Cerberus embeds the following set of features that allows itself to remain under the radar and successfully perform attacks : Overlaying : Dynamic ( Local injects obtained from C2 ) Keylogging SMS harvesting : SMS listing SMS harvesting : SMS forwarding Device info collection Contact list collection Application listing Location collection Overlaying : Targets list update SMS : Sending Calls : USSD request making Calls : Call forwarding Remote actions : App installing Remote actions : App starting Remote actions : App removal Remote actions : Showing arbitrary web pages Remote actions : Screen-locking Notifications : Push notifications C2 Resilience : Auxiliary C2 list Self-protection : Hiding the App icon Self-protection : Preventing removal Self-protection : Emulation-detection Architecture : Modular Overlay attack Most Android banking Trojans use overlay attacks to trick the victim into providing their personal information ( such as but not limited to : credit card information , banking credentials , mail credentials ) and Cerberus is no exception .


A backdoor targetting Linux also known as: Trojan.Unix.Mlw.evxpjx Linux.Trojan.Rootkit.40 Trojan/Linux.Rootkit.40 Trojan.Linux.Rootkit Linux/RootKit.40 Win32/RootKit.Rootkit.05f


A backdoor also known as: W32.SvchostPP.Worm Trojan.VBS.Downloader.U Trojan.VBS.Downloader.U Trojan.StartPage.Win32.8162 Trojan.VBS.Downloader.U Win32.Trojan.WisdomEyes.16070401.9500.9984 W32/Trojan2.MMWH Trojan.Qhosts Win32/Delf.OF TROJ_FAM_00011b6.TOMA Win.Trojan.Delf-8259 Trojan.VBS.Downloader.U Trojan.VBS.Qhost.v Trojan.VBS.Downloader.U Trojan.Win32.StartPage.blxqw Trojan.VBS.Downloader.U Trojan.MulDrop1.37420 TROJ_FAM_00011b6.TOMA BehavesLike.Win32.Downloader.ch Trojan.VBS.Qhost W32/Trojan.DBWF-7475 Troj.VBS.StartPage.lgP3 Trojan.VBS.Qhost.v Trojan/Win32.Fakesys.R2395 VBS/TrojanDownloader.Psyme.NHE Trojan.DL.Delf.FCBW


The Carbanak financial APT group made the headlines when Group-IB and Fox-IT broke the news in December 2014, followed by the Kaspersky report in February 2015.


Mandiant assesses with high confidence that APT43 is a moderately-sophisticated cyber operator that supports the interests of the North Korean regime.


This is why getting access to their devices could be worth a lot more than for a normal user.


ISSP informs on new wave of cyber attack in Ukraine on August 22, 2017


Sowbug has been seen mounting classic espionage attacks by stealing documents from the organizations it infiltrates.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9973 Trojan.DownLoader25.64806 Trojan.MSILPerseus.D23337 Trj/GdSda.A


A backdoor also known as: W32.Wanex.A WORM_WANEX.TOMA Win32.Trojan.WisdomEyes.16070401.9500.9879 W32.Wanex WORM_WANEX.TOMA Win.Trojan.Delf-1033 Virus.Win32.Wanex Virus.Win32.Wanex.ggsj W32.Wanex!c Win32.Wanex.A Win32.HLLW.Pewk.46651 Virus.Wanex.Win32.1 backdoor.win32.xtrat.a Win32/Wanker.a GrayWare[AdWare]/Win32.Wanex.a Win32.Wanex.a.57014 Trojan/Win32.Buzus.R2227 Virus.Win32.Wanex Win32/Wanex.A Win32.Wanex Trojan-GameThief.Win32.OnLineGames Win32/Wanex.A W32/Wanexorl.A


Talos recently spotted a targeted phishing attack with several unique characteristics that are not normally seen.


Last week, thanks to the Check Point web sensor network, our researchers discovered a new and massive IoT Botnet, IoTroop'.


IRC Botnets alive, effective & evolving Magento exploits in the wild The CozyDuke toolset, which we believe has been under active development since at least 2011, consists of tools for infecting targeted hosts, establishing and maintaining backdoor access to the hosts, gathering information from them and gaining further access to other hosts inside the victim organization.


In particular, we identified advanced methods consistent with nation-state level capabilities including deliberate targeting and access management' tradecraft – both groups were constantly going back into the environment to change out their implants, modify persistent methods, move to new Command Control channels and perform other tasks to try to stay ahead of being detected.


The attack originates from a phishing email containing a Word document in Arabic language.


A backdoor also known as: Ransom:Win32/Cryptomix.A


The downloader also uses an uncommon technique to perform a timing check to decide whether it should perform its malicious activities.


There has been a proliferation of malware specifically designed to extract payment card information from Point-of-Sale POS systems over the last two years.


A backdoor also known as: Trojan/W32.Flooder.24292 TROJ_GICHTY.A W32/Risk.YWAF-8783 Hacktool.Flooder TROJ_GICHTY.A Win.Trojan.Gitch-1 Flooder.Win32.GichtyChatFlood.11 Trojan.Win32.GichtyChatFlood.dhga Flooder.W32.GichtyChatFlood.11!c TrojWare.Win32.Flooder.Chat.11 Trojan.Gichty.11 Tool.GichtyChatFlood.Win32.2 BehavesLike.Win32.Mydoom.mc Flooder.Chat.GichtyChatFlood.11 TR/GichtyChatFlood.11 Trojan.Heur.bmuee9li6sbi Flooder.Win32.GichtyChatFlood.11 Trojan.Win32.VB.2644 Win32/Flooder.Chat.GichtyChatFlood.11 Win32.Trojan.Gichtychatflood.Efbn Trojan.GichtyChatFlood!JHbWXCe+Dp8 Backdoor.Win32.VB Malware_fam.gw


A backdoor also known as: Adware.Rogue.Windefender.B Aplicacion/TotalSecure2009.ae Fraudtool.TotalSecure2009!VN58ZBrXUCY Trojan-FakeAV.Win32.TotalSecure2009.ae Adware.Rogue.Windefender.B Trojan.Win32.Delflob!IK Adware.Rogue.Windefender Trojan.Fakealert.3458 Trojan:Win32/Delflob.I Adware.WinDefender2009.R.2828800 Adware.Rogue.Windefender.B Win-AppCare/Windefender.2828800 RogueAntiSpyware.WinDefender Trojan.Win32.Delflob


It is worth noting that this number only shows hosts potentially vulnerable to the first exploit, while the second one is also required to execute code on the router or modem.


The data is encoded prior to transmission using a dword XOR routine, so IDS technology is unlikely to see raw Track data flying around a compromised network.


A backdoor also known as: Backdoor.Hupigon.AAAH Backdoor.Hupigon.AAAH Backdoor.Trojan Trojan.Dropper.Small-159 Backdoor.Hupigon.AAAH Virus.Win32.Delf!IK Packed.Win32.Klone.~KH Backdoor.Hupigon.AAAH Win32.Troj.Loader.fw.9734 TrojanDownloader:Win32/Bulilit.A Backdoor.Hupigon.AAAH BScope.HackTool.Sniffer.WpePro Backdoor.Trojan Virus.Win32.Delf W32/Shooo.A!tr Win32/Delf.2.K


The cybercriminal group Lurk was one of the first to effectively employ fileless infection techniques in large-scale attacks—techniques that arguably became staples for other malefactors.


In March 2013, the country of South Korea experienced a major cyberattack, affecting tens of thousands of computer systems in the financial and broadcasting industries.


This new RETADUP variant has features that would be useful for cybercrime instead of espionage.


On November 2015, Kaspersky Lab researchers identified ATMZombie, a banking Trojan that is considered to be the first malware to ever steal money from Israeli banks.


A backdoor also known as: TrojanPWS.Zbot.A4 Spyware.Zbot Trojan.Zbot.Win32.150744 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Zbot TROJ_MALKRYP.SM1 Trojan.Win32.Zbot.cuxeug Win32.Trojan.Spy.Pefj TrojWare.Win32.Injector.AYTP Trojan.PWS.Panda.2982 TROJ_MALKRYP.SM1 BehavesLike.Win32.PWSZbot.cc TrojanSpy.Zbot.ecmj TR/Spy.ZBot.rhwnxx Trojan[Spy]/Win32.Zbot Win32.Troj.Undef.kcloud Trojan:Win32/Tesch.B Trojan.Kazy.D53F00 Backdoor/Win32.Androm.R99103 BScope.Malware-Cryptor.Winlock.7414 Win32/Injector.AYPX TrojanSpy.Zbot!As9snjQ7nLU Trojan-Downloader.Win32.Carberp W32/Kryptik.WIF!tr


A backdoor also known as: W32.Clodc3b.Trojan.b7e0 Trojan/Downloader.Vqod.bq Trojan.DL.Vqod!a48Wt68Nq30 Trojan-Downloader.Win32.Vqod.bq Trojan.Win32.Vqod.cokvn Trojan.DownLoad2.31415 TR/Dldr.Vqod.bq Trojan[:HEUR]/Win32.Unknown Win32.Troj.Undef.kcloud TrojanDownloader:Win32/Lisfonp.A Win-Trojan/Vqod.57856.B TrojanDownloader.Vqod Win32.Trojan-downloader.Vqod.Pgmj Trojan-Downloader.Win32.Lisfonp W32/Vqod.BQ!tr.dldr Win32/Trojan.7ff


At launching, it checks for the presence of /var/run/dhcpclient-eth0.pid. file.


A backdoor also known as: Trojan.AutoIT.Injector.S Trojan/Cosmu.bizd AutoIt.Trojan.Injector.g Trojan.Packed.40821 Trojan.Autoit.F


A backdoor also known as: Trojan-Downloader.Win32.Small!O TrojanDownloader.Pipsek.B5 Downloader.Small.Win32.48755 Trojan/Downloader.Small.bjqy TROJ_REDOSD.SMQ Win32.Trojan.KillAV.c W32/KillAV.GG Trojan.Dropper Win32/Pigeon.BCUH TROJ_REDOSD.SMQ Trojan-Downloader.Win32.Small.bjqy Trojan.Win32.Small.bdavsq Trojan.Win32.A.Downloader.48432 TrojWare.Win32.AntiAV.nhr W32/KillAV.JXYA-5937 Trojan/Win32.Antavmu Trojan.Symmi.D2028 Trojan-Downloader.Win32.Small.bjqy Downloader/Win32.Small.R14220 Trojan.Antavmu Win32/AntiAV.NHJ Trojan.Win32.FakeUsp.c Trojan.AntiAV!GuYWyLBvRFY Trojan-Downloader.Win32.Small


A backdoor also known as: Virus.Win32.Sality!O TrojanSpy.Zbot Trojan-Spy.Win32.Zbot.wjen Troj.Spy.W32.Zbot!c Trojan.PWS.Panda.9309 BehavesLike.Win32.Downloader.fc TR/AD.ZbotCitadel.kvrxb Trojan.Win32.Z.Zbot.312320.HY Trojan-Spy.Win32.Zbot.wjen Trojan/Win32.Zbot.C2294377 TrojanSpy.Zbot Trojan.Crypt.RV Win32/Spy.Zbot.AAO W32/Zbot.AAO!tr Trj/CI.A


This threat can collect your sensitive information without your consent.


A backdoor also known as: Trojan-PSW.Win32.Prostor!O TrojanPWS.Prostor Trojan.Prostor.Win32.53 Trojan/PSW.Prostor.h TROJ_PROSTOR.AA Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/PWStealer.APR Win32/Prostor.D TROJ_PROSTOR.AA Win.Trojan.Ag-1 Trojan-PSW.Win32.Prostor.h Trojan.Win32.Prostor.hoip Trojan.Win32.PSWProstor.16896 Virus.Malware.Sbg!c TrojWare.Win32.PSW.Prostor.~I Trojan.PWS.Prostor W32/PWS.PNJG-2228 Trojan/PSW.Prostor.y KIT/Prostor.I.1 Trojan[PSW]/Win32.Prostor Trojan-PSW.Win32.Prostor.h Trojan/Win32.Prostor.C16806 Trj/Prostor.F Win32.Trojan-qqpass.Qqrob.Lkdt Trojan.PWS.Prostor!B7NqNICS3Y4 Trojan-PWS.Win32.Prostor.h Win32/Trojan.PSW.7e6


A backdoor also known as: W32.ThundeSnS.Trojan Trojan-Clicker.Win32.VB!O Trojan.Desurou Troj.W32.Scar!c Win32.Trojan.WisdomEyes.16070401.9500.9957 Trojan.Adclicker Win32/TrojanClicker.VB.NNM TROJ_VBCLICK.SMO Win.Trojan.Adclicker-49 Trojan.Win32.Scar.qppd Win32.Trojan.Scar.Akez Trojan.DownLoad1.52605 Trojan.VB.Win32.40030 TROJ_VBCLICK.SMO Trojan/Clicker.VB.esc Trojan-Clicker.Win32.VB TR/Click.VB.esc Trojan.Heur.VP2.EF8A48 Trojan/Win32.VB.R2074 Trojan.Win32.Scar.qppd Trojan.VBRA.07317 Trojan.CL.VB!imzVbRyD0G8 Win32/Trojan.fb0


A backdoor also known as: Trojan.Mauvaise.SL1 Trojan.Razy.D1E0B8 Win32.Trojan.WisdomEyes.16070401.9500.9905 TSPY_LOKI.SMA Trojan.PWS.Stealer.17779 TSPY_LOKI.SMA BehavesLike.Win32.VirRansom.nh Trojan:Win32/Pwsteal.Q!bit Trojan/Win32.naKocTb.C1675893 Win32.Trojan.Dropper.Heur Trojan.naKocTb!


ArborNetworks For the past few months ASERT has been keeping an eye on a relatively new banking malware banker known as Pkybot


A backdoor also known as: Hoax.Win32.ArchSMS!O Hoax.W32.ArchSMS.HEUR.lFj0 Adware.Ziconarch.122880 Tool.SMSSend.178 Trojan.Win32.Ziconarch TR/ZipCoin.A HackTool[Hoax]/Win32.ArchSMS Trojan:Win32/Ziconarch.B.dam#2 Adware/Win32.SMSHoax.R13251 Win32/Trojan.048


IOCs related to an attack against banks in Poland


The ransomware author of Mole made a small mistake, which gives everyone the statistics of all the infected clients.


A backdoor also known as: Trojan.Mauvaise.SL1 Trojan.Kovter Ransom_HPCERBER.SMALY0A Win32.Trojan.WisdomEyes.16070401.9500.9998 Ransom_HPCERBER.SMALY0A Trojan.Win32.Pennelas.evftsg Downloader.BloKrypt.Win32.2 BehavesLike.Win32.Ransomware.hh Trojan-Downloader.Win32.Blocrypt TrojanDownloader.BloKrypt.c TR/Pennelas.tmcdy Trojan[Downloader]/Win32.BloKrypt Downloader/Win32.BloKrypt.C1680725 Trj/GdSda.A Win32/TrojanDownloader.Blocrypt.AK Trojan.DL.BloKrypt! W32/Kryptik.FKEL!tr


Odin very much resembles another Locky variant, Zepto.


This new campaign includes new evasive macros and demonstrates continued evolution in their tools and techniques, showcasing attacker adaptation to evolving defenses and the widespread use of sandboxes.


A backdoor also known as: TrojanDropper.Oblivion Trojan/Dropper.oblivion W32/Tool.JTFL-0204 TROJ_OBLIVION.B Win.Dropper.Oblivion-3 Trojan-Dropper.Win32.Oblivion Trojan.Win32.Oblivion.dksy Trojan.Win32.Z.Oblivion.53248 Troj.Dropper.W32.Oblivion!c TrojWare.Win32.TrojanDropper.Oblivion Dropper.Oblivion.Win32.1 TROJ_OBLIVION.B BehavesLike.Win32.Dropper.qt TrojanDropper.Win32.Oblivion W32.Trojan.Backdoor-Oblivion Trojan[Dropper]/Win32.Oblivion Trojan-Dropper.Win32.Oblivion Trojan/Win32.HDC.C97188 TrojanDropper.Oblivion Trj/Oblivion.Drp Win32/TrojanDropper.Oblivion Win32.Trojan-dropper.Oblivion.Wpjr Trojan.DR.Oblivion!js3IRiusBTg Trojan-Dropper.Win32.Oblivion W32/Oblivion.A!tr Win32/Trojan.Dropper.f88


The other appears to be CVE-2015-1770.


A backdoor also known as: P2P-Worm.Win32.Picsys!O Worm.Picsys.CC1 Worm.Picsys.Win32.3 W32/Picsys.b Win32.Worm.Picsys.a W32/Picsys.B W32.HLLW.Yoof Win32/Picsys.A WORM_SPYBOT.PA Win.Worm.Picsys-4 P2P-Worm.Win32.Picsys.b Trojan.Win32.Picsys.cxhvjd Worm.Win32.Picsys.aab Worm.Win32.Picsys.B Win32.HLLW.Morpheus.2 WORM_SPYBOT.PA BehavesLike.Win32.Picsys.mc W32/Picsys.FYLV-4646 I-Worm/P2P.Picsys Worm[P2P]/Win32.Picsys Worm:Win32/Yoof.E Worm.Win32.P2P-Picsys.65221 Worm/Win32.Picsys.C116429 W32/Picsys.worm.b Worm.Picsys Win32/Picsys.B Worm.Picsys!vNEZkf1mA50 P2P-Worm.Win32.Picsys.b


A backdoor also known as: Uds.Dangerousobject.Multi!c Trojan.Kazy.D5BCBA TROJ_SPNR.24AI13 Win32.Trojan.WisdomEyes.16070401.9500.9995 TROJ_SPNR.24AI13 Trojan.Win32.Scar.kdnc Trojan.DownLoader7.54481 BehavesLike.Win32.VirRansom.nc TR/Slamu.A Trojan.Win32.Scar.kdnc Trojan.Kryptik!2D0DfpBZg1g W32/DotNet.B!tr


A backdoor also known as: Trojan-PWS/W32.WebGame.17708.D Trojan-GameThief.Win32.OnLineGames!O TrojanPWS.OnLineGames.ZF4 Trojan.OnLineGames.Win32.42164 Trojan/OnLineGames.bnbk Trojan.Graftor.D80DC Win32.Trojan.WisdomEyes.16070401.9500.9969 Win32/Gamepass.NKR TSPY_ONLINEG.SMV Win.Spyware.67145-2 Trojan-GameThief.Win32.OnLineGames.bnbk Trojan.Win32.OnLineGames.bqvvjm Trojan.Win32.PSWIGames.17708.E TrojWare.Win32.PSW.Onlinegames.OQU.1 Trojan.PWS.Wsgame.24647 TSPY_ONLINEG.SMV Trojan[GameThief]/Win32.OnLineGames TrojanDropper:Win32/Vtimrun.C Trojan-GameThief.Win32.OnLineGames.bnbk Dropper/Win32.OnlineGameHack.R137 BScope.Trojan-Dropper.OLGames.2512 Trojan.PWS.OnLineGames!ZUTM5XqTClQ


A backdoor also known as: Win32.Valhalla.2048 Win32.Valhalla.2048 Trojan.Malpack Win32.Xorala Win32/Valla.2048 W32.Xorala Win32.Valhalla.2048 Virus.Win64.Xorala.cbehdj Win32.Valhalla.2048 Win32.Valhalla.2048 BehavesLike.Win64.Chir.cm W32/Xorala.b Win32.Valhalla.2048 Virus.Win32.Xorala Win32/Valla.2048


A backdoor also known as: Win32.Spy.Bancos.Oer Trojan-PWS.Banker6!IK Trojan-PWS.Banker6 VBCrypt.DDL


The Locky variant of ransomware has been responsible for huge amounts of spam messages being sent on a daily basis.


A backdoor also known as: HW32.Packed.AE5C Downloader.Tibs.Win32.6 Trojan/Tibs.al Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Packed.13 Packed.Win32.Tibs.al Trojan.Win32.Small.erlei Win32.Packed.Tibs.Wtdn TrojWare.Win32.TrojanDownloader.Tibs.~mm Trojan.Packed.142 Trojan.Win32.Crypt TrojanDownloader.Tibs.amzo TR/Small.DBY.LH.14 Win32.TrojDownloader.Tibs.mm.kcloud TrojanDownloader:Win32/Nuwar.B Trojan.Heur.TP.ED17A6 Troj.Downloader.W32.Tibs.mm!c Packed.Win32.Tibs.al Trojan-Downloader.Revelation.Tibs.B


Reports on this malware family have previously been published by both Intel Security and Microsoft.


A backdoor also known as: Trojan-Spy/W32.KeyLogger.178176.B Win32.Backdoor.Rbot.1470B0D03 WORM_SDBOT.CTJ Virus.Win32.Rbot!IK Worm/Rbot.210944 WORM_SDBOT.CTJ Heuristic.BehavesLike.Win32.PasswordStealer.H Virus.Win32.Rbot


While some findings where very interesting, others were misleading or simply wrong.


Mexico has previously confirmed that it is a purchaser of NSO Group's spyware.


A phone belonging to the Interdisciplinary Group of Independent Experts GIEI, a group of investigators from several countries, was sent text messages with links to NSO's exploit infrastructure


This blog post describes another attack campaign where attackers used the Uri terror attack and Kashmir protest themed spear phishing emails to target officials in the Indian Embassies and Indian Ministry of External Affairs MEA.


After publication I was contacted by another analyst who was able to link the information from my blog to other samples from an actual campaign.


A backdoor also known as: Backdoor.Etumbotb Trojan/Ixeshe.i Win32.Trojan.WisdomEyes.16070401.9500.9996 W32/Etumbot.I Backdoor.Typideg Trojan.Etumbot.1 Trojan.Ixeshe.Win32.30 BKDR_ETUMBOT.UQU Trojan.Etumbot W32/Etumbot.UDKV-8115 Trojan.Graftor.D234F5 Trj/CI.A


The researcher came upon an interesting set of emails, which were soon determined to be part of a widespread spam campaign.


The site was infected with an iframe injector that redirects to Angler EK.


The number of LINE users in Taiwan reaches up to 17 million in the same year.


A backdoor also known as: Trojan.RockRat.S1875120 Troj.W32.Rockrat!c Trojan.Johnnie.D1566D Win32.Trojan.WisdomEyes.16070401.9500.9957 W32/Trojan.IKOU-3732 Backdoor.Rokrat TROJ_KORPODE.A Win.Trojan.Rokrat-6443187-0 Trojan.Win32.RockRat.exmijf Trojan.Inject3.2444 Trojan.RockRat.Win32.1 W32/RockRat.A Trojan.RockRat.a W32/FakeAV.BCMZ!tr Trojan/Win32.RockRat Trojan:Win32/Korpode.A!dha Trojan/Win32.Loader.R219535 Trj/CI.A Win32.Trojan.Rockrat.Ljuk Trojan.RockRat! Win32/Trojan.549


The injected code attempts to download them all and execute.


A backdoor also known as: Trojan-Dropper.Win32.Mudrop!O Spyware.WSLogger Trojan/Dropper.Mudrop.hs Win32.Trojan.WisdomEyes.16070401.9500.9934 W32/Risk.AAJK-2149 Infostealer.Tarno.B Win32/Mdrop.MD not-a-virus:PSWTool.Win32.WSLogger.a Trojan.Win32.Mudrop.dgpnb Trojan.WSLogger.38 BehavesLike.Win32.Wabot.cc W32/Dropper.AOIJ TrojanDropper.Mudrop.amp Trojan[Dropper]/Win32.Mudrop TrojanDropper:Win32/Spiloog.A!bit not-a-virus:PSWTool.Win32.WSLogger.a Dropper/Win32.Mudrop.R19044 TrojanDropper.Mudrop Trojan.DR.Mudrop!uBx16xyI0u0 Trojan-Dropper.Win32.Mudrop


A backdoor also known as: BackDoor.Rurktar.3 Backdoor:MSIL/Rurktar.A


A backdoor also known as: Trojan/Jorik.IRCbot.iia Win32.Trojan.WisdomEyes.16070401.9500.9935 Win32.Worm.Autorun.R TrojWare.Win32.Kryptik.ACZQ Win32.HLLW.Autoruner1.3120 Trojan.Jorik.Win32.159726 BehavesLike.Win32.RAHack.pt Trojan/Jorik.ayqm Trojan/Win32.IRCbot Trojan.IRCbot Win32.Crypt W32/Jorik.FSC!tr


A backdoor also known as: W32.Clod94b.Trojan.33b2 Trojan.Proxy.Webber.B Trojan-Proxy/W32.Webber.6176 Trojan/Proxy.Webber.b Trojan.PR.Webber!M1rEz2z+nTg W32/Webber.XHQG-0071 Backdoor.Exdis Webber.CB Trojan-Proxy.Win32.Webber.b Trojan.Proxy.Webber.B Trojan.Win32.Webber.ejli Hoax.W32.Renos Trojan.Proxy.Webber.B TrojWare.Win32.TrojanProxy.Webber.B Trojan.Proxy.Webber.B Trojan.Webber.Win32.42 BehavesLike.Win32.Dropper.xm W32/Webber.J TrojanProxy.Webber.r TR/Proxy.Webber.B Trojan[Proxy]/Win32.Webber Win32.Troj.Webber.b.kcloud TrojanProxy:Win32/Webber.B Win-Trojan/Webber.6176 Trojan.Proxy.Webber.B Win32/TrojanProxy.Webber.B W32/DwnLdr.MO!tr Proxy.2.AM Trojan.Win32.Webber.aY Win32/Trojan.a1a


A backdoor also known as: DLOADER.Trojan Heuristic.Malware


They are never well detected but recent ones are getting very poor detections by antiviruses.


This exploit kit evolves on an almost constant basis.


A backdoor also known as: Application.Hacktool.MD Tool.Kiser.Win32.1373 HackTool.Win32.HackAV.c Application.Hacktool.MD Application.Hacktool.MD BehavesLike.Win32.BadFile.vm W32/Application.MUHU-1657 HackTool.HackAV.e HackTool:Win32/Kapahyku.A Application.Hacktool.MD HackTool.W32.HackAV.tn1i HackTool.Win32.HackAV.c Application.Hacktool.MD Unwanted/Win32.HackAV.R173782 RiskWare.Tool.HCK RiskWare.HackAV! PUA.RiskWare.HackAV Win32/Application.Hacktool.63c


The WildFire Locker ransomware has risen from the dead and rebranded itself using the apropos name of Hades Locker.


A backdoor also known as: Dos.Clodf80.Trojan.7c93 Trojan.AOL.PWS.SUPERNAUT.A Trojan.AOL.PWS.SUPERNAUT.A Smalltroj.JNY Trojan.AOL.Supernaut Trojan-IM.Win16.Supernaut Trojan.AOL.PWS.SUPERNAUT.A Trojan.Win16.Supernaut.hqzm Trojan.Win16.A.IM-Supernaut.47117 Win16.Trojan-im.Supernaut.Ebgh Trojan.AOL.PWS.SUPERNAUT.A TrojWare.Win16.AOL.Supernaut Trojan.AOL.PWS.SUPERNAUT.A Trojan.Supernaut.Win16.1 Trojan/AOL.Supernaut TR/Aol.Supernaut Trojan[IM]/Win16.Supernaut Win32.Troj.Undef.kcloud Trojan.AOL.PWS.SUPERNAUT.A Trojan.Win16.Supernaut.Au Win16/AOL.Supernaut NORMAL:Trojan.AOL.Supernaut!19246 Trojan-AOL.Win16.Supernaut W16/AOL.D!tr Trj/AOLPS.D Win32/Trojan.AOL.52f


A backdoor also known as: Trojan.Boaxxe.E Trojan.FakeMS.ED Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_ZBOT.SMUH Win32.Trojan.Zbot.N Packed.Win32.Krap.iu Trojan.Win32.Krap.brabpa Packer.W32.Krap.lKMc TrojWare.Win32.Kazy.FOF Trojan.DownLoad3.2720 Win32.Troj.Krap.iu.kcloud Trojan.Graftor.D487A Trojan/Win32.Plosa.R24487 Packed.Win32.Krap.iu BScope.Malware-Cryptor.SB.01798 Bck/Qbot.AO W32/ZBOT.HL!tr


A backdoor also known as: Trojan.Securityshield W32/Trojan.JOHS-0158 Trojan-FakeAV.Win32.SecurityShield.vip Trojan.Win32.FakeAV.euwntc Win32.Trojan-fakeav.Securityshield.Syrj Trojan.Click2.45032 BehavesLike.Win32.Spyware.dc TR/Pingdel.A.15 W32.W.AutoIt.mr6E Trojan-FakeAV.Win32.SecurityShield.vip Trojan.Win32.Pingdel W32/SecurityShield.RMG!tr Win32/Trojan.228


A backdoor also known as: Dropper.Msil.BO


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G W32.Virut.CF Win32/Virut.17408 PE_VIRUX.O Win.Phishing.NikoLata-6332081-0 Win32.Virus.Virut.Q Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg Virus.Win32.Virut.CE Win32.Virut.56 PE_VIRUX.O Trojan.MSIL.TrojanClicker Win32/Virut.bt Virus/Win32.Virut.ce Win32.Virut.cr.61440 TrojanClicker:MSIL/Worfload.A!bit W32.Virut.lqtW Virus.Win32.Virut.ce Win32/Virut.F Virus.Virut.14 W32/Sality.AO Win32/Virut.NBP Virus.Win32.VirutChangeEntry.A


Typically, file-less malware has been observed in the context of Exploit Kits such as Angler.


These lures were expected, until we started digging into the actual documents attached and saw an interesting method within the Visual Basic VB macros in the attached documents used for dropping the malware.


However, the occasional functional enhancements combined with its multiple layers of obfuscation and server-side polymorphism periodically breathe new life into this seemingly immortal malware.


A backdoor also known as: W32.CombotoD.Trojan Backdoor.Minaps BKDR_MINAPS.A W32/Trojan.WDQB-6441 Backdoor.Wakeminap!g1 BKDR_MINAPS.A Win.Downloader.133181-1 Trojan.Win32.Snojan.jj Trojan.Win32.A.Downloader.52224.HP DLOADER.Trojan Backdoor:Win32/Minaps.A Trojan.Win32.Snojan.jj Win32.Trojan.Snojan.Wrgx Win32/Trojan.cb9


Compromised hosts cause a victim's machine to be attached to the Andromeda botnet, giving attackers the ability to push plugins or additional malware onto these machines.


In early 2016 the Callisto Group began sending highly targeted spear phishing emails with malicious attachments that contained, as their final payload, the Scout malware tool from the HackingTeam RCS Galileo platform.


Our analysis reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013.


Package Name SHA256 digest SHA1 certificate com.network.android 98ca5f94638768e7b58889bb5df4584bf5b6af56b188da48c10a02648791b30c 516f8f516cc0fd8db53785a48c0a86554f75c3ba com.network.android 5353212b70aa096d918e4eb6b49eb5ad8f59d9bec02d089e88802c01e707c3a1 44f6d1caa257799e57f0ecaf4e2e216178f4cb3d com.binary.sms.receiver 9fae5d148b89001555132c896879652fe1ca633d35271db34622248e048c78ae 7771af1ad3a3d9c0b4d9b55260bb47c2692722cf com.android.copy e384694d3d17cd88ec3a66c740c6398e07b8ee401320ca61e26bdf96c20485b4 7771af1ad3a3d9c0b4d9b55260bb47c2692722cf com.android.copy 12e085ab85db887438655feebd249127d813e31df766f8c7b009f9519916e389 7771af1ad3a3d9c0b4d9b55260bb47c2692722cf com.android.copy 6348104f8ef22eba5ac8ee737b192887629de987badbb1642e347d0dd01420f8 31a8633c2cd67ae965524d0b2192e9f14d04d016 FinFisher exposed : A researcher ’ s tale of defeating traps , tricks , and complex virtual machines March 1 , 2018 Office 365 Advanced Threat Protection ( Office 365 ATP ) blocked many notable zero-day exploits in 2017 .


This malware has been around since 2011 and shows no signs of stopping.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9982 Trojan.Win32.Dwn.eenglt Win32.Trojan.Spy.Peqf Trojan.DownLoader14.35508 BehavesLike.Win32.HToolMimiKatz.dc Trojan.Symmi.D8341 PWS:Win32/Banker.UC!bit Trj/CI.A


A backdoor also known as: Trojan/Swisyn.aqrf Win32.Trojan.WisdomEyes.16070401.9500.9996 Win.Trojan.Swisyn-969 Trojan.Win32.Swisyn.deruf Trojan.Win32.A.Swisyn.7680.G Uds.Dangerousobject.Multi!c Trojan.Swisyn.Win32.16931 BehavesLike.Win32.Trojan.zt Trojan/Swisyn.njs Trojan/Win32.Swisyn TrojanDownloader:Win32/Surin.B Trojan.Swisyn!uy708DPUCgU Trojan.Win32.Swisyn W32/Dx.WKM!tr Win32/Trojan.ee6


Bookworm has little malicious functionality built-in, with its only core ability involving stealing keystrokes and clipboard contents.


A backdoor also known as: Worm/W32.VBNA.28672.Z Trojan-Ransom.Win32.Blocker!O Worm.VBNA.Win32.168532 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/VB.OHY HT_DROJ_GG310200.UVPM Trojan-Ransom.Win32.Blocker.cdug Trojan.Win32.VB.crkzva Worm.Win32.VBNA.28672.I Trojan.MulDrop4.59381 HT_DROJ_GG310200.UVPM BehavesLike.Win32.VBObfus.mz Worm/VBNA.hggx Trojan/Win32.Vilsel.gic Trojan.Barys.D819 Trojan-Ransom.Win32.Blocker.cdug Trojan:Win32/Droj.A Worm/Win32.VBNA.R79506 Worm.VBNA Trojan.Crypt


A backdoor also known as: Backdoor.MSIL Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.DownLoader26.11210 TR/Dropper.MSIL.aexpd Trojan:MSIL/Upadter.A Trj/GdSda.A Win32.Trojan.Inject.Auto Trojan.MSIL.Inject Win32/Backdoor.990


A backdoor also known as: Trojandownloader.Tosct Win32.Trojan.WisdomEyes.16070401.9500.9994 BKDR_WEBRV.A Trojan.Click2.39104 BKDR_WEBRV.A W32/Trojan.KRMY-0312 Trojan.Heur.JP.ED64BF TrojanDownloader:Win32/Tosct.B


Today, RSA Research published an in-depth report on a commercial VPN network, originating in China, which we are calling Terracotta


At the end of March 2017, we detected another malicious document leveraging an unknown vulnerability in EPS and a recently patched vulnerability in Windows Graphics Device Interface GDI to drop malware.


Increasingly, cyberattackers have been leveraging non-malware attack methods to target vulnerable organizations.


A backdoor also known as: Troj.W32.Jorik.Virut.ltFj BehavesLike.Win32.Parite.cm Trojan.Kazy.D23845 Trojan:Win32/Dantmil.A Win32/RiskWare.PEMalform.E


A backdoor also known as: Trojan.Downloader.NSIS.BI Trojan.NSIS.Minix.A Trojan.Downloader.NSIS.BI TROJ_DLDR.SMIM Trackware.MegaSearch TROJ_DLDR.SMIM Win.Trojan.Clicker-3867 Trojan.Downloader.NSIS.BI Trojan.Downloader.NSIS.BI Trojan.Win32.Dwn.kvabt Trojan.Downloader.NSIS.BI Trojan.DownLoader4.20561 Downloader.NSIS.Win32.1874 TrojanDownloader:Win32/Minix.A Trj/CI.A W32/Dloader.EP!tr.NSIS Win32/Trojan.Downloader.79d


A backdoor also known as: Infostealer.Lokibot Trojan.PWS.Stealer.18836 TROJ_HPUTOTI.SMQ BehavesLike.Win32.Downloader.dh DR/Autoit.ppevb Trojan:Win32/Lepoh.A Spyware.LokiBot Trojan.Win32.Injector Trj/CI.A Win32/Trojan.15d


A backdoor also known as: Backdoor/W32.Redsip.49152 Backdoor.Redsip.Win32.2 Trojan.Heur.LP.EDEA74 W32/Backdoor2.HIOG Hacktool.Keylogger Win32/Redsip.A BKDR_REDSIP.C Trojan.Win32.Redsip.dcevd Uds.Dangerousobject.Multi!c BKDR_REDSIP.C Backdoor.Win32.Redsip W32/Backdoor.WNDK-6859 TR/Spy.49152.662 Trojan[Backdoor]/Win32.Redsip Win32.Hack.Redsip.b.kcloud Backdoor:Win32/Redsip.B!svc Win-Trojan/Nightdragon.49152 Backdoor.Redsip Win32/Redsip.AA Win32.Trojan.Spy.Lohv W32/REDSIP.B!tr.bdr


Unit 42 has reported on various Sofacy group attacks over the last year, most recently with a post on Komplex, an OS X variant of a tool commonly used by the Sofacy group.


Analyzing malware is often like solving a puzzle, you have to do it piece by piece to reach the final image.


By connecting multiple Black Vine campaigns, we traced how the attack group has evolved over the last three years.


A backdoor also known as: Trojan.Zusy.D2F05E Win32.Trojan.WisdomEyes.16070401.9500.9757 Trojan.Win32.Badur.cubwxj TrojWare.Win32.Delf.ebs Trojan.DownLoader9.4478 BehavesLike.Win32.Sytro.ch TrojanDownloader:Win32/Cefunlor.A Trojan/Win32.Downloader.R91863 TScope.Trojan.Delf Spyware.PasswordStealer Trojan-Dropper.Delf W32/Delf.RQV!tr.dldr Trj/Dtcontx.L


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G W32.Virut.CF Win32/Virut.17408 PE_VIRUX.R Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg W32.Virut.lGNe Virus.Win32.Virut.CE Win32.Virut.56 Virus.Virut.Win32.1938 PE_VIRUX.R BehavesLike.Win32.Ramnit.fh Trojan.Win32.Malex Win32/Virut.bt Win32.Virut.dd.368640 TrojanDownloader:Win32/Otlard.D Virus.Win32.Virut.ce Win32.Virus.Virut.U Win32/Virut.F Virus.Virut.14 Win32/Virut.NBP W32/Virut.CE W32/Sality.AO Virus.Win32.VirutChangeEntry.A


A backdoor also known as: Trojan.Win32.SilentSpy.zmwjp Backdoor.SilentSpy Silentspy.F Win32/SilentSpy.208 BKDR_SILENTSPY.C Trojan.W32.Fadedoor.10B-3 Backdoor.Win32.SilentSpy.208 Backdoor.SilentSpy.D Backdoor.Win32.SilentSpy.208 BackDoor.Silent.208 BKDR_SILENTSPY.C Win32.Hack.SilentSpy.20.kcloud Backdoor.Win32.SilentSpy_208.559104 Win-Trojan/SilentSpy.559104 Backdoor.SilentSpy Win32/SilentSpy.208 Backdoor.Win32.SilentSpy.200 W32/Bdoor.ZT!tr.bdr BackDoor.Silentspy.G


A backdoor also known as: HackTool.Incognito Trojan.Win32.Meterpreter.exjxlb Trojan.Win64.Meterpreter W32/Trojan.VCYK-3916 HackTool.Meterpreter.ei HackTool/Win32.Meterpreter Trj/GdSda.A Win32.Hacktool.Meterpreter.Phqd Win32/Trojan.Hacktool.8d0


A backdoor also known as: Worm/W32.PadoBot.86528 W32.Sality.U Worm.Padobot.D Win32/Sality.NBA W32/Korgo.V W32.Sality.AE Korgo.V PE_SALITY.RL Worm.Padobot.M Net-Worm.Win32.Padobot.m Worm.Padobot.BV.Dam Worm.Korgo Net-Worm.Win32.Padobot!IK Worm.Padobot.BV.Dam Win32.Lsabot W32/Sality.AT PE_SALITY.RL Win32/Sality.AA Worm:Win32/Korgo.V Win32.Sality.N Worm.Padobot.BV.Dam W32/Korgo.V Win32/IRCBot.worm.variant Virus.Win32.Sality.bakb Malware.Sality Worm.Padobot.bl Net-Worm.Win32.Padobot W32/Padobot!worm.im Worm/Korgo.A W32/Korgo.U.worm


The first message after establishing the connection is always sent by the server – the most important thing it contains is a random 128-byte key used for encrypting further communication.


A backdoor also known as: W32.SampleswareTG.Trojan Trojan-GameThief.Win32.Magania!O Backdoor.Farfli.O Trojan/Magania.eken Win32.Trojan.Farfli.ai Win32/Farfli.GKH Win.Trojan.Magania-19224 Trojan-GameThief.Win32.Magania.uagj Trojan.Win32.Magania.bvkxn Troj.W32.MMM.ljA2 Backdoor.Win32.Gh0st.g Trojan.Magania.Win32.38676 BKDR_INJECT.SMJ BehavesLike.Win32.Backdoor.cc Backdoor/IRCBot.qan Trojan.Barys.62 Trojan-GameThief.Win32.Magania.uagj Trojan/Win32.PcClient.R12944 TrojanPSW.Magania Win32/Farfli.AK Trojan.Farfli!czCLTsqt/Nw Backdoor.Win32.FirstInj Backdoor.Win32.Gh0st.BH


Several months ago I examined a malware-tainted Word document titled ISIS_twitter_list.doc. I didn't think much of it and quickly moved on after a cursory analysis.


As of late December 2019, ITG03-derived macOS malware was discovered being hosted on a fake cryptocurrency-related website, also likely designed by ITG03.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9982 W32/Backdoor.TGTY-5139 Backdoor.Trojan Win32/Smalldoor.RX BKDR_SHARK.WMP BackDoor.Werchan BKDR_SHARK.WMP W32/Backdoor2.HITJ Trojan.Graftor.Elzob.D3B3C TrojanProxy:Win32/Zolpiq.A Trojan/Win32.Dllbot.R811 Backdoor.Swofi.121 Win32/Trojan.256


A backdoor also known as: Trojan.Tinba.WR4 Trojan/Tinba.be Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Backdoor2.HYQY Trojan.Win32.Inject.dqhpeo TrojWare.Win32.Tinba.BD Trojan.PWS.Tinba.153 Dropper.Injector.Win32.66634 Trojan.Win32.Exploit W32/Backdoor.DVHN-3684 TrojanDropper.Injector.avtd TR/Crypt.Xpack.182297 Trojan[Dropper]/Win32.Injector Trojan/Win32.Small.R145411 TrojanDropper.Injector Trojan.Symmi.DD5E0 Win32/Tinba.BE Trojan.DR.Injector!OJez9sRxlMc W32/Deshacop.XO!tr


A backdoor also known as: BehavesLike.Win32.Dropper.dh Trojan.AD.Lnkget TR/AD.Lnkget.hrjck TrojanDownloader:BAT/Lnkget.B Trojan/Win32.PcClient.C204685


The results are described in this report.The Trojan may then perform the following actions:Open and close the CD tray Steal Outlook password Steal login passwords to websites Intercept network traffic


In addition, this template file could also potentially be used to download other malicious payloads to the victim s computer.


A backdoor also known as: Trojan/W32.Xorist.13824 TrojanRansom.Xorist.bh Trojan/Xorist.bh Trojan.Xorist!Ff7hNbBp1Hc W32/NetworkWorm.ROB Trojan-Ransom.Win32.Xorist.bh Trojan.Encoder.91 TR/Ransom.Xorist.BH.3 Trojan/Xorist.q Trojan:Win32/Filecoder.D Trojan/Win32.Xorist Trojan-Ransom.Win32.Xorist


A backdoor also known as: W32.KowinH.Worm Backdoor/W32.PopWin.17408 Backdoor.Win32.Popwin!O Trojan.FakeMS.ED Win32.Trojan.WisdomEyes.16070401.9500.9938 W32.Popwin Win32/Pipown.EI TROJ_NSPAK.A Backdoor.Win32.Popwin.anx Backdoor.Win32.Popwin.~IQ Trojan.Popwin TROJ_NSPAK.A Trojan[Backdoor]/Win32.Popwin Win32.Hack.NsPackT.a.kcloud Trojan:Win32/Pepatch.E Backdoor.Win32.Popwin.anx Worm/Win32.AutoRun.R7462 Worm.Win32.AutoRun Win32/Backdoor.1ad


A backdoor also known as: W32.HfsAutoB.7B64 Trojan/W32.DoS.188416.C DoS.Win32.Small!O Trojan.Small DoS.W32.Small.to1D W32/VirTool.TK Win.Trojan.Small-13866 DoS.Win32.Small.ai Trojan.Win32.Small.bqdli Trojan.Win32.Small.188416 Trojan.Inject.762 Virus.Win32.Small W32/Tool.FQGY-6235 DoS.Small.h HackTool[DoS]/Win32.Small DoS.Win32.Small.ai HackTool:Win32/Upsodos.A Trojan/Win32.Flooder.R118574 DoS.Small Win32.Trojan.Small.Hpd Win32/Trojan.5b5


Shamoon is designed to destroy computer hard drives by wiping the master boot record MBR and data irretrievably, unlike ransomware, which holds the data hostage for a fee.


A backdoor also known as: Backdoor.Turla Win32.Trojan.WisdomEyes.16070401.9500.9996 Trojan.Turla Backdoor.Win32.Turla.u Trojan.Win32.FKM.evjxqd Backdoor.W32.Turla!c Win32.Backdoor.Turla.Agvc W32/Trojan.GDRU-3141 Trojan.Win32.Z.Turla.37892 Backdoor.Win32.Turla.u Trojan:Win32/Ouftap.B W32/Turla.TCW!tr.bdr Backdoor.Turla Trj/CI.A


A backdoor also known as: Trojan-Downloader/W32.Cabby.379904 Trojan.Mauvaise.SL1 Ransom.Maktub Trojan/Filecoder.MaktubLocker.b W32/Trojan2.PUUQ Ransom_HPLOCKY.SME Trojan-Downloader.Win32.Cabby.zipxi Trojan.Win32.Cabby.ejsael Troj.Downloader.W32.Cabby.tnvB TrojWare.Win32.Cabby.SA Trojan.Encoder.7386 Downloader.Cabby.Win32.1866 Ransom_HPLOCKY.SME BehavesLike.Win32.ICLoader.fc W32/Trojan.RLTC-3878 TrojanDownloader.Cabby.coy Trojan[Downloader]/Win32.Cabby Trojan-Downloader.Win32.Cabby.zipxi Trojan/Win32.Locky.R192278 TrojanDownloader.Cabby Win32/Filecoder.MaktubLocker.B Trojan.DL.Cabby! Trojan.FileCryptor


Based on the mutexes and domain names of some of their C C servers, BlackTech's campaigns are likely designed to steal their target's technology.


A backdoor also known as: Trojan.ChePro Win32.Trojan.WisdomEyes.16070401.9500.9810 Trojan-Banker.Win32.ChePro.ink Trojan.Win32.ChePro.eihuuw Trojan.Win32.Z.Banker.266752 Trojan.PWS.Banker1.15002 BehavesLike.Win32.Worm.dc Trojan.Banker.ChePro.ctf TR/Spy.Banker.hgsvz Trojan.Renos.96 Trojan-Banker.Win32.ChePro.ink Trojan:Win32/Tombrep.B Trojan/Win32.Banload.C579920 TrojanBanker.ChePro Trj/GdSda.A Win32.Trojan.Spy.Ebgv W32/Banker.ABMA!tr.spy


Proofpoint recently observed a targeted email campaign attempting a spearphishing attack using a Game of Thrones lure.


A backdoor also known as: W32.FamVT.ExpiroPC.PE Win32.Trojan.WisdomEyes.16070401.9500.9727 Heur.Corrupt.PE Trojan.Win32.Refpron Packed.Koblu.adu


The blog describes an incident that took place in late September of 2022.


Using powerful filters, various methods of communication with its operators and an interesting persistence technique, it aims to exfiltrate selected files from governmental and public institutions, which are mostly focused on economic growth and cooperation in Central and Eastern Europe.


Our published investigations have now confirmed at least 19 individuals targeted with NSO in Mexico, including lawyers, politicians, journalists, anti-corruption activists, scientists, public health campaigners, government officials, and their family members.


The Windows bot's spreading method for Mirai is very limited as well – it only delivers the Mirai bots to a Linux host from a Windows host if it successfully brute forces a remote telnet connection.


A backdoor also known as: TrojanAPT.Garveep.MUE.DR4 TROJ_TAPAOUX.B Win32.Trojan.WisdomEyes.16070401.9500.9680 Backdoor.Trojan TROJ_TAPAOUX.B Trojan.Win32.Drop.bgdoxj Trojan.Win32.Tapaoux.357344 Trojan.MulDrop1.12202 Trojan.Win32.Pincav W32/Trojan.TEGY-1102 Trojan:Win32/Tapaoux.A TR/Tapaoux.A.3 Trojan[Backdoor]/Win32.Tusha Trojan:Win32/Tapaoux.A Dropper/Win32.Mudrop.C58765 Trojan.Tapaoux.A Win32/Trojan.Dropper.663


They are bolder and more reckless than their more experienced veteran counterparts.


The criminals are also relying on a network of hacked servers to perform the multi-stage infection chain.


Periodically Necurs goes offline and during these periods we typically see Locky activity decrease drastically.


This particular ransomware appeared in 2014 when the operators of the Reveton Windows screen-locking ransomware decided to branch out and create an Android counterpart, which they began advertising on Russian-speaking hacking forums.


The White House and Department of State are two of the most spectacular known victims.


A backdoor also known as: W32.HfsAutoB.2E84 Trojan.Facebook.VP Trojan.Chromex!ZGfUkXSe3KA Worm.Win32.Febipos.da Trojan:W32/Febipos.A Trojan.FBookCRTD.Win32.1277 Worm/Febipos.h TR/Drop.Febipos.E.7 Worm/Win32.Febipos.da Trojan/Win32.Febipos.N1033287704 TrojanDropper:Win32/Febipos.E Win32.Trojan.Falsesign.Pcib Trojan.Chromex!ZGfUkXSe3KA Trojan.Win32.Spy Stolen.D87 Trj/Thymus.J Win32/Trojan.357


This case study contains information from an engagement that the RSA Incident Response IR team worked during the September to October 2013 timeframe.


A backdoor also known as: Packed.Win32.TDSS!O RiskWare.Tool.CK Trojan.Win32.AutoRun.omsr W32.SillyDC TROJ_LOSABEL.SMD Trojan.Killav-157 Worm.Win32.AutoRun.rpm Worm.Win32.Autorun.74752.D[h] PE:Worm.Win32.DownLoad.jy!1075170189 Worm.Win32.AutoRun.~KZI Worm.AutoRun.Win32.89087 TROJ_LOSABEL.SMD BehavesLike.Win32.Downloader.cm Worm/Win32.AutoRun TrojanDownloader:Win32/Losabel.G Worm/Win32.AutoRun Downloader.Rozena


A backdoor also known as: Trojan.MSIL.DNGuard


In the multiple incidents we have been involved in, the group has relied heavily on BeEF and Cobalt Strike.


A backdoor also known as: Trojan.Heur.RP.E74F56 BKDR_INJECT.SMA Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan BKDR_INJECT.SMA Win.Trojan.Downloader-50333 TrojWare.Win32.Downloader.Inject.~E Trojan.DownLoad3.17548 Backdoor.Win32.Nbdd W32/Trojan.LFAS-4542 Trojan[Downloader]/Win32.Small TrojanDropper:Win32/Surin.A


A backdoor also known as: Trojan/W32.Mepaow.21127168 Trojan.Win32.Mepaow!O Trojanpws.Qqpass.16554 Trojan/Mepaow.mwv Win32.Trojan.WisdomEyes.16070401.9500.9707 Win32/Oflwr.A!crypt HV_MEPAOW_CI053B4B.RDXN Win32.Trojan.FlyStudio.F Trojan.Win32.Mepaow.mwv Trojan.Win32.Mepaow.dbtqtp Trojan.Win32.A.Mepaow.647168.A Troj.W32.Mepaow.mwv!c Worm.Win32.Dropper.RA Trojan:W32/DelfInject.R Trojan.MulDrop3.13823 Trojan.Mepaow.Win32.1575 Packed.PePatch.hiy Trojan/Win32.Mepaow Trojan.Buzy.33 Trojan.Win32.Mepaow.mwv Trojan:Win32/Rusparail.A Trojan.Mepaow Trj/CI.A Win32.Trojan.Spy.Pbpm Trojan.Mepaow!GQd1AlSBw3E W32/QQPass.ELG!tr.pws


A backdoor also known as: Win32.TRSpy Trojan.DownLoader4.63572 Trojan/Win32.ADH Trj/CI.A


Many of these domains are compromised legitimate websites, and will automatically expire from this pulse within a month.


add a guard code to monitor its own processes,


A backdoor also known as: Trojan.Onlinegames.P.mue Backdoor.Bot/Variant Trojan/Farfli.aag Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Inject.brokcs TrojWare.Win32.Farfli.S Trojan.DownLoad3.17387 BehavesLike.Win32.Virut.qh Win32.Troj.Injector.GD.kcloud Trojan.Graftor.DEF08 W32.W.Otwycal.kYP3 Trojan.Scar Win32/Farfli.AAG


The early targets: a vast number of US military and government networks, including Wright Patterson and Kelly Air Force Bases, the Army Research Lab, the Naval Sea Systems Command in Indian Head, Maryland, NASA, and the Department of Energy labs.


Poseidon scans the memory for running processes and employs keystroke logging to gather payment card data and credentials.


This week Proofpoint researchers observed several noteworthy changes in the macros used by an actor we refer to as TA530, who we previously examined in relation to large-scale personalized malware campaigns


A backdoor also known as: W32.AutoITFldE1.Worm Trojan.AutoIT.AHP Worm.AUTOIT.Tupym.A W32/Tupym.worm W32.W.AutoRun.llU2 WORM_SOHAND.SM Win32.Trojan.WisdomEyes.16070401.9500.9890 W32/Autorun.SX W32.Svich WORM_SOHAND.SM Win.Worm.Autorun-313 Virus.Win32.Virut.ce Trojan.AutoIT.AHP Trojan.AutoIT.AHP Virus.Win32.Virut.Ce Trojan.AutoIT.AHP Win32.Virut.56 Worm.Autorun.Win32.63723 Worm.Win32.AutoRun W32/Autorun.HBBB-2740 Worm/AutoRun.agto WORM/Autorun.aaer Virus/Win32.Virut.ce Trojan.AutoIT.AHP Virus.Win32.Virut.ce Trojan:Win32/Peaac.A!gfc HEUR/Fakon.mwf Trojan.AutoIT.AHP I-Worm.Autoit.EB Worm.Win32.Autorun.fnc Trojan.Autoit.ZA W32/Autoit.AHP!tr


Rather, it uses a technique recently reported on by SensePost, which allows an attacker to craft a specifically created Microsoft Word document, which uses the Dynamic Data Exchange DDE protocol.


A backdoor also known as: Trojan-Downloader/W32.Greetyah.3584 Trojandownloader.Greetyah Downloader-BW.d Trojan/Downloader.Greetyah.b Win32/Wmpatch.B TROJ_GREETYAH.B Trojan-Downloader.Win32.Greetyah.b Trojan.Win32.Greetyah.hjbl Trojan.Win32.Downloader.3584.DU Troj.Downloader.W32.Greetyah.b!c Trojan-Downloader.Win32.Greetyah.b Trojan.Sysman Downloader.Greetyah.Win32.1 TROJ_GREETYAH.B Downloader-BW.d W32/Risk.VHLX-8577 TrojanDownloader.Greetyah.b W32.Malware.Downloader Trojan[Downloader]/Win32.Greetyah Trojan.Barys.D7C0 Trojan-Downloader.Win32.Greetyah.b TrojanDownloader:Win32/Greetyah.B Trojan/Win32.Downloader.R94251 Win32/TrojanDownloader.Greetyah.B Win32.Trojan-downloader.Greetyah.Llho Trojan.DL.Greetyah!8XCxgqzFn7g Trojan-Downloader.Win32.Tiny W32/Greetyah.B!tr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9917 Trojan.Win32.ExtenBro.dqxgxi TR/Downloader.A.15310 TrojanDownloader:MSIL/Kilim.D Trj/CI.A Win32.Trojan.Downloader.Szvb Trojan.ExtenBro! MSIL/ExtenBro.BS!tr


The exploit takes advantage of a buffer overflow vulnerability in the demo version of a program called Uploader!.


The subject is a series of targeted attacks against private companies around the world.


A backdoor also known as: Win32.Trojan.CoinMiner.q Win32/CoinMiner.TD Trojan.BAT.BitMin.f Trojan.BtcMine.941 BehavesLike.Win32.Dropper.vc Trojan.Win32.CoinMiner TR/CoinMiner.nelvs Trojan.BAT.BitMin.f


A backdoor also known as: HT_FASONG_GA250334.UVPM Win32.Trojan-PSW.OLGames.bm HT_FASONG_GA250334.UVPM Win.Worm.Fasong-5 Win32.HLLW.Fasong.1 Trojan.Scar.Win32.103683 BehavesLike.Win32.BadFile.vh Worm.Win32.Fasong Worm:Win32/Fasong.I Trojan.Zusy.D3494E W32.W.Fasong.lZpB Win32/Fasong.J Trojan.Scar!YU9FfkV5QC0


At the time of this writing the domain is still serving malware.


Send your Bitcoin wallet ID and personal installation key to e-mail wowsmith123456@posteo.net.


In this article, we will describe the details of our investigation.


Knownsec Security Team has followed up this incident ever since its happening.


A backdoor also known as: W32.FamVT.ExpiroPC.PE Virus.Win32.Sality!O TrojanPWS.Vkont Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Win32.Z.Packer.40610 Troj.W32.AntiAV.lApy BehavesLike.Win32.HLLPPhilis.nc Trojan/PSW.VKont.c TR/PSW.VKont.wwdih PWS:Win32/Vkont.A Trj/StartPage.DGO Backdoor.Win32.Hupigon Win32/Trojan.2ff


A backdoor also known as: Heuristic.BehavesLike.Win32.Packed.A TrojanDownloader:Win32/Whinetroe.A


The two reports describe the same cybercriminal gang which stole up to several hundreds of millions of dollars from various financial institutions.


A backdoor also known as: Worm/W32.Wozer.23552.B Worm.Wozer W32/Wozer.h Win32.Trojan.WisdomEyes.16070401.9500.9643 W32/Wozer.F W32.Wozer.Worm Email-Worm.Win32.Wozer.h Trojan.Win32.Wozer.eokb W32.W.Wozer.h!c Win32.Worm-email.Wozer.Wozu Worm.Win32.Wozer.H Win32.HLLW.Wozer.4 Worm.Wozer.Win32.11 BehavesLike.Win32.Backdoor.mc Backdoor.Win32.Optix I-Worm.Wozer.c Worm:Win32/Wozer.G@mm Worm[Email]/Win32.Wozer Worm.Wozer.h.kcloud Email-Worm.Win32.Wozer.h Worm:Win32/Wozer.G@mm Trojan/Win32.Rirc.R100483 Email-Worm.Wozer W32/Wozer.C.worm Win32/Wozer.H Worm.Wozer!/x/Vuw7rp3c W32/Wozer.H@mm Win32/Worm.Email-Worm.795


This post discusses our findings and potential security risks to iOS device users.


A backdoor also known as: Rootkit.27428 Trojan/W32.Rootkit.71040 Rootkit.27428 Backdoor.Rustock Rootkit.D6B24 Win32.Trojan.WisdomEyes.16070401.9500.9984 Hacktool.Rootkit Rootkit.27428 Rootkit.27428 Rootkit.27428 BehavesLike.Win32.Virut.kc Win32.Troj.Undef.kcloud Backdoor.Rustock Trojan.Win32.Rootkit Win32/RootKit.Rootkit.3e8


A backdoor also known as: Worm.Kalockan Trojan.Graftor.D46F63 Win32.Trojan.WisdomEyes.16070401.9500.9926 Trojan.Win32.Z.Graftor.143360.EV BackDoor.Tdss Worm.Win32.Kalockan Worm:Win32/Kalockan.A Trj/CI.A Win32/Trojan.621


A backdoor also known as: Win32.Backdoor.Ciadoor.13.3 W32/VB-Dropper-based.2!Maximus Backdoor.Ciadoor BKDR_CIAD1.TOMA Backdoor.Win32.Ciadoor.cvi Backdoor.Win32.Ciadoor!IK Backdoor.Win32.Ciadoor.G Trojan.DownLoader.62487 BDS/Ciadoor.13.4 BKDR_CIAD1.TOMA Backdoor/Ciadoor.130 TrojanDropper:Win32/Ciadoor.C W32/VB-Dropper-based.2!Maximus Backdoor.Ciadoor.cvi Backdoor.CiaDoor.13 Backdoor.Win32.Ciadoor W32/Ciadoor.V13!tr.bdr


Using privilege escalation


A backdoor also known as: Backdoor.Ursus.A Backdoor/W32.Ursus.3072 BKDR_URSUS.A Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan BKDR_URSUS.A Win.Trojan.Ursus-1 Backdoor.Ursus.A Backdoor.Win32.Ursus Backdoor.Ursus.A Trojan.Win32.Ursus.ehmu Backdoor.Win32.Ursus.3072 Backdoor.W32.Ursus!c Backdoor.Ursus.A Backdoor.Win32.Ursus.A Backdoor.Ursus.A BACKDOOR.Trojan Backdoor.Ursus.Win32.1 W32.Trojan.Trojan-Backdoor-Ursu Trojan[Backdoor]/Win32.Ursus Backdoor.Ursus.A Backdoor.Win32.Ursus Backdoor:Win32/Ursus.A Backdoor.Ursus.A Backdoor.Ursus Bck/Ursus.B Win32/Ursus.A Win32.Backdoor.Ursus.Wvkp Backdoor.Ursus!H8M0lbEN7e8 Trojan.Win32.Ursus W32/Ursus.A!tr.bdr


Downeks uses third party websites to determine the external IP of the victim machine, possibly to determine victim location with GeoIP.


A backdoor also known as: Trojan.Ransom.Paradise W32/Trojan.PLFO-2827 Ransom_Paradiz.R029C0DAC18 MSIL.Trojan-Ransom.Paradise.A Trojan.Win32.Encoder.exgjts Trojan.Encoder.14933 Ransom_Paradiz.R029C0DAC18 TR/FileCoder.gourg Ransom:MSIL/Paradiz.A!bit Ransom.FileCryptor Trj/GdSda.A Trojan.Filecoder!HVBN1jZrlCU MSIL/Paradise.A!tr.ransom


A backdoor also known as: Backdoor.Tapazom Trojan.Heur.E5D2E1 Win32.Trojan.WisdomEyes.16070401.9500.9901 Trojan.Win32.Winlock.crkzwj Win32.Backdoor.Tapazom.Hrfh Trojan.Winlock.7759 Trojan.Delf.Win32.59125 Backdoor.Win32.Tapazom W32/Trojan.HYVM-8493 BDS/Tapazom.A.82 Trojan[Ransom]/Win32.Blocker Backdoor:Win32/Tapazom.A HEUR/Fakon.mwf Trojan.Blocker!KkFY0lqXiEM Win32/Trojan.e5e


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.MSIL.Zapchast.akhiw Trojan/MSIL.Zapchast Trojan.Strictor.D1662C Trojan.MSIL.Zapchast.akhiw W32/Zapchast.AKHIW!tr


A backdoor also known as: Trojan/W32.Flooder.581632 W32/Trojan.GGXC-4249 Hacktool.Flooder TROJ_DRBLAST.A Email-Flooder.Win32.DirectBlaster.651 Trojan.Win32.DirectBlaster.dggz Email-Flooder.W32.DirectBlaster.651!c Trojan.PWS.Hukle.67 TROJ_DRBLAST.A W32/Trojan.AFHI Flooder.DirectBlaster.b TR/Flood.DirectBlaster.651 HackTool[Flooder]/Win32.DirectBlaster Spammer:Win32/DirectBlaster.6_51 Email-Flooder.Win32.DirectBlaster.651 EmailFlooder.DirectBlaster Flooder/DBlaster.B Win32.Trojan.Directblaster.Wrqh Flooder.DirectBlaster!mE1A4daHzRk Malware_fam.gw


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9982 Backdoor.Trojan BehavesLike.Win32.BadFile.ht TrojanDropper:Win32/Fedripto.A Trojan.Buzy.DD86 Win32/Backdoor.e9a


However, Unit 42 has recently discovered the actors have continued to evolve their custom malware arsenal.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9931 W32/Trojan2.HLRY W32.W.Fearso.kYUv Trojan.DownLoader5.44969 BehavesLike.Win32.Rootkit.ph W32/Trojan.LZVM-6897 Trojan:Win32/Lukicsel.A W32/Dx.TOC!tr Win32/Trojan.c9e


Just starting to see the second run of today's Trickbot downloaders coming in.


Sofacy also known as Fancy Bear Sednit STRONTIUM and APT28 is an advanced threat group that has been active since around 2008, targeting mostly military and government entities worldwide, with a focus on NATO countries.


A backdoor also known as: TR/RedCap.dtrps Exploit:Win32/Spectre.A


A backdoor also known as: HW32.Packed.EB9A Trojan/AutoRun.VB.ahf W32/Risk.HKZN-7619 Worm.AutoRun.Win32.41218 W32/MalwareF.MDOM Trojan/Refroso.alid TR/Comitsproc.whlbv Trojan/Win32.Scar.R211104 TScope.Trojan.VB Trj/CI.A Win32.Worm.Autorun.Dyzv Worm.AutoRun!QjN27yFtykA Worm.Win32.AutoRun W32/AutoRun.RPV!worm Win32/Trojan.df1


On 29 March 2017 the German Federal Office for Information Security BSI said in a statement that the website of Israeli newspaper Jerusalem Post was manipulated and linked to a harmful third party.


A backdoor also known as: Virus/W32.Induc Virus.Induc.Win32.1 W32.W.Deecee.lrKT Trojan.Induc.1 Win32.Virus.Induc.a W32/Trojan2.GROR W32.Induc.A Win32/Nedsym.C PE_INDUC.A Win.Virus.Induc-2 Virus.Win32.Induc.b Virus.Win32.Induc.dffkeg Win32.Induc.A Virus.Win32.Induc.A0 Win32.Induc PE_INDUC.A Trojan-Spy.Win32.Banker W32/Trojan.QGYF-1386 Win32/Induc.a W32/Induc.blr Trojan[Spy]/Win32.KeyLogger Win32.Induc.b.820224 Trojan:Win32/Nedsym.F Virus.Win32.Induc.b TrojanSpy.Delf Virus.Win32.Indcu.A.200014 Win32.Induc Virus.Win32.Induc.A


A backdoor also known as: Trojan-Downloader.Win32.Geral!O Trojan.KillAV.Win32.4515 Trojan/KillAV.nka Trojan.Dropper.18 Trojan.KillAV Win32/Tnega.AANE Trojan.Win32.Drop.csaym Trojan.Win32.A.Downloader.44432[UPX] TrojWare.Win32.TrojanDownloader.Geral.djfl Trojan.MulDrop2.15 BehavesLike.Win32.Backdoor.pc Trojan.Win32.Claretore Trojan/Win32.Unknown Trojan:Win32/Bodime.C Win-Trojan/Inject.43892 Trojan.KillAV!AN0QbvE+MIE Win32/Trojan.BO.785


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Trojan.YRTS-5407 Trojan.MSIL.Androm.3 HackTool:MSIL/Boilod.C!bit Trojan/Win32.Boilod.C2311288


The Trojan's technical details and the vectors of its propagation were recently described in the blog by Unit42.


A backdoor also known as: TrojanAPT.LecnaCShip.MUE.Z4 Win32.Trojan.WisdomEyes.16070401.9500.9955 Infostealer.Spasip Trojan.Win32.ShipUp.bbuken Trojan.MulDrop4.6955 Trojan/ShipUp.hh TR/Drop.ShipUp.vauvq Worm:Win32/Shup.A Trojan/Win32.ShipUp.R191080 Trj/CI.A W32/Lecna.C!tr


A backdoor also known as: RiskWare.SecurityXploded W32/Trojan.BXPP-2784 Win32.Riskware.Passdump.A Trojan.Win32.Stealer.dbmdyq Trojan.PWS.Stealer.13033 RiskWare[PSWTool]/Win32.PasswordCracker Unwanted/Win32.HackTool.R117574 not-a-virus:PSWTool.PasswordCracker HackTool.Samples Win32/Virus.PSW.c09


The domain was hosted by an IP address assigned to ito.gov[.]ir - The Iranian Ministry of Communication and Information Technology.


Since at least November 2018, ITG03 actors have stolen money from ATMs in Asia and Africa, according to U.S. Government sources and Symantec.


DDE traditionally allows for the sending of messages between applications that share data, for example from Word to Excel or vice versa.


Over the past few months, we've been following a new type of worm we named PhotoMiner.


Researchers at Lumen Black Lotus Labs have identified a never-before-seen campaign involving compromised routers.


It infects business-grade routers and deploys two malicious binaries, including a Remote Access Trojan RAT called HiatusRAT, and a variant of tcpdump that enables packet capture on the target device.


Once the device is compromised, a process of sophisticated intelligence gathering starts, exploiting the ability to access the phone's video and audio capabilities, SMS functions, and location.


Zscaler's cloud sandboxes recently detected a Remote Access Trojan RAT being delivered by a well-known Chinese cyber espionage group using the Hacking Team's 0-day exploits.


Most of the IP addresses belong to known bulletproof hosting networks that advertise their services on different forums.


A backdoor also known as: Trojan.Startpage.MP3 W32/Trojan2.NCFX Downloader.BBNK Win32/SillyDl.WLY Trojan.Downloader-96481 Trojan.Win32.A.Downloader.274432.H Trojan.DownLoad2.14890 TROJ_DLOAD.SMCV Heuristic.BehavesLike.Win32.AdSpyware.H TrojanDownloader:Win32/Sysfade.B W32/Trojan.QIXU-7273 HeurEngine.MaliciousPacker Win32/StartPage.NVY Trojan.Win32.Fednu.amu Trojan.Win32.StartPage Trj/Downloader.MDW


A backdoor also known as: W32.OnGamesLTSHWDN.Trojan Trojan.Azberg.B Trojan.Skeeyah Dropper.FrauDrop.Win32.3255 Backdoor.W32.Azbreg.miLK TSPY_AZBREG_BL132B01.TOMC Win32.Trojan.WisdomEyes.16070401.9500.9996 Trojan.Dropper TSPY_AZBREG_BL132B01.TOMC Win.Trojan.Azberg-1 Trojan.Azberg.B Trojan-Downloader.Win32.Bandit.ey Trojan.Azberg.B Trojan.Win32.Azbreg.dtleix Trojan.Win32.Z.Azbreg.209435 Trojan.Azberg.B W32/Trojan.QMPY-2353 Win32.Hack.Azbreg.a.kcloud Trojan.Azberg.B Trojan-Downloader.Win32.Bandit.ey Trojan:Win32/HistBoader.A Backdoor/Win32.Azbreg.R29412 Trojan.Azberg.B Trj/CI.A Win32.Trojan-downloader.Bandit.Sxef Backdoor.Azbreg!vdtQoRBMLTw Trojan.Crypt Win32/Trojan.Dropper.e71


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9983 Trojan.Heriplor Trj/CI.A Trojan.Rogue!T/cJXL8TDNE


It has been deployed in attacks against organizations across many industries and is predominantly delivered via phishing emails.


For years now, criminals behind banking Trojans, remote access tools RATs and other types of malware have targeted Microsoft Windows hosts in Brazil through malicious spam malspam.


Palo Alto Networks researchers recently discovered a family of malware, designated ProxyBack, and observed over 20 versions that have been used to infect systems as far back as March 2014.


The malicious ads would automatically no click required redirect users to a casino website used as decoy to silently load malicious iframes from disposable domains which ultimately lead to the Angler exploit kit.


Typically, other exploit kits make an effort to hide their exploits.


A backdoor also known as: Backdoor.Badoor.2.0 Backdoor.Win32.Zemac!O Backdoor.Badoor.2.0 W32/VBTrojan.19G!Maximus BKDR_ZEMAC.B Win.Trojan.Zemac-1 Backdoor.Win32.Zemac.b Backdoor.Badoor.2.0 Trojan.Win32.Zemac.fypm Backdoor.Badoor.2.0 TrojWare.Win32.BackDoor.2_0 Backdoor.Badoor.2.0 BackDoor.Zemac.200 BKDR_ZEMAC.B W32/VBTrojan.19G!Maximus Backdoor/Zemac.b TR/Zemac.B Trojan[Backdoor]/Win32.Zemac Backdoor:Win32/Zemac.B Backdoor.Win32.Zemac.b Backdoor.Badoor.2.0 Backdoor.Badoor.2.0 Backdoor.Zemac Win32/BackDoor.2_0 W32/Bdoor.AR!tr


A backdoor also known as: Trojan.Flooder.Intelirc.1.5 Trojan.Flooder.Intelirc.1.5 Trojan.Flooder.Intelirc.1.5 Trojan.Flooder.Intelirc.1.5 Flooder.Win32.IntelIRC.15 Trojan.Flooder.Intelirc.1.5 Trojan.Win32.IntelIRC.dicf Flooder.W32.IntelIRC.15!c Trojan.Flooder.Intelirc.1.5 TrojWare.Win32.Flooder.IntelIRC.15 Trojan.Flooder.Intelirc.1.5 BackDoor.Spieluhr Tool.IntelIRC.Win32.1 Flooder.IntelIRC.b HackTool[Flooder]/Win32.IntelIRC Flooder.Win32.IntelIRC.15 Flooder.IntelIRC Win32/Flooder.IntelIRC.15 Trojan.Win32.Flooder Malware_fam.gw


Talos continuously monitors malicious emails campaigns.


A backdoor also known as: Backdoor/W32.Slackbot.8329 Backdoor.Win32.Slackbot!O Backdoor/Slackbot.b TROJ_DLDER.A Win32.Trojan.WisdomEyes.16070401.9500.9979 W32/Slackbot.B Backdoor.Slackbot.10 Win32/Slack.10 TROJ_DLDER.A Win.Trojan.Slackbot-1 Backdoor.Win32.Slackbot.b Trojan.Win32.Slackbot.bmpwl Backdoor.Win32.Slackbot.7712 Virus.Malware.Sidldg!c Backdoor.Win32.Slackbot.B BackDoor.IRC.Sdbot.13459 Backdoor.Slackbot.Win32.28 BehavesLike.Win32.Downloader.xh Backdoor.Win32.Slackbot W32/Slackbot.TGFH-5934 Trojan/PSW.Magania.imu BDS/SlackBot.B1 Trojan[Backdoor]/Win32.Slackbot Backdoor:Win32/Slackbot.D Backdoor.Slackbot Backdoor.Win32.Slackbot.b Win-Trojan/Slackbot.8329 Backdoor.Slackbot Bck/Slackbot.Be Win32/Slackbot.B Trojan.Slackbot.B W32/Slackbot.B!tr


A few months ago, we covered the ChessMaster cyberespionage campaign, which leveraged a variety of toolsets and malware such as ChChes and remote access trojans like RedLeaves and PlugX to compromise its targets—primarily organizations in Japan.


Based on the leaked code , the RCSAndroid app can do the following intrusive routines to spy on targets : Capture screenshots using the “ screencap ” command and framebuffer direct reading Monitor clipboard content Collect passwords for Wi-Fi networks and online acco ; .unts , including Skype , Facebook , Twitter , Google , WhatsApp , Mail , and LinkedIn Record using the microphone Collect SMS , MMS , and Gmail messages Record location Gather device information Capture photos using the front and back cameras Collect contacts and decode messages from IM accounts , including Facebook Messenger , WhatsApp , Skype , Viber , Line , WeChat , Hangouts , Telegram , and BlackBerry Messenger .


As part of this breach, the media organization's website was being leveraged as a component of a malware campaign targeting select visitors.


The buyer can then choose to host/spread/distribute it in whatever way they see fit - as opposed to some of the more recent turn-key offerings like Ransom32, ORX-Locker, or Encryptor RAAS, which lack a full administrative panel and other customization features present in a fully packaged malware kit'.


A backdoor also known as: Win32.HLLP.Delf.B Worm.Niklas RiskWare.Tool.CK Win32.HLLP.Delf.B Win32.Trojan.WisdomEyes.16070401.9500.9630 W32.HLLW.Niklas Win32.HLLP.Delf.B Virus.Win32.HLLP.Delf.b Win32.HLLP.Delf.B Trojan.Win32.Niklas.hekr Trojan.Dropper/Packed Win32.HLLP.Delf.B TrojWare.Win32.Patched.KSU Win32.HLLP.Delf.B Win32.HLLW.Atmetka Virus.Delf.Win32.30 BehavesLike.Win32.Downloader.lc Worm:Win32/Niklas.C W32/Hllp.Delf.E Worm:Win32/Niklas.C W32.HLLP.Delf.b!c Virus.Win32.HLLP.Delf.b Trojan/Win32.Xema.C36267 Win32.HLLP.Delf.B Win32.Virus.Hllp.Dztg HLLP.Delf.SV1 Trojan-PWS.Win32.Lmir.awg W32/HLLP.DELF.B


Websense Security Labs researchers have been monitoring a mass scale malvertising campaign that leads to Angler Exploit Kit.


A backdoor also known as: W32.Vetor.PE Win32.Worm.Autorun.VN Virus.Win32.Virut.1!O W32.Virut.G Win32.Worm.Autorun.VN W32.W.Bnf.tnnw Win32.Worm.Autorun.VN W32.SillyFDC Win32/Virut.17408 WORM_OTORUN.SMXY Win.Trojan.VB-73727 Worm.Win32.AutoRun.hfp Win32.Worm.Autorun.VN Trojan.Win32.Autoruner1.csgwlt Worm.Win32.Autorun.afe Win32.Worm.Autorun.VN Virus.Win32.Virut.CE Win32.Worm.Autorun.VN Win32.Virut.56 WORM_OTORUN.SMXY BehavesLike.Win32.Gupboot.ht Worm.Win32.AutoRun Win32/Virut.bv WORM/Autorun.hfp Trojan/Win32.Unknown Worm:Win32/Wecykler.A Worm.Win32.AutoRun.364544.A Worm.Win32.AutoRun.hfp HEUR/Fakon.mwf W32/Autorun.worm.aaav Worm.AutoRun.Silly Backdoor.Bot Worm.AutoRun!iW63fF1TdWk W32/AutoRun.GP!worm W32/Sality.AO Worm.Win32.FakeFolder.BY


A backdoor also known as: W32.OnGameXLIIUAAR.Trojan Backdoor.Win32.Xtobox!O Backdoor/Xtob.m Win32.Trojan.WisdomEyes.16070401.9500.9787 W32/Risk.CVOB-2286 Win32/Tnega.AKCE Win.Trojan.Xtob-2 Backdoor.Win32.Xtob.m Trojan.Win32.Scar.bqzdl Backdoor.Win32.A.Xtob.118784[UPX] Backdoor.W32.Xtob!c BackDoor.Piroxcc TSPY_YAHOS_CD1000EC.RDXN BehavesLike.Win32.Dropper.dz Trojan.Win32.Scar W32/MalwareS.BFOO Trojan/Cosmu.drs Trojan[Backdoor]/Win32.Xtob Backdoor.Win32.Xtob.m Trojan:Win32/Scar.V Trojan/Win32.Scar.C104448 Backdoor.Xtob Win32.Backdoor.Xtob.Dyzl Trojan.Scar!bp+jOb+ovfY Win32/Backdoor.f23


A backdoor also known as: Trojan-Ransom.Win32.VB!O Trojan.VB Trojan.Infidesgate Win32/Adslock.A Trojan-Ransom.Win32.VB.du Troj.Ransom.W32!c Trojan.DownLoader4.48837 BehavesLike.Win32.Trojan.nz Trojan-Ransom.Win32.VB Trojan[Ransom]/Win32.VB Ransom:Win32/Adslock.A Trojan-Ransom.Win32.VB.du Trojan/Win32.HDC.C94839 Win32.Trojan.Vb.Piah Trojan.ATRAPS!J/1Dm4j1sNA


A backdoor also known as: Dropper.Sysn.Win32.882 Trojan.Win32.Spammer.dchmhr Trojan-Dropper.Win32.Sysn.ailj Trojan.DR.Sysn! Trojan.Spambot.12672 TR/Dynamer.ac.1747 Trojan[Dropper]/Win32.Sysn Win32.Troj.Sysn.ai.kcloud W32/Sysn.AILJ!tr


A backdoor also known as: Trojan/W32.Small.36864.BLO Win32.Trojan.WisdomEyes.16070401.9500.9887 Trojan.Win32.Small.vptjr Backdoor.Win32.Huigezi.oba BackDoor.IRC.NgrBot.189 Trojan.Zusy.D3B9D Trojan:Win32/Gutosver.A Trojan/Win32.Scar.R90823 TScope.Malware-Cryptor.SB W32/Small.NHC!tr


In this post we describe the technical details about a newly observed campaign of the notorious Crypt0l0cker aka TorrentLocker or Teerac ransomware.


Most online ads are displayed as a result of a chain of trust, from the publishers to the malicious advertiser via ad agencies and/or ad networks.


The Android version was a hit from the get-go, and it was one of 2014 s most active Android threats, being detected in multiple campaigns during that year [1, 2, 3], including one that leveraged an SMS worm to automate and boost its infection process.


A backdoor also known as: Troj.Spy.W32.Zbot.touj Trojan.Razy.D164A7 Win32.Trojan.WisdomEyes.16070401.9500.9649 Trojan.Win32.Zbot.eljrsb Trojan.Win32.Zbot.44544.AI Trojan.DownLoader22.26316 TrojanSpy.Zbot.fgio Trojan[Spy]/Win32.Zbot TrojanDownloader:Win32/Smordess.A


A backdoor also known as: W32.Clodceb.Trojan.2ec7 Trojan.Downloader.Delf.ER Trojan.Downloader.Delf.ER Downloader.Delf.Win32.5663 Trojan/Downloader.Delf.er Trojan.DL.Delf!VxwiJYoF8rw W32/Downloader.VRCK-6872 Trojan-Downloader.Win32.Delf.er Trojan.Downloader.Delf.ER Trojan.Win32.Delf.gudt Trojan.Win32.Downloader.17920.FB Trojan.Downloader.Delf.ER Trojan.Downloader.Delf.ER BehavesLike.Win32.PWSOnlineGames.lh W32/Downldr2.CMGJ TrojanDownloader.Dfg.a Trojan/Win32.Oirec Win32.Troj.Delf.er.kcloud PWS:Win32/Hacksoft.E Trojan.Downloader.Delf.ER Win-Trojan/Xema.variant TrojanDownloader.Delf Win32/TrojanDownloader.Delf.ER Win32.Trojan-downloader.Delf.Akoy Trojan-PWS.Win32.QQPass W32/DelpDldr.F!tr Downloader.Delf.4.BS Trojan.Win32.Delf.AVva


A backdoor also known as: W32/Gedza.c Trojan.Symmi.D54D9 Win32.Trojan.WisdomEyes.16070401.9500.9785 W32/P2P_Worm.TWVI-7072 W32.SillyP2P Win.Trojan.Aitselom-1 P2P-Worm.Win32.Gedza.c Trojan.Win32.Gedza.empl W32.W.Gedza.c!c Worm.Win32.Gedza.C Win32.HLLW.Aitselom Worm.Gedza.Win32.3 Worm.Win32.Gedza W32/P2PWorm.GQ Worm/Gedza.c Worm:Win32/Gedza.C WORM/Gedza.C.1 Worm[P2P]/Win32.Gedza Worm.Gedza.c.kcloud Worm:Win32/Gedza.C P2P-Worm.Win32.Gedza.c TScope.Trojan.Delf W32/Gedza.F.worm Win32/Gedza.C Worm.P2P.Gedza!r6gvDWKTb4U W32/Delf.NHN!tr Win32/Worm.a05


A backdoor also known as: Ransom.Kangaroo Win32.Trojan.WisdomEyes.16070401.9500.9872 Trojan.Randsom.A Ransom_Apocalypse.R039C0DAT18 Win32.Trojan-Ransom.Apocalypse.D Trojan-Ransom.Win32.Kangar.a Trojan.Win32.Filecoder.epdfna Trojan.Encoder.5883 Ransom_Apocalypse.R039C0DAT18 BehavesLike.Win32.Worm.lt W32/Trojan.ATNA-2545 Ransom:Win32/Apocalypse.A!bit Trojan-Ransom.Win32.Kangar.a Trojan/Win32.Kangaroo.R194907 Trj/GdSda.A Trojan.Mikey.D127AA Win32/Filecoder.NIC


A backdoor also known as: Trojan.AceDeciever.15 Trojan:Win32/AceDeceiver.A Trojan.Win32.Acedeceiver


The last time I saw proshuto8.exe it was Trickbot, but these malware gangs do mix match and reuse file names and delivery methods to deliver multiple different malwares.


A backdoor also known as: PE:Malware.XPACK/RDM!5.1


A backdoor also known as: W32/Dropper.ALXP Trojan.Dropper Trojan.Dropper-23429 Trojan-Dropper.Win32.Injector.hrpm Exploit.Servu!8cjzV0go40I Trojan.MulDrop.30820 Muster.c W32/Risk.XPXS-2512 TR/Expl.Servu.AK Trojan/Win32.Sasfis TrojanDropper:Win32/Apptom.B Virus.Win32.Part.a BScope.Trojan.Win32.Inject.2 Exploit.Win32.Servu


The overwriting of the data files will make it extremley difficult and costly, if not impossible, to recover the data using standard forensic methods.


Android.Bankosy is a Trojan horse for Android devices that steals information from the compromised device.


Series of attacks mostly against Israel-based organisations.


A backdoor also known as: W32.OnlineGameGLISC.Trojan W32/Mydoom.cf.dll WORM_MYDOOM.EA W32/Downloader.EZUZ-6892 Trojan.Dozer Win32/Mydoom.BS WORM_MYDOOM.EA Win.Downloader.73527-1 DDoS.Config.6 W32/Mydoom.cf.dll Trojan.Win32.Lyzapo W32/Downldr2.FZUB W32.Trojan.Worm-myDoom Trojan:Win32/Lyzapo.A Trojan/Win32.DDoS.R528 W32/MyDoom.HN.worm Win32/Lyzapo.A


A backdoor also known as: TrojanDownloader.Win32.Theefdl Trojan-Downloader.Win32!O Trojandownloader.Theefdl Downloader.Theefdl.Win32.5 TrojanDownloader.Win32.Theefdl W32/Theef.G@bd Downloader.Trojan Win32/TrojanDownloader.Theefdl TROJ_THEEFDL.A TrojanDownloader.Win32.Theefdl Trojan-Downloader.Win32.Theefdl TrojanDownloader.Win32.Theefdl Trojan.Win32.Theefdl.fydt Trojan.Win32.A.Downloader.81920.VZ TrojanDownloader.Win32.Theefdl TrojWare.Win32.TrojanDownloader.Theefdl Trojan.Thedl BehavesLike.Win32.Backdoor.mh Trojan-Downloader.Win32.Theefdl W32/Theef.TVQD-5666 TrojanDownloader.Theefdl Trojan[Downloader]/Win32.Theefdl TrojanDownloader:Win32/Theefdl.1_0 Trojan/Win32.Downloader.R94200 Trojan-Downloader.Win32.Theefdl TrojanDownloader.Win32.Theefdl TrojanDownloader.Theefdl Trojan.DL.Theefdl!lWNJHAF8U1M W32/Theefdl.G!tr


A backdoor also known as: Trojan.NSAnti.1 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32.Riskware.NoobyProtect.B Trojan.Win32.NobodyProtect.eviakq TrojWare.Win32.Amtar.KNB Trojan.DownLoader4.12788 BehavesLike.Win32.Pate.tc Trojan:Win32/Gee.B Dropper/Win32.PcClient.R6061 Trojan.Cryptic


At the same time, in previous update activities, due to the setting of a specific named planned task, the researchers named it Blue Tea Action based on the name and Operation Black Ball 。


A backdoor also known as: W32.SunimodG.Trojan Worm.Win32.Juched!O WORM_GANELP.SMIA W32.Griptolo WORM_GANELP.SMIA Win.Worm.Autorun-9195 Worm.Win32.Juched.209429 Worm.Win32.Jushed.KA Trojan.Proxy.20270 Trojan.Win32.Webprefix W32.Worm.Ganelp Worm/Win32.Juched Worm.Juched.d.kcloud Worm:Win32/Ganelp.E Trojan/Win32.Npkon.R18258 Worm.Juched Trojan.FakeJava Trojan.Win32.FakeFolder.bba


A backdoor also known as: W32.WpechkLTD.Trojan Trojan-Spy/W32.Vskim.160256 Trojan.Mauvaise.SL1 Dropper.Dapato.Win32.16801 Trojan/Spy.POSCardStealer.k Win32.Trojan.WisdomEyes.16070401.9500.9904 Backdoor.Trojan BKDR_HESETOX.SMJ Trojan.Win32.Vskim.cqipth Backdoor.Win32.Hesetox.160260 Trojan.DownLoader8.15980 BKDR_HESETOX.SMJ BehavesLike.Win32.Dropper.ch Trojan[Dropper]/Win32.Dapato Backdoor:Win32/Hesetox.A Win-Trojan/Hesetox.160256 TrojanSpy.Vskim Backdoor.Bot.X Backdoor.Win32.Hesetox Win32/Trojan.IM.73c


A backdoor also known as: HW32.Packed.4904 Trojan.Clicker.Delf.CN Trojan.Clicker.Delf.CN Trojan/Clicker.Delf.cn Trojan.Win32.Delf.ifph Trojan.Adclicker TROJ_ADCLICKE.AS Trojan-Clicker.Win32.Delf.cn Trojan.CL.Delf!GHMyZMRoBZw Trojan.Win32.Clicker.197194[h] Troj.Clicker.W32.Delf.cn!c Virus.Win32.Heur.e Trojan.Clicker.Delf.CN Backdoor.Win32.Popwin.~IQ Trojan.Clicker.Delf.CN Trojan.Dasist Trojan.Delf.Win32.8103 TROJ_ADCLICKE.AS BehavesLike.Win32.PWSZbot.cc Trojan/Delf.ab TR/Click.Delf.CN.5 Trojan[Clicker]/Win32.Delf Trojan.Clicker.Delf.CN Win-Trojan/Xema.variant Trojan:Win32/Adcliker.K TrojanClicker.Delf Win32.Trojan.Delf.Lhxa Trojan.Clicker.Delf.CN Clicker.CSA


A backdoor also known as: Backdoor.Win32.Noobot!O Backdoor.Poftsyun Backdoor.W32.Noobot.h!c Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Ecltys Backdoor.Win32.Noobot.h Trojan.Win32.Noobot.ylgzy Backdoor.Win32.A.Noobot.158756 Backdoor.Noobot.Win32.6 BehavesLike.Win32.Downloader.ch Backdoor.Win32.Ecltys W32/Trojan.SKHW-8707 Backdoor/Noobot.d BDS/Noobot.A.14 Backdoor:Win32/Poftsyun.A Backdoor.Win32.Noobot.h Trojan/Win32.Noobot.R214072 Backdoor.Noobot Trojan.Zusy.D49A6 Win32.Backdoor.Noobot.Pfts Backdoor.Noobot!KDSSDgztHWQ W32/Noobot.H!tr.bdr Win32/Trojan.231


A backdoor also known as: Trojan-Downloader.Win32.ChePro.aaa WIN.MACRO.SCRIPT.IRC.WORM.Virus Trojan-Downloader.Win32.ChePro.aaa PUP/Win32.Avdownloader.C2126268


Threat actors keep taking advantage of the tax season in the US, using tax-related phishing scams to US-based victims to infect systems with stealthy malware.


In early May, the phishing lures leveraged RTF attachments that exploited the Microsoft Windows vulnerability described in CVE 2017-0199.


These threats are usually exacerbated by the further abuse of legitimate tools such as PowerShell, or script automation utility AutoIt. It's thus not surprising that we discovered an information stealer employing LNK files, which our sensors detected in Israeli hospitals.


INDEX MNEMONIC DESCRIPTION 0x0 JMP Special obfuscated conditional Jump ( always taken or always ignored ) 0x1 JMP Jump to a function ( same as opcode 0x10 ) 0x2 CALL Call to the function pointed by the internal VM value 0x3 CALL Optimized CALL function ( like the 0x1E opcode of the 32-bit VM ) 0x4 EXEC Execute code and move to the next packet 0x5 JMP Jump to an internal function 0x6 NOP No operation , move to the next packet 0x7 CALL Call an imported API ( whose address is stored in the internal VM value ) 0x8 LOAD Load a value into the VM descriptor structure * 0x9 STORE Store the internal VM value inside a register 0xA WRITE Resolve a pointer and store the value of a register in its content 0xB READ Move the value pointed by the VM internal value into a register 0xC LOAD Load a value into the VM descriptor structure ( not optimized ) 0xD CMP Compare the value pointed by the internal VM descriptor with a register 0xE CMP Compare the value pointed by the internal VM descriptor with an immediate value 0xF XCHG Exchange the value pointed by the internal VM descriptor with a register 0x10 SHL Jump to a function ( same as opcode 0x1 ) This additional virtual machine performs the same duties as the one already described but in a 64-bit environment .


The campaign was found to have delivered several types of malware including Redline Stealer, AgentTesla, Eternity, Blackmoon and Philadelphia Ransomware.


A backdoor also known as: W32.Otwyacal.C Win32.Trojan.WisdomEyes.16070401.9500.9748 W32.Wapomi.C!inf Win.Trojan.Vjadtre-6170948-0 Win32.HLLP.Protil.1 BehavesLike.Win32.Virut.ch W32/Jadtre.C Trojan.Symmi.D4E83 Trj/CI.A Win32/Wapomi.Z Virus.Win32.Wapomi.a Exploit.Win32.ShellCode


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Msil Trojan.Kazy.D4D672 TrojanDownloader:MSIL/Winpud.A Trojan/Win32.Inject.C149530 Win32/Trojan.a9f


However, the attacks against targets in the Middle East except Israel were renewed in less than 20 days.


rename .APK Android application package files used to install the malicious apps,


Malicious code was appended to the compromised script file, which redirected a visitor.


The backdoor provided an alternative foothold in several observed instances for the group and employed a few tricks like using the Intel SSE extended instruction set to avoid emulation and obscure analysis.


The malware uses the Tor anonymity network for command and control C2 and does not require network connectivity to encrypt files, which complicates detection, prevention, and remediation.


The list of vulnerable devices, as well as the logins and passwords that go with them, are stored on the server belonging to the cybercriminals.


NexusLogger is a cloud-based keylogger that uses the Microsoft .NET Framework and has a low level of sophistication.


A backdoor also known as: Trojan.Crypt.CC Packed.Win32.CPEX-based!O Backdoor.PePatch.Win32.2676 Trojan.Crypt.CC W32/Trojan.GQIB-3577 TrojanSpy.KeyLogger Trojan.Win32.Llac.laav Trojan.Win32.CPEXbased.oyaq Trojan.Win32.Buzus.589824[UPX] Packer.W32.CPEX-based.kZ3Y Trojan.Crypt.CC Trojan.PWS.Lineage.4319 BehavesLike.Win32.PUPXAO.dh W32/Trojan2.ANIR Trojan/Buzus.afzu TR/Dldr.Buzus.dhk Trojan[Packed]/Win32.CPEX-based TrojanDropper:Win32/Sharke.C Trojan.Crypt.CC Trojan.Win32.Llac.laav Trojan.Crypt.CC Trojan/Win32.Buzus.C22005 Trojan.Crypt.CC Trojan.Crypt.CC HackTool.Win32.Crypt


The URLs for Sundown requests for Flash files end in .swf, while Silverlight requests end in .xap.


A backdoor also known as: Backdoor.Trojan Trojan.Win32.Mlw.euwoug Backdoor:Win32/DarkEnergy.A!bit Backdoor.Bot Trj/GdSda.A


After laying low for a few years, it had a sudden resurgence last May.


A backdoor also known as: W32.Surabaya.Worm Worm.Win32.AutoRun!O Worm.SillyShare.EE2 W32/Pitin.worm Worm.AutoRun W32.W.AutoRun.luA8 WORM_VB.DTH Win32.Trojan.VB.iy W32/Worm.BGBK W32.SillyFDC Win32/Dodaykil.B WORM_VB.DTH Win.Worm.VB-632 Worm.Win32.AutoRun.bant Trojan.Win32.AutoRun.cnwrek Trojan.Win32.Autorun.40960.R Worm.Win32.VB.~E Win32.HLLW.Autoruner.874 Virus.VB.Win32.86 BehavesLike.Win32.Dropper.ch Worm.Win32.AutoRun W32/Worm.DPLM-0673 Worm/AutoRun.tyn TR/VB.aei Worm/Win32.AutoRun Trojan.Heur.E9EB80 Worm.Win32.AutoRun.bant Worm:Win32/SillyShareCopy.E HEUR/Fakon.mwf SScope.Trojan.VBO.0348 Trj/Yabarasu.A Worm.Pitin Win32/VB.DG Trojan.Win32.Autorun.bep Worm.SillyShareCopy!GFdqFqCX45w


A backdoor also known as: W97M.Dropper.MM W97M/Dropper.x W97M/Mdropper.G W2KM_FAREIT.IAV Trojan.Script.Drop.dyxcgh Trojan-Dropper:W97M/MaliciousDoc.A Trojan.PWS.Stealer.4118 W2KM_FAREIT.IAV W97M/Mdropper.G TR/Crypt.Xpack.310779 Trojan[PSW]/Win32.Fareit TrojanPSW.Fareit possible-Threat.Embedded.ExeInOffice virus.office.qexvmc.1100


Operation Groundbait Russian: Прикормка, Prikormka is an ongoing cyber-surveillance


A backdoor also known as: VB:Trojan.Valyria.849 W97M.Downloader.BLR Troj.Downloader.Msoffice!c W97M.Downloader W2KM_HANCITOR.YYSYN VB:Trojan.Valyria.849 VB:Trojan.Valyria.849 Trojan.Script.Downloader.espmja VB:Trojan.Valyria.849 VB:Trojan.Valyria.849 W2KM_HANCITOR.YYSYN TrojanDownloader:O97M/Damatak.A VB:Trojan.Valyria.849 virus.office.qexvmc.1080


Volexity has tied this attack campaign to an advanced persistent threat APT group first identified as OceanLotus by SkyEye Labs in 2015.


Probably, attackers used web site vulnerabilities for placing malicious files.


Since our previous publication, we have found another, similar but different payload used to target a second organization in Saudi Arabia that was configured to wipe systems twelve days later on November 29, 2016.


A backdoor also known as: Trojan/Losya.gg Trojan-Ransom.Win32.Losya.gg Trojan-Ransom.Win32.Losya!IK Trojan.Winlock.2932 Trojan/Losya.cs Trojan:Win32/LockScreen.BA Hoax.Losya.bd Trojan-Ransom.Win32.Losya W32/Krap.A!tr


Servers of The Left in German Bundestag have been infected with malware, apparently by a state-sponsored group of Russian origin.


Sakula also leverages single-byte XOR encoding to obfuscate various strings and files embedded in the resource section, which are subsequently used for User Account Control UAC bypass on both 32 and 64-bit systems.


A backdoor also known as: Trojan/W32.ICQNuker.19456 Trojan.ICQNuker!jj+ciDVRnhs Hacktool.Nuker Smalltroj.EAH TROJ_ICQNUKER.A Trojan.ICQNuker Trojan.Win32.ICQNuker Trojan.Win32.ICQNuker Trojan.Win32.ICQNuker.dhzl TrojWare.Win32.ICQNuker Trojan.Win32.ICQNuker Trojan.ICQNuker TROJ_ICQNUKER.A Trojan/Win32.ICQNuker Trojan.Win32.ICQNuker.19456 Trojan.Win32.ICQNuker Win32.Trojan.ICQNuker Hacktool.Nuker


Linux malware is slowly becoming more popular.


This porn clicker Trojan, which we detect as Android/Clicker, has once more become available for download from Play Store.


A backdoor also known as: Trojan.Downloader.LoadAdv.ABV Trojan.Piptea Downloader.Small.Win32.11983 Trojan.Downloader.LoadAdv.ABV Multi.Threats.InArchive W32/Downldr2.FZLV Trojan.Dropper Win.Downloader.65024-1 Trojan-Downloader.Win32.Small.agns Trojan.Downloader.LoadAdv.ABV Trojan.Win32.Small.bcwtvk Trojan.Win32.Downloader.246584 Trojan.Downloader.LoadAdv.ABV W32/Downloader.UPFZ-7129 Trojan[Downloader]/Win32.Small Trojan:Win32/Piptea.E Trojan-Downloader.Win32.Small.agns Trojan.DL.Small!mUFJjjvpkTw Email-Worm.Win32.Joleee Win32/Trojan.8ed


A backdoor also known as: Win32/Adclicker.DH Trojan-Clicker.Win32.Small!O Trojan/Clicker.Small.tc Trojan.Zusy.D730F Win32.Trojan.WisdomEyes.16070401.9500.9905 W32/Trojan.HWTO-6812 Trojan.KillAV Win32/TrojanClicker.Small.QZ TROJ_CLICKER.UU Win.Trojan.Clicker-1328 Trojan.Win32.Small.pbsu Trojan.Win32.Clicker.20480.C TrojWare.Win32.TrojanClicker.Small.QZ Trojan.PWS.Gamania.16782 Trojan.Small.Win32.16009 W32/Trojan2.AUEO TrojanClicker.Small.aps W32.Email.Worm.Silly TR/Click.Mon.1 Trojan[Clicker]/Win32.Small Dropper/Win32.Small.R41509 TrojanClicker.Small Trj/CI.A Trojan-Downloader.Win32.Small W32/CLICKER.UU!tr Win32/Trojan.d06


SpyNote RAT is capable of performing a variety of alarming functions that includes : Activating the device ’ s microphone and listening to live conversations Executing commands on the device Copying files from the device to a Command & Control ( C & C ) center Recording screen captures Viewing contacts Reading SMS messages The screenshot below shows part of the sandbox ’ s report on the SpyNote RAT ’ s signature and detected functions : The fake Netflix app we are analyzing in this blog appears to be built using an updated version of SpyNote RAT builder , which was leaked last year .


The details we are releasing are to provide insight into attack methodologies being employed by sophisticated groups such as FIN7 who are consistently changing techniques between attacks to avoid detection.


The Dyre group, a major malware spam producer, has changed their initial malware dropper to utilize Microsoft Word document macros instead of the usual executable types, such as .exe files contained in a .zip.


A backdoor also known as: Ransom_Shieldcrypt.R00WC0DEQ17 Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Ransom.WTYO-5087 Ransom.Troldesh Ransom_Shieldcrypt.R00WC0DEQ17 Win32.Trojan-Ransom.Filecoder.BO Trojan.Win32.Encoder.ephyjr Trojan.Encoder.11787 Ransom:Win32/Shieldcrypt.A Trj/GdSda.A Win32.Trojan.Raas.Auto Trojan-Ransom.Shieldcrypt


A backdoor also known as: W32/Backdoor2.DBLT WS.Reputation.1 Win32.TRVirtl HackTool.Patcher!7MmWKbVM2EE Tool.DVTPatch TR/Virtl.7341 Trojan/Virtl.b Win32.HACKTOOL.pocomail.cx.kcloud W32/Backdoor2.DBLT Trojan.Virtl.7341


IOC s for the Wildifre ransomware


A backdoor also known as: Trojan/PinkBlocker.arw Trojan.Heloag BKDR_HELOAG.SM PUA.Packed.ASPack BDS/Heloag.A.30 BKDR_HELOAG.SM Backdoor.Win32.Heloag!IK Backdoor:Win32/Heloag.A Trojan.Heloag Backdoor.Win32.Heloag Trj/CI.A


Symantec discovered the Greenbug cyberespionage group during its investigation into previous attacks involving W32.Disttrack.B aka Shamoon.


A backdoor also known as: Backdoor.Win32.Rbot!O Backdoor.Rbot.20414 Win32.Trojan.WisdomEyes.16070401.9500.9964 Win.Trojan.Mybot-4324 Trojan.Win32.Rbot.cuqnmc Win32.HLLW.MyBot.based Backdoor.RBot.Win32.38765 BehavesLike.Win32.Msposer.jz Backdoor.Win32.SdBot EXP/DameWare.ggg Trojan[Backdoor]/Win32.Rbot Win32.Hack.RBotT.a.83968 Backdoor.Win32.Sdbot.yx W32/SdBot.IT!tr.bdr


Cylance SPEAR has uncovered a long-standing persistent threat targeting numerous major industries spread across Japan, South Korea, the United States, Europe, and several other Southeast Asian countries.


A backdoor also known as: Trojandownloader.Script Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Drop.etdypm Trojan.MulDrop7.42636 BehavesLike.Win32.Dropper.fh W32/Trojan.EURA-7093 Trojan:VBS/Sminager.D Exploit.UACSkip Trj/CI.A Exploit.UACSkip! Win32/Trojan.Downloader.251


A backdoor also known as: W32.HfsAutoB.424D Virus.Hupigon.Win32.5 Trojan/PSW.QQShou.is TSPY_QQSHOU.GY Win32.Trojan.WisdomEyes.16070401.9500.9956 W32/Trojan.KBAU-5151 Trojan.PWS.QQPass TSPY_QQSHOU.GY Backdoor.Win32.Hupigon.vpk Trojan.Win32.QQShou.lofh Backdoor.W32.Rbot.lgxa Backdoor.Win32.Popwin.~IQ Trojan.PWS.Gamania.5830 W32/Trojan.LGV Trojan/PSW.QQShou.eu Trojan[Backdoor]/Win32.Hupigon.vpk PWS:Win32/Whoran.A Backdoor.Win32.Hupigon.vpk Trojan.PWS.QQShou!NqwrJPeZllY W32/Hupigon.VPK!tr.pws


A backdoor also known as: Trojan.Rotbrow.KK6 PUP.Optional.BProtector Trojan.Bromngr.Win32.445 Win32.Adware.Bprotector.a Adware.GoonSquad Win.Adware.BProtector-1 Win32.Application.BHO.A Trojan.Win32.BGuard.cunxgw Application.Win32.bProtector.KA Adware.BGuard.47 Trojan-Dropper.Win32.Rotbrow Trojan.Bromngr.ed W32.Adware.Installbrain Trojan.Adware.BHO.Bprotector.1 TrojanDropper:Win32/Rotbrow.A W32/Bprotect.B!tr Trj/CI.A Win32/Trojan.10d


A backdoor also known as: Trojan.Kryptik.ASES Trojan.MulDrop1.32726 Win32/Tnega.CZG


A backdoor also known as: Trojan.Crypt.Delf.AL Worm/W32.G_Spot.200704 Backdoor.G_Spot.r8 W32/Grandspot.worm!p2p Trojan.Crypt.Delf.AL W32/G_Spot.c Trojan.Win32.GSpot.dzdidh W32.HLLW.Sambut Win32/GrandSpot.C BKDR_GSPOT.15 P2P-Worm.Win32.G_Spot.c Worm.P2P.G_Spot!iWsciEZCFG4 W32.W.G_Spot.c!c Trojan-Downloader.win32.Delf.xoq Trojan.Crypt.Delf.AL Worm.Win32.GrandSpot.C Trojan.Crypt.Delf.AL WIN.WORM.Virus Worm.GSpot.Win32.1 BKDR_GSPOT.15 BehavesLike.Win32.Eggnog.ch Worm/Sramota.qs BDS/GSpot.15.Srv W32/G_Spot.C Trojan[Backdoor]/Win32.G_Spot Trojan.Crypt.Delf.AL Win32/KorGameHack.worm.200704 Worm:Win32/Gespo.C Win32/Spotbot.15 Worm.G_Spot Trojan-PWS.Win32.Lmir.mw Trojan.Crypt.Delf.AL Worm/Gspot.C


A backdoor also known as: Trojan-Dropper.Win32.Exetemp!O W32/Backdoor.GJUL-4537 TROJ_DROPER.SMJN Trojan-Dropper.Win32.Exetemp.a Troj.Dropper.W32.Exetemp.tnGD Trojan.MulDrop.30795 TROJ_DROPER.SMJN W32/Backdoor2.FAQY Backdoor/Huigezi.2009.api W32.Trojan.Exetemp Trojan[Dropper]/Win32.Exetemp TrojanDropper:Win32/Exetemp.A!bit Trojan.Graftor.D45DD Trojan-Dropper.Win32.Exetemp.a TrojanDropper.Exetemp Trojan.DL.Win32.Small.grn W32/Exetemp.A!tr


Hydrochasma, the threat actor behind this campaign, has not been linked to any previously identified group, but appears to have a possible interest in industries that may be involved in COVID-19-related treatments or vaccines.


The malware is usually packaged with apps that users may download from third-party app stores.


Analysis from cyintanalysis.com describing infrastructure of an actor using PoisonIvy and PlugX implants.


Once infected, Mansoor's phone would have become a digital spy in his pocket, capable of employing his iPhone's camera and microphone to snoop on activity in the vicinity of the device, recording his WhatsApp and Viber calls, logging messages sent in mobile chat apps, and tracking his movements.


Once installed, it hides itself and then tricks the user into typing his or her credentials into fake bank web pages that have been injected onto the device's screen.


It requires root privileges to be installed, and relies on: A userland binary, providing an encrypted backdoor with remote code execution and proxy functionalities A lightweight Linux Loadable Kernel Module, providing an additional port-knocking service for the userland backdoor


Recently, FortiGuard Labs found a phishing campaign targeting French Nationals.


Palo Alto Networks has discovered a previously unknown remote access Trojan RAT that has been active for over two years.


A backdoor also known as: Trojan.Mauvaise.SL1 TROJ_ETERNALROM.A TROJ_ETERNALROM.A Win32.Exploit.EqEternalRomance.A Exploit.Win32.ShadowBrokers.aj Exploit.Win32.ShadowBrokers.epajub Exploit.Win32.ShadowBrokers.~ Trojan.Equation.37 Exploit.ShadowBrokers.Win32.13 Trojan.Exploit.Equation Exploit.ShadowBrokers.v W32.Hacktool.Equation TR/Eqtonex.HG Trojan[Exploit]/Win32.ShadowBrokers Uds.Dangerousobject.Multi!c Exploit.Win32.ShadowBrokers.aj Exploit:Win32/Eqtonex.A Trojan/Win32.ShadowBrokers.C1919146 Exploit.ShadowBrokers Trj/CI.A Win32/Exploit.Equation.EternalRomance.A HackTool.Win32.ShadowB.a Exploit.ShadowBrokers! Win32/Trojan.Multi.daf


The Corebot malware family is relatively new and was first documented by Security Intelligence.


A backdoor also known as: W32.FamVT.Cosmu.PE Win32.Worm.VB.NZQ Trojan.Win32.Cosmu!O W32.Lamer.EL3 Downloader.VB.Win32.95 Trojan/Downloader.VB.eex Win32.Virus.VBbind.a W32.Besverit Win32/VB.JU TROJ_DLOADR.SMM Win.Trojan.Cosmu-4 Virus.Win32.Lamer.el Win32.Worm.VB.NZQ Trojan.Win32.VB.ltch Troj.Downloader.W32.VB.l4ji Worm.Win32.VB.kp Win32.Worm.VB.NZQ Win32.Worm.VB.NZQ Win32.HLLW.Autoruner.6014 TROJ_DLOADR.SMM BehavesLike.Win32.Autorun.th Trojan/Cosmu.lan Trojan.Win32.Cosmu.887991 Virus.Win32.Lamer.el Win32.Worm.VB.NZQ Win32/Lamer.D Win32.Worm.VB.NZQ SIM.Trojan.VBO.0859 Trojan.Downloader Win32/VB.NUP Worm.Win32 W32/AutoRun.RPV!worm W32/OverDoom.A Virus.Win32.Lamer.B


This mechanism is similar to premium rate SMS messages but Trojans do not need to send any SMS in this case – they just need to click on a button on a web-page with WAP-billing.


A backdoor also known as: Trojan.Keylogger.88 Win32.Backdoor.Ciadoor.13.y.2.Pack Backdoor/Ciadoor.13 Backdoor.Ciadoor!4PAHfVwkIvk W32/BackdoorX.FCC Backdoor.Ciadoor Win32/Ciadoor.J BKDR_CIADOOR.E Win32.Stration Backdoor.Win32.Ciadoor.cia Trojan.Keylogger.88 Backdoor.Win32.Ciadoor.13 Trojan.Keylogger.88 Trojan.DownLoader.62487 BDS/Ciadoor.13.A BKDR_CIADOOR.E Backdoor.Win32.Ciadoor!IK Backdoor/Ciadoor.az Backdoor/Win32.Ciadoor VirTool:Win32/VB.L Backdoor.Win32.Ciadoor.60726 Trojan.Keylogger.88 W32/BackdoorX.FCC OScope.Backdoor.VB Win32/Ciadoor.13 Backdoor.Win32.Ciadoor W32/Ciadoor.13!tr.bdr BackDoor.Ciadoor.3.AH Bck/Ciadoor.FQ


Indicators for the TripleNine backdoor used by an actor.


A backdoor also known as: Trojan.Pakes Troj.W32.Pakes!c Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/Trojan.ZCVD-4026 Trojan.Win32.Encoder.euxeay Trojan.Encoder.15133 Trojan.Pakes.Win32.41830 Trojan.Win32.Injector Backdoor.Backboot.s TR/Crypt.Xpack.frnur W32/Injector.DSRQ!tr Trojan.Graftor.D67C49 Ransom:Win32/Criakl.D Backdoor.Backboot Ransom.FileCryptor Trj/GdSda.A Trojan.Pakes!3sBO8Lnk+/0 Win32/Trojan.7d4


Some of the stolen Skype databases included chat history going back to 2012 and activity as recent as January 2014


A backdoor also known as: Rootkit.Win32.Xanfpezes!O Trojan.Rootkitdrv Rootkit.Xanfpezes.Win32.13 Trojan/Xanfpezes.bru Trojan.Symmi.DC01B Win32.Trojan.WisdomEyes.16070401.9500.9873 W32/Trojan.VQCP-2977 Win32/Rootkit.KX RTKT_HIDEPROC.BB Win.Trojan.Hideproc-77 Rootkit.Win32.Xanfpezes.bru Riskware.Win32.HideProc.crvalg Trojan.Fakealert.28173 RTKT_HIDEPROC.BB BehavesLike.Win32.PUP.wc Downloader.Delphi TrojanDropper.Delf.cdq RiskWare[RiskTool]/Win32.HideProc Win32.Hack.Rootkit.kcloud Rootkit.Win32.Xanfpezes.bru Backdoor/Win32.Xanfpezes.C131817 TrojanDownloader.Banload HackTool.Win32.ProcHide.ad Rootkit.Xanfpezes!kqbV3Mm24ww


A backdoor also known as: Trojan.Nsis.Ocna.eqkruk Trojan.InstallCoreCRTD.Win32.3467 Win32/RA-based.AB


A backdoor also known as: Win32.Worm.Mariofev.O Win32.Worm.Mariofev.O WORM_MARIOFEV.TO Win32.Trojan.WisdomEyes.16070401.9500.9961 W32/Backdoor2.CSNQ W32.Spamuzle WORM_MARIOFEV.TO Win.Spyware.53855-2 Worm.Win32.Pinit.piv Win32.Worm.Mariofev.O Trojan.Win32.Pinit.bmcqcd W32.W.Pinit.piv!c Win32.Worm.Pinit.Ljul Win32.Worm.Mariofev.O Win32.Worm.Mariofev.O BackDoor.Zapinit.81 BehavesLike.Win32.VTFlooder.nc Trojan-Ransom.HydraCrypt W32/Backdoor.CNPZ-8382 TrojanDropper:Win32/Mariofev.H Worm.Win32.Pinit.piv Worm.Pinit Worm.Mariofev!HCn84tcMG2k


Readers who are interested in this campaign should start with our first blog that lays out the overall functionality of the malware and introduces its many components.


A backdoor also known as: Trojan.Novel.DOS.1 PSW.Novel TROJ_PSWNOVEL.A Trojan-PSW.DOS.Novel Trojan.Dos.Novel.fnqs DOS.S.PSWNovel.7120 Troj.PSW.DOS.Novel!c TrojWare.PSW.Novel TROJ_PSWNOVEL.A Trojan/PSW.Novel TR/PSW.Novel Trojan[PSW]/DOS.Novel Trojan-PSW.DOS.Novel Login.7120 Dos.Trojan-qqpass.Qqrob.Aenr W32/HLLW_NewStory.A!tr.pws Win32/Trojan.99d


A backdoor also known as: Trojan.Losicoa.S18597 Trojan.Zusy.D39F92 TrojanDownloader:Win32/Qdownb.A Trojan.Win32.BHO Win32/Trojan.cb1


The group effectively controls an arsenal of over 85 million mobile devices around the world.


Last week, a new version was spotted in the wild, and based on our analysis, we believe that this variant is the one used in a recent attack against San Francisco Municipal Transport Agency SFMTA.


We observed 3 squatting domain registrations related to a victim in the media sector.


A backdoor also known as: Trojan.Razy.D1558E Win32.Trojan.WisdomEyes.16070401.9500.9566 Trojan.MSIL.Crypt W32/Trojan.UXDY-5009 TR/Kryptik.udtxo TrojanDropper:MSIL/Vibes.A Trj/GdSda.A MSIL/Kryptik.GXI!tr Win32/Trojan.855


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 PowerShell.DownLoader.36 BehavesLike.Win32.Trojan.dh Trojan-Dropper.PowerShell.Ploty W32/Trojan.ZKDA-3628 TrojanDropper:PowerShell/Ploty.C Trj/CI.A JS/Psdl.A!tr.dldr Win32/Trojan.f31


Analysis of HackingTeam Android malware


We refer to this backdoor as T9000, which is a newer variant of the T5000 malware family, also known as Plat1.


A backdoor also known as: Ransom.Pottieq Win32.Trojan.WisdomEyes.16070401.9500.9786 Trojan.Win32.Aura.evxqqg Trojan.Encoder.2667 BehavesLike.Win32.BadFile.th TrojanDropper.FrauDrop.annq Trojan[Ransom]/Win32.Aura Ransom:Win32/Pottieq.A


The Trapwot malware family is considered scareware or rogue antivirus because it attempts to mislead victims into believing their machine is infected with malware.


In comparison to other threat groups, TG-3390 is notable for its tendency to compromise Microsoft Exchange servers using a custom backdoor and credential logger.


A backdoor also known as: Trojan.Dynamer Win32.Trojan.WisdomEyes.16070401.9500.9999 MSIL.Packed.Skaldring.D Win32.Trojan.Fsysna.Hwwo Trojan.DownLoader14.15241 BehavesLike.Win32.Trojan.cc Trojan.Crypt TR/Dropper.MSIL.rpjh Trojan.Barys.DCAFA Trojan:Win32/Bshan.A Trojan.Fsysna! MSIL/Injector.PKZ!tr Trj/GdSda.A


A backdoor also known as: Worm.Alien Trojan.Zusy.D3E06C Win32.Trojan.WisdomEyes.16070401.9500.9952 Worm.Win32.Alien.oe W32/Trojan.RDLO-7674 WORM/Alien.ugxeq TrojanDownloader:VBS/Kaloki.A Worm.Win32.Alien.oe Trj/CI.A Win32/Trojan.9de


The malware was included as an attachment intended to trick the user into opening the malware.


Cybercriminals, however, are equal opportunity exploiters, so just recently an interesting targeted malware campaign was found to be using another document vulnerability.


The backdoor code was found between Display Widgets version 2.6.1 released June 30 and version 2.6.3 released September 2.


However, over the past few years, we have been tracking a separate, less widely known suspected Iranian group with potential destructive capabilities, whom we call APT33.


If the registration is successful, it uses the received unique identifier to further communicate with the C&C server and receive commands.


A backdoor also known as: Backdoor.Avosim Backdoor.Trojan W32/Trojan.BPEV-1033 BDS/Avosim.azmiq W32/ISMdoor.5E1D!tr Trj/GdSda.A Win32/Backdoor.ed0


run a malicious DEX file without notification,


A further blog by FireEye titled Acknowledgement of Attacks Leveraging Microsoft Zero-Day provided additional useful information.


The Sage ransomware variant appears to have been out of circulation for a while in the malware scene.


A backdoor also known as: PDF/Trojan.PGPW-0


After further research, we found the malware has been repackaged into several pirated iOS apps that are available for download via multiple channels.


Crypt0l0cker has gone through a long evolution, the adversaries are updating and improving the malware on a regular basis.


The Sofacy group, also known as APT28 and Sednit, is a fairly well known cyber espionage group believed to have ties to Russia.


Even harder is when you do not receive telemetry data from products that contains information about infected machines.


What is more, they are tied to the attacked applications, which creates an illusion that they are legitimate and belong to the corresponding software.


However, there are several good reasons for an attacker to use this particular feature.


NCC Group is monitoring a number of OOXML and RTF techniques our red team has been using since September 2016, which uncovered multiple malicious documents from around August 2017.


A backdoor also known as: Virus.Win32.Sality!O Tool.Transmit.Win32.60 Win32.Trojan.WisdomEyes.16070401.9500.9549 not-a-virus:NetTool.Win32.Transmit.a Riskware.Win32.Transmit.exlakv Trojan.Win32.Z.Transmit.67795 Backdoor.Win32.VanBot.24 Tool.Transmit BehavesLike.Win32.VirRansom.kc Trojan/Pakes.emd not-a-virus:NetTool.Win32.Transmit.a Trj/CI.A Trojan.TenThief.DNFTrojan.tnh


The attacks leveraged a malware named EyePyramid to target a dozen politicians, bankers, prominent freemasons and law enforcement personalities in Italy.


Recently, we've seen a number of reports related to 9002 remote access Trojan RAT.


A backdoor also known as: Trojan.Kadena.B4 Trojan.Ipatre.1 Win32.Trojan.Kryptik.lx TROJ_UPATRE.SMX7 Win32.Trojan.Kryptik.CI Trojan.Win32.Kryptik.expevv Trojan.Win32.Z.Upatre.71168.AI TrojWare.Win32.TrojanDownloader.Upatre.EMD Trojan.DownLoader26.15470 TROJ_UPATRE.SMX7 W32/Trojan.DPWC-8231 TR/Crypt.ZPACK.karjs Trojan/Win32.Upatre.R160419 Trojan-Downloader.Win32.Waski W32/Kryptic.ABGK!tr Win32/Trojan.8c5


When clicked it launches an infection chain made up of JavaScript, and a final shellcode payload that makes use of DNS to load additional shellcode from a remote command and control server.


A backdoor also known as: Backdoor.IRC.MRAK.A Virus.Win32.Mkar!O W32.Mkar.A4 Backdoor.IRC.MRAK.A Virus.Mkar.Win32.5 Backdoor.IRC.MRAK.A Win32.Trojan.WisdomEyes.16070401.9500.9981 W32/Mkar.C W32.Marak PE_MKAR.A.DAM Win.Trojan.Mkar-3 Virus.Win32.Mkar.a Backdoor.IRC.MRAK.A Virus.Win32.Mkar.cyau Backdoor.IRC.MRAK.A Win32.Mkar.A Backdoor.IRC.MRAK.A Win32.HLLP.Mrak.9 PE_MKAR.A.DAM BehavesLike.Win32.Koobface.mc W32/Mkar.LNJG-1026 WORM/Mkar.A Backdoor:Win32/Mkar.A Win32.Mrak.A Virus.Win32.Mkar.a Backdoor.IRC.MRAK.A Malware/Win32.Mkar.C408081 Win32/Mkar.A Win32.Mkar.E Virus.Win32.Mkar W32/Mkar.D W32/Mkar.E


CrowdStrike Services Inc., our Incident Response group, was called by the Democratic National Committee DNC, the formal governing body for the US Democratic Party, to respond to a suspected breach.


A backdoor also known as: Trojan/W32.Buzus.32878.D TrojanDownloader.Small.grk Trojan/Downloader.Small.grk Trojan.DL.Small.ALEE Win32/SlhBack.B W32/Downldr2.BDIE W32/DLoader.DZIA Trojan.Downloader-20119 Trojan-Downloader.Win32.Small.grk Trojan.Downloader.Delf.OJS Backdoor.Win32.SlhBack.B Trojan.Downloader.Delf.OJS Trojan.DownLoader.50258 TR/Dldr.Small.grk.24 TROJ_DELF.HXO Heuristic.BehavesLike.Win32.Backdoor.H Win32/SillyDl.ETL W32/Downldr2.BDIE TrojanDownloader.Small.zhn Trojan-PWS.Win32.OnLineGames!IK TrojanDownloader:Win32/Small.AAAL Trojan.Win32.Downloader.35496 Trojan.Downloader.Delf.OJS Win-Trojan/Downloader.32877 Trojan-Downloader.Win32.Small.grk Trojan.DL.Small.AJEZ Trojan.DL.Win32.Small.grk Trojan-PWS.Win32.OnLineGames W32/Small.GRK!tr Trj/Downloader.REB


The McAfee Labs research team has tracked an advanced persistent threat for the past couple of months.


A backdoor also known as: Trojan.Win32.Vilsel!O BackDoor-EZO.a Trojan/Bewymids.a Trojan.Vilsel!fjBL+ssgwjs Infostealer.Hoardy Win.Trojan.Vilsel-265 Trojan.Win32.Vilsel.aybc Trojan.Win32.Vilsel.djwjt Trojan.Win32.S.Vilsel.61544[h] Trojan.DownLoader2.44985 Trojan.Vilsel.Win32.20666 BehavesLike.Win32.Downloader.km Trojan/Vilsel.uxx TR/Bewymids.A.2 Trojan/Win32.Vilsel Win32.Troj.Vilsel.kcloud Trojan:Win32/Bewymids.A Trojan/Win32.Vilsel Spyware.Infostealer.Flea.APT Trojan.Vilsel Win32.Trojan.Vilsel.Phqe Trojan.Win32.Vilsel W32/Vilsel.AYBC!tr Trojan.Win32.Bewymids.BA Win32/Trojan.bab


As the attack is currently active, it effectively turns compromised sites into attack surfaces against their visitors.


A backdoor also known as: TrojanDownloader.Stegvob.C9 Win32.Trojan-Downloader.Delf.c WORM_TOPHOS.BKD Trojan.Win32.Dropper.aas Win32.HLLW.Tophos.1 WORM_TOPHOS.BKD Trojan.Symmi.DD7FE Worm:Win32/Tophos.B BScope.Worm.Tophos.2612 Backdoor.Bot Virus.Win32.Sality W32/Tophos.AAA!tr Win32/Trojan.278


Aside from stealing keystrokes, passwords, Bitcoins, system information, and files on disk, NionSpy also known as Mewsei and MewsSpy can record video using the webcam, audio using the microphone, take screenshots, and use infected machines as a proxy tunnel to connect to other machines within the network.


The actors behind this adware utilize a simple yet effective approach – they download a popular, legitimate Android application, decompile it, add their malicious routines, then repackage the Android application package APK.


A backdoor also known as: Trojan.Mauvaise.SL1 Trojan.FlyStudio.Win32.19742 Trojan/FlyStudio.ooa Trojan.Zusy.D38745 Win32.Trojan.FlyStudio.we Win32.Application.PUPStudio.B Trojan.Win32.Dwn.eeopgy Trojan.DownLoader24.6094 Trojan.Win32.Antavmu TR/Winder.sbcde Trojan[Dropper]/Win32.Sysn Trojan:Win32/Winder.A RiskWare.GameHack Backdoor.Farfli!+OYA++JJfG8


#ISMDoor impersonates ZAHRANI an electrical equipment and engineering company in Saudi Arabia and ThetaRay.


In the third intrusion, the Mandiant Incident Response team was contacted after UNC961 had compromised the victim and transferred access to UNC3966.


Modification of KBOT from the Carberp leak.


A backdoor also known as: Trojan.Lossymem MSIL/Filecoder.LI Ransom_LTML.THAOJH Trojan.Win32.Ransom.ewugaq Ransom_LTML.THAOJH Trojan-Ransom.FileCoder W32/Trojan.QFKV-3532 TR/Ransom.xaclx Trojan/Win32.Ransom.C2353444 Trojan.Ransom.LongTermMemoryLoss Trj/GdSda.A MSIL.Trojan-Ransom.LTML.A


A backdoor also known as: Trojan.Floxif.S1578425 Trojan.Rozena.Win32.59165 BKDR_CCHACK.A W32/CChack.A Trojan.Ccleaner BKDR_CCHACK.A Win.Spyware.CCBkdr-6336251-2 Win32.Backdoor.Forpivast.B Backdoor.Win32.InfeCleaner.a Trojan.PRForm.A Trojan.Win32.Floxif.estdxt Trojan.Win32.Z.Floxif.5000118 Trojan.PRForm.A Trojan.CCleaner.2 BehavesLike.Win32.Dropper.rc Backdoor.Hacked.CCleaner W32/CChack.SQBY-7641 Trojan[FakeAV]/Win32.CCleaner Backdoor.Win32.InfeCleaner.a Win-Trojan/Floxif.9791816 Backdoor.InfeCleaner Trj/CI.A Trojan.PRForm.A Win32.Backdoor.Infecleaner.Lkns Win32/Trojan.54c


A backdoor also known as: Exp.OLE.CVE-2015-1641.E Trojan.Mdropper Win32/Exploit.CVE-2015-1641.V TROJ_MDROP.YYSRH TROJ_MDROP.YYSRH RTF/Trojan.BTCC-93 Trojan[Exploit]/Win32.CVE-2015-1641 Exploit.CVE-2015-1641 Exploit.CVE-2015-1641


A backdoor also known as: W97M.Downloader.CXJ O97M.Drop.P W97M.Downloader.CXJ VBA.Trojan.Obfuscated.u VBA/Obfuscated.C W2KM_GOLROTED.AGG W97M.Downloader.CXJ W97M.Downloader.CXJ Trojan.Ole2.Vbs-heuristic.druvzi W97M.Downloader.CXJ W97M.Downloader.CXJ W97M.DownLoader.1033 W2KM_GOLROTED.AGG W97M.Downloader.CXJ WM/Obfuscated.C!tr virus.office.obfuscated.1


A new custom backdoor used by the Mustang Panda APT group is targeting a governmental institution in Taiwan, according to ESET researchers who have analyzed samples of MQsTTang, a new type of malware.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9970 Backdoor.Trojan.B Win.Trojan.10430800-1 Trojan.Win32.Pugeshe.ctexqh BDS/Pugeshe.A.2 Trj/Ziyang.A Win32.Backdoor.Pugeshe.Phzt Trojan.Ziyanzho!


The original code of BankBot was divulged on a Russian forum in late 2016, and you can read more about that here.


Based on observations on infrastructure, and the state of the code, we believe these incidents represent the first attempts to deploy the agent, and features such as persistence do not appear to work.