INDEX MNEMONIC DESCRIPTION 0x0 JMP Special obfuscated conditional Jump ( always taken or always ignored ) 0x1 JMP Jump to a function ( same as opcode 0x10 ) 0x2 CALL Call to the function pointed by the internal VM value 0x3 CALL Optimized CALL function ( like the 0x1E opcode of the 32-bit VM ) 0x4 EXEC Execute code and move to the next packet 0x5 JMP Jump to an internal function 0x6 NOP No operation , move to the next packet 0x7 CALL Call an imported API ( whose address is stored in the internal VM value ) 0x8 LOAD Load a value into the VM descriptor structure * 0x9 STORE Store the internal VM value inside a register 0xA WRITE Resolve a pointer and store the value of a register in its content 0xB READ Move the value pointed by the VM internal value into a register 0xC LOAD Load a value into the VM descriptor structure ( not optimized ) 0xD CMP Compare the value pointed by the internal VM descriptor with a register 0xE CMP Compare the value pointed by the internal VM descriptor with an immediate value 0xF XCHG Exchange the value pointed by the internal VM descriptor with a register 0x10 SHL Jump to a function ( same as opcode 0x1 ) This additional virtual machine performs the same duties as the one already described but in a 64-bit environment .


The campaign was found to have delivered several types of malware including Redline Stealer, AgentTesla, Eternity, Blackmoon and Philadelphia Ransomware.


A backdoor also known as: W32.Otwyacal.C Win32.Trojan.WisdomEyes.16070401.9500.9748 W32.Wapomi.C!inf Win.Trojan.Vjadtre-6170948-0 Win32.HLLP.Protil.1 BehavesLike.Win32.Virut.ch W32/Jadtre.C Trojan.Symmi.D4E83 Trj/CI.A Win32/Wapomi.Z Virus.Win32.Wapomi.a Exploit.Win32.ShellCode


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Msil Trojan.Kazy.D4D672 TrojanDownloader:MSIL/Winpud.A Trojan/Win32.Inject.C149530 Win32/Trojan.a9f


However, the attacks against targets in the Middle East except Israel were renewed in less than 20 days.


rename .APK Android application package files used to install the malicious apps,


Malicious code was appended to the compromised script file, which redirected a visitor.


The backdoor provided an alternative foothold in several observed instances for the group and employed a few tricks like using the Intel SSE extended instruction set to avoid emulation and obscure analysis.


The malware uses the Tor anonymity network for command and control C2 and does not require network connectivity to encrypt files, which complicates detection, prevention, and remediation.


The list of vulnerable devices, as well as the logins and passwords that go with them, are stored on the server belonging to the cybercriminals.


NexusLogger is a cloud-based keylogger that uses the Microsoft .NET Framework and has a low level of sophistication.


A backdoor also known as: Trojan.Crypt.CC Packed.Win32.CPEX-based!O Backdoor.PePatch.Win32.2676 Trojan.Crypt.CC W32/Trojan.GQIB-3577 TrojanSpy.KeyLogger Trojan.Win32.Llac.laav Trojan.Win32.CPEXbased.oyaq Trojan.Win32.Buzus.589824[UPX] Packer.W32.CPEX-based.kZ3Y Trojan.Crypt.CC Trojan.PWS.Lineage.4319 BehavesLike.Win32.PUPXAO.dh W32/Trojan2.ANIR Trojan/Buzus.afzu TR/Dldr.Buzus.dhk Trojan[Packed]/Win32.CPEX-based TrojanDropper:Win32/Sharke.C Trojan.Crypt.CC Trojan.Win32.Llac.laav Trojan.Crypt.CC Trojan/Win32.Buzus.C22005 Trojan.Crypt.CC Trojan.Crypt.CC HackTool.Win32.Crypt


The URLs for Sundown requests for Flash files end in .swf, while Silverlight requests end in .xap.


A backdoor also known as: Backdoor.Trojan Trojan.Win32.Mlw.euwoug Backdoor:Win32/DarkEnergy.A!bit Backdoor.Bot Trj/GdSda.A


After laying low for a few years, it had a sudden resurgence last May.


A backdoor also known as: W32.Surabaya.Worm Worm.Win32.AutoRun!O Worm.SillyShare.EE2 W32/Pitin.worm Worm.AutoRun W32.W.AutoRun.luA8 WORM_VB.DTH Win32.Trojan.VB.iy W32/Worm.BGBK W32.SillyFDC Win32/Dodaykil.B WORM_VB.DTH Win.Worm.VB-632 Worm.Win32.AutoRun.bant Trojan.Win32.AutoRun.cnwrek Trojan.Win32.Autorun.40960.R Worm.Win32.VB.~E Win32.HLLW.Autoruner.874 Virus.VB.Win32.86 BehavesLike.Win32.Dropper.ch Worm.Win32.AutoRun W32/Worm.DPLM-0673 Worm/AutoRun.tyn TR/VB.aei Worm/Win32.AutoRun Trojan.Heur.E9EB80 Worm.Win32.AutoRun.bant Worm:Win32/SillyShareCopy.E HEUR/Fakon.mwf SScope.Trojan.VBO.0348 Trj/Yabarasu.A Worm.Pitin Win32/VB.DG Trojan.Win32.Autorun.bep Worm.SillyShareCopy!GFdqFqCX45w


A backdoor also known as: W97M.Dropper.MM W97M/Dropper.x W97M/Mdropper.G W2KM_FAREIT.IAV Trojan.Script.Drop.dyxcgh Trojan-Dropper:W97M/MaliciousDoc.A Trojan.PWS.Stealer.4118 W2KM_FAREIT.IAV W97M/Mdropper.G TR/Crypt.Xpack.310779 Trojan[PSW]/Win32.Fareit TrojanPSW.Fareit possible-Threat.Embedded.ExeInOffice virus.office.qexvmc.1100


Operation Groundbait Russian: Прикормка, Prikormka is an ongoing cyber-surveillance


This malicious app , detected by ESET as a variant of Android/Twitoor.A , can ’ t be found on any official Android app store – it probably spreads by SMS or via malicious URLs .


When reviewing the decrypted packet , it ’ s clear it has the same content as previous versions .


] net .


The entered data is then checked and the last four digits of the bank card number are also checked against the data sent in the C & C command .


] com www5.zyns [ .


The developer name used , GAS Brazil , suggests the criminals behind the app targeted Brazilian users .


A backdoor also known as: VB:Trojan.Valyria.849 W97M.Downloader.BLR Troj.Downloader.Msoffice!c W97M.Downloader W2KM_HANCITOR.YYSYN VB:Trojan.Valyria.849 VB:Trojan.Valyria.849 Trojan.Script.Downloader.espmja VB:Trojan.Valyria.849 VB:Trojan.Valyria.849 W2KM_HANCITOR.YYSYN TrojanDownloader:O97M/Damatak.A VB:Trojan.Valyria.849 virus.office.qexvmc.1080


Volexity has tied this attack campaign to an advanced persistent threat APT group first identified as OceanLotus by SkyEye Labs in 2015.


Probably, attackers used web site vulnerabilities for placing malicious files.


Since our previous publication, we have found another, similar but different payload used to target a second organization in Saudi Arabia that was configured to wipe systems twelve days later on November 29, 2016.


A backdoor also known as: Trojan/Losya.gg Trojan-Ransom.Win32.Losya.gg Trojan-Ransom.Win32.Losya!IK Trojan.Winlock.2932 Trojan/Losya.cs Trojan:Win32/LockScreen.BA Hoax.Losya.bd Trojan-Ransom.Win32.Losya W32/Krap.A!tr


Servers of The Left in German Bundestag have been infected with malware, apparently by a state-sponsored group of Russian origin.


Sakula also leverages single-byte XOR encoding to obfuscate various strings and files embedded in the resource section, which are subsequently used for User Account Control UAC bypass on both 32 and 64-bit systems.


A backdoor also known as: Trojan/W32.ICQNuker.19456 Trojan.ICQNuker!jj+ciDVRnhs Hacktool.Nuker Smalltroj.EAH TROJ_ICQNUKER.A Trojan.ICQNuker Trojan.Win32.ICQNuker Trojan.Win32.ICQNuker Trojan.Win32.ICQNuker.dhzl TrojWare.Win32.ICQNuker Trojan.Win32.ICQNuker Trojan.ICQNuker TROJ_ICQNUKER.A Trojan/Win32.ICQNuker Trojan.Win32.ICQNuker.19456 Trojan.Win32.ICQNuker Win32.Trojan.ICQNuker Hacktool.Nuker


Linux malware is slowly becoming more popular.


This porn clicker Trojan, which we detect as Android/Clicker, has once more become available for download from Play Store.


A backdoor also known as: Trojan.Downloader.LoadAdv.ABV Trojan.Piptea Downloader.Small.Win32.11983 Trojan.Downloader.LoadAdv.ABV Multi.Threats.InArchive W32/Downldr2.FZLV Trojan.Dropper Win.Downloader.65024-1 Trojan-Downloader.Win32.Small.agns Trojan.Downloader.LoadAdv.ABV Trojan.Win32.Small.bcwtvk Trojan.Win32.Downloader.246584 Trojan.Downloader.LoadAdv.ABV W32/Downloader.UPFZ-7129 Trojan[Downloader]/Win32.Small Trojan:Win32/Piptea.E Trojan-Downloader.Win32.Small.agns Trojan.DL.Small!mUFJjjvpkTw Email-Worm.Win32.Joleee Win32/Trojan.8ed


A backdoor also known as: Win32/Adclicker.DH Trojan-Clicker.Win32.Small!O Trojan/Clicker.Small.tc Trojan.Zusy.D730F Win32.Trojan.WisdomEyes.16070401.9500.9905 W32/Trojan.HWTO-6812 Trojan.KillAV Win32/TrojanClicker.Small.QZ TROJ_CLICKER.UU Win.Trojan.Clicker-1328 Trojan.Win32.Small.pbsu Trojan.Win32.Clicker.20480.C TrojWare.Win32.TrojanClicker.Small.QZ Trojan.PWS.Gamania.16782 Trojan.Small.Win32.16009 W32/Trojan2.AUEO TrojanClicker.Small.aps W32.Email.Worm.Silly TR/Click.Mon.1 Trojan[Clicker]/Win32.Small Dropper/Win32.Small.R41509 TrojanClicker.Small Trj/CI.A Trojan-Downloader.Win32.Small W32/CLICKER.UU!tr Win32/Trojan.d06


SpyNote RAT is capable of performing a variety of alarming functions that includes : Activating the device ’ s microphone and listening to live conversations Executing commands on the device Copying files from the device to a Command & Control ( C & C ) center Recording screen captures Viewing contacts Reading SMS messages The screenshot below shows part of the sandbox ’ s report on the SpyNote RAT ’ s signature and detected functions : The fake Netflix app we are analyzing in this blog appears to be built using an updated version of SpyNote RAT builder , which was leaked last year .


The details we are releasing are to provide insight into attack methodologies being employed by sophisticated groups such as FIN7 who are consistently changing techniques between attacks to avoid detection.


The Dyre group, a major malware spam producer, has changed their initial malware dropper to utilize Microsoft Word document macros instead of the usual executable types, such as .exe files contained in a .zip.


A backdoor also known as: Ransom_Shieldcrypt.R00WC0DEQ17 Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Ransom.WTYO-5087 Ransom.Troldesh Ransom_Shieldcrypt.R00WC0DEQ17 Win32.Trojan-Ransom.Filecoder.BO Trojan.Win32.Encoder.ephyjr Trojan.Encoder.11787 Ransom:Win32/Shieldcrypt.A Trj/GdSda.A Win32.Trojan.Raas.Auto Trojan-Ransom.Shieldcrypt


A backdoor also known as: W32/Backdoor2.DBLT WS.Reputation.1 Win32.TRVirtl HackTool.Patcher!7MmWKbVM2EE Tool.DVTPatch TR/Virtl.7341 Trojan/Virtl.b Win32.HACKTOOL.pocomail.cx.kcloud W32/Backdoor2.DBLT Trojan.Virtl.7341


IOC s for the Wildifre ransomware


A backdoor also known as: Trojan/PinkBlocker.arw Trojan.Heloag BKDR_HELOAG.SM PUA.Packed.ASPack BDS/Heloag.A.30 BKDR_HELOAG.SM Backdoor.Win32.Heloag!IK Backdoor:Win32/Heloag.A Trojan.Heloag Backdoor.Win32.Heloag Trj/CI.A


Symantec discovered the Greenbug cyberespionage group during its investigation into previous attacks involving W32.Disttrack.B aka Shamoon.


A backdoor also known as: Backdoor.Win32.Rbot!O Backdoor.Rbot.20414 Win32.Trojan.WisdomEyes.16070401.9500.9964 Win.Trojan.Mybot-4324 Trojan.Win32.Rbot.cuqnmc Win32.HLLW.MyBot.based Backdoor.RBot.Win32.38765 BehavesLike.Win32.Msposer.jz Backdoor.Win32.SdBot EXP/DameWare.ggg Trojan[Backdoor]/Win32.Rbot Win32.Hack.RBotT.a.83968 Backdoor.Win32.Sdbot.yx W32/SdBot.IT!tr.bdr


Cylance SPEAR has uncovered a long-standing persistent threat targeting numerous major industries spread across Japan, South Korea, the United States, Europe, and several other Southeast Asian countries.


After obtaining the desired rights , the Trojan sets itself as the default SMS app ( by independently clicking Yes in AccessibilityService ) , before vanishing from the device screen .


A backdoor also known as: Trojandownloader.Script Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Drop.etdypm Trojan.MulDrop7.42636 BehavesLike.Win32.Dropper.fh W32/Trojan.EURA-7093 Trojan:VBS/Sminager.D Exploit.UACSkip Trj/CI.A Exploit.UACSkip! Win32/Trojan.Downloader.251


A backdoor also known as: W32.HfsAutoB.424D Virus.Hupigon.Win32.5 Trojan/PSW.QQShou.is TSPY_QQSHOU.GY Win32.Trojan.WisdomEyes.16070401.9500.9956 W32/Trojan.KBAU-5151 Trojan.PWS.QQPass TSPY_QQSHOU.GY Backdoor.Win32.Hupigon.vpk Trojan.Win32.QQShou.lofh Backdoor.W32.Rbot.lgxa Backdoor.Win32.Popwin.~IQ Trojan.PWS.Gamania.5830 W32/Trojan.LGV Trojan/PSW.QQShou.eu Trojan[Backdoor]/Win32.Hupigon.vpk PWS:Win32/Whoran.A Backdoor.Win32.Hupigon.vpk Trojan.PWS.QQShou!NqwrJPeZllY W32/Hupigon.VPK!tr.pws


] com/api/s2s/tracks/ and is used for activation .


A backdoor also known as: Trojan.Rotbrow.KK6 PUP.Optional.BProtector Trojan.Bromngr.Win32.445 Win32.Adware.Bprotector.a Adware.GoonSquad Win.Adware.BProtector-1 Win32.Application.BHO.A Trojan.Win32.BGuard.cunxgw Application.Win32.bProtector.KA Adware.BGuard.47 Trojan-Dropper.Win32.Rotbrow Trojan.Bromngr.ed W32.Adware.Installbrain Trojan.Adware.BHO.Bprotector.1 TrojanDropper:Win32/Rotbrow.A W32/Bprotect.B!tr Trj/CI.A Win32/Trojan.10d


A backdoor also known as: Trojan.Kryptik.ASES Trojan.MulDrop1.32726 Win32/Tnega.CZG


Further research of the attacker ’ s infrastructure revealed more related mimicking domains .


A backdoor also known as: Trojan.Crypt.Delf.AL Worm/W32.G_Spot.200704 Backdoor.G_Spot.r8 W32/Grandspot.worm!p2p Trojan.Crypt.Delf.AL W32/G_Spot.c Trojan.Win32.GSpot.dzdidh W32.HLLW.Sambut Win32/GrandSpot.C BKDR_GSPOT.15 P2P-Worm.Win32.G_Spot.c Worm.P2P.G_Spot!iWsciEZCFG4 W32.W.G_Spot.c!c Trojan-Downloader.win32.Delf.xoq Trojan.Crypt.Delf.AL Worm.Win32.GrandSpot.C Trojan.Crypt.Delf.AL WIN.WORM.Virus Worm.GSpot.Win32.1 BKDR_GSPOT.15 BehavesLike.Win32.Eggnog.ch Worm/Sramota.qs BDS/GSpot.15.Srv W32/G_Spot.C Trojan[Backdoor]/Win32.G_Spot Trojan.Crypt.Delf.AL Win32/KorGameHack.worm.200704 Worm:Win32/Gespo.C Win32/Spotbot.15 Worm.G_Spot Trojan-PWS.Win32.Lmir.mw Trojan.Crypt.Delf.AL Worm/Gspot.C


A backdoor also known as: Trojan-Dropper.Win32.Exetemp!O W32/Backdoor.GJUL-4537 TROJ_DROPER.SMJN Trojan-Dropper.Win32.Exetemp.a Troj.Dropper.W32.Exetemp.tnGD Trojan.MulDrop.30795 TROJ_DROPER.SMJN W32/Backdoor2.FAQY Backdoor/Huigezi.2009.api W32.Trojan.Exetemp Trojan[Dropper]/Win32.Exetemp TrojanDropper:Win32/Exetemp.A!bit Trojan.Graftor.D45DD Trojan-Dropper.Win32.Exetemp.a TrojanDropper.Exetemp Trojan.DL.Win32.Small.grn W32/Exetemp.A!tr


Hydrochasma, the threat actor behind this campaign, has not been linked to any previously identified group, but appears to have a possible interest in industries that may be involved in COVID-19-related treatments or vaccines.


The malware is usually packaged with apps that users may download from third-party app stores.


Analysis from cyintanalysis.com describing infrastructure of an actor using PoisonIvy and PlugX implants.


Once infected, Mansoor's phone would have become a digital spy in his pocket, capable of employing his iPhone's camera and microphone to snoop on activity in the vicinity of the device, recording his WhatsApp and Viber calls, logging messages sent in mobile chat apps, and tracking his movements.


Once installed, it hides itself and then tricks the user into typing his or her credentials into fake bank web pages that have been injected onto the device's screen.


EventBot uses this permission in order to achieve persistence and run in the background as a service .


It requires root privileges to be installed, and relies on: A userland binary, providing an encrypted backdoor with remote code execution and proxy functionalities A lightweight Linux Loadable Kernel Module, providing an additional port-knocking service for the userland backdoor


Recently, FortiGuard Labs found a phishing campaign targeting French Nationals.


Palo Alto Networks has discovered a previously unknown remote access Trojan RAT that has been active for over two years.


A backdoor also known as: Trojan.Mauvaise.SL1 TROJ_ETERNALROM.A TROJ_ETERNALROM.A Win32.Exploit.EqEternalRomance.A Exploit.Win32.ShadowBrokers.aj Exploit.Win32.ShadowBrokers.epajub Exploit.Win32.ShadowBrokers.~ Trojan.Equation.37 Exploit.ShadowBrokers.Win32.13 Trojan.Exploit.Equation Exploit.ShadowBrokers.v W32.Hacktool.Equation TR/Eqtonex.HG Trojan[Exploit]/Win32.ShadowBrokers Uds.Dangerousobject.Multi!c Exploit.Win32.ShadowBrokers.aj Exploit:Win32/Eqtonex.A Trojan/Win32.ShadowBrokers.C1919146 Exploit.ShadowBrokers Trj/CI.A Win32/Exploit.Equation.EternalRomance.A HackTool.Win32.ShadowB.a Exploit.ShadowBrokers! Win32/Trojan.Multi.daf


The Corebot malware family is relatively new and was first documented by Security Intelligence.


A backdoor also known as: W32.FamVT.Cosmu.PE Win32.Worm.VB.NZQ Trojan.Win32.Cosmu!O W32.Lamer.EL3 Downloader.VB.Win32.95 Trojan/Downloader.VB.eex Win32.Virus.VBbind.a W32.Besverit Win32/VB.JU TROJ_DLOADR.SMM Win.Trojan.Cosmu-4 Virus.Win32.Lamer.el Win32.Worm.VB.NZQ Trojan.Win32.VB.ltch Troj.Downloader.W32.VB.l4ji Worm.Win32.VB.kp Win32.Worm.VB.NZQ Win32.Worm.VB.NZQ Win32.HLLW.Autoruner.6014 TROJ_DLOADR.SMM BehavesLike.Win32.Autorun.th Trojan/Cosmu.lan Trojan.Win32.Cosmu.887991 Virus.Win32.Lamer.el Win32.Worm.VB.NZQ Win32/Lamer.D Win32.Worm.VB.NZQ SIM.Trojan.VBO.0859 Trojan.Downloader Win32/VB.NUP Worm.Win32 W32/AutoRun.RPV!worm W32/OverDoom.A Virus.Win32.Lamer.B


This mechanism is similar to premium rate SMS messages but Trojans do not need to send any SMS in this case – they just need to click on a button on a web-page with WAP-billing.


A backdoor also known as: Trojan.Keylogger.88 Win32.Backdoor.Ciadoor.13.y.2.Pack Backdoor/Ciadoor.13 Backdoor.Ciadoor!4PAHfVwkIvk W32/BackdoorX.FCC Backdoor.Ciadoor Win32/Ciadoor.J BKDR_CIADOOR.E Win32.Stration Backdoor.Win32.Ciadoor.cia Trojan.Keylogger.88 Backdoor.Win32.Ciadoor.13 Trojan.Keylogger.88 Trojan.DownLoader.62487 BDS/Ciadoor.13.A BKDR_CIADOOR.E Backdoor.Win32.Ciadoor!IK Backdoor/Ciadoor.az Backdoor/Win32.Ciadoor VirTool:Win32/VB.L Backdoor.Win32.Ciadoor.60726 Trojan.Keylogger.88 W32/BackdoorX.FCC OScope.Backdoor.VB Win32/Ciadoor.13 Backdoor.Win32.Ciadoor W32/Ciadoor.13!tr.bdr BackDoor.Ciadoor.3.AH Bck/Ciadoor.FQ


Indicators for the TripleNine backdoor used by an actor.


A backdoor also known as: Trojan.Pakes Troj.W32.Pakes!c Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/Trojan.ZCVD-4026 Trojan.Win32.Encoder.euxeay Trojan.Encoder.15133 Trojan.Pakes.Win32.41830 Trojan.Win32.Injector Backdoor.Backboot.s TR/Crypt.Xpack.frnur W32/Injector.DSRQ!tr Trojan.Graftor.D67C49 Ransom:Win32/Criakl.D Backdoor.Backboot Ransom.FileCryptor Trj/GdSda.A Trojan.Pakes!3sBO8Lnk+/0 Win32/Trojan.7d4


Some of the stolen Skype databases included chat history going back to 2012 and activity as recent as January 2014


A backdoor also known as: Rootkit.Win32.Xanfpezes!O Trojan.Rootkitdrv Rootkit.Xanfpezes.Win32.13 Trojan/Xanfpezes.bru Trojan.Symmi.DC01B Win32.Trojan.WisdomEyes.16070401.9500.9873 W32/Trojan.VQCP-2977 Win32/Rootkit.KX RTKT_HIDEPROC.BB Win.Trojan.Hideproc-77 Rootkit.Win32.Xanfpezes.bru Riskware.Win32.HideProc.crvalg Trojan.Fakealert.28173 RTKT_HIDEPROC.BB BehavesLike.Win32.PUP.wc Downloader.Delphi TrojanDropper.Delf.cdq RiskWare[RiskTool]/Win32.HideProc Win32.Hack.Rootkit.kcloud Rootkit.Win32.Xanfpezes.bru Backdoor/Win32.Xanfpezes.C131817 TrojanDownloader.Banload HackTool.Win32.ProcHide.ad Rootkit.Xanfpezes!kqbV3Mm24ww


A backdoor also known as: Trojan.Nsis.Ocna.eqkruk Trojan.InstallCoreCRTD.Win32.3467 Win32/RA-based.AB


A backdoor also known as: Win32.Worm.Mariofev.O Win32.Worm.Mariofev.O WORM_MARIOFEV.TO Win32.Trojan.WisdomEyes.16070401.9500.9961 W32/Backdoor2.CSNQ W32.Spamuzle WORM_MARIOFEV.TO Win.Spyware.53855-2 Worm.Win32.Pinit.piv Win32.Worm.Mariofev.O Trojan.Win32.Pinit.bmcqcd W32.W.Pinit.piv!c Win32.Worm.Pinit.Ljul Win32.Worm.Mariofev.O Win32.Worm.Mariofev.O BackDoor.Zapinit.81 BehavesLike.Win32.VTFlooder.nc Trojan-Ransom.HydraCrypt W32/Backdoor.CNPZ-8382 TrojanDropper:Win32/Mariofev.H Worm.Win32.Pinit.piv Worm.Pinit Worm.Mariofev!HCn84tcMG2k


This capability was confirmed when the Android permission , called android.permission.RECORD_AUDIO , was being requested along with code found in the app .


Readers who are interested in this campaign should start with our first blog that lays out the overall functionality of the malware and introduces its many components.


The fake applications are built using WebView , a popular extension of Android ’ s View class that lets the developer show a webpage .


A backdoor also known as: Trojan.Novel.DOS.1 PSW.Novel TROJ_PSWNOVEL.A Trojan-PSW.DOS.Novel Trojan.Dos.Novel.fnqs DOS.S.PSWNovel.7120 Troj.PSW.DOS.Novel!c TrojWare.PSW.Novel TROJ_PSWNOVEL.A Trojan/PSW.Novel TR/PSW.Novel Trojan[PSW]/DOS.Novel Trojan-PSW.DOS.Novel Login.7120 Dos.Trojan-qqpass.Qqrob.Aenr W32/HLLW_NewStory.A!tr.pws Win32/Trojan.99d


A backdoor also known as: Trojan.Losicoa.S18597 Trojan.Zusy.D39F92 TrojanDownloader:Win32/Qdownb.A Trojan.Win32.BHO Win32/Trojan.cb1


The group effectively controls an arsenal of over 85 million mobile devices around the world.


Last week, a new version was spotted in the wild, and based on our analysis, we believe that this variant is the one used in a recent attack against San Francisco Municipal Transport Agency SFMTA.


We observed 3 squatting domain registrations related to a victim in the media sector.


A backdoor also known as: Trojan.Razy.D1558E Win32.Trojan.WisdomEyes.16070401.9500.9566 Trojan.MSIL.Crypt W32/Trojan.UXDY-5009 TR/Kryptik.udtxo TrojanDropper:MSIL/Vibes.A Trj/GdSda.A MSIL/Kryptik.GXI!tr Win32/Trojan.855


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 PowerShell.DownLoader.36 BehavesLike.Win32.Trojan.dh Trojan-Dropper.PowerShell.Ploty W32/Trojan.ZKDA-3628 TrojanDropper:PowerShell/Ploty.C Trj/CI.A JS/Psdl.A!tr.dldr Win32/Trojan.f31


Analysis of HackingTeam Android malware


We refer to this backdoor as T9000, which is a newer variant of the T5000 malware family, also known as Plat1.


A backdoor also known as: Ransom.Pottieq Win32.Trojan.WisdomEyes.16070401.9500.9786 Trojan.Win32.Aura.evxqqg Trojan.Encoder.2667 BehavesLike.Win32.BadFile.th TrojanDropper.FrauDrop.annq Trojan[Ransom]/Win32.Aura Ransom:Win32/Pottieq.A


] 6 2020-02-29 http : //themoil [ .


The Trapwot malware family is considered scareware or rogue antivirus because it attempts to mislead victims into believing their machine is infected with malware.


In comparison to other threat groups, TG-3390 is notable for its tendency to compromise Microsoft Exchange servers using a custom backdoor and credential logger.


A backdoor also known as: Trojan.Dynamer Win32.Trojan.WisdomEyes.16070401.9500.9999 MSIL.Packed.Skaldring.D Win32.Trojan.Fsysna.Hwwo Trojan.DownLoader14.15241 BehavesLike.Win32.Trojan.cc Trojan.Crypt TR/Dropper.MSIL.rpjh Trojan.Barys.DCAFA Trojan:Win32/Bshan.A Trojan.Fsysna! MSIL/Injector.PKZ!tr Trj/GdSda.A


Yamato Transport - One of Japan 's largest door-to-door delivery service companies , also in Tokyo .


A backdoor also known as: Worm.Alien Trojan.Zusy.D3E06C Win32.Trojan.WisdomEyes.16070401.9500.9952 Worm.Win32.Alien.oe W32/Trojan.RDLO-7674 WORM/Alien.ugxeq TrojanDownloader:VBS/Kaloki.A Worm.Win32.Alien.oe Trj/CI.A Win32/Trojan.9de


The malware was included as an attachment intended to trick the user into opening the malware.


Cybercriminals, however, are equal opportunity exploiters, so just recently an interesting targeted malware campaign was found to be using another document vulnerability.


The backdoor code was found between Display Widgets version 2.6.1 released June 30 and version 2.6.3 released September 2.


Most devices can be controlled by Xiaomi ’ s “ MiHome ” Android app , which is available on Google Play with between 1,000,000 and 5,000,000 downloads .


However, over the past few years, we have been tracking a separate, less widely known suspected Iranian group with potential destructive capabilities, whom we call APT33.


If the registration is successful, it uses the received unique identifier to further communicate with the C&C server and receive commands.


A backdoor also known as: Backdoor.Avosim Backdoor.Trojan W32/Trojan.BPEV-1033 BDS/Avosim.azmiq W32/ISMdoor.5E1D!tr Trj/GdSda.A Win32/Backdoor.ed0


run a malicious DEX file without notification,


A further blog by FireEye titled Acknowledgement of Attacks Leveraging Microsoft Zero-Day provided additional useful information.


The Trojan uses this counter to activate the bot - if aforementioned step counter hits the pre-configured threshold it considers running on the device to be safe .


The Sage ransomware variant appears to have been out of circulation for a while in the malware scene.


A backdoor also known as: PDF/Trojan.PGPW-0


After further research, we found the malware has been repackaged into several pirated iOS apps that are available for download via multiple channels.


Crypt0l0cker has gone through a long evolution, the adversaries are updating and improving the malware on a regular basis.


These attacks are only becoming more common , with one third of all malware now targeting mobile endpoints .


The Sofacy group, also known as APT28 and Sednit, is a fairly well known cyber espionage group believed to have ties to Russia.


Even harder is when you do not receive telemetry data from products that contains information about infected machines.


What is more, they are tied to the attacked applications, which creates an illusion that they are legitimate and belong to the corresponding software.


However, there are several good reasons for an attacker to use this particular feature.


NCC Group is monitoring a number of OOXML and RTF techniques our red team has been using since September 2016, which uncovered multiple malicious documents from around August 2017.


It has modular architecture implemented in the form of plugins , or it can receive new .NET source code , which will be compiled on the device in runtime .


A backdoor also known as: Virus.Win32.Sality!O Tool.Transmit.Win32.60 Win32.Trojan.WisdomEyes.16070401.9500.9549 not-a-virus:NetTool.Win32.Transmit.a Riskware.Win32.Transmit.exlakv Trojan.Win32.Z.Transmit.67795 Backdoor.Win32.VanBot.24 Tool.Transmit BehavesLike.Win32.VirRansom.kc Trojan/Pakes.emd not-a-virus:NetTool.Win32.Transmit.a Trj/CI.A Trojan.TenThief.DNFTrojan.tnh


The attacks leveraged a malware named EyePyramid to target a dozen politicians, bankers, prominent freemasons and law enforcement personalities in Italy.


Recently, we've seen a number of reports related to 9002 remote access Trojan RAT.


A backdoor also known as: Trojan.Kadena.B4 Trojan.Ipatre.1 Win32.Trojan.Kryptik.lx TROJ_UPATRE.SMX7 Win32.Trojan.Kryptik.CI Trojan.Win32.Kryptik.expevv Trojan.Win32.Z.Upatre.71168.AI TrojWare.Win32.TrojanDownloader.Upatre.EMD Trojan.DownLoader26.15470 TROJ_UPATRE.SMX7 W32/Trojan.DPWC-8231 TR/Crypt.ZPACK.karjs Trojan/Win32.Upatre.R160419 Trojan-Downloader.Win32.Waski W32/Kryptic.ABGK!tr Win32/Trojan.8c5


Under these conditions , the app continues executing and the intent of targeting Xiaomi devices and users could be inferred , however poorly written code results in execution in more environments than perhaps intended ; further checks are made to ascertain whether the app is running on an emulator , perhaps to evade researcher analysis environments .


EventBot Updated library naming convention EventBot New library naming convention .


When clicked it launches an infection chain made up of JavaScript, and a final shellcode payload that makes use of DNS to load additional shellcode from a remote command and control server.


A backdoor also known as: Backdoor.IRC.MRAK.A Virus.Win32.Mkar!O W32.Mkar.A4 Backdoor.IRC.MRAK.A Virus.Mkar.Win32.5 Backdoor.IRC.MRAK.A Win32.Trojan.WisdomEyes.16070401.9500.9981 W32/Mkar.C W32.Marak PE_MKAR.A.DAM Win.Trojan.Mkar-3 Virus.Win32.Mkar.a Backdoor.IRC.MRAK.A Virus.Win32.Mkar.cyau Backdoor.IRC.MRAK.A Win32.Mkar.A Backdoor.IRC.MRAK.A Win32.HLLP.Mrak.9 PE_MKAR.A.DAM BehavesLike.Win32.Koobface.mc W32/Mkar.LNJG-1026 WORM/Mkar.A Backdoor:Win32/Mkar.A Win32.Mrak.A Virus.Win32.Mkar.a Backdoor.IRC.MRAK.A Malware/Win32.Mkar.C408081 Win32/Mkar.A Win32.Mkar.E Virus.Win32.Mkar W32/Mkar.D W32/Mkar.E


CrowdStrike Services Inc., our Incident Response group, was called by the Democratic National Committee DNC, the formal governing body for the US Democratic Party, to respond to a suspected breach.


A backdoor also known as: Trojan/W32.Buzus.32878.D TrojanDownloader.Small.grk Trojan/Downloader.Small.grk Trojan.DL.Small.ALEE Win32/SlhBack.B W32/Downldr2.BDIE W32/DLoader.DZIA Trojan.Downloader-20119 Trojan-Downloader.Win32.Small.grk Trojan.Downloader.Delf.OJS Backdoor.Win32.SlhBack.B Trojan.Downloader.Delf.OJS Trojan.DownLoader.50258 TR/Dldr.Small.grk.24 TROJ_DELF.HXO Heuristic.BehavesLike.Win32.Backdoor.H Win32/SillyDl.ETL W32/Downldr2.BDIE TrojanDownloader.Small.zhn Trojan-PWS.Win32.OnLineGames!IK TrojanDownloader:Win32/Small.AAAL Trojan.Win32.Downloader.35496 Trojan.Downloader.Delf.OJS Win-Trojan/Downloader.32877 Trojan-Downloader.Win32.Small.grk Trojan.DL.Small.AJEZ Trojan.DL.Win32.Small.grk Trojan-PWS.Win32.OnLineGames W32/Small.GRK!tr Trj/Downloader.REB


The McAfee Labs research team has tracked an advanced persistent threat for the past couple of months.


This means that the malware can be remotely eliminated by an SMS message .


A backdoor also known as: Trojan.Win32.Vilsel!O BackDoor-EZO.a Trojan/Bewymids.a Trojan.Vilsel!fjBL+ssgwjs Infostealer.Hoardy Win.Trojan.Vilsel-265 Trojan.Win32.Vilsel.aybc Trojan.Win32.Vilsel.djwjt Trojan.Win32.S.Vilsel.61544[h] Trojan.DownLoader2.44985 Trojan.Vilsel.Win32.20666 BehavesLike.Win32.Downloader.km Trojan/Vilsel.uxx TR/Bewymids.A.2 Trojan/Win32.Vilsel Win32.Troj.Vilsel.kcloud Trojan:Win32/Bewymids.A Trojan/Win32.Vilsel Spyware.Infostealer.Flea.APT Trojan.Vilsel Win32.Trojan.Vilsel.Phqe Trojan.Win32.Vilsel W32/Vilsel.AYBC!tr Trojan.Win32.Bewymids.BA Win32/Trojan.bab


As the attack is currently active, it effectively turns compromised sites into attack surfaces against their visitors.


A backdoor also known as: TrojanDownloader.Stegvob.C9 Win32.Trojan-Downloader.Delf.c WORM_TOPHOS.BKD Trojan.Win32.Dropper.aas Win32.HLLW.Tophos.1 WORM_TOPHOS.BKD Trojan.Symmi.DD7FE Worm:Win32/Tophos.B BScope.Worm.Tophos.2612 Backdoor.Bot Virus.Win32.Sality W32/Tophos.AAA!tr Win32/Trojan.278


Aside from stealing keystrokes, passwords, Bitcoins, system information, and files on disk, NionSpy also known as Mewsei and MewsSpy can record video using the webcam, audio using the microphone, take screenshots, and use infected machines as a proxy tunnel to connect to other machines within the network.


The actors behind this adware utilize a simple yet effective approach – they download a popular, legitimate Android application, decompile it, add their malicious routines, then repackage the Android application package APK.


A backdoor also known as: Trojan.Mauvaise.SL1 Trojan.FlyStudio.Win32.19742 Trojan/FlyStudio.ooa Trojan.Zusy.D38745 Win32.Trojan.FlyStudio.we Win32.Application.PUPStudio.B Trojan.Win32.Dwn.eeopgy Trojan.DownLoader24.6094 Trojan.Win32.Antavmu TR/Winder.sbcde Trojan[Dropper]/Win32.Sysn Trojan:Win32/Winder.A RiskWare.GameHack Backdoor.Farfli!+OYA++JJfG8


#ISMDoor impersonates ZAHRANI an electrical equipment and engineering company in Saudi Arabia and ThetaRay.


In the third intrusion, the Mandiant Incident Response team was contacted after UNC961 had compromised the victim and transferred access to UNC3966.


Modification of KBOT from the Carberp leak.


A backdoor also known as: Trojan.Lossymem MSIL/Filecoder.LI Ransom_LTML.THAOJH Trojan.Win32.Ransom.ewugaq Ransom_LTML.THAOJH Trojan-Ransom.FileCoder W32/Trojan.QFKV-3532 TR/Ransom.xaclx Trojan/Win32.Ransom.C2353444 Trojan.Ransom.LongTermMemoryLoss Trj/GdSda.A MSIL.Trojan-Ransom.LTML.A


A backdoor also known as: Trojan.Floxif.S1578425 Trojan.Rozena.Win32.59165 BKDR_CCHACK.A W32/CChack.A Trojan.Ccleaner BKDR_CCHACK.A Win.Spyware.CCBkdr-6336251-2 Win32.Backdoor.Forpivast.B Backdoor.Win32.InfeCleaner.a Trojan.PRForm.A Trojan.Win32.Floxif.estdxt Trojan.Win32.Z.Floxif.5000118 Trojan.PRForm.A Trojan.CCleaner.2 BehavesLike.Win32.Dropper.rc Backdoor.Hacked.CCleaner W32/CChack.SQBY-7641 Trojan[FakeAV]/Win32.CCleaner Backdoor.Win32.InfeCleaner.a Win-Trojan/Floxif.9791816 Backdoor.InfeCleaner Trj/CI.A Trojan.PRForm.A Win32.Backdoor.Infecleaner.Lkns Win32/Trojan.54c


A backdoor also known as: Exp.OLE.CVE-2015-1641.E Trojan.Mdropper Win32/Exploit.CVE-2015-1641.V TROJ_MDROP.YYSRH TROJ_MDROP.YYSRH RTF/Trojan.BTCC-93 Trojan[Exploit]/Win32.CVE-2015-1641 Exploit.CVE-2015-1641 Exploit.CVE-2015-1641


eSurv ’ s public marketing is centered around video surveillance software and image recognition systems , but there are a number of individuals claiming to be mobile security researchers working at the company , including one who has publically made claims to be developing a mobile surveillance agent .


A backdoor also known as: W97M.Downloader.CXJ O97M.Drop.P W97M.Downloader.CXJ VBA.Trojan.Obfuscated.u VBA/Obfuscated.C W2KM_GOLROTED.AGG W97M.Downloader.CXJ W97M.Downloader.CXJ Trojan.Ole2.Vbs-heuristic.druvzi W97M.Downloader.CXJ W97M.Downloader.CXJ W97M.DownLoader.1033 W2KM_GOLROTED.AGG W97M.Downloader.CXJ WM/Obfuscated.C!tr virus.office.obfuscated.1


A new custom backdoor used by the Mustang Panda APT group is targeting a governmental institution in Taiwan, according to ESET researchers who have analyzed samples of MQsTTang, a new type of malware.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9970 Backdoor.Trojan.B Win.Trojan.10430800-1 Trojan.Win32.Pugeshe.ctexqh BDS/Pugeshe.A.2 Trj/Ziyang.A Win32.Backdoor.Pugeshe.Phzt Trojan.Ziyanzho!


The original code of BankBot was divulged on a Russian forum in late 2016, and you can read more about that here.


Based on observations on infrastructure, and the state of the code, we believe these incidents represent the first attempts to deploy the agent, and features such as persistence do not appear to work.


‘ SimBad ’ comes with a respected list of capabilities on the user ’ s device , such as removing the icon from the launcher , thus making it harder for the user to uninstall , start to display background ads and open a browser with a given URL .


The malware contains an old school exclusion list that performs extremely rapid double word comparisons rather than the slower but far more common string comparisons to identify which process to ignore, and internally validates the identified account data through an implementation of the Luhn algorithm.


Symantec's latest whitepaper documents multiple Black Vine operations that have been occurring since 2012.


A backdoor also known as: HT_BLADABINDI_GL190001.UVPM HT_BLADABINDI_GL190001.UVPM Backdoor.MSIL.Bladabindi.alfk Trojan.Win32.Bladabindi.exqcus Ht.Bladabindi.Gl190001!c BehavesLike.Win32.Dropper.wc Trojan:Win32/Trogle.A Backdoor.MSIL.Bladabindi.alfk Trj/CI.A Msil.Backdoor.Bladabindi.Tbsy


A backdoor targetting Linux also known as: Backdoor.Linux.Tsunami.A Linux.Kaiten.B ELF_KAITEN.SMK Trojan.Tsunami.excyez Linux.BackDoor.Tsunami.123 ELF_KAITEN.SMK ELF/Backdoor.MRMO- LINUX/Tsunami.ojldj Trojan.Backdoor.Linux.Tsunami.1 Backdoor.Linux.Tsunami!c Linux.Backdoor.Tsunami.Wrpx


Yes , we are talking about SuperMarioRun , which was recently launched by Nintendo only for iOS users .


August contains stealing functionality targeting credentials and sensitive documents from the infected computer.


A backdoor also known as: Trojan.Win32.VB!O Trojan/VB.htj Trojan.Heur.RX.ED14C7A Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan Win.Trojan.VB-8430 Trojan-Dropper.Win32.Daws.enmy Troj.Downloader.W32.VB.ldQ2 TrojWare.Win32.Trojan.VB.~DQ Trojan.VB.Win32.6994 BehavesLike.Win32.Trojan.nm Trojan.Win32.VB Trojan/VB.fgm Backdoor:Win32/Lordly.A Trojan-Dropper.Win32.Daws.enmy Trojan/Win32.Downloader.R12171 Trojan.VB!jnJsu+mHRvk W32/VB.JHO!tr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Revetrat Trojan:MSIL/Starter.I Trj/GdSda.A Win32/Trojan.db5


A backdoor also known as: Trojan.Win32.Z.Pemalform.45056.A W32.W.Otwycal.l4av TrojanDownloader:Win32/Raemnk.A Win32/RiskWare.PEMalform.E Win32/Trojan.444


The targets were then further narrowed to those that were running the Mac OS X operating system, had not previously visited the website, and had specific browser versions.


The sample ’ s first appearance seems to be May 15 , 2018 , when it was uploaded to VirusTotal , but it ’ s unclear how the tainted sample is disseminated .


Ginp embeds the following set of features , allowing it to remain under the radar and successfully perform attacks : Overlaying : Dynamic ( local overlays obtained from the C2 ) SMS harvesting : SMS listing SMS harvesting : SMS forwarding Contact list collection Application listing Overlaying : Targets list update SMS : Sending Calls : Call forwarding C2 Resilience : Auxiliary C2 list Self-protection : Hiding the App icon Self-protection : Preventing removal Self-protection : Emulation-detection Update 10/03/2020 At the end of February the actors behind Ginp added screen capture capabilities to their Trojan .


A backdoor also known as: TrojanPWS.Grozlex.A3 Win32.Trojan.WisdomEyes.16070401.9500.9999 TSPY_GROZLEX.SMA Win.Spyware.Grozlex-1 TSPY_GROZLEX.SMA PWS:MSIL/Mintluks.A Trojan.PasswordStealer.MSIL


A backdoor also known as: W32.ArtemisPuty.Trojan Trojan.Modputty.A5 Trojan.Puty.Win32.1 Trojan/MalPutty.a W32/Trojan.SHOY-1500 Win.Trojan.Stealzilla-1 Trojan-PSW.Win32.Puty.a Trojan.Win32.Puty.dsnaim Troj.PSW32.W.Puty.tnaX Win32.Trojan-qqpass.Qqrob.Llhf BackDoor.DaVinci.18 BehavesLike.Win32.BadFile.hh Trojan.Win32.Modputty Trojan/PSW.Puty.a Trojan:Win32/Modputty.A Trojan-PSW.Win32.Puty.a Trojan/Win32.Modputty.C862836 TrojanPSW.Puty Trojan.PWS.Puty! W32/MalPutty.A!tr Trj/Fakeputty.A Win32/Trojan.Spy.b9b


” social ” – this command that starts the ‘ AndroidMDMSupport ’ service – this allows the files of any other installed application to be grabbed .


We have analyzed the samples to determine the author's ultimate goal and have named this malware KeyRaider


A backdoor also known as: VBS/Downldr.HM VBS.Downloader.B VBS_LOCKY.DLDSARF Win.Trojan.Locky-6360731-0 Trojan.Script.ExpKit.etmlqw Troj.Downloader.Script!c VBS.DownLoader.1006 VBS_LOCKY.DLDSARF VBS/Downldr.HM Trojan/VBS.downloder TrojanDownloader:VBS/Locky.A VBS/Obfus.S8 Trojan-Ransom.Script.Locky virus.vbs.qexvmc.1


It uses insidious injection and other sophisticated and stealthy methods.


A backdoor also known as: W32.Sasser.D Win32.Trojan.WisdomEyes.16070401.9500.9679 W32.Sasser.D Win32/Sasser.D Win.Worm.Sasser-2 Net-Worm.Win32.Sasser.c Trojan.Win32.Sasser.fvek Worm.Win32.Sasser.16384 W32.W.Sasser.kZ72 W32/Sasser.worm.d I-Worm/Sasser.d WORM/Sasser.D Worm[Net]/Win32.Sasser Net-Worm.Win32.Sasser.c Worm:Win32/Sasser.dam W32/Sasser.worm.d Worm.Sasser W32/Sasser.D.worm Email-Worm.Win32.Plexus W32/Sasser.C!worm.im


Full remote access capabilities is a dream tool for the black hat community, and are highly sought after.


The purpose of using such a design is likely to make understanding and analyzing the malware's code flow more difficult for researchers.


Recently, I've been investigating malware utilizing PowerShell and have spent a considerable amount of time refining ways to identify new variants of attacks as they appear.


The following screenshot shows the command execution functionality in action : The paramString parameter shown in the above screenshot can be any command received from C & C .


As proof of its popularity, certain government officials are said to employ this application for communication purposes in the office.


A backdoor also known as: Trojan/Turla.ar Trojan.Asprox.B Trojan.MulDrop7.18901 BehavesLike.Win32.Downloader.dc Trojan:Win32/Regin.D!dha Trj/Chgt.J Win32/Turla.AR Trojan.Turla!gdUjdZ2fM5A


Now, three months after the source code was published, we decided to have a look at what has changed in the banking malware landscape.


A backdoor also known as: Trojan.Crypt.RI Trojan.Crypt.RI Trojan.Crypt.RI Trojan.Crypt.RI Trojan.Crypt.RI Trojan.Crypt.RI Trojan.Crypt Trojan.Crypt.RI


Sysget malware was delivered both directly via phishing emails, as well as in Rich Text Format RTF documents exploiting the CVE-2015-1641 vulnerability patched in MS15-033 that in turn leveraged a very unique shellcode.


All these packages used provisioning profiles with distribution certificates associated with the company Connexxa S.R.L .


Indicators about Sakula and multiple RATs that are being used across multiple intrusions.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Tofsee.B Trojan-Proxy.Win32.Xorpix.m Trojan.Win32.Xorpix.zybt Trojan.Win32.Proxy.12800.C Trojan.DownLoader.19108 Trojan.Small.Win32.39831 TrojanProxy.Xorpix.k Troj.Proxy.W32!c Trojan-Proxy.Win32.Xorpix.m Trojan/Win32.Xorpix.R72000 Win32/Small.NCN Win32.Trojan-proxy.Xorpix.Amci Trojan.Win32.Small Bck/Xorpix.AG Win32/Trojan.Proxy.211


Mobile monetization platforms create software libraries that authors can embed into their apps to start earning money quickly.


It required other means to be deployed on targeted organizations' networks and is configured with previously stolen credentials.


A backdoor also known as: W32.FamVT.ExpiroPC.PE Heur.Corrupt.PE TrojanDownloader:Win32/WarezSet.dam#2


A backdoor also known as: W32.KloggerQKA.Trojan Trojan-Downloader.Win32.Delf!O Backdoor.Gobot Downloader.Delf.Win32.70 Backdoor.W32.Gobot.lfDt Trojan/Downloader.Delf.bm Win32.Trojan.WisdomEyes.16070401.9500.9965 W32/Avokado.SIKN-9031 W32.Gobot.A Backdoor.Gobot Win32/Gobot.B WORM_GOBOT.G Win.Downloader.Delf-144 Trojan.Win32.Delf.gvzc Trojan.Win32.Delf.47087 Win32.HLLW.Ghostbot WORM_GOBOT.G BehavesLike.Win32.Kudj.pc Backdoor.Win32.Gobot W32/Avokado.B@bd TrojanDownloader.Delf.pgr TR/Dldr.Delf.BM Trojan[Backdoor]/Win32.Gobot Backdoor:Win32/Gobot.A Worm/Win32.IRCBot.R29095 Bck/Gotob.AA Trojan.Delf.BM Win32/TrojanDownloader.Delf.BM Trojan.DL.Delf!UOW7nlBxiow


The greater worry is that these situations may sometimes not be simple mistakes .


In recent weeks, Unit 42 has discovered three documents crafted to exploit the InPage program.


The malware families identified at this time are DarkComet, LuminosityLink RAT, Pony, ImmenentMonitor, and some multiple variations of shellcode.


Despite the 2016 Olympics coming to a close, cybercriminals remain relentless in using the sporting event as a social engineering hook to distribute a banking Trojan.


A backdoor also known as: Program.Optimizer.12 TrojanDownloader:Win32/Javsisxep.A Trj/CI.A


We believe the initial versions of this malware were created at least three years ago – at the end of 2014 .


Of note, this is three years earlier than the oldest Elise sample we have found, suggesting this group has been active longer than previously documented.


A backdoor also known as: TSPY_KILLAV_BK2200FA.TOMC Trojan.Win32.NtRootKit.dgaent Troj.GameThief.W32.OnLineGames.l7iy Trojan.DownLoad3.35430 Trojan.KillAV.Win32.9854 TSPY_KILLAV_BK2200FA.TOMC TR/Killav.OI.2 Trojan/Win32.Unknown Trojan.Graftor.D3B65 Trojan:WinNT/Killav.E Trojan/Win32.KillAV.R32978 Trojan.Win32.KillAV.aal W32/KillAV.NKC!tr


Users do not see those SMS because they are processed not by the SMS app , but by the app that has initiated the transaction — e.g a free-to-play game .


A backdoor also known as: TrjnDwnldr.Banload.FC.2467 Win32.Trojan.WisdomEyes.16070401.9500.9993 W32/Trojan.FOJF-1615 Ransom_Blocker.R004C0DAM18 Win.Trojan.12504345-1 Trojan-Ransom.Win32.Blocker.kqil Troj.Ransom.W32.Blocker!c Trojan.DownLoader13.59179 Ransom_Blocker.R004C0DAM18 Trojan/Blocker.kir TR/Spy.Banker.37888.6 Trojan[Ransom]/Win32.Blocker Trojan.Kazy.D81FF3 Trojan-Ransom.Win32.Blocker.kqil TrojanSpy:MSIL/Banker.M Trojan/Win32.MDA.C931868 Hoax.Blocker Trojan.Banker.WHS Win32.Trojan.Blocker.Pgmu Trojan.Blocker!RxWDop6Ua70 Trojan.MSIL.PSW Win32/Trojan.Spy.d2d


Through this entry, in which we take a closer look at an individual who we believe might be connected to the Winnti group, we hope to give both ordinary users and organizations better insights into some of the tools – notably the server infrastructures- these kinds of threat actors use, as well as the scale in which they operate.


Also , command communications with the malware are parsed with a function named “ chuli ( ) ” prior to POSTing stolen data to the command-and-control server .


A backdoor also known as: Trojan-Dropper.Win32.Dinwod!O W32.Virut.Cur1 W32.Virut.CF Win32/Virut.17408!corrupt WORM_OTORUN.SMN1 Trojan-Dropper.Win32.Dinwod.by Trojan.Win32.Dinwod.cooobe Troj.Dropper.W32.Dinwod.mmkC Virus.Win32.Virut.ua Virus.Win32.Virut.CE Trojan.MulDrop3.51046 WORM_OTORUN.SMN1 Win32/Virut.bv TR/VB.Inject.qopannv Trojan[Dropper]/Win32.Dinwod Win32.Virut.cr.61440 Trojan.Zusy.D423D8 Dropper.Dinwod.151552 Trojan-Dropper.Win32.Dinwod.by Worm:Win32/Rortoti.A HEUR/Fakon.mwf TScope.Trojan.VB Trojan.FileLock I-Worm.Filecoder.A Win32/Virut.NBP Trojan-Dropper.Win32.Dinwod W32/Sality.AO


A backdoor also known as: Trojan.Ursu.D1347A Win32.Trojan.WisdomEyes.16070401.9500.9990 Trojan.MulDrop7.48244 Trojan-Ransom.Rantest W32.Ransomsimulation TR/StartPage.wgude Trojan/MSIL.Miner RiskWare.RansomSimulator Trj/GdSda.A Trojan.StartPage!pRfC+LclTxM Win32/Trojan.7c5


A backdoor also known as: Trojan.WebSearch W32/Application.KWFL-8070 Trojan.Win32.WebSearch.ak Trojan.Win32.WebSearch.ommdf Trojan.Win32.Z.Websearch.263168 Troj.W32.Websearch!c TR/WebSearch.V Trojan:Win32/WebSearch.F Trojan.Win32.WebSearch.ak Trj/CI.A Win32.Trojan.Websearch.Lmap Trojan.WebSearch!GWyPJuQViZY Win32/Trojan.3ff


Locky is a ransomware that can be installed when you open an attachment, usually as a Word file from a spam email.


We are seeing a bit of an uptick of emails containing java adwind or Java Jacksbot attachments.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9991 W32/Dropper.ANAB TROJ_DROPPER.SMW Packed.Win32.Krap.ap Trojan.Winlock.587 TROJ_DROPPER.SMW BehavesLike.Win32.FakeAlertSecurityTool.fc W32/Risk.VFHY-0574 Trojan[Packed]/Win32.Krap Packed.Win32.Krap.ap Dropper/Win32.Smiscer.R13962 Trojan.DR.Procesemes!WkidsgpO+Do Packed.Win32.Krap


A backdoor also known as: Trojan.Win32.BitCoinMiner.jz Trojan.Win32.BitCoinMiner.euxcee Win32.Trojan.Bitcoinminer.Wrgk Trojan.DownLoader25.54215 Trojan.CoinMiner.Win32.6503 Trojan/Win32.BitCoinMiner Trojan.Win32.BitCoinMiner.jz TrojanDownloader:MSIL/CoinMiner.A!bit Trojan.BitCoinMiner Trojan.BitCoinMiner Trj/GdSda.A Trojan.BitCoinMiner!x6PcA/gbW/U W32/BitCoinMiner.JZ!tr Win32/Trojan.5d5


A few weeks ago, we observed new activity from ChessMaster, with notable evolutions in terms of new tools and tactics that weren't present in the initial attacks.


It abuses the legitimate and popular open source framework DroidPlugin which allows an app to dynamically launch any apps as plugins without installing them in the system.


A backdoor also known as: W32.FamVT.StartPage.e.Trojan Trojan.Startpage TROJ_STARTPAGE_FD050152.UVPM Trojan.Win32.Z.Startpage.4001399 TROJ_STARTPAGE_FD050152.UVPM TR/StartPage.sdjtv W32/STARTPAGE_FD050152.UVPM!tr Win32/Trojan.41b


Application launch When launching for the first time , the Trojan checks if it is being launched in an emulation environment , and in which country it is being launched .


THREAT ANALYSIS Infection Vector : Smishing Your Device Thus far , FakeSpy campaigns are characterized by SMS phishing ( a.k.a .


A backdoor also known as: Trojan.Win32.VB!O Trojan.VB Trojan/VB.bmd Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Trojan.ZJNQ-3376 TROJ_VB.FVH Win.Trojan.VB-3241 Trojan.Win32.VB.bmd Trojan.Win32.VB.crkyqv Troj.W32.Vb!c Trojan.Win32.VB.aae Trojan.SimSun Trojan.VB.Win32.1599 TROJ_VB.FVH BehavesLike.Win32.PJTbinder.qz Trojan.Win32.Elkmil W32/Trojan2.YLV W32/VB.QRB!tr Trojan/Win32.VB Win32.Troj.VB.kcloud Trojan.Heur.E1F0CA Trojan.Win32.VB.28672.K Trojan.Win32.VB.bmd Trojan/Win32.Xema.R125410 TScope.Trojan.VB Trj/QQPass.AWP Virus.Win32.HideDoc.C


A backdoor also known as: Backdoor/W32.PPdoor.159232 Backdoor.Win32.PPdoor!O Win32.Trojan.WisdomEyes.16070401.9500.9989 Backdoor.Trojan BKDR_PPDOOR.AL Win.Trojan.PPDoor-3 Backdoor.Win32.PPdoor.bo Trojan.Win32.PPdoor.qstx Backdoor.Win32.PPdoor.A BackDoor.Srvlite BKDR_PPDOOR.AL BehavesLike.Win32.Pykse.ch W32/PPdoor.GR Backdoor/PPdoor.bo DR/Pere.103936.E.2 Trojan[Backdoor]/Win32.PPdoor Backdoor:Win32/Ppdoor.AJ Backdoor.Win32.PPdoor.bo Trojan/Win32.Ppdoor.C139757 Virus.Win32.Bayan-based Backdoor.PPdoor!lYc+pVWanGQ Backdoor.Win32.PPdoor Trj/PPDoor.FD


Check Point Mobile Threat Prevention has detected a new, unknown mobile malware that targeted two customer Android devices belonging to employees at a large financial services institution.


FireEye recommends that Microsoft Office users apply the patch from Microsoft.


A backdoor also known as: Hacktool.Flystudio.16558 TSPY_AKSULA_CA083865.TOMC Win32.Trojan-PSW.Alipay.a TSPY_AKSULA_CA083865.TOMC Trojan-PSW.Win32.Alipay.peq Troj.Downloader.W32.BaiDload.lhQG TR/Aksula.jqeqy Trojan:Win32/Aksula.A Trojan.Mikey.D906C Trojan-PSW.Win32.Alipay.peq Trojan/Win32.Aksula.R27086 Win32.Trojan-qqpass.Qqrob.Phqe


IOCs C & C IP addresses : 155.133.82.181 155.133.82.240 155.133.82.244 185.234.218.59 195.22.126.160 195.22.126.163 195.22.126.80 195.22.126.81 5.45.73.24 5.45.74.130 IP addresses from which the Trojan was downloaded : 185.174.173.31 185.234.218.59 188.166.156.110 195.22.126.160 195.22.126.80 195.22.126.81 195.22.126.82 195.22.126.83 SHA256 : 158c7688877853ffedb572ccaa8aa9eff47fa379338151f486e46d8983ce1b67 3aedbe7057130cf359b9b57fa533c2b85bab9612c34697585497734530e7457d f3ae6762df3f2c56b3fe598a9e3ff96ddf878c553be95bacbd192bd14debd637 df61a75b7cfa128d4912e5cb648cfc504a8e7b25f6c83ed19194905fef8624c8 c0cfd462ab21f6798e962515ac0c15a92036edd3e2e63639263bf2fd2a10c184 d791e0ce494104e2ae0092bb4adc398ce740fef28fa2280840ae7f61d4734514 38dcec47e2f4471b032a8872ca695044ddf0c61b9e8d37274147158f689d65b9 27cea60e23b0f62b4b131da29fdda916bc4539c34bb142fb6d3f8bb82380fe4c 31edacd064debdae892ab0bc788091c58a03808997e11b6c46a6a5de493ed25d 87ffec0fe0e7a83e6433694d7f24cfde2f70fc45800aa2acb8e816ceba428951 eabc604fe6b5943187c12b8635755c303c450f718cc0c8e561df22a27264f101 Kernel Backdoor found in Gadgets Powered by Popular Chinese ARM Maker May 12 , 2016 Mohit Kumar How to Hack an Android device ? It is possibly one of the most frequently asked questions on the Internet .


All born in the 90s, these neophytes are not afraid to get caught, carelessly leaving a trail of traceable contact details online.


A backdoor also known as: W32.DefayliLTO.Trojan Trojan.Win32.Cosmu!O Trojan.Hosts Trojan.Cosmu.Win32.8116 Win32.Trojan.Qhost.y W32/Trojan2.OIIF Trojan.Qhosts TROJ_COSMU_000001b.TOMA Win.Trojan.Cosmu-1352 Trojan.Win32.Hosts2.wog Trojan.Win32.Drop.rqzxb Troj.W32.Hosts2.toz0 Virus.Win32.Virut.ua TrojWare.Win32.Qhost.rqj Trojan.MulDrop3.7647 TROJ_COSMU_000001b.TOMA BehavesLike.Win32.PUPXAN.tz W32/Trojan.VWTG-6346 Win32/Virut.bv TR/Cosmu.oiqea Trojan/Win32.Cosmu Worm:Win32/Makc.A Trojan.Graftor.D2333 Trojan.Win32.A.Cosmu.577633 Trojan.Win32.Hosts2.wog HEUR/Fakon.mwf BScope.Trojan.IRCbot Win32/Qhost.ONX Trojan.Cosmu!mnslE6bxKwc Worm.Win32.AutoIt W32/Qhost.ONX!tr


A backdoor also known as: W32.Gezak Trojan.Vir.HLL Trojan.Heur.ED5CCE WORM_GEZAK.A W32/Risk.GNIP-0600 W32.Osapex Win32/Gezak.A WORM_GEZAK.A Win.Trojan.Gezak-1 Virus.Win32.HLLW.Gezak Virus.Win32.HLLW.gjmh W32.HLLW.Gezak!c Win32.HLLW.Gezak Win32.HLLW.Osapex Virus.Gezak.Win32.1 W32/Osapex.b.worm Win32/HLLW.Gezak Virus/Win32.Gezak Win32.HLLW.kcloud Virus.Win32.HLLW.Gezak Win32/Osapex.worm.31744 W32/Osapex.b.worm Trojan.Worm Univ.AP.K Win32/HLLW.Gezak Win32.Virus.Hllw.Hnbi Win32.HLLW.Gezak Virus.Win32.HLLW W32/Gezak.A!worm Win32/Worm.fc8


Some examples are email messages claiming to be in regards to an overdue bill or invoice, utilizing such terminology in the subject line and given file name, such as invoice.zip or payment_doc_298427.zip


We haven't seen Locky for a long time, so I was quite surprised to see this one.


WHO IS BEHIND FAKESPY ’ S SMISHING CAMPAIGNS ? The Cybereason Nocturnus team suspects that the malware operators and authors are Chinese speakers .


It was hosting an Adobe Flash exploit targeting one of the newly disclosed vulnerabilities from the Hacking Team data breach, CVE-2015-5122.


After that it ’ s necessary to send “ stop_blocker ” to the same number – this will disable the display of HTML pages that extort money and block the screen .


A backdoor also known as: Trojan/W32.Small.14848.GD Trojan.Win32.Small!O Trojan/Small.cnp Trojan.Conjar.8 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Ransomlock TROJ_IKYTOK.SMI Trojan.Win32.Small.djdxj TROJ_IKYTOK.SMI Trojan/Small.kgz TR/Zapchast.I Trojan:Win32/Ikytoky.A Trojan.Win32.A.Small.14848 Trojan/Win32.Menti.R9065 Trojan.Karagany Trojan.Downloader.MB Trj/Hexas.HEU


A backdoor also known as: Trojan/Injector.dtxv TROJ_INJECTOR_HA010038.UVPM Win32.Trojan-PSW.Fareit.a W32/Injector.GBX TROJ_INJECTOR_HA010038.UVPM Win.Trojan.Fareit-403 Riskware.Win32.Stealer.evlqpt Trojan.PWS.Stealer.18592 Trojan.Ekstak.Win32.3539 W32/Injector.ELVO-4299 DR/Delphi.rghyi Trojan/Win32.Ekstak.R214290 Backdoor.Androm Trojan.Injector Win32/PSW.Fareit.A Trojan.Win32.Injector W32/Kryptik.GCFM!tr


] site/gate_cb8a5aea1ab302f0_c online 208.91.197 [ .


Many domains in this report are compromised domains - traffic to them may not be malicious.


The tweet stated that TrickBot , a well-known banking Trojan owned by an organized cybercrime gang , uses man-in-the-browser ( MITB ) web injects in online banking sessions to ask infected users for their mobile phone number and device type .


Figure 14 .


Analysis of TG-3390's operations, targeting, and tools led CTU researchers to assess with moderate confidence the group is located in the People's Republic of China.


In January 2016 Forcepoint Security Labs reported an email campaign delivering the Ursnif banking Trojan which used the Range' feature within its initial HTTP requests to avoid detection.


The Lazarus group, which has been identified as the backbone of the report, has been active in the past, and Novetta's research is helping to preemptively counteract and prevent Lazarus attacks around the world.


While vertical targeting varies, we observed a significant focus on Financial Services.


A backdoor also known as: W32.LRSgzengelSvrA.Trojan Trojan/W32.Rootkit.78592 Trojan.Festi.C6 Trojan/Tent.cow Trojan.Rootkit.1 RTKT_FESTI.SM Win32.Trojan.WisdomEyes.16070401.9500.9989 Trojan.Festi RTKT_FESTI.SM Win.Trojan.Rootkit-4345 Trojan.Win32.Tent.ddfje Trojan.NtRootKit.12267 Rootkit.Tent.Win32.134 Rootkit.Tent.fc RKIT/Tent.aui Trojan[Rootkit]/Win32.Tent Backdoor:WinNT/Festi.C Win-Trojan/Festi.78592 TScope.Malware-Cryptor.SB Trj/CI.A Win32.Exploit.Tent.cmvx


In order to simulate this technique , we took two videos side by side of how FakeSpy ( the Royal Mail sample ) behaves differently on a physical device versus an emulator .


A backdoor also known as: W32.downCN.Adware Trojan-Downloader.Win32.Petus!O Win32.Trojan.WisdomEyes.16070401.9500.9998 TROJ_DLDR.SMIH Trojan.Win32.Petus.efjtuk Trojan.Win32.A.Downloader.69153 Troj.Dropper.W32.StartPage.lmCy Trojan.DownLoader4.54937 Downloader.Petus.Win32.9 TROJ_DLDR.SMIH Trojan-Downloader.Win32.Petus Trojan[Downloader]/Win32.Petus TrojanDownloader:Win32/Petus.C Trojan/Win32.Petus.R4023 Win32/Trojan.c81


A backdoor also known as: W32.FamVT.Cosmu.PE Win32.Worm.VB.NZQ Trojan.Win32.Cosmu!O W32.Lamer.EL3 Trojan.Downloader Worm.VB.Win32.26804 Trojan/VB.nup Win32.Virus.VBbind.a W32.Besverit Win32/VB.JU TROJ_DLOADR.SMM Win.Trojan.Cosmu-4 Virus.Win32.Lamer.el Win32.Worm.VB.NZQ Trojan.Win32.VB.ltch Trojan.Win32.Cosmu.887991 Worm.Win32.VB.kp Win32.Worm.VB.NZQ Win32.Worm.VB.NZQ Win32.HLLW.Autoruner.6014 TROJ_DLOADR.SMM BehavesLike.Win32.Autorun.vh Worm.Win32.VB Trojan/Cosmu.lan Win32.Worm.VB.NZQ Troj.Downloader.W32.VB.l4ji Virus.Win32.Lamer.el Win32.Worm.VB.NZQ Win32/Lamer.D Win32.Worm.VB.NZQ SIM.Trojan.VBO.0859 Win32/VB.NUP W32/AutoRun.RPV!worm W32/OverDoom.A Virus.Win32.Lamer.B


In early 2015, FIN1 updated their toolset to include a utility that modifies the legitimate system Volume Boot Record VBR and hijacks the system boot process to begin loading Nemesis components before the Windows operating system code.


A backdoor also known as: Exploit.Java.CVE20130422.crcqcf Exploit:Java/CVE-2013-0422.A heur:Exploit.CVE-2013-0422 Exploit:Java/Obfuscator.AS Trojan.Java.Downloader virus.java.bot.a


A backdoor also known as: W32.PasistA.Worm Worm.Sfone.A3 Worm.Sform Worm.Sfone W32/Worm.BLGI W32.SillyWNSE Win32/Sfone.A BehavesLike.Win32.Trojan.ch W32/Worm.KOKR-0749 Worm:Win32/Sfone.A Worm.Sfone.A W32/WinSxsBot.A.worm


] com Counter Measures Use an up to date anti-malware software that is capable of identifying this threat .


Communicates via TOR


ONLINE – send information about Trojan ’ s current status to C & C : whether it has device administrator privileges , which HTML page is currently displayed , whether screen is on or off , etc .


Without the use of SSL interception traditional IDS/IPS systems could cease to detect compromised systems.


A backdoor also known as: Worm.Theals W32/Theals.dam Worm.Theals.Win32.2 Win32.Trojan.WisdomEyes.16070401.9500.9975 Win32/VB.VOMRAe Win.Exploit.DCOM-5 Net-Worm.Win32.Theals.c Virus.Win32.Theals.vvbf Net.Worm.W32!c Virus.Win32.Theals_re.c Win32.Zombie.4214 BehavesLike.Win32.Virut.ch Worm/Theals.i W32/Theals.D Win32.Theals.bd.8704 Net-Worm.Win32.Theals.c Worm/Win32.Theals.C1456665 Virus.Win32.Stealth.c W32/Theals.C!worm.im Win32/Trojan.529


A backdoor also known as: W32.Delf.S10 Trojan.Delf.Win32.63014 Troj.W32.Bcex.tnto Win32.Trojan.Delf.ah Downloader.Ponik Win.Trojan.Delf-33216 Win32.Trojan-Dropper.FakeDoc.B Trojan.Win32.Broskod.rb Trojan.Win32.Delf.cqqvkh TrojWare.Win32.Delf.DHHK BehavesLike.Win32.AdwareDealPly.ch Worm.Win32.Takc Trojan/Win32.Unknown Worm:Win32/Takc.A Trojan.Win32.Broskod.rb Hoax.Blocker Win32.Virus.Delf.Wsjq Trojan.Delf!8gjXiSoqNjg W32/Delf.NBJ!tr Win32/Trojan.Delf.I


A backdoor also known as: Ransom.Apollo Ransom.Apollo Ransom_Apollo.R058C0TLR17 Win32.Trojan.WisdomEyes.16070401.9500.9925 W32/Trojan.MNOB-4766 Ransom_Apollo.R058C0TLR17 Win32.Trojan-Ransom.ApolloLocker.A Trojan.Win32.Crypted.ewmuiu W32.Troj.Ransom!c Ransom.Win32.Apollo Ransom:Win32/Apollo.A Trj/CI.A Win32/Trojan.160


A backdoor also known as: Trojan.JobLaunch.ODB Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Memsyl TROJ_NECURS.SMJ10 Trojan.Win32.Crypted.dgzzxe Trojan.DownLoader11.38598 TROJ_NECURS.SMJ10 W32/Trojan.TVCC-2701 TrojanDropper.Injector.atzu Trojan.Zusy.D1B5A0 Dropper/Win32.Necurs.R121870 TrojanDropper.Injector Trojan.MSIL.Inject MSIL/Injector.FWI!tr


A backdoor also known as: HW32.Packed.C675 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan2.IUJL SecurityRisk.Downldr Trojan.DownLoad.42343 W32.Malware.Downloader Trojan.Kelios.1 TScope.Malware-Cryptor.SB Trojan.Win32.Dogrobot


Initial research identified that the filename suggested a relationship to the D-30 122mm towed howitzer, an artillery weapon first manufactured in the Soviet Union in the 1960s but still in use today.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9772 Win.Trojan.Adwind-9 W32/Trojan.YEAY-3186 W32.Dropper.Java Trj/CI.A Win32/Application.22f


A backdoor also known as: HW32.Packed.38CB Virus.Win32.Virut


Until now, it was widely believed the actor's activities had largely subsided in 2013, following numerous public disclosures and detailed analyses of their backdoors.


Surprisingly, there is a lot of media attention going on at the moment on a macOS malware called OSX/Dok.


A backdoor also known as: Trojan.Symmi.DEFF7 W32.Extrat Win.Trojan.B-471 BackDoor.Cybergate.4022 BehavesLike.Win32.Backdoor.gc Troj.W32.Scar.lByG Trojan.Win32.Xtrat.ldu Backdoor/Win32.Poison.R139029 Trojan.Xtrat Trojan.Win32.Remtasu


The Trojan may send the following information to one of the remote locations: Computer name


Mobile implant evolution timeline However , some facts indicate that the APK samples from stage two can also be used separately as the first step of the infection .


A backdoor also known as: Trojan/W32.DoS.751104 DoS.Win32.Delf!O Trojan/DOS.Delf.j DoS.Delf!7331ealGHQM W32/Worm.ATZ Hacktool.Flooder TROJ_DELF.FOE DoS.Delf DoS.Win32.Delf.j Trojan.Win32.Delf.hdtu PE:Hack.DDoSer.Win32.Delf.j!1074949418 Tool.Delf.Win32.630 TROJ_DELF.FOE BehavesLike.Win32.Trojan.bh W32/Worm.OXOE-7458 Trojan/DDoS.Delf.f DDOS/Delf.J.4 HackTool[DoS]/Win32.Delf Win32.Hack.Delf.j.kcloud Trojan.Win32.Dos-Delf.626688[h] Win-Trojan/Xema.variant DoS.Delf Trojan.Win32.Delf.j Win32.Trojan.Delf.brp Trojan-Dropper.Delf W32/Delf.A!tr DoS.BRY Win32/Trojan.2ff


In the months leading up to August, the Sofacy group launched several waves of attacks relying on zero-day exploits in Microsoft Office, Oracle Sun Java, Adobe Flash Player and Windows itself.


A new variant of the notorious ransomware Petya is back - again - and with yet another James Bond reference for a name: Goldeneye.


This particular HenBox variant , as listed in Table 3 above , harvests data from two popular messaging and social media apps : Voxer Walkie Talkie Messenger ( com.rebelvox.voxer ) and Tencent ’ s WeChat ( com.tencent.mm ) .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9996 Trojan.Cridex Trojan.Win64.Kryptik.exmlew Trojan.Win32.Z.Mikey.577536.K Trojan.Kryptik.Win64.1541 Trojan.Win64.Crypt W64/Trojan.WNTM-1890 TR/Crypt.ZPACK.fzarm Trojan/Win64.Dridex Trojan.Mikey.D123A2 Backdoor.NanoCore Trj/CI.A Win32.Trojan.Mikey.Szbg Win32/Trojan.4d2


REQUEST_INSTALL_PACKAGES - make a request to install packages .


A backdoor also known as: Backdoor.PePatch.Win32.108052 Trojan.Razy.D2AD35 Win32.Trojan.WisdomEyes.16070401.9500.9515 Trojan.Win32.Wencho.eqsozv Backdoor.Win32.Wencho Backdoor:Win32/Wencho.A Downloader/Win32.Paph.C1961981 TrojanDownloader.Paph Trj/GdSda.A


A backdoor also known as: Trojan-Exploit/W32.IMG-WMF.23552.O Trojan-GameThief.Win32.OnLineGames!O Exploit.IMG.Win32.498 Trojan/Exploit.IMG-WMF.axd TROJ_BEHAV.FL Win32.Trojan.WisdomEyes.16070401.9500.9981 TROJ_BEHAV.FL Win.Trojan.Exploit-289 Exploit.Win32.IMGWMF.bekdjb Exploit.W32.IMG-WMF.loBk TrojWare.Win32.GameThief.Magania.~EV Trojan.DownLoad.15186 BehavesLike.Win32.Worm.mc Exploit.IMG-WMF.agp Rootkit.Small Trojan.Win32.KillAv.hd Exploit.Win32.IMG-WMF Win32/Trojan.Exploit.a54


A backdoor also known as: Trojan.Delf Trojan.Heur.iO0au4aNrMf Win32.Trojan.WisdomEyes.16070401.9500.9705 W32/Trojan.UNZI-1320 W32.Datom.Worm Trojan.Win32.Delf.enaz Trojan.Win32.Datom.euwmlv Worm.Win32.Datom.A~1 Win32.HLLW.Datom BehavesLike.Win32.Sality.cc Virus.Worm.Datom Trojan.Win32.Delf.enaz Trojan/Win32.Buzus.C104859 Trojan.Delf Win32.Trojan.Delf.Swlf


SANS has published a new blog regarding a tax filing service that has been compromised.


A backdoor also known as: Application.NirSoft.PSPassView.C PSWTool.Win32.PassView!O HackTool.Pspv.SD4 W32/PWS.IMQI-4038 Hacktool.PStorRevealer Application.NirSoft.PSPassView.C not-a-virus:PSWTool.Win32.PassView.iv Application.NirSoft.PSPassView.C Riskware.Win32.PassView.exmcew Application.NirSoft.PSPassView.C ApplicUnsaf.Win32.PSWTool.PassView.A Tool.PassView Tool.PassView.Win32.6 W32/PWStealer.CAT PSWTool.PassView.k Trojan[PSWTool]/Win32.PassView Application.NirSoft.PSPassView.C not-a-virus:PSWTool.Win32.PassView.iv TScope.Malware-Cryptor.SB PUP.Optional.PassView Trj/CI.A HackTool.IcqSmiley.A not-a-virus:PSWTool.Win32.PassView Win32/Application.40e


Unit 42 recently identified a targeted attack against an individual working for the Foreign Ministry of Afghanistan in China.


What we found were several other fake apps developed using the SpyNote builder , which should come as a warning to Android users .


This threat targets Russians but the apps are accessible worldwide.


A backdoor also known as: Trojan.Qhost.Win32.10597 Trojan/Qhost.pdq Trojan.Zusy.D5AFC Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Hosts.bgaqwt Troj.Banker.W32.Qhost.lE9S Trojan.Hosts.5268 Trojan.Win32.Hider Trojan/Win32.Unknown Trojan:WinNT/QHosts.B Win32/Qhost.PDQ Trojan.Qhost!QXppfUGnhzI W32/Kryptic.QHS!tr


A backdoor also known as: Trojan.Spymel.A4 Trojan.ReconycCRTD.Win32.8402 Trojan.Zusy.D1E1BE Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Reconyc.inec Trojan.DownLoader13.49710 Trojan/Win32.Reconyc Backdoor:MSIL/Moidirat.A Trojan.Win32.Reconyc.inec Trojan.MSIL.Spy Win32/Backdoor.a11


A backdoor also known as: Trojan/W32.Nymaim.561152 Trojan.NymaimCS.S1199370 TROJ_NYMAIM.SMR2 Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_NYMAIM.SMR2 Trojan.Win32.Nymaim.eqlfnf TrojWare.Win32.Nymaim.CH Trojan.Nymaim.143 BehavesLike.Win32.MultiPlug.hh Trojan-Downloader.Nymaim Trojan.Nymaim.czv TR/Crypt.Xpack.owrka Trojan/Win32.Nymaim Win32.Trojan.Nymaim.M Trojan/Win32.Nymaim.C2027429 Trojan.Nymaim Trojan.Nymaim Win32/TrojanDownloader.Nymaim.BA Trojan.Nymaim!ovdfLq+hmM4 W32/Nymaim.BA!tr Trj/GdSda.A


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Java.Downloader.1096 BehavesLike.Win32.Trojan.vc Java.Obfus


Microsoft Publisher is included and installed by default in Office 365.


Kaspersky Lab began this ongoing research in the autumn of 2011.


In this post we will review the research results of Votiro Labs and ClearSky, the weaponized documents and campaign infrastructure.


At the same time , it hides an icon and starts background services to hide further actions from the user .


A backdoor also known as: Trojan.Heur.TP.ED1233C Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Win32.Z.Starter.204271 Trojan.Win32.Starter Exploit.ShellCode Trojan:Win32/Starter.P Trojan.Win32.Starter Trj/CI.A Win32.Trojan.Crypt.Dzkb Win32/Trojan.6f7


DustySky called NeD Worm by its developer is a multi-stage malware in use since May 2015.


When a user opens the .zip file and double clicks the JavaScript, the default browser Internet Explorer, Mozilla, etc. opens and executes JavaScript.


We have identified a new distribution campaign which took place on 4th July.


A backdoor also known as: Trojan.Minxer Win32.Trojan.WisdomEyes.16070401.9500.9994 W32/Trojan.CFWS-6788 Win32.Application.Bitcoinminer.W Riskware.Win64.BtcMine.eiegeg Trojan.BtcMine.604 Worm.WBNA.Win32.419008 W32.Trojan.Minxer Trojan.Razy.D197C7 Trojan.BitCoinMiner Trj/CI.A Riskware.BitCoinMiner! Win32/Trojan.582


Linux.Rekoobe variant


Sex sells, and nowhere is that more true than the Chinese mobile landscape.


BAIJIU's goal in this attack was to deploy a set of espionage tools through a downloader we call TYPHOON and a set of backdoors we call LIONROCK.


Adding AV exceptions


The first one is used to receive a list of logins and passwords, the second one—for operation of the SOCKS proxy server.


Variants of H-Worm, primarily connecting to command and control servers located in Algeria.


A backdoor also known as: Trojan/W32.ShipUp.90112 W32.VisuDir.A3 Trojan.Zusy.D2CF33 PE_SHIPUP.A Win32.Worm.ShipUp.h Win32/Gamarue.ISACBfC PE_SHIPUP.A Trojan.Win32.ShipUp.futk TrojWare.Win32.ShipUp.AR Trojan.KillFiles.28137 Worm.Win32.ShipUp Worm:Win32/Lecna.A!dha Trojan.Win32.ShipUp.futk Trojan/Win32.Cossta.R120893 Trojan.FakeDoc Trojan.Win32.Csyr.A


The malicious macro inside the Office document is obfuscated as shown in the code snapshot below -Recently [Kaspersky] came across a new family of cross-platform backdoors for desktop environments.


Typhon is an info stealer first that was reported in mid-2022 for the first time.


A backdoor also known as: Trojan.Zenshirsh.SL7 Trojan.Win32.Pigeon.cxszod Uds.Dangerousobject.Multi!c Win32.Trojan.Mikey.Swlc BackDoor.Pigeon.8805 Backdoor.Hupigon.Win32.185096 Trojan.Mikey.D9181 HackTool:Win32/Goldoseri.A Win32/HackTool.DoSer.AE BackDoor.Pigeon! Win32/Trojan.6bf


On July 6, 2017, RSA FirstWatch noted renewed MONSOON APT campaign activity submitted from a community user in India to Virus Total.


A backdoor also known as: RDN/BackDoor-AWQ.b Heur.Corrupt.PE Backdoor.Win32.Hupigon TrojanDropper:Win32/Arbinder.B.dam#2 Backdoor/Win32.Graybird.C194482


A backdoor also known as: Trojan.Zenshirsh.SL7 Hacktool.Flooder BehavesLike.Win32.RAHack.xc Trojan-DDoS.Win32.Resod TrojanDDoS.Resod.g TR/DDoS.Maker.11.B Trojan[DDoS]/Win32.Resod DDoS:Win32/Resod.dam#2 Win32/Trojan.DDoS.835


FakeSpy Masquerades as Postal Service Apps Around the World July 1 , 2020 KEY FINDINGS The Cybereason Nocturnus team is investigating a new campaign involving FakeSpy , an Android mobile malware that emerged around October 2017 .


60 % of devices containing or accessing enterprise data are mobile , and mobile devices tend to include a significant amount of personal and business data , assuming the organization has a bring-your-own-device policy in place .


A backdoor also known as: Win32.Wurmark.A@mm Win32.Wurmark.A@mm W32/Mugly.h@MM W32.W.Wurmark.g!c W32/Wurmark.g Win32.Wurmark.A@mm Win32.Wurmark.E90817 I-Worm.Wurmark!utsCc3R91ZU W32/Wurmark.F W32.Mugly.G@mm Win32/Wurmark.G WORM_MUGLY.H Worm.Wurmark.G Email-Worm.Win32.Wurmark.g Trojan.Win32.Wurmark.fsml Virus.Win32.Heur.c Win32.Wurmark.A@mm Worm.Win32.Wurmark.G Win32.Wurmark.A@mm Worm.Wurmark.Win32.11 WORM_MUGLY.H BehavesLike.Win32.VBObfus.fc W32/Wurmark.JPAN-1543 I-Worm.Wurmark.a WORM/Uglatad.2 Worm[Email]/Win32.Wurmark Worm:Win32/Mugly.H@mm Win32/Mugly.worm.351744 Win32.Wurmark.A@mm Win32/Mugly.G Worm.Wurmark Win32.Wurmark.A@mm Virus.Win32.QQRob.AS W32/Mugly.H@mm I-Worm/Wurmark.E Worm.Win32.Wurmark.AGmW


Darkhotel APT attacks dated 2014 and earlier are characterized by the misuse of stolen certificates, the deployment of .hta files with multiple techniques, and the use of unusual methods like the infiltration of hotel Wi-Fi to place backdoors in targets' systems.


A backdoor also known as: Trojan.Symmi.D11236 Win32.Trojan.WisdomEyes.16070401.9500.9993 DLOADER.Trojan Trojan-Downloader.Win32.Small Trojan/Win32.Rozepads.R172444 BScope.Trojan.Win32.Inject.2


Smartphones are the dominant form of internet access in the region and Xinjiang was recently above the national average of internet users in China .


A backdoor also known as: Backdoor/W32.Androm.1289728 Trojan.Skeeyah Backdoor.Bot Win32.Trojan.WisdomEyes.16070401.9500.9989 W32/Trojan.UWVT-1669 W32.Golroted TROJ_INJECTOR_FE31022B.UVPM Backdoor.Win32.Androm.hjzg Trojan.PWS.Stealer.13025 TROJ_INJECTOR_FE31022B.UVPM BehavesLike.Win32.Trojan.tc W32/Trojan2.PTAY Backdoor/Androm.gyi Trojan[Backdoor]/Win32.Androm Trojan.MSIL.Androm.9 Backdoor.Win32.Androm.hjzg Trojan:MSIL/Loksec.A Trojan/Win32.Inject.R140951 Backdoor.Androm Trojan.Injector Trj/CI.A


A backdoor also known as: Trojan/Dropper.Delf.bl TROJ_DROPPER.IPJ W32/Risk.CLFC-1497 Backdoor.Acropolis TrojanDropper.Delf TROJ_DROPPER.IPJ Win.Trojan.Acropolis-1 Trojan-Dropper.Win32.Delf.bl Trojan.Win32.Delf.ffej Dropper.Delf.972288 Troj.Dropper.W32.Delf.bl!c TrojWare.Win32.TrojanDropper.Delf.BL BackDoor.Acropolis.10 Dropper.Delf.Win32.1638 Trojan-Dropper.Win32.Delf W32/Dropper.HL TrojanDropper.Delf.cj W32.Trojan.Dropper-Tetris BDS/Acropolis.3 Trojan[Dropper]/Win32.Delf Win32.Troj.Delf.bl.kcloud Backdoor:Win32/Tetris.A Trojan.Graftor.D2B929 Trojan-Dropper.Win32.Delf.bl Win32/TrojanDropper.Delf.BL Win32.Trojan-dropper.Delf.Efao TrojanDropper.Delf!n6JtRIRZLjo W32/Acrop.A!tr.bdr Win32/Trojan.Dropper.605


A backdoor also known as: W32.FamVT.ExpiroPC.PE Backdoor.Win32.Nucleroot!O Win32.Trojan.WisdomEyes.16070401.9500.9750 Adware.Lop Win32/Talpalk.C Win.Trojan.Maha-2 Backdoor.Win32.Nucleroot.c Trojan.Win32.Maha.gubp Packer.W32.PePatch.l5Ml Packed.Win32.Klone.~KE Trojan.Maya BehavesLike.Win32.Ipamor.ch Trojan-Dropper.Delf Backdoor/Nucleroot.fk Trojan[PSW]/Win32.Maha Backdoor.Win32.A.Nucleroot.130560 Backdoor.Win32.Nucleroot.c PWS:Win32/Bividon.A Backdoor.Nucleroot W32/Nucleroot.C!tr


Security researchers have identified and identified a new type of malware, which they believe is being developed by threat actors operating from North, East and South-East Asia, and is capable of being fully undetectable.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Zbot Backdoor.Win32.DarkKomet.zvj Trojan.Win32.DarkKomet.dklzqc Trojan-Dropper.Win32.Injector Trojan[Backdoor]/Win32.DarkKomet Trojan.MSIL.Krypt.3 Backdoor.Win32.DarkKomet.zvj PWS:MSIL/Skonpri.A Backdoor/Win32.DarkKomet.R90638 Backdoor.DarkKomet Trj/CI.A Trojan.Krypt!XrXGvmn0xR4 W32/DarkKomet.FZ!tr.bdr


The main goal of the xDedic forum is to facilitate the buying and selling of credentials for hacked servers which are available through RDP.


This report is the first to detail the attack against strategic US interests to China.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Archbomb.ZIP Trojan-ArcBomb.ZIP.Bubl.b Trojan.Zip.Arch-Bomb.yngkq BehavesLike.Win32.Trojan.dh Trojan.Archbomb BOMB/ArcBomb.O Trojan-ArcBomb.ZIP.Bubl.b


The abuse of shortcut LNK files is steadily gaining traction among cybercriminals.


Initially, we've called it Matrix Banker based on its command and control C2 login panel, but it seems that Matrix Admin is a template available for the Bootstrap web framework.


A backdoor also known as: Win32/Shuq.B W32/Shuq.g I-Worm.Shuq!TBLjXfxv+A8 W32.SillyFDC Win32/Shuq.NAA TROJ_ANGEL.F Worm.Shuq.B Email-Worm.Win32.Shuq.g Trojan.Win32.Shuq.epjd Trojan.Win32.S.HDC.66048[h] W32.W.Shuq.g!c Backdoor.Win32.Shuq.NAA BackDoor.HSV.1013 Worm.Shuq.Win32.5 TROJ_ANGEL.F W32/Risk.OPXF-7688 Worm/Sramota.aws W32/ANGEL.G@mm Worm[Email]/Win32.Shuq Trojan/Win32.HDC Backdoor:Win32/Shuq.A Worm.Shuq Win32.Worm-email.Shuq.Eerm Email-Worm.Win32.Shuq I-Worm/Shuqing.E


Reasons for Taiwan being targeted range from being one of the sovereign states of the disputed South China Sea region to its emerging economy and growth with Taiwan being one of the most innovative countries in the High-Tech industry in Asia.


A backdoor also known as: Worm/W32.DipNet.139264 W32/DipNet.f Trojan.Win32.DipNet.emkm W32/Dipnet.F Trojan.Netdepix.B Win32/Dipnet.NAD Net-Worm.Win32.DipNet.f Worm.DipNet!vTuZ7jF3dLw Worm.Win32.DipNet.139264[h] W32.W.DipNet.f!c Virus.Win32.Part.a Worm.Win32.Dipnet.NAD BackDoor.Xdoor.351 Worm.DipNet.Win32.8 BehavesLike.Win32.Trojan.ch W32/Dipnet.XULH-0302 Worm/DipNet.a WORM/DipNet.b W32/Netdepix.B!worm Worm[Net]/Win32.DipNet Win32/Dipnet.worm.139264 Worm:Win32/DipNet.H Win32/Oddbob.E Net-Worm.DipNet W32/Oddbob.E.worm Backdoor.Win32.Xdoor Worm/Dipnet.M Worm.Win32.DipNet.aMVE


RECEIVE_SMS - allow the application to receive text messages .


A backdoor also known as: Trojan.DL.VB.IHEW Trojan-Spy.Win32.Bancos.alh!IK Trojan-Downloader.Win32.VB.tbx TR/Spy.65536.194 TSPY_ZBOT.SMDM Trojan.Spy.65536.194 TrojanDownloader.VB.vhu TrojanSpy:Win32/Bancos.KY Trojan-Downloader.Win32.VB.tbx Trojan-Spy.Win32.Bancos.alh


On July 5, 2015 an unknown hacker publicly announced on Twitter that he had breached the internal network of Hacking Team – an Italian pentesting company known to purchase 0-day exploits and produce their own trojans.


A backdoor also known as: Trojan-Downloader.Win32.Harnig!O Win32.Trojan-Downloader.Harnig.cu Trojan.Gobrena TROJ_HARNIG.FC Trojan-Downloader.Win32.Harnig.cu Trojan.Win32.Harnig.dpsezu PE:Trojan.DL.Tibs.fxl!1074175505 Trojan.DownLoader.13549 Downloader.Harnig.Win32.2 TROJ_HARNIG.FC TrojanDownloader.Harnig.alh TR/Dldr.Small.dib.6 Trojan[Downloader]/Win32.Harnig.cu Win32.TrojDownloader.Harnig.co.kcloud Trojan/Win32.Harnig Trojan-Downloader.Revelation.Tibs.B Trojan-Downloader.Win32.Harnig.cr W32/Harnig.CU!tr.dldr Downloader.Harnig.AP Trojan.Win32.Harnig.Aj


Receiver was involved in receiving commands from the Server and the main functionality of Sender was to send all the data collected to the C & C over Wi-Fi .


Every one of these campaigns involved a Windows version of Derusbi.


On October 10, 2017, Kaspersky Lab's advanced exploit prevention systems identified a new Adobe Flash zero day exploit used in the wild against our customers.


The service offers a binder tool that allows users to masquerade their malware as legitimate software.


] com ( and third-levels of this domain ) www3.mefound [ .


Malwarebytes has been observing a surge in drive-by download attacks since the recent Flash zero-day now patched.


A backdoor also known as: TrojanAPT.BrowsPass.ST3 Trojan.MSIL.Ubibila.1 Win32.Trojan.WisdomEyes.16070401.9500.9999 MSIL.Trojan.Pinject.A Trojan-Dropper.Win32.Sysn.bgns Trojan.Win32.MailPassView.dzxrgp Tool.MailPassView.236 BehavesLike.Win32.Trojan.gc Trojan.PSW.Fareit.te TR/Dropper.MSIL.sbcsg Trojan:MSIL/Golbla.B Trojan-Dropper.Win32.Sysn.bgns Trojan/Win32.Golbla.C1246680 Trj/CI.A Win32.Trojan-dropper.Sysn.Akyi Trojan.Inject MSIL/Injector.MRD!tr


A backdoor also known as: W32.AutorunXjyv.Worm Trojan.Dropper.VIO Trojan/W32.Chydo.569344.E Trojan.KillAv.DR Trojan.Chydo Win32.Worm.Autorun.j Win32/Pykspa.C WORM_MESSEN.SMF Trojan.Dropper.VIO Worm.Win32.AutoRun.iea Trojan.Dropper.VIO Trojan.Win32.Chydo.eahreo Trojan.Win32.Chydo.516096.B Trojan.Dropper.VIO Trojan.MulDrop5.14836 Worm.AutoRun.Win32.116380 WORM_MESSEN.SMF BehavesLike.Win32.Backdoor.hc Trojan/Chydo.bj Trojan.Dropper.VIO Worm.Win32.AutoRun.iea TrojanDropper:Win32/Pykspa.A Trojan/Win32.Chydo.R40147 Trojan.Dropper.VIO Trojan.Chydo Trojan.Win32.FakeAlert.ate Trojan.Win32.KillAV.Y


In this post, we will be pulling apart and dissecting the Rambo backdoor and discussing several of its evasion techniques.


DarkKomet variant, often dropped as patcher.exe


A backdoor also known as: W32.Clodee5.Trojan.2bfc Trojan.Proxy.Wopla.Q Trojan-Proxy/W32.Wopla.20992.D Trojan.Wopla.Win32.59 Trojan/Proxy.Wopla.q Trojan.PR.Wopla!heGrkrdKLNg Trojan.Tannick.B Win32/Pokier.V TSPY_WOPLA.Q Trojan.Proxy.Wopla.Q Trojan-Proxy.Win32.Wopla.q Trojan.Proxy.Wopla.Q Trojan.Win32.Wopla.csuaej PE:Trojan.Proxy.Wopla.ay!100004534 Trojan.Proxy.Wopla.Q TrojWare.Win32.TrojanDownloader.Small.AA Trojan.Proxy.Wopla.Q TSPY_WOPLA.Q BehavesLike.Win32.Downloader.mc W32/Trojan.AXS TrojanProxy.Wopla.d TR/Proxy.Wopla.Q.4 Win32.Troj.Wopla.q.kcloud Trojan.Proxy.Wopla.Q Win-Trojan/Wopla.20992 TrojanProxy.Wopla Trj/Alpiok.A Trojan-Proxy.Win32.Wopla.Q Multidr.J!tr Proxy.BKA.dropper Trojan.Win32.Wopla.AdJ


We rapidly determined that this spam campaign was attempting to broadly deliver TeslaCrypt 4.1A to individuals.


FireEye Threat Intelligence analysts identified a spear phishing campaign carried out in August 2015 targeting Hong Kong-based media organizations.


A backdoor also known as: DoS.Small W32/VirTool.OH Bloodhound.W32.EP DoS.Win32.Small.e Trojan.Win32.Small.dosb Flooder.Upsend W32/Tool.GNXW-3960 DoS.Small.c HackTool[DoS]/Win32.Small DoS:Win32/Small.E DoS.Win32.Small.e DoS.Small Win32.Trojan.Small.Lnoh DoS.Win32.Small W32/Small.E!dos


A backdoor also known as: W32.UsernameReimuatH.Trojan Worm/W32.WBNA.294912.AU Trojan.Win32.Diple!O Trojan.Beebone.D Trojan/VBObfus.fz Win32.Worm.Pronny.d Win32/VB.KXfdHDB WORM_VOBFUS.SM37 Win.Packer.VBCrypt-5731517-0 Worm.Win32.Vobfus.erof Trojan.Win32.Vobfus.enwdjc Win32.Worm.Vobfus.Wvay Win32.HLLW.Autoruner2.18084 WORM_VOBFUS.SM37 BehavesLike.Win32.Autorun.dh Win32.Virut.ce.57344 Trojan.Symmi.D13A73 Trojan.Win32.A.Diple.299008.BAT Worm.Win32.Vobfus.erof Worm/Win32.WBNA.R108353 TScope.Trojan.VB Worm.Win32.Vobfus


Once OSX/Dok infection is complete, the attackers gain complete access to all victim communication, including communication encrypted by SSL.


By going on the offensive and hunting the attackers , our team was able to unearth the early stages of what may be a very dangerous mobile malware .


Once in the live session, if there is a file in /var/lib/man.cy, then this is an infected ISO.


At a high level, Romberik is a complex piece of malware that is designed to hook into the user's browser to read credentials and other sensitive information for exfiltration to an attacker controlled server, similar to Dyre.


A backdoor also known as: Trojan-PWS/W32.Avisa.69632 Trojan-PSW.Win32!O W32/Inttest.worm PWS-Inttest.B TROJ_AVISA.B Win32.Trojan.WisdomEyes.16070401.9500.9757 W32/Risk.CNKX-3667 Infostealer.Avisa Win32/PSW.Cript.B Trojan-PSW.Win32.Deintel Trojan.Win32.Avisa-Psw.fdrj Trojan.Win32.Avisa.69632 Trojan.Avisa.Win32.2 BehavesLike.Win32.PJTbinder.km Worm.Pws.Inttest Trojan/PSW.Avisa Trojan[PSW]/Win32.Deintel Trojan-PSW.Win32.Deintel Trojan/Win32.HDC.C89238 TrojanPSW.Deintel Trj/PSW.Intetest Win32/PSW.Avisa.A Win32.Trojan-qqpass.Qqrob.Sxoe Trojan.PSW.Avisa W32/Avisa.A!tr


Related insfrastructure shows another suspicious looking domain that mimics the Court of Arbitration for Sport


Their primary interest appears to be gathering intelligence related to foreign and security policy in the Eastern Europe and South Caucasus regions.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9998 Backdoor.Bifrose Trojan.Win32.Small.cup Trojan.Win32.Buzus.rbpz Trojan.Win32.Buzus.86895 Trojan.MulDrop.18143 BehavesLike.Win32.Backdoor.hc Trojan/Buzus.fcx Virus.Trojan.Win32.Buzus.acj W32/Trojan2.AGMZ Trojan/Buzus.cf TrojanDropper:Win32/Buzus.B W32.W.Ridnu.ls5O Trojan.Win32.Small.cup Trojan/Win32.Buzus.C71809 Trojan.Buzus W32/Kryptix.KZB!tr Win32/Trojan.6a2


A backdoor also known as: HW32.Packed.771B Ransom.Cerber.A4 Ransom.Cerber Trojan.Symmi.D13E52 Ransom_HPCERBER.SM3 Win32.Trojan.Kryptik.avs Ransom_HPCERBER.SM3 Trojan-Ransom.Win32.Rack.hly Trojan.Win32.Rack.evkhfe Trojan.Encoder.761 BehavesLike.Win32.Ransomware.gh Ransom.Win32.Teerac Trojan.Rack.dk Trojan-Ransom.Win32.Rack.hly Trojan.Menti Trj/GdSda.A W32/Kryptik.FSUS!tr Win32/Trojan.Ransom.7c1


In addition to the feature base it already possesses and the money that can be made from the rental , it could evolve to compete with the mightiest Android banking Trojans .


A backdoor also known as: TrojanDownloader.Yafive.A.mue Win32.Trojan.WisdomEyes.16070401.9500.9991 Trojan-Downloader.Win32.QQHelper.air Troj.Spy.W32.Zbot.kYVW TrojWare.Win32.TrojanDownloader.Tiny.~CA BackDoor.Update.293 Win32.Hack.XComp.a.410674 TrojanDownloader:Win32/Yafive.A Trojan-Downloader.Win32.QQHelper.air TrojanDownloader.QQHelper Trojan-Downloader.Win32.QQHelper


Malware Features Android According to the observed samples and their signatures , early versions of this Android malware were developed by the end of 2014 and the campaign has remained active ever since .


It recently resurfaced in November 2016 W32.Disttrack.B, again attacking targets in Saudi Arabia.


A backdoor also known as: Win32.Yodo.A@mm Worm/W32.Yodo.1273856 W32/Yodo.a Win32.Yodo.E90817 WORM_YODO.F W32.Yodo@mm Win32/Yodo.D WORM_YODO.F Win32.Yodo.A@mm Email-Worm.Win32.Yodo.a Win32.Yodo.A@mm Trojan.Win32.Yodo.bdnumu W32.W.Yodo.a!c Win32.Yodo.A@mm Worm.Win32.Yodo.B.Dropper Win32.Yodo.A@mm Trojan.MulDrop.572 Worm.Yodo.Win32.1 BehavesLike.Win32.VBObfus.tm W32/Risk.OQBD-6759 Worm/Yodo.b Worm:Win32/Yodo.B.dr WORM/Yodo.A.1 Worm[Email]/Win32.Yodo Worm.Yodo.a.kcloud Worm:Win32/Yodo.B.dr Email-Worm.Win32.Yodo.a Worm.Yodo Win32/Yodo.B.Dropper Win32.Worm-email.Yodo.Eddu I-Worm.Yodo!uEen0717POE W32/Yodo.A!worm Win32/Worm.bde


We don't have the statistics of devices vulnerable to both issues at the same time.


A backdoor also known as: Trojan.Krypt.8 TROJ_TDSS.SMA Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_TDSS.SMA Packed.Win32.TDSS.aa Trojan.Win32.Tdss.btyvr Win32.PkdTdss Trojan.Packed.2936 BehavesLike.Win32.Adware.kc TrojanDropper:Win32/Sudiet.A Packer.W32.Tdss!c Packed.Win32.TDSS.aa Trojan/Win32.ADH.R21764 Trojan.TDSS.01414 Win32.Packed.Tdss.Akox Packer.Win32.Tdss W32/PackTDss.K!tr Win32/Trojan.5b8


A backdoor also known as: Win32.Worm.Bundpil.d Win32.Worm.Resparc.B Trojan:Win32/Lodbak.A Trojan/Win32.Lodbak.R151670 Trj/Gamarue.A


Intrusions began as early as 1996.


A backdoor also known as: Trojan.Win32.Scrop.exbmlp BehavesLike.Win32.AdwareConvertAd.fh W32/Trojan.YEZU-6096 TrojanDropper.Scrop.ns Trojan[Dropper]/Win32.Scrop Backdoor:Win32/Blopod.A!bit Trojan.Symmi.D13661 Dropper/Win32.Scrop.C2319178 TrojanDropper.Scrop Trj/GdSda.A


A backdoor also known as: Trojan.Netstop.A Backdoor.Padmin Backdoor.W32.Padmin.08!c Trojan/wGet.d Backdoor.Padmin.0.8 W32/Risk.LANR-3940 Win.Trojan.Padmin-2 Backdoor.Padmin.0.8 Trojan.Netstop.A Trojan.Win32.Padmin.dyyica Backdoor.Win32.Padmin.08 Trojan.Netstop.A BackDoor-ATM.dr Backdoor/Padmin.08.Install DR/Padmin.08 BackDoor-ATM.dr Backdoor.Padmin Bck/Iroffer.BG Win32/Padmin.08.A.dropper W32/Padmin.A!tr.bdr


A backdoor also known as: Adware.Heur.cmSfNKMeS5mk WORM_AMBLER.SMI Win32.Trojan.WisdomEyes.16070401.9500.9938 WORM_AMBLER.SMI Trojan.Win32.BHO.bmciwr Trojan.PWS.Finanz.origin W32/Ambler.dll TrojanDownloader:Win32/BHO.A TrojanDownloader.BHO Trj/CI.A Win32.Trojan.Spy.Hrza TrojanSpy.Banker!l0YgZsorMww Trojan-Spy.Finanz.J W32/Ambler.A!tr


The app then continues to run in the background without the user ’ s knowledge .


This new report is an updated dissection of the group's attacks and methodologies—something to help organizations gain a more comprehensive and current view of these processes and what can be done to defend against them.


The email messages used in the attacks leverage themes related to economic development and politics in Burma, which is relevant to the work of the NGO.


A backdoor also known as: Trojan:Win32/Vareids.A Trojan.FakeAV


A backdoor also known as: Trojan.Win32.VBKrypt!O Worm.Rebhip.B3 Troj.W32.Scar!c Trojan/Injector.eyu Trojan.Win32.Scar.odxb Trojan.Win32.VBKrypt.ecjqdh Trojan.Win32.A.VBKrypt.200710 TrojWare.Win32.VBKrypt.cjb Trojan.Inject.27856 Trojan.VBKrypt.Win32.39868 BehavesLike.Win32.PWSSpyeye.cc W32/Trojan.FNVH-2986 Trojan/VBKrypt.bgwm Trojan/Win32.VBKrypt Trojan.ManBat.1 Trojan.Win32.Scar.odxb Trojan/Win32.VBKrypt.C66955 PWS-Spyeye.el SScope.Malware-Cryptor.VBCR.1841 Win32.Trojan.Scar.Tccd Trojan.VBKrypt!joEshOiwspo Win32/Trojan.00c


A backdoor also known as: Trojan/VB.qtt Backdoor.Win32.Sdbot.aeua Trojan.Win32.Nifclop.bbwtga Trojan.DownLoader6.34031 TR/Nifclop.A.6 Trojan:Win32/Nifclop.A Backdoor.Win32.Sdbot.aeua Win32/VB.QTT Trojan.Win32.Nifclop Win32/Trojan.fdb


During the last few days, we have observed a campaign redirecting visitors from large websites to the Angler EK.


But our researchers have predicted that these small Trojans would certainly be used to download some really bad malware that can actually harm the owners of the infected devices .


A backdoor also known as: Trojan-Downloader.Win32.Gamarue.2!O TrojanDropper.Dexel.A5 Trojan.Blocker.Win32.18819 WORM_DEXEL.SM Win32.Trojan.WisdomEyes.16070401.9500.9869 W32/Autorun.LWDQ-2252 W32.SillyFDC Win32/Dapato.AY WORM_DEXEL.SM Trojan.Win32.Blocker.dbnfux Troj.Dropper.W32.FrauDrop.tnsr BehavesLike.Win32.Trojan.fh W32/Autorun.ABG TrojanDropper.Dapato.pgs Trojan[Dropper]/Win32.Dapato TrojanDropper:Win32/Dexel.A Trojan.Zusy.D26D16 Win32.Trojan.Dapato.B HEUR/Fakon.mwf TrojanDropper.FrauDrop Trj/CI.A


A backdoor also known as: W32.SvchostVS.Trojan Worm.Moarider Trojan/Autoit.nlq Win32.Trojan.AutoIt.a Bloodhound.Malautoit WORM_SOHANAD_EH110001.UVPC Trojan.Win32.Autoit.aza Trojan.Script.AutoIt.dbycya Troj.W32.Autoit.lWNh TrojWare.Win32.Autoit.AZA Trojan.DownLoader19.27399 WORM_SOHANAD_EH110001.UVPC BehavesLike.Win32.Comame.fc Trojan.Win32.Autoit TR/BAS.Samca.1188111 Trojan:Win32/Svhoder.A Trojan.Heur.E6CE86 Trojan.Win32.Autoit.aza HEUR/Fakon.mwf Trojan.Autoit.Wirus Trojan.Autoit.NLQ Win32/Autoit.NLQ W32/Autoit.NLQ!tr W32/Sality.AH


] com/gate_cb8a5aea1ab302f0_c online 185.158.248 [ .


This infection is based on previously reported Gozi ISFB/Ursnif activity from March 6, 2023.


A backdoor also known as: PUP.Optional.BrSoftware Trojan.ADH Trojan-Banker.Win32.Lohmys.a Application.Win32.Midia.BR MalSign.Skodna.BRS Adware.Win32.Midia.B


It is designed to steal money from unsuspecting victims right off their bank accounts without them even noticing.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9866 W32/Trojan.IKAJ-5854 Infostealer.Banker.C Win32/Kollah.MWH Trojan.JarDrop.1 W32.Trojan.Dropper TR/Spy.ZBot.aww TrojanDropper:Win32/Jazuz.A Win32/Trojan.Spy.d85


Indicators about some panels hosting the DDoS Blue Botnet


The utility can be installed on smartphones and tablets as a program named Insta Plus, Profile Checker, and Cleaner Pro.


A backdoor also known as: Trojan.Minnerchek Trojan.Win32.S.Downloader.31046816 Trojan.Win32.Minnerchek Adware.Installcore Trojan:Win32/Minnerchek.A Dropper/Win32.CoinMiner.C2322242 Trj/Downloader.MEP


The sux library appears to be a customized super user ( su ) tool that includes code from the com.koushikdutta.superuser app and carries the equivalent of a super user ( su ) binary in order to run privileged commands on the system .


A backdoor also known as: W32.HfsAdware.689E PUP.Firseria/Variant Trojan.Application.Bundler.Morstar.30 Trojan.Dropper Win32/Tnega.ZRdFDZD Win.Adware.Morstar-136 not-a-virus:Downloader.Win32.Morstar.dhp Trojan.Win32.Morstar.dmuxrd Adware.Win32.Firseria.b Trojan.DownLoader11.57090 AdWare/Solimba.h RiskWare[Downloader]/Win32.Morstar TrojanDropper:Win32/Sventore.C not-a-virus:Downloader.Win32.Morstar.dhp Win32.Application.Morstar.E PUP/Win32.Solimba.R133806 PUP.Optional.Firseria PUA.Downloader! AdWare.BundleApp Win32/Application.164


A backdoor also known as: Trojan.Kazy.D4E7E3 Win32.Trojan.WisdomEyes.16070401.9500.9858 Trojan.Win32.CFI.eurnzt Trojan.Win32.Z.Kazy.253952.EN TrojWare.Win32.FraudPack.P Trojan.Click2.54806 W32/Trojan.JQCG-7679 PWS:Win32/Reteged.B TrojanSpy.Dibik Trojan-Spy.Reteged Adware/Win32.180solutions.BM


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Mlw.ewmnqj W32/Trojan.MKOX-6072 TR/Dropper.MSIL.citga Trj/CI.A Win32/Trojan.5e4


A backdoor also known as: Backdoor/W32.Cyn.18944.B Backdoor.Cyn Email-Worm.Win32.GOPworm.196 BKDR_CYN.C Backdoor.Trojan BKDR_CYN.C Backdoor.Win32.Cyn.12.a Trojan.Win32.Cyn.dotopq Backdoor.Win32.Cyn_12.EditSvr BackDoor.Cyn.12 Trojan.Cyn.Win32.1 BehavesLike.Win32.Trojan.lh W32/Risk.EBIW-7264 Backdoor/Cyn.f BDC/Cyn.12.A.EdS Backdoor:Win32/Cyn.1_02 Backdoor.Win32.Cyn.12.a Win-Trojan/Cyn_v12.18944 Email-Worm.Win32.GOPworm.196 SScope.Trojan.VBRA.3344 Bck/Cyn.12 Win32/Cyn.12 Backdoor.Cyn!pLjU0MDAXWM W32/Cyn.12!tr.bdr Win32/Backdoor.ac7


A backdoor also known as: Ransom.Exxroute.A3 Ransom.Cerber Win32.Trojan.Kryptik.bjk Ransom_CERBER.SM37 Win.Ransomware.Cerber-6162277-0 Trojan.Win32.Zerber.eltxmx Troj.Ransom.W32.Zerber.toho Trojan.DownLoader23.53130 Trojan.Kryptik.Win32.1113485 Ransom_CERBER.SM37 BehavesLike.Win32.Ransom.kh Trojan.Zerber.atr Backdoor:Win32/Crugup.B W32/Kryptik.FOLJ!tr


Typically, these campaigns leverage spear phishing as the delivery vector and often include malicious attachments designed to bypass typical detection controls.


A backdoor also known as: W32.BackdoorKasidetAF.Trojan Backdoor/W32.Kasidet.87040 Trojan.Dynamer.20568 Backdoor.W32.Kasidet.tnrA BKDR_NEUTRINO.SM Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Kasidet.J BKDR_NEUTRINO.SM Backdoor.Win32.Kasidet.bgo Trojan.Win32.Kasidet.dpmgpp Worm.Win32.Kasidet.CAK BackDoor.Neutrino.19 Backdoor.Kasidet.Win32.519 BehavesLike.Win32.TrojanShifu.mh Worm.Win32.Kasidet W32/Kasidet.INNN-8495 Backdoor/Kasidet.by TR/Hijacker.ldiu Trojan[Backdoor]/Win32.Kasidet Backdoor:Win32/Kasidet.C Backdoor.Win32.Kasidet.bgo Trojan/Win32.Dynamer.R156738 Backdoor.Kasidet Spyware.PasswordStealer Win32/Kasidet.AB Win32.Backdoor.Kasidet.Phgi Win32/Trojan.cd8


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9978 Trojan.Win32.Infospy.everjh Trojan.Infospy.13 BehavesLike.Win32.FakeAlert.lh Trojan-Dropper.Win32.Jscrpt W32.Trojan.Emotet TrojanDropper:Win32/Jscrpt.A!bit Trj/CI.A Win32/Trojan.f75


The overall image of these ties is below in Figure 5 and paints a picture of an adversary with at least 5 malware families in their toolbox dating back to at least 2015 .


He matched both PDB paths as wel as behaviour to these samples, this blog describes the changed made to CryptoApp as well as the active campaign.


A backdoor also known as: Trojanpws.Tepfer Trojan-PSW.Win32.Tepfer.psxgjz Troj.Psw.W32.Tepfer!c Trojan.MSIL.Crypt TR/Dropper.MSIL.273998 Trojan-PSW.Win32.Tepfer.psxgjz Trojan:Win32/Matta.A!gfc TrojanPSW.Tepfer Trj/GdSda.A Win32.Trojan.Falsesign.Agbe MSIL/Injector.ONL!tr Win32/Trojan.Dropper.28b


A backdoor also known as: PowerShell/Rozena.AF BehavesLike.Win64.Dropper.cc Trojan/Scar.bmid


A backdoor also known as: Backdoor.RSM.2.0 Backdoor/W32.RSM.204800 Backdoor.RSM Backdoor.RSM.2.0 Backdoor.RSM.2.0 Backdoor.Trojan Backdoor.RSM.2.0 Backdoor.Win32.RSM.20 Backdoor.RSM.2.0 Trojan.Win32.RSM.dmmg Backdoor.Win32.Z.Rsm.204800 Backdoor.W32.RSM.20!c Backdoor.RSM.2.0 Backdoor.RSM.2.0 BackDoor.RMS.20 Backdoor.RSM.Win32.4 BehavesLike.Win32.Dropper.dc Backdoor.Win32.Intruder W32/Risk.WUUC-5425 Backdoor/RSM.28.b BDS/RSM.20.2 Backdoor:Win32/RSM.2_0 Backdoor.Win32.RSM.20 Backdoor.RSM Win32/RSM.20 Win32.Backdoor.Rsm.Sysb Backdoor.RSM!gcfh+QxIfXE W32/RSM.20!tr.bdr


Security researchers have discovered that Cl0p is now targeting Linux systems, using a new variant specifically designed for this operating system.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9951 Worm.BAT.Autorun.ex TrojWare.Win32.StartPage.~AO Win32.HLLW.Autoruner2.11336 Worm.AutoRun.Win32.42154 BehavesLike.Win32.Virus.cz Trojan-Dropper.Win32.Autorun Worm.BAT.al Win32.HeurC.KVM007.a.kcloud Worm.BAT.Autorun.ex TrojanDropper:Win32/Autorun.AC Worm/Win32.AutoRun.R74164 TScope.Trojan.Delf Trj/CI.A BAT/Autorun.BK Bat.Worm.Autorun.Aihw BAT/Autorun.EX!worm


Nonetheless, we can obtain targeting information and insight into tactics from the spearphish messages used by the threat actors.


The primary goal of sux appears to be steal messages and other data from popular messaging and social media apps specified within the HenBox sample .


The idea is simple - if the infected device belongs to a real person , sooner or later this person will move around , increasing the step counter .


A recent campaign compromised Taiwan and Hong Kong sites to deliver Flash exploits related to Hacking Team and eventually download PoisonIvy and other payloads in user systems.


This trojanized version of PuTTY harvests credentials and relays the information back to a collection server in the same way too.


For example , this could be when the victim ’ s device connects to a Wi-Fi access point that is infected or controlled by the attackers .


A backdoor also known as: W32.SysAntiH.Worm Worm.Win32.AutoRun!O Worm.Yeltminky.A2 Win32.Trojan.KillAV.y W32.SillyFDC Win32/SillyAutorun.BBA Trojan.Win32.AntiAV.ciuz Trojan.Win32.AutoRun.btmkp Worm.Win32.Autorun.70144.E Trojan.Win32.KillAV.tco Win32.HLLW.Autoruner.25125 BehavesLike.Win32.Backdoor.lc Trojan-PWS.Win32.Lmir Worm/AutoRun.inq Virus/Win32.Virut.ce Worm:Win32/Yeltminky.A Trojan.Win32.AntiAV.ciuz Trojan/Win32.Hupigon.C73726 MalwareScope.Trojan-PSW.Game.7 RiskWare.Tool.CK Worm.AutoRun!snJYP2M4Pvg W32/QQPass.BTC Win32/Trojan.2ff


Ransomware has been responsible for many millions of dollars in damages, and CryptoWall is one of the most lucrative ransomware families in use today.


In March 2017, FireEye observed both nation state and financially motivated actors using EPS zero day exploits assigned as CVE-2017-0261 and CVE-2017-0262, prior to Microsoft disabling EPS rendering in its Office products with an update in April 2017.


A backdoor also known as: Trojan.Coantor.11 Win.Trojan.Cuegoe-6336261-0 BehavesLike.Win32.Dropper.vc Trojan:Win32/Salgorea.C!dha


In a story which reminds us of the Bangladesh Bank case – the culprits had compromised the bank's system connected to the SWIFT network and used this to perform the transfers.


A backdoor also known as: W32.Clodcaf.Trojan.0256 Worm/W32.Opanki.176640 W32.Allim W32/Funmov.a Win32.Trojan.WisdomEyes.151026.9950.9984 W32.Allim Win32/Opanki.R WORM_OPANKI.Q Backdoor.Win32.Aimbot.d Trojan.Win32.Aimbot.fujn Win32.Backdoor.Aimbot.Syse Worm.Win32.Opanki.R BackDoor.Oscar Worm.Opanki.Win32.38 WORM_OPANKI.Q BehavesLike.Win32.Sdbot.cc W32/Risk.ZUMS-8015 I-Worm/Opanki.b W32/Opanki.A1D5!worm Trojan[Backdoor]/Win32.Aimbot Backdoor.W32.Aimbot.d!c Win32/Funmov.worm.176640 Worm:Win32/Funmov.A Win32/Trykid.Y W32/Opanki.worm W32.Allim Bck/Sdbot.JED.worm Worm.Funmov!UUJQui2L6no Backdoor.Win32.Aimbot Worm/Opanki.N Backdoor.Win32.Aimbot.aLdg


During the past few weeks, we have received information about a new campaign of targeted ransomware attacks.


A backdoor also known as: W32.HfsAutoA.DAEE W32.Virut.G W32.Virut.CF Trojan.Win32.Crypt.dzf Virus.Win32.Virut.CE BehavesLike.Win32.BadFile.pt W32/Trojan.UBPC-4784 Trojan.Crypt.cm Trojan/Win32.Crypt TrojanDownloader:Win32/Dothemt.A Trojan.Win32.Crypt.dzf Trojan.Crypt W32/Sality.AO Win32/Virut.NBP Virus.Win32.Virut.ug W32/Virut.CE Virus.Win32.VirutChangeEntry.A


Japan Post - A private Japanese post , logistics and courier headquartered in Tokyo .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9962 Trojan.Win32.Graftor.dcgcrd TrojWare.Win32.Kryptik.~NT Trojan-Downloader.Win32.Banload Trojan:Win32/BrobanAda.A TScope.Trojan.Delf


They represent features and can be turned on and off from the command-and-control ( C & C ) server or by an SMS message , effectively instructing the malware to execute certain tasks .


Apart from including the country ’ s name , the app ’ s name is probably intended to imply a relationship with the antifraud solution named GAS Tecnologia .


A backdoor also known as: Trojan.Win32.BadApp!O TrojanDownloader.Small.AGT4 PWS-Mmorpg.e TSPY_RUNAE.SM Infostealer.Gampass Win32/AdClicker.DZX Win.Trojan.Toopu-1 Trojan.Win32.Dwn.bxzwi Backdoor.Win32.A.Rbot.65536 TrojWare.Win32.TrojanDownloader.Nirava.~clj Trojan.DownLoader1.38650 Adware.FloodAd.Win32.2 PWS-Mmorpg.e Trojan/Win32.Unknown Win32.Troj.Undef.kcloud TrojanClicker:Win32/Runae.A Trojan/Win32.OnlineGameHack.R1804 Adware.FloodAd Win32/Adware.FloodAd.AA Trojan.Win32.Clicker.sa W32/FLOODAD.SM!tr


These have been highly active in the Middle East region and unveiled ongoing targeted attacks in multiple regions.


One of Strider's targets had also previously been infected by Regin.


A backdoor also known as: Trojan.Dyname TROJ_WOONIKY.B TROJ_WOONIKY.B W32/Trojan.TZVR-6635 TR/Kazy.196035.1 Trojan.MSIL.Krypt.2 Trj/CI.A


A backdoor also known as: W32.KowinPC.Worm Win32.Trojan.WisdomEyes.16070401.9500.9820 W32.Kaxela.A Win32/Pipown.KJ Win.Worm.Autorun-2398 Worm.Win32.AutoRun.zt Trojan.Win32.ARSleep.gcbz W32.W.AutoRun.yo!c TrojWare.Win32.Magania.~L Trojan.Popwin.651 Worm.AutoRun.Win32.11126 BehavesLike.Win32.Dropper.lc Trojan/DiskAutorun.px BDS/Exaal.45056 Worm/Win32.AutoRun Win32.Troj.OnlineGames.w.kcloud Trojan.Win32.Autorun.21043 Worm.Win32.AutoRun.zt Trojan:Win32/Malamiko.A Worm.AutoRun Trojan/Win32.lssj.2cc.rgrk


A backdoor also known as: Worm/W32.SdBoter.28496 I-Worm.SdBoter.r2 Worm.SdBoter!97XSxLq3xLE W32/Sdbot.GFWC-1787 Win32/SdBoter.J WORM_SDBOTER.J Worm.W32.SdBoter.J Net-Worm.Win32.SdBoter.j Trojan.Win32.SdBoter.oxfz W32.W.SdBoter.j!c Win32.Worm-net.Sdboter.Star Worm.Win32.SdBoter.J BackDoor.IRC.Sdbot Worm.SdBoter.Win32.7 WORM_SDBOTER.J BehavesLike.Win32.Worm.mc W32/Sdbot.DMQ WORM/NetBot.A.2 W32/KWBOT.H Worm[Net]/Win32.SdBoter Win32/IRCBot.worm.28496 Worm:Win32/Sdboter.J W32/Sdbot.XT.worm Net-Worm.Win32.SdBoter.I IRC/BackDoor.SdBot.24.AC


During our investigation we found several backdoors that the HDRoot bootkit used for infecting operating systems.


One of the top targets is the Japan Pension Service, but the list of targeted industries includes government and government agencies, local governments, public interest groups, universities, banks, financial services, energy, communication, heavy industry, chemical, automotive, electrical, news media, information services sector, health care, real estate, food, semiconductor, robotics, construction, insurance, transportation and so on.


Another interesting feature in FakeSpy ’ s code is the collection of the device 's IMEI ( International Mobile Station Equipment Identity ) number and all installed applications using the function upAppinfos .