A backdoor also known as: W32.HfsAdware.B36E Application.Bundler.DomaIQ.Q PUP.Optional.BundleInstaller Adware.DomaIQ.Win32.132 Adware.DomaIQ/Variant Application.Bundler.DomaIQ.Q Win32.Adware.DomnIQ.b Infostealer.Limitail Win32/DomainIQ.eOTUWS Win.Adware.Domaiq-1 not-a-virus:AdWare.MSIL.DomaIQ.clek Application.Bundler.DomaIQ.Q Trojan.Win32.DomaIQ.ctadmg Adware.Win32.Lollipop.f Application.Bundler.DomaIQ.Q Application.Win32.DomaIQ.URT Trojan.DownLoader9.21779 AdWare/MSIL.ps Pua.Tuguu GrayWare[AdWare]/MSIL.DomaIQ TrojanDownloader:Win32/Tugspay.A not-a-virus:AdWare.MSIL.DomaIQ.clek Win32.Application.DomalQ.G PUP/Win32.DomaIQ.R99208 BScope.Downware.DomaIQ PUA.DomaIQ! Trj/CI.A


Between December 2021 and July 2022, the Mandiant Managed Defense and Incident Response teams responded to three UNC961 intrusions at different organizations that each started in similar fashion.


When the user tries to open one of these legitimate apps, the malware replaces the genuine app window with a phishing window that asks for banking information.


A backdoor also known as: W32.TikoraxaDSB.Trojan Trojandownloader.Script W32/Snojan.OHXS-3777 VBS/TrojanDownloader.Small.NGH Trojan.Win32.Mlw.evnleg Troj.Downloader.Script!c BehavesLike.Win32.Downloader.dh Trojan-Downloader.VBS.Small W32/Snojan.Q Trojan.Pincav.aer VBS/Dldr.Small.vxbdh Trojan.DL.Alien! Trojan.Snojan Trj/CI.A Script/Virus.72d


A backdoor also known as: W32.DownLoadRiniLTN.Trojan Trojan.Win32.Scar!O Trojan.Popureb.B4 Trojan/Scar.ejkj Trojan.Zusy.D2E760 TROJ_POPUREB.SM Win32.Trojan.Scar.i Win32/Scar.ZF TROJ_POPUREB.SM Win.Trojan.Scar-8452 Trojan.Win32.Scar.bccuvv Trojan.Win32.A.Scar.86016.F Backdoor.Win32.Popwin.~IT Trojan.DownLoader11.5691 Trojan.Scar.Win32.75436 BehavesLike.Win32.Dropper.mm Backdoor.Win32.Poison TR/Popureb.B.20 Trojan/Win32.Scar Win32.Troj.Poison.b.29696 Trojan:Win32/Popureb.B Trojan/Win32.PbBot.R3997 Trojan.Scar Trojan.Scar Trojan.Win32.Scar.tgh Trojan.Ghodow!qzMoVFGUIfc W32/Scar.ENA!tr Win32/Trojan.285


In the past, we investigated TorLocker and its flawed encryption, which was created and negotiated worldwide by a Brazilian cybercriminal.


The Trojan itself is well known and contained x32 and x64 rootkits.


The multiple downloads is probably a redundancy measure in case some sources are taken down.


In this case it capitalized on the recent terrorist attack in New York City.


A backdoor also known as: BackDoor-CYK.srv Backdoor/VB.alk Backdoor.VB!XZJVRUVgqYg W32/Backdoor.LPS TROJ_MALKZR.A Backdoor.Win32.VB.alk Backdoor.Win32.VB.37168 Backdoor.Win32.VB!IK Backdoor.Win32.Delf.~EC TROJ_MALKZR.A Heuristic.BehavesLike.Win32.Downloader.D Backdoor/VB.rj Backdoor:Win32/Norachs.A W32/Backdoor.LPS Win-Trojan/Xema.variant Trojan.Win32.VB.ALK Win32/VB.ALK Backdoor.Win32.VB W32/VB.ALK!tr BackDoor.VB.FLP


Our analysis reveals connections between these attacks, recent strategic web compromises against Burmese government websites, and previous campaigns targeting groups in the Tibetan community.


In past revivals, the botnet has been distributed through malicious emails containing attachments or links to compromised websites hosting exploit kit content.


A backdoor also known as: PWS-Xema.dr PWS-Xema.dr Trojan.Win32.Malware.4 W32/Smalltroj.IUNZ Win32.TRCrypt.XPACK Trojan.Win32.Pincav.cay Trojan.MulDrop.29150 Trojan:Win32/Cinject.B Win-Trojan/Ristix.8192 Trojan.Win32.Pincav.cay Packer.Win32.UnkPacker.a Trj/Downloader.MDW


However, after reverse analysis, we found that it to be part of a brand new family, which we called Alice.


A backdoor also known as: W32.OnGameZLEU.Worm Trojan.Reval.28280 TROJ_SPNR.05AD13 TROJ_SPNR.05AD13 Worm.MSIL.Autorun Trojan/MSIL.hcf TR/BAS.Samca.22510458 Trojan/MSIL.Hor Trojan:MSIL/Reval.A Trojan.Zusy.D53EB


These analysts were linked by their coverage of the telecommunications industry, making this targeting very similar to, and likely a continuation of, activity described in our In Pursuit of Optical Fibers and Troop Intel blog.


Perhaps the most interesting aspect of the Snake Wine group is the number of techniques used to obscure attribution.


A backdoor also known as: Trojan.Dumpy.A6 Trojan.Zusy.DFB8F W32.Dompie WORM_DUMPY.SM23 Trojan.Win32.Hesv.apqe Trojan.Win32.AVKill.dqemmh Troj.W32.Scar.tnl2 TrojWare.Win32.Injector.XYNZ Trojan.AVKill.33151 WORM_DUMPY.SM23 WORM/Taranis.2225 Trojan.Win32.Hesv.apqe HEUR/Fakon.mwf Trojan.Scar Worm.AutoRun Worm.Win32.Dumpy


It mainly targets Chinese users, but has also successfully affected people and organizations in the United States, United Kingdom, Thailand, Spain, and Ireland.


A backdoor also known as: Trojan.Win32.Swisyn!O VirTool.VBInject.DZ Trojan.Swisyn.Win32.11562 Troj.W32.Swisyn.lsGr Win32.Worm.IRCBot.ad W32/MalwareS.BHPN Win32/Swisyn.DJ TROJ_SWISYN.SMK Trojan.Win32.Swisyn.ahwe Trojan.Win32.Swisyn.btyha Trojan.Win32.A.Swisyn.327680 Trojan.VbCrypt.68 TROJ_SWISYN.SMK BehavesLike.Win32.VBObfus.fm Trojan.Win32.Swisyn Trojan/Swisyn.lxc Trojan.Symmi.D2474 Trojan.Win32.Swisyn.ahwe Trojan/Win32.Swisyn.R2925 Trojan.VBRA.03646 W32/Swisyn.F.worm Win32/AutoRun.IRCBot.FL Virus.Win32.Virut.ue Win32/RootKit.Rootkit.7e5


The malware has functionality to steal user credentials, provide shell access, and persist through firmware upgrades.


A backdoor also known as: Zum.Razy.1 Win32.Trojan.WisdomEyes.16070401.9500.9999 Zum.Razy.1 Zum.Razy.1 BehavesLike.Win32.Trojan.dh Zum.Razy.1


A backdoor also known as: Worm.NSIS.NeksMiner.A WORM_CO.331300D2 Win32.Trojan.WisdomEyes.16070401.9500.9766 W32/Adware.DEZV-3749 Trojan.Coinbitminer WORM_CO.331300D2 Win.Trojan.Virtob-1633 Worm.NSIS.BitMin.d Trojan.Win32.BitCoinMiner.ddjqfi Trojan.BtcMine.1665 BehavesLike.Win32.TrojanCoinMiner.vc Trojan-PSW.Win32.Tepfer W32/Adware.ALRW RiskTool.BitCoinMiner.bf Trojan[PSW]/Win32.Tepfer Worm:Win32/NeksMiner.A Trojan.Strictor.D1B5F4 Worm.NSIS.BitMin.d Trojan/Win32.BitCoinMiner.C931392 TScope.Malware-Cryptor.SB RiskWare.BitCoinMiner NSIS/CoinMiner.T Trj/CI.A


Recently observed initial threat activities targeting the telecommunication sector.


We decided to check the original plugin package and, to our surprise, found the file in the source! We also discovered that we were not the only ones that found this file although people on the forum seemed to believe that the file was just vulnerable .


This way, the HTA effectively serves as a wrapper to try and slip passed traditional file type-based scanning in the network as well as anti-spam services.


ESET researchers discovered a campaign that we attribute with high confidence to the APT group Tick.


A backdoor also known as: Trojan.Win32.Small.eivvce Trojan.Inject2.21676 BehavesLike.Win64.BadFile.wc PUA.Zzinfor TrojanDropper.Dinwod.aml Dropper/Win32.Dinwod.C1833968 Trojan.Mikey.D1229E Rootkit.Small!LMZdSa8k9cE Win32/Trojan.45a


The injected DLL then downloads the fileless Gootkit and saves it in the registry as binary data, then loading it in memory only.


This article mainly analyzes the controlling end, the generator and Windows and Linux variants in controlled end of this tool and makes a display of the homologous analysis and network infection of these samples.


A backdoor also known as: Trojan.Zlob Adware.NetAdware.BD


A backdoor also known as: W32.FakeSvchostXKRB.Trojan Trojan-Downloader.Win32.Geral!O Downloader.Dogrobot.20415 Win32/SillyDl.QAC Trojan-Dropper.Win32.Injector.paib Trojan.Win32.Vilsel.iini Troj.Downloader.W32.Geral.kYTA Trojan.Win32.Downloader.wzh BackDoor.Guan.14 Downloader.Geral.Win32.1376 BehavesLike.Win32.StartPage.lm W32.Malware.Downloader Trojan[Dropper]/Win32.Injector Trojan.Win32.Downloader.16384.BHH Trojan-Dropper.Win32.Injector.paib TrojanDownloader:Win32/Dogrobot.D Trojan.Win32.Qhost


A backdoor also known as: Trojan.Win32.Dialer!O Trojan.Zenshirsh.SL7 Trojan.Dialer Win32.Trojan.WisdomEyes.16070401.9500.9746 Win32/Startpage.RT TROJ_CJ.A Win.Trojan.Dialer-61 Trojan.Win32.Dialer.cj Trojan.Win32.MLW.wvye Troj.W32.Diamin.l3NB TrojWare.Win32.Dialer.A Dialer.Virgilio TROJ_CJ.A Trojan/Dialer.cio Trojan/Win32.Dialer Trojan.Win32.Dialer.cj Trojan/Win32.Dialer.R2306 MalwareScope.Dialer.Small.1 Dialer.LBU Win32.Trojan.Dialer.Pgxd Trojan.Win32.Dialer.cj


Thanks to Bulwarkz for additional Forensic Analysis: - Clears the windows event log - Clears the journal log - Drops executables to the windows directory and starts them - Shows the ability to spread by using its contained functionality to enumerate network shares of other attached devices - Uses shutdown.exe to shutdown or reboot the system - Contains functionality to register a low level keyboard hook - Contains functionality to infect the boot sector.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9894 Trojan.Win32.CsDown.bdcfvq Trojan.CsDown.25 TrojanDropper:Win32/Waltrodock.B Trojan.Graftor.D4ACD Trojan.CsNowDown!qDe+BhsdQ1Y W32/WDockDrp.A!tr Trj/CI.A Win32/Trojan.8ea


The decoy documents and filenames used in the attacks suggest the intended targets include organisations with political interests or influence in Israel and Palestine.


A lot of additional anti-sandbox checks are performed in this exact order : Check that the malware is not executed under the root folder of a drive Check that the malware file is readable from an external source Check that the hash of base path is not 3D6D62AF1A7C8053DBC8E110A530C679 Check that the full malware path contains only human readable characters ( “ a-z ” , “ A-Z ” , and “ 0-9 ” ) Check that no node in the full path contains the MD5 string of the malware file Fingerprint the system and check the following registry values : HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid should not be “ 6ba1d002-21ed-4dbe-afb5-08cf8b81ca32 ” HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DigitalProductId should not be “ 55274-649-6478953-23109 ” , “ A22-00001 ” , or “ 47220 ” HARDWARE\Description\System\SystemBiosDate should not contain “ 01/02/03 ” Check that the mutex WininetStartupMutex0 does not already exist Check that no DLL whose base name has hash value of 0xC9CEF3E4 is mapped into the malware address space The hashes in these checks are most likely correspond to sandbox or security products that the FinFisher authors want to avoid .


Halloween is still a month from now and yet Android users are already being haunted by the previously reported Ghost Push malware, which roots devices and makes them download unwanted ads and apps.


Last March, we reported on Operation C-Major, an active information theft campaign that was able to steal sensitive information from high profile targets in India.


Custom Content Type Manager CCTM is a relatively popular plugin with three years of development, 10,000+ active installs, and a satisfaction rating of 4.8. It helps create custom post types.


A backdoor also known as: Trojan.Heur.AutoIT.13 Win32/Fynloski.STBTHUD Trojan.Win32.DarkKomet.dokuem Trojan.DownLoader12.11337 Trojan.Script.abcv Trojan:Win32/Manger.A Trojan.Autoit.Wirus Win32/TrojanDropper.Autoit.IC Win32/Trojan.Script.ed4


Moreover, the Sednit group has a special interest in Eastern Europe, where it regularly targets individuals and organizations involved in geopolitics


This virus ransomware arrives via email in a malicious attachment or by usurping an Adobe Flash Player installation.


Within a few minutes of installing one of these Trojans, all other active malware on the network is enabled on the victim's device.


This particular application/game from Google Play Store is certainly not a system application, as the name seems intended to suggest.


The bank then shared indicators of compromise IOCs with other institutions and a number of other institutions confirmed that they too had been compromised.


A few of these organizations have specifically been targeted by OceanLotus since early 2015.


A backdoor also known as: W32.MurLoDll1.Trojan Trojan-Downloader.Win32.Murlo!O Downloader.Murlo.Win32.5244 Trojan/Downloader.Murlo.nn TROJ_MURLO.BA Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Downloader.EKMU-1740 Win32/TrojanDownloader.Murlo.NN TROJ_MURLO.BA Win.Trojan.Murlo-7 Trojan-Downloader.Win32.Murlo.nn Trojan.Win32.Murlo.cpwkr Trojan.Win32.Downloader.5632.AY Trojan.DownLoader.62110 Trojan-Downloader.Win32.Murlo W32/Downldr2.CIAF TrojanDownloader.Murlo.hb Trojan[Downloader]/Win32.Murlo TrojanDownloader:Win32/Almanahe.A Trojan-Downloader.Win32.Murlo.nn Win32/SillyDl.EPI TrojanDownloader.Murlo W32/Murlo.NN!tr.dldr


A backdoor also known as: Worm.Wabbin Win32.Trojan.WisdomEyes.16070401.9500.9773 W32.Wabbin Win.Worm.Wabbin-1 Email-Worm.Win32.Wabbin Trojan.Win32.Wabbin.eoih Email.Worm.W32!c IM-Worm.Win32.VB W32/Trojan.TLKW-6882 Worm[Email]/Win32.Wabbin Trojan.Heur.VP.E513A3 Email-Worm.Win32.Wabbin Worm:Win32/Wabbin.A@mm Worm.Wabbin Trj/CI.A Win32.Worm-email.Wabbin.Dxnb Worm.Wabbin! W32/Wabbin.A@mm Win32/Trojan.97a


A backdoor also known as: I-Worm.Music.C W32/Music.40960.B Music.H WORM_MUSIC.B Email-Worm.Win32.Music.B Worm.Win32.Email-Worm.Music.B BACKDOOR.Trojan WORM_MUSIC.B W32/Music.40960.B I-Worm/Music.b WORM/Music.B Worm:Win32/Music.C@mm I-Worm.Win32.Music.B[h] W32/Music.B Win32/Music.B Email-Worm.Win32.Music.A W32/Music.B@mm Worm.Win32.Music.Abh


A backdoor also known as: Trojan/W32.Hijack.356352.M VirTool.DelfInject Trojan.DelfInject Dropper.Injector.Win32.25443 Trojan/Dropper.Injector.dyha Win32.Trojan.Delf.k TROJ_NEOJIT.SMAR Trojan.Win32.Buzus.rfedr Trojan.DownLoader6.1239 TROJ_NEOJIT.SMAR BehavesLike.Win32.Worm.fh TrojanDropper.Injector.taw Trojan/Win32.Buzus TrojanDownloader:Win32/Neojit.A Trojan/Win32.Injector.R23295 BScope.Trojan-Dropper.Injector Win32/Delf.OEN Trojan-Downloader.Win32.Neojit Win32/Trojan.dee


A backdoor also known as: Win32.MTX.B@mm W95.MTX Win32.MTX.B@mm W32/MTX@M.dll WORM_MTX.D W32/MTX.9244.B WORM_MTX.D Win.Trojan.MTX-5 Win32.MTX.B@mm Email-Worm.Win32.MTX.D Win32.MTX.B@mm Virus.Win32.MTX.hfxi Win32.MTX Win32.MTX.B@mm Win32.MTX.B@mm Win95.Matrix.9307 W95/MTX.dll@M W32/MTX.9244.B I-Worm/MTX.d W95/Mtx.B Win32.MTX.E2C45E Email-Worm.Win32.MTX.D Worm:Win32/MTX.B.dll W95/MTX.dll@M W32/MTX.D!worm


A backdoor also known as: Trojan/W32.Small.9728.KQ Win32.Trojan.WisdomEyes.16070401.9500.9990 Backdoor.Teambot Win.Trojan.Zapchast-130 Trojan.Win32.TeamBot.ctspsr BackDoor.TeamBot.60 Trojan/Zapchast.exm W32/Sheldor.NAB!tr Win32.Troj.Undef.kcloud Trojan.Graftor.Elzob.950 Troj.W32.Zapchast.lhAn Trojan:Win32/Availmetre.B Trojan/Win32.Zapchast.R17936 SScope.Backdoor.Mudak Trojan.Win32.Availmetre


A backdoor also known as: Backdoor.Win32!O Backdoor.Small.MUE.A11 RiskWare.SpySoft Trojan.Udr.Win32.1 W32/BackdoorX.GMX Backdoor.Trojan Win32/BackMan.A BKDR_NEWHEUR.IZ Win.Trojan.Udr-1 Backdoor.Win32.Udr.a Trojan.Win32.Udr.csnpza Backdoor.Win32.Udr.aa BackDoor.Udr.1 BKDR_NEWHEUR.IZ BehavesLike.Win32.Backdoor.fc W32/Backdoor.COLY-8496 Backdoor/Udr.d BDS/Udr.A Trojan[Backdoor]/Win32.Udr Win32.Hack.Udr.B5.kcloud Backdoor.Win32.Udr.692018 Backdoor.Win32.Udr.a Trojan/Win32.Udr.R577 OScope.Backdoor.Udr Backdoor.JYfi Backdoor.Udr!EwW5NHJTxmo Backdoor.Win32.Udr W32/Udr.A!tr.bdr Dialer.CKP


It also has a general purpose-proxy and a module for sending spam messages.


The attackers attempted to steal $951m, of which $81m is still unaccounted for.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9828 Win32.Trojan.Kriskynote.Ozic Trojan.Win32.Kriskynote Backdoor:Win32/Kriskynote.A BScope.Trojan.SvcHorse.01643 W32/Dropper.TMP!tr


Before that patch was released, the groups launched phishing campaigns against multiple companies in the aerospace and defense, construction and engineering, education, energy, health and biotechnology, high tech, non-profit, telecommunications, and transportation industries.


A backdoor also known as: Trojan.Ollexos Win32.Trojan.Heur.Lhdl Trojan.Heur.Win32.9371 BehavesLike.Win32.Spyware.jc TR/RedCap.xrytt Trojan.Heur.OmNfrrOwGgmOh Trojan.Win32.Z.Redcap.655360 Trojan:Win32/Ollexos.A Win32/Trojan.7b0


A backdoor also known as: W32.OnGamesHEXW32AH.Trojan Trojan.Win32.Scar!O BackDoor.Boomie.A3 Trojan.Scar.Win32.63773 Trojan/Scar.fvka Win32.Trojan.Scar.d Win.Trojan.Scar-895 Trojan.Win32.Scar.fvka Trojan.Win32.Scar.bbmdmf Troj.W32.Scar.fvka!c Trojan.Win32.Scar.ft Trojan.DownLoad2.52794 Backdoor.Win32.Boomie Trojan/Scar.azbo Trojan/Win32.Scar Backdoor:Win32/Boomie.A Trojan.Win32.Scar.fvka Win-Trojan/Boomie.40960 Trojan.Scar!AGwL0r/7hW4 Win32/Trojan.Spy.81b


A backdoor also known as: Trojan.Shamoon.A Trojan/W32.Shamoon.192000 Trojan.Depriz Trojan/DistTrack.d Trojan.Shamoon.A Win32.Trojan.WisdomEyes.16070401.9500.9987 W32.Disttrack.B TROJ64_DISTTRACK.D Win.Malware.DistTrack-5743117-1 Trojan.Shamoon.A Trojan.Shamoon.A Trojan.Win64.DistTrack.elcfal Trojan.Win32.Z.Disttrack.192000 Trojan.Shamoon.A Trojan.Shamoon.A Trojan.DistTrack.Win32.9 TROJ64_DISTTRACK.D W64/Trojan.BOAO-0112 Trojan:Win64/Depriz.E!dha Trojan.DistTrack.A Trj/CI.A W64/DistTrack.D!tr


FastPOS was true to its moniker—pilfer data as fast as possible, as much as it can, even at the expense of stealth.


A backdoor also known as: Trojan-Downloader.Win32.Banload!O Trojan/Downloader.Banload.qku Trojan.Graftor.D3222 Win32.Trojan.WisdomEyes.16070401.9500.9991 Trojan.DownLoad2.52025 Downloader.Banload.Win32.37297 Trojan.Win32.Spy TrojanDownloader:Win32/Spycos.B TrojanDownloader.Banload


A backdoor also known as: Backdoor.KVM.B Backdoor/W32.KWM.70656 PWS-Susanin.dr Backdoor.KVM.B Trojan.KWM.B2 Infostealer.KMW.B KWM.B Win32/PSW.KWM.B BKDR_KWM.B Backdoor.Win32.KWM.b Trojan.Win32.KWM.baukx PE:Trojan.KWM.b!1073777723 Backdoor.KVM.B TrojWare.Win32.PSW.Susanin.B Backdoor.KVM.B BackDoor.KWM Backdoor.KWM.Win32.11 BKDR_KWM.B PWS-Susanin.dr W32/Risk.SBUI-3175 Backdoor/KWM.b TR/WebMoney.2 Trojan[Backdoor]/Win32.KWM Win32.Hack.KWM.b.kcloud PWS:Win32/Susanin.B Backdoor.Win32.KWM.70656[h] Win-Trojan/KWM.70656 Backdoor.KVM.B Backdoor.KVM.B Dropper.PSW.Liz.17 Trj/PSW.Susanin Win32/PSW.Susanin.B Backdoor.Win32.Kwm.B W32/Contract.B!tr.bdr PSW.Susanin Backdoor.Win32.KWM.aWbC


A backdoor also known as: W32.Raxlogon.Trojan Worm.Win32.AutoRun!O Worm.Autorun.ZI8 Worm.AutoRun.Win32.22949 Win32.Worm.FakeFolder.b Win32/QQPass.NNE Worm.AutoRun Worm.Win32.AutoRun.hit Trojan.Win32.AutoRun.uaado Worm.Win32.Autorun.81108 Worm.Win32.Pronny.BL Trojan.PWS.Qqpass.5627 BackDoor-CCT.dll Worm/AutoRun.wxz Trojan:Win32/Hideproc.E Trojan[Monitor]/Win32.ActualSpy Win32.Troj.Undef.kcloud HEUR/Fakon.mwf Trojan.AVKill W32/Autorun.KBC Trojan.Win32.FakeFolder.pb Worm.AutoRun!PDL9JmhYC4g Backdoor.Win32.DarkMoon


New campaign involving PoSeidon/FindPOS point of sale malware


This morning Mozilla released security updates that fix the vulnerability.


A backdoor also known as: Trojan.Notepices Win32.Trojan.WisdomEyes.16070401.9500.9871 not-a-virus:AdWare.Win32.ICLoader.alpu Riskware.Win32.Hpdefender.ekfhpl Trojan.StartPage1.28867 Trojan.Win32.Notepices Pua.Downloader GrayWare[AdWare]/Win32.Hpdefender not-a-virus:AdWare.Win32.ICLoader.alpu Adware.HPDefender Win32/Adware.HPDefender.JG


A backdoor also known as: W32.FamVT.RsLpTTc.Worm Ransom.Lyposit.S3755 W32.Sality.lak4 Trojan/Lyposit.a Trojan.Zusy.D382F1 Ransom_Lyposit.R002C0CAT18 Win32.Trojan.WisdomEyes.16070401.9500.9902 Ransom_Lyposit.R002C0CAT18 Win.Trojan.Updays-1 Trojan.Win32.Clicker.efvwpu TrojWare.Win32.Lyposit.C Trojan.Click2.50933 Trojan.Lyposit.Win32.25 Trojan-Ransom.Lyposit Ransom:Win32/Lyposit.B Trojan/Win32.Lyposit.R188188 W32/Lyposit.A70!tr


The malware used in email campaigns is often ransomware or banking malware.


A backdoor also known as: Trojan.Injector.AutoIt Trojan.StartPage1.24074 TrojanClicker:Win32/Rubalotalow.A Win32/Trojan.ab1


A backdoor also known as: W32.eHeur.Virus02 Virus.Win32.Sality!O Win32.Trojan.WisdomEyes.16070401.9500.9989 Win.Trojan.Zusy-6041926-0 Trojan.Win32.Scar.okvf Win32.Trojan.Scar.Wwek Trojan.DownLoader24.19336 Trojan.Scar.kws Trojan/Win32.Cosmu PWS:Win32/Sapbexts.B Trojan.Win32.Scar.okvf Trojan/Win32.Cosmu.R214802 Trojan.Vilsel Trojan.Cosmu!F9mC6Li+PNw Win32/Trojan.Scar.C


You may mistakenly download and run TrojanDropper:Win32/Gepys.A, thinking it is an update for Java.


If the attack succeeds, the malware changes the addresses of the DNS servers in the router's settings, thereby rerouting all DNS queries from devices in the attacked Wi-Fi network to the servers of the cybercriminals such an attack is also known as DNS-hijacking.


Interestingly, the attackers camouflage one of their delivery domains by redirecting visitors to El Universal, a major Mexican newspaper.


These emails are mainly sent to Colombians who may work in the accounting or finance departments of various-sized organizations.


A backdoor also known as: Trojan.Downloader Trojan/Downloader.Boaxxe.aa Win32.TRDldr.JeRips TR/Dldr.JeRips.A W32/Boaxxe.AB!tr


Service Name Purpose AndroidAlarmManager Uploading last recorded .amr audio AndroidSystemService Audio recording AndroidSystemQueues Location tracking with movement detection ClearSystems GSM tracking ( CID , LAC , PSC ) ClipService Clipboard stealing AndroidFileManager Uploading all exfiltrated data AndroidPush XMPP С & C protocol ( url.plus:5223 ) RegistrationService Registration on C & C via HTTP ( url.plus/app/pro/ ) Interestingly , a self-protection feature was implemented in almost every service .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.MulDrop5.40693 TR/Downloader.A.7912 Trojan[Ransom]/Win32.Blocker Trojan:MSIL/Dubfot.A Trojan.FakeMS Trojan.MSIL.IRCBot


New ransomware using the .ipygh extension.


How do you know if your Google account is breached ? You can check if your account is compromised by accessing the following web site that we created : https : //gooligan.checkpoint.com/ .


The most recently discovered Microsoft SQL server being used as Escalar infrastructure contained records of 1660 infections that all connected in a two-day time frame.


Later on, we found evidence of the same attack perpetrated on May 3.


A backdoor also known as: Win32.Worm.Lemoor.A Worm/W32.Lemoor.1981 Trojan-Downloader.Win32.Small!O Win32.Worm.Lemoor.A Worm.Lemoor.Win32.2 W32.W.Lemoor.a!c W32/Lemoor.a Win32.Worm.Lemoor.A WORM_LEMOOR.D Win32.Trojan.WisdomEyes.16070401.9500.9995 W32/Lemoor.A W32.Lemoor.A WORM_LEMOOR.D Win.Worm.Lemoor-3 Win32.Worm.Lemoor.A Worm.Win32.Lemoor.a Win32.Worm.Lemoor.A Win32.Worm.Lemoor.A Worm.Win32.Lemoor.B Win32.Worm.Lemoor.A Win32.Ephem.24 W32/Lemoor.JDMS-3575 I-Worm/Lemoor.a WORM/Lemoor.A Worm/Win32.Lemoor Worm.Win32.Lemoor.a Worm/Win32.Lemoor.R37765 Worm.Lemoor W32/Lemoor.B.worm Win32/Lemoor.B Win32.Worm.Lemoor.Ahos Worm.Lemoor!V5CZ/YV1RTs Worm.Win32.Lemoor W32/Lemoor.A!worm Win32/Worm.857


User-agent: Go-http-client/1.1


A backdoor also known as: Trojan.Skeeyah Trojan.KillDisk.Win32.208 Trojan/KillDisk.nbh Win32.Trojan.WisdomEyes.16070401.9500.9834 Trojan.Disakil Win.Trojan.KillDisk-3 Trojan.Win32.KillDisk.fw Win32.Trojan.Killdisk.Pgmq Trojan:Win32/KillDisk.N!dha Trojan.KillDisk.1 Trojan.Win32.KillDisk.fw Trojan/Win32.KillDisk.C1706046 Trojan.KillDisk Win32/KillDisk.NBH Trojan.KillDisk!B1yc+Gvh2zs Trj/CI.A


The normal lifecycle of an Office exploit starts with the initial use in targeted attacks.


A backdoor also known as: Trojan-PSW.Win32.LdPinch!O TrojanPWS.Ldpinch Win32.Trojan.WisdomEyes.16070401.9500.9997 Win32/Tnega.YML TSPY_LDPINCH_DD3005CF.UVPA Trojan-PSW.Win32.LdPinch.guf Trojan.Win32.LdPinch.crgdkw Trojan.LdPinch.Win32.5281 BehavesLike.Win32.Trojan.fz Trojan.Win32.Vilsel W32/Trojan.JQPI-8861 Trojan/PSW.LdPinch.pxf Trojan[PSW]/Win32.LdPinch Trojan.Heur.E4E165 Troj.Psw.W32.Ldpinch!c Trojan-PSW.Win32.LdPinch.guf PWS:Win32/Phorex.A Trojan/Win32.LdPinch.R68731 Trojan.PWS.LdPinch!MPU8gCWOSOw W32/LdPinch.GUF!tr.pws TrojanPSW.Pinch Win32/Trojan.PSW.b93


A backdoor also known as: Trojan.PWS.QQRob.NBU Trojan-PSW.Win32.QQPass!O PSW.QQPass.13953 Trojan.PWS.QQRob.NBU Trojan/PSW.QQPass.ban Win32.Worm.Autorun.ar Infostealer.QQRob.A WORM_AUTORUN.EDD Win.Trojan.QQPass-84 Trojan.PWS.QQRob.NBU Trojan-PSW.Win32.QQPass.ban Trojan.PWS.QQRob.NBU Trojan.Win32.QQPass.btqyi Trojan.Win32.Z.Qqpass.73427 Trojan.Tencent/Variant Trojan.PWS.QQRob.NBU TrojWare.Win32.PSW.QQPass.~GK Trojan.PWS.Qqpass.1364 WORM_AUTORUN.EDD BehavesLike.Win32.PWSQQGame.lh W32/Pws.VYB Trojan/PSW.QQPass.bhp Win32.Troj.QQPswT.bs.116858 Trojan.PWS.QQRob.NBU Troj.Psw.W32.Qqpass!c Trojan-PSW.Win32.QQPass.ban MalwareScope.Trojan-PSW.Game.7 Trj/QQPass.AOI Win32.Trojan-qqpass.Qqrob.Pcsk Trojan-Dropper.Win32.Delf W32/Dropper.DLF!tr


A backdoor also known as: Trojan/W32.BHO.89848 Trojan/BHO.gzx TSPY_BZUB.CN Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan2.FNXB TSPY_BZUB.CN Win.Trojan.Bho-4826 Trojan.Win32.BHO.gzx Trojan.Win32.BHO.cqlbw TrojWare.Win32.BHO.SR Trojan.MulDrop.20001 Trojan.BHO.Win32.3053 BehavesLike.Win32.Backdoor.mc W32/Trojan.RKCQ-8049 Trojan/BHO.csn Win32.Troj.BHO.kcloud Trojan.Heur.RP.E89CDE Trojan.Win32.BHO.gzx PWS:Win32/Cimuz.J Trojan/Win32.Inject.C94649 Trojan.BHO Win32/Spy.BZub.NFS Trojan.BHO!Tkmwppjy1xw


A backdoor also known as: Trojan-Downloader.Win32.VB!O TrojanDownloader.VB Troj.Banker.W32.Bancos.lgUF Trojan/Downloader.VB.iro Win32.Trojan.WisdomEyes.16070401.9500.9935 Win32/SillyDl.GEF Win.Trojan.Downloader-37507 Trojan-Downloader.Win32.VB.iro Trojan.Win32.VB.vrga Trojan.Win32.Downloader.69122.B TrojWare.Win32.Banker.etk74 Trojan.Show.34817 Downloader.VB.Win32.114 WORM_IRCBOT.SMOK BehavesLike.Win32.YahLover.ct TrojanDownloader.VB.gvh Trojan[Downloader]/Win32.VB Trojan-Downloader.Win32.VB.iro DoS:Win32/Pokanti.A Downloader/Win32.VB.R6537 TScope.Trojan.VB Win32.Trojan-downloader.Vb.Pdmc Trojan.DL.VB!zHigarbFEUc Trojan-Downloader.Win32.VB Win32/Trojan.Downloader.b8b


A backdoor also known as: W97M.Dropper.GO W97M/Downloader.aho W2KM_DLOADE.VHC Trojan.Script.MLW.dsmnja W2KM_DLOADE.VHC W97M/Downloader.aho HEUR.VBA.Trojan macro.ole.encodedownload.g


A backdoor also known as: Trojan-Ransom.Win32.PornoBlocker!O Trojan/PornoBlocker.adki Win32.Virus.Krap.a HV_RANSOM_CA222F78.TOMC Win.Trojan.Kryptik-1359 Trojan-Ransom.Win32.PornoBlocker.adki Trojan.Win32.Butirat.wyaex Trojan.Win32.A.PornoBlocker.197120.B ApplicUnwnt.Win32.Hoax.ArchSMS.SG BackDoor.Butirat.51 BehavesLike.Win32.PUPXAG.ch Trojan/PornoBlocker.chv Trojan[Ransom]/Win32.PornoBlocker Trojan.Kazy.DCA1D Trojan-Ransom.Win32.PornoBlocker.adki Trojan:Win32/Waprox.A Trojan/Win32.PornoBlocker.C156437 Hoax.PornoBlocker Trj/Pacrypt.D Trojan.PornoBlocker!0B81yxGeAIw Trojan.Win32.Waprox W32/Zbot.RO!tr


A backdoor also known as: Trojan.VBS.UAJ Trojan.VBS.UAJ Win32.Trojan.WisdomEyes.16070401.9500.9853 Trojan.VBS.UAJ Vbs.Trojan.Vbs.Ljjs Trojan.VBS.UAJ Trojan.VBS.UAJ Trojan.DownLoader19.25627 BehavesLike.Win32.Downloader.qh Trojan.Barys Trojan.MSIL.amcc Trojan.VBS.UAJ Trojan.VBS.UAJ Trojan.MSIL.Zapchast VBS/Shutdown.NAH


A backdoor also known as: RTKT_SMALL.NLA RTKT_SMALL.NLA Trojan.Win32.Small.dplckv Adware.AdLoad.Win32.8710 BehavesLike.Win32.PUPXAX.lc Trojan.Zusy.D2BE63 Rootkit.Small!rTi0K4xzlKc


A backdoor also known as: W32.VodyDmpA.Worm Trojan/W32.Small.9265 RiskWare.Tool.CK Trojan/Pakes.c Win32.Trojan.WisdomEyes.151026.9950.9983 W32/Trojan.WZX TROJ_PAKES.JV Virus.Win32.Xorer.a Trojan.Win32.Pakes.bovph Trojan.Win32.Pakes.9261[h] Trojan.Dropper/Packed Win32.Virus.Xorer.Pkqs TrojWare.Win32.Patched.KSU Trojan.Rox Virus.Xorer.Win32.101 TROJ_PAKES.JV BehavesLike.Win32.Downloader.zc W32/Trojan.YUJV-5997 W32/Pakes.C!tr W32.Xorer.a!c Win-Trojan/Pakes.9265 Trojan.Pakes Virus.Win32.Xorer Clicker.BEHT


A backdoor also known as: W32.GamesonTBDll1.Trojan Trojan.PWS.OnlineGames.ZLU Trojan-PWS/W32.WebGame.229376.BS Trojan.Tilcun.B7 Trojan.PWS.OnlineGames.ZLU Trojan/OnLineGames.arus TSPY_ONLINEG.FGF Win32.Trojan-PSW.OLGames.cc Infostealer.Gampass TSPY_ONLINEG.FGF Win.Spyware.45047-2 Trojan.PWS.OnlineGames.ZLU Trojan.PWS.OnlineGames.ZLU Trojan.Win32.OnLineGames.bemmm Trojan.Win32.PSWIGames.229376.Q Trojan.PWS.OnlineGames.ZLU TrojWare.Win32.PSW.OnLineGames.NOA Trojan.PWS.OnlineGames.ZLU Trojan.PWS.Gamania.11506 BehavesLike.Win32.Downloader.dh Trojan.Win32.Tilcun TR/Tilcun.B Win32.Troj.OnlineGameT.na.218624 Trojan.PWS.OnlineGames.ZLU Troj.GameThief.W32.OnLineGames.arus!c Trojan/Win32.OnlineGameHack.R2107 PWS-OnlineGames.br BScope.Trojan-PSW.Gomex.22 Win32/PSW.OnLineGames.NOA Win32.GamePsw.OnlineGame.bscx W32/OnLineGames.AKLO!tr.pws


BlackMoon Trojan is a banking trojan that is designed to phish user credentials from various South Korean banking institutions.


A backdoor also known as: Trojan.Script.9271 BAT.Trojan.KillFiles.h Win.Worm.530490-1 BAT.Conwonk BehavesLike.Win64.Downloader.qh BAT/KillWin.NAR Trojan.BAT.KillWin BAT/KillWin.NAR!tr


A backdoor also known as: Trojan.Patched.Shopperz.1 Trojan.DllPatcher.A6 PTCH64_NOPLE.SM Trojan.Mentono!inf PTCH64_NOPLE.SM Trojan.Patched.Shopperz.1 Trojan.Win64.Patched.qw Trojan.Patched.Shopperz.1 Trojan.Patched.Shopperz.1 Trojan.Hosts.37524 Trojan.Patched.Shopperz Trojan/Win64.Patched.ap Trojan.Patched.Shopperz.1 Trojan.Win64.Patched.qw W64/Patched.AP!tr Win32/Trojan.133


A malicious Word document targeting Mac users.


It also targets Ahnlab by killing processes and deleting files specific to the software.


BlackTech is a cyber espionage group operating against targets in East Asia, particularly Taiwan, and occasionally, Japan and Hong Kong.


A backdoor also known as: Trojan.Affpach.A4 Trojan.Graftor.D6130 Win32.Trojan.StartPage.a W32/Trojan2.NTSB TROJ_SPNR.30BF13 Trojan.Win32.AVKill.bfnuts Trojan.Win32.Inject.tja Trojan.AVKill.27746 TROJ_SPNR.30BF13 W32/Trojan.ZXAC-7369 Variant.Graftor.xm Win32/StartPage.OKV Trojan.StartPage!m0gBcMRinXU Trojan.Hijacker W32/StartPage.OKV!tr


Threat Actors TAs employ sophisticated techniques to create phishing websites that are designed to appear legitimate and attractive to users.


BianLian continues to exhibit a high level of operational security and skill in network penetration, seeming to have also found their stride in the pace of their operations.


A backdoor also known as: VEX8687.Webshell Backdoor.PHP.RST.H HTML.BackDoor.A Backdoor.Php.Rst!c PHP.Backdoor.WebShell.al PHP/Rst.H PHP.RSTBackdoor PHP/Small.NAL PHP_R57SHELL.SM Win.Trojan.R57-2 Script.Trojan.PHPShellRST.A Backdoor.PHP.RST.H Trojan.Html.Rst.bgzarv PHP.S.Rst.87741 Backdoor.PHP.RST.H Backdoor.PHP.Rst.~BBA Backdoor.PHP.RST.H PHP.R57Shell.12 PHP_R57SHELL.SM PHP/Rst.H PHP/Rst.H.95982 Backdoor.PHP.RST.H PHP/Rst.A Backdoor.PHP.r57Shell.A BPX.Shell Backdoor.PHP.Rst.ai Php.Backdoor.Rst.Ssgx PHP.RST.G Trojan.PHP.Rst PHP/Rst.AI!tr php.script.c99shell.6


Symantec first reported on this group back in January 2017, detailing their operations and using a custom information stealing Trojan called ISMDoor.


A backdoor also known as: W32/Adware.AMRL Trojan.DownLoader22.55869 BehavesLike.Win32.Worm.th W32/Adware.OAXQ-2836 Worm:Win32/Imafly.AC Trojan.Strictor.D19956 Trojan/Win32.Cosmu.R158790 Win32/Autoit.LH Worm.Win32.AutoIt W32/Autoit.EQP!tr


A backdoor also known as: W32.FakeW7Folder.Fam.Trojan Worm.Goldrv.A7 Trojan-Ransom.Win32.Blocker.jaic Trojan.Win32.Dapato.dbzcxx W32.Virut.lMey Trojan.Win32.Dapato.a TrojWare.Win32.Dapato.DFS Trojan.DownLoader11.18798 Trojan-Dropper.Win32.Dapato TrojanDropper.Dapato.peb Trojan[Dropper]/Win32.Dapato Worm:Win32/Goldrv.A Trojan-Ransom.Win32.Blocker.jaic HEUR/Fakon.mwf Trojan-Ransom.Blocker Backdoor.Bot W32/Dapato.EDU!tr Win32/Trojan.df8


The malware used in this campaign has similar features to that distributed earlier in 2017 with the following changes: A new decoy document copy/pasted from an article published on the 3rd of July by Yonhap News Agency in Korea;


The Computer Incident Response Center Luxembourg CIRCL has recently uncovered malicious files attached to an email through the use of Pandora Document and File Analysis.


New variant of the Android rootnik malware that disguises itself as a legal app.


Using google translate, I found that the language is Armenian and translates to The Law on Banks and Banking 27.07.2015.doc VirusTotal intelligence spotted the decoy in the wild as an email attachment with the subject name Law changes which gave me a suspicion that the attempt was made to specifically target the employees of Central bank of Armenia.


Everything started from a well edited Italian language email given to me from a colleague of mine, thank you Luca! reaching out many Italian companies.


BEBLOH is a banking Trojan that has been around since as early as 2009.


The actor utilizes spear phishing campaigns to deliver NetTraveler, also known as TravNet.


A backdoor also known as: Backdoor/W32.PcClient.409260 Trojan.Pincav.9356 Backdoor.PcClient.Win32.5 Backdoor/PcClient.alqk Trojan.Buzy.D10B5 W32/Backdoor.MMJP-0040 Backdoor.Trojan Trojan.Win32.PcClient.ihgd Trojan.MulDrop3.45818 Backdoor.Win32.PcClient W32/Backdoor2.FUIH Trojan:Win32/Wisp.A BDS/Pcclient.alqk Trojan[Backdoor]/Win32.PcClient Backdoor.Win32.A.PcClient.386732 Trojan/Win32.PcClient.R55121 Backdoor.PcClient Backdoor.PcClient!4LPCxDv4AHg Win32/Backdoor.851


A backdoor also known as: Trojan.Mauvaise.SL1 BehavesLike.Win64.MysticCompressor.ch Trojan:Win64/Jifcapi.A Win32/Trojan.03e


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.PWS.Steam.12700 BehavesLike.Win32.Trojan.bc TR/Dropper.MSIL.dhgqe Spyware.AzorUlt Trj/GdSda.A Trojan.MSIL.Krypt MSIL/Kryptik.MPY!tr


A backdoor also known as: W32.AlustinH.Trojan Trojan.Diacam.KL3 Trojan.VB.Win32.96905 Trojan/VB.qms TROJ_DIACAM_BK0846C6.TOMC Win32.Trojan.WisdomEyes.16070401.9500.9992 TROJ_DIACAM_BK0846C6.TOMC Win.Trojan.Mokes-11 Trojan.Win32.Dwn.coomze TrojWare.Win32.VB.QMS Trojan.DownLoader6.45576 Trojan/Jorik.glae Trojan/Win32.Mokes Trojan:Win32/Diacam.A Trojan.Symmi.D23C3 Win32.Trojan.VB.BE Trojan/Win32.VBKrypt.C161437 Trojan.Mokes Win32/VB.QMS Win32.VBCrypt W32/VBKrypt.MBSX!tr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Packed.16 Win32/Pigeon.AZTT Win.Trojan.Packed-77 Backdoor.Win32.Hupigon.oqk Trojan.Win32.Crypt.mkur Backdoor.Win32.Hupigon.412672.K Win32.Backdoor.Hupigon.cuda Packed.Win32.Klone.~KMF BackDoor.Pigeon.20533 Backdoor.Hupigon.Win32.100099 BehavesLike.Win32.Fujacks.fc Backdoor/Hupigon.af Win32.Troj.Klone.ab.389660 Trojan/Win32.Malpacked5.R134022 Trojan-Dropper.Kaos Trojan.Win32.Pincav


In some cases, it appeared to be a single use domain shadowing which is incredibly difficult to stop by using blacklisting.


A backdoor also known as: Trojan.Heur.VP.ED105D0 Win32.Trojan.WisdomEyes.16070401.9500.9911 Trojan.MulDrop4.19536 BehavesLike.Win32.VBObfus.nt TR/Spy.36864.1691 Win32/VB.OIX


Since our first published analysis of the OilRig campaign in May 2016 Unit42 has continued to monitor this group for new activity.


A backdoor also known as: Trojan-Dropper.Win32.Dapato!O Trojan.Symmi.D6404 Win32.Trojan.WisdomEyes.16070401.9500.9991 Trojan-Dropper.Win32.Dapato.buqu Trojan.Win32.Dapato.bcmajb Trojan.DownLoader7.19485 BehavesLike.Win32.BadFile.mm W32/Trojan.IAVK-8796 TrojanDropper.Dapato.mbp TR/Dapato.AG Win32.Troj.Dapato.bu.kcloud Trojan:Win32/Omdork.A Trojan-Dropper.Win32.Dapato.buqu Trojan/Win32.Inject.R46970 Trojan.Win32.Swisyn W32/Dapato.B!tr


More and more we've been seeing references to a malware family known as FormBook.


A backdoor also known as: W32.HfsAdware.6632 PUP.Optional.Nosibay TROJ_GE.FF4D51A5 Adware.Downware.11318 virus.win32.sality.at PUA/BubbleDock.A PUP.Nosibay/Variant NSIS.Application.SilentInstaller.A Win32.Trojan.Bubbledock.Huzb


These apps are not hosted inside the Google Play store, but are distributed via third party distribution mechanisms in China.


A backdoor also known as: W32.eHeur.Virus02 Trojan.PWS.Banker1.23807 TR/Crypt.ZPACK.qkbzo Trojan:Win32/Ahriynoteemo.A Trojan-Spy.Win32.Noon Trj/CI.A Win32/Trojan.1fa


A backdoor also known as: W32.FakeW7Folder.Fam.Trojan Trojan.Mauvaise.SL1 Trojan.Skeeyah W32.SillyFDC Trojan.Win32.Bulknet.eljnif TrojWare.Win32.Imwee.A Trojan.DownLoader11.19812 Trojan.Zusy.D38629 TrojanDownloader:Win32/Gratem.A HEUR/Fakon.mwf Trj/Downloader.WKR


A worm Madang infects files across all drives, and installs itself as serverx.exe


A backdoor also known as: W32.MosquitoQKB.Fam.Trojan Trojan.Kryptik.Win32.93516 Trojan/Kryptik.kuf BKDR_QAKBOT.SMG Win32.Trojan.WisdomEyes.16070401.9500.9999 BKDR_QAKBOT.SMG Win.Trojan.5453446-1 Trojan-Ransom.Win32.Gimemo.dtt Trojan.Win32.Crypted.efbdjj Trojan.Packed.21485 BehavesLike.Win32.HLLP.dc Trojan:Win32/Dishigy.B Trojan-Ransom.Win32.Gimemo.dtt Trojan/Win32.Zbot.R2835 Trojan.Flasher.xr Worm.Win32.Slenfbot


This attack was specifically targeting a well-known financial services firm.


Cmstar was named for the log message CM**' used by the downloader.


A backdoor also known as: Backdoor.ASP.Ace.B Backdoor.ASP.Ace.B ASP/Ace.C Backdoor.Trojan Ace.B HTML_Haiyasp.a Backdoor.ASP.Ace.b Backdoor.ASP.Ace.B Backdoor.ASP.Ace.b Backdoor.ASP.Ace.B BDS/ASP.Ace.E HTML_Haiyasp.a Backdoor/ASP.Ace.b Backdoor/ASP.Ace Backdoor:ASP/Ace.B Backdoor.ASP.Ace.B ASP/Ace.C Backdoor.ASP.Ace.b Backdoor.Trojan ASP/Ace.B Script.haiyang.a Bck/Ace.B


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.NtRootKit.bozxzq TrojWare.Win32.Rootkit.Festi.AA Trojan.NtRootKit.15667 BehavesLike.Win32.Dropper.mm Trojan.Win32.Rootkit Trojan[Rootkit]/Win32.Tent TrojanDropper:Win32/Festi.C SScope.Trojan.CLR.18907 W32/Rootkit_Festi.AA


In-depth reverse engineering revealed the APK contained an Android variant of X-Agent, the command and control protocol was closely linked to observed Windows variants of X-Agent, and utilized a cryptographic algorithm called RC4 with a very similar 50 byte base key.


A backdoor also known as: Trojan-Ransom.Win32.Cidox!O Trojan/Cidox.bpa TROJ_VUNDO.SMFQ Win32.Trojan.WisdomEyes.16070401.9500.9988 TROJ_VUNDO.SMFQ Trojan.Win32.Mayachok.esnzar Trojan.Mayachok.1 Dropper.Cidox.Win32.14633 BehavesLike.Win32.PUPXDR.ph Trojan-Dropper.Win32.Cidox Trojan.Symmi.DD688 TrojanDownloader:Win32/Vundo.HIY Trojan/Win32.Cidox.R20237 Trojan-Ransom.Cidox.1212 Win32/Trojan.1b7


A backdoor also known as: W32.Virut.G W32/Trojan3.ATP W32.Virut.CF W32/Virut.BS Win32/Virut.17408 PE_VIRUX.A-3 Virus.Win32.Virut.ce Win32.Virut.AM Virus.Win32.Virut.Ce Win32.Virut.56 PE_VIRUX.A-3 Heuristic.BehavesLike.Win32.ModifiedUPX.J Win32/Virut.bn Win32.Virut.nd.53248 Virus:Win32/Virut.BN Win32/Virut.F W32/Trojan3.ATP Virus.Virut.06 Win32/Virut.NBP Win32.Obduran.a W32/Sality.AO


It then uses open-sourced Android root exploit tools to gain root access on an Android device.


The actors weaponized the delivery document to install a variant of the 9002' Trojan called 3102' that heavily relies on plugins to provide functionality needed by the actors to carry out on their objectives.


Spearphishes impersonating RAND


KeyRaider targets jailbroken iOS devices and is distributed through third-party Cydia repositories in China.


The malware, dubbed CopyCat by researchers, uses a novel technique to generate and steal ad revenues.


The criminal gangs of the Carbanak/FIN7 syndicate have been attributed to numerous intrusions in the banking, hospitality, retail and other industrial verticals, collecting financial information of all kinds.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 LNK/Trojan.XMFH-4 Worm.Win32.AutoIt.aku Worm.W32.Autoit!c LNK_DORKBOT.SMF Trojan/Win32.Autoit Trojan.Autoit.DHZ Worm.Win32.AutoIt.aku Trojan:Win32/Chinqincin.A Win32.Worm.Autoit.Lndx Trj/CI.A Win32/Trojan.1e1


However, only the Georgian language portion of the website was impacted and used in an effort to distribute malware.


A backdoor also known as: Heur.Win32.Veebee.1!O Trojan.Dyname.r3 Trojan.Dropper Trojan.VB.Win32.118717 Trojan.VB!K6eQMCc/nZg Trojan.Win32.VB.ckbb Worm.Win32.WBNA.ROC TR/Dynamer.dtc.17594 W32/Trojan.MKPV-4364 Trojan/Win32.VB Trojan.VB Win32/AutoRun.VB.BDM Trojan-Banker.Win32.Bancos W32/VB.CKBB!tr


A backdoor also known as: W32.eHeur.Virus02 Trojan/W32.Cobalt.196608 Trojan.Conbea Win.Tool.CobaltStrike-6336852-0 HackTool.Win32.Cobalt.k Trojan.Win32.Cobalt.egtrej BackDoor.Meterpreter.42 BehavesLike.Win32.Backdoor.ch HackTool.CobaltStrike HackTool/Win32.Cobalt Trojan.Application.HackTool.CobaltStrike.1 HackTool.Win32.Cobalt.k HackTool/Win32.Cobalt.R197271 TrojanDownloader.Agresbeak RiskWare.HackTool Riskware.HackTool!t96XHdFe7u4 W32/CobaltStrike_Beacon.A!tr Win32/Application.Hacktool.e79


A backdoor also known as: Trojan.Graftor.D1A90 Win32.Trojan.Kryptik.afz Trojan.Proxy2.1039 BehavesLike.Win32.BadFile.lc Trojan-Dropper.Win32.Injector TR/Obfuscated.sarli Trojan:Win32/Riern.M TScope.Malware-Cryptor.SB Win32/Trojan.Downloader.9c1


Talos has named this malware KONNI.


A backdoor also known as: Application.MiniFtp.A Server-FTP.Win32.MiniFTP!O Backdoor.Banito.Win32.283 Backdoor/Banito.nk Application.MiniFtp.A Win32.Trojan.WisdomEyes.16070401.9500.9964 W32/VirTool.CJ Win.Trojan.Miniftp-1 Application.MiniFtp.A not-a-virus:Server-FTP.Win32.MiniFTP.c Application.MiniFtp.A Trojan.Win32.Banito.xnaq Backdoor.Win32.Banito.81920[h] Application.MiniFtp.A Backdoor.Win32.Banito.nk0 BackDoor.Bandito.2207 W32/Tool.XUIH-6856 Hacktool.Miniftp APPL/MiniFTP.A RiskWare[Server-FTP]/Win32.MiniFTP.c Backdoor.W32.Banito.lx25 Backdoor:Win32/Shesmi.A Unwanted/Win32.MiniFTP.R63415 Backdoor.Sdbot!9v31gLa9+gE Backdoor.Win32.Formador.b W32/FTPMini.A!tr Bck/Formador.B Win32/Backdoor.662


This pulse includes indicators from this analysis, and indicators from other campaigns that employ related malware.


We refer to this group of attackers as Moonlight, after the name the attackers chose for one of their command-and-control domains.


A backdoor also known as: Trojan.Endowerpo Win32.Trojan.WisdomEyes.16070401.9500.9987 Backdoor.Industroyer Win32.Backdoor.Industroyer.F Trojan.Win32.Industroyer.c Trojan.Win32.Industroyer.136704.A Trojan.Industroyer.5 Trojan.Industroyer.Win32.3 Trojan.Industroyer.b Trojan.Win32.Industroyer.c Trojan:Win32/CrashOverride.A Trojan/Win32.Industroyer.R202380 Trojan.Industroyer Trojan.Industroyer!


A backdoor also known as: Trojan.Downloader.Delf.RAN Downloader.Delf.Win32.2328 Trojan.Downloader.Delf.RAN W32/Trojan2.JVAP Downloader.MisleadApp Win.Trojan.Adpclient-2 Trojan.Downloader.Delf.RAN Trojan.Win32.Delf.crqcbd Troj.Downloader.W32.Delf.spu!c Trojan.Downloader.Delf.RAN TrojWare.Win32.TrojanDownloader.Murlo.~JH2 Trojan.Downloader.Delf.RAN Trojan.DownLoad.32205 Trojan.Win32.Adpclient Trojan.Downloader.Delf.RAN Trojan/Win32.Xema.C73230 Trojan.Downloader.Delf.RAN Trojan.DL.Delf!ywDF9K4Uqh8 Trojan/Win32.lssj.2cc.rgrk


The SLocker family is one of the oldest mobile lock screen and file-encrypting ransomware and used to impersonate law enforcement agencies to convince victims to pay their ransom.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 BAT/Runner.AV BehavesLike.Win32.Downloader.hh


A backdoor also known as: TrojanDownloader:MSIL/Faksost.B!bit


A backdoor also known as: Exploit.Win32.Servu!O Exploit.Win32.Servu.ab Exploit.Win32.Servu.dxeal Exploit.W32.Servu.ab!c Win32.Trojan.Inject.Auto Trojan.Starter.973 Exploit.Servu.Win32.15 Muster.c Trojan:Win32/Cryptrun.A W32/ServU.AB!exploit Trojan[Exploit]/Win32.Servu Trojan.Win32.Exploit.45056[h] Exploit.Win32.Servu.ab Trojan:Win32/Cryptrun.A Muster.c Exploit.Servu Exploit.Servu!ffzFcMCTx/E Exploit.Win32.Servu Exploit.DUB Trj/ServU.GM


We analysed the XData code and found two host-based kill-switches one of them is about detecting an antivirus running on an infected machine.


There's no vulnerability involved.


More recently, we have also seen an increase in activity targeting Ukraine.


The victims include establishments in the United States, Canada, Europe, Middle East, and Latin America.


These attacks, which occurred in November 2016 and January 2017, reportedly affected thousands of computers across multiple government and civil organizations in Saudi Arabia and elsewhere in Gulf states.


Our findings show that Rocket Kitten is still active, retains a growing level of persistence, and acts ever more aggressively in terms of attack method.


A backdoor also known as: Trojan/W32.StartPage.311296.F Trojan.Senphiv.A W32/MalwareS.ZPG VBDloader.E TROJ_DLOAD.SMT Trojan.Win32.StartPage.fss TrojWare.Win32.Pincav.IAD TROJ_DLOAD.SMT TrojanDownloader:Win32/Senphiv.A Downloader/Win32.VB W32/Risk.QGTQ-7423 Trojan-Downloader.Win32.Senphiv W32/StartPage.CTK!tr Trj/StartPage.DAW


Category: Unit 42 Tags: CVE-2012-0158, Downloader, QuasarRAT, Subaat


Analysis of this malware is presented to provide the computer network defense CND community with indicators of this malware.


A backdoor also known as: Hoax.Win32.BadJoke!O W32/Cietas.B@MM Win.Joke.Bomov-1 Hoax.Win32.BadJoke.Cierrame Riskware.Win32.Cierrame.hpzm Joke.Win32.Cierrame.A Trojan.Tetas Backdoor.PePatch.Win32.18825 not-virus:Joke.Win32.Cierrame HackTool[Hoax]/Win32.Cierrame Win32.Joke.Cierrame.kcloud Hoax.Win32.BadJoke.Cierrame Win-AppCare/Badjoke.274432 Win32/Cierrame.A Win32.Trojan-psw.Badjoke.Ajbz Hoax.Win32.BadJoke.Cierrame


Operation Armageddon, active since at least mid-2013, exposes a cyber espionage campaign devised to provide a military advantage to Russian leadership by targeting Ukrainian government, law enforcement, and military officials in order to steal information that can provide insight into near term Ukrainian intentions and plans.


That method relied on enterprise certificates from Apple—which are costly, since the certificates needed are changed very frequently.


A backdoor also known as: W32.HfsAutoB.316D Trojan/Buzus.yca W32/Trojan2.EHHN Win.Trojan.Buzus-3134 Trojan.Win32.Buzus.bohnlg Trojan.Packed.650 BehavesLike.Win32.Ramnit.tc W32/Trojan.ACNM-2721 Troj.W32.Buzus.yca!c Trojan/Win32.Buzus.C104217 Trojan-PWS.Win32.IMMultiPass Win32/Application.1b1


A backdoor also known as: Trojan.Application.Alphaeon.4 Win32.Trojan.WisdomEyes.16070401.9500.9952 Trojan.Proxy2.1030 BehavesLike.Win32.AdwareConvertAd.gh Trojan:Win32/Vkhost.B


A backdoor also known as: W32.HaluosysLTU.Trojan Trojan-Spy/W32.ZBot.358400.V Trojan.Buzus.Win32.114137 Trojan/Spy.Zbot.aao Win32.Trojan.WisdomEyes.16070401.9500.9607 Trojan.Win32.Winlock.cqkdnb TrojWare.Win32.Injector.AHSP Trojan.Winlock.8004 TrojanSpy.Zbot.diqw Trojan/Win32.Buzus TrojanDownloader:Win32/Dimegup.A Trojan/Win32.Zbot.R69076 TScope.Malware-Cryptor.SB Win32/Spy.Zbot.AAO TrojanSpy.Zbot!SJBAuE7A31M Trojan.Win32.Ransom


A backdoor also known as: Trojan-Downloader.Win32.Small.aggy Trojan-Downloader.Win32.Small.aggy DLOADER.Trojan TrojanDownloader:Win32/Yellsob.A Trojan.PSW.Win32.GameOL.tbi


A backdoor also known as: Trojan.Perseus.MSIL Trojan.Ransomcrypt.AE TR/Samas.orhr Trojan.MSILPerseus.D4B2D Ransom:MSIL/Samas.A Trj/GdSda.A Trojan.MSIL.Filecoder


A backdoor also known as: Trojan.KryptikCRTD.Win32.11290 Trojan.Dropper.166 Win32.Trojan.WisdomEyes.16070401.9500.9769 Trojan.Win32.Dapato.enqgpq Win32.Trojan.Kryptik.Pdwn TrojWare.Win32.Spy.Tewgol.A BackDoor.Radmin.150 W32.Trojan.Dropper TR/Fuery.znvrd Dropper/Win32.Dapato.C1935389 Malware-Cryptor.Limpopo Trj/CI.A


WithSecure has revealed the latest details of the DUCKTAIL malware operation, which was previously described by Deep Instinct Threat Lab as a strategic threat that was being tested to avoid detection.


Website owners find the classical blog format too restrictive, use the plugin to add custom elements to their posts.


A backdoor also known as: Trojan-Dropper.Win32.SennaOneMaker!O TROJ_SENNAONEMAKER_0000000.TOMA Win32.Trojan.RSP.b W32/Trojan.FIW Backdoor.SubSeven Win32/RSP.A TROJ_SENNAONEMAKER_0000000.TOMA Win.Trojan.Win-52 Trojan.Win32.SennaOneMaker.dxcclv Backdoor.Win32.HostCtrl.253674 TrojWare.Win32.RSP.A Trojan.MulDrop.8 W32/Trojan.UUJQ-7044 TrojanDropper.Win32.RSP.a TR/Multidropper.A Trojan[Dropper]/Win32.SennaOneMaker Win32.Troj.RSP.a.kcloud Troj.Dropper.W32.SennaOneMaker.lcEu TrojanDropper:Win32/SennaOneMaker.A Dropper/SennaOneMaker.6556 TrojanDropper.SennaOneMaker Trj/Sennaonemaker.B Trojan.DR.SennaOneMaker!laIkEqmRI+A W32/SennaOneMaker.V20!tr.dr


Further research revealed a connection between these attacks and members of the so-called Gaza Hackers Team. We refer to this campaign as Molerats.


A backdoor also known as: virus.office.qexvmc.1075


A backdoor also known as: W32/VB.aaa W32/MalwareF.JYOH Spyware.Keylogger Trojan.Win32.VB.butwpn W32.W.VB.aaa!c Win32.Worm-im.Vb.Pbfr W32/Retomo.worm W32/Risk.KAPY-3991 Trojan:Win32/Kxhack.B WORM/VB.aaa Trojan:Win32/Kxhack.B W32/Retomo.worm Worm.VB!zIluMBtcaN8 IM-Worm.Win32.VB W32/Retomo.AAA!worm.im Win32/Worm.cc6


A backdoor also known as: W32.OnGamesLT250912NLAJIR.Trojan Rootkit.Win32.TDSS!O Trojan.Fsysna Trojan/TDSS.rhu TSPY_DOWNLOADER_BK220264.TOMC Win32.Trojan.WisdomEyes.16070401.9500.9999 Infostealer.Gampass TSPY_DOWNLOADER_BK220264.TOMC Win.Downloader.Pangu-2 Trojan.Win32.Fsysna.epjv Trojan.Win32.TDSS.bkqey Trojan.Win32.Tdss.37888.H Troj.W32.Fsysna!c BackDoor.Tdss.3314 Rootkit.TDSS.Win32.3904 BehavesLike.Win32.Msposer.nh Trojan/DDos.af W32.Malware.Downloader Trojan[Rootkit]/Win32.TDSS Win32.TrojDownloader.wk.kcloud Trojan.Symmi.D1492 Trojan.Win32.Fsysna.epjv TrojanDownloader:Win32/Mypo.A Trojan/Win32.Tdss.C50395 Rootkit.TDSS Win32.Trojan.Fsysna.Hros Rootkit.TDSS!r3YXF8ZrJBY W32/TDSS.RHU!tr.rkit Win32/Trojan.f75


Instead of ALL American spam recipients receiving the malware, however, only those whose email ends in the country code .us received this malware.


A backdoor also known as: W32.WsExplorer.Worm Virus.Win32.VB!O W32/Autorun.worm.h Win32.Trojan.VB.c Infostealer.Gampass Win32/Jampork.D WORM_VB.DVP Virus.Win32.VB.bu Virus.Win32.VB.unsvo Trojan.Win32.PSWIGames.36864.M Virus.VB.Win32.87 WORM_VB.DVP BehavesLike.Win32.VBObfus.cz Trojan/PSW.Jianghu.ei W32/VB.BU Virus/Win32.VB.bu Trojan.Heur.EED21E7 W32.VB.tngk Virus.Win32.VB.bu Worm:Win32/Jampork.A Trojan/Win32.OnlineGameHack.R868 TScope.Trojan.VB W32/VB.ADO Trojan.Win32.VB.mss Virus.Win32.VB.bu W32/VB.BU!tr Win32/Worm.VB.V


A backdoor also known as: W32.eHeur.Virus02 Virus.Win32.Sality!O Win32/TrojanDownloader.AutoHK.AN BackDoor.Bladabindi.13678 BehavesLike.Win32.Downloader.fc Trojan-Downloader.Win32.Autohk Trojan.Reconyc.eur TR/AD.AhkDldr.tstej Trojan/MSIL.Disfa TrojanDownloader:Win32/AutoHK.A!bit Trojan.Cossta


This could be an indicator of the massive cyber attack preparation before the National Holidays in Ukraine.


Once clicked, an attacker can use the embedded code for various malicious purposes, such as stealing data or installing ransomware on victims' systems.


A backdoor also known as: Backdoor.IRCBot W32.Spybot.Worm Win.Exploit.Fnstenv_mov-1 BehavesLike.Win32.Downloader.mc W32.Hack.Tool EXP/MS06-040.B HackTool:Win32/Lpdexpl.A Backdoor.IRCBot Trj/CI.A Exploit.MS05-017!2vyTKSxF9zk Win32/Trojan.Exploit.8b7


Security firm Kaspersky has published a new blog regarding a backdoor that was deployed through the supply chain attack on 3CX, in combination with an info-stealer.


A backdoor also known as: W32.TisroparLTAAH.Trojan Trojan.Ruandmel Trojan.Heur.FU.E2E781 Win32.Trojan.WisdomEyes.16070401.9500.9922 TROJ_GAUDOX.SM TrojWare.Win32.Ruandmel.AG Trojan.Inject2.57861 TROJ_GAUDOX.SM BehavesLike.Win32.Trojan.kh TrojanDropper.Injector.bkgu Trojan:Win32/Ruandmel.A!bit Trojan/Win32.Dynamer.C1318203 Hoax.Blocker Trojan.MalPack Trojan.Blocker!KJVutD4QUXc


Of these, SeaDuke is a simple trojan made interesting by the fact that it's written in Python.


A backdoor also known as: Trojan/W32.RepakMiner.94720 Trojan.CoinMiner.Win32.220 Trojan/CoinMiner.ej Win32.Trojan.WisdomEyes.16070401.9500.9936 Trojan.Win32.RepakMiner.pgm Trojan.Win32.RepakMiner.csnwjo Win32.Trojan.Repakminer.Pezd Trojan.BtcMine.119 Trojan/RepakMiner.c Trojan/Win32.RepakMiner Trojan:Win32/Tarcloin.G Trojan.Zusy.DEA69 Trojan.Win32.RepakMiner.pgm Trojan/Win32.RepakMiner.C189719 Trojan.RepakMiner Win32/CoinMiner.EJ


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_GE.B172C45D Win.Trojan.Autorun-15347 Worm.Win32.AutoRun.cgfw Trojan.Win32.AutoRun.gzlvd Worm.W32.Autorun!c Trojan.MulDrop4.47 TROJ_GE.B172C45D BehavesLike.Win32.Dropper.tc Worm.Win32.Honditost Worm/AutoRun.allw Worm/Win32.AutoRun Worm:Win32/Honditost.A Worm.Win32.AutoRun.cgfw Worm.AutoRun Worm.AutoRun!5JHcPe4YmAc


A backdoor also known as: Worm.P2p.Vance.A Worm.Vance.Win32.2 W32/Vance.a WORM_VANCE.T Win32.Trojan.WisdomEyes.16070401.9500.9978 W32/P2PWorm.DU W32.SillyP2P WORM_VANCE.T Worm.P2p.Vance.A P2P-Worm.Win32.Vance.a Worm.P2p.Vance.A Trojan.Win32.Vance.eofq W32.W.Vance.a!c Worm.P2p.Vance.A Worm.P2p.Vance.A Win32.HLLW.Vance Worm.Win32.Vance W32/P2P_Worm.XQZJ-6276 Worm/Vance.c Worm:Win32/Vance.A WORM/Vance.A Worm[P2P]/Win32.Vance Worm.P2p.Vance.A P2P-Worm.Win32.Vance.a Worm:Win32/Vance.A Worm.P2p.Vance.A Worm.Vance Trj/CI.A Win32/Vance.A Win32.Worm-p2p.Vance.Svrm Worm.P2P.Vance!6yBrY3ioCyI W32/Vance.A!worm.p2p


The operation is very quick and quiet.


Bedep was known to be the notorious ad fraud malware and vawtrak is a banking trojan following the success of Zeus.


So far, the malware primarily affects iOS users in mainland China and Taiwan.


A Trojan for Linux that was named Linux.Mirai has several predecessors.


This spambot, commonly downloaded by the Andromeda malware, has been observed delivering pharmaceutical industry spam as well as further propagating the main Andromeda bot.


A backdoor also known as: Backdoor.Win32.Delf!O Backdoor.Delf.Win32.12791 W32/Backdoor.ZRKL-8278 Backdoor.Trojan Trojan.Win32.Delf.iuqg Win32.Backdoor.Delf.Sxnw Trojan.PWS.Banker.26677 Trojan-Spy.Banker W32/Backdoor2.CTBF Backdoor/Delf.hfo Trojan[Backdoor]/Win32.Delf Trojan:Win32/Braba.D Trojan.UserStartup.EB690C Trojan/Win32.Delf.R104794 TScope.Trojan.Delf


A backdoor also known as: Application.Downloader.ALJ Pua.Downloader Win32.Trojan.WisdomEyes.16070401.9500.9999 Application.Downloader.ALJ Application.Downloader.ALJ Trojan.Win32.Z.Downloader.179560 Application.Downloader.ALJ BehavesLike.Win32.Downloader.ch Application.Downloader.ALJ Application.Downloader.Alj!c Trj/CI.A Win32/Application.Downloader.dad


A backdoor also known as: Trojan-Ransom.Win32.Foreign!O Trojan.Foreign Win32.Trojan.WisdomEyes.16070401.9500.9823 Win32/Ransom.ANJ Ransom_Foreign.R039C0DKF17 Trojan-Ransom.Win32.Foreign.wy Troj.Ransom.W32!c Win32.Trojan.Foreign.Wqdm Trojan.DownLoad2.55226 Trojan.Foreign.Win32.208 Ransom_Foreign.R039C0DKF17 BehavesLike.Win32.Dropper.cc Trojan.Foreign.ays Trojan[Ransom]/Win32.Foreign Trojan.Graftor.D35EB Trojan.Win32.A.Foreign.142848[UPX] Trojan-Ransom.Win32.Foreign.wy Trojan:Win32/Ransirac.A Trojan/Win32.Foreign.R20679 Hoax.Foreign Trojan.Foreign!cDyTfOA7GhM Win32/Trojan.7b3


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32.Trojan.Spy.Eawf BehavesLike.Win32.Trojan.qm W32/Trojan.NEXM-1236 Trojan.MSILKrypt.4 TrojanSpy:MSIL/Fitin.A Trojan.MSIL.Spy Trj/GdSda.A Win32/Trojan.948


The Scarcruft Group aka APT37, a North Korean APT group, is believed to have been active since 2016 and continues to carry out attacks against institutions and political organizations around the world until 2023.


Further details in it reflect characteristics of Exodus ( such as the bypass of power managers we described from Exodus One , and more ) : Indicators of Compromise Exodus One 011b6bcebd543d4eb227e840f04e188fb01f2335b0b81684b60e6b45388d3820 0f5f1409b1ebbee4aa837d20479732e11399d37f05b47b5359dc53a4001314e5 2055584625d24687bd027a63bc0b8faa7d1a854a535de74afba24840a52b1d2f 26fef238028ee4b5b8da631c77bfb44ada3d5db8129c45dea5df6a51c9ea5f55 33a9da16d096426c82f150e39fc4f9172677885cfeaedcff10c86414e88be802 34d000ee1e36efd10eb37e2b79d69249d5a85682a61390a89a1b9391c46bf2ba 4f6146956b50ae3a6e80a1c1f771dba848ba677064eb0e166df5804ac2766898 5db49122d866967295874ab2c1ce23a7cde50212ff044bbea1da9b49bb9bc149 70e2eea5609c6954c61f2e5e0a3aea832d0643df93d18d7d78b6f9444dcceef0 80810a8ec9624f317f832ac2e212dba033212258285344661e5da11b0d9f0b62 8453ce501fee1ca8a321f16b09969c517f92a24b058ac5b54549eabd58bf1884 a37f5d2418c5f2f64d06ba28fe62edee1293a56158ddfa9f04020e316054363f db59407f72666526fca23d31e3b4c5df86f25eff178e17221219216c6975c63f e0acbb0d7e55fb67e550a6bf5cf5c499a9960eaf5f037b785f9004585202593b Exodus One Package Names com.phonecarrier.linecheck rm.rf operatore.italia it.offertetelefonicheperte it.servizipremium assistenza.sim assistenza.linea.riattiva assistenza.linea it.promofferte Exodus Two 64c11fdb317d6b7c9930e639f55863df592f23f3c7c861ddd97048891a90c64b a42a05bf9b412cd84ea92b166d790e8e72f1d01764f93b05ace62237fbabe40e Exodus Two ELF Utilities 00c787c0c0bc26caf623e66373a5aaa1b913b9caee1f34580bdfdd21954b7cc4 11499ff2418f4523344de81a447f6786fdba4982057d4114f64db929990b4b59 13ec6cec511297ac3137cf7d6e4a7c4f5dd2b24478a06262a44f13a3d61070b6 3c9f08b3280851f54414dfa5a57f40d3b7be7b73736fa0ba21b078e75ce54d33 3ee3a973c62ba5bd9eab595a7c94b7a26827c5fa5b21964d511ab58903929ec5 47449a612697ad99a6fbd6e02a84e957557371151f2b034a411ebb10496648c8 48a7dd672931e408662d2b5e1abcd6ef00097b8ffe3814f0d2799dd6fd74bd88 824ad333320cbb7873dc49e61c14f749b0e0d88723635524463f2e6f56ea133a b46f282f9a1bce3798faee3212e28924730a657eb93cda3824c449868b6ee2e7 c228a534535b22a316a97908595a2d793d0fecabadc32846c6d1bfb08ca9a658 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 e3f65f84dd6c2c3a5a653a3788d78920c0321526062a6b53daaf23fa57778a5f Command & Controls ad1.fbsba [ .


LOWBALL abuses the Dropbox cloud storage service for command and control CnC.


The initial infection vector in this attack is not clear, but it results in installing the Downeks downloader, which in turn infects the victim computer with the Quasar RAT.


A backdoor also known as: Trojan.Dropper.NSIS Trojan.Zbot.Win32.160494 Win32.Trojan.WisdomEyes.16070401.9500.9957 TROJ_SPNR.15AE15 Trojan-Spy.Win32.Zbot.sbfu Trojan.Win32.Zbot.dtpiom TrojWare.Win32.CnzzBot.DAQ Trojan.Fakealert.47485 TROJ_SPNR.15AE15 Trojan[Spy]/Win32.Zbot.sbfu Trojan-Spy.Win32.Zbot.sbfu TrojanSpy.Zbot W32/CnzzBot.A!tr


A backdoor also known as: W32.OnGameXEA.Trojan Trojan.Dropper.TJD Trojan.Dropper.TJD Trojan.Dropper.TJD Win32.Trojan.WisdomEyes.16070401.9500.9991 W32/Dropper.AYXX Trojan.Dropper.TJD Worm.Win32.AutoRun.gpog Trojan.Dropper.TJD Trojan.Dropper.TJD Trojan.Win32.Wimpixo Trojan:Win32/Wimpixo.B Trojan:Win32/Wimpixo.B Worm.Win32.AutoRun.gpog BScope.Trojan-Spy.Zbot


A backdoor also known as: Trojan-GameThief.Win32.OnLineGames!O Win32.Trojan.WisdomEyes.16070401.9500.9995 Win.Trojan.Mono-15 Trojan.Win32.OnLineGames.fcdid TrojWare.Win32.TrojanSpy.Pophot.d Trojan.PWS.Gamania.5803 BehavesLike.Win32.Ransom.lc Trojan/PSW.OnLineGames.kdn Win32.Hack.UpackT.a.15981 Trojan.Graftor.Elzob.D185D Troj.Heur.bmLerbcan7diu.moF3 Trj/Pupack.A Trojan.Win32.PSW Win32/Trojan.d9e


A backdoor also known as: Trojan.Win32.Elzob!O Trojan.Crastic.B Trojan.Heur.BmGfrb243Kiib W32.Imaut Trojan.Win32.Popuper.bfzygk Trojan.Popuper.42424 W32.Infostealer.Zeus HEUR/Fakon.mwf


A backdoor also known as: W32/Trojan.NFEP-4133 Trojan.DownLoader9.29630 DDoS:MSIL/Webxahr.A DDoS.MSIL.Webxahr W32/DoSAttack.C!tr Win32/RootKit.Rootkit.7e5


Dridex has evolved, and now Dridex V4 uses Atom Bombing to perform process injection.


A backdoor also known as: Trojan.Exploit.Vb.R Exploit.Vb Exploit.VB.Win32.18 Trojan.Exploit.Vb.R Win32/Exploit.VB.R TROJ_VB.JUC Trojan.Exploit.Vb.R Exploit.Win32.VB.r Trojan.Exploit.Vb.R Exploit.W32.VB.r!c Trojan.Exploit.Vb.R Trojan.Exploit.Vb.R Trojan.Win32.Exploit Hacktool.SQL.54NB.a TR/Expl.VB.R Trojan[Exploit]/Win32.VB HackTool:Win32/Echoload.A Exploit.Win32.VB.r Trojan.Exploit.Vb.R Exploit.VB Win32.Exploit.Vb.Wsjr Exploit.VB!P1jmyBXhN28 W32/VB.R!exploit Win32/Trojan.2ff


The Winter Vivern Advanced Persistent Threat APT is a pro-Russian cyber-espionage group that targets government and private businesses, including those involved in the ongoing war in Ukraine.


One of the command and control C2 servers that had been dormant for quite some time had suddenly woken up and started distributing what looks to be a new PoS malware family we're calling LockPoS.


Geopolitical analysts have suggested that the United States may have its own interests that involve thwarting Chinese ambitions in the region.


A backdoor also known as: Trojan/Kryptik.kqs Win32.Trojan.WisdomEyes.16070401.9500.9996 Tool.PassView.1838 Trojan.Kryptik.Win32.1246441 Worm.MSIL.Autorun Trojan.MSIL.Bladabindi.1 Trojan.MSIL.DOTHETUK Trj/CI.A Win32/Trojan.62b


A backdoor also known as: Backdoor.DarkKomet.Win32.23088 Trojan.Strictor.DF4F5 Win32.Trojan.WisdomEyes.16070401.9500.9970 Trojan.Win32.Zbot.deisvu Trojan.Hottrend.435 TR/Dropper.xzclg Trojan[Backdoor]/Win32.DarkKomet Trojan:Win32/Rombertik.C Backdoor.DarkKomet Trj/CI.A


A backdoor also known as: Trojan.Ocna Trojan.Win32.Ocna.k Trojan.OcnaCRTD.Win32.4895 TR/RemoteAdmin.tkpmq TrojanDropper:Win32/Jowbaki.A Trojan.Win32.Ocna.k Trojan.Ocna Trj/CI.A Win32/RA-based.AB Win32.Trojan.Ocna.Pgmm Win32/Trojan.388


I started by trying to find the sample that the blog post analyzed and I was able to find it submitted to the great sandboxing site of Hybrid Analysis Big Shutout to @PayloadSecurity for the great service.


A backdoor also known as: Trojan.ScriptKD.4274 Trojan.ScriptKD.4274 Trojan/Remtasu.f Win32.Trojan.WisdomEyes.16070401.9500.9859 W32/Trojan.QQOQ-8191 Trojan.ScriptKD.4274 Trojan.ScriptKD.4274 BehavesLike.Win32.Trojan.wc W64/Coinminer.N Trojan/Win32.Swisyn Trojan.ScriptKD.D10B2 Win32/CoinMiner.AFZ


The malware encrypts files and the boot record of hard disks, leaving behind a ransomware note.


A backdoor also known as: Trojan.EquationDrug Troj.W32.Equationdrug!c Win32.Trojan.WisdomEyes.16070401.9500.9689 Trojan.Win32.EquationDrug.evztli Trojan.Win32.Z.Equationdrug.102912 Trojan.EquationDrug.85 W32/Trojan.DLSV-8631 W32.Trojan.Equdrug TR/Dropper.bkecf Trojan/Win32.EquationDrug Trojan.EquationDrug.4 Trj/GdSda.A Win32.Trojan.Equationdrug.Pgmi Trojan.EquationDrug! Trojan.Win32.Equdrug Win32/Trojan.6ba


In February, the source code was reportedly leaked online, which likely spurred some of the recent changes we've observed in the kit.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9872 Bloodhound.Malautoit TR/AD.DelfInject.twazy Trojan:Win32/Regub.A Zum.Locky.1 Zum.Locky.1 Zum.Locky.1


A backdoor also known as: Trojan/Cossta.icp Trojan.Mikey.D12734 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Banker-13888 Virus.Win32.Lamer.kh Trojan.Win32.A.Cossta.65536.D Win32.Trojan.Cossta.bwce Trojan.DownLoader4.46980 BehavesLike.Win32.Downloader.ch Trojan/Cossta.bii Trojan/Win32.Cossta Win32.RabbitTail.b.2098552 Virus.Win32.Lamer.kh Trojan/Win32.Cossta.R23559 Trojan.Cossta Trojan.Win32.Cossta Win32/Trojan.ed9


This allowed NoMoreRansom to gain access to many of the decryption keys for the ransomware s victims.


To date, Sowbug appears to be focused mainly on government entities in South America and Southeast Asia and has infiltrated organizations in Argentina, Brazil, Ecuador, Peru, Brunei and Malaysia.


Recently, Palo Alto Networks researchers discovered an advanced Android malware we've named SpyDealer which exfiltrates private data from more than 40 apps and steals sensitive messages from communication apps by abusing the Android accessibility service feature.


A backdoor also known as: Hoax.Win32.ArchSMS!O Trojan.ArchSMS.Win32.178 Win32/FakeInstall.BH Win.Trojan.Archsms-882 HEUR:Hoax.Win32.ArchSMS.HEUR Riskware.Win32.ArchSMS.dqovc ApplicUnwnt.Win32.Hoax.ArchSMS.E Tool.SMSSend.117 Trojan-Banker.Win32.Banbra TR/Zen.C HackTool[Hoax]/Win32.ArchSMS Win32.Troj.Hoax.kcloud Trojan:Win32/Moxtrarch.A HEUR:Hoax.Win32.ArchSMS.HEUR Adware.VPets.121105 Hoax.ArchSMS!DSd5P3jaerI W32/ArchSMS.EF!tr


The Rilide stealer is a prime example of the increasing sophistication of malicious browser extensions and the dangers they pose.


The oldest sample we've seen up to now is from November 2013.


A backdoor also known as: Hacktool.Koobface Win32/Koobface.AKJ Trojan.Win32.Facebfr.cvvcfx Tool.Facebfr BehavesLike.Win32.Swisyn.kh SPR/HackFacebo.A Trojan.Kazy.DA8A0


A backdoor also known as: W32.Winupnemsys.Trojan Worm.Win32.Mefir!O Win32.Trojan.WisdomEyes.16070401.9500.9998 W32.SillyFDC Win32/Mefir.A Win.Worm.Autorun-316 Worm.Win32.Mefir.a Trojan.Win32.MLW.uvszt Worm.Win32.A.Mefir.143360 Win32.Virus.Mefir.Ectu Worm.Win32.Mefir.B Win32.HLLW.Autoruner.216 Worm.Mefir.Win32.3 Worm/Mefir.f Worm:Win32/Mefir.A Worm:Win32/Mefir.A Worm.Win32.Mefir.a W32/Mefir.A.worm Worm.Mefir!BwUbuvfvViU Worm.Win32.Mefir.a Win32/Trojan.d06


In the recent weeks, various anti-virus vendors and security researchers published blog posts on this threat, presenting their analysis and findings.


A backdoor also known as: Backdoor.Trojan BKDR_MANGZAMEL.B Trojan.Mangzamel.Win32.11 BKDR_MANGZAMEL.B BDS/Vedratve.zgxnw Backdoor:Win32/Vedratve.A!dha Trj/CI.A Win32/Backdoor.f40


A backdoor also known as: Trojan.Symmi.D13C10 Win32.Trojan.WisdomEyes.16070401.9500.9915 Trojan.Win32.Ekstak.ddqe Trojan.Win32.Ekstak.exahds Trojan.InstallCube.2631 PUA.ICLoader Pua.Downloadmgr Trojan:Win32/Spiltderp.A Trojan.Win32.Ekstak.ddqe Trojan/Win32.Ekstak.R217792 Trj/CI.A


A backdoor also known as: Exp.OLE.CVE-2009-3129.A Exploit.MSExcel.CVE-2009-3129.ccxskf Exploit.Excel.CVE-2009-3129 Downloader.OLE.HiddenEXE MSExcel/CVE_2009_3129.A!exploit Win32/Trojan.Exploit.19f


A second version 2.1-LNK with the network tag StrangeLove was discovered shortly after.


Appendix Samples Some of the latest Ginp samples found in the wild : App name Package name SHA-256 hash Google Play Verificator sing.guide.false 0ee075219a2dfde018f17561467272633821d19420c08cba14322cc3b93bb5d5 Google Play Verificator park.rather.dance 087a3beea46f3d45649b7506073ef51c784036629ca78601a4593759b253d1b7 Adobe Flash Player ethics.unknown.during 5ac6901b232c629bc246227b783867a0122f62f9e087ceb86d83d991e92dba2f Adobe Flash Player solution.rail.forward 7eb239cc86e80e6e1866e2b3a132b5af94a13d0d24f92068a6d2e66cfe5c2cea Adobe Flash Player com.pubhny.hekzhgjty 14a1b1dce69b742f7e258805594f07e0c5148b6963c12a8429d6e15ace3a503c Adobe Flash Player sentence.fancy.humble 78557094dbabecdc17fb0edb4e3a94bae184e97b1b92801e4f8eb0f0626d6212 Target list The current list of apps observed to be targeted by Ginp contains a total of 24 unique applications as seen below .


We typically see techniques at this level by well-resourced, well-funded, motivated adversaries.


Additionally, in all cases, the theft took place using normal cash withdrawals from various ATM terminal locations outside the bank's originating country.


A backdoor also known as: Exploit-MSExcel.p Trojan.Mdropper.AA TROJ_MDROP.AH Exploit.MSExcel.CVE-2008-0081.ccxsez Exploit.Excel.1 TROJ_MDROP.AH Exploit-MSExcel.p EXP/Excel.CVE-2008-0081 MSExcel/UDDesc.A!exploit.M20080081 Win32/Trojan.Exploit.903


A backdoor also known as: Heuristic.LooksLike.Trojan.Dropper.I TrojanDropper:Win32/Datunif.A


A backdoor also known as: Trojan.Emotet TSPY_EMOTET.SMZD172 Win32.Trojan.WisdomEyes.16070401.9500.9999 TSPY_EMOTET.SMZD172 Trojan.Packed2.40646 Trojan.Dovs.Win32.2068 BehavesLike.Win32.Backdoor.ch W32.Trojan.Emotet Trojan:Win32/Emotet.R!bit Trojan.Razy.D36CE4 Trojan/Win32.Emotet.R215266 Trojan.Win32.Emotet


Additional targets have included journalists, political advisors, and organizations associated with political activism in central Asia.


However, initial static analysis revealed that all of these samples appear to be identical on the surface, leading us to believe that we had discovered a new loader.


A backdoor also known as: Trojan.Win32.Rimecud.1!O Trojan.Rimecud.U TROJ_RIMECUD.SMX Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_RIMECUD.SMX Trojan.Win32.Fsysna.eqph TrojWare.Win32.Kryptik.AMMN BehavesLike.Win32.PWSZbot.ch Virus.Win32.Cryptor Ransom:Win32/Grymegat.A Trojan.Kazy.D16E7F Trojan.Win32.Fsysna.eqph Trojan/Win32.Jorik.R40701 Trj/Rimecud.f W32/Rimecud.GRC!tr Win32/Trojan.801


A backdoor also known as: Trojan-Exploit/W32.Nuker.203264 Exploit.Nuker Tool.Vai.Win32.1 Exploit.W32.Nuker!c W32/Trojan2.EKA Win.Tool.W32-65 Exploit.Win32.Nuker.Vai.c Exploit.Win32.Nuker-Vai.htmm TrojWare.Win32.Nuker.Vai.C FDOS.VTG.201 W32/Trojan.LISQ-8951 Nuke/Win32.Vai.c Trojan:Win32/VAI.C SPR/DDoS.ICMP.Vait10 Trojan[Exploit]/Win32.Nuker Trojan:Win32/VAI.C Exploit.Win32.Nuker.Vai.c Nuker.Vai Win32/Nuker.Vai.C Win32.Exploit.Nuker.Efbk W32/Nuker_Vai.C!tr Win32/Trojan.Exploit.237


These malicious Office documents are being spread as an attachment using spear phishing emails as described here.


A backdoor also known as: Trojan.AutoIt.Pistolar.A Worm.AutoIt.Win32.16752 Trojan.Heur.rmLfrvwRR2pib TROJ_SPNR.03BL13 Win32.Trojan.AutoIt.a TROJ_SPNR.03BL13 Trojan.KillFiles.61768 BehavesLike.Win32.VirRansom.dc Troj.W32.Autoit.lWNh HEUR/Fakon.mwf Win32/Autoit.MB


A backdoor also known as: Infostealer.Limitail Trojan.Win32.Sourtoff.dshygu Trojan.Yakes.Win32.34007 BehavesLike.Win32.Backdoor.fc Trojan/Injector.cbpj Trojan.Win32.Boaxxe TrojanDropper.Injector.awup TR/Crypt.Xpack.8996 Trojan/Win32.Sourtoff Trojan.Zboter.5 Trojan/Win32.Ransomcrypt.R151582 Trojan.Yakes Trojan.Yakes!LiL7XolSsr0 Win32/Trojan.34b


A backdoor also known as: Worm.AutoIt Worm.AutoIt.Win32.13406 Win32.Trojan.WisdomEyes.16070401.9500.9999 Worm.Win32.AutoIt.qaw Trojan.Win32.AutoIt.ewujea W32.W.WBNA.lJwt Trojan.MulDrop5.8834 BehavesLike.Win32.Trojan.cz Worm.Win32.AutoRun W32/Trojan.WOLP-1815 Worm/Win32.AutoIt Worm:Win32/Selfita.A Worm.Win32.AutoIt.qaw Worm.AutoIt Win32/AutoRun.VB.BEZ Win32.Worm.Autoit.Pgmr


A backdoor also known as: W32.Clodd7a.Trojan.d028 Trojan-Downloader/W32.Lemmy.65536.B Downloader.Lemmy.Win32.31 Troj.Downloader.W32.Lemmy.u!c Trojan/Downloader.Lemmy.q W32/Lemmy.AO Adware.Roimoi Win32/TrojanDownloader.Lemmy.AA TROJ_LEMMY.L Win.Downloader.71376-1 Trojan-Downloader.Win32.Lemmy.u Trojan.Win32.Lemmy.gugs Trojan.Win32.Downloader.65536.IK[h] TrojWare.Win32.TrojanDownloader.Lemmy.u0 Adware.MediaMotor.130 TROJ_LEMMY.L BehavesLike.Win32.Trojan.kt W32/Lemmy.RFEY-5815 TrojanDownloader.Lemmy.f TR/Dldr.Lemmy.Q.2 W32/Dloader.X!tr Trojan[Downloader]/Win32.Lemmy Win32.Troj.Lemmy.o.kcloud Trojan/Win32.HDC.C89215 TrojanDownloader:Win32/Lemmy.U TScope.Trojan.VB Win32.Trojan-downloader.Lemmy.Egoh Trojan.DL.Lemmy!fetCOQguJic Trojan-Downloader.Win32.Lemmy.q


A backdoor also known as: WS.Reputation.1 PWS:Win32/Yaludle.D Trojan-PWS.Win32.Yaludle


Today, we noticed CVE-2015-5119 the identifier for this vulnerability being used in a rather unusual attack pattern.


A backdoor also known as: Ransom_Necne.R002C0DAU18 Win32.Trojan.WisdomEyes.16070401.9500.9999 Ransom_Necne.R002C0DAU18 Trojan.Win32.Filecoder.eximhz Trojan.Win32.Z.Kelios.56320 Trojan.Encoder.24408 Trojan.Filecoder.Win32.7015 BehavesLike.Win32.Backdoor.qh Trojan-Ransom.FileCoder W32/Trojan.TPMK-1866 TR/AD.Petya.muyif Ransom.Filecoder/Variant Trojan.Encoder Ransom.FileCryptor Trj/GdSda.A W32/Filecoder.FV!tr Win32/Trojan.4af


In the attached paper we will focus on two exploits which at the time of discovery in the Hacking Team archives were unpatched.


A backdoor also known as: Trojan.Mikey.DDFDA Ransom_PETYA.SM2 Win32.Trojan.WisdomEyes.16070401.9500.9986 Ransom_PETYA.SM2 Trojan.Win32.AD.epiohw BehavesLike.Win32.Ransom.cc Ransom.Petya Win32/Diskcoder.Petya.E Trojan.Diskcoder! Trojan-Ransom.GoldenEye W32/Petya.E!tr.ransom


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan-Downloader.MSIL.Small.vii Trojan.Win32.Clicker.dckckw Trojan[Downloader]/MSIL.Small Win32.TrojDownloader.MSIL.kcloud Trojan.Kazy.D17F7F Trojan-Downloader.MSIL.Small.vii Trojan:MSIL/Keywsec.B Trojan.Clicker Trojan.Keywsec!MUZFw6FSjt8 Win32/Trojan.419


During the last weeks there have been several cases of international brand names being used by malware authors to propagate malware through phishing emails.


A backdoor targetting Linux also known as: Exploit.Linux.Vmsplice.A Exploit.Lotoor.Linux.131 HEUR:Exploit.Linux.Lotoor.bh Exploit.Unix.Lotoor.exdfpk Exploit.Linux.Lotoor!c Linux.Exploit.Local.147 Exploit.Linux.auf LINUX/Lotoor.qcvrg Trojan[Exploit]/Linux.Lotoor.bh HEUR:Exploit.Linux.Lotoor.bh Linux.Exploit.Lotoor.Htmf Trojan.Linux.Exploit Linux/Vmsplice.K!tr


The attackers used different command and control servers C2s for each malware family, a tactic we believe was meant to thwart attempts to tie the attacks together using infrastructure alone.


This new version comes as an email attachment which is a zip inside a zip before extracting to a .js file in a fake Delivery Status Notification, failed to deliver email bounce message.


Attacks using BigBoss appear likely to have occurred since mid-2015, whereas SillyGoose appears to have been distributed since September 2016.


The first method, dubbed proxy-changing is commonly used for HTTP packets inspections.


A backdoor also known as: Win32.LovGate.W@mm W32.LovGate.W Win32.LovGate.W@mm Spyware.PasswordStealer W32/Lovgate.W@M Win32.LovGate.E8C19A WORM_LOVGATE.BJ Win32.Trojan.WisdomEyes.16070401.9500.9982 W32/Lovgate.W@mm W32.HLLW.Lovgate.I@mm Win32/Lovgate.AX WORM_LOVGATE.BJ Win.Worm.Lovgate-35 Win32.LovGate.W@mm Trojan.Win32.MultiPacked.dgpeeo Win32.Worm-email.Lovgate.Dwsv Win32.HLLM.Lovgate.based Worm.LovGate.Win32.79 BehavesLike.Win32.PWSZbot.cc W32/Lovgate.W@mm I-Worm/Supkp.a WORM/Lovgate.BK Worm[Email]/Win32.LovGate Worm:Win32/Lovgate.W@mm W32.W.LovGate.kYPD Win32.LovGate.W@mm Win32/LovGate.worm.179200 W32/Lovgate.w@M Worm.Lovgate I-Worm.Lovgate.AP Win32/Lovgate.AP I-Worm.Lovgate.BI Worm.Win32.Lovgate Win32.LovGate.W@mm


The Trojan may download and execute the following potentially malicious file: %Temp%\[RANDOM CHARACTERS].dll


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9711 Spyware.Keylogger BehavesLike.Win32.Fake.lc Trojan-Proxy.Win32.Glukelira Trojan/Win32.Glukelira.R10186


A backdoor also known as: W32.HfsAdware.909D Downloader.AdloadCRT.Win32.596 Win.Trojan.Downloader-65968 not-a-virus:Downloader.Win32.AdLoad.rbbv Trojan.Win32.AdLoad.dvwwyc Adware.Downloadadmin.85624 Trojan.Vittalia.12437 not-a-virus:Downloader.DownloAdmin Pua.Downloadmanager RiskWare[Downloader]/Win32.AdLoad.rbbv Trojan.Application.Bundler.DownloadAdmin.3 PUP.DownloadAdmin/Variant not-a-virus:Downloader.Win32.AdLoad.rbbv PUP/Win32.DownloadAdmin.R162593 Downloader.DownloAdmin Trj/Downloader.WOL Win32/Application.d3c


A backdoor also known as: Trojan.Inject Trojan.Bublik.Win32.19217 W32/Trojan.NHBC-1750 BKDR_BMDOOR.SMZAEK-A Trojan.Win32.Inject.wavu Trojan.Win32.Androm.dlcdpz Win32.Trojan.Inject.Duwc BKDR_BMDOOR.SMZAEK-A Trojan.Inject.gwc Trojan/Win32.Inject Trojan.Win32.Inject.wavu Trojan.Inject Trojan.Inject!zWOSv6fC2j0 Win32/Trojan.ae0


A backdoor also known as: Virus.Win32.Virut.1!O Hacktool.Virledi Win32.Worm.AutoRun.bz W32/Virut.AI PE_VIRUX.A-1 Worm.Win32.WBNA.roc Virus.Win32.Virut.hpeg Virus.Win32.Virut.CE Win32.HLLW.Autoruner2.15607 PE_VIRUX.A-1 W32/Virut.AI Win32/Virut.bt Virus/Win32.Virut.ce Worm:Win32/Virledi.A Worm.Win32.WBNA.roc Trojan/Win32.Zbot.C401270 Virus.Virut.06 Worm.AutoRun.FLD Win32.Virut.E Trojan-Downloader.Win32.VB Trj/Dtcontx.M


A backdoor also known as: Trojan/W32.ProxyChanger.144352 Trojan.ProxyChanger Trojan/ProxyChanger.to Win32.Trojan.WisdomEyes.16070401.9500.9857 Trojan.Win32.ProxyChanger.mx Trojan.Win32.Z.Proxychanger.144352 Trojan.Proxy.27390 Trojan.ProxyChanger.Win32.985 Trojan.Win32.ProxyChanger W32/Trojan.WVYD-3840 TrojanDownloader.Cabby.ug TR/Crypt.ZPACK.137306 Trojan/Win32.ProxyChanger Trojan.Win32.ProxyChanger.mx Trojan:Win32/Tepoyx.K Trojan/Win32.Cryptolocker.R145008 Trojan.ProxyChanger Win32/ProxyChanger.TO Trojan.ProxyChanger!ZhCr5dI6SeY W32/Kryptik.DEQP!tr Win32/Trojan.0f5


A backdoor also known as: Trojan.Heur.GZ.E0D821 Ransom_Blocker.R004C0DK917 Win32.Trojan.WisdomEyes.16070401.9500.9999 Ransom_Blocker.R004C0DK917 Trojan-Ransom.Win32.Blocker.kklp Backdoor.Win32.Zelug.ER BehavesLike.Win32.BadFile.mt TR/Barys.796 Trojan[Downloader]/Win32.Dapato Backdoor:Win32/Zelug.B Trojan-Ransom.Win32.Blocker.kklp TScope.Malware-Cryptor.SB W32/Dapato.A!tr.dldr


The backdoor has been analyzed previously and is a robust tool associated with this group, likely being used as an early stage reconnaissance tool.


It has frequently been used to spread cryptocurrency mining malware, perhaps indicating an evolution towards direct monetization.


Due to these two layers, we use the name TwoFace to track this webshell.


Because of the active investigation, I cannot reveal C&C domains used in the samples.


The discovered Javascript code runs hidden in the browser and activates when text is entered on a payment page.


These included Fabrizio Saccomanni, the former deputy governor of the Bank of Italy, Piero Fassino, the former mayor of Turin, several members of a Masonic lodge, Matteo Renzi, former prime minister of Italy and Mario Draghi, another former prime minister of Italy and now president of the European Central Bank.


This particular family of information stealers has been around since 2011


A backdoor also known as: Win32.Worm.Sohanad.NGW Ransom/W32.Blocker.3009335 Trojan.Musta Win32.Worm.Sohanad.NGW TROJ_ZAPCHAST.BN Win32/Tnega.SdcSccB TROJ_ZAPCHAST.BN Trojan-Ransom.Win32.Blocker.kock Win32.Worm.Sohanad.NGW Trojan.Win32.Blocker.ewkvvx Troj.Ransom.W32.Blocker!c Win32.Trojan.Blocker.Ahon Win32.Worm.Sohanad.NGW W32/Trojan.VZLV-7504 TR/Autoit.ezxix Trojan:Win32/Musta.A Win32.Worm.Sohanad.NGW Trojan-Ransom.Win32.Blocker.kock Win32.Worm.Sohanad.NGW Trojan/Win32.Zapchast.R109977 Trojan-Ransom.Blocker Win32/Autoit.KE Worm.Win32.AutoIt Trj/CI.A Win32/Worm.f95


BankBot is particularly risky because it disguises itself as legitimate banking apps, typically using fake overlay screens to mimic existing banking apps and steal user credentials.


The dropper includes a 64 bit version of KONNI;


The C2 infrastructure contains a lack of sophistication such as open panels , reuse of old servers publicly tagged as malicious… So what ? After being publicly denounced by CSIS Group — a threat intelligence company in Denmark — Wolf Research was closed and a new organization named LokD was created .


A backdoor also known as: VB:Trojan.Valyria.186 W97M/Downloader.c Trojan.OBLD-0 O97M_BOGAVERT.A VB:Trojan.Valyria.186 VB:Trojan.Valyria.186 VB:Trojan.Valyria.186 VB:Trojan.Valyria.186 W97M.DownLoader.110 O97M_BOGAVERT.A W97M/Downloader.c W97M/Dldr.Bogavert.xehvk TrojanDownloader:O97M/Bogavert.A HEUR.VBA.Trojan.e VB:Trojan.Valyria.186 Trojan-Downloader.O97M.Bogavert heur.macro.drop.fa


How did Gooligan emerge ? Our researchers first encountered Gooligan ’ s code in the malicious SnapPea app last year .


Recent variants drop distinctively named malware such as KingKong.dll.


Proofpoint researchers are tracking an espionage actor targeting organizations and high-value targets in defense and government.


A backdoor also known as: Trojan.Dropper.Wolfst.A Trojan-Dropper.Win32!O TrojanDropper.Wolfst Trojan/Dropper.Wolfst TROJ_WOLFST.DRP Win32.Trojan.WisdomEyes.16070401.9500.9858 Trojan.Dropper TROJ_WOLFST.DRP Trojan.Dropper.Wolfst.A Trojan-Dropper.Win32.Wolfst Trojan.Dropper.Wolfst.A Trojan.Win32.Wolfst.ejqa Dropper.Wolfst.26146 Trojan.Dropper.Wolfst.A Trojan.Dropper.Wolfst.A Trojan.MulDrop.385 Dropper.Wolfst.Win32.8 BehavesLike.Win32.Dropper.tc W32/Trojan.DTTZ-6513 TrojanDropper.PeStaple.t RiskWare[RemoteAdmin]/Win32.RMS Trojan.Dropper.Wolfst.A W32.W.Bybz.lwoN Trojan-Dropper.Win32.Wolfst Dropper/Win32.Wolfst.R141816 Trojan.Dropper.Wolfst.A TScope.Trojan.Delf Trojan.DR.Wolfst!967kQq5cZ1Q Trojan-Dropper.Win32.Wolfst


For more information, see information on the EITest campaign in the Unit 42 blog titled: Decline in Rig Exploit Kit.


A backdoor also known as: W32.IlamMak.Trojan Trojan.Win32.Delf!O Trojan.Delf Trojan.Delf.Win32.9224 Win32.Trojan.Delf.ii W32/Trojan.HGGE-3556 Infostealer.Yahmali Win32/Yahmali.C TSPY_YAHMALI.B Trojan.Win32.Delf.aam Trojan.Win32.Delf.dxmnga TSPY_YAHMALI.B Trojan-GameThief.Win32.Nilage W32/Trojan2.OXXZ Trojan/Delf.ia TR/Delf.aam.35 Trojan/Win32.Delf Win32.Virut.ce.57344 PWS:Win32/Yahmali.A Trojan.Win32.A.Delf.104448 Trojan.Win32.Delf.aam Trojan/Win32.Yahmali.R25760 Trojan.Autorun.Havijak.1 Trojan.PasswordStealer W32/FolderToEXE.A.worm Win32/Delf.AAM Trojan.Delf!QRjoRop97so


The Elf.BillGates version targets Linux operating system.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9995


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9933 Trojan.Win32.Pincav.dxbist Trojan.Win32.Z.Zusy.618496.BJ Trojan.DownLoader22.56304 BehavesLike.Win32.AdwareConvertAd.jh TR/AD.Corebot.mgjun Trojan.Zusy.D27BC8 Trojan:Win32/Corebot.A Trojan.Downloader Win32/Trojan.BO.918


Since then, it has evolved fairly rapidly and has added new capabilities, as reported.


A backdoor also known as: Trojan.Mauvaise.SL1 Trojan.Inject.Win32.237373 Troj.W32.Inject!c W32/Trojan.JMPH-3101 Trojan.Win32.Inject.aeryd Trojan.Win32.Banbra.elzzqd Trojan.MulDrop7.31178 BehavesLike.Win32.PUPXBY.dh Trojan.Inject.vwf TR/Sfuzuan.jhmvt Trojan.Ursu.D4870 Trojan.Win32.Inject.aeryd Trojan:Win32/Sfuzuan.B!bit Trj/GdSda.A Win32.Trojan.Inject.Wklz Trojan.PWS.Banbra!c5Sww8Szjr0 Trojan.Win32.Sfuzuan


Within the time between the discovery of the vulnerability and the release of the fix, a bad actor might try to get the most out of his previously valuable attack assets.


This malware has been reported to have been used in high profile breaches like the ones at Wellpoint/Anthem, VAE Inc, USIS and Mitsubishi Heavy Industries.


A backdoor also known as: TROJ_DLDR.SMI Win32.Trojan.WisdomEyes.16070401.9500.9976 Trojan.Adclicker TROJ_DLDR.SMI Trojan.Win32.CcKrizCry.dpsxlj Troj.Downloader.W32.Helminthos.kZDa Downloader.KrizCry.Win32.252 BehavesLike.Win32.Backdoor.dm TR/Malushka.umxne Trojan[Downloader]/Win32.CcKrizCry TrojanDownloader:Win32/Malushka.T Trojan/Win32.Cckrizcry.R7632 Win32.Trojan.Dldr.Lscd W32/KrizCry.M!tr.dldr Win32/Trojan.3f8


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G PE_VIRUX.R Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Worm.GBYU-0953 W32.Virut.CF Win32/Virut.17408 PE_VIRUX.R Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg Worm.Win32.Delf.579072 Virus.Win32.Virut.CE Win32.Virut.56 Virus.Virut.Win32.1938 Virus.Win32.Ramnit W32/Worm.APDA Win32/Virut.bt Virus/Win32.Virut.ce W32.Virut.lJ4T Virus.Win32.Virut.ce HEUR/Fakon.mwf Virus.Virut.14 W32/Sality.AO Virus.Win32.Virut.M


The in-depth report provides an analysis of technology, impact, possible attribution – and a signature to detect the malware.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9995 Trojan-Downloader.Win32.VB.aohd Trojan.Win32.VB.ecbrdj Trojan.DownLoad2.47277 BehavesLike.Win32.BadFile.nm TrojanDownloader.VB.dkqk Trojan-Downloader.Win32.VB.aohd TrojanDownloader:Win32/Vbload.J


BadRabbit is distributed as a fake flash update, and reportedly using Mimikatz, the Eternal Romance exploit, and a list of passwords to spread via SMB in a worm-like fashion.


A backdoor also known as: Backdoor.Bitsto BKDR_BISCUIT.A Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/TrojanX.EGVY BKDR_BISCUIT.A Trojan.Win32.Click.dsvjap Trojan.Click.31006 BehavesLike.Win32.RAHack.nc W32/Trojan.RGTL-7538 Backdoor:Win32/Bitsto.A Adware/Win32.NaviPromo.R36681


A backdoor also known as: RiskWare.Tool.CK Trojan.Tool!qSvNdOK1TCo Riskware.Win32.ASEye.cjxuqg Virus.Win32.Heur.c Tool.ASEye.2 BehavesLike.Win32.ToolTPatch.lm Unwanted/Win32.Patch Hacktool.Win32.TPE.BA Trojan.Feutel.AV


We estimate that through the malware s malicious activities, the perpetrators behind it gained over $1.5 million over the course of two months.


A backdoor also known as: Trojan.MSIL.FC.6901 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Diztakun.dbjduc Win32.Trojan.Spy.Sudw BehavesLike.Win32.Trojan.dh Trojan.Win32.Diztakun W32/Trojan.IYBN-7194 Trojan.Kazy.D82509 Trojan:MSIL/Diztakun.A!bit Trojan/Win32.Diztakun.C2318558 Trj/GdSda.A Win32/Trojan.c81


A backdoor also known as: Trojan/StartPage.axk Trojan.Startpage Win.Trojan.Startpage-757 Trojan.MSIL.StartPage.bo Trojan.Win32.StartPage.eaqxl Trojan.StartPage.22255 Trojan/StartPage.ajy TR/StartPage.axk.2 Trojan:MSIL/Startpage.A Trojan.MSIL.StartPage.bo Trojan/Win32.StartPage.C59843 Trj/CI.A MSIL/StartPage.A Win32.Trojan.Startpage.cduj Trojan.StartPage!8fKymuz2/+o Trojan.Win32.StartPage W32/StartPage.PL!tr


A backdoor also known as: W32/Morto.dll.b Trojan/Morto.l WORM_MORTO.SM2 Worm.Win32.Morto!IK Worm.Win32.Morto.~dln Worm/Morto.dlnam WORM_MORTO.SM2 W32/Morto.dll.b Worm:Win32/Morto.D Worm/Win32.Morto Worm.Win32.Morto.h Worm.Win32.Morto W32/Morto.A!tr Worm/Morto.D


Adversaries have been seen leveraging JexBoss, an open source tool for testing and exploiting JBoss application servers, to gain a foothold in the network.


In this case, Proofpoint researchers discovered an infected Android version of the newly released mobile game Pokemon GO


Upon loading the rtf document, it will drop a base64 encoded powershellscript in the following location:%TEMP%\log.ps1


A backdoor also known as: Trojan.Detrahere Trojan.Midie.DA596 TROJ_KRYPTIK_HA22006D.UVPM Trojan.Win32.DownLoad3.exdqqe Trojan.DownLoad3.64586 Trojan.Kryptik.Win32.1347406 TROJ_KRYPTIK_HA22006D.UVPM Trojan.MSIL.ikyj TR/Crypt.ZPACK.hgndb Trojan:Win32/Detrahere.E Trojan/Win32.Tiggre.R216587 Trojan.Crypt Win32/Trojan.daa


Now more threat actors are leveraging the vulnerability in Microsoft Server Message Block SMB protocol – this time to distribute Backdoor.Nitol and Trojan Gh0st RAT.


Specifically, the format resembles custom virtual machine code, where numeric hexadecimal identifiers present in the configuration file make the stealer run desired functions.


A backdoor also known as: Win32.Stration.DDA@mm Win32.Stration.DDA@mm I-Worm.Warezov.r3 Win32.Stration.DDA@mm Trojan.Win32.Warezov.ehypz W32/Worm.ARBW W32.Stration@mm Win32.Stration.DDA@mm I-Worm.Opnis!V3KJQVovhbU I-Worm.Win32.Warezov.20480.AW[h] Win32.Worm-email.Warezov.Lpvc Win32.Stration.DDA@mm Worm.Win32.Warezov.~AD Win32.Stration.DDA@mm Win32.HLLM.Limar.3939 Worm.Warezov.Win32.123 W32/Worm.IQCC-3677 I-Worm.Warezov.bu WORM/Warezov.2048.1 W32/Stration.KG!tr Worm[Email]/Win32.Warezov Win32.Stration.E878FD Worm:Win32/Stration.ST Win32/Stration.AHP Worm.Win32.Warezov.aK Worm.Win32.Warezov Win32.Stration.DDA@mm Trj/CI.A


A backdoor also known as: Trojan.Heur.E38E91 Win32.Trojan.WisdomEyes.16070401.9500.9982 WORM_AMBLER.SMZ Trojan-Spy.Win32.Amber.zdc Trojan.Win32.Amber.etbxtl Win32.Trojan-spy.Amber.Wskc Trojan-Spy.Win32.Ambler WORM_AMBLER.SMZ BehavesLike.Win32.Virut.qc Trojan-Dropper.Win32.Ambler W32/Trojan.MMWY-8251 TrojanSpy:Win32/Ambler.D Trojan-Spy.Win32.Ambler Win32/AutoRun.Spy.Ambler.NAW


A backdoor also known as: Trojan.Keylogger.Win32.19936 Trojan/Spy.nut Win32.Trojan.WisdomEyes.16070401.9500.9996 Trojan.DownLoader6.20458 Trojan/Win32.Graftor.R31665 TrojanSpy.KeyLogger!VshB9boiuX0 Trj/CI.A


With that inclusion, companies running on those systems will also be at risk.


A backdoor also known as: RemoteAdmin.Win32.RAT!O Backdoor.Daromec Backdoor.Breut not-a-virus:RemoteAdmin.Win32.RAT.a Trojan.Win32.MLW.dbyfty BackDoor.Comet.21 Trojan[RemoteAdmin]/Win32.RAT not-a-virus:RemoteAdmin.Win32.RAT.a Backdoor:Win32/Daromec.A RiskWare.RemoteAdmin Trojan.MiniUPnP!L9xsRhGGfN0


That domain still hosts the malicious Flash file CVE-2015-7645 that it previously used in standalone attacks.


On August 4, 2016, the Gmail account of an unknown individual was compromised in order to conduct spearphishing campaigns against a diverse set of targets related to Iran.


The attack is part of a trend where threat groups hide malicious activity by communicating with legitimate web services such as social networking and cloud storage sites to foil detection efforts.


A backdoor also known as: Program.Hadsruda Trojan.Razy.D2C7F5 Win32.Trojan-Downloader.Adload.aa Win.Malware.Zusy-5689722-0 Riskware.Win32.AdLoad.epwtbh Adware.Oxypumper.159236 Application.Win32.OxyPumper.ADA Trojan.DownLoader26.15650 Adware.OxyPumper.Win32.616 BehavesLike.Win32.Trojan.cc W32/Trojan.TQZU-9354 Adware.Adload.cqi ADWARE/OxyPumper.vgssx GrayWare[AdWare]/Win32.AdLoad Adware.OxyPumper/Variant Trojan.Downloader Trj/GdSda.A Win32.Trojan.Razy.Lmkk PUA.AdLoad! PUA.OxyPumper Win32/Trojan.4e9


A backdoor also known as: Trojan.Dynamer.A5 Win32.Trojan.WisdomEyes.16070401.9500.9603 not-a-virus:NetTool.Win64.RPCHook.a BehavesLike.Win32.Downloader.vc TrojanDownloader.Paph.ds Trojan[Downloader]/Win32.Betload Trojan.Jaike.DD8D Troj.W32.Inject.tnKf not-a-virus:NetTool.Win64.RPCHook.a Trojan-Downloader.Win32.Moure Trj/CI.A


We previously reported on SamSam ransomware charging high ransoms for infected servers.


A backdoor also known as: W32.S_Gamma.Trojan Trojan/W32.Obfuscated.770368 Trojan.Win32.Obfuscated!O Trojan.VBCrypt.MF.137 WORM_IRCBOT.BXN Win32.Worm.VB.rx W32/VB.Worm.A W32.Mibling Win32/Malinbot.A WORM_IRCBOT.BXN Trojan.Win32.Obfuscated.aiiz Trojan.Win32.Obfuscated.700736 Troj.W32.Obfuscated.l2p6 Trojan.Click.43851 BehavesLike.Win32.Ramnit.bc W32/VB.Worm.A Worm:Win32/Lamin.A Worm:Win32/Lamin.A Trojan.Win32.Obfuscated.aiiz Trojan.Obfuscator Trj/Dropper.AJT Win32/VB.NRJ Trojan.Obfuscated.AHVV


A backdoor also known as: Win32/PSW.Katalog Trojan-PWS/W32.Katalog.61440 Trojan/PSW.Katalog Trojan.PWS.Katalog!pK2Uo9nMTKQ TROJ_KATALOG.A Trojan-PSW.Win32.Katalog Trojan.Win32.Katalog-Psw.fjsg Trojan.Win32.A.PSW-Katalog.61440[h] TrojWare.Win32.PSW.Katalog TROJ_KATALOG.A W32/Trojan.XHBZ-0001 Trojan/PSW.Katalog TR/Katalog.PSW W32/Katalog.A!tr.pws Trojan[PSW]/Win32.Katalog Win32.Troj.pswKatalog.kcloud Downloader/Win32.VB TrojanPSW.Katalog Trj/PSW.Katalog Trojan.Win32.InfoStealer.Ahg Win32/Trojan.PSW.b74


The Dark Power ransomware gang is new on the block, and is trying to make a name for itself.


A backdoor also known as: Trojan/Dropper.Grizl.kp W32/Dropper.ANGS Infostealer.Gampass TSPY_ONLINEG.SMA Trojan-GameThief.Win32.Lmir!IK TrojWare.Win32.PSW.OnLineGames.NYT0 Trojan.PWS.Gamania.22629 TSPY_ONLINEG.SMA TrojanDropper:Win32/Lolyda.F W32/Dropper.ANGS Trojan/Win32.Lmir TrojanPSW.Lmir.jfz Win32/PSW.OnLineGames.NYT Trojan.PSW.Win32.GameOnline.gcv Trojan-GameThief.Win32.Lmir W32/Grizl.GA!tr.dldr PSW.OnlineGames3.WPS Trj/Krap.Y


A backdoor also known as: Trojan.Ransom.BHE Ransom.Petya.S19638 Trojan.Ransom.BHE W32/GoldenEye.SONR-5498 Ransom.Goldeneye Ransom_PETYA.SM1 Trojan.Ransom.BHE Trojan.Win32.MBRlock.epgnaf Trojan.Ransom.BHE Trojan.MBRlock.265 Trojan-Ransom.GoldenEye W32/GoldenEye.D Trojan.DiskWriter.bp W32/Petya.D!tr.ransom Trojan.Ransom.BHE Trojan/Win32.Petr.C1697437 Trojan.Ransom.BHE Ransom.Petya Trojan.Petya Hoax.Petr


A backdoor also known as: HW32.Packed.AB21 Trojan-Downloader.Win32.Firu!O Troj.Downloader.W32!c Trojan/Downloader.Firu.bp Win32.Trojan.WisdomEyes.16070401.9500.9958 Trojan-Downloader.Win32.Firu.bp Trojan.Packed.418 BehavesLike.Win32.Dropper.mc Trojan-Downloader.Win32.Firu.bp W32/Trojan.BNRM-7642 TrojanDownloader.Firu.t Trojan:Win32/Bohmini.A Trojan-Downloader.Win32.Firu.bp Trojan/Win32.Xema.C57004 TrojanDownloader.Firu Trj/Downloader.VMH Win32.Trojan-downloader.Firu.Tcmb Win32/Trojan.Downloader.d1e


Recently, we spotted a new attack where PowerShell was abused to deliver a FAREIT variant.


The newly discovered samples show new capabilities not previously documented.


What is most interesting about this group's more recent activity however, is their focus on users of encryption tools, peaking this summer.


Once the malware is installed on the victim's device, it opens a back door, collects a list of system-specific information, and sends it to the command and control C&C server to register the device and then get a unique identifier for the infected device.


We believe the use of the Retadup malware family is limited to a very small set of threat actors.


On May 30th our honeypots captured the first attack to make use of this particular vulnerability, but the payload in this exploit had nothing in common with the Trojan-Crypt that was EternalBlue and WannaCry.


A backdoor also known as: Win32.Trojan.Rogue.bjbo W32/Trojan.AMVM-7843 TR/Rogue.7932483 Trojan.Graftor.DBF88 Backdoor/Win32.Etso.R61020 Trojan.Win32.Webprefix Win32/Trojan.Multi.daf


The Carbanak team does not just blindly compromise large numbers of computers and try to milk the cow' as other actors do, instead they act like a mature APT-group.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9831 Bloodhound.Gampass.E Trojan.Win32.Patched.ox Trojan.Win32.PatchedDll.C BehavesLike.Win32.BadFile.cm Virus.Win32.Crypted Trojan/PSW.OnLineGames.ckdm Trojan/Win32.Patched.ox PWS:Win32/Cuepilini.A Trojan.Win32.Patched.ox Trojan.Win32.Patched.b


Based on VirusTotal uploads, malicious documents content, and known victims – other targeted organizations are located in Turkey, Qatar, Kuwait, United Arab Emirates, Saudi Arabia, and Lebanon.


A backdoor also known as: Trojan.Win32.Jorik.Crix!O Win32.Trojan.WisdomEyes.16070401.9500.9992 Trojan.Win32.Dwn.sbard Trojan.Win32.A.Inject.129544 Trojan.DownLoader5.50729 Win32.Malware Trojan/Lebag.auv TrojanDownloader:Win32/Beshades.A Trojan/Win32.Inject.R29920 BScope.Malware-Cryptor.4112 Trj/CI.A Trojan.DL.Injecter!F6PQPalmepA W32/Injecter.AA!tr.dldr


xDedic is a trading platform where cybercriminals can purchase any of over 70,000 hacked servers from all around the internet.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9889 Trojan.Sniff BehavesLike.Win32.BadFile.mc PWS:Win32/Finsgra.A


Unit 42 does not have detailed targeting information for all known Bookworm samples, but we are aware of attempted attacks on at least two branches of government in Thailand.


A backdoor also known as: Backdoor.Elitespyz.A Backdoor/W32.EliteSpyz.1687552 Backdoor.Elitespyz Backdoor.Elitespyz.A Backdoor.Elitespyz.A W32/Risk.FRAF-2715 Backdoor.Trojan BKDR_ELITESPYZ.A Backdoor.Elitespyz.A Backdoor.Win32.EliteSpyz.4 Backdoor.Elitespyz.A Trojan.Win32.EliteSpyz.dgpj Backdoor.Win32.EliteSpyz.1687552 Backdoor.W32.EliteSpyz.4!c Backdoor.Elitespyz.A Backdoor.Win32.EliteSpyz.04 Backdoor.Elitespyz.A BackDoor.EliteSpyz.4 Backdoor.EliteSpyz.Win32.1 BKDR_ELITESPYZ.A Trojan.Win32.Elitespyz Backdoor/EliteSpyz.4 W32.Hack.Tool BDS/EliteSpyz.4 Trojan[Backdoor]/Win32.EliteSpyz Backdoor.Win32.EliteSpyz.4 Backdoor.EliteSpyz Win32/EliteSpyz.04 Win32.Backdoor.Elitespyz.Wrgi Backdoor.EliteSpyz!8lwaYNdDuBo W32/EliteSpy.A!tr.bdr Win32/Backdoor.Spy.754


A backdoor also known as: Trojan.Uncrre TR/RedCap.wfhca Trojan.Win32.Z.Uncrre.3584 Trojan:Win32/Uncrre.A Trojan.Win32.Uncrre Trj/GdSda.A


A backdoor also known as: Backdoor/W32.Ruskill.143360 Backdoor.Win32.Ruskill!O Worm.Ainslot.A Backdoor.Ruskill.Win32.42 Backdoor.W32.Ruskill.fi!c Backdoor/Ruskill.fi TROJ_DROPR.SMIO Worm.Win32.Ngrbot.dfk Trojan.Win32.StartPage.cjvsv Trojan.Win32.Menti.98304 TrojWare.Win32.Injector.GWW BackDoor.IRC.Bot.892 TROJ_DROPR.SMIO Trojan.Win32.Buzus Backdoor/Ruskill.da W32/Injector.HCR!tr Worm/Win32.Ngrbot Worm.Win32.Ngrbot.dfk Worm/Win32.AutoRun.R6237 Worm.Ngrbot Win32.Trojan.Inject.Auto Backdoor.Ruskill!/ah4op3yVOE


Since approximately September 2022, cyber criminals have compromised U.S. and international organizations with a Royal ransomware variant.


A backdoor also known as: W97M.Dropper.H W97M.Dropper.CB W97M/Dropper.m Troj.Downloader.Msword!c W97M/Dropexe.A W97M.Dropper.H W97M.Dropper.H W97M.Dropper.H W97M.Dropper.H W97M/Dropper.m W97M/Dropexe.A HEUR/Macro.Dropper HEUR.VBA.Trojan.d W97M.Dropper.H macro.ole.encodedownload.f


It has outlived several competitors including Zeus, and SpyEye.


Dyre employed the spambot Gophe to send thousands of randomized documents hashes and file names per spam campaign


Throughout 2015 and 2016, Android banking Trojans were primarily distributed outside the Google Play Store by using SMSishing, phishing e-mails and rogue websites, often dropping APKs related to Adobe Flash Player.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9935 TrojanDownloader:Win32/Leodon.D


On June 14th, 2017, a new variant of ZXShell appears to have been uploaded from the Marmara region of Turkey.


A backdoor also known as: Trojan.Razy.D3E075 Trojan.MSIL.Crypt.gbqy BehavesLike.Win32.Trojan.gc Trojan.MSIL.Crypt TR/Kryptik.psxte Backdoor:Win32/Dodiw.A Trojan.MSIL.Crypt.gbqy Trj/GdSda.A MSIL/Kryptik.MQQ!tr


Tick also uses a range of hacktools to map the victim's network and attempt to escalate privileges further.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9993 Trojan.Win32.KrServ.rq Trojan.Win32.JackServn.exlgil Trojan.Win32.Z.Jackservn.306688 Trojan.DownLoader26.11701 Trojan.Win64.Jackservn TR/JackServn.sphdt Trojan.Downloader.184 Trojan.Win32.KrServ.rq Trj/CI.A W32/JackServn.K!tr Win32/Trojan.Downloader.369


A backdoor also known as: W32.Clodeb4.Trojan.8496 Trojan/W32.Scar.350208.E W32/Autorun.worm.bcd Worm.Autorun Trojan/Scar.dyfr W32/MalwareS.BDRB W32.Huanot Virut.A[gs] Win32/Huanot.A WORM_HUANOT.SMIA Trojan.Scar-846 Trojan.Win32.Scar.bvisc Trojan.Win32.A.Scar.350208 Trojan.Copyself.101 TR/Scar.ccwl WORM_HUANOT.SMIA W32/Autorun.worm.bcd Trojan/Scar.pkp Worm:Win32/Huanot.A Trojan/Win32.Scar W32/Risk.JTAZ-7050 Virus.Win32.Heur.l W32/Autorun.JXD PE:Malware.FakeFolder@CV!1.6AA9 Worm.Win32.Huanot


A backdoor also known as: W32.Virut.Cur1 W32/Manex.worm Trojan.Zusy.D62E9 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Dropper.BBXI Win.Trojan.Cosmu-1044 Trojan.Win32.Scar.ojal Trojan.Win32.AutoRun.cgsnz Worm.Win32.A.AutoRun.310273 W32.W.AutoRun.cikl!c Win32.HLLW.Autoruner.27598 Trojan.Cosmu.Win32.3832 W32/Manex.worm W32/Risk.SOOH-5229 Trojan/Cosmu.dxm Trojan/Win32.Cosmu Worm:Win32/Vestgo.A Trojan.Win32.Scar.ojal HEUR/Fakon.mwf Worm.AutoRun Win32.Trojan.Scar.Dxwy Trojan.Scar!/4mh5woJZa8


A backdoor also known as: HW32.CDB.C8b2 TrojanBanker.Banker.awoc Trojan.Win32.Banker.bdicvp W32/MalwareF.FQTI Infostealer.Bancos Trojan-Banker.Win32.Banker.awoc Trojan.PWS.Banker!/1rqiSjn+V4 TrojWare.Win32.Spy.Banker.awoc Trojan-Banker.Win32.Banker TR/Banker.Banker.awoc Trojan/Banker.Banker.kbj Trojan:Win32/Sawmabs.A W32/Risk.BGBM-2797 Trojan-GameThief.Magania Trj/Thed.E Win32/Spy.Delf.NZK Trojan-Banker.Win32.Banker W32/Banker.AWOC!tr PSW.Banker5.BFQR Trojan.Win32.Delf.amo


The attack against Anthem resulted in the largest known healthcare data breach to date, with 80 million patient records exposed.


ITG08 also has gained initial access by targeting specific employees with LinkedIn and spear-phishing emails to deliver the More_eggs backdoor.


A backdoor also known as: Trojan.Constructor.Xploitzomshc.A Constructor/W32.XploitZomShc.253952 Hacktool.Zomshc Trojan/Constructor.XploitZomShc.a Trojan.Constructor.Xploitzomshc.A W32/TrojanX.GSC Construction.Kit Trojan.Constructor.Xploitzomshc.A Constructor.Win32.XploitZomShc.a Trojan.Constructor.Xploitzomshc.A Riskware.Win32.XploitZomShc.hrxx Constructor.XploitZomShc.253952 Constructor.W32.XploitZomShc.a!c Win32.Trojan.Xploitzomshc.Wqwm Trojan.Constructor.Xploitzomshc.A Trojan.Constructor.Xploitzomshc.A VirusConstructor.Shc Tool.XploitZomShc.Win32.1 BehavesLike.Win32.Dropper.dc Trojan.Constructor.Xploitzomshc W32/Trojan.KXHA-5736 Constructor.XploitZomShc.b W32.Hack.Tool KIT/XploitZomShc.A HackTool[Constructor]/Win32.XploitZomShc VTool.XploitZomShc.a.kcloud Constructor.Win32.XploitZomShc.a Trojan.Constructor.Xploitzomshc.A Constructor.XploitZomShc W32/XploitZomShc.A!tr Win32/Constructor.96c


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9986 Trojan-Downloader.Win32.Hover2.n TrojWare.Win32.TrojanDownloader.Small.NZK Trojan.DownLoader.45214 Trojan-Downloader.Win32.Hover2.n Win32/TrojanDownloader.Small.NZK