R4495 TrojanDownloader.Geral Trojan.KillAV Win32.Trojan-downloader.Geral.Sqtn Trojan.DL.Geral!qBECnW5XLLM W32/Pincav.SNS!tr Win32/Trojan.836


Other configuration data is located elsewhere , and some of it can been seen here : The encrypted library path The output folder on the device for the dropped library The name of the library after it is loaded eventBot name string Version number A string used as an RC4 key , both for decrypting the library and as a part of the network data encryption ( hasn ’ t changed from the previous version ) The C2 URLs A randomized class name using the device ’ s accessibility services EventBot extracted configuration Part of the extracted configuration of the new version .


A backdoor also known as: W32.HfsAdware.1F0C Adware.SearchSafer.A Adware.OutBrowse/Variant Win32.Trojan.WisdomEyes.16070401.9500.9922 Downloader.Sesafer TROJ_GE.24FE3DBE not-a-virus:Downloader.Win32.SearchSafe.a Adware.SearchSafer.A Trojan.Nsis.SearchSafe.dyoiec Adware.SearchSafer.A Adware.Downware.3008 Downloader.SearchSafe.Win32.2 TROJ_GE.24FE3DBE TR/AD.Uascape.myjsl Trojan:Win32/Uascape.A Adware.SearchSafer.A not-a-virus:Downloader.Win32.SearchSafe.a Adware.SearchSafer.A Downloader.SearchSafe PUP.Optional.SearchSafer PUA.Downloader!


A backdoor also known as: W32.ScaraNV.Trojan Trojan/W32.Scar.1611453 Trojan.Win32.Scar!O TrojanDropper.Scudy.S12799 Trojan.Scar.Win32.11534 Trojan.Zusy.D382CD WORM_SCUDY.SMA WORM_SCUDY.SMA Trojan.Win32.A.Scar.876573 Trojan:W32/Scar.O Trojan.Click1.19227 Trojan/Scar.flx TrojanDropper:Win32/Scudy.A Trojan/Win32.Scar.R45219 Trojan.Scar Trojan.Dropper Trojan.Scar!3JbHUSbGsGc Trojan.Win32.Scar


On April 19, Cyphort hardware sandbox trolled over a site www.49lou.com that served up 83 pieces of Windows executable files EXE and DLL binaries with zero user interaction.


A backdoor also known as: Trojan.Vake BehavesLike.Win32.BadFile.mt Trojan.Win32.Vake TR/Vake.onkgl Trojan.Heur.RX.EDF54F Trojan:Win32/Vake.D Trj/GdSda.A


Another interesting artifact part of the EK flow is the use of an XML configuration file which contains JScript code.


A backdoor also known as: TrojanDownloader.Votos Trojan.Zusy.D151C6 Win32.Trojan.WisdomEyes.16070401.9500.9956 Trojan.Win32.Clicker.cqsnmq Trojan.Win32.Z.Zusy.314880.BK Trojan.Click2.61352 Trojan-Downloader.Win32.Votos W32/Trojan.OORK-3033 TR/Taranis.2482 Trojan[Dropper]/Win32.Dinwod TrojanDownloader:Win32/Votos.A Trojan/Win32.Votos.R105546 TrojanDropper.Dinwod Trj/CI.A Win32/Trojan.ac2


A backdoor also known as: W32/Trojan.OXFE-7365 Backdoor.Chilurat Trojan.Win32.Trochil.a BehavesLike.Win32.Downloader.mz Trojan.Trochil.a Trojan.Win32.Trochil.a Trojan:Win32/Trochil.A Win32.Trojan.Trochil.Wrqj Win32/Trojan.369


Threat Source newsletter March 2, 2023 — Little victories in the fight against ransomware


This round of FIN7 phishing lures implements hidden shortcut files LNK files to initiate the infection and VBScript functionality launched by mshta.exe to infect the victim.


In 2014, TrendMicro began seeing attacks that abused the Windows PowerShell.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9944 TSPY_EMOTET.SMD3 Trojan.Win32.Inject.exldsx Trojan.Encoder.24431 TSPY_EMOTET.SMD3 BehavesLike.Win32.Backdoor.dc Trojan.Jorik.afpv TR/Crypt.ZPACK.uxhop Trojan[Dropper]/Win32.Scrop Ransom:Win32/Pulobe.A Trojan.Midie.DA9F2 Trojan.SmokeLoader Win32/Trojan.9b7


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9961 Trojan-Dropper.Win32.Dapato TrojanDropper:Win32/Ambler.F Trojan.Zusy.953


[clearskysec] Attacks against all targets in the Middle East stopped at once, after we published our first report.


Thanatos is being marketed as a service with both short and long-term subscriptions and support and the authors claim it is under ongoing development with new plugins and functionality being actively added


Details about the sample, including a hash are available at the end of this writeup.


A backdoor also known as: Trojan-Spy.MSIL.KeyLogger!O TrojanSpy.Moorest Trojan/KeyLogger.iec Win32.Trojan.WisdomEyes.16070401.9500.9996 W32/Trojan2.NZWO TSPY_MOOREST.SMJJ Trojan-Spy.MSIL.KeyLogger.iec Trojan.Win32.Clicker.dkktnp IM-Flooder.W32.Delf.l2lu Msil.Trojan-spy.Keylogger.Pito Trojan.Click2.7338 TSPY_MOOREST.SMJJ W32/Trojan.CJSE-3516 Trojan-Spy.MSIL.KeyLogger.iec TrojanSpy:MSIL/Moorest.A TrojanSpy.MSIL.KeyLogger MSIL/Spy.Keylogger.GT Win32/Trojan.Spy.9b9


A backdoor also known as: Pwstool.Cain Application.Pwcrack.Cain.GL not-a-virus:PSWTool.Win32.Cain.s Application.Pwcrack.Cain.GL Riskware.Win32.Cain.ewvhjq Application.Pwcrack.Cain Tool.Cain PUA.CainAbel PSWTool.Cain.c DR/PSW.Cain.284.47 not-a-virus:PSWTool.Win32.Cain.s Trj/CI.A Win32/Trojan.Dropper.0c3


A backdoor also known as: Worm.Ainslot.A3 Win32.Trojan.WisdomEyes.16070401.9500.9999 BKDR_BLADABI.SMC Trojan.Win32.Drop.dcmduv Trojan.Win32.Z.Fraudrop.205824 Backdoor.MSIL.Parama.RANG BKDR_BLADABI.SMC BehavesLike.Win32.Trojan.dh Trojan-Dropper.Win32.Dorifel Trojan[Dropper]/Win32.FrauDrop Win32.Troj.FrauDrop.kcloud PWS:MSIL/Mintluks.A Trojan/Win32.FrauDrop.R127506 TrojanDropper.FrauDrop MSIL/Blocker.PAN!tr


A backdoor also known as: Application.Webcrack.A Trojan/WebCracker.a W32/Trojan.NDIN-1455 Application.Webcrack.A Application.Webcrack.A Riskware.Win32.WebCrack.bbira Application.Webcrack.A TrojWare.Win32.WebCracker.A Application.Webcrack.A Tool.WebCrack Trojan.WebCracker.Win32.2 W32/Trojan2.MHTV HackTool.WebCrack.40 Win32.Troj.WebCracker.A.kcloud Application.Webcrack.A Trojan/Win32.Webcracker.R66570 Trojan.Webcracker Win32/WebCracker.A Trojan.Win32.WebCracker.tfe Trojan.Win32.Webcracker Trojan.Win32.WebCraker.A


A backdoor also known as: Trojan/W32.Cossta.152000 Trojan.Cossta W32/Trojan.OSNY-0798 Backdoor.Cruprox Win32/NukeSped.AK Trojan/NukeSped.ak Trojan.Win32.Cossta.akea Trojan.Win32.Cossta.erwfkk Troj.W32.Cossta!c Trojan.DownLoader25.21345 Trojan.Cossta.Win32.10320 BehavesLike.Win32.MysticCompressor.cm Trojan.Win32.Cossta Worm/AutoIt.nml Trojan/Win32.Cossta Trojan.Win32.Cossta.akea Trojan/Win32.Cossta.C2091223 Win32.Trojan.Cossta.Syrj Trojan.Cossta!Kqe4w1x4ygI W32/Cossta.AKEA!tr Trojan.Cossta Trj/CI.A Win32/Trojan.b36


Preferences such as the FTP hostname and username are stored in a file named uploadpref.dat.


There has been no evidence found yet that funds have been stolen from any infected banks.


A backdoor also known as: W32.Clode7b.Trojan.1410 Virtool.6143 Virtool.6143 Flooder.Piaoyes!YL6KHAf2k3Q Flooder.AG Flooder.Win32.Piaoyes.40 Virtool.6143 Virtool.6143 TrojWare.Win32.Flooder.Piaoyes.40 Virtool.6143 TR/Flood.Piaoyes.40.2 HackTool.Piaoyes Win32.Hack.Piaoyes.40.kcloud Win-Trojan/Piaoyes.171008 Virtool.6143 W32/Risk.PMPJ-1484 Win32/Flooder.Piaoyes.40 Flooder.Win32.Piaoyes.40 W32/Piaoyes.40!tr Flooder.DTA Trojan.Win32.Flooder.aS Win32/Trojan.Flood.199


A backdoor also known as: Worm.Ivruat.A11 Worm.AutoRun.Win32.120028 Win32.Trojan.WisdomEyes.16070401.9500.9986 W32/Trojan.TNXK-0638 Trojan.Win32.Autoruner2.cvshvv Win32.HLLW.Autoruner2.20037 BehavesLike.Win32.BadFile.fh Trojan.Win32.Spy W32/Trojan2.OYTC W32.Worm.Pqk Worm:Win32/Ivruat.A Worm/Win32.AutoRun.R140023 Win32.Worm.Autorun.Dxwf Trojan.Scar


A backdoor also known as: Backdoor/W32.Optix.340187 Backdoor.Win32.Optix!O Trojan.Madtol.C Backdoor.Optix Packer.W32.NSAnti.kZ85 Backdoor/Optix.f W32/OptixPro.I Backdoor.OptixPro.13 Win32/OptixPro.F BKDR_OPTIXPRO.H Win.Trojan.Optix-5 Backdoor.Win32.Optix.b Trojan.Win32.Optix.bslhnb Backdoor.Win32.Optix_Pro.340203 Trojan.DownLoader.60627 BKDR_OPTIXPRO.H BehavesLike.Win32.Dropper.fc W32/OptixPro.WZQS-7361 Backdoor/Optix.Pro.bd BDS/Optix.Pro.13.7 Trojan[Backdoor]/Win32.Optix Backdoor:Win32/Optixpro.T Backdoor.Win32.Optix.b Trojan/Win32.Xema.C66170 Backdoor.Optix Bck/OptixPro.C Win32/Optix.Pro.13 Backdoor.Optix.Pro.BD Backdoor.Win32.Optix


A backdoor also known as: Trojan.Win32.Hider!O W32/Backdoor.BVFG TROJ_HIDER.I Win.Trojan.Hider-4 Trojan.Win32.Hider.234496 Troj.W32.Hider.toFP Trojan.Hidn Trojan.Hider.Win32.266 TROJ_HIDER.I Trojan-Dropper.Delf Trojan/Win32.Hider.gh Win32.Troj.Hider.i.234496 Trojan.Win32.Hider.gh Trojan.Hider Win32/Trojan.0bc


Over the past few months, new strains of this infamous Android malware family have surfaced in third-party APK markets, as well as in the official Google Play store.


A backdoor also known as: Trojan/W32.VBKrypt.315392.AK Trojan.Win32.VBKrypt!O Trojan/Injector.wms Win32.Trojan.Inject.bh HV_VBKRYPT_CG092B3E.RDXN Trojan.Win32.VBKrypt.nrzc Trojan.Win32.VBKrypt.dzjqpk Trojan.MulDrop4.8756 Trojan.VBKrypt.Win32.180705 BehavesLike.Win32.BadFile.fh Trojan-PWS.Win32.Zbot Trojan.VBKrypt.amiu Trojan/Win32.VBKrypt Trojan.Symmi.D4542 Trojan.Win32.A.VBKrypt.315392.CI Trojan.Win32.VBKrypt.nrzc Worm:Win32/Secrar.A Trojan/Win32.Jorik.R37626 BScope.Worm.Gamarue.1191 W32/VBKrypt.MBW!tr


A backdoor also known as: Trojan-Proxy/W32.Mitglieder.8304 Trojan/Proxy.Mitglieder.af TrojanProxy.Mitglied!TVlYB86T2l0 Trojan.Mitglieder.G Win32/Mitglieder.Z TSPY_TARNO.D Trojan.Win32.Mitglieder.dkdz TrojWare.Win32.TrojanProxy.Mitglieder.AF Trojan.Mitglieder.Win32.173 TSPY_TARNO.D BehavesLike.Win32.Downloader.xc W32/Mitglieder.M TrojanProxy.Mitglieder.h Win32.Troj.Mitglieder.af.kcloud TrojanProxy:Win32/Mitglieder.DK Win-Trojan/Mitglieder.8304 Trojan-Proxy.Win32.Mitglieder.e Trojan.Win32.Mitglieder.aTNT Win32/TrojanProxy.Mitglieder.AF Win32.Trojan-proxy.Mitglieder.Ectn Trojan-Proxy.Win32.Mitglieder.CL W32/Tarno.D!tr Proxy.4.AZ Win32/Trojan.63b


SilentPush investigates a recent Facebook phishing campaign targeting social media users on Facebook Messenger, but what do we know about the attack's tactics and what can we do about it?


A backdoor also known as: Trojan.Win32.VB!O Trojan.VB Trojan.Symmi.DFDA4 Win32.Trojan.WisdomEyes.16070401.9500.9858 Trojan.Win32.VB.ckrm Trojan.Win32.VB.edplzz Troj.W32.Vb!c Trojan:W32/Kilim.P Trojan.VB.Win32.164816 TR/Kecix.ztie Trojan/Win32.VB Trojan:Win32/Kecix.A Trojan.Win32.VB.ckrm Trojan.VB Trj/CI.A Win32.Trojan.Vb.Pdlo Trojan.VB!Qw/pqsBL6E0 Win32.Outbreak Win32/Trojan.b08


A backdoor also known as: Tool.PassView.Win32.702 Win.Trojan.Lmir-87 not-a-virus:PSWTool.Win32.PassView.vly Win32.Trojan.Psw.Szlj Application.Win32.PassView.1_51 BehavesLike.Win32.Dropper.mh not-a-virus:PSWTool.Win32.PassView W32/Application.YMHQ-2387 Backdoor/Prorat.fxr TR/PSW.Dumaru Trojan[PSWTool]/Win32.PassView Worm:Win32/Dumaru.H@mm Application.Heur.E5E9B8 not-a-virus:PSWTool.Win32.PassView.vly PassDump.b PUP.Optional.PassView Riskware.PSWTool!


While some criminals blow up ATMs to steal cash, others use less destructive methods, such as infecting the ATM with malware and then stealing the money.


A backdoor also known as: W32.Pinfi.B Win32.Parite.B Virus/W32.Parite.C Virus.Win32.Parite.b!O W32.Perite.A W32/Pate.b W32/Pate.B Win32.Virus.Parite.d W32/Parite.B@mm W32.Pinfi.B Win32/Pinfi.A PE_PARITE.A Heuristics.W32.Parite.B Virus.Win32.Parite.b Win32.Parite.B Virus.Win32.Parite.bgvo W32.Parite.b!c Win32.Parite.B Win32.Parite.B Win32.Parite.2 Virus.Parite.Win32.9 PE_PARITE.A BehavesLike.Win32.Pate.gc Trojan.Win32.FakeAV W32/Parite.LAQX-0866 Win32/Parite.b Virus/Win32.Parite.c Win32.Parite.b.5756 TrojanDownloader:Win32/Grogsas.A Win32.Parite.B Win32.Parite.A Virus.Win32.Parite.b Win32.Parite.B Win32.Parite.B Virus.Win32.Parite.b Win32.Parite.B Win32/Parite.B Win32.Parite.B W32/Parite.B W32/Parite.B Virus.Win32.Parite.H


A backdoor also known as: Backdoor.Suslix.C Backdoor/W32.PlxT.20480 Backdoor.Suslix.C Win32.Trojan.WisdomEyes.16070401.9500.9991 W32/Backdoor.NXX Backdoor.Trojan Win32/Paltry.C Win.Trojan.Delf-473 Backdoor.Suslix.C Backdoor.Win32.PlxT.a Backdoor.Suslix.C Backdoor.Win32.Z.Suslix.20480 Backdoor.Suslix.C W32/Backdoor.PGXD-0378 Backdoor/PlxT.b Trojan[Backdoor]/Win32.Suslix Backdoor.Suslix.C Backdoor.Win32.PlxT.a Backdoor:Win32/Suslix.A Backdoor.Suslix.C Trj/CI.A Win32/Suslix.NAA Win32.Backdoor.Plxt.Ejez Trojan.Win32.Spy W32/Suslix.NAA!tr


Cyber4Sight has analyzed the malware distributed via the compromised Polish Financial Supervision Authority webpage and used in targeted attacks against a number of large banks and telecommunication companies.


A backdoor also known as: Trojan/W32.Small.38400.AY Trojan-Spy.Win32.Brospa!O Trojan.Witkinat Trojan/Spy.Brospa.cm TROJ_BROSPA.SMC Win32.Trojan.WisdomEyes.16070401.9500.9979 Backdoor.Trojan Win32/Witkinat.AY TROJ_BROSPA.SMC Win.Spyware.78717-2 Trojan.Win32.Brospa.bpglj Trojan.Win32.A.Brospa.38400.N Trojan.PWS.iThink.16 Trojan.Brospa.Win32.159 Trojan.Win32.Scar TrojanSpy.Brospa.o W32.Trojan.Witkinat.A Trojan[Spy]/Win32.Brospa Trojan:Win32/Witkinat.A Trojan/Win32.Brospa.R4351 TrojanSpy.Brospa Win32.Trojan-spy.Brospa.Wrqa W32/Witkinat.Q!tr


It appears to have evolved from the NewPOSthings family of malware first discovered by Dennis Schwarz and Dave Loftus at Arbor Networks.


This new variant, dubbed HummingWhale,' includes new, cutting edge techniques that allow it to perform ad fraud better than ever before.


SANS mail server quarantined this file FautraPago392023.gz and extracted the file to find there was no .exe extension associated with the file.


When installed, GreenDispenser may display an out of service' message on the ATM -- but attackers who enter the correct pin codes can then drain the ATM's cash vault and erase GreenDispenser using a deep delete process, leaving little if any trace of how the ATM was robbed.


Interestingly , there is an allowlist of tapped activities : ui.ConversationActivity ui.ConversationListActivity SemcInCallScreen Quadrapop SocialPhonebookActivity The listener can operate with only coordinates , so it calculates pressed characters by matching given values with hardcoded ones : Additionally , if there is a predefined command , the keylogger can make a screenshot of the tapped display area : Manual access and operator menu There is a hidden menu ( Activity ) for controlling implant features that looks like it was created for manual operator control .


A backdoor also known as: Trojan.DeltreeY Trojan:BAT/DeltreeY.CA Trojan.BAT.DeltreeY


A backdoor also known as: Application.Miner.CB Application.Miner.CB Linux/RubyMiner.A BAT_COINMINE.WIPX Application.Miner.CB Troj.Downloader.Shell!c Application.Miner.CB Linux.DownLoader.684 BAT_COINMINE.WIPX Trojan.RubyMiner Win32/Trojan.Downloader.72e


The malware is a reflection of how PoS threats, though no longer novel, are increasingly used against businesses and their customers.


A backdoor also known as: Trojan.Skeeyah.19132 Win32.Trojan.WisdomEyes.16070401.9500.9934 not-a-virus:HEUR:Monitor.Win32.BeyondKeyLogger.heur System.Monitor.Relytec.All-in-o TR/Spy.arobe not-a-virus:HEUR:Monitor.Win32.BeyondKeyLogger.heur Trojan:Win32/Dhodareet.A


Actors related to the Operation Lotus Blossom campaign continue their attack campaigns in the Asia Pacific region.


Based on the data we have acquired since October 2016, about 500 organizations from 50 countries were affected by the attack.


The AES key is generated using a SHA256 hash and due to the keys being stored on the infected machine, victims in many cases could likely decrypt files without paying the ransom.


A backdoor also known as: W32.Clod2e7.Trojan.3dab Backdoor/W32.Bifrose.737280.H Backdoor/Bifrose.chym BKDR_BIFROSE.DMQ W32/Trojan2.NEIM Backdoor.Trojan Win32/Tnega.UYbaRd BKDR_BIFROSE.DMQ Trojan.Win32.Bifrose.crakl Backdoor.W32.Bifrose.chym!c BackDoor.Bifrost.16023 Backdoor.Bifrose.Win32.49130 Backdoor.Bifrose W32/Trojan.TWKO-3939 BDS/Bifrose.chym W32/Bifrose.CHYM!tr.bdr Trojan[Backdoor]/Win32.Bifrose Backdoor/Win32.Bifrose.R127707 Backdoor.Bifrose Backdoor.Bifrose!bEtmoN1K0yI


The affected educational organizations, for instance, are used to deliver employment exams for government employees.


A backdoor also known as: W32.DusbyetorLTS.Trojan Trojan/W32.Kriskynote.442892.B Backdoor.Kriskynote.A4 Trojan/Rootkitdrv.w Trojan.Graftor.D35150 Win32.Trojan.WisdomEyes.16070401.9500.9510 W32/Trojan.HHCY-2846 Backdoor.Korplug.B Win32/Rootkitdrv.W BKDR_WINNT.SMD Trojan.Win32.Kriskynote.ay Trojan.Win32.Kriskynote.dkkllk Trojan.Win32.Z.Kriskynote.442892 BackDoor.Korplug.18 Trojan.Kriskynote.Win32.1 BKDR_WINNT.SMD Trojan.Win32.Kriskynote Trojan/Kriskynote.a Trojan/Win32.Kriskynote Trojan.Win32.Kriskynote.ay Trojan:Win64/Kriskynote.A!dha Win32/Tnega.aacQTM Trojan.Kriskynote Win32.Trojan.Kriskynote.Lkmz W32/Kriskynote.AY!tr Win32/Trojan.6da


A backdoor also known as: Trojan/Crypt.qk Win32.Trojan.WisdomEyes.16070401.9500.9532 TROJ_KRYPTIK.VTG Trojan.MSIL.Crypt.qk Trojan.Win32.Crypt.djsue BackDoor.Cybergate.1727 Trojan.Crypt.Win32.2613 TROJ_KRYPTIK.VTG Trojan.MSIL.Crypt Trojan/MSIL.bms TR/MSIL.Crypt.qk Trojan.MSIL.Krypt.2 Trojan.MSIL.Crypt.qk TrojanDownloader:Win32/Radet.A Msil.Trojan.Crypt.Swvd Trojan.Crypt!QtVXUF+C8/k Win32/Trojan.b12


A backdoor also known as: W32.Vetor.PE W32.Virut.G Win32/Virut.17408 PE_VIRUX.J Win.Trojan.Clicker-3135 Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg Virus.Win32.Virut.Ce Win32.Virut.56 PE_VIRUX.J BehavesLike.Win32.Virut.mm Win32/Virut.bn Virus/Win32.Virut.ce Win32.Virut.ce.53248 TrojanClicker:Win32/Sadbick.A W32.Virut.l4o5 Virus.Win32.Virut.ce Win32/Virut.F Virus.Virut.06 Win32/Virut.NBP Worm.Win32.VBNA W32/Sality.AO


A backdoor also known as: HW32.Packed.9ED0 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32.HLLM.Reset.493 BehavesLike.Win32.Ransomware.cc Backdoor.Poison Trojan.Midie.DA81B Backdoor/Win32.Poison.R217323 Trojan.Nymaim


Mandiant, working in partnership with SonicWall Product Security and Incident Response Team PSIRT, has identified a suspected Chinese campaign that involves maintaining long term persistence by running malware on an unpatched SonicWall Secure Mobile Access SMA appliance.


A backdoor also known as: Antivirus2008.DN MemScan:Trojan.Peed.JRX Trojan.Win32.Pakes.czg


This ransomware encrypts files and uses .braincrypt as file name extension for encrypted files.


The first example, a campaign observed on May 17, 2016, uses a fake Microsoft security alert social engineering lure to trick the victim into opening a link that leads to an executable download.


This blog details CNACOM, a web-based campaign that appears to be related to a well-known nation-state actor more commonly associated with spear-phishing attacks.


A backdoor also known as: Trojan.Dyloader Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Win32.Injector TR/Dropper.gjdjj Trojan.Graftor.D4C89C W32/Injector.DHHK!tr Trj/GdSda.A


A backdoor also known as: Trojan.Win32.Demp.cxoswz TrojanDropper.Demp.aao Trojan[Dropper]/Win32.Injector


The effects were broad reaching, with Ukraine Cyber police confirming over 2000 affected companies in Ukraine alone.


A backdoor also known as: RDN/Gaobot.worm!f Backdoor.Agobot.Win32.5073 Backdoor.W32.Agobot.svu!c Trojan.Heur.RP.EDFC38 Win32.Trojan.WisdomEyes.16070401.9500.9986 TROJ_ADAMOL.A Trojan.Win32.Agobot.dikwjo Win32.Backdoor.Agobot.Wlfl TROJ_ADAMOL.A BehavesLike.Win32.Downloader.gh Trojan.ATRAPS Backdoor/Agobot.bnd W32/AgoBot.SVU!tr.bdr Trojan[Backdoor]/Win32.Agobot Trojan:Win32/Adamol.A Trojan/Win32.Hupigon.C48593 Trj/Chgt.L


On the heels of recent disclosures of ATM malware such as Suceful Plotus and Padpin aka Tyupkin, Proofpoint research has discovered yet another variant of ATM malware, which we have dubbed GreenDispenser.


Initial reports of the attacks, published April 26 in Hebrew by the Israel National Cyber Event Readiness Team CERT-IL and The Marker, confirm that the attack was delivered through compromised email accounts at Ben-Gurion University and sent to multiple targets across Israel.


A backdoor also known as: Trojan.Small Trojan.Win32.Small Trojan.Win32.Small.cva Trojan.Win32.Crypted.dxzuxb Troj.W32.Small!c Trojan.PWS.Banker1.19315 Trojan/Win32.Small Trojan.Win32.Small.cva Trojan.Win32.Small Trojan.Small Trj/CI.A Trojan.Win32.Clipbanker W32/ClipBanker.F!tr Win32/Trojan.65e


This is the summary of an analysis by an IT security researcher, which we publish in full.


Carbanak also known as Anunak are a group of financially motivated criminals first exposed in 2015.


It spread via a recompiled version of the otherwise legitimate open source BitTorrent client application Transmission and distributed on their official website.


A backdoor also known as: Trojan-PWS/W32.QQPass.757760.Q Trojan.Win32.Badur!O Risktool.Flystudio.16885 Trojan/AddUser.q TROJ_ADDUSER_EJ19018D.UVPM Win32/Tnega.CEGPWM TROJ_ADDUSER_EJ19018D.UVPM Trojan-Ransom.Win32.Snocry.yj Trojan.Win32.QQPass.cqivxp Backdoor.W32.Hupigon.lHRl Worm.Win32.Dropper.RA Trojan:W32/DelfInject.R Trojan.DownLoader10.35182 Trojan.QQPass.Win32.21864 Exploit.Win32.MS Trojan/PSW.QQPass.qla TR/Strictor.38430 Trojan[PSW]/Win32.QQPass Trojan.Zusy.D2B925 Trojan-Ransom.Win32.Snocry.yj Trojan:Win32/Casus.A Trojan/Win32.QQPass.C217887 Trojan.Badur Win32/AddUser.Q Trojan.Win32.QQPass.i Trojan.PWS.QQPass!VhZvRiUJbao W32/QQPass.ELG!tr.pws Trojan.Win32.Extortioner.Q


A backdoor also known as: TrojanDownloader.Unruy.C3 Downloader-BPA.d Trojan.Cosmu.Win32.1584 Trojan/Cosmu.fzo Win32.Trojan-Clicker.Cycler.a W32.Unruy.A Win32/Unruy.NaMNFGC HT_UNRUY_GF0601E8.UVPM Win.Trojan.Unruy-5876 Trojan.Win32.Drop.bcagho Troj.Spy.W32.BZub.l2bS TrojWare.Win32.TrojanSpy.BZub.~IP Trojan.MulDrop1.276 HT_UNRUY_GF0601E8.UVPM BehavesLike.Win32.Downloader.rt Trojan-Downloader.Win32.Unruy Trojan/Cosmu.bhh TR/Dldr.Unruy.C Worm/Win32.Unknown TrojanDownloader:Win32/Unruy.C Trojan.Unruy.1 Trojan/Win32.Cosmu.R39186 TrojanClicker.Cycler Trojan.CL.Cycler!gZ0c9KQr9Uk W32/ZAccess.Y!tr W32/OverDoom.B.worm Win32/Trojan.688


Also seen in other Exploits Kits: - Neutrino - Nuclear - Magnitude - RIG - Hanjuan


A backdoor also known as: Trojan.PSW.Qwak.A Trojan-PWS/W32.Qwak.24576 PSWTool.Win32.Pqwak!O Trojan.Pqwak Trojan.Qwak.Win32.2 Trojan.PSW.Qwak.A W32/HackTool.AZN TROJ_PQWAK.A Trojan.PSW.Qwak.A not-a-virus:PSWTool.Win32.Pqwak.10 Trojan.PSW.Qwak.A Riskware.Win32.Pqwak.hqlb Trojan.Win32.Z.Qwak.24576 Trojan.PSW.Qwak.A TrojWare.Win32.PSW.Qwak.A Trojan.PWS.Qwak.10 TROJ_PQWAK.A Trojan.Win32.PSW W32/Tool.QTCZ-8948 TR/Pqwak.A Trojan[PSWTool]/Win32.Pqwak not-a-virus:PSWTool.Win32.Pqwak.10 Win-Trojan/Qwak.24576 Trojan.PSW.Qwak.A TrojanPSW.Qwak Trj/CI.A Win32/PSW.Qwak.A Win32.Trojan.Pqwak.Eeha Trojan.PSW.Qwak!llR4IBPnUH0 Win32/Trojan.006


Stretching back to April 2016, she d befriended a lot of individuals, as many as 500, with similar interests.


Based on received commands, it can either download malicious apps or switch the C C Twitter account to another one.


A backdoor also known as: TrojanDropper.Goominer Win32.Trojan.WisdomEyes.16070401.9500.9958 Trojan.Win32.Kazy.dbtlfz Trojan.Win32.Z.Kazy.939008.A Trojan.Kazy.D607AA TrojanDropper:Win32/Goominer.A Trj/GdSda.A Win32.Trojan.Kazy.Pciu Trojan.Win32.Comitsproc Win32/Trojan.013


We dubbed this activity Operation Wilted Tulip


A backdoor also known as: Trojan.Win32.Swisyn!O Trojan.Starpage.A.mue Trojan/Swisyn.bhyk Win32.Trojan.Delf.it Trojan.Win32.Fsysna.djck Trojan.Win32.A.Swisyn.97827[UPX] Worm.Win32.Pronny.BL Trojan.PWS.Qqpass.6162 Trojan.Swisyn.Win32.21499 Trojan.Crypt Trojan/Win32.Swisyn HEUR/Fakon.mwf Worm.AutoRun Trojan.Win32.FakeFolder.pb Trojan.Swisyn!4rRLtK78L7s


Some samples talk to compromised South Korean server at 203.250.148.63 and communicate in port 30000.


The new GozNym hybrid takes the best of both the Nymaim and Gozi ISFB malware to create a powerful Trojan.


The people behind the attacks are likely attempting to gain access to computers where banking transactions are performed, in order to steal banking credentials.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9982 Trojan.Win64 Trojan[Backdoor]/Win32.Simda Trojan:Win64/Claretore.B W64/Simda.BD!tr


One of them was of particular interest because we'd never seen the backdoor before and it leveraged a relatively unique German dynamic DNS provider for command and control.


A backdoor also known as: Application.Htool.WKE Application.Htool.WKE W32/Risk.IUUB-2604 HKTL_DUMPSEC.TOMA Application.Htool.WKE Application.Htool.WKE Trojan.MulDrop3.34925 HKTL_DUMPSEC.TOMA W32/MalwareS.ITI Packed.Multi.rq HackTool:Win32/Dumpsec.A Application.Htool.WKE


Marcher inspects its infected devices carefully by using a dedicated, hard-coded configuration in each Android Package Kit APK, Google's file format for distributing and installing application software like mobile banking apps on the Android OS.


A backdoor also known as: W32/Downldr2.IYLF Trojan.Starter.1949 Riskware/Win32.Krap.ii Win32.Hack.Undef.kcloud TrojanDropper:Win32/Kidtok.A W32/Downloader.LQFG-1421 Virus.Win32.Heur.g BScope.Trojan-Spy.Zbot PE:Malware.FakeDOC@CV!1.9C3B Trojan-Dropper.Win32.Kidtok


Therefore we instead discuss a number of ways to detect and analyse these documents using freely available tools.


PDFs with download links


A backdoor also known as: PSWTool.Win32.NetPass!O HackTool.Dialupas Tool.NetPass.Win32.1002 Win32.Trojan.WisdomEyes.16070401.9500.9825 W32/Risk.DWIG-1726 Trojan-Spy.IEPV not-a-virus:PSWTool.Win32.NetPass.atx Trojan.Win32.Ool.cjzhzi Tool.PassView.277 BehavesLike.Win32.Downloader.gc W32/MalwareS.AKEN APPL/PSWTool.Pass.A Application.Heur.BmNfbCuqfGoO not-a-virus:PSWTool.Win32.NetPass.atx Trojan/Win32.Klone.C127582 PUP.Optional.Dialupass Trojan.PSWTool!vbtNAUr+Slw


The email, first of them submitted from Middle East, purports to be coming from a Turkish trading company, which might further indicate the geographic area where the attacks were active.


A backdoor also known as: W32.Cleanmg.Trojan Trojan-Spy.Win32.TianYan!O BackDoor-YA.dr Trojan/Spy.TianYan.b TSPY_TIANYAN.SMD Win32.Backdoor.Prisos.b W32.Killaut.A Win32/TianYan.A TSPY_TIANYAN.SMD Win.Spyware.35814-2 Trojan.Win32.TianYan.xbqa Trojan.Win32.TianYan.40960 Troj.Spy.W32.TianYan.m9ks TrojWare.Win32.TrojanSpy.TianYan.~A Win32.HLLP.Nemesis.28687 BackDoor-YA.dr TrojanSpy.TianYan.a Trojan[Spy]/Win32.TianYan Win32.Troj.TianYan.b.kcloud Trojan.Symmi.D7121 Backdoor:Win32/Prisos.A Worm/Win32.Mabezat.R26794 TrojanSpy.TianYan Win32/Prisos.A Trojan-Spy.Win32.TianYan.b Win32/Trojan.Dropper.e23


Our documentation points to a campaign that started somewhere in late February 2015 and ended in mid-March.


A backdoor also known as: W32.LRQwegierExe.Trojan Trojan/W32.Small.14848.CH Trojan.Daws.17020 Trojan.Kazy.D192B Win32.Trojan.Dalixi.f Trojan-Dropper.Win32.Daws.dyru Troj.W32.KillAV.lCzy BehavesLike.Win32.VTFlooder.lh Trojan:Win32/Ghodow.A Trojan-Dropper.Win32.Daws.dyru Win32/Dalixi.A Trojan.Dalixi!sYT5S6B5t8c W32/Dloader.IQS!tr.dldr Win32/Trojan.b7f


A new ransomware called CryptoLuck has been discovered by Proofpoint security researcher and exploit kit expert Kafeine that is being distributed via the RIG-E exploit kit.


Ransomware in its various forms continues to make headlines as much for high-profile network disruptions as for the ubiquity of attacks among consumers.


A backdoor also known as: Trojan.Win32.Staget!O Trojan.Vb.AB2 Trojan.Injector Trojan/Staget.fk Trojan.Zusy.D381B TROJ_CHEKAF.SMIA Win32.Trojan.U-Staget.a TROJ_CHEKAF.SMIA Win.Trojan.Staget-28 Trojan.Win32.SelfDel.cdyc Trojan.Win32.Staget.btpvn Trojan.Win32.A.Staget.98334 Troj.W32.SelfDel.tnPD Trojan.MulDrop1.56405 Trojan.Staget.Win32.367 BehavesLike.Win32.Swisyn.nm Trojan/Staget.hg Trojan/Win32.Staget Win32.Troj.Staget.fk.kcloud Trojan.Win32.SelfDel.cdyc Trojan/Win32.Staget.R21060 Trojan.VBRA.09701 Trojan.Staget!A6l5b/HpLEg Trojan.Win32.Staget W32/Staget.EG!tr


A backdoor also known as: Trojan/CoinMiner.td not-a-virus:RiskTool.Win32.BitCoinMiner.wzo Riskware.Win32.BitCoinMiner.dktqwy Tool.BtcMine.479 Trojan.CoinMiner.Win32.1509 Trojan.Win32.CoinMiner RiskWare[RiskTool]/Win32.BitCoinMiner Trojan:Win32/Dimnir.A Application.Heur2.EE0329 not-a-virus:RiskTool.Win32.BitCoinMiner.wzo W32/CoinMiner.TD!tr


A backdoor also known as: Backdoor.Hotdog.A Backdoor.Hotdog.A Trojan.Win32.Hotdog.chmwe W32/Hotdog.B Spyware.Hotra TROJ_HOTDOG.A Backdoor.Win32.Hotdog Backdoor.Hotdog.A Backdoor.Hotdog!YGk3IGmjo+U Backdoor.Win32.Hotdog.B Backdoor.Hotdog.A Trojan.Hotdog.49152 TROJ_HOTDOG.A Win32.Hack.Hotdog.8F.kcloud Backdoor:Win32/Hotdog.A Trojan.Win32.Hotra.49152 Backdoor.Hotdog.A W32/Hotdog.OZIJ-0895 Win-Trojan/Hotra.57344 Spyware.Hotra Win32/Hotdog.B Backdoor.Win32.Hotdog W32/Hotdog.A!tr.bdr BackDoor.Hotdog.A


malware used by the HiddenCobra threat group


A backdoor also known as: TrojanPWS.Dexter.A4 Trojan.Poxters.Win32.176 Win32.Trojan.WisdomEyes.16070401.9500.9999 BKDR_DEXTR.SMM HEUR:Trojan.Win32.Invader Trojan.Win32.Invader.elqaga Trojan.FakeAV.19781 BKDR_DEXTR.SMM BehavesLike.Win32.VTFlooder.nh Trojan.Invader.aqk Trojan/Win32.Invader HEUR:Trojan.Win32.Invader Trojan.Invader! Trojan.Win32.Poxters W32/Poxters.E!tr Trj/GdSda.A


A backdoor also known as: Trojan.Dynamer.FC.316 Win32.Trojan.WisdomEyes.16070401.9500.9957 MSIL.Backdoor.Orcus.A Troj.Spy.Msil!c Trojan.DownLoader25.14345 BehavesLike.Win32.Backdoor.dc TrojanSpy.MSIL.sam TR/Dropper.MSIL.yknpx PWS:MSIL/Orcus.A!bit Win-Trojan/OrcusRAT.Exp Trj/CI.A Win32/Trojan.Spy.c29


A year later, a more dangerous version was released.


The malware spreads very fast using Telegram messenger application in smartphones, targeting high-profile Libyan influential and political figures.


Much of the contents of that report are reproduced here.


A backdoor also known as: Win32.Stration PUA.Packed.MEW-1 IM-Worm.Win32.Sumom.C


In a seven-hour window, Raytheon | Websense stopped over 16,000 malicious email messages from being delivered to customers, all of which appear to have been Japanese targets.


The exploit code attached used for dropping the malware is older – CVE-2012-0158 – and from our vantage point, we have no indication of successful or failed exploitation.


A backdoor also known as: Trojan/W32.OptixKill.31744 Trojan/OptixKill.10 TROJ_OPTIXKILL.F Win32.Trojan.WisdomEyes.16070401.9500.9985 W32/Trojan.HEHF-6024 TROJ_OPTIXKILL.F Win.Trojan.Killer-4 Trojan.Win32.OptixKill.10 Trojan.Win32.OptixKill.dkur Trojan.Win32.A.OptixKill.31744 TrojWare.Win32.OptixKill.10 Trojan.OptixKiller Trojan.OptixKill.Win32.20 Trojan/Win32.OptixKill.10 W32.Trojan.Backdoor-Ealim TR/OptixKill.10 Trojan/Win32.OptixKill Trojan:Win32/Optixkiller.A Troj.W32.OptixKill.10!c Trojan.Win32.OptixKill.10 Trojan/Win32.HDC.C1938 Trojan.OptixKill Trj/OptixKill.10 Win32/OptixKill.10 Win32.Trojan.Optixkill.Wsat Trojan.OptixKill!RjZYoc6lQeg Trojan-PWS.Win32.Lmir.wj W32/OptixKill.10!tr


While threat actors using the PlugX Trojan typically leverage legitimate executables to load their malicious DLLs through a technique called DLL side-loading, Unit 42 has observed a new executable in use for this purpose.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 BehavesLike.Win32.Conficker.lh Trojan.Win32.Spy Win32.Troj.Undef.kcloud Trojan.Kazy.D2002F


Although Banker has been in the wild for years, this time we see it using a Dynamic Loading Library DLL with malicious exported functions.


It was first reported in 2013 under the version number 2.0-LNK where it used the tag BaneChant in its command-and-control C2 network request.


Due to its ability to intercept SMS communications, the malware is also able to bypass SMS-based two-factor authentication.


In 2019, X-Force IRIS incident responders observed ITG03 conducting a campaign against a financial institution in Southeast Asia targeting the institution's SWIFT environment.


A backdoor also known as: Trojan.Zenshirsh.SL7 W32/Small.WMNN-1529 TSPY_ONLING.SMIF Trojan.Win32.OnLineGames.vmk Trojan.DownLoader4.46724 TSPY_ONLING.SMIF W32/Small.IH TR/Fakealert.39719 TrojanDownloader:Win32/Rarcon.B Trojan.Graftor.D46F5 Trojan-Downloader.Win32.Small Win32/Trojan.add


A backdoor also known as: Android.SmForw.AE Android.Trojan.SMSSend.IA AndroidOS/Trojan.DPEF-9 Android.Trojan.SMSSend.IA A.H.Int.SmsThief.DBA Trojan.Android.SmsForward.duiqpk Android.SmsSpy.672.origin Trojan[SMS]/Android.SmForw.aa Android.Trojan.SMSSend.IA Android-Trojan/SmsSend.915f Trojan.AndroidOS.Lockerpin


SageCrypt downloaders, often poorly detected at the network level due to the usage of LetsEncrypt certificates.


A backdoor also known as: Packer.Morphine.B Packer.Morphine.B Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Conhook-11 Packer.Morphine.B Packer.Morphine.B Packer.Morphine.B TrojWare.Win32.PkdMorphine.~AN Packer.Morphine.B Trojan.Click.3614 BehavesLike.Win32.Pykse.gc Trojan.Win32.BHO Packed.Morphine.a Trojan:Win32/Bohojan.A Packer.Morphine.B W32/BHO.BO!tr


A backdoor also known as: Trojan.Newspy W32/NionSpy.e!dr TROJ_MEWSPY.CE Trojan.Win32.MewsSpy.drsazo TrojWare.Win32.TrojanDownloader.Geral.A Win32.MewsSpy.47 TROJ_MEWSPY.CE BehavesLike.Win32.DocumentCrypt.cc Virus.Win32.MewsSpy W32/Trojan.OBEZ-9322 Trojan.Kazy.D2524 Trojan:Win32/Newspy.A Trj/CI.A Win32.Virus.Mewsspy.Hroy W32/MewsSpy.AE Win32/Trojan.22f


A backdoor also known as: Exp.SWF.CVE-2014-8439.A Trojan.Swifi TROJ_FRS.PMA000B515 Swf.Exploit.Angler-4 Trojan.Swf.CVE20140515.dsfxmi SWF.Z.CVE-2014-0515.87352 Exploit.SWF.376 TROJ_FRS.PMA000B515 BehavesLike.Flash.Exploit.cb Exploit:SWF/Axpergle.B SWF/Exploit.ExKit.H Exploit.SWF


A backdoor also known as: Trojan:Win32/Plugx.B


A backdoor also known as: Downloader.Zlob.Win32.16141 Trojan.Kazy.D15115 Win32.Trojan.WisdomEyes.16070401.9500.9987 TROJ_ZLOB.HRX Win.Trojan.Zlob-2206 Trojan-Downloader.Win32.Zlob.vjl Trojan.Win32.Zlob.cvogpg TrojWare.Win32.TrojanDownloader.Zlob.~YG Trojan.Popuper.7315 TROJ_ZLOB.HRX Trojan.Zlob TrojanDownloader.Zlob.lui TR/Dldr.Zlob.pea.1 Trojan[Downloader]/Win32.Zlob Trojan-Downloader.Win32.Zlob.vjl Trojan/Win32.Zlob.R23708 Trojan.Zlob.23616 Win32/TrojanDownloader.Zlob.CHF


For five months, Check Point mobile threat researchers had unprecedented, behind the scenes access to a group of cybercriminals in China.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Zusy.D3C813 Trj/GdSda.A


A backdoor also known as: W32.FamVT.KolabcK.PE Net-Worm.Win32.Kolabc!O W32.Futu.A2 Win32.Virus.Probably.c W32.Blaster.Worm PE_FUTU.A Win.Exploit.DCOM-5 Win32.Trojan-Dropper.Rbot.A Virus.Win32.Kolabc.brlvjf W32.W.Kolabc.m0xC Virus.Win32.Kolabc.aab BackDoor.Swz.125 Worm.Kolabc.Win32.2973 PE_FUTU.A BehavesLike.Win32.Backdoor.wz Worm[Net]/Win32.Kolabc Worm.Kolabc.gu.kcloud Worm/Win32.Kolabc.R68544 BackDoor.Swz! Trojan-Proxy.Win32.Ranky W32/Kolabc.GU!worm.im Worm.Kolabc W32/BadFuture.A


A backdoor also known as: W32.HfsAdware.4A43 Trojan.Application.LoadMoney.Razy.8 Win32.Adware.Kryptik.c Infostealer.Limitail Win.Trojan.Loadmoney-12443 not-a-virus:Downloader.Win32.Plocust.dwa Trojan.Win32.LoadMoney.cspznv TrojWare.Win32.Kryptik.BAJ Trojan.LoadMoney.15 Trojan/StartPage.pch RiskWare[Downloader]/Win32.Plocust.dwa not-a-virus:Downloader.Win32.Plocust.dwa PUP/Win32.LoadMoney.R99289 TScope.Malware-Cryptor.SB Trojan.Win32.Spy Win32/Application.a8e


An unknown attacker gained access to the Bangladesh Bank's BB SWIFT payment system and reportedly instructed an American bank to transfer money from BB's account to accounts in The Philippines.


The Stegoloader malware family also known as Win32/Gatak.DR and TSPY_GATAK.GTK despite not sharing any similarities with the Gataka banking trojan was first identified at the end of 2013 and has attracted little public attention.


A backdoor also known as: Trojan.Graftor.D2B9C9 Trojan.Delf.Win32.71682 BehavesLike.Win32.BadFile.hh PUA.Toolbar.TB Trojan:Win32/Waqlop.A


A backdoor also known as: Trojan.Win32.Scar!O Trojan.Scar Win.Trojan.Scar-8271 Trojan.Win32.Scar.evwf Trojan.Win32.A.Scar.53248.I W32.W.WBNA.lJwt Trojan.Scar.Win32.68398 BehavesLike.Win32.VBObfus.lz Trojan.Win32.Scar Trojan/Scar.azur Trojan/Win32.Scar Trojan.Win32.Scar.evwf Trojan/Win32.Scar.R55318 Trojan.Scar Win32/VB.ROS Win32.Trojan.Scar.Pbfp Trojan.Scar!dNffxsGO4PU W32/Scar.EVWF!tr Win32/Trojan.b39


Fidelis Cybersecurity analysis has identified unrelated cyber criminal activity leveraging the vulnerability cited in CVE-2014-4114, which was initially exploited by advanced persistent threat APT actors in October 2014.


A backdoor also known as: Trojan.Downloader.E1FFDC Trojan.Win32.Delf.cxivds BehavesLike.Win32.Trojan.gh TR/Dldr.Slarkic.H.4 Trojan[Downloader]/Win32.Unknown TrojanDownloader:Win32/Notorgatro.B Trojan/Win32.CSon.R2885 Downloader.Delphi Trj/CI.A Win32/Trojan.BO.0a3


A backdoor also known as: Backdoor.Protux Backdoor/Protux.wz Trojan.Win32.Protux.pdpbh Backdoor.Trojan Protux.AO Backdoor.Win32.Protux.ws Backdoor.Protux!x0RB0sLZXQU Win32.HLLW.Autoruner1.4496 BDS/Protux.ws Heuristic.BehavesLike.Win32.Backdoor.H Backdoor/Protux.ht Win32.Troj.Undef.kcloud Backdoor.Win32.A.Protux.102400.A Backdoor/Win32.Trojan Backdoor.Protux Backdoor.Trojan Backdoor.Win32.Protux W32/Protux.WS!tr.bdr Trj/CI.A


A backdoor also known as: W32/Obfuscated.FA Trojan.Win32.Zapchast!IK Dropper.Win32.Mnless.fxg Trojan.Win32.Zapchast


The reader looked at the config and realized that his router got a new, suspicious entry in the NTP server name field, namely


A backdoor also known as: W32.Nimda.E Win32.Trojan.HotKeysHook.b W32/NetWorm.YYMQ-0484 Win32/Nimda.E Win.Worm.N-74 Win32.Trojan.HotKeysHook.A Net-Worm.Win32.Nimda.e Trojan.Win32.Nimda.glkx Win32.HLLW.Nimda.57344 Worm.Nimda.Win32.79 W32/NetWorm.BF W32/Nimda.3 Worm[Net]/Win32.Nimda.e Trojan.Strictor.D1109F Net-Worm.Win32.Nimda.e Trojan/Win32.HDC.C61626 Worm.Nimda Worm.Nimda!YOZDpQiibZo Trojan.I-Worm.Nimda Trj/CI.A


Here is a list of broadcast actions : android.provider.Telephony.SMS_RECEIVED android.net.conn.CONNECTIVITY_CHANGE android.intent.action.BATTERY_CHANGED android.intent.action.USER_PRESENT android.intent.action.PHONE_STATE android.net.wifi.SCAN_RESULTS android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.SCREEN_OFF android.intent.action.SCREEN_ON android.media.RINGER_MODE_CHANGED android.sms.msg.action.SMS_SEND android.sms.msg.action.SMS_DELIVERED Creating a Web Server to Phish XLoader creates a provisional web server to receive the broadcast events .


A backdoor also known as: Java/Jacksbot.W Backdoor.Trojan Java.Jacksbot.136 BehavesLike.Win32.Trojan.wc Java/Jacksbot.W Trojan.Java.ce Trj/CI.A Win32/Trojan.407


The targeting of state and local government agencies as well as the distribution methods are very similar to a CryptFile2 campaign we described in August.


We detected yet another 51 Trojan porn clickers accessible for the users to download.


After launch , it downloads a codec for MP3 encoding directly from the C & C server : http : //54.67.109.199/skype_resource/libmp3lame.dll The skype_sync2.exe module has a compilation timestamp – Feb 06 2017 and the following PDB string : \\vmware-host\Shared Folders\dati\Backup\Projects\REcodin_2\REcodin_2\obj\x86\Release\REcodin_2.pdb network.exe is a module for submitting all exfiltrated data to the server .


Dell SecureWorks Counter Threat Unit™ CTU researchers analyzed spam campaigns that distributed the AdWind remote access trojan RAT.


Following a previous discovery, FireEye Labs mobile researchers discovered another malicious adware family quickly spreading worldwide that allows for complete takeover of a user's Android device.


This campaign was focused on various South American banks in an attempt to steal credentials from the user to allow for illicit financial gain for the malicious actors.


Ironically, Ben-Gurion University is home to Israel's Cyber Security Research Center.


A backdoor also known as: Trojan-Dropper.Win32.Typic!O Downldr.TonickCS.S543700 Dropper.Typic.Win32.736 Trojan/Dropper.Typic.arx Win32.Trojan-Downloader.VB.p Win32/Fruspam.GF Win.Trojan.Typic-1 Trojan-Downloader.Win32.Dapato.stb Trojan.Win32.Typic.dvexc TrojWare.Win32.TrojanDownloader.VB.OSNA TrojanDropper.Typic.me Trojan[Dropper]/Win32.Typic Dropper/Win32.Typic.R2031 TrojanDownloader.VB Trojan.Downloader.WCA Win32/TrojanDownloader.VB.OSN Trojan.DR.Typic!OCnhzJxHb3A Backdoor.Win32.Bifrose Trj/Downloader.XOR


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Shylock Trojan.Win32.Inject1.dkmayz Trojan.Win32.Z.Matrix.5088483 Trojan.Inject1.30662 Trojan.Blocker.Win32.12010 Trojan.Win32.Trxa W32/Trojan.SIWU-6483 Backdoor/Androm.ayy Trojan/Win32.Unknown Trojan.Matrix.1 Trojan:Win32/Trxa.A Backdoor.Androm Trj/CI.A Msil.Trojan.Kryptik.Lnej Trojan.Kryptik!0hVPn+vQuN8 MSIL/Kryptik.OR!tr Win32/Trojan.edc


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9967 Trojan.VB.Win32.113731 Backdoor.Win32.Cinasquel Backdoor:Win32/Cinasquel.A Backdoor/Win32.RemoteAccess.R125850


Comodo Threat Research Labs CTRL identified a new phishing email, that contains a malware file, and spread to email user with subject Dossier M978885982A -


Adobe may have already patched a Flash Player vulnerability last week, but several users—especially those in the US, Canada, and the UK —are still currently exposed and are at risk of getting infected with CryptoWall 3.0. The Magnitude Exploit Kit included an exploit, detected as SWF_EXPLOIT.MJTE, for the said vulnerability, allowing attackers to spread crypto-ransomware into their target systems.


In the listed indicators of compromise, we noticed domains that we had seen used in a distinct skimming campaign which didn't seem to be documented yet.


A backdoor also known as: Dropped:Trojan.Script.32120 Trojan.Script.D7D78 Win32.Trojan.WisdomEyes.16070401.9500.9925 Dropped:Trojan.Script.32120 Script.Trojan.Script.Eddq Dropped:Trojan.Script.32120 Trojan.DownLoad1.58708 Dropped:Trojan.Script.32120 Trojan/Win32.Xema.C28003 Dropped:Trojan.Script.32120


It also used multiple anti-analysis techniques and the final payload was written in Delphi which is quite unique to the banking trojan landscape.


A backdoor also known as: W32.Cloda4a.Trojan.4db2 Backdoor/W32.EvilBot.49184.D Backdoor/Evilbot.a Backdoor.Evilbot!ON36921kndI Backdoor.Evilbot BKDR_EVILBOT.A Backdoor.Win32.Evilbot.a Trojan.Win32.Evilbot.dgrj Backdoor.Win32.A.Evilbot.49184 Backdoor.Win32.Brat BackDoor.Brat BDS/Brat.A BKDR_EVILBOT.A Trojan[Backdoor]/Win32.Evilbot Win32.Hack.EvilBot.a.kcloud W32/Risk.PNHY-7386 Bck/Evilbot.H PE:Trojan.Evilbot.a!1173766179 Backdoor.Win32.Evilbot W32/EvilBot.A2!tr Backdoor.Win32.Evilbot.AMnQ


Report on APT attacks against Korea by AhnLab.


Phones ? November 16 , 2016 In what 's being chalked up as an apparent mistake , more than 120,000 Android phones sold in the U.S. were shipped with spying code that sent text messages , call logs and other sensitive data to a server in Shanghai .


A backdoor also known as: W32.FakeSmssV.Trojan Backdoor/W32.Jewdo.14848 Backdoor.Win32.Jewdo!O Backdoor.Jedobot.A4 Trojan.Downloader Backdoor/Jewdo.a WORM_JEWDO.SMD Win32.Backdoor.Dipeok.b W32/Trojan3.PWU Backdoor.Warbot WORM_JEWDO.SMD Win.Downloader.94233-1 Trojan.Win32.Fsysna.diom Trojan.Win32.Jewdo.rvcd Backdoor.Win32.Jewdo.14848 Troj.W32.Fsysna.tnhD BackDoor.Ddoser.432 Backdoor.Win32.Jewdo W32/Trojan.YZKF-7158 Trojan[Backdoor]/Win32.Jewdo Win32.Hack.Jewdo.kcloud Backdoor:Win32/Jedobot.A Trojan.Win32.Fsysna.diom Trojan/Win32.Jewdo.R4708 Backdoor.Jewdo Trojan.Dipeok.A Win32/Dipeok.A Backdoor.Win32.Jewdo.a W32/Jewdo.A!tr


A backdoor also known as: Backdoor/Delf.aarf Trojan.Win32.Delf.djezh Backdoor.Trojan Malware.XSSC BKDR_DELF.RFY Backdoor.Win32.Delf.aarf Backdoor.Delf!KqYaW6LeN/8 BKDR_DELF.RFY Backdoor:Win32/Dekara.A Backdoor/Win32.Delf Backdoor.Delf Backdoor.Trojan!rem Trojan-Dropper.Delf W32/Delf.AARF!tr.bdr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9996 BehavesLike.Win32.Backdoor.cc Backdoor:Win32/Govrat.A


Based on data aggregated from a controlled sinkhole, Fidelis Cybersecurity has observed some notable changes with the primary command and control C&C and conducted in-depth analysis of the secondary C&C Domain Generation Algorithim DGA.


A backdoor also known as: Trojan.Win32.PopUpper!O Worm.Shamli.A3 Trojan.PopUpper.Win32.66 Trojan.ShellStartup.E6CAF2 Win32.Trojan.WisdomEyes.16070401.9500.9949 Trojan.Win32.PopUpper.eg W32.Virut.low6 Trojan.MulDrop3.38938 BehavesLike.Win32.VBObfus.tz Trojan/PopUpper.bi Trojan/Win32.PopUpper Worm:Win32/Shamli.A Trojan.Win32.A.PopUpper.1695744 Trojan.Win32.PopUpper.eg Trojan/Win32.PopUpper.R52146 MAS.Trojan.VB.0879 Win32/VB.ODX Trojan.Win32.PopUpper W32/Popupper.A!tr Trj/Shamli.A Win32/Trojan.41d


A backdoor also known as: Trojan.Dropper.Joiner Trojan.DR.Joiner!+J8FCDf4wyY W32/Dropper.AVHN Backdoor.Colfusion W32/Microjoin.IG Win32/Joiner.U BKDR_JOINER.U Trojan-Dropper.Win32.Joiner.u Trojan.Dropper.Joiner Trojan-PWS.Win32.Atrojan!IK TrojWare.Win32.TrojanDropper.Joiner.U Trojan.Dropper.Joiner Trojan.MulDrop.210 BKDR_JOINER.U TrojanDropper.Win32.Joiner.u Trojan.Dropper.Joiner W32/Dropper.AVHN Dropper/Joiner.44544 Win32/TrojanDropper.Joiner.U Dropper.Joiner.by Trojan-PWS.Win32.Atrojan W32/Joiner.U!tr Dropper.Delf.AW


A backdoor also known as: Riskware.Confuser! Trojan.Win32.SteamBurglar.dmdrlr Trojan.SteamBurglar.621 Trojan.Katusha.Win32.39398 BehavesLike.Win32.Backdoor.cc TR/Confuser.181248 MSIL/Injector.LTM!tr PWS:MSIL/Stimilini.C Trj/CI.A Trojan.MSIL.Stimilik MSIL6.AKRX Trojan.MSIL.Stimilik.DT


DotRunpeX is a new injector written in .NET using the Process Hollowing technique and used to infect systems with a variety of known malware families.


A backdoor also known as: W32/Sdbot.worm Backdoor.Shark.Win32.1896 Backdoor/Shark.ed Win32.Trojan.WisdomEyes.16070401.9500.9984 W32/Backdoor2.ETS Packed.Win32.Black.a Trojan.Win32.Shark.wxsv Packer.W32.Black.lbw7 Packed.Win32..Black.~A Trojan.Packed.650 W32/Sdbot.worm BDS/Shark.N Trojan[Packed]/Win32.Black Win32.Hack.Shark.eu.kcloud Backdoor:Win32/Sharke.H Backdoor.Win32.Shark.1483254 Packed/Win32.Black.C34704 Win32/Shark.RU Backdoor.Win32.Shark W32/Packed.2D18!tr


A backdoor also known as: W32.HfsAutoB.243F Backdoor.Win32.HacDef.073!O Win32.Trojan.WisdomEyes.16070401.9500.9837 Backdoor.HackDefender Win.Trojan.PcClient-54 Backdoor.Win32.Hupigon.p Trojan.Win32.Maran.enrszy Backdoor.W32.Rbot.lgxa BackDoor.HackDef.239 Backdoor/HacDef.084 BDS/Hacdef.084 Trojan[Backdoor]/Win32.Hupigon Backdoor.Win32.A.Hupigon.41500 Backdoor.Win32.Hupigon.p Trojan/Win32.Xema.C75969 Trojan.Obfuscated!wEhK/9pikzI Trojan-Dropper.Delf


A backdoor also known as: Trojan.PSW.Glacier TrojanPWS.Glacier Trojan.PSW.Glacier Trojan/PSW.glacier W32/Glacier.A Win32/GDoor.F BKDR_GLACIER.A Win.Spyware.9313-2 Trojan.PSW.Glacier Trojan-PSW.Win32.Glacier Trojan.PSW.Glacier Trojan.Win32.Glacier.furm Troj.Psw.W32!c Win32.Trojan-qqpass.Qqrob.Hyx Trojan.PSW.Glacier TrojWare.Win32.PSW.Glacier Trojan.PSW.Glacier Trojan.PWS.Glacier Trojan.Glacier.Win32.8 BKDR_GLACIER.A BackDoor-FR.svr W32/Glacier.UXNT-8441 Backdoor/G_Door.b Trojan.PSW.Glacier Trojan.Win32.Glacier Trojan-PSW.Win32.Glacier Win-Trojan/GDoor.262144 BackDoor-FR.svr TrojanPSW.Glacier Trojan.Glacier Win32/PSW.Glacier Trojan.PWS.Glacier!4KEClY9FaHQ Trojan-PWS.Win32.Glacier W32/Glacier.A!tr.pws Win32/Trojan.ff1


The incident took place in the network of an East Asian company that develops data-loss prevention DLP software.


This group was named Winnti


A backdoor also known as: Win32.P2P.Spear.E Win32.P2P.Spear.E I-Worm.Spear.d.n8 W32/Spear.worm.d!p2p Worm.Spear.Win32.12 W32/Spear.d Win32.P2P.Spear.E Trojan.Win32.Spear.enxr W32/Spear.D W32.HLLW.Yoohoo Spear.M Win32/Spear.G WORM_SPEAR.D P2P-Worm.Win32.Spear.d Worm.P2P.Spear.D Worm.Win32.P2P-Spear.15360[h] Win32.P2P.Spear.E Worm.Win32.Spear.D Win32.P2P.Spear.E Win32.HLLW.Spear.15360 WORM_SPEAR.D W32/Spear.worm.d!p2p W32/Spear.YBIW-1290 Worm/P2P.Spear.e Worm/P2P.Spear Worm.Spear.d.kcloud Worm:Win32/Spear.D Win32.P2P.Spear.E Win32/Spear.worm.40448 Win32.P2P.Spear.E W32/Spear.D Win32/Spear.D Win32.Worm-p2p.Spear.Efao Worm.P2P.Spear.Based W32/Spear.D!worm.p2p Worm.Win32.Spear.aAAZ


A backdoor also known as: TrojanSpy.Neos.A3 Trojan.Razy.D1F24 TSPY_NEOS.SM Win32.Trojan.WisdomEyes.16070401.9500.9999 TSPY_NEOS.SM Win.Dropper.Skyneos-6192156-1 Trojan.Win32.KeyLogger.dbjjal TrojWare.MSIL.Spy.Keylogger.agk Trojan.MulDrop3.2465 Win32.Troj.Undef.kcloud TrojanSpy:MSIL/Neos.A Spyware.Keylogger Spyware/Win32.KeyLogger.R30636 Win32.Trojan.Spy.Wqdr


A backdoor also known as: Trojan.Orsam.A3 TSPY_PATUN.SMHA Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.FakeAV Win32/Petun.B TSPY_PATUN.SMHA BehavesLike.Win32.PWSZbot.nm PWS:MSIL/Petun.A MSIL.Trojan-Spy.Petun.B Trojan.KeyLogger.MSIL Trojan-Spy.Win32.Zbot MSIL/KeyLogger.BA!tr


A backdoor also known as: Backdoor.Rat.10 Backdoor/W32.RAT.8192.B Backdoor.Rat Backdoor/RAT.10 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.XWXN-0597 Win32/Rat.10 BKDR_RAT.10 Win.Trojan.Rat-4 Backdoor.Rat.10 Backdoor.Win32.RAT.10 Backdoor.Rat.10 Trojan.Win32.RAT.bqzxxm Backdoor.Win32.Rat_10.Svr Backdoor.W32.RAT.10!c Backdoor.Rat.10 Troj/Rat-1.0B Backdoor.Win32.Rat-10._0 Backdoor.Rat.10 BackDoor.Rat.10 Backdoor.RAT.Win32.24 BKDR_RAT.10 BehavesLike.Win32.PUP.xz Backdoor/Rat.10 Trojan[Backdoor]/Win32.RAT Backdoor:Win32/Rat.1_0 Backdoor.Rat.10 Backdoor.Win32.RAT.10 Backdoor.Rat.10 Backdoor.Rat.10 Bck/Rat.1_0 Rat.10 Win32.Backdoor.Rat.Szbj Backdoor.RAT!GoQkQzcwjDw W32/Rat.10!tr.bdr


The malware is based on a freely-available open-source backdoor – something no one would expect from an alleged state-sponsored malware operator.


Proofpoint researchers have recently observed the re-emergence of two malware downloaders that had largely disappeared for several months.


A backdoor also known as: TROJ_GE.1E00D038 Win32.Trojan.WisdomEyes.16070401.9500.9866 TROJ_GE.1E00D038


This research has proven valuable for Talos and led the development of better detection methods within the products we support along with the disruption of adversarial operations.


Currently, the XData decryption tools are available.


A backdoor also known as: Backdoor.Win32.Poison!O Backdoor.Poison Trojan.Heur.E84A91 Win32.Worm.VB.sn Trojan.FakeAV Backdoor.Win32.Poison.cwpk W32.W.VBNA.lsMe Win32.Backdoor.Poison.Pfjd Trojan.AVKill.11304 BehavesLike.Win32.RAHack.ct W32/Trojan.ULXW-4781 Backdoor.Poison.zo Trojan[Backdoor]/Win32.Poison Worm:Win32/Ructo.N Backdoor.Win32.Poison.cwpk Win32/Trojan.d07


Astrum was known to be have been exclusively used by the AdGholas malvertising campaign that delivered a plethora of threats including banking Trojans Dreambot/Gozi also known as Ursnif, and detected by Trend Micro as BKDR_URSNIF and RAMNIT TROJ_RAMNIT, PE_RAMNIT.


This report reveals a campaign of reconnaissance, phishing, and malware operations that use content and domains made to mimic Chinese language news websites.


It means this was most likely the actual operator.


A backdoor also known as: Trojan.LVBP Win32.Trojan.WisdomEyes.16070401.9500.9984 W32.SillyFDC TrojanSpy:MSIL/Ruzmoil.A Trojan/Win32.Keylogger.R17549


A backdoor also known as: Backdoor.Trojan Win32/Wykcores.A BKDR_MURCY.SM1 PE:Backdoor.Win32.Undef.cnd!1463577[F1] DLOADER.Trojan BKDR_MURCY.SM1 BehavesLike.Win32.Backdoor.qh Win32.Hack.PcClient.al.kcloud Trojan.Barys.955 Backdoor/Win32.Etso Backdoor:Win32/Wykcores.A Trojan-Downloader.Delphi


A backdoor also known as: Trojandownloader.Rameh Backdoor/DsBot.ayd Backdoor.Win32.A.DsBot.3918918[UPX] BehavesLike.Win32.BadFile.vc Trojan-Downloader.Win32.Rameh TrojanDownloader:Win32/Rameh.C


A backdoor also known as: Win32.Trojan.Staser.f Backdoor.Trojan Win.Trojan.Yoddos-2 Trojan.Win32.Delf.ffdi W32.W.Runouce.lgxV BackDoor.MaosBoot.1707 BehavesLike.Win32.Trojan.mm Backdoor/Huigezi.2008.ybi Trojan[Backdoor]/Win32.Hupigon Trojan:Win32/Yoddos.C Backdoor/Win32.Trojan.C2392352 TScope.Malware-Cryptor.SB Trojan.Kryptik!+IjAt1MW7ss Trojan.Win32.SystemHijack


Attacks involving this Trojan have been noted since February 2017 but peaked in late May.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9857 Packed.Win32.Black.a Packer.W32.Black.l6cB Trojan.Packed.650 BehavesLike.Win32.Sdbot.tc BehavesLikeWin32.ExplorerHijack W32/Packed.2D18!tr


Our researchers noted that IcedID has a modular malicious code with modern banking Trojan capabilities comparable to malware such as the Zeus Trojan.


For example, most organizations have little to no DNS restrictions or security monitoring for DNS activity.


A backdoor also known as: Trojan/Downloader.Nekill.al Trojan.DL.Nekill.X Adware.Rugo Trojan-Downloader.Win32.Nekill.al Heuristic.BehavesLike.Win32.Downloader.J Trojan-Downloader.Win32.Nekill!IK Adware/MsLock.qg Trojan-Downloader.Nekill.al Adware.Rugo Trojan-Downloader.Win32.Nekill


These changes not only make it more difficult for the victim to identify what files have been encrypted, but also may thwart security protections currently in place for the CryptoWall threat.


A backdoor also known as: Trojan.Barys.D1CD2 Win32.Trojan.WisdomEyes.16070401.9500.9968 Trojan.MSIL.Inject.abuiq Trojan/Windef.hm DDoS:Win32/Darktima.A Trojan.MSIL.Inject.abuiq TrojanFakeAV.Windef Trj/CI.A Win32.Trojan.Inject.dfju Trojan.DR.MSIL!M+jYeJcGakI Trojan.Win32.FakeAV W32/Dropper.FBQ!tr Win32/Trojan.f70


Consider the following phish delivered to the email address displayed on the bank's website.


Eltima was very responsive and maintained an excellent communication with us throughout the incident.


Beginning in December 2016, unconnected Middle Eastern human rights activists began to receive spearphishing messages in English and Persian that were not related to any previously-known groups.


This campaign appears to be directly related to the launch and the ensuing discussion of North Korean missile technology.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Downldr2.FYWH Hacktool.Rootkit Win32/Kerproc.A Win.Trojan.Rootkit-5417 Trojan.Win32.NtRootKit.duatym Trojan.DownLoader12.58402 W32/Downloader.QURR-6406 Trojan[Rootkit]/Win32.Small TrojanDropper:Win32/Bodsuds.A Dropper/Win32.Downloader.R143536 Rootkit.Win32.SMA


While the current campaign from this attacker has been active for a couple of months, there is evidence of activity by this attacker as far back as 2013, employing other backdoors such as Saker, Netbot and DarkStRat


A backdoor also known as: Trojan.DownLoader6.51149 RKIT/Mon.A Backdoor:Win32/Feljina.B Trojan.Graftor.DE2AD TScope.Trojan.Delf


It is spread presumably via ShellShock vulnerabilities.


A backdoor also known as: Trojan.Ransom.HiddenTear.H Ransom.Ryzerlo.A3 Trojan.Ransom.HiddenTear.H Ransom.HiddenTear Ransom_CRYPTEAR.SM0 Trojan.Win32.Hesv.crqo Trojan.Ransom.HiddenTear.H Trojan.Ransom.HiddenTear.H Trojan.Encoder.10598 Ransom_CRYPTEAR.SM0 Ransom:MSIL/Ryzerlo.A Trojan.Win32.Hesv.crqo Trojan.Ransom.HiddenTear.H Trj/GdSda.A Win32.Trojan.Fakedoc.Auto Trojan-Ransom.HiddenTear Win32/Trojan.504


However, recently, we have observed cases where PoisonIvy with expanded features in its communication function were used for attacks.


They might be Jaff ransomware or might be Dridex banking Trojan or Trickbot banking Trojan.


It turns out that this campaign had an association to 2016 Fancy Bear activity previously identified by the German Federal Office for the Protection of the Constitution BfV.


Also of particular interest from an attribution obfuscation perspective is direct IP crossover with previous Dynamic DNS domains associated with known CN-APT activity.


It has strong behavioral ties to Ke3chang and is being used in an ongoing attack campaign against Indian embassy personnel worldwide.