Adobe may have already patched a Flash Player vulnerability last week, but several users—especially those in the US, Canada, and the UK —are still currently exposed and are at risk of getting infected with CryptoWall 3.0. The Magnitude Exploit Kit included an exploit, detected as SWF_EXPLOIT.MJTE, for the said vulnerability, allowing attackers to spread crypto-ransomware into their target systems.


In the listed indicators of compromise, we noticed domains that we had seen used in a distinct skimming campaign which didn't seem to be documented yet.


A backdoor also known as: Dropped:Trojan.Script.32120 Trojan.Script.D7D78 Win32.Trojan.WisdomEyes.16070401.9500.9925 Dropped:Trojan.Script.32120 Script.Trojan.Script.Eddq Dropped:Trojan.Script.32120 Trojan.DownLoad1.58708 Dropped:Trojan.Script.32120 Trojan/Win32.Xema.C28003 Dropped:Trojan.Script.32120


It also used multiple anti-analysis techniques and the final payload was written in Delphi which is quite unique to the banking trojan landscape.


A backdoor also known as: W32.Cloda4a.Trojan.4db2 Backdoor/W32.EvilBot.49184.D Backdoor/Evilbot.a Backdoor.Evilbot!ON36921kndI Backdoor.Evilbot BKDR_EVILBOT.A Backdoor.Win32.Evilbot.a Trojan.Win32.Evilbot.dgrj Backdoor.Win32.A.Evilbot.49184 Backdoor.Win32.Brat BackDoor.Brat BDS/Brat.A BKDR_EVILBOT.A Trojan[Backdoor]/Win32.Evilbot Win32.Hack.EvilBot.a.kcloud W32/Risk.PNHY-7386 Bck/Evilbot.H PE:Trojan.Evilbot.a!1173766179 Backdoor.Win32.Evilbot W32/EvilBot.A2!tr Backdoor.Win32.Evilbot.AMnQ


Using the device accelerometer sensor it implements a simple pedometer that is used to measure movements of the victim .


Report on APT attacks against Korea by AhnLab.


Phones ? November 16 , 2016 In what 's being chalked up as an apparent mistake , more than 120,000 Android phones sold in the U.S. were shipped with spying code that sent text messages , call logs and other sensitive data to a server in Shanghai .


A backdoor also known as: W32.FakeSmssV.Trojan Backdoor/W32.Jewdo.14848 Backdoor.Win32.Jewdo!O Backdoor.Jedobot.A4 Trojan.Downloader Backdoor/Jewdo.a WORM_JEWDO.SMD Win32.Backdoor.Dipeok.b W32/Trojan3.PWU Backdoor.Warbot WORM_JEWDO.SMD Win.Downloader.94233-1 Trojan.Win32.Fsysna.diom Trojan.Win32.Jewdo.rvcd Backdoor.Win32.Jewdo.14848 Troj.W32.Fsysna.tnhD BackDoor.Ddoser.432 Backdoor.Win32.Jewdo W32/Trojan.YZKF-7158 Trojan[Backdoor]/Win32.Jewdo Win32.Hack.Jewdo.kcloud Backdoor:Win32/Jedobot.A Trojan.Win32.Fsysna.diom Trojan/Win32.Jewdo.R4708 Backdoor.Jewdo Trojan.Dipeok.A Win32/Dipeok.A Backdoor.Win32.Jewdo.a W32/Jewdo.A!tr


A backdoor also known as: Backdoor/Delf.aarf Trojan.Win32.Delf.djezh Backdoor.Trojan Malware.XSSC BKDR_DELF.RFY Backdoor.Win32.Delf.aarf Backdoor.Delf!KqYaW6LeN/8 BKDR_DELF.RFY Backdoor:Win32/Dekara.A Backdoor/Win32.Delf Backdoor.Delf Backdoor.Trojan!rem Trojan-Dropper.Delf W32/Delf.AARF!tr.bdr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9996 BehavesLike.Win32.Backdoor.cc Backdoor:Win32/Govrat.A


Based on data aggregated from a controlled sinkhole, Fidelis Cybersecurity has observed some notable changes with the primary command and control C&C and conducted in-depth analysis of the secondary C&C Domain Generation Algorithim DGA.


As outlined in the diagram above , It installs an additional application with the same functionality and these two applications monitor the removal of each other .


It can also access the phone ’ s cameras and microphone .


A backdoor also known as: Trojan.Win32.PopUpper!O Worm.Shamli.A3 Trojan.PopUpper.Win32.66 Trojan.ShellStartup.E6CAF2 Win32.Trojan.WisdomEyes.16070401.9500.9949 Trojan.Win32.PopUpper.eg W32.Virut.low6 Trojan.MulDrop3.38938 BehavesLike.Win32.VBObfus.tz Trojan/PopUpper.bi Trojan/Win32.PopUpper Worm:Win32/Shamli.A Trojan.Win32.A.PopUpper.1695744 Trojan.Win32.PopUpper.eg Trojan/Win32.PopUpper.R52146 MAS.Trojan.VB.0879 Win32/VB.ODX Trojan.Win32.PopUpper W32/Popupper.A!tr Trj/Shamli.A Win32/Trojan.41d


A backdoor also known as: Trojan.Dropper.Joiner Trojan.DR.Joiner!+J8FCDf4wyY W32/Dropper.AVHN Backdoor.Colfusion W32/Microjoin.IG Win32/Joiner.U BKDR_JOINER.U Trojan-Dropper.Win32.Joiner.u Trojan.Dropper.Joiner Trojan-PWS.Win32.Atrojan!IK TrojWare.Win32.TrojanDropper.Joiner.U Trojan.Dropper.Joiner Trojan.MulDrop.210 BKDR_JOINER.U TrojanDropper.Win32.Joiner.u Trojan.Dropper.Joiner W32/Dropper.AVHN Dropper/Joiner.44544 Win32/TrojanDropper.Joiner.U Dropper.Joiner.by Trojan-PWS.Win32.Atrojan W32/Joiner.U!tr Dropper.Delf.AW


A backdoor also known as: Riskware.Confuser! Trojan.Win32.SteamBurglar.dmdrlr Trojan.SteamBurglar.621 Trojan.Katusha.Win32.39398 BehavesLike.Win32.Backdoor.cc TR/Confuser.181248 MSIL/Injector.LTM!tr PWS:MSIL/Stimilini.C Trj/CI.A Trojan.MSIL.Stimilik MSIL6.AKRX Trojan.MSIL.Stimilik.DT


DotRunpeX is a new injector written in .NET using the Process Hollowing technique and used to infect systems with a variety of known malware families.


A backdoor also known as: W32/Sdbot.worm Backdoor.Shark.Win32.1896 Backdoor/Shark.ed Win32.Trojan.WisdomEyes.16070401.9500.9984 W32/Backdoor2.ETS Packed.Win32.Black.a Trojan.Win32.Shark.wxsv Packer.W32.Black.lbw7 Packed.Win32..Black.~A Trojan.Packed.650 W32/Sdbot.worm BDS/Shark.N Trojan[Packed]/Win32.Black Win32.Hack.Shark.eu.kcloud Backdoor:Win32/Sharke.H Backdoor.Win32.Shark.1483254 Packed/Win32.Black.C34704 Win32/Shark.RU Backdoor.Win32.Shark W32/Packed.2D18!tr


A backdoor also known as: W32.HfsAutoB.243F Backdoor.Win32.HacDef.073!O Win32.Trojan.WisdomEyes.16070401.9500.9837 Backdoor.HackDefender Win.Trojan.PcClient-54 Backdoor.Win32.Hupigon.p Trojan.Win32.Maran.enrszy Backdoor.W32.Rbot.lgxa BackDoor.HackDef.239 Backdoor/HacDef.084 BDS/Hacdef.084 Trojan[Backdoor]/Win32.Hupigon Backdoor.Win32.A.Hupigon.41500 Backdoor.Win32.Hupigon.p Trojan/Win32.Xema.C75969 Trojan.Obfuscated!wEhK/9pikzI Trojan-Dropper.Delf


A backdoor also known as: Trojan.PSW.Glacier TrojanPWS.Glacier Trojan.PSW.Glacier Trojan/PSW.glacier W32/Glacier.A Win32/GDoor.F BKDR_GLACIER.A Win.Spyware.9313-2 Trojan.PSW.Glacier Trojan-PSW.Win32.Glacier Trojan.PSW.Glacier Trojan.Win32.Glacier.furm Troj.Psw.W32!c Win32.Trojan-qqpass.Qqrob.Hyx Trojan.PSW.Glacier TrojWare.Win32.PSW.Glacier Trojan.PSW.Glacier Trojan.PWS.Glacier Trojan.Glacier.Win32.8 BKDR_GLACIER.A BackDoor-FR.svr W32/Glacier.UXNT-8441 Backdoor/G_Door.b Trojan.PSW.Glacier Trojan.Win32.Glacier Trojan-PSW.Win32.Glacier Win-Trojan/GDoor.262144 BackDoor-FR.svr TrojanPSW.Glacier Trojan.Glacier Win32/PSW.Glacier Trojan.PWS.Glacier!4KEClY9FaHQ Trojan-PWS.Win32.Glacier W32/Glacier.A!tr.pws Win32/Trojan.ff1


The incident took place in the network of an East Asian company that develops data-loss prevention DLP software.


This group was named Winnti


A backdoor also known as: Win32.P2P.Spear.E Win32.P2P.Spear.E I-Worm.Spear.d.n8 W32/Spear.worm.d!p2p Worm.Spear.Win32.12 W32/Spear.d Win32.P2P.Spear.E Trojan.Win32.Spear.enxr W32/Spear.D W32.HLLW.Yoohoo Spear.M Win32/Spear.G WORM_SPEAR.D P2P-Worm.Win32.Spear.d Worm.P2P.Spear.D Worm.Win32.P2P-Spear.15360[h] Win32.P2P.Spear.E Worm.Win32.Spear.D Win32.P2P.Spear.E Win32.HLLW.Spear.15360 WORM_SPEAR.D W32/Spear.worm.d!p2p W32/Spear.YBIW-1290 Worm/P2P.Spear.e Worm/P2P.Spear Worm.Spear.d.kcloud Worm:Win32/Spear.D Win32.P2P.Spear.E Win32/Spear.worm.40448 Win32.P2P.Spear.E W32/Spear.D Win32/Spear.D Win32.Worm-p2p.Spear.Efao Worm.P2P.Spear.Based W32/Spear.D!worm.p2p Worm.Win32.Spear.aAAZ


A backdoor also known as: TrojanSpy.Neos.A3 Trojan.Razy.D1F24 TSPY_NEOS.SM Win32.Trojan.WisdomEyes.16070401.9500.9999 TSPY_NEOS.SM Win.Dropper.Skyneos-6192156-1 Trojan.Win32.KeyLogger.dbjjal TrojWare.MSIL.Spy.Keylogger.agk Trojan.MulDrop3.2465 Win32.Troj.Undef.kcloud TrojanSpy:MSIL/Neos.A Spyware.Keylogger Spyware/Win32.KeyLogger.R30636 Win32.Trojan.Spy.Wqdr


By browsing EventBot ’ s installation path on the device , we can see the library dropped in the app_dex folder .


A backdoor also known as: Trojan.Orsam.A3 TSPY_PATUN.SMHA Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.FakeAV Win32/Petun.B TSPY_PATUN.SMHA BehavesLike.Win32.PWSZbot.nm PWS:MSIL/Petun.A MSIL.Trojan-Spy.Petun.B Trojan.KeyLogger.MSIL Trojan-Spy.Win32.Zbot MSIL/KeyLogger.BA!tr


A backdoor also known as: Backdoor.Rat.10 Backdoor/W32.RAT.8192.B Backdoor.Rat Backdoor/RAT.10 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.XWXN-0597 Win32/Rat.10 BKDR_RAT.10 Win.Trojan.Rat-4 Backdoor.Rat.10 Backdoor.Win32.RAT.10 Backdoor.Rat.10 Trojan.Win32.RAT.bqzxxm Backdoor.Win32.Rat_10.Svr Backdoor.W32.RAT.10!c Backdoor.Rat.10 Troj/Rat-1.0B Backdoor.Win32.Rat-10._0 Backdoor.Rat.10 BackDoor.Rat.10 Backdoor.RAT.Win32.24 BKDR_RAT.10 BehavesLike.Win32.PUP.xz Backdoor/Rat.10 Trojan[Backdoor]/Win32.RAT Backdoor:Win32/Rat.1_0 Backdoor.Rat.10 Backdoor.Win32.RAT.10 Backdoor.Rat.10 Backdoor.Rat.10 Bck/Rat.1_0 Rat.10 Win32.Backdoor.Rat.Szbj Backdoor.RAT!GoQkQzcwjDw W32/Rat.10!tr.bdr


The malware is based on a freely-available open-source backdoor – something no one would expect from an alleged state-sponsored malware operator.


Proofpoint researchers have recently observed the re-emergence of two malware downloaders that had largely disappeared for several months.


A backdoor also known as: TROJ_GE.1E00D038 Win32.Trojan.WisdomEyes.16070401.9500.9866 TROJ_GE.1E00D038


This research has proven valuable for Talos and led the development of better detection methods within the products we support along with the disruption of adversarial operations.


Currently, the XData decryption tools are available.


A backdoor also known as: Backdoor.Win32.Poison!O Backdoor.Poison Trojan.Heur.E84A91 Win32.Worm.VB.sn Trojan.FakeAV Backdoor.Win32.Poison.cwpk W32.W.VBNA.lsMe Win32.Backdoor.Poison.Pfjd Trojan.AVKill.11304 BehavesLike.Win32.RAHack.ct W32/Trojan.ULXW-4781 Backdoor.Poison.zo Trojan[Backdoor]/Win32.Poison Worm:Win32/Ructo.N Backdoor.Win32.Poison.cwpk Win32/Trojan.d07


Astrum was known to be have been exclusively used by the AdGholas malvertising campaign that delivered a plethora of threats including banking Trojans Dreambot/Gozi also known as Ursnif, and detected by Trend Micro as BKDR_URSNIF and RAMNIT TROJ_RAMNIT, PE_RAMNIT.


This report reveals a campaign of reconnaissance, phishing, and malware operations that use content and domains made to mimic Chinese language news websites.


It means this was most likely the actual operator.


A backdoor also known as: Trojan.LVBP Win32.Trojan.WisdomEyes.16070401.9500.9984 W32.SillyFDC TrojanSpy:MSIL/Ruzmoil.A Trojan/Win32.Keylogger.R17549


A backdoor also known as: Backdoor.Trojan Win32/Wykcores.A BKDR_MURCY.SM1 PE:Backdoor.Win32.Undef.cnd!1463577[F1] DLOADER.Trojan BKDR_MURCY.SM1 BehavesLike.Win32.Backdoor.qh Win32.Hack.PcClient.al.kcloud Trojan.Barys.955 Backdoor/Win32.Etso Backdoor:Win32/Wykcores.A Trojan-Downloader.Delphi


A backdoor also known as: Trojandownloader.Rameh Backdoor/DsBot.ayd Backdoor.Win32.A.DsBot.3918918[UPX] BehavesLike.Win32.BadFile.vc Trojan-Downloader.Win32.Rameh TrojanDownloader:Win32/Rameh.C


A backdoor also known as: Win32.Trojan.Staser.f Backdoor.Trojan Win.Trojan.Yoddos-2 Trojan.Win32.Delf.ffdi W32.W.Runouce.lgxV BackDoor.MaosBoot.1707 BehavesLike.Win32.Trojan.mm Backdoor/Huigezi.2008.ybi Trojan[Backdoor]/Win32.Hupigon Trojan:Win32/Yoddos.C Backdoor/Win32.Trojan.C2392352 TScope.Malware-Cryptor.SB Trojan.Kryptik!+IjAt1MW7ss Trojan.Win32.SystemHijack


Attacks involving this Trojan have been noted since February 2017 but peaked in late May.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9857 Packed.Win32.Black.a Packer.W32.Black.l6cB Trojan.Packed.650 BehavesLike.Win32.Sdbot.tc BehavesLikeWin32.ExplorerHijack W32/Packed.2D18!tr


Our researchers noted that IcedID has a modular malicious code with modern banking Trojan capabilities comparable to malware such as the Zeus Trojan.


For example, most organizations have little to no DNS restrictions or security monitoring for DNS activity.


The Right App at the Right Time The malicious HenBox and embedded DroidVPN app combination is one instance of the type of legitimate apps the attackers choose to mimic to compromise their victims .


A backdoor also known as: Trojan/Downloader.Nekill.al Trojan.DL.Nekill.X Adware.Rugo Trojan-Downloader.Win32.Nekill.al Heuristic.BehavesLike.Win32.Downloader.J Trojan-Downloader.Win32.Nekill!IK Adware/MsLock.qg Trojan-Downloader.Nekill.al Adware.Rugo Trojan-Downloader.Win32.Nekill


The malware uses smishing , or SMS phishing , to infiltrate target devices , which is a technique that relies on social engineering .


There are some indicators that this sample is just a test sample on its final stages of development .


These changes not only make it more difficult for the victim to identify what files have been encrypted, but also may thwart security protections currently in place for the CryptoWall threat.


A backdoor also known as: Trojan.Barys.D1CD2 Win32.Trojan.WisdomEyes.16070401.9500.9968 Trojan.MSIL.Inject.abuiq Trojan/Windef.hm DDoS:Win32/Darktima.A Trojan.MSIL.Inject.abuiq TrojanFakeAV.Windef Trj/CI.A Win32.Trojan.Inject.dfju Trojan.DR.MSIL!M+jYeJcGakI Trojan.Win32.FakeAV W32/Dropper.FBQ!tr Win32/Trojan.f70


Consider the following phish delivered to the email address displayed on the bank's website.


In contrast , on the emulator , a toast message is displayed that shows “ Install completed ” , at which point FakeSpy removes its shortcut from the device 's homescreen .


Eltima was very responsive and maintained an excellent communication with us throughout the incident.


The full list of banking applications targeted is included in the appendix .


Beginning in December 2016, unconnected Middle Eastern human rights activists began to receive spearphishing messages in English and Persian that were not related to any previously-known groups.


This campaign appears to be directly related to the launch and the ensuing discussion of North Korean missile technology.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Downldr2.FYWH Hacktool.Rootkit Win32/Kerproc.A Win.Trojan.Rootkit-5417 Trojan.Win32.NtRootKit.duatym Trojan.DownLoader12.58402 W32/Downloader.QURR-6406 Trojan[Rootkit]/Win32.Small TrojanDropper:Win32/Bodsuds.A Dropper/Win32.Downloader.R143536 Rootkit.Win32.SMA


ACCESS_NETWORK_STATE - Allows the application to access information about networks .


While the current campaign from this attacker has been active for a couple of months, there is evidence of activity by this attacker as far back as 2013, employing other backdoors such as Saker, Netbot and DarkStRat


A backdoor also known as: Trojan.DownLoader6.51149 RKIT/Mon.A Backdoor:Win32/Feljina.B Trojan.Graftor.DE2AD TScope.Trojan.Delf


It is spread presumably via ShellShock vulnerabilities.


A backdoor also known as: Trojan.Ransom.HiddenTear.H Ransom.Ryzerlo.A3 Trojan.Ransom.HiddenTear.H Ransom.HiddenTear Ransom_CRYPTEAR.SM0 Trojan.Win32.Hesv.crqo Trojan.Ransom.HiddenTear.H Trojan.Ransom.HiddenTear.H Trojan.Encoder.10598 Ransom_CRYPTEAR.SM0 Ransom:MSIL/Ryzerlo.A Trojan.Win32.Hesv.crqo Trojan.Ransom.HiddenTear.H Trj/GdSda.A Win32.Trojan.Fakedoc.Auto Trojan-Ransom.HiddenTear Win32/Trojan.504


However, recently, we have observed cases where PoisonIvy with expanded features in its communication function were used for attacks.


For example , some of the more advanced banking Trojans now offer features such as a back-connect proxy , screen-streaming and even remote control .


They might be Jaff ransomware or might be Dridex banking Trojan or Trickbot banking Trojan.


It turns out that this campaign had an association to 2016 Fancy Bear activity previously identified by the German Federal Office for the Protection of the Constitution BfV.


Also of particular interest from an attribution obfuscation perspective is direct IP crossover with previous Dynamic DNS domains associated with known CN-APT activity.


It has strong behavioral ties to Ke3chang and is being used in an ongoing attack campaign against Indian embassy personnel worldwide.


It involves modifying browser proxy configurations and capturing traffic between a client and a server, acting as Man-In-The-Middle.


Late last year, a wave of cyber-attacks hit several critical sectors in Ukraine.


A backdoor also known as: W32.FamVT.LocktETTc.Worm Trojan.Miuref.S21958 Trojan.MalPack Variant.Symmi.m8Nr Win32.Trojan.WisdomEyes.16070401.9500.9995 BehavesLike.Win32.Miuref.tc Trojan.Win32.Miuref Trojan.Miuref.3 Trojan:Win32/Miuref.B Win32.Trojan.Miuref.Wqws Win32/Trojan.eb2


Its primary institutional targets have included government bodies, diplomatic institutions, and military forces and installations in NATO member states and certain Eastern European countries.


After the cyber attack on the German Bundestag in 2015, some protective functions that the BSI has established for government networks have also been adopted by the German Bundestag for its own networks.


A backdoor also known as: Trojan.Graftor.D5ABC0 BackDoor.IRC.Skynet.69 BehavesLike.Win32.AdwareLinkury.dc W32/Trojan.ETUC-5276 Trojan[Spy]/Win32.Zbot Trojan:Win32/Zeeborot.A Trj/CI.A BackDoor.Skynet! Trojan.Win32.Zeeborot


A backdoor also known as: Trojan/W32.Darkhotel.692224 Trojan.Inexsmar.r5 Trojan/Inexsmar.a Trojan.Zusy.D25651 W32/Trojan.GJSD-2947 Win32/Inexsmar.A TROJ_INEXSMAR.SMA Trojan.Win32.Darkhotel.c Trojan.Win32.Darkhotel.duiemo Trojan.Win32.Z.Darkhotel.692224[h] Trojan/Win32.Darkhotel Trojan:Win32/Inexsmar.A Troj.W32.Darkhotel.c!c Trojan/Win32.DarkHotel Win32.Trojan.Darkhotel.Pftk Trojan.Darkhotel! Trojan.Win32.Inexsmar W32/Darkhotel.C!tr Trojan.Win32.Darkhotel.c


A backdoor also known as: Trojan.Inject.FC.363 Trojan.MSILKrypt.57 BKDR_HPNOANCOOE.SM Win32.Trojan.WisdomEyes.16070401.9500.9998 BKDR_HPNOANCOOE.SM Trojan.DownLoader24.26511 Trojan.Injector.Win32.512453 Trojan.MSIL.Crypt Trojan.MSIL.fwua TR/Dropper.MSIL.uuodb Trojan:MSIL/Kuhaname.A Trojan/Win32.MSIL.C957690 Trojan.Malicious Trojan.Injector!2xVDVY5re4U Trj/GdSda.A


INTERNET - open network sockets .


Category: Unit 42 Tags: EITest, HoeflerText, malware, RAT


A backdoor also known as: Android.Downloader.N Android.Trojan.Downloader.KY Other:Android.Reputation.2 Android.Trojan.Downloader.KY A.L.Rog.BlackCert Android.HiddenAds.171.origin Android.Trojan.Downloader.KY Android-Trojan/Boosad.3b718 a.gray.hiddendown.g Trojan.AndroidOS.Hiddenapp


A paper released today by our colleagues at Palo Alto Networks presented a portion of data on this crew under the label the Lotus Blossom Operation likely named for the debug string present in much of the Elise codebase since at least 2012: d:\lstudio\projects\lotus\…


This particular SLocker variant is notable for being one of the first Android file-encrypting ransomware, and the first mobile ransomware to capitalize on the success of the previous WannaCry outbreak.


A backdoor also known as: Exploit.SWF.CVE-2016-4117.B Exploit-RTF.docswf.d Trojan.Mdropper Win32/Exploit.CVE-2016-4117.A TROJ_CVE20164117.A Exploit.SWF.CVE-2016-4117.B Exploit.Swf.CVE20164117.ecpjvq Exploit.SWF.CVE-2016-4117.B Exploit.SWF.CVE-2016-4117.B Exploit.SWF.1001 TROJ_CVE20164117.A Exploit-RTF.docswf.d RTF/Trojan.XBFM-4 TrojanDropper:Win32/CVE-2016-4117.A Exploit.SWF.CVE-2016-4117.B Exploit.SWF.CVE-2016-4117.B Trojan-Dropper.Win32.CVE-2016-4117 Malicious_Behavior.SB swf.exp.shellcode.b


A backdoor also known as: W32.WoletixC.Trojan Backdoor.Likseput.B3 Win32.Trojan.WisdomEyes.16070401.9500.9998 BKDR_LIKSPUT.SMR Trojan.Win32.A.Downloader.14336.AV Win32.Trojan.Spy.Wnmg Trojan.DownLoad2.44669 BKDR_LIKSPUT.SMR BehavesLike.Win32.Downloader.lm Backdoor:Win32/Likseput.B Win32/Backdoor.b78


A backdoor also known as: Backdoor.Androm.Win32.27371 Backdoor.W32.Androm.mAsy Trojan/Spy.Shiz.nct Win32.Trojan.Kryptik.qb Win.Trojan.Shifu-6330434-1 Trojan.DownLoader17.28342 Backdoor.Androm.fj TR/AD.Beaugrit.M.29 Trojan[Backdoor]/Win32.Androm Win32.Trojan-Ransom.TeslaCrypt.N SScope.Malware-Cryptor.Drixed Win32/Spy.Shiz.NCT Backdoor.Androm!fkBWkP4HCvw


Currently, the trojan spy is still in development and is not spotted in-the-wild yet.


A backdoor also known as: Backdoor.Prosti.AG8 BackDoor-DUG.a Trojan.DL.Delphi!PZt9n9YNSJ4 Hacktool.Rootkit W32/Delf.GRUM Win32/SillyDl.RUQ TROJ_DLOAD.SMMO Trojan.Scraze Trojan.Win32.Scar.cbyd Trojan.Win32.Downloader.723460 TrojWare.Win32.TrojanDownloader.Delf.~QEA Trojan.DownLoad.40151 TR/Dldr.Delf.uvk TROJ_DLOAD.SMMO BackDoor-DUG.a Backdoor.Win32.Prosti!IK TrojanDownloader.Delf.rui Backdoor:Win32/Prosti.AG Adware.ScreenBlaze Trojan/Win32.Scar Trojan-Downloader.Win32.Delf.uvk Hacktool.Rootkit Win32/Adware.ScreenBlaze.AA Backdoor.Win32.Prosti.xa Backdoor.Win32.Prosti W32/Delf.SCB!tr Downloader.Delf Trj/Downloader.MDW


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9997 BehavesLike.Win32.Downloader.nt Trojan:Win32/Uniemv.B Trojan/Win32.Cryptolocker.C301960 Trj/CI.A


Turla macro maldoc - Embassy of the republic of Kazakhstan Helsinki.


In late October, Proofpoint researchers identified and began tracking a financially-motivated threat actor group with access to banking Trojans and other malware, including Dridex, Ursnif, Tinba, and the point-of-sale POS malware AbaddonPOS with its loader, TinyLoader.


On a regular basis for the past several months, we have observed the inclusion of QRAT in a number of spam campaigns.


A backdoor also known as: Banker/W32.BestaFera.3193856 W32/Trojan.UWMZ-4840 Trojan.Win32.Depok.dsfkzn Troj.W32.Depok.akz!c BehavesLike.Win32.Dropper.wh Trojan/Win32.Depok Trojan.Heur.EDDAE3 Backdoor:Win32/Nioriglio.A Trojan.Depok!iA0ZBWd8EAg Trojan.Win32.Depok


A backdoor also known as: Win32.Trojan-Downloader.Dluca.by Trojan.Downloader.Dluca-29 Trojan-Downloader.Win32.Dluca.by TrojWare.Win32.TrojanDownloader.Dluca.~D3 Dialer.Adultparty Trojan-Downloader.Win32.Dluca.dj!IK TrojanDownloader.Dluca.bg TrojanDownloader:Win32/Dluca.DK Win-Trojan/Dluca.94208 Trojan-Downloader.Win32.Dluca.dj


The actors appear to have learned from our previous takedown and sinkholing of their Command and Control C2 infrastructure – Foudre incorporates new anti-takeover techniques in an attempt to avoid their C2 domains being sinkholed as we did in 2016.


On April 20, Proofpoint observed a targeted campaign focused on financial analysts working at top global financial firms operating in Russia and neighboring countries.


The loader injects a DLL component found in its body into explorer.exe.


These key technologies allow RSA analysts to process massive datasets and find forensically interesting artifacts in near real-time and more quickly than using standard incident response processes.


A backdoor also known as: Trojan.Posmemdump.A8 TSPY_RAWPOS.SM Win32.Trojan.WisdomEyes.16070401.9500.9903 Infostealer.Rawpos!g1 TSPY_RAWPOS.SM Win.Trojan.RawPOS-1 Trojan.Win32.POSCardStealer.dqfnqc Trojan.Inject1.54360 TrojanSpy.POSCardStealer.e Trojan:Win32/MemCCDump.A!POS Trojan.POSMemDump Trj/CI.A


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 BehavesLike.Win32.Trojan.tc MSIL/Injector.TDS!tr


A backdoor also known as: Backdoor.Win32!O Backdoor.Takit W32/Recerv.a.dr Trojan.Heur.E5D728 Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Zyxerv Backdoor.Win32.Takit Trojan.Win32.Invader.euuocd Trojan.Win32.Z.Takit.135680 Backdoor.W32.Takit!c Backdoor.Win32.Takit.A BackDoor.TakeIt.1 W32/Recerv.a.dr Backdoor/Takit.a BDS/RedCap.xurnc Trojan/Win32.Invader Backdoor.Win32.Takit Backdoor.Takit Win32/Takit.A Win32.Backdoor.Takit.Wrgr Trojan.Win32.Takit W32/RECERV.A!tr


A backdoor also known as: BehavesLike:Win32.Malware


A backdoor also known as: Python/Motovilo.A Win32.Worm.Motovilo.Hvjc Win32.HLLW.Motovilo.2 BehavesLike.Win32.Trojan.tc Python/Motovilo.A!worm Trojan:Win32/Motve.A Trj/CI.A Win32/Trojan.09a


Whether its Exploit Kits or SPAM messages threat actors are pushing as many different variants of Ransomware as possible.


Our new intelligence on BlackEnergy expands previous findings on the first wide-scale coordinated attack against industrial networks.


The country is resource rich, with a variety of natural resources and a steady labor supply.


Please see the IOCs section for all app and package name combinations .


ince mid-2016 we have observed multiple new samples of the Android Adware family Ewind


Organizations in 31 countries have been targeted in a new wave of attacks which has been underway since at least October 2016.


But GPlayed is an example of where this can go wrong , especially if a mobile user is not aware of how to distinguish a fake app versus a real one .


A backdoor also known as: W32.HLLW.Cloner Trojan.Vir.HLL Trojan.Heur.EA0E79 W32/HLLW.Cloner W32.Cloner PE_CLONER.A Virus.Win32.HLLW.Cloner Virus.Win32.HLLW.gcdu W32.HLLW.Cloner!c Win32.HLLW.Cloner Win32.HLLW.Cloner.32768 Virus.Cloner.Win32.1 PE_CLONER.A W32/Cloner.worm.a Virus.Win32.HLLW W32/HLLW.Cloner Virus/Win32.Cloner Virus.Win32.HLLW.Cloner W32/Cloner.worm.a W32/HLLW.SelfCloner Win32/HLLW.Cloner Win32.HLLW.Cloner


In this collaboration post with Morphisec Lab and Cisco s Research and Efficacy Team, we are now publishing details of this new document variant that makes use of an LNK embedded OLE object, which extracts a JavaScript bot from a document object, and injects a stealer DLL in memory using PowerShell.


Alert from the CNCERT related to a piece of malware that is being used to perform DDoS attacks.


A backdoor also known as: Troj.W32.Buzus.kZ4S BKDR_PHDET.SMI Win32.Trojan.WisdomEyes.16070401.9500.9959 BKDR_PHDET.SMI Trojan.Win32.A.Downloader.34304.CO BackDoor.Dax BehavesLike.Win32.FDoSBEnergy.nt W32.Trojan.Trojan-downloader.Ge Backdoor:Win32/Phdet.B


A backdoor also known as: Win32/Dedler.B Win32.Worm.Dedler.U Worm/W32.Dedler.38400.B Win32.Worm.Dedler.U W32/Dedler.c Win32.Worm.Dedler.U W32.Dedler.Worm Win32/Dedler.E WORM_DEDLER.C Win.Worm.Dedler-12 Win32.Worm.Dedler.U Net-Worm.Win32.Dedler.c Win32.Worm.Dedler.U Trojan.Win32.Dedler.frkx Worm.Win32.S.Net-Dedler.38400 W32.W.Dedler.c!c Win32.Worm-net.Dedler.Ahok Win32.Worm.Dedler.U Worm.Win32.Dedler.E Win32.Worm.Dedler.U Trojan.DownLoader.198 Worm.Dedler.Win32.19 BehavesLike.Win32.Downloader.nc Net-Worm.Win32.Dedler W32/Dedler.B.unp Worm/Dedler.c Worm:Win32/Dedler.B WORM/Dedler.G Worm[Net]/Win32.Dedler Worm:Win32/Dedler.B Net-Worm.Win32.Dedler.c Trojan/Win32.Horst.R28469 Worm.Dedler Backdoor.Dedler.E W32/ICQ.Smvss.A!tr Win32/Worm.352


A backdoor also known as: Trojan.Snojan Trojan.Strictor.D43F0 Win.Trojan.Ag-1 Trojan.Win32.Snojan.kbr Trojan.Win32.DownLoad3.csckao Trojan.Win32.Z.Strictor.268488 Troj.W32.Snojan!c Trojan.DownLoad3.30879 Trojan/Invader.kbu TR/Spy.182784.101 Trojan/Win32.Invader TrojanDropper:Win32/Coopop.B Trojan.Win32.Snojan.kbr Trojan.Snojan Win32.Trojan.Snojan.Llhd Trojan-Banker.Win32.Banker Win32/Trojan.67a


These components are responsible for a myriad of functions including handling decryption , network communications , gaining super-user privileges , monitoring system logs , loading additional Dalvik code files , tracking the device location and more .


A backdoor also known as: Multi.Threats.InArchive Worm.Win32.Poswauto W64/Trojan.LELA-7925 WORM/Poswauto.gwore Worm:Win32/Poswauto.A Trj/CI.A


A backdoor also known as: W32.eHeur.Malware03 Trojan.Win32.Pakes!O TSPY_SUKWIDON.C Win32.Trojan.WisdomEyes.16070401.9500.9998 Infostealer.Sofacy Win32/Metlar.A TSPY_SUKWIDON.C Win.Trojan.Sofacy-1 Trojan.Win32.Pakes.qcb Trojan.Win32.Pakes.fizzg Win32.Trojan.Pakes.Pdmf Trojan.KillProc.7386 Trojan.Pakes.Win32.11534 BehavesLike.Win32.Mydoom.nc Trojan/Win32.Pakes Win32.Troj.Unknown.c.kcloud PWS:Win32/Sukwidon.A Trojan.TDss.20 Troj.W32.Pakes.qcb!c Trojan.Win32.Pakes.qcb Trojan/Win32.Xema.C81978 Trojan.Qhost Trojan.DR.Tiny!eZN8HfCUlLI Trojan.Win32.Sasfis W32/Malware_fam.NB


A backdoor also known as: W97M.Downloader Win32/Exploit.CVE-2017-8570.A TROJ_CVE20170199.JVU Exploit.Xml.CVE-2017-0199.equmby PPT.S.Exploit.35022 Trojan[Exploit]/Win32.CVE-2017-8570 Trojan.Win32.Exploit


Ironically the decoy document is a flyer concerning the Cyber Conflict U.S. conference organized by the NATO Cooperative Cyber Defence Centre of Excellence on 7-8 November 2017 at Washington, D.C. Due to the nature of this document, we assume that this campaign targets people with an interest in cyber security.


Version 0.3.0.1 includes Italian and Spanish language compatibility within the resources section .


After downloading , it will be loaded by the main module via DexClassLoader api : As mentioned , we observed a payload that exclusively targets the WhatsApp messenger and it does so in an original way .


A backdoor also known as: Worm/W32.AutoRun.110592.V Worm.Win32.AutoRun!O Win32.Worm.VB.rp Win.Worm.Autorun-7819 Worm.Win32.AutoRun.hvo Trojan.Win32.AutoRun.ubuid Win32.Worm.Autorun.Aihq Win32.HLLW.Autoruner1.8766 Worm.AutoRun.Win32.41616 BehavesLike.Win32.BadFile.ch Worm.Win32.AutoRun Worm/AutoRun.alsp Worm/Win32.AutoRun Worm:Win32/Krangtor.A Trojan.Heur.VP2.gm0faiC9QKoi Worm.Win32.A.AutoRun.87040.A Worm.AutoRun Win32/AutoRun.VB.AJW Worm.AutoRun!P7D8pPa150U


A backdoor also known as: Win32.Malachite.A W32.WLKSM.A1 Virus.WLKSM.Win32.1 Win32.Malachite.A Win32.Virus.MoonRover.a W32/Malachite.A Virus.Win32.MoonRover Virus.Win32.WLKSM.a Virus.Win32.Infector.dleseh Virus.Win32.WLKSM.AA BehavesLike.Win32.Virut.cc W32/Malachite.A Win32.Malachite.A Virus.Win32.WLKSM.a Win32.Malachite.A Win32.Malachite.A Win32.Malachite.A Virus.Win32.Wlksm.c


EventBot loaded library Loaded library as seen in Logcat .


A backdoor also known as: Win32/Otlard.A W32/Smalltroj.YCPZ Virus.Win32.Heur.c TROJ_OTLARD.SM Trojan-Dropper.Win32.Otlard!IK BackDoor.Gootkit.4 TROJ_OTLARD.SM Win32/Droplet.NU Backdoor/IEbooot.iz TrojanDropper:Win32/Otlard.A Trojan/Win32.Xema Rootkit.Otlard.aa Trojan-Dropper.Win32.Otlard


A backdoor also known as: Worm.Win32.Fasong!O Trojan.Reconyc Worm.Fasong.Win32.10 Win32.Trojan-PSW.OLGames.bm W32/Worm.DPJC-5721 Trojan.PWS.QQPass WORM_FASONG.L Win.Trojan.Fasong-9 Trojan.Win32.Fsysna.djfi Trojan.Win32.Legmir.bonls Worm.Win32.A.Fasong.461667 Worm.Win32.Fasong.G Win32.HLLW.Fasong.7 WORM_FASONG.L BehavesLike.Win32.Virut.gh W32/Worm.AVIX Worm/Fasong.a W32.Worm.Fasong BDS/Delf.H Worm/Win32.Fasong Worm:Win32/Ming.A W32.W.Fasong.l6SH Trojan.Win32.Fsysna.djfi Trojan/Win32.HDC.C154421 Worm.Fasong Win32/Fasong.G Worm.Fasong!UQMX8yr/3P8 Worm.Win32.Fasong


A backdoor also known as: Joke/W32.BadJoke.561258 Trojan.Aduser.A4 Trojan/AddUser.t TROJ_GRAFTOR_EK2501C5.UVPM Win32.Trojan.AddUser.e TROJ_GRAFTOR_EK2501C5.UVPM Win32.Application.PUPStudio.A Trojan.Win32.Z.Graftor.561258 Worm.Win32.Dropper.RA Trojan.Adduser.216 Tool.BadJoke.Win32.3025 Trojan/Pasta.hsb TR/Winlock.KB Trojan.Graftor.D1E8A6 Trojan:Win32/Adduser.D Spyware.OnlineGames Win32/AddUser.T Win32.Trojan-psw.Badjoke.Taer Trojan.AddUser!BXWljasYS+k


If , for some reason , SuperService does not switch off the screen when there is an attempt to revoke the device administrator privileges , the Trojan tries to intimidate the user : While running , Rotexy tracks the following : switching on and rebooting of the phone ; termination of its operation – in this case , it relaunches ; sending of an SMS by the app – in this case , the phone is switched to silent mode .


This background image likely contains a fake “ software update ” screen .


Code improvements , new capabilities , anti-emulation techniques , and new , global targets all suggest that this malware is well-maintained by its authors and continues to evolve .


A backdoor also known as: Trojan.Blocker TROJ_PUWIN.A Win32.Trojan.WisdomEyes.16070401.9500.9979 TROJ_PUWIN.A Trojan-Ransom.Win32.Blocker.kgxt Trojan.Win32.Keylogger.evercw Trojan.Win32.Z.Blocker.17408.C Troj.Ransom.W32.Blocker!c Trojan.DownLoader25.58899 W32/Trojan.BMCJ-5014 Trojan.Blocker.hvt Trojan[Ransom]/Win32.Blocker Trojan:MSIL/Puwin.A Trojan-Ransom.Win32.Blocker.kgxt Trojan-Ransom.Blocker Trj/GdSda.A Win32.Trojan.Blocker.Tbsp Trojan.Blocker!xyv3gcnzFBI Trojan-Ransom.Win32.Blocker W32/Blocker.KGXT!tr Win32/Trojan.Ransom.460


Ignore Battery Optimization : This sets permissions to continue to operate at full capacity while the phone 's screen is turned off and the phone locked .


BrainTest leverages an anti-uninstall watchdog that uses two system applications to monitor the removal of one of the components and reinstall the component .


A backdoor also known as: MemScan:Backdoor.Turkojan.DQ Backdoor.Turkojan Backdoor.Turkojan.Win32.25407 Win32.Backdoor.Cakl.c Backdoor.Trojan Win32/Turkojan.A HT_TURKOJAN_HA110001.UVPM Win.Trojan.Truko-10 Backdoor.Win32.Turkojan.zwh MemScan:Backdoor.Turkojan.DQ Trojan.Win32.Turkojan.jebp Win32.Backdoor.Turkojan.Wnwd MemScan:Backdoor.Turkojan.DQ Win32.HLLW.MyBot HT_TURKOJAN_HA110001.UVPM BackDoor-CZP.dr Trojan.Win32.Cakl Backdoor/Turkojan.x BDS/Turkojan.im Trojan[Backdoor]/Win32.Turkojan Backdoor:Win32/Turkojan.AI Backdoor.Turkojan.DQ Troj.W32.Buzus.l4J9 MemScan:Backdoor.Turkojan.DQ Backdoor/Win32.Turkojan.R148548 MemScan:Backdoor.Turkojan.DQ Trojan.SDP.27105 Win32/Cakl.NAG Backdoor.Turkojan.I Trj/CI.A


These unknown actors continued launching DDoS attacks over the next few years.


A backdoor also known as: Trojan.Brambul Troj.W32.Brambul.toT6 Win32/Pepex.F Trojan.Win32.Brambul.bp Worm.Win32.Pepex.E0 Win32.HLLW.Bumble BehavesLike.Win32.Downloader.mz Trojan:Win32/Brambul.A Trojan:Win32/Brambul.A!dha Trojan.Win32.Brambul.bp Win32/Tnega.WW Win32.Trojan.Brambul.Dvzk


First reports could be linked to Operation Aurora and dated back to 2009 2.


A backdoor also known as: Sefnit.ab Trojan/Jorik.Gbot.cdb Trojan.Sefnit.2 TROJ_DLDR.SMII Win32.Trojan.WisdomEyes.16070401.9500.9938 Trojan.ADH.2 TROJ_DLDR.SMII Win.Trojan.Gbot-539 Trojan.Win32.Jorik.wkvaa Trojan.DownLoader4.46549 Trojan.Jorik.Win32.14116 BehavesLike.Win32.MultiPlug.tz Trojan/Win32.Gbot TrojanDownloader:Win32/Tegtomp.A Trojan/Win32.ADH.C90187 Trojan.Gbot Bck/Qbot.AO Trojan.DL.Tegtomp!ykAGemfy9WA W32/Buzus.AABB!tr


A backdoor also known as: W32.HfsAutoB.3DA4 Trojan/W32.Sasfis.432279 Trojan.Sasfis.Win32.35026 Win32.Trojan.Injector.jm Trojan.Win32.StartPage.ecbeu Trojan.Win32.A.Sasfis.432083 Troj.W32.Invader.liPS Trojan.StartPage.40117 BehavesLike.Win32.Sdbot.gc Trojan/Win32.Sasfis Trojan:Win32/Kilonepag.A Win32.Trojan.Killav.Losk Trojan.Sasfis!92bCxe6lda4 Win32/Trojan.48c


Zscaler ThreatLabZ has been closely monitoring a new Spy Banker Trojan campaign that has been targeting Portuguese-speaking users in Brazil.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9989 Trojan.Win32.Kryptik.exgddi Trojange.N TR/Dropper.MSIL.hlkdw Trj/GdSda.A Msil.Trojan.Kryptik.Eyg


Chinese language traces in the code : During the investigation , the Cybereason Nocturnus team discovered code artifacts that may indicate Chinese threat actors .


A backdoor also known as: W32.OnGameAZPIXS.Trojan Trojan-Dropper.Win32.Dapato!O Dropper.Dapato.Win32.12031 Trojan.Delf.106 Trojan.Coinbitminer Win32/CoinMiner.AJ Trojan.Win32.Dapato.vksez Troj.Dropper.W32.Dapato.boht!c Trojan.Packed.194 TR/Kryptik.GZC Trojan[Dropper]/Win32.Dapato Trojan:Win32/Kexqoud.A TrojanDropper.Dapato Trojan.Injector!8vu2hFasaTU Trojan-Dropper.Win32.Dapato W32/Injector.URR!tr Trj/CI.A


A backdoor also known as: Win32.Trojan.WisdomEyes.151026.9950.9999 Trojan-Downloader.Win32.Gootkit.kn Trojan.Packed Trojan.Kryptik.Win32.910183 BehavesLike.Win32.BadFile.cm W32/Trojan.TLOU-5726 TR/Renaz.ivfk W32/Gootkit.KN!tr.dldr Trojan/Win32.Inject Trojan.Win32.Crypt Crypt5.BVAN Trj/GdSda.A


A backdoor also known as: W32.ServerAJ.Trojan Trojan.Bublik.28294 Trojan.Zusy.Elzob.D833 TSPY_SASFIS_CD10021A.RDXN Win32.Backdoor.Naprat.d W32/Trojan2.MXXM Win32/Spyrat.B TSPY_SASFIS_CD10021A.RDXN Win.Trojan.Hupigon-28437 Trojan.Win32.Bublik.lkn Trojan.Win32.Bot.bblhdq Trojan.Win32.Bublik.lkn TrojWare.Win32.Naprat.A BackDoor.IRC.Bot.355 BehavesLike.Win32.Worm.cc Trojan/Naprat.c Trojan-GameThief.Win32.OnLineGames W32/Trojan.APHW-4252 Trojan/Win32.Sasfis Backdoor:Win32/Naprat.A Trojan.Win32.Bublik.lkn Win-Trojan/Antisb.190976.J Trojan.Bublik Win32/Naprat.C


Today, we have discovered more pieces of the puzzle: two more Corebot samples and an online crypt service.


The modules analyzed by CTU researchers list recently accessed documents, enumerate installed programs, list recently visited websites, steal passwords, and steal installation files for the IDA tool.


A backdoor also known as: Virus.Win32.Sality!O Ransom_Natasa.R039C0DLB17 W32/Trojan.IPMQ-6780 Ransom_Natasa.R039C0DLB17 Trojan-Ransom.Satan Ransom:Win32/Natasa.A Trojan-Ransom.Win32.Satan.x Trj/CI.A W32/MBRlock.AP!tr


A backdoor also known as: Trojan-GameThief.Win32.OnLineGames!O Trojan.Onlinegames Troj.Gamethief.W32.Onlinegames!c Trojan-GameThief.Win32.OnLineGames.bnfw Trojan.Win32.OnLineGames.bwrpuv TrojWare.Win32.GameThief.OnLineGames.~bnfw Trojan.PWS.Qqpass.4325 Trojan-Dropper.Win32.Nemqe Trojan/Vilsel.dki Trojan[GameThief]/Win32.OnLineGames Trojan.Heur.ED351E Trojan-GameThief.Win32.OnLineGames.bnfw TrojanPSW.OnLineGames.a Win32.Trojan-gamethief.Onlinegames.Pfje Win32/Trojan.GameThief.844


A backdoor also known as: Trojan/W32.Cosmu.41472.E Backdoor.Begman.A Trojan/Cosmu.anpk Trojan.Autorun.3 Win32.Trojan.Delf.v W32.Begmian BKDR_BEGMA.SM Trojan.Cosmu.Win32.6467 BKDR_BEGMA.SM BehavesLike.Win32.Sality.pc BDS/Begman.cmnra Worm/Win32.AutoRun Backdoor:Win32/Begman.B Trojan/Win32.Cosmu.R11227 Trj/GdSda.A Trojan.Win32.Autorun.bwq Backdoor.Win32.Begman W32/Begma.SM!tr


The campaign, which experts believe is still in its early stages, targets Android OS devices.


In addition, Sundown doesn't have the anti-crawling feature used by other exploit kits.


It uses a multi-stage installation process with specific checks at each point to identify if it is undergoing analysis by a security researcher.


A backdoor also known as: Trojan.PWS.ZKD Trojan/W32.naKocTb.106496 Trojan.Mauvaise.SL1 Spyware.Infostealer.Fareit Spyware.LokiBot Trojan/Fareit.l Trojan.PWS.ZKD TSPY_LOKI.SMA Win32.Trojan.WisdomEyes.16070401.9500.9723 W32/Trojan.LAPN-1109 TSPY_LOKI.SMA Win.Trojan.naKocTb-6331389-1 Trojan.PWS.ZKD Trojan.PWS.ZKD Trojan.Win32.Stealer.eshrhl Trojan.PWS.Stealer.17779 Trojan.naKocTb.Win32.12 BehavesLike.Win32.Downloader.ch W32/Trojan2.PBTA Trojan.naKocTb.l PWS:Win32/Primarypass.A Trojan.PWS.ZKD Troj.W32.naKocTb.tnB5 Trojan/Win32.naKocTb.C1575888 Trojan.naKocTb Trj/GdSda.A Trojan.Nakoctb Win32/PSW.Fareit.L Trojan-Spy.Dyzap Win32/Trojan.15d


Starting in November 2022, Morphisec has been tracking an advanced info stealer we have named SYS01 stealer. SYS01 stealer uses similar lures and loading techniques to another information stealer recently dubbed S1deload by the Bitdefender group, but the actual payload stealer is different.


Article primarily covering activity from 2016.


A backdoor also known as: W32.AutoHotkeyA.Worm Virus.Win32.Sality!O Backdoor.Vercuser.B4 Worm.AutoHotKey.Win32.37 Trojan.Heur.uquarfYBWDlih Win32/Tnega.NCdVJJ Win.Trojan.Ag-13 Worm.Win32.AutoHotKey.a Trojan.Win32.AutoHotKey.cmxqxy Win32.HLLW.Autoruner1.26246 BehavesLike.Win32.Virut.fc Backdoor.Win32.Vercuser Worm:Win32/Vercuser.B Trojan/Win32.Hupigon.R57102 Trj/CI.A Win32/Vercuser.B Win32.Worm.Autohotkey.Dzjb Worm.AutoHotKey!


A backdoor also known as: Trojan.Pirril.B5 Trojan/BHO.aisa TROJ_PIRRIL.SMI Win.Trojan.Pirril-7 Trojan.Win32.BHO.czvu Trojan.Win32.BHO.btaog Troj.W32.Bho!c Backdoor.Win32.Ripinip.a TrojWare.Win32.Pirril.smi Win32.HLLW.Riplip.10 Trojan.BHO.Win32.9746 TROJ_PIRRIL.SMI BehavesLike.Win32.Pirril.mm Adware/BHO.bmy Trojan.Graftor.D453B Trojan.Win32.Z.Bho.90112 Trojan.Win32.BHO.czvu Pirril.a Trojan.BHO Trojan.Win32.BHO W32/BHO.AJZ!tr Backdoor.Win32.Ripinip.C


Additionally, others have been referring to the group responsible for the OilRig campaign itself as the OilRig group as well.


Expanded with indicators generated by Alienvault Labs


What 's new ? WolfRAT is based on a previously leaked malware named DenDroid .


However, Buckeye's focus appears to have changed as of June 2015, when the group began compromising political entities in Hong Kong.


F5 research conducted in March 2017 followed 153 Marcher configuration files to uncover target and activity trends in the worldwide attack campaigns.


The Word document initiated the same multiple-stage infection process as the file from the Hybrid Analysis report we previously discovered and allowed us to reconstruct a more complete infection process.


SpiderLabs has uncovered a new strain of malware that can steal cryptocurrencies and other digital currencies.


A backdoor also known as: Worm/W32.Protoride.59392 W32.Protoride.E Worm.RAHack W32/Protoride2.worm Trojan.Win32.Protoride.fsfk W32/Protoride.C.unp W32.Protoride.Worm Win32/Protoride.E Worm.Protoride.F Worm.Win32.Protoride.59392[h] W32.W.Protoride.e!c Worm.Win32.Protoride.E BackDoor.IRC.Cirilico Worm.Protoride.Win32.7 BehavesLike.Win32.SpyLydra.qc W32/Protoride.ZUZR-8900 Worm/Protoride.e WORM/Protoride.E.2 Worm[Net]/Win32.Protoride Worm/Win32.IRCBot Worm:Win32/Protoride.F Win32/Protoride.F W32/Protoride.worm BScope.Trojan.IRCbot Win32.Worm-net.Protoride.Lorr Net-Worm.Win32.Protoride


Exfiltrated contact list data sent to the C2 server .


Following the April 2017 Patch Tuesday, in which Microsoft disabled EPS, FireEye detected a second unknown vulnerability in EPS.


In the most recent versions, APT19 added an application whitelisting bypass to the macro-enabled Microsoft Excel XLSM documents.


The NCSC has observed these tools being used by the Turla group to maintain persistent network access and to conduct network operations.


A backdoor also known as: Ransom.Cerber.B NSIS/ObfusRansom.f Ransom_Enestaller.R00EC0CL417 Packed.NSISPacker!g4 Ransom_Enestaller.R00EC0CL417 Trojan.Nsis.Zerber.emhumo BehavesLike.Win32.ObfusRansom.dc Ransom.Cerber/Variant Trojan/Win32.Cerber.R196343 Ransom.Cerber W32/Injector.UQ!tr


A file called x32dbg.exe was used to sideload a malicious DLL we identified as a variant of PlugX.


A backdoor also known as: Trojan.Graftor.Elzob.D5035 Win32.Trojan.WisdomEyes.16070401.9500.9799 W32/Trojan2.HUBT Win32/Tnega.RA Trojan.Cebaek BehavesLike.Win32.PWSOnlineGames.pm W32/Trojan.JRGD-8081 PWS:Win32/Jomloon.E BScope.Trojan-Downloader.6707 W32/PWS_y.XR!tr


A backdoor also known as: Backdoor/W32.WinShell.12832 Backdoor.WinShell.I W32/Backdoor.LOY Backdoor.Winshell.50 W32/Winshell.AIC Backdoor.Win32.WinShell.50 BackDoor.WinShell.74 Backdoor.Win32.WinShell.50!IK Backdoor/WinShell.50 Backdoor:Win32/Winshell.G Backdoor.Win32.A.WinShell.203004.A W32/Backdoor.LOY Win-Trojan/Winshell.54178 Backdoor.Win32.WinShell.50 Win32/WinShell.50 Backdoor.WinShell Backdoor.Win32.WinShell.50 W32/Winshell.A!tr.bdr Bck/Winshell.F


Debug BuildConfig with the version After a deep analysis of all discovered versions of Skygofree , we made an approximate timeline of the implant ’ s evolution .


A backdoor also known as: Trojan.Win32.VB!O Trojan.VB.Win32.23241 Trojan/VB.ymg Win32.Trojan.WisdomEyes.16070401.9500.9965 TROJ_VB.JNH Worm.Win32.VBNA.b Trojan.Win32.VB.edhhbs Trojan.Win32.A.VB.206336[UPX] Backdoor.W32.VB.l0cp TrojWare.Win32.Trojan.VB.~Ymg Trojan.VbCrypt.68 TROJ_VB.JNH BehavesLike.Win32.Rontokbro.lc Trojan.Win32.Sopcol Worm.VBNA.skk Trojan:Win32/Sopcol.A Worm/Win32.VBNA Trojan.Jaiko.DF2A Worm.Win32.VBNA.b Trojan:Win32/Sopcol.A Trojan/Win32.Xema.C33567 SScope.Trojan.VBO.0286 Trojan.VB!6EP+kawqBsw


Black Vine's targets include gas turbine manufacturers, large aerospace and aviation companies, healthcare providers, and more.


A backdoor also known as: W32.WinfileH.Worm Email-Worm.Win32.VB!O Worm.Wukill.AM3 Trojan.TempCom Win32.Worm.VB.sg W32/VB.KL W32.Traxg@mm Win32/Traxg.B WORM_VB.F Win.Worm.Traxg-4 Trojan.Win32.Scar.avxe Trojan.Win32.Scar.bjfnz Troj.W32.Scar!c Trojan.Win32.Rays.tzs Win32.HLLM.Utenti Worm.Rays.Win32.3 WORM_VB.F BehavesLike.Win32.Autorun.cz W32/VB.CWJD-9096 I-Worm/Wukill.j W32.Email-worm.Win32.Rays WORM/Traxgy.B Worm[Email]/Win32.VB Worm.Rays.8192 I-Worm.Win32.Traxg.57344 Trojan.Win32.Scar.avxe Worm:Win32/Wukill.G@mm Worm/Win32.Traxg.R2565 W32/Nethood.worm SScope.Trojan.VBO.0362 I-Worm.VB.NBB Win32/VB.NBB I-Worm.Rays.K W32/Vinet.A.worm Trojan.Win32.VBCode.D


A backdoor also known as: W32.Tufei503.PE Win32.Tufik.A Virus.Win32.Tufik!O W32.Tufik.A Troj.GameThief.W32.Magania.leKk PE_TUFIK.B Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Tufik.A W32.Tufik Win32/Tufik.A PE_TUFIK.B Win.Trojan.Tufik-3 Win32.Tufik.A Packed.Win32.Krap.hm Win32.Tufik.A Virus.Win32.Tufik.cdpn Win32.Tufik.A Virus.Win32.Virut.Ce VBS.Dropper.128 Virus.Tufik.Win32.2 BehavesLike.Win32.PWSZbot.dh Trojan-Dropper.Win32.Wlord W32/Tufik.A Win32/Tufei.a W32/Tufik.J Win32.Tufik.a.13824 Win32.Tufik.A Packed.Win32.Krap.hm Worm:Win32/Tufik.A Win32.Tufik.A Virus.Win32.Tufei.13798 Worm.Qakbot W32/Tufei.A Trojan.Zbot Win32/Tufik.A Virus.Win32.Tufik.cb Win32.Perez.B Win32/Sorter.AutoVirus.VMKUKU.A


In our initial two-part blog series on FIN7 we covered network activity patterns, payloads, and defensive best practices.


hackers, leaving most areas of western Ukraine in the dark.


The threat actors behind Operation Tropic Trooper—we named specifically for its choice of targets—aim to steal highly classified information from several Taiwanese government ministries and heavy industries as well as the Philippine military.


In addition to using PlugX and Poison Ivy PIVY, both known to be used by the group, they also used a new Trojan called ChChes by the Japan Computer Emergency Response Team Coordination Center JPCERT.


A backdoor also known as: Trojan.Quolko.A Trojan/Dropper.Drooptroop.ixt Trojan.Heur.JP.dmGfaeisekjc Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Bamital.I Win32/Droplet.LNE TROJ_KRYPTIK.SMY Trojan.Win32.Drooptroop.cxmbc Troj.GameThief.W32.OnLineGames.lkrK Backdoor.Win32.Shiz.A Trojan.Packed.21232 Dropper.Drooptroop.Win32.3912 TROJ_KRYPTIK.SMY BehavesLike.Win32.Ramnit.qc Trojan.Win32.Bulta W32/Bamital.I TrojanDropper.Drooptroop.cuc Worm:Win32/Yahos.A Trojan/Win32.Zbot.C168741 Trojan.SB.01742 Win32.Trojan-dropper.Drooptroop.Wlzg Trojan.DR.Drooptroop!S4bmnA2fbPM W32/Drooptroop.SMY!tr Win32/Trojan.98f


The C2 URL is : hxxp : //64.78.161.133/ * victims ’ s_cell_phone_number * /process.php In addition to this , the malware also reports to another script , “ hxxp : //64.78.161.33/android.php ” .


A backdoor also known as: AIT:Trojan.Autoit.CLU Win32.Trojan.WisdomEyes.16070401.9500.9768 AIT:Trojan.Autoit.CLU AIT:Trojan.Autoit.CLU AIT:Trojan.Autoit.CLU AIT:Trojan.Autoit.CLU Trojan.Autoit.F


A backdoor also known as: Trojan.Win32.Nosok!O Trojan/Nosok.dez Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Worm.AMZR Trojan.Win32.Nosok.ignra Worm.Win32.A.AutoRun.78881 Trojan.DownLoader11.6990 Trojan.Nosok.Win32.81 BehavesLike.Win32.VirRansom.dc W32/Worm.SMLT-2477 Trojan/Nosok.df Trojan.Razy.D2AA1A Trojan/Win32.Xema.C90213 Worm.AutoRun!dge3lshCyjI


UNBLOCK – unblock the telephone ( revoke device administrator privileges from the app ) .


The Threat Actor would then craft specific spear phishing emails to direct their targets to visit the malicious web sites and open the malware laden documents.


A backdoor also known as: Trojan.Scar Win32.Trojan.WisdomEyes.16070401.9500.9573 Trojan.Win32.Scarsi.apft Trojan.Win32.Inject.ewxioq Trojan.MulDrop6.38561 BehavesLike.Win32.AdwareSearchProtect.jc TR/Inject.oiycd TrojanSpy:MSIL/CoinStealer.C!bit Trojan.Win32.Scarsi.apft Trojan/Win32.Scarsi.C2337044 Trj/CI.A Win32.Trojan.Scarsi.Dkx Trojan.Win32.Injector W32/Injector.DUUK!tr Win32/Trojan.f68


In the second half of 2016, ESET researchers identified a unique malicious toolset that was used in targeted cyberattacks against high-value targets in the Ukrainian financial sector.


FakeSpy is an information stealer that exfiltrates and sends SMS messages , steals financial and application data , reads account information and contact lists , and more .


Example of more recent FakeSpy campaigns targeting France .


In this blog we will detail our discovery of the next two versions of MM Core, namely BigBoss 2.2-LNK and SillyGoose 2.3-LNK.


During the preparation of the IT threat evolution Q2 2017 report I found several common Trojans in the Top 20 mobile malware programs list that were stealing money from users using WAP-billing – a form of mobile payment that charges costs directly to the user's mobile phone bill so they don't need to register a card or set up a user-name and password.


Here is a full list of possible commands that can be executed by the first module : Command name Description @ stop Stop IRC @ quit System.exit ( 0 ) @ start Start IRC @ server Set IRC server ( default value is “ irc.freenode.net ” ) , port is always 6667 @ boss Set IRC command and control nickname ( default value is “ ISeency ” ) @ nick Set IRC client nickname @ screen Report every time when screen is on ( enable/disable ) @ root Use root features ( enable/disable ) @ timer Set period of IRCService start @ hide Hide implant icon @ unhide Unhide implant icon @ run Execute specified shell @ broadcast Send command to the second module @ echo Write specified message to log @ install Download and copy specified component to the system path The implant uses a complex intent-based communication mechanism between its components to broadcast commands : Approximate graph of relationships between BusyGasper components Second ( main ) module This module writes a log of the command execution history to the file named “ lock ” , which is later exfiltrated .


This post takes a look at a new banking malware that has, so far, been targeting financial institutions in Latin America—specifically, Mexico and Peru.


On June 9th, 2017 Morphisec Lab published a blog post detailing a new infection vector technique using an RTF document containing an embedded JavaScript OLE object.


A backdoor also known as: Trojan.JS.QAI PDF.Trojan.4250 JS.Exploit.Pdfka.jr JS/Exploit.Pdfka.QNP JS_PIDIEF.SMQ Exploit.JS.Pdfka.axt Trojan.JS.QAI Exploit.Script.Pdfka.otnl Trojan.JS.QAI Exploit.JS.Pdfka.aqn Trojan.JS.QAI JS_PIDIEF.SMQ BehavesLike.PDF.Exploit.zb EXP/Pidief.hcb Trojan[Exploit]/JS.Pdfka.axt Trojan.JS.QAI Exploit.JS.Pdfka.axt Exploit.JS.Pdfka.axt Exploit.JS.Pdfka JS/Pdfka.AABY!exploit virus.js.pdfjs


Targeted individuals that enabled macros in a malicious Microsoft Word document may have been infected with Poison Ivy, a popular remote access tool RAT that has been used for nearly a decade for key logging, screen and video capture, file transfers, password theft, system administration, traffic relaying, and more.


A backdoor also known as: PDF/Phish.AGU Troj.Downloader.Pdf!c PDF/Phish.AGU Trojan.PDF.Phishing Win32/Trojan.Downloader.8a8


Sundown remained highly vigilant and the subdomains in use were recycled quickly to help in avoiding detection.


Dridex has drastically reduced in volume throughout 2016.Actors are now appearing to prefer crypto-ransomware such as Locky over the infamous banking trojan.However, Dridex is still being actively developed.


Due to this Cerberus will come in handy for actors that want to focus on performing fraud without having to develop and maintain a botnet and C2 infrastructure .


From September 2016 through late November 2016, a threat actor group used both the Trochilus RAT and a newly idenfied RAT we've named MoonWind to target organizations in Thailand, including a utility organization.


A backdoor also known as: Trojan.Killav Downloader.Betload.Win32.51 Win32.Trojan.WisdomEyes.16070401.9500.9783 Trojan.Win32.KillAV.me Troj.W32.SchoolGirl.tnx1 Trojan.Win32.Killav BehavesLike.Win32.Downloader.lh Trojan.Win32.KillAV.me Trojan.Win32.Killav BAT/KillAV.NCO Win32.Trojan.Killav.Pgwh PUA.Bat.Hoax W32/KillAV.ME!tr Win32/Trojan.ba9


The group has been in operation since at least 2011 but has re-emerged over the past two years from a quiet period following exposure by Symantec and a number of other researchers in 2014.


A backdoor also known as: Trojan.Bamital.EC Trojan/PornoBlocker.jhw W32/PornoBlocker.N Win32/PornoBlocker.EW TROJ_KRYPTK.SM11 Trojan-Ransom.Win32.Gimemo.cpe Trojan.Win32.A.PornoBlocker.59904 Trojan-Ransom.Win32.PornoBlocker!IK TrojWare.Win32.Bamital.FA Trojan.Hosts.4025 TROJ_KRYPTK.SM11 Trojan/PornoBlocker.aba TrojanDropper:Win32/Bamital.I Hoax.PornoBlocker.jhw Downloader.Lofog Win32/Bamital.FA Trojan-Ransom.Win32.PornoBlocker W32/Bamital.FA!tr Bck/Qbot.AO


The user would have to then open the downloaded executable in order to infect their computer.


The first sample found was submitted 7 months ago.


A backdoor also known as: Swrort.d Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Swrort-5710536-0 Packed.Win32.BDF.a Trojan.Win32.Shellcode.ewfvwj TrojWare.Win32.Rozena.A Trojan.Swrort.1 Swrort.d Trojan:Win32/Meterpreter.A Packed.Win32.BDF.a W32/Swrort.C!tr Win32/Trojan.6bc


WRITE_SMS - Allows the application to write to SMS messages stored on the device or SIM card , including y deleting messages .


Check Point Mobile Threat Prevention has detected two instances of a mobile malware variant infecting multiple devices within the Check Point customer base .


A backdoor also known as: W32/Downldr2.EOVV Infostealer.Bancos Trojan-Downloader.Win32.Banload.aadik Trojan.Win32.Banload.bmdsil Trojan.DownLoad.22103 BehavesLike.Win32.Pate.dc W32/Downloader.SIUT-2288 TrojanDownloader.Banload.bhyz Troj.Downloader.W32.Banload.aadik!c Trojan-Downloader.Win32.Banload.aadik Trojan:Win32/Pitke.A Trojan/Win32.Banker.R143357 Win32.Trojan-downloader.Banload.Ebrq Trojan.Win32.Scar W32/DelpBanc.A!tr


A backdoor also known as: Backdoor/W32.Runar.53248 Backdoor/Runar.b W32/Backdoor.LCQ Backdoor.Trojan Win.Trojan.Runar-2 Backdoor.Win32.Runar.b Trojan.Win32.Runar.dmmx Backdoor.Win32.A.Runar.53248 Win32.Backdoor.Runar.duq Backdoor.Win32.Runar.b BackDoor.Hiper Backdoor.Runar.Win32.6 W32/Backdoor.WJPY-2871 BDS/Runar.B Trojan[Backdoor]/Win32.Runar Backdoor.W32.Runar.b!c Backdoor.Win32.Runar.b Backdoor:Win32/Runar.B Backdoor.Runar Backdoor.Runar!lU3ZFWcAWmA W32/Runar.B!tr.bdr Win32/Backdoor.d80


It did not take long for attackers to repackage this PoC and use it in attacks in the wild.


A backdoor also known as: Ransom:Win32/Jaffrans.A!rsm


There are the following relevant detection paths ( the last one is an alternative Telegram client – “ Telegram X “ ) : Name Detection path Sex Game For Adults 18.apk /storage/emulated/0/WhatsApp/Media/WhatsApp Documents/ 4_6032967490689041387.apk /storage/emulated/0/Telegram/Telegram Documents/ Psiphon-v91.apk /storage/emulated/0/Android/data/org.thunderdog.challegram/files/documents/ Backdoored Open Source During the course of our analysis , we also found samples sharing code with the ViceLeaker malware , in particular they shared a delimiter that was used in both cases to parse commands from the C2 server .


The Darkhotel APT continues to spearphish targets around the world, with a wider geographic reach than its previous botnet buildout and hotel Wi-Fi attacks.


A backdoor also known as: Backdoor.Mangit BKDR_MANGIT.SM W32/Adware5.BH BKDR_MANGIT.SM Trojan-Banker.Win32.Banbra.tolm Trojan.Win32.Banker1.eeflxo Trojan.PWS.Banker1.21424 Dropper.DapatoCRTD.Win32.29 W32/Adware.ZANB-0757 Trojan.Banker.19 Trojan-Banker.Win32.Banbra.tolm Backdoor:Win32/Mangit.A Trj/GdSda.A Win32.Trojan-banker.Banbra.Syia Trojan.PWS.Banbra!KoDGdYjSbaA Trojan-Downloader.Win32.Delf Win32/Trojan.5ed


FireEye recently detected malicious Microsoft Office RTF documents that leverage CVE-2017-0199, a previously undisclosed vulnerability.


A backdoor also known as: W32.eHeur.Virus02 Worm.Rikihaki.A4 Trojan.Razy.D23D4 WORM_RIKIHAKI.SM Trojan.Tinba WORM_RIKIHAKI.SM Trojan.Win32.KillFiles.didhhl Trojan.KillFiles.14550 BehavesLike.Win32.Worm.gh TR/ATRAPS.sxzgc Worm:Win32/Rikihaki.A Trj/GdSda.A


This could change once the trojan spy has fully developed.


The sexually explicit images in this screenshot have been covered with a black box .


A backdoor also known as: W32/VBTroj.CYJD Trojan.Win32.VB!IK Trojan.Win32.VB


At the same time , the domain admin.nslookupdns [ .


EventBot loaded library The loaded library dropped on the device .


Most of the attacks begin with a phone call from a UK phone number, with attackers speaking in either English or Farsi.


While some ransomware i.e. Chimera give bogus threats about stealing and releasing private files, there are other malware families that in fact have made this possibility a reality.


Unit 42 researchers have uncovered a backdoor Trojan used in an espionage campaign.


The software masqueraded as a confidential document and was intended to infect a Windows computer.


A backdoor also known as: Trojan.Proxy.Delf.C Trojan-Proxy/W32.Steredir.524288 Trojan/Proxy.Steredir.a TROJ_PROXY.ARF Backdoor.Trojan.Client TROJ_PROXY.ARF Win.Trojan.Proxy-467 Trojan.Proxy.Delf.C Trojan-Proxy.Win32.Steredir.a Trojan.Proxy.Delf.C Trojan.Win32.Steredir.dqbk Trojan.Win32.Proxy.524288 Troj.Proxy.W32.Steredir.a!c Trojan.Proxy.Delf.C TrojWare.Win32.TrojanProxy.Delf.C Trojan.Proxy.Delf.C BackDoor.StealthRedir.20 W32/Risk.HXFA-2912 TrojanProxy.Steredir.m TR/Proxy.Steredir.A.2 Trojan.Proxy.Delf.C Trojan-Proxy.Win32.Steredir.a TrojanProxy:Win32/Delf.C Backdoor.RAT.StealthRedirector.V2.0 TrojanProxy.Steredir Win32/TrojanProxy.Delf.C Win32.Trojan-proxy.Steredir.Eawz Trojan.PR.Steredir!IftwXs0S3T4 W32/Delf.A!tr Win32/Trojan.Proxy.118


These attempts differed from other tactics seen by us elsewhere, such as those connected to Iran, with better attention paid to the operation of the campaign.


If a typical user tries to get rid of the malicious app , chances are that only the shortcut ends up getting removed .


A backdoor also known as: Dropper.Dinwod.Win32.1277 Trojan.Zusy.D217BF Win32.Trojan.Delf.iv Trojan.Win32.Dinwod.dqohqi Trojan.MulDrop6.4509 Trojan[Dropper]/Win32.Dinwod Trojan:Win32/Walinlog.A TrojanDropper.Dinwod Win32/Delf.SRU Trojan.DR.Dinwod!WCRzCOHRNbg Win32/Trojan.c58


A backdoor also known as: Trojan.Win32.Swisyn!O Trojan.Swisyn W32/Backdoor.KUPO-4695 TROJ_SWISYN.KK Trojan.Win32.Swisyn.cbuq Troj.W32.Swisyn!c Win32.Trojan.Swisyn.Lrsk Trojan.MulDrop3.21821 Trojan.Swisyn.Win32.23323 TROJ_SWISYN.KK Trojan.Win32.Swisyn W32/Backdoor2.HJRU Trojan/Swisyn.vuq Trojan/Win32.Swisyn Trojan.Win32.A.Swisyn.35840.B[UPX] Trojan.Win32.Swisyn.cbuq TrojanDropper:Win32/Bolardoc.A Trojan/Win32.Swisyn.R43544 Trojan.Swisyn Win32/VB.ODF Trojan.Swisyn!Pk7uhYgClNU W32/Swisyn.CBUQ!tr Win32/Trojan.Dropper.c9f


The adversary had also conducted attacks using Daserf malware in the past, and Symantec refers to them as Tick in their report


A backdoor also known as: HW32.Packed.DB9B Spyware.OnlineGames W32/Palevo.eszc Riskware.Win32.Lime.cukpjv HV_PALEVO_CA2255B5.TOMC W32.Worm.Palevo-187 Worm.P2P.Palevo!qwzmy5h6XK0 Worm.Win32.A.P2P-Palevo.2637834[h] Win32.HLLW.Lime.2579 Worm.Palevo.Win32.83875 BehavesLike.Win32.Trojan.vc Worm/Palevo.cubr Worm[P2P]/Win32.Palevo Trojan.Kazy.D1020 Worm/Win32.Palevo Worm.Palevo P2P-Worm.Win32.Palevo


Malicious programs of this family request administrator rights and then make themselves invisible in the list of installed apps.


RSA Research investigated the source of suspicious, observed beaconing


A backdoor also known as: Win32.Enemany.A@mm Worm/W32.Alcaul.9728.C W32.Enemany.A.int Enemany.A Win32/Enemany.A!intended WORM_ENEMANY.A Email-Worm.Win32.Alcaul.r Win32.Enemany.A@mm I-Worm.Enemany!xtYbjkEFnbQ Win32.Enemany.A@mm Worm.Win32.Enemany.A Win32.Enemany.A@mm Worm.Alcaul.Win32.145 WORM_ENEMANY.A W32/Risk.ZRGC-4282 Worm.Alcaul.r.kcloud Worm:Win32/Enmny.A I-Worm.Win32.Enemany.A[h] Win32/Enemany.worm.9728 Win32.Enemany.A@mm Worm.Win32.Alcaul.am Win32/Enemany.A Email-Worm.Win32.Alcaul W32/Alcaul.R!worm W32/Enemany.A


A backdoor also known as: TrojanSpy.Hakey.FC.1702 TSPY_HAKEY.SM MSIL.Trojan-Spy.Keylogger.a Backdoor.Trojan Win32/SillyAutorun.FJI TSPY_HAKEY.SM Trojan.Win32.Win32.dcdhel W32/Application.ZMXW-2371 TrojanSpy:MSIL/Hakey.A MSIL/Spy.Keylogger.DY Trojan-Dropper.MSIL


More likely , this is a case of common attack tools being re-used between different threat actor groups .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9914 Trojan-Ransom.Win32.Birele.aisl Win32.Trojan.Birele.Wtxf Trojan.MulDrop6.10288 Trojan-Ransom.Win32.Birele.aisl Trojan-Ransom.Win32.Foreign


Moreover, the presence of intrusion software does not necessarily equate to its misuse, as such software may be utilized by intelligence or law enforcement agencies in a manner that conforms with rule of law and democratic principles.


What is the scope of Chrysaor ? Chrysaor was never available in Google Play and had a very low volume of installs outside of Google Play .


This is significant, because it indicates a potential shift in the motives of this adversary.


THE INITIAL INSTALLATION PROCESS Once installed , EventBot prompts the user to give it access to accessibility services .


A backdoor also known as: Backdoor/Inject.knu Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan Win.Trojan.Inject-4540 Trojan.Win32.Donbot.ctdhoe Trojan.Win32.Z.Inject.646633 BackDoor.Donbot.2 Backdoor.Inject.Win32.2858 BehavesLike.Win32.PWSZbot.jc Backdoor/Inject.cpw TR/Donbot.hjsmv Trojan/Win32.Invader Win32.Troj.Undef.kcloud Trojan:Win32/Donbot.A Backdoor/Win32.Trojan.R78442 Backdoor.Inject Win32.Trojan.Spnr.Pijv Backdoor.Inject!WaCQ7k+5qK0 Win32/Trojan.BO.cc2


The original name given to the encryptor by its creator is not known; other security vendors detect it as Trojan.Encoder.858, Ransom:Win32/Troldesh.


A backdoor also known as: W32.JaydarkE.Trojan Win32.Runouce.B@mm Virus.Worm.Win32.Runouce.1!O W32.Runouce.B Win32.Runouce.B@mm W32.W.Runouce.lk4E W32/Chir.b.dannado Win32.Runouce.E2C45E W32.Chir.B@mm Win32/Chir.B WORM_CHIR.DI Win.Worm.Brontok-88 Win32.Virus.Chir.A Win32.Runouce.B@mm Virus.Win32.Runouce.bxafx Win32.Chir.B Win32.Runouce.B@mm Win32.Runonce.6652 WORM_CHIR.DI BehavesLike.Win32.Virut.nh Email-Worm.Win32.Runouce Win32/cnPeace.b W32/Chir.I Worm[Email]/Win32.Runouce.b Worm.NimdaT.d.18848 Trojan:JS/Nimda.A Win32/ChiHack.6652 W32/Chir.b@MM Virus.Win32.Chur.A Win32/Chir.B Worm.Win32.Runouce.a I-Worm.Chir.B Win32/Trojan.1a7


Kaspersky products detect the above-described threat with the verdict Trojan-Banker.AndroidOS.Riltok .


A backdoor also known as: W32.Sality.PE Win32.Sality.3 Virus/W32.Sality.D Worm.Dumpy.S19687 Win32.Sality.3 Virus.Sality.Win32.25 Win32.Sality.3 Win32.Sality.3 W32.Sality.AE Win32/Sality.AA PE_SALITY.RL Trojan-Ransom.Win32.Blocker.gfeq Virus.Win32.Sality.beygb Win32.Sality.3 Win32.Sality.3 Win32.Sector.30 BehavesLike.Win32.Sality.cm Win32/HLLP.Kuku.poly2 W32/Sality.AT Worm:Win32/Dumpy.B Trojan-Ransom.Win32.Blocker.gfeq Win32.Virus.Sality.A HEUR/Fakon.mwf Virus.Win32.Sality.bakc Worm.AutoRun W32/Sality.AA Win32.Sality Win32/Sality.NBA Trojan-Ransom.Win32.Blocker.b Win32.Sality.BL Worm.Win32.Dumpy Virus.Win32.Sality.I


By accessing and stealing this data , Eventbot has the potential to access key business data , including financial data .


This all started with the great analysis and blog done by RSA in August 2017 about a phishing wave targeting Russian Banks.


The same is true for banking malware .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9717 Trojan.Win32.Zbot.dsnigs Trojan.Reconyc.Win32.16630 TrojanSpy.Zbot.ewlp


The emails come with an attached Microsoft Word document file.


During our monitoring of activities around the APT28 threat group, McAfee Advanced Threat Research analysts identified a malicious Word document that appears to leverage the Microsoft Office Dynamic Data Exchange DDE technique that has been previously reported by Advanced Threat Research.


A backdoor also known as: Trojan.Win32.Webprefix!O Trojan.Webprefix.B3 Trojan.Webprefix.Win32.30550 Trojan/Webprefix.agl Win32.Trojan.Webprefix.d Trojan.Farfli Win32/Webprefix.F Trojan-Downloader.Win32.Klevate.bv Trojan.Win32.Webprefix.balbkt Troj.W32.Webprefix.agl!c Trojan.Win32.Krypttik.a Trojan.Webprefix.13 BehavesLike.Win32.Trojan.ch Trojan/Webprefix.w W32.Trojan.Webprefix Trojan[Packed]/Win32.Katusha Trojan:Win32/Webprefix.B Trojan.Win32.A.Webprefix.128000.B Trojan-Downloader.Win32.Klevate.bv Packed/Win32.Katusha.R3725 Trojan.Webprefix.01 Trojan.Webprefix!EZ6BvH+ekbw Packer.Win32.Katusha


A backdoor also known as: Trojan/Constructor.MS04-032.b Riskware.Win32.MS04-032.hrwi W32/Trojan.NOKE-5825 Trojan.Moo Constructor.Win32.MS04-032.b Exploit.MS04-032.B Constructor.Win32.MS04-032.b Tool.MS04.Win32.28 W32/TrojanX.IRQ Constructor.MS04-032.d KIT/MS04-032.B W32/MS04_032.B!kit HackTool[Constructor]/Win32.MS04-032 Constructor.W32.MS04-032.b!c Constructor/Xema.36864 Trojan:Win32/Shelcod.A Constructor.MS04032 VirTool.Win32.MS04 Constructor.AMN Trojan.Win32.MS04-032.b Win32/Constructor.990


A backdoor also known as: Backdoor.BO2K.1.1.2.plugin Backdoor.BO2K.1.1.2.plugin Backdoor/Orifice2K.plugin Win32.Trojan.WisdomEyes.16070401.9500.9851 W32/Risk.JQIA-3547 Backdoor.BO2K.1.1.2.plugin Backdoor.Win32.BO2K.112.plugin Backdoor.BO2K.1.1.2.plugin Trojan.Win32.BO2K-112.guih Win32.Backdoor.Bo2k.Edxg Backdoor.BO2K.1.1.2.plugin Backdoor.Win32.BO2K.112.plugin Backdoor.BO2K.1.1.2.plugin BackDoor.BO2k.plugin Backdoor.BO2K.Win32.168 Backdoor/BO2K.112.Plugin BDS/Bo2k.112.plugin.3 Trojan[Backdoor]/Win32.BO2K Backdoor.BO2K.1.1.2.plugin Backdoor.Win32.BO2K.112.plugin Backdoor:Win32/BO2K.1_12 Backdoor.BO2K.112 Win32/BO2K.112.plugin Backdoor.BO2K.plugin!QCV0kLCiRV0 Trojan.Win32.BO2K


] ru/4 * * * * * 7 ” , containing a link to download the Trojan .


So far , this software ( along with the Android version ) has been made available through phishing sites that imitated Italian and Turkmenistani mobile carriers .


In late August 2015, Symantec identified a previously unknown back door Trojan Backdoor.Dripion infecting organizations primarily located in Taiwan, as well as Brazil and the United States.


A backdoor also known as: TrojanDownloader.Rakhni Downloader.Rakhni.Win32.344 Trojan-Downloader.Win32.Rakhni.moc TrojanDownloader.Rakhni.hu TR/Dldr.Delf.ltfzo TrojanDownloader:Win32/Docdobex.A Trojan.Zusy.D3FCFF Trojan-Downloader.Win32.Rakhni.moc Downloader/Win32.Rakhni.C2136522 TrojanDownloader.Rakhni W32/Delf.CDW!tr.bdr Trj/GdSda.A


The following screenshot shows the contacts being stolen and written in a local array , which is then sent to C & C : Uninstalling apps Uninstalling apps is another function favored by developers of Android spyware and malware .


Malware mostly communicating with compromised domains


Programs of this family interfere with bank apps, such as the Commerzbank app or Google Play.


A backdoor also known as: Trojan.Win32.VB!O Trojan.VB Trojan/VB.pra Trojan.Kazy.D61DA Win32.Trojan.WisdomEyes.16070401.9500.9965 W32.SillyFDC Win32/Tnega.AEVL Trojan.Win32.VB.aspi Trojan.Win32.VB.eijsbx Trojan.Win32.A.VB.40960.AS Troj.W32.Vb!c Trojan.VB.Win32.100469 BehavesLike.Win32.Vilsel.pz Trojan/VB.ckmo Trojan:Win32/Tazi.A Trojan.Win32.VB.aspi HEUR/Fakon.mwf Trojan.VB Worm.AutoRun Win32/VB.PRA Win32.Trojan.Vb.Ljka Trojan.VB!n6riGwYVvNo Trojan.Win32.VB W32/SillyFDC.IZ!tr Win32/Trojan.db1


A backdoor also known as: Ransom/W32.WannaCry.5267459 Ransom.WannaCrypt.S1670344 Ransom.WannaCrypt Trojan/Exploit.CVE-2017-0147.a Ransom_WCRY.SMALYM Win32.Worm.Rbot.a Ransom.Wannacry Ransom_WCRY.SMALYM Win.Ransomware.WannaCry-6313787-0 Win32.Exploit.CVE-2017-0147.A Trojan-Ransom.Win32.Wanna.m Trojan.Win32.Wanna.epxkni Trojan.Win32.WannaCry.5267459 Troj.Ransom.W32.Wanna.toP0 Trojan.Encoder.11432 Exploit.CVE.Win32.1765 BehavesLike.Win32.RansomWannaCry.th Trojan.Wanna.k Trojan[Ransom]/Win32.Wanna Ransom:Win32/WannaCrypt.A!rsm Trojan-Ransom.Win32.Wanna.m Trojan/Win32.WannaCryptor.R200894 Hoax.Wanna Trj/GdSda.A Win32/Exploit.CVE-2017-0147.A Trojan-Ransom.Win32.Wanna.m Exploit.CVE-2017-0147! Trojan.Win32.Exploit W32/WannaCryptor.H!tr.ransom


A backdoor also known as: Packer.FSG.A Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Downloader.BFIA Downloader.Trojan TROJ_APHER.A Win.Trojan.Small-10534 Packer.FSG.A Trojan-Downloader.Win32.WebDown.10 Packer.FSG.A Trojan.Win32.WebDown.cdwvkr Packer.FSG.A TrojWare.Win32.TrojanDownloader.Apher.0700 Packer.FSG.A Trojan.DownLoader.4572 TROJ_APHER.A Trojan-Downloader.Win32.WebDown W32/Downloader.MUZI-7025 Trojan/Downloader.WebDown.10 Trojan/Win32.Unknown Packer.FSG.A Trojan-Downloader.Win32.WebDown.10 Win-Trojan/Apher.1312 Packer.FSG.A Trj/Downloader.GE Win32/Randon.A W32/Dloader.AE!tr


A backdoor also known as: Trojan.Heur.D.EED80 Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Win32.Bayrob.etejdt BehavesLike.Win32.Ipamor.jc Trojan/Win32.Scar.C59481 Trojan.Win32.Woripecs W32/Scar.CTI!tr


A backdoor also known as: Trojan/W32.Small.14336.BM Trojan.Zenshirsh.SL7 Backdoor.Small.Win32.3772 Backdoor/Small.wn BKDR_RINCUX.AD Trojan.Win32.Scar.nzec Backdoor.Win32.Small.32768.H[UPX] Backdoor.W32.Small.wn!c Trojan.DownLoad3.19355 BKDR_RINCUX.AD BehavesLike.Win32.Backdoor.lm BDS/Salamdom.A Trojan.Win32.Scar.nzec Backdoor:Win32/Salamdom.A Adware/AdHelper.B Win32/Salamdom.AA Win32.Backdoor.Small.Sxyt Backdoor.Small!t0Kn4UZH16w Trojan-Downloader.Win32.Pangu W32/ServStart.AS!tr


There are several strings and labels still mentioning 'test ' or 'testcc ' — even the URL used for the credit card data exfiltration is named " testcc.php .


Our analysis confirms the excellent investigative work done by TALOS and expands on what they found.


TABLE OF CONTENTS Key Findings Introduction Threat Analysis Fakespy Code Analysis Dynamic Library Loading Stealing Sensitive Information Anti-Emulator Techniques Under Active Development Who is Behind Fakespy 's Smishing Campaigns ? Conclusions Cybereason Mobile Detects and Stops FakeSpy Indicators of Compromise INTRODUCTION For the past several weeks , Cybereason has been investigating a new version of Android malware dubbed FakeSpy , which was first identified in October 2017 and reported again in October 2018 .


A backdoor also known as: Joke/W32.ArchSMS.2449920.C Trojan.Zusy.D14269 Win32.Trojan.WisdomEyes.16070401.9500.9992 not-a-virus:WebToolbar.Win32.Webatla.b Trojan.Win32.ArchSMS.csnmld Trojan.SMSSend.4975 Tool.ArchSMS.Win32.17120 BehavesLike.Win32.BadFile.vc Trojan:Win32/Blinerarch.A Trojan/Win32.ArchSMS.C198920 Hoax.ArchSMS Trojan.ArchSMS!HGAxbs185b0 Hoax.Win32.ArchSMS


Over the course of their campaigns, we analyzed their modus operandi and dissected their tools of the trade—and uncovered common denominators indicating that PLEAD, Shrouded Crossbow, and Waterbear may actually be operated by the same group.


Hancitor is one of the better-known malware downloaders due to its numerous SPAM runs and evolving delivery technique.


A backdoor also known as: W32.FantibagB.Trojan Email-Worm.Win32.Bagle!O Win32.Trojan.WisdomEyes.16070401.9500.9958 Win32/Fantibag.E Email-Worm.Win32.Bagle.cv Email-Worm.Win32.Bagle Worm/Bagle.aac TR/Bagle.BR.A.Dll I-Worm.Win32.Bagle.FA Email-Worm.Win32.Bagle.cv Trojan:Win32/Fantibag.B Win32/Bagle.BI Trojan.Fantibag.A1


It is meant solely to empty the safe of ATMs. We detect this new malware family as BKDR_ALICE.A.


A backdoor also known as: Trojan.Dropper.Refroso.B Trojan/W32.Refroso.62976.D Trojan.Win32.Refroso!O Trojan.Injector.5265 Trojan.Refroso.Win32.766 Trojan/Refroso.dzt Trojan.Dropper.Refroso.B Win32.Trojan.WisdomEyes.16070401.9500.9997 TROJ_LETHIC.SMA Trojan.Win32.Refroso.ayz Trojan.Dropper.Refroso.B Trojan.Win32.Refroso.bwzzc Trojan.Dropper.Refroso.B Trojan.Dropper.Refroso.B BackDoor.Bifrost.26171 TROJ_LETHIC.SMA BehavesLike.Win32.Downloader.kc Backdoor/Poison.bhw Worm:Win32/Refroso.A Trojan[Downloader]/Win32.Refroso Win32.Troj.Refroso.kcloud Worm:Win32/Refroso.A Backdoor.Win32.Poison.46632 Trojan.Dropper.Refroso.B Trojan/Win32.Refroso.R694 Trojan.Dropper.Refroso.B Trojan.Win32.Buzus.8101325 Trojan.Refroso Trojan.Win32.Buzus W32/Injector.IA!tr


A backdoor also known as: TrojanPSW.LdPinch.cds PWS-Lineage.dll Trojan.Downloader-35380 Trojan-GameThief.Win32.OnLineGames.stab Trojan.PWS.Wsgame.origin PWS:Win32/Kotwir.A.dll Trojan-Downloader.Win32.Banload.aqi


After manual launch , it shows a fake welcome notification to the user : Dear Customer , we ’ re updating your configuration and it will be ready as soon as possible .


A backdoor also known as: Trojan/W32.Blocker.194764 Trojan.Bepush.Win32.889 Trojan.Strictor.D7317 TROJ_SPNR.11GF13 Win32.Trojan.WisdomEyes.16070401.9500.9800 TROJ_SPNR.11GF13 Win.Trojan.Truado-1 Trojan.Win32.Dapato.dcitdy Trojan-Downloader:W32/Kilim.T Trojan.DownLoader9.41166 Trojan.JS.FBExt W32/Trojan.CAKN-6742 Trojan/Blocker.eyy TR/Dldr.Truado.B.5 TrojanDownloader:MSIL/Truado.B Trojan/Win32.Blocker.R77853 Hoax.Blocker Trj/CI.A Trojan.Blocker!Jm7NxUGe2as Win32/Trojan.a10


A backdoor also known as: Trojan.PWS.LdPinch.TMK Trojan-PWS/W32.LdPinch.557056 Trojan.PWS.LdPinch.TMK Trojan.PWS.LdPinch.TMK Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Win32.Pakes.nkj Trojan.PWS.LdPinch.TMK Trojan.Win32.Pakes.gkhlc Trojan.PWS.LdPinch.TMK Trojan.PWS.LdPinch.TMK BehavesLike.Win32.VirRansom.hc Trojan.PWS.LdPinch.TMK Trojan.DR.Jeshex!G2i88bn5YEw W32/LdPinch.TNV!tr.pws Win32/Trojan.PWS.912


January 23 , 2017 SpyNote RAT posing as Netflix app As users have become more attached to their mobile devices , they want everything on those devices .


A backdoor also known as: BehavesLike.Win32.BadFile.nm TrojanDownloader:Win32/Xuwuq.A


This strengthens our suspicion that this malware is still undergoing development and has not been officially marketed or released yet .


Facebook page managed by the C & C domain registrant uses the same base domain name ( minigameshouse ) and phone number as the registered malicious C & C used by the Ashas adware Of interest is that on the Minigameshouse Facebook page , the malicious developer promotes a slew of games beyond the Ashas family for download on both Google Play and the App Store .


A backdoor also known as: W64.HfsAutoA.4EC7 Exploit.CVE-2015-1701.A Trojan.Win64 Exploit.CVE-2015-1701.A W64/Trojan.CBXE-7834 Exploit.CVE-2015-1701.A Exploit.Win64.CVE-2015-1701.b Exploit.CVE-2015-1701.A Exploit.CVE-2015-1701.A Exploit.CVE2015-1701.1 BehavesLike.Win64.BadFile.mh Virus.Win32.Virut Exploit.CVE-2015-1701.e Trojan[Exploit]/EXE.CVE-2015-1701 Exploit.CVE-2015-1701.A Exploit.Win64.CVE.tnlV Exploit.Win64.CVE-2015-1701.b Trojan/Win32.Exploit.R200799 Exploit.Win64.CVE-2015-1701 Trj/CI.A Win64.Exploit.Cve-2015-1701.Ahyf W64/CVE_2015_1701.A!tr Win32/Trojan.Exploit.059


A backdoor also known as: Trojan.Win32.Cult.fvly W32/Cult.B@mm W32.HLLW.Cult@mm Win32/Cult.E Email-Worm.Win32.Cult.b Win32.Cult.B@mm I-Worm.Cult.B Worm.Win32.Cult.B Win32.HLLW.SpyBot I-Worm/Cult.b Worm.Cult.b.kcloud Worm:Win32/Cult.D@mm I-Worm.Win32.Cult.16418 Win32/Cult.worm.16418 Win32.Cult.B@mm W32/Cult.B@mm Worm.Cult Net-Worm.Cult Win32/Cult.B Worm.Cults.b Email-Worm.Win32.Cult W32/Cult.B


Last week, an Endgame researcher was analyzing spam emails for indications of emergent malicious activity.


Symantec is currently investigating reports of yet another new attack in the Middle East involving the destructive disk-wiping malware used by the Shamoon group W32.Disttrack, W32.Disttrack.B.


A backdoor also known as: W32.OnlineGamesXTUG.Worm Trojan-PSW.Win32.QQShou!O Trojan/PSW.QQShou.aqt Trojan.Win32.QQShou.evyqv TROJ_AGKT.SMUS6 Trojan.Qqshou-23 Trojan-PSW.Win32.QQShou.pfp Trojan.PWS.QQShou!WQNr+ttAX9g Trojan.Win32.PSWQQShou.80480[h] Troj.PSW32.W.QQShou.aqt!c Trojan.QQShou.Win32.1230 TROJ_AGKT.SMUS6 BehavesLike.Win32.Autorun.lc Trojan/PSW.QQShou.adz W32/VB.NII!tr Trojan[PSW]/Win32.QQShou Trojan.Graftor.D33E1 Trojan/Win32.QQShou PWS:Win32/QQpass.DW Win32/QQPass.NVO TrojanPSW.QQShou Win32.Trojan-qqpass.Qqrob.Hwwq Trojan-PWS.Qqshou Trojan.Win32.VB.NII


A backdoor also known as: Trojan/W32.Rootkit.9056.H Win32.Trojan.WisdomEyes.16070401.9500.9999 Hacktool.Rootkit Win32/Rookuz.S Trojan.Win32.Hmir.bczend Trojan.NtRootKit.13456 Downloader.Hmir.Win32.3829 Backdoor.Winnt Trojan[Downloader]/Win32.Hmir Troj.GameThief.W32.OnLineGames.kZeW Backdoor:WinNT/Blazgel.A Trojan/Win32.Rootkit.R24603 TrojanDownloader.Hmir Win32/RootKit.Rootkit.03f


A backdoor also known as: HW32.Packed.BD3E


Symantec first began looking into this threat in the fall of 2013.


Once this malware has successfully installed , it will collect personal data , passwords , keystrokes , banking information , and more .


A backdoor also known as: Trojan.Win32.A.Downloader.39936.EG Trojan.DownLoad2.31494 W32/Trojan.BMBV-5898 TR/Vodvit.A.10 Trojan:Win32/Vodvit.A Trojan.Graftor.D79FB


A backdoor also known as: HW32.Packed.71D4 Win32.Trojan.Kryptik.hj W32/Trojan.YMZM-8551 Trojan.Win32.SpyEyes.cxesvi Trojan.PWS.Papras.244 BehavesLike.Win32.DocumentCrypt.dc Trojan[Spy]/Win32.SpyEyes Trojan.Kazy.D5A6E2 TrojanDropper:Win32/Vawtrak.A Trojan/Win32.Reveton.R107579 TrojanPSW.Tepfer Backdoor.Andromeda Win32.Trojan.Atraps.Pbfq TrojanSpy.SpyEyes!jq5iqgzT3B4 Trojan-Spy.Zbot W32/Kryptik.EWVT!tr Win32/Trojan.73f


A backdoor also known as: W32.BackdoorWabot.Trojan Backdoor.Win32.Wabot!O Trojan.Wabot.A8 Trojan/Delf.nrf Win32.Backdoor.Wabot.a W32.Wabot Win32/DCMgreen.A BKDR_WABOT.SMIA Win.Trojan.Wabot-6113548-0 Backdoor.Win32.Wabot.a Trojan.Win32.Wabot.dmukv Backdoor.Win32.Wabot.157619 Backdoor.W32.Wabot.tn6b Trojan.Win32.Wabot.a Backdoor.Win32.Wabot.A Trojan.MulDrop6.64369 Backdoor.Wabot.Win32.1 BKDR_WABOT.SMIA BehavesLike.Win32.Wabot.wc P2P-Worm.Win32.Delf Backdoor/Wabot.z Trojan[Backdoor]/Win32.Wabot.a TrojanSpy:MSIL/Omaneat.B Trojan.ShellIni.E7E294 Backdoor.Win32.Wabot.a Worm/Win32.IRCBot.R3689 Backdoor.Wabot Backdoor.Wabot I-Worm.Delf.NRF Win32/Delf.NRF Backdoor.Wabot!jai+hnpgbwI W32/Luiha.M!tr


Starting on May 11, 2017, Flashpoint analysts observed several large spam campaigns originating from the Necurs botnet that aim to dupe recipients into opening malicious attachments that infect their computers with Jaff ransomware.


A backdoor also known as: Backdoor.Celofot.D Trojan/W32.Sasfis.93184.B Trojan.Win32.Sasfis!O Trojan.Sasfis TROJ_DELF.SMH Win32.Trojan.WisdomEyes.16070401.9500.9986 W32/Risk.WXEM-5531 Backdoor.Bifrose Trojan.Sasfis Win32/Sasfis.NUH Win.Trojan.Sasfis-42 Backdoor.Celofot.D Trojan.Win32.Sasfis.aobz Backdoor.Celofot.D Trojan.Win32.Sasfis.ikchn Trojan.Win32.A.Sasfis.93696.C Troj.W32.Smardf.lrGo Backdoor.Celofot.D Trojan.DownLoader4.42747 BehavesLike.Win32.SpywareLyndra.nc Trojan-Dropper.Delf W32/MalwareS.BHQS Trojan/Sasfis.koz Trojan/Win32.Sasfis.aobz Backdoor:Win32/Nitvea.A Backdoor.Celofot.D Trojan.Win32.Sasfis.aobz Trojan/Win32.Sasfis.R20535 Backdoor.Celofot.D Backdoor.Celofot.D Win32.Trojan.Sasfis.Pijo Trojan.Sasfis!nQm4iaN0os8 W32/Sasfis.LB!tr Win32/Trojan.6e1


A backdoor also known as: W32.FamVT.ExpiroPC.PE Win32.Backdoor.Prorat.e W32/Prorat.BNXP-3134 Backdoor.Prorat Win32/Prorat.19.P Win.Trojan.Delf-1540 Trojan.Win32.Tiny.baadu Backdoor.W32.Prorat!c BackDoor.ProRat.19 BehavesLike.Win32.Adware.tc Backdoor.Win32.Prorat W32/ProratX.ANJ BDS/Lurpen.rts W32/BDoor.AVW!dam Backdoor/Win32.Prorat.R111443 Backdoor.Prorat Bck/Prorat.HT Backdoor.Prorat!o+pRlXhwebo


A backdoor also known as: W32.OnlinegameJTPX.Trojan Virus.Win32.Sality!O Troj.GameThief.W32.WOW.hre!c Win32.Trojan.WisdomEyes.16070401.9500.9997 Infostealer.Gampass Win32/Wowpa.HS TROJ_FAM_0001989.TOMA Win.Trojan.Delf-1669 Trojan.Win32.PSWWow.22440.B TrojWare.Win32.Trojan.Banker.~d08 Trojan.PWS.Wow.1283 Trojan.WOW.Win32.2972 TROJ_FAM_0001989.TOMA BehavesLike.Win32.Sality.lc W32/Trojan.EOQM-5227 Trojan/PSW.Moshou.ars Trojan[GameThief]/Win32.WOW Win32.Troj.PswWowT.lk.kcloud TrojanDropper:Win32/Dozmot.B Trojan/Win32.OnlineGameHack.C54025 BScope.Trojan.OnlineGames.0825 Win32/PSW.WOW.DZI Win32.Trojan.Heurinject.Lnxt


A backdoor also known as: Joke.Movingmouse Joke/W32.BadJoke.21504 Joke.Movingmouse Joke.MoveMouse Win.Joke.MovingMouse-1 Hoax.Win32.BadJoke.MovingMouse.a Joke.Movingmouse Riskware.Win32.MovingMouse.hrfx Hoax.BadJoke.21504.A Win32.Trojan-psw.Badjoke.Suno Joke.Win32.BadJoke.MovingMouse.~FCD Joke.Movingmouse Trojan.MulDrop.28720 Aplicacion/MovingMouse.a not-a-virus:BadJoke.Win32.MovingMouse.a W32/Joke.RZZA-1623 not-virus:Joke.Win32.MovingMouse HackTool[Hoax]/Win32.MovingMouse Joke.Movingmouse Hoax.W32.BadJoke.MovingMouse.a!c Hoax.Win32.BadJoke.MovingMouse.a Joke.Movingmouse Unwanted/Win32.Movingmouse.R123022 Joke.Movingmouse Win32/Hoax.MovingMouse.B Win32/Trojan.2ff


A backdoor also known as: W64/Application.KFTW-0763 Trojan.Win64.AdAnti.exbcmq ADWARE/AdAnti.nqwib Adware.ChinAd Trj/CI.A Win32/Trojan.7be


WAKE_LOCK - Allows the application to use PowerManager WakeLocks to keep the processor from sleeping or the screen from dimming .


A backdoor also known as: Trojan.MSIL Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.MSIL.SpyGate.wsr Trojan.Win32.Disfa.dqmqly BehavesLike.Win32.Trojan.cc GrayWare/MSIL.Injector.AWA Trojan.Zusy.D28231 Trj/CI.A Trojan.Win32.Fsysna Win32/Trojan.7c5


tcpdo [ .


Consumers in English-speaking countries, in particular the US and UK, are most at risk, since this is where the largest numbers of targeted banks are located.


Earlier this month, we spotted a phishing campaign that led victims to unknowingly download the Banker malware.


A backdoor also known as: Trojan.Skeeyah.S5 Downloader.Chindo.Win32.162 Trojan.Adware.Graftor.D374DC not-a-virus:Downloader.Win32.Chindo.ap Trojan.Win32.Chindo.dumnyn Variant.Mikey.mvHB Adware.Chindo.12 PUA.RiskWare.Chindo RiskWare[Downloader]/Win32.Chindo.ap TrojanDownloader:Win32/Codumwis.B not-a-virus:Downloader.Win32.Chindo.ap BScope.Malware-Cryptor.Ngrbot Win32/RiskWare.Chindo.L


Odatv is a secular news organization founded in 2007 with a reputation for being critical of Turkey's government and the Gülen Movement.


This threat can download other malware and unwanted software onto your PC.


This malware appears to be newly developed with code that differs significantly from previously known Android malware .


These URLs are all in the form of “ http : // $ C2. $ SERVER. $ IP/api/ ? id= $ NUM ” .


A backdoor also known as: Backdoor.Bladabindi.FC.3722 Trojan.Zusy.D3D182 Win32.Trojan.WisdomEyes.16070401.9500.9999 BehavesLike.Win32.Trojan.lt MSIL/Small.CM!tr


A backdoor also known as: Trojan.Yakes.8842 Trojan/CsNowDown.c Win32.Trojan.WisdomEyes.16070401.9500.9736 Downloader.Darkmegi Win.Trojan.Darkcpn-1 Trojan.Win32.Yakes.ktpl Trojan.Win32.Gamania.dridjs Trojan.PWS.Gamania.34539 BehavesLike.Win32.Backdoor.ct Trojan.Graftor.DCAF7 Trojan.Win32.Yakes.ktpl Trojan:WinNT/Waltrodock.A Downloader/Win32.Darkmegi.C1839200 Trj/CI.A W32/CsNowDown.C


Command and Control T1437 Standard Application Layer Protocol Uses Firebase Cloud Messaging for C & C .


Decrypted EventBot configuration Decrypted EventBot configuration returned from the C2 .


Upon investigation we have determined the malware payload to be DELoader, which downloads a Zeus variant banking trojan upon execution.


A backdoor also known as: Trojan.Lexfir.A TrojanAPT.Lexfir.A6 Trojan.Lexfir.A TSPY_DERUSBI.SMJ1 Win32.Trojan.WisdomEyes.16070401.9500.9979 Infostealer.Derusbi TSPY_DERUSBI.SMJ1 Win.Trojan.Derusbi-42 Trojan.Lexfir.A Backdoor.Win32.Winnti.jr Trojan.Lexfir.A Trojan.Lexfir.A Trojan.Lexfir.A DLOADER.PWS.Trojan W32/Trojan.ZNCA-7493 TR/PSW.Lexfir.A.3 Trojan.Lexfir.A Backdoor.Win32.Winnti.jr PWS:Win32/Lexfir.A Backdoor/Win32.Etso.R30303 Win32.Backdoor.Winnti.Lfzs Trojan.Derusbi!jrrDP0rufRk Trojan-Spy.Win32.Derusbi W32/DERUSBI.C!tr Win32/Trojan.PSW.186


The unidentified financial group targeted regional and global banks with offices in the Middle East.


Security Service of Ukraine SBU indicated that Russian spies had implanted malicious softwares in the State Grid which caused power plants shut down unexpectedly.


However , it ’ s possible the set of commands may change in future versions of the Trojan .


A backdoor also known as: W32.LarmogasD.Trojan Dropped:Backdoor.Hupigon.211672 W32.Jadtre.B4 Trojan.Black.Win32.3180 Trojan/Dropper.Delf.dlv Dropped:Backdoor.Hupigon.211672 W32/Risk.UMVG-4201 TROJ_JADTRE.SMM Win.Spyware.66802-2 TScope.Malware-Cryptor.SB W32.Parite.lf96 TrojWare.Win32.PSW.OnLineGames.~LLD Trojan.PWS.Legmir.3153 BehavesLike.Win32.Gate.nh W32/Dropper.ANYI Trojan/KillAV.bbj TR/Drop.Delfdru.O Win32.PSWTroj.OnLineGames.kcloud Backdoor.Hupigon.D33AD8 Dropped:Backdoor.Hupigon.211672 Dropper/Win32.Microjoin.R1379 Dropped:Backdoor.Hupigon.211672 Dropped:Backdoor.Hupigon.211672 Trj/CI.A Trojan.DR.Delfdru!ayAD7it/9FQ Win32/Trojan.Dropper.cad


APT19 used three different techniques to attempt to compromise targets.


A backdoor also known as: AIT:Trojan.Autoit.CAQ AIT:Trojan.Autoit.CAQ Win32.Trojan.WisdomEyes.16070401.9500.9949 AIT:Trojan.Autoit.CAQ Trojan-Banker.Win32.AutoIt.zl AIT:Trojan.Autoit.CAQ Trojan.DownLoader23.53524 Trojan/Banker.AutoIt.bu TrojanSpy:Win32/Aneatop.A Trojan-Banker.Win32.AutoIt.zl Win32.Trojan-banker.Autoit.Suny Win32/Trojan.5f1


A backdoor also known as: W32.WscmgrA.Trojan Trojan-PSW.Win32.Delf!O Trojan/PSW.Delf.abx Win32.Trojan.WisdomEyes.16070401.9500.9700 W32/Autorun.MSPP-2235 W32.SillyFDC Win32/Retecha.A WORM_DELF.NAN Win.Trojan.Delf-3449 Trojan-PSW.Win32.Delf.abx Trojan.Win32.Delf.brmlqc Trojan.Win32.Autorun.382020 Win32.Trojan-qqpass.Qqrob.Sxyo Trojan.PWS.Sadas Trojan.Delf.Win32.3468 WORM_DELF.NAN W32/Autorun.O Trojan/PSW.GamePass.yqg TR/PSW.Delf.abx.3 Worm:Win32/Hamtacker.A Trojan-PSW.Win32.Delf.abx Worm/Win32.AutoRun.R76556 Worm.Brontok Trojan.Delf.ABX Win32/PSW.Delf.ABX Hacktool.Dialuppass.A not-a-virus:PSWTool.Win32.Dialupass.an W32/Autorun.PG.worm Win32/Trojan.PSW.8bb


And this just means attackers will continue to be successful .


The following scenario may play out : according to the templates for processing incoming SMSs , Rotexy intercepts a message from the bank that contains the last four digits of the bank card connected to the phone number .


Yet perhaps most notably, BianLian has shifted the main focus of their attacks away from ransoming encrypted files to focus more on data-leak extortion as a means to extract payments from victims.


Visa also published a list of Internet addresses that may have been involved in the Oracle breach and are thought to be closely tied to an Eastern European organized cybercrime gang.


Destructive malware used by unknown computer network exploitation CNE operators has been identified.


The earliest instance where a cyber attack was attributed to the OilRig campaign was in late 2015.


This screen persists on the screen and prevents the user from using the navigation buttons .


android.intent.action.SIM_STATE_CHANGED System notification that the SIM card has changed or been removed .


] com/gate_cb8a5aea1ab302f0_c online 185.158.249 [ .


If the geolocation points to Brazil, then another malicious file is downloaded.


Command Description push Shows a push notification .


Furthermore , we found that in just the first two weeks of 2017 , there have been more than 120 such spyware variants already built using the same SpyNote Trojan builder as SpyNote RAT and roaming in the wild .


A backdoor also known as: Trojan.BitcoinMiner Win32.Trojan.WisdomEyes.16070401.9500.9983 Downloader.MisleadApp not-a-virus:RiskTool.Win32.BitCoinMiner.iqlc Trojan.Win32.Z.Svcminer.27648 RiskTool.BitCoinMiner.gvg TR/Downloader.knzhj RiskWare[RiskTool]/Win32.BitCoinMiner TrojanDownloader:Win32/SvcMiner.A!bit not-a-virus:RiskTool.Win32.BitCoinMiner.iqlc Trojan/Win32.Mepaow.C87266 Trj/GdSda.A Trojan.CoinMiner


] net page for DroidVPN remained identical when serving either HenBox or DroidVPN apps , just that the legitimate APK file had been replaced with HenBox for an unknown period of time .


A backdoor also known as: W32.RadmasAM.Trojan Worm/W32.Updater.65536.B Virus.Win32.Sality!O Win32.Worm.Pepex.b W32.Virut.CF Win32/Tnega.AQRF WORM_DIPASIK.SM Win.Worm.Updater-4 Email-Worm.Win32.Updater.n Hoax.W32.ArchSMS.m5oU Win32.HLLM.Updater.5 WORM_DIPASIK.SM Email-Worm.Win32.Atak Worm/Updater.e Worm[Email]/Win32.Updater Worm:Win32/Networm.A Email-Worm.Win32.Updater.n Trojan/Win32.Kykymber.R128813 Worm.Updater Win32/Pepex.I Trojan.Win32.Snake.a


Playing further off the suggested GAS Tecnologia link , the app promises better security for its users .


Several days ago, researchers at FireEye attributed a recent phishing campaign to FIN7, a campaign in which cybercriminals delivered malicious Microsoft Office documents to users, deploying both Cobalt Strike and a VBS-based backdoor on infected workstations.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9974 Trojan.Win32.ArchSMS.cwxrht Hoax.MSIL.gn Trojan:MSIL/Blinerarch.AU Trj/CI.A Msil.Risk.Hoax.Wure Trojan.ArchSMS!IMpJTYjIG18 Hoax.MSIL Win32/Trojan.Dropper.411


A backdoor also known as: W32/Systex.A Trojan.Inject1.7920 Win32.Troj.Undef.kcloud VirTool:Win32/Obfuscator.XZ Rootkit.Xytets HeurEngine.Vmpbad Trojan.Spy.Texy!4898 Trojan.Win32.Spy Trj/Thed.W


Subsequently , the malware will change the screen off time-out to 10 minutes .


A backdoor also known as: Trojan.Graftor.D255EA Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan BackDoor.Miniduke.3 BehavesLike.Win32.RansomWannaCry.tz Trojan.Win32.Bayrob TR/Crypt.ZPACK.88814 Trojan[Backdoor]/Win32.CosmicDuke Win32.Hack.CosmicDuke.h.kcloud Trojan:Win32/Bandiu.A Backdoor.CosmicDuke Backdoor.CosmicDuke! W32/CosmicDuke.F!tr.bdr


A backdoor also known as: Virus.Pesin.Win32.2 Trojan.Heur.E41DEE Win32.Trojan.WisdomEyes.16070401.9500.9997 Win32/Pesin.C Virus.Win32.HLLW.Delf.b Virus.Win32.HLLW.gjjl Trojan.PWS.Mob Trojan/HLLP.s W32/Banker.TOA!tr Worm:Win32/Pesin.C Virus.Win32.HLLW.Delf.b Trojan.Worm.Delf


A backdoor also known as: W32.HfsAutoB.35FE WORM_METSYS.SMI W32/Trojan.ZLO Win32/ProRat.AL WORM_METSYS.SMI Trojan.Ratibe W32/Trojan.JJUN-8278 Trojan:Win32/Metsys.A HEUR/Fakon.mwf W32/MediaTest.A.worm


A backdoor also known as: W32.RansomGimemoE.Trojan Trojan-Ransom.Win32.Gimemo!O Trojan.Dofoil.A Trojan.Gimemo.Win32.2687 Trojan/Injector.sxm Win32.Trojan.Injector.ec W32.Pilleuz Win32/Loktrom.FR TROJ_RANSOM.SM3 Win.Trojan.Injector-603 Trojan-Ransom.Win32.Gimemo.vhu Trojan.Win32.Gimemo.tfgni Trojan.Win32.A.Gimemo.83968 Trojan.Packed.22718 TROJ_RANSOM.SM3 BehavesLike.Win32.ZBot.dc Trojan/Gimemo.cmk Trojan[Ransom]/Win32.Gimemo Ransom:Win32/Loktrom.A Trojan.Zusy.D2A53 Win.Adware.Websearch.moge Trojan-Ransom.Win32.Gimemo.vhu Trojan/Win32.Injector.R30428 BScope.Trojan-Injector.2151 Trojan.Injector!ZShGusAMkc8 Trojan-Ransom.Win32.Gimemo W32/Zbot.YW!tr


In the past two years, two campaigns of Sakula activity stand out as being particularly significant – the French Aerospace Campaign and the Ironman Campaign.


After the files are encrypted filenames are appended with .rokku


A backdoor also known as: Trojan.VB Trojan.Midie.DA596 Win32.Trojan.VB.gx W32/Trojan.ZVBM-4484 Win32/FakeRecycled.A WORM_VB.SMF Win.Trojan.VB-684 Trojan.Win32.VB.aqt Trojan.DownLoad3.64248 WORM_VB.SMF BehavesLike.Win32.Dropper.wc Trojan.Atros6 W32/Trojan.XUP Trojan.Qhost.pw TR/VB.AQT Trojan/Win32.VB Worm:Win32/Fakerecy.A Trojan.Win32.VB.aqt Trojan/Win32.Tiggre.R216587 SScope.Trojan.VBRA.7311 Trj/CI.A Worm.Autorun.DU


As a part of this campaign, we also observed attacks on Russian-speaking financial analysts working at global financial firms and covering telecom corporations in Russia, likely a result of collateral damage caused by the attackers targeting tactics.


A backdoor also known as: Trojan.Win32.Jorik.IRCbot!O Trojan.Jorik Trojan.Jorik.Win32.190644 Troj.W32.Jorik.Ircbot!c Trojan/IRCBot.nhr Win32.Trojan.WisdomEyes.16070401.9500.9992 W32.IRCBot Trojan.Win32.Jorik.IRCbot.wja Trojan.Win32.Jorik.dgdeqb BackDoor.IRC.Sdbot.17833 BehavesLike.Win32.Trojan.nh Trojan.Win32.Jorik Trojan/Jorik.gmen Trojan/Win32.IRCbot Trojan.Win32.Jorik.IRCbot.wja Trojan:Win32/Squida.A Worm/Win32.IRCBot.R123038 Trojan.IRCbot Win32.Trojan.Jorik.Ahef Win32/Trojan.053


The newest variant, TeslaCrypt 2.0, uses the same encryption algorithm; however, the keys and other configuration data are stored in the Windows Registry instead of a file on the local disk as in previous versions.


During our investigation, we were able to discover a number of domains all part of the same infrastructure with custom skimmers for several Magento stores.


The Trojan may ask the user to pay a ransom in order to have their files decrypted.


While SeaDuke is a single - albeit cross-platform - trojan, CloudDuke appears to be an entire toolset of malware components, or solutions as the Duke group apparently calls them.


A backdoor also known as: Trojan.Strictor.D1A6AB BehavesLike.Win32.DlHelper.tc Trojan:Win32/Merca.A Trj/GdSda.A Trojan-Spy.Banker W32/Delf.OKU!tr


According to several timestamps , this payload is used by implant versions created since 2016 .


A backdoor also known as: W32.HfsAuto.5860 Backdoor.Lesbot.152 Backdoor.Lesbot.152.n2 Trojan.Win32.Lesbot.djep Win32/Lesbot.B WORM_NETSPREE.A Backdoor.Win32.Lesbot.152 Backdoor.Lesbot.152 Backdoor.Leeter.B Worm.Win32.Netspree Worm.Win32.Netspree.A Backdoor.Lesbot.152 Win32.IRC.Bot.based WORM_NETSPREE.A Backdoor/Lesbot.152 Bck/Lesbot.152 Win32.Hack.Lesbot.kcloud Backdoor.Lesbot.152 W32/Risk.OZRI-5730 Win32/Netspree.worm.48448 Win32/Netspree.A Backdoor.Lesbot.152.a Backdoor.Win32.Lesbot.152 W32/Lesbot.152!tr


A backdoor also known as: Trojan-Spy/W32.AutoHK.877056 TrojanSpy.AutoHK W32/Trojan.FIJU-8952 Trojan-Spy.Win32.AutoHK.b Trojan.Win32.Z.Autohk.877056.A Win32.Trojan-spy.Autohk.Anzi TrojWare.Win32.Hadoc.AS BehavesLike.Win32.Dropper.ch PUA.EnigmaProtector TrojanSpy.AutoHK.a Trojan:Win32/Haudicx.A!bit Troj.Spy.W32!c Trojan-Spy.Win32.AutoHK.b Trojan/Win32.Asprox.R130565 TrojanSpy.AutoHK Win32/Spy.AHK.E


A backdoor also known as: W32.Cantone.Trojan Win32.Worm.TTE Worm.Win32.Zombaque!O Worm.Ppzombie.A3 Worm.Zombaque.Win32.16 Win32.Worm.TTE WORM_BIZOME.SMF W32/Risk.KAIL-2278 W32.Spybot.Worm Win32/Zombaque.B WORM_BIZOME.SMF Win.Worm.Bizome-4 Worm.Zombaque Worm.Win32.Zombaque.h Trojan.Win32.Zombaque.igegn Trojan.Win32.P2P-Icmp.437760 Win32.HLLW.RAhack.2 BehavesLike.Win32.Downloader.gc Worm.Win32.Zombaque W32/Zombaque.A Worm/Zombaque.k Win32.Virut.cr.61440 Worm:Win32/Ppzombie.A Win32.Worm.TTE Worm.Win32.Zombaque.h Worm/Win32.Zombaque.R15854 Win32.Worm.TTE Win32.Worm.TTE Win32/Zombaque.B Virus.Win32.Virut.ue Worm.Zombaque!1mLwNArV7Hg


The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality.


A backdoor also known as: Trojan.Ceeinject.6879 PWS-Spyeye.cr Trojan/PornoAsset.avl TROJ_KRYPTO.SMOZ Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Ransom.AQY TROJ_KRYPTO.SMOZ Win.Trojan.Ransom-1156 Trojan.Win32.A.PornoAsset.43521 Trojan.Winlock.3300 PWS-Spyeye.cr Trojan/PornoAsset.nh TR/Winlock.CR Trojan[Backdoor]/Win32.Buterat Trojan.Barys.D8A2 Ransom:Win32/Trasbind.A Trojan/Win32.Tdss.R14197 Hoax.PornoAsset Trojan.Win32.Jorik


On the 9th of August, a tweet from @MalwareHunterTeam caught my eye; it mentioned a fake Flash update that used a PowerShell script to connect to a very particular host


Nemesis, the malware ecosystem used by FIN1, includes comprehensive backdoors that support a variety of network protocols and communication channels for command and control CnC.


A backdoor also known as: W32.HfsOval.152A Backdoor.Win32.VB!O Backdoor.VB.MV3 Trojan.Llac.Win32.24709 Trojan/Injector.eih BKDR_RSHOT.SMA Win32.Backdoor.VB.y BKDR_RSHOT.SMA Win.Trojan.6387874-3 Trojan.Win32.Temr.ssc Trojan.Win32.Temr.ejiehl Backdoor.W32.Ciadoor.lo5L TrojWare.Win32.Qhost.nls Trojan.DownLoader16.56820 Backdoor.Win32.VB BehavesLike.Win32.Trojan.tc Trojan.Temr.ak Backdoor:Win32/Lybsus.A Trojan.Graftor.D4305 Backdoor.Win32.A.VB.168034 Trojan.Win32.Temr.ssc Backdoor.Win32.VB Backdoor.VB Trojan.Injector!pDYfo+3Pf04 Trojan-Spy.Win32.KeyLogger W32/DarkKomet.GUKH!tr Trj/CI.A


Technical details Here is the meta information for the observed samples , certificates and hardcoded version stamps : Certificate MD5 Module Version Serial Number : 0x76607c02 Issuer : CN=Ron Validity : from = Tue Aug 30 13:01:30 MSK 2016 to = Sat Aug 24 13:01:30 MSK 2041 Subject : CN=Ron 9e005144ea1a583531f86663a5f14607 1 – 18abe28730c53de6d9e4786c7765c3d8 2 2.0 Serial Number : 0x6a0d1fec Issuer : CN=Sun Validity : from = Mon May 16 17:42:40 MSK 2016 to = Fri May 10 17:42:40 MSK 2041 Subject : CN=Sun 9ffc350ef94ef840728564846f2802b0 2 v2.51sun 6c246bbb40b7c6e75c60a55c0da9e2f2 2 v2.96s 7c8a12e56e3e03938788b26b84b80bd6 2 v3.09s bde7847487125084f9e03f2b6b05adc3 2 v3.12s 2560942bb50ee6e6f55afc495d238a12 2 v3.18s It ’ s interesting that the issuer “ Sun ” matches the “ Sun1 ” and “ Sun2 ” identifiers of infected devices from the FTP server , suggesting they may be test devices .


A backdoor also known as: Backdoor.Masteseq Win32.Trojan.WisdomEyes.16070401.9500.9872 Backdoor.Masteseq Trojan.Win32.Masteseq.evvgyd Backdoor.W32.Masteseq!c BackDoor.Liskey Backdoor.Masteseq.x Backdoor:Win32/Masteseq.AC Trojan/Win32.Masteseq.R12342 Trj/GdSda.A Win32.Backdoor.Masteseq.Lpbn Backdoor.Win32.Masteseq Win32/Trojan.d37


Cisco Talos is currently observing a widespread campaign leveraging the Samas/Samsam/MSIL.B/C ransomware variant.


Last March 2016, we noted that PowerWare crypto-ransomware also abused PowerShell.


What makes this botnet successful is its highly configurable and modular design that can fit any malicious intent, like distributing Zeus or, more recently, distributing a Lethic bot.


A backdoor also known as: Trojan.Exploit.WordPerf.B Trojan/Exploit.WordPerf.b TROJ_WORDPERF.B W32/Risk.DAAG-1937 Win32/Exploit.WordPerf.B TROJ_WORDPERF.B Win.Trojan.Exploit-204 Exploit.Win32.WordPerf.b Trojan.Exploit.WordPerf.B Exploit.Win32.WordPerf.gpac Exploit.W32.WordPerf.b!c Trojan.Exploit.WordPerf.B TrojWare.Win32.Exploit.WordPerf.B Trojan.Exploit.WordPerf.B Exploit.Qaaz Exploit.WordPerf.Win32.2 Exploit.WordPerf.b TR/Expl.WordPerf.B Trojan[Exploit]/Win32.WordPerf Win32.EXPLOIT.WordPerf.b.kcloud Exploit:Win32/WordPerf.B Trojan.Exploit.WordPerf.B Exploit.Win32.WordPerf.b Trojan.Exploit.WordPerf.B Trojan.Exploit.WordPerf.B Win32.Exploit.Wordperf.Wxrv Exploit.WordPerf!zPzGZ0A1+Q4 Trojan.Win32.Exploit W32/WordPerf.B!exploit Win32/Trojan.827


Rokku seems to be distributed by a malicious document, which contains a macro that when is executed downloads and runs Rokku.


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G PE_VIRUX.O W32.Virut.CF Win32/Virut.17408 PE_VIRUX.O Win32.Virus.Virut.Q Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg W32.Virut.mzNk Win32.Virut.56 Virus.Virut.Win32.1938 Win32/Virut.bt Virus/Win32.Virut.ce Win32.Virut.cr.61440 TrojanDownloader:MSIL/Tackerkin.A Virus.Win32.Virut.ce Win32/Virut.F Virus.Virut.14 W32/Sality.AO Win32/Virut.NBP Trojan-Downloader.MSIL W32/Virut.CE Virus.Win32.VirutChangeEntry.A


We have detected a total of 17 C & C servers on 4 different domains , which probably means the bad guys are quite familiar with what redundancy is .


Both the loader and dropped class are obfuscated using ProGuard , which obfuscates names using alphabet letters .


A backdoor also known as: Ransom.Ryzerlo.A3 Trojan.Ransom.HiddenTears.1 Ransom_BLOCCATO.SM Ransom.HiddenTear Ransom_BLOCCATO.SM MSIL.Trojan-Ransom.Cryptear.B Trojan.Win32.Filecoder.ethwkz Trojan.Win32.Z.Ransom.211968.EF TrojWare.MSIL.Ransom.Ryzerlo.A Trojan.Encoder.10598 Trojan-Ransom.HiddenTear TR/ATRAPS.jnrzk Ransom.HiddenTear/Variant Trojan.Ransom.HiddenTear Trj/GdSda.A MSIL/Filecoder.Y!tr Win32/Trojan.61e


The implant provides the ability to grab a lot of exfiltrated data , like call records , text messages , geolocation , surrounding audio , calendar events , and other memory information stored on the device .


A backdoor also known as: W32.Clod232.Trojan.380a Heur.Win32.Veebee.1!O TrojanSpy.VB!WEMPyAgOnlg W32/MalwareF.ZFHU Trojan-Spy.Win32.VB.dwb Trojan.Win32.VB.cpxay Trojan.Win32.A.VB.77932 TrojWare.Win32.TrojanSpy.VB.NNW Trojan.DownLoader1.62643 Trojan[Spy]/Win32.VB PWS:Win32/Gypthoy.A W32/Risk.FBWB-6710 Trojan.VBRA.02824 Trojan-Spy.Win32.VB W32/VB.DWB!tr