A backdoor also known as: Trojan.PWS.ZIY Trojan-PSW.Win32.Tepfer!O Trojan.Fareit.S467850 Trojan.Tepfer.Win32.85789 Trojan/Fareit.a Trojan.PWS.ZIY Win32.Trojan-PSW.Fareit.a Win32/PSW.Fareit.A BKDR_PONY.SM Win.Trojan.Fareit-403 Trojan.PWS.ZIY Trojan.Win32.Tepfer.dnnwuu Trojan.PWS.ZIY TrojWare.Win32.PWS.Fareit.GS Trojan.PWS.ZIY Trojan.PWS.Stealer.1932 BKDR_PONY.SM BehavesLike.Win32.ZBot.nh W32.Tepfer TR/PSW.Fareit.iloen Trojan[PSW]/Win32.Tepfer Trojan.Win32.PSW-Tepfer.92672 Trojan/Win32.Tepfer.R50650 Trojan.PWS.ZIY BScope.Malware-Cryptor.Ponik Spyware.Pony Trj/Tepfer.D Trojan.Fareit Win32.Outbreak Win32.Trojan-Stealer.Zbot.AB Win32/Trojan.PSW.5cd


A backdoor also known as: TSPY_DOWNLOADER_DD300501.UVPA Win32.Trojan.WisdomEyes.16070401.9500.9967 Infostealer.Donx TSPY_DOWNLOADER_DD300501.UVPA Trojan.Win32.VB.ckqm Trojan.VB.Win32.119679 BehavesLike.Win32.Sality.dm Worm.Win32.VB Trojan/VB.cvqf Trojan/Win32.VB Worm:Win32/Vberaspul.A Trojan.Heur.RX.E04E5F Trojan.Win32.VB.ckqm Trojan/Win32.VB.R85915 Trojan.VB Win32/AutoRun.VB.BDA Trojan.VB!nw7hcYRbBc8


A backdoor also known as: TROJ_CLICKER.API W32/Trojan.HUCV-9091 TROJ_CLICKER.API Win.Trojan.Clicker-2623 Trojan.Win32.Click.ddmsji W32/Trojan2.GMLR Adware/Clicker.hjb TrojanDownloader:Win32/Valfroc.A Win32.Trojan.Clicker.Tbip W32/CLICKER.API!tr Win32/Trojan.Multi.daf


Additionally , rootdaemon attempts to remove its own power usage statistics from Huawei phones ' SystemManager : Similarly , the malicious application probably attempts to minimize traces on Samsung phones by adding to the file /data/data/com.samsung.android.securitylogagent/shared_prefs/apm_sp_status_of_apps.xml the following lines : And adding to the file /data/data/com.samsung.android.securitylogagent/shared_prefs/com.samsung.android.securitylogagent_preferences.xml these lines instead : Data Collection and Exfiltration As mentioned , mike.jar equips the spyware with extensive collection capabilities , including : Retrieve a list of installed applications .


In light of this , we believe an attack against unpatched vulnerabilities is a reasonable conjecture for how the server was compromised .


Seeing this type of activity typically indicates that a particular ransomware will see much wider distribution and thus a larger amount of victims.


A backdoor also known as: Trojan-Downloader.Win32.LibPatcher!O W32/Trojan.KFBA-3961 Trojan.KillAV Win32/KillAV.EA RTKT_BUREY.C TrojWare.Win32.AntiAV.~B Trojan.MulDrop.30985 Downloader.LibPatcher.Win32.272 RTKT_BUREY.C BehavesLike.Win32.Backdoor.mc W32/Dldr.Age.41984.C Trojan[Downloader]/Win32.LibPatcher Trojan:Win32/Perkesh.A Trojan/Win32.KillAV.R5311 Win32.Trojan-downloader.Libpatcher.Dumk Trojan-Downloader.Win32.Perkesh W32/Perkesh.A!tr Win32/Virus.81b


A backdoor also known as: W32.CKTNum.Trojan Virus.Win32.VB!O Virus.VB.Win32.90 W32.W.Mabezat.kZb9 Trojan.Heur.E2A0A7 Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Worm.EJIG-5497 Trojan.Killfiles Win32/Disackt.B TROJ_VB.BHC Trojan.Win32.VB.mrc Virus.Win32.VB.bcfhqp Win32.Trojan.Vb.Eddp TrojWare.Win32.VB.AMN TROJ_VB.BHC BehavesLike.Win32.Downloader.mz W32/Worm.AWSI Virus.VB.bc W32/Overwriter.A Worm:Win32/Disackt.A Trojan.Win32.VB.mrc TScope.Trojan.VB Win32/VB.AMN Trojan.VB!eJU5EBjve4c Virus.Win32.VB W32/VB.AMN!tr Trj/CI.A


A backdoor also known as: Trojan/W32.Small.49152.AYF Trojan.Dofoil.A Trojan/Kryptik.vgb Win32.Trojan.WisdomEyes.16070401.9500.9963 W32/Trojan.QQGJ-6488 Trojan.Win32.ULPM.eszgb Trojan.Yakes.Win32.1447 BehavesLike.Win32.Conficker.pc Trojan-Dropper.Win32.Injector W32/Kryptik.VIA!tr Trojan.Kazy.DABAF TrojanDropper:Win32/Finkmilt.C Trojan/Win32.Yakes.C144665 BScope.Trojan.Jorik.1421 Trojan.Kryptik!Y5cjjPIzRWk Bck/Qbot.AO Win32/Trojan.aeb


At the end of December 2015, the network system of Ukrainian power companies was attacked by


A backdoor also known as: W32/Socks.agz Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/Trojan2.BFTZ HT_PHDET_FD042CB0.UVPM Trojan.Win32.Socks.utqwi Trojan.MulDrop7.51577 HT_PHDET_FD042CB0.UVPM BehavesLike.Win32.Dropper.jc W32/Trojan.NOBV-3130 TrojanDownloader.Small.sui Worm/Win32.Socks Trojan:Win32/Phdet.E Worm.Win32.A.Socks.93017 SScope.Worm.Socks.afv Worm.Socks!GMlFK48cpa8 W32/Kryptik.BD!tr Win32/Trojan.e0b


Recently, WeipTech was analyzing suspicious Apple iOS tweaks reported by users and found over 225,000 valid Apple accounts with passwords stored on a server.


A backdoor also known as: W32.HfsAutoB.D676 Win32.Trojan.WisdomEyes.16070401.9500.9591 TR/Drop.Delfsnif.pmkbu TrojanDropper:Win32/Delfsnif.A


A backdoor also known as: Trojan-Dropper.Win32.AphexLace!O TrojanDropper.AphexLace Dropper.AphexLace.Win32.1 Troj.W32.Inject!c Trojan/Dropper.AphexLace.b Trojan.Heur.EA2D6B TROJ_APHEXLACE.D Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Dropper.IHO Trojan.Dropper TROJ_APHEXLACE.D Trojan.Win32.Inject.vgog Trojan.Win32.AphexLace.glqv Dropper.AphexLace.17920 TrojWare.Win32.TrojanDropper.AphexLace.B Trojan.MulDrop.12656 Trojan-Dropper.Win32.Delf W32/Risk.JBWO-6048 TrojanDropper.AphexLace.b TR/Drop.AphexLace.B Trojan[Dropper]/Win32.Poisoner TrojanDropper:Win32/AphexLace.B Trojan.Win32.Inject.vgog Dropper/Win32.Xema.C57521 TrojanDropper.Poisoner Win32/TrojanDropper.AphexLace.B Win32.Trojan.Inject.Dypn Trojan.DR.AphexLace!M08TVuH6+oM


Indicators related to the Sundown Exploit Kit


CopyCat is a fully developed malware with vast capabilities, including elevating privileges to root, establishing persistency, and to top it all - injecting code into Zygote.


A backdoor also known as: HW32.Packed.D9E5 TrojanSpy.Zbot Spyware.LokiBot Win.Packer.VbPack-0-6334882-0 Trojan-Spy.Win32.Zbot.yjsw Trojan.Win32.Zbot.etexpw Trojan.Win32.Z.Zbot.1081344 Trojan.PWS.Panda.12377 Trojan.Zbot.Win32.204854 BehavesLike.Win32.Fareit.tc Trojan.Win32.Injector TrojanSpy.Zbot.fkpq TR/AD.Zbot.cxjcv Trojan[Spy]/Win32.Zbot Trojan.Symmi.D1360F Trojan-Spy.Win32.Zbot.yjsw Trojan:Win32/Dukrid.A!bit Spyware/Win32.Zbot.R210148 TScope.Trojan.VB Trj/GdSda.A Win32.Trojan-spy.Zbot.Lqer TrojanSpy.Zbot!AasFtIJIGGs W32/Zbot.YJSW!tr Win32/Trojan.BO.553


The WordPress.org team has intervened and removed the plugin from the official WordPress Plugins repository.


It is likely these spearphishes are generated via a builder - so attribution to an exact group of attackers may be incorrect.


SimBad : A Rogue Adware Campaign On Google Play March 13 , 2019 Check Point researchers from the Mobile Threat Team have discovered a new adware campaign on the Google Play Store .


This campaign was found to be connected to the same party which previously targeted Vietnam Airlines and some other high profile targets possibly led by the Chinese 1937CN group.


A backdoor also known as: I-Worm.Stator.A Worm/W32.Stator.62976 Email-Worm.Win32.Stator!O W32.Stator.A Worm.Stator.Win32.3 W32/Stator.worm I-Worm.Stator.A W32/Stator.A W32.Stator@mm Win32/Stator.62464.A WORM_STATOR.A Win.Worm.Stator-1 I-Worm.Stator.A Email-Worm.Win32.Stator.a I-Worm.Stator.A Trojan.Win32.Stator.jahi I-Worm.Win32.Stator I-Worm.Stator.A EmailWorm.Win32.Stator.a0 I-Worm.Stator.A Win32.HLLW.Plict WORM_STATOR.A BehavesLike.Win32.Downloader.kc Email-Worm.Win32.Stator.a W32/Stator.A I-Worm/Stator.a Worm[Email]/Win32.Stator Worm:Win32/Stator.A@mm Email-Worm.Win32.Stator.a Trojan/Win32.HDC.C40377 I-Worm.Stator.A Win32.HLLW.Stator.A I-Worm.Stator.62464 Win32/Stator.62464 Win32.Stator.B W32/Stator.A


encrypt its APK and shell code,


It looked like a typical backdoor that could be uploaded anywhere on a compromised server, not just in this particular plugin.


Emissary is related to the Elise Trojan and the Operation Lotus Blossom attack campaign, which prompted us to start collecting additional samples of Emissary.


This trojan 's design and implementation is of an uncommonly high level , making it a dangerous threat .


To quote the original article: It could be through attachments in spam messages, downloads from untrusted websites or something else.


The spyware in this analysis was portraying itself as the Netflix app .


Command Action Unistxcr Restart the app dowsizetr Send the file stored in the /sdcard/DCIM/.dat/ directory to the C & C server Caspylistx Get a list of all hidden files in the /DCIM/.dat/ directory spxcheck Check whether call details are collected by the spyware S8p8y0 Delete call details stored by the spyware screXmex Take screenshots of the device screen Batrxiops Check battery status L4oclOCMAWS Fetch the victim 's location GUIFXB Launch the fake Facebook login page IODBSSUEEZ Send a file containing stolen Facebook credentials to the C & C server FdelSRRT Delete files containing stolen Facebook credentials chkstzeaw Launch Facebook LUNAPXER Launch apps according to the package name sent by the C & C server Gapxplister Get a list of all installed applications DOTRall8xxe Zip all the stolen files and store in the /DCIM/.dat/ directory Acouxacour Get a list of accounts on the victim 's device Fimxmiisx Open the camera Scxreexcv4 Capture an image micmokmi8x Capture audio Yufsssp Get latitude and longitude GExCaalsss7 Get call logs PHOCAs7 Call phone numbers sent by the C & C server Gxextsxms Get a list of inbox SMS messages Msppossag Send SMS with message body sent by the C & C server Getconstactx Get a list of all contacts Rinxgosa Play a ringtone bithsssp64 Execute commands sent by the C & C server DOWdeletx Deletes the file specified by the C & C server Deldatall8 Delete all files stored in the /sdcard/DCIM/.dat/ directory We do n't have the space to cover all of the commands , but let 's take a look at some of the major ones .


If any of these conditions is true , the application does not continue to execute the malicious flow .


It has been the subject of many analysis reports, including those describing targeted espionage campaigns like Operation Night Dragon and the GhostNet attacks on Tibet.


A backdoor also known as: Trojan.Miner Troj.W32.Miner!c Trojan.MulDrop7.60223 TR/Muldrop.jzijj Trojan.Win32.Miner.tjvn


The threat actor's campaigns attempt to convince high-profile North American and European government officials as well as CEOs of prominent companies and celebrities into participating in recorded phone calls or video chats.


The earliest evidence obtained shows it has been in use since at least November 2016.


The hash listed in the Pastebin led us to a malicious Word document that had also been uploaded to a public sandbox.


] 91 2020-03-04 http : //ora.carlaarrabitoarchitetto [ .


] com ’ as an ad-related SDK .


A backdoor also known as: Ransom/W32.Locky.48128 Exploit.Cve20151701 Win32.Trojan.WisdomEyes.16070401.9500.9999 Exploit.Win32.CVE-2015-1701.bd Exploit.Win32.CVE20151701.euekja Trojan.Win32.LockCrypt.48128.A Trojan.Encoder.12135 BehavesLike.Win32.Mydoom.pm W32/Trojan.JPLA-3344 Exploit.CVE-2015-1701.ar TR/AD.RansomHeur.fbqvj Exploit.W32.Cve!c Exploit.Win32.CVE-2015-1701.bd Ransom:Win32/LockCrypt.A!bit Trojan/Win32.Scar.R211760 Exploit.CVE-2015-1701 Ransom.DXXD Trj/GdSda.A Trojan.Win32.Filecoder Win32.Trojan-Ransom.LockCrypt.A Win32/Trojan.Exploit.3d9


This is exactly what we saw in late October and early November 2016, when the espionage group Pawn Storm also known as Fancy Bear, APT28, Sofacy, and STRONTIUM ramped up its spear-phishing campaigns against various governments and embassies around the world.


A backdoor also known as: Virus.Win32!O W32.Etap W32/Etap.dr Win32.Trojan.WisdomEyes.16070401.9500.9929 W32.Simile Virus.Win32.Etap Win32.Etap.E Win32/Linux.Etap W32/Etap.dr Virus.Win32.Etap Backdoor/Hupigon.ish Virus/Win32.Etap Trojan.Kazy.D65E9 Virus.Win32.Etap Backdoor:Win32/Etap.dr Win32/Etap.E W32/Etap.D


Furthermore, each of the stages used different development platform and was obfuscated in a different way.


Rather than simply copying the features that were present within the Zeus trojan as-is Floki Bot claims to feature several new capabilities making it an attractive tool for criminals.


A backdoor also known as: Worm/W32.Silva.447488 Worm.Keco W32.W.Silva.d!c W32/Silva.d W32/Silva.D W32.Silva@mm Trojan.Win32.Silva.envq Worm.Win32.Silva.D Win32.HLLW.Silva Worm.Win32.Silva W32/Silva.QGXV-8360 I-Worm/Silva.d Worm:Win32/Silva.D@mm Worm:Win32/Silva.D@mm Email-Worm.Keco W32/Keco.G.worm Win32/Silva.D Win32.Worm-email.Keco.Peze I-Worm.Silva!97fYr5ijFvQ W32/Silva.D@mm


Below are a couple of images of the panel that the attacker would be utilizing.


A backdoor also known as: Trojan.BHO.Delf.T Trojan.Win32.Delf!O Trojan.Lnkhyd.A7 Trojan.Delf.Win32.15794 Troj.W32.Delf.lV2h Win32/Delf.AXIT TROJ_DELF.PVC Win.Trojan.Delf-11211 Trojan.BHO.Delf.T Trojan.Win32.Delf.ssh Trojan.BHO.Delf.T Trojan.Win32.Delf.cjzwb Trojan.Win32.Delf.157696.J Trojan.BHO.Delf.T TROJ_DELF.PVC Trojan.Lnkhyd Trojan/Delf.mdz Trojan:Win32/Lnkhyd.A Trojan/Win32.Delf Trojan.BHO.Delf.T Trojan.Win32.Delf.ssh Trojan:Win32/Lnkhyd.A Trojan/Win32.Fides.R3508 Trojan.BHO.Delf.T TScope.Trojan.Delf Win32.Trojan.Delf.Ednr Trojan.Win32.BHO.R


Interaction with these servers is performed in two different threads.


They use compromised e-mail accounts to distribute their malware widely and their targeting appears opportunistic rather than specific.


A backdoor also known as: PUP.Riskware.Tool Trojan.Win32.Cindyc.wrlqe TR/DyCode.A.110 Backdoor/Cindyc.bv Win32.Troj.Undef.kcloud Trojan:Win32/DyCode.A Backdoor.Win32.A.Cindyc.141184 Backdoor/Win32.Cindyc Backdoor.Cindyc.adk Backdoor.Win32.Cindyc Trj/CI.A


] com csip6 [ .


Credit card industry giant Visa on Friday issued a security alert warning companies using point-of-sale devices made by Oracle s MICROS retail unit to double-check the machines for malicious software or unusual network activity, and to change passwords on the devices.


The dropper family, referred to internally as PNG_dropper, was observed being used as a second stage tool in different targeted attacks.


A backdoor also known as: Trojan.StartPageCRTD.Win32.8798 Win32.Trojan.WisdomEyes.16070401.9500.9990 Trojan.Win32.Clicker!BT Trojan.MSIL.EzirizNetReactor TR/Dropper.MSIL.76348 TrojanClicker:MSIL/Balamid.B Trojan.Jatif.32 Trojan/Win32.FakeMS.R113384 Trojan.Win32.Clicker!BT Win32/Trojan.Dropper.2f1


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9589 TROJ_DELF.IVW Trojan-Downloader.Win32.Delf.acc Troj.Downloader.W32.Delf!c Win32.Trojan-downloader.Delf.Edoh TrojWare.Win32.TrojanDownloader.Delf.~ABI Trojan.DownLoader.46506 Trojan-Downloader.Win32.Delf.ACC TrojanDownloader.Delf.fqq Trojan[Downloader]/Win32.Delf Win32.TrojDownloader.Delf.ac.kcloud Trojan.Downloader.bGWcaOz2KakG Trojan.Win32.A.Downloader.34816.FA Trojan-Downloader.Win32.Delf.acc Trj/Banbra.FSU Win32/Trojan.Downloader.dac


It does this by leveraging the Android plugin technology.


HenBox : The Chickens Come Home to Roost March 13 , 2018 at 5:00 AM Unit 42 recently discovered a new Android malware family we named “ HenBox ” masquerading as a variety of legitimate Android apps .


Trojan Ransom Xpan was created by an organized gang, which used targeted attacks via RDP that abused weak passwords and wrong implementations.


The operators have used use a range of techniques to target Windows computers and Android phones with the apparent goal of penetrating the computers of well-connected individuals in the Syrian opposition.


On the network traffic analysis end, post compromise activity results in some interesting but not unexpected activity.


Based on this evidence we believe this new malware is likely targeting South Koreans.


A series of malware attacks targeting users of cryptocurrency wallets has been identified by security firm Kaspersky, which has developed an anti-malware solution to detect and prevent such attacks in the future.


A backdoor also known as: Virus/W32.Patched.P W32.Patched.QC1 Trojan.Razy.D19982 PE_PATCHED.SMB Win32.Trojan.ImPatch.a W32/Floxif.A PE_PATCHED.SMB Trojan.Win32.Patched.qc Troj.W32.Patched.lnCt Trojan.Starter.3187 W32/Floxif.A Trojan.Win32.Patched.qc Trojan.Patched.al W32/Patched.AL Virus.Win32.Loader.abd Trojan.Win32.Patched W32/Patched.AL!tr Virus.Win32.Patched.DG


A backdoor also known as: W32.OnGamesGBTOFAB.Trojan Trojan-Dropper.Win32.Dapato!O Trojan/Vilsel.bftr Trojan-Dropper.Win32.Dapato.bzqh Trojan.Win32.Vilsel.dktcmg Trojan.Vilsel.Win32.24133 Trojan-PWS.Win32.QQPass TrojanDropper.Dapato.jop Trojan/Win32.Vilsel Win32.Troj.Vilsel.kcloud Trojan-Dropper.Win32.Dapato.bzqh Trojan.Vilsel


The first timer will be fired on the configured interval ( 20 seconds in this case ) , pinging the command and control ( C2 ) server .


For now , that is the only way how cybercriminals can profit from Triada , but don ’ t forget that it ’ s a modular Trojan , so it can be turned into literally everything on one command from the C & C server .


Most users are pushing a variety of information stealers with the service.


Rooting and Ad Network Presentation The reflection loaded methods check if the device is rooted .


This command is used to connect the victim to a Wi-Fi network controlled by the cybercriminals to perform traffic sniffing and man-in-the-middle ( MitM ) attacks .


First, users cannot easily spot any malicious behavior since PowerShell runs in the background.


root9B's analysis determined that the adversary is using advanced memory-resident techniques to maintain persistence and avoid detection.


The malware has a remote controlling function, and attackers sending these emails seem to attempt intruding into the targets' network using the malware.


A backdoor also known as: Virus.Win32.Sality!O Ransom.Exxroute.A3 Trojan.Kryptik.Win32.1099877 Troj.Downloader.W32.Banload.l42y Ransom_CERBER.SM3B Win32.Trojan.Kryptik.bjm W32/Trojan.FUEH-0857 Backdoor.Trojan Ransom_CERBER.SM3B Trojan.Encoder.10103 BehavesLike.Win32.Cutwail.ph Trojan.Spora.mw TR/AD.Spora.svton Trojan[Ransom]/Win32.Spora Trojan.Symmi.DB88E Ransom:Win32/Spora.A Hoax.Spora Virus.Win32.VBInject


A backdoor also known as: BKDR_PIRPI.YE Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan BKDR_PIRPI.YE Trojan.Heur.LP.E69C7F Trojan:Win32/Pirpi.O Win32.Backdoor.Backdoor.Hwmn Win32/Trojan.9b5


The SMS message with a link to a banker looked as follows : “ % USERNAME % , i send you prepayment gumtree [ .


Called “ DEFENSOR ID ” , the banking trojan was available on Google Play at the time of the analysis .


A backdoor also known as: TSPY_MAJIKPOS.SMA Trojan.Majikpos TSPY_MAJIKPOS.SMA Trojan.DownLoader23.50404 W32/Trojan.QKOU-4044 Trojan.MSIL.Krypt.2 TrojanSpy:MSIL/Majikpos.A Spyware/Win32.Majikpos.C1861368 Trj/GdSda.A PUA.BrowseSmart Win32/Trojan.d60


The DragonOK group has been actively launching attacks for years.


non-Google Play ) app stores which often have fewer security and vetting procedures for the apps they host .


A backdoor also known as: W32.OnGameMITL.Trojan RDN/Downloader.a!vq Win32.Trojan.WisdomEyes.16070401.9500.9883 Trojan.FakeAV Trojan.DownLoad.41552 BehavesLike.Win32.Backdoor.ch Trojan.Win32.Redosdru Trojan/PSW.WOW.amc TrojanDownloader:Win32/Induiba.A Trojan.Heur.RP.EEBC2E Trj/CI.A


By analyzing the TaskManager class we can see the new commands that are supported at this stage : As can be seen in the code snippet above , there are quite a lot of data collection tasks that are now available : Collect device info Track location Upload contacts information Upload sent and received SMS messages Upload images Upload video files Send recursive dirlist of the external storage Upload specific files Record audio using the microphone Record calls Use the camera to capture bursts of snapshots Those tasks can either run periodically , on event ( such as incoming call ) or when getting a command from the C & C server .


A backdoor also known as: Trojan.Win32.Kargatroj!O Trojan.Kargatroj.Win32.5 BKDR_DEPPEELS.A Win32.Trojan.WisdomEyes.16070401.9500.9993 W32/Trojan.FYPB-4329 Backdoor.Kargatroj BKDR_DEPPEELS.A Win.Trojan.Kargatroj-5 Trojan.Win32.Kargatroj.a Trojan.Win32.Kargatroj.zribt Trojan.Win32.A.Kargatroj.288256 Trojan.Click2.18984 BehavesLike.Win32.Virus.dh Backdoor.Win32.IRCBot Trojan/Kargatroj.e WORM/Autorun.Agr.3 Trojan/Win32.Kargatroj Backdoor:Win32/Deppeels.A Trojan.Win32.Kargatroj.a Trojan/Win32.Kargatroj.R50492 Trojan.Kargatroj Trojan.Kargatroj!+VQ4l8zO8kI


We refer to this utility as BOOTRASH.


A backdoor also known as: W32.W.Fujack.lmEa Trojan.Dropper Win.Trojan.Packed-24 Trojan.Win32.Baidu.iidnc Trojan.Win32.A.PSW-Magania.1913020.A Trojan/Win32.Zegost Trojan.Zusy.D88F TrojanDropper:Win32/Demekaf.A Trojan.MalPack.NSPack Win32/TrojanDropper.Demekaf.A Trojan.Win32.Jorik W32/Obfuscated.AAAD!tr Win32/Trojan.4b9


In most so-called Western versions of the Trojan , the package names in the default configuration file are erased .


A backdoor also known as: Trojan-Dropper/W32.Hirhir.2779437 TrojanDropper.Hirhir.20 Trojan/Dropper.Hirhir.20 Trojan-Dropper.Win32.Hirhir.20 Win32/TrojanDropper.Hirhir.20 W32/Hirhir.A Trojan.Dropper W32/Smalldrp.BTL Win32.Dropper.Hirhir Trojan.Dropper-1156 Trojan-Dropper.Win32.Hirhir.20 Trojan.Dropper.Hirhir.2.0 TrojWare.Win32.TrojanDropper.Hirhir.20 Trojan.Dropper.Hirhir.2.0 Trojan.MulDrop.1734 TR/Drop.Hirhir.20.5 TROJ_HIRHIR.20 Trojan.Drop.Hirhir.20.5 Win32/DigitalM.10 W32/Hirhir.A TrojanDropper.Dmexeb.10 Trojan-Dropper.Win32.Hirhir.20!IK TrojanDropper:Win32/Hirhir.2_0 Trojan.Win32.Hirhir.2164429 Trojan.Dropper.Hirhir.2.0 Dropper/Hirhir.11776 Win32.TrojanDropper.Hirhir.20 Trojan.DR.Hirhir.H Trojan.Dmexeb.10 Trojan-Dropper.Win32.Hirhir.20 W32/Hirhir.A!tr.dr Dropper.Hirhir Trj/Hirhir.A


Configuration file received from the C & C server As for stealth and resilience , the attacker uses a number of tricks .


A backdoor also known as: W32.FamVT.ExpiroPC.PE TROJ_ZYX_BK083A77.TOMC Heur.Corrupt.PE TROJ_ZYX_BK083A77.TOMC Trojan-Downloader.Win32.Vorloma TrojanDownloader:Win32/Vorloma.A


A backdoor also known as: PE:Trojan.Win32.Xcomp.a!1075128424 Heur.Packed.MultiPacked DDoS.Rincux Backdoor.Httpbot.Win32.799 BehavesLike.Win32.Trojan.cz Backdoor:Win32/Luder.H Trojan/Win32.Injector Virus.Win32.Heur.c Trj/CI.A Packed.Win32.PolyCrypt Trojan.Win32.Downloader.aC


The specific points of connection between these new samples and Operation Blockbuster include: payloads delivered by the macros discussed in Operation Blockbuster Sequel


A backdoor also known as: Trojan.ADH.2 Win.Trojan.Mediyes-1761 Trojan.Hosts.5806 Trojan.VBCRTD.Win32.7945 Trojan:Win32/Mediyes.C Trojan.Pirminay Trojan.Win32.Mediyes


A backdoor also known as: Backdoor.Aimaster.A Backdoor/W32.Aimaster.49152 Backdoor.Aimmaster Backdoor.RAT.Aimaster Backdoor.Trojan Win32/Aimaster.A BKDR_AIMASTER.A Win.Trojan.Aimaster-4 Backdoor.Win32.Aimaster Backdoor.Aimaster.A Trojan.Win32.Aimaster-Bd.fdhc Win32.Backdoor.Aimaster.Ahyt Backdoor.Aimaster.A Backdoor.Win32.Aimaster.A Backdoor.Aimaster.A BackDoor.Master.10 BackDoor-XT.svr W32/Risk.FHHV-3782 BDS/Aimaster.B W32/Aimaste.A!tr.bdr Trojan[Backdoor]/Win32.Aimaster Backdoor.Aimaster.A Backdoor.W32.Aimaster!c Backdoor.Win32.Aimaster Trojan/Win32.Aimaster.C662411 BackDoor-XT.svr Backdoor.Aimaster Backdoor.Aimaster!2o1TvHIl4Fg Backdoor.Aimaster.A Win32/Backdoor.IM.d95


The data available in the leaked Hacking Team files provides circumstantial evidence pointing to an interest in compromising individuals with ties to South Korea i.e., Korean language speakers who use software or apps popular in South Korea, or South Korean editions of Samsung phones.


A backdoor also known as: Backdoor/W32.Amitis.827392 Backdoor.Amitis!GgBFlh0m/G4 W32/Amitis.MXVV-8538 Backdoor.Amitis Win32/Amitis.13 BKDR_AMITIS.B Trojan.Amitis.13-B Backdoor.Win32.Amitis.13 Trojan.Win32.Amitis.dbhy Backdoor.Win32.S.Amitis.827392.A[h] Backdoor.W32.Amitis.13!c Backdoor.Win32.Amitis.13 BackDoor.Amitist.13 Backdoor.Amitis.Win32.17 BKDR_AMITIS.B BehavesLike.Win32.Downloader.ch W32/Amitis.N@bd Backdoor/Amitis.p W32/Amitis.C!tr Trojan[Backdoor]/Win32.Amitis Win-Trojan/Amitis.827392 Backdoor:Win32/Amitis.1_3 Win32/Amitis.13 Backdoor.Amitis Win32.Backdoor.Amitis.Akfc Backdoor.Win32.Amitis BackDoor.Amitis.G Backdoor.Win32.Amitis.13


A backdoor also known as: HackTool.Patcher Backdoor.RBot.Win32.54805 Troj.GameThief.W32.Magania.lHhM Multi.Threats.InArchive W32.Pilleuz Win.Worm.Mytob-399 Trojan.Win32.Rbot.bhwabq Heur.Packed.Unknown Win32.HLLW.MyBot.based Trojan[Backdoor]/Win32.Rbot Trojan/Win32.Malco.R7515 Trj/CI.A Win32.Viking.BJ Backdoor.Win32.Rbot


A backdoor also known as: Trojan.Win32.Mlw.ewdlbx TR/Dropper.lusig Trojan.Win32.Eightow Trj/CI.A


Though Orcus has all the typical features of RAT malware, it allows users to build custom plugins and also has a modular architecture for better management and scalability.


A backdoor also known as: Win32.Worm.SdDrop.C Worm.Sddrop W32/Sddrop.worm.c!p2p Win32.Worm.SdDrop.C Win32.Trojan.WisdomEyes.16070401.9500.9999 W32.Kwbot.Worm Unix.Tool.IRC-1 Win32.Worm.SdDrop.C P2P-Worm.Win32.SdDrop.c Win32.Worm.SdDrop.C Trojan.Win32.SdDrop.entp W32.W.SdDrop.c!c Win32.Worm.SdDrop.C Win32.Worm.SdDrop.C Win32.SdDrop.3 Worm.SdDrop.Win32.21 W32/Sddrop.worm.c!p2p Backdoor.Win32.SdBot I-Worm/P2P.SdDrop.c BDS/Sdbot.AA Worm[P2P]/Win32.SdDrop Worm:Win32/Sddrop.C P2P-Worm.Win32.SdDrop.c Trojan/Win32.HDC.C38855 Win32.Worm.SdDrop.C Backdoor.Sdbot Trj/CI.A Worm.SdDrop Win32/Sddrop.C Win32.Worm-p2p.Sddrop.Lknd Worm.P2P.SdDrop!LrfriCz8zKY W32/KWBot.E!worm


Recently, the FortiGuard Labs research team observed that a new variant of Poison Ivy was being spread through a compromised PowerPoint file.


Many victims have discussed YiSpecter infections of their jailbroken and non-jailbroken iPhones in online forums and have reported the activity to Apple.


send funds via a wire transfer ) .


The campaign operated out of handful of IPs, but we ended up finding in excess of 80K malicious subdomains associated with more than 500 domains leveraging various registrant accounts.


A backdoor also known as: Udsdangerousobject.Multi TROJ_DLOADR.YLP TROJ_DLOADR.YLP Trojan.Win32.Dwn.dcbaru Trojan.Win32.Z.Tapaoux.49152 Trojan.DownLoader11.19325 W32/Trojan.FALA-2329 TR/Rogue.icdl Trojan.DownLoader! Trojan.Rogue


A backdoor also known as: Trojan.MSIL.Bladabindi.1 Win32.Trojan.WisdomEyes.16070401.9500.9922 Trojan.Win32.Bladabindi.etjjte Trojan.Win32.Z.Clicker.90624 Trojan.Win32.Clicker!BT BehavesLike.Win32.PWSZbot.mm Trojan.Win32.Clicker!BT Trj/Chgt.O Win32.Outbreak


The most popular member of the Android/AdDisplay.Ashas family on Google Play was “ Video downloader master ” with over five million downloads Ashas functionality All the apps provide the functionality they promise , besides working as adware .


The file size of the malware is mostly around ~50Kb, as you can see from the list of sample hashes at the end of this report.


For this purpose , the app receives from the C & C server the isGoogleIp flag , which indicates whether the IP address of the affected device falls within the range of known IP addresses for Google servers .


A backdoor also known as: W32.YahooPass.Spyware Backdoor.Win32.Bredavi!O Backdoor.Bredavi.Win32.215 Backdoor.W32.Bredavi.kYWA Backdoor/Bredavi.le Win32.Trojan-PSW.Yahoo.a Backdoor.Trojan Win32/Bredolab.PS Win.Trojan.Bredolab-1635 Trojan.Win32.Krap.ihir Backdoor.Win32.Bredavi.348960 Application.Win32.Adware.Superjuan.~JAJ Trojan.BhoSpy.97 Trojan.Win32.Glecia Backdoor/Bredavi.bf BDS/Glecia.A Trojan[Backdoor]/Win32.Bredavi Adware.Heur.E51E88 Trojan/Win32.Bredavi.C83160 Backdoor.Bredavi Trj/Sinowal.WNX Win32/PSW.YahooPass.NAD


A backdoor also known as: Email-Worm.Win32.Scano!O W32/Scano.bm WORM_SCANO.BT Win32.Worm.Scano.a W32.Areses.P@mm WORM_SCANO.BT Win.Worm.Scano-70 Email-Worm.Win32.Scano.bm Trojan.Win32.LdPinch.fmye I-Worm.Win32.A.Scano.105231 W32.W.Otwycal.l7h6 Win32.HLLM.Perf Worm.Scano.Win32.69 BehavesLike.Win32.Autorun.cm Email-Worm.Win32.Scano Worm/Scano.at W32.Worm.Areses Worm[Email]/Win32.Scano Email-Worm.Win32.Scano.bm Worm/Win32.Scano.R1851 BScope.Trojan-Dropper.Injector Win32/Scano.BM I-Worm.Scano!zrLOU/XMrws W32/Scano.AA@mm


A backdoor also known as: Trojan.Fsysna Win32.Trojan.WisdomEyes.16070401.9500.9969 Trojan.Win32.Fsysna.eqvl Trojan.Win32.Z.Strictor.607232.C Trojan.MulDrop7.49159 Trojan.Fsysna.Win32.15357 Trojan.MSIL.Spy TrojanSpy:MSIL/Logadat.A Trojan.Win32.Fsysna.eqvl Trojan.Fsysna Trj/GdSda.A Win32.Trojan.Fsysna.Lqym


The report includes extra detail to help potential targets recognize similar attacks.


ThreatStream Labs recently became aware of a campaign beginning on 30 June 2015 by the omniprescent Wekby threat actors a/k/a TG-0416, APT-18, Dynamite Panda.


Adding this extra layer of filtering may help the group focus on targets of interest and evade detection due to use of known malware.


A backdoor also known as: W97M.Downloader TROJ_CVE201711882.E Exploit.Xml.CVE-2017-0199.equmby Xml.Exploit.Cve!c TROJ_CVE201711882.E Malicious_Behavior.SB DOC.S.Exploit.11442 XML/Dloader.S1 Exploit.CVE-2017-0199 XML.Exploit.CVE-2017-0199.E


Our malware analysts Nikita Buchka and Mikhail Kuzin can easily name 11 families of such Trojans .


It was a standalone utility with the name HDD Rootkit for planting a bootkit on a computer.


A backdoor also known as: Win32/Goft.B Trojan.Win32.cvrsqp.eaqdwq Trojan.MyRunner BehavesLike.Win32.PWSZbot.nc Virus.Win32.AA Trojan/PSW.QQPass.fx Trojan/Win32.QQTail.R5474


It provides the same functionality you would expect from a remote access tool: keylogging, webcam access, microphone access, remote desktop, URL download, program execution, etc.


Attacks that use completely fileless malware are a rare occurrence, so we thought it important to discuss a new trojan known as JS_POWMET Detected by Trend Micro as JS_POWMET.DE, which arrives via an autostart registry procedure.


As you can see in the sample list below, this means that many school employees will have received this spam, as K-12 schools very commonly use .us domain names.


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G PE_VIRUX.R W32/Virut.AM Win32/Virut.17408 Trojan.Scar PE_VIRUX.R Win.Trojan.Virtob-1456 Win32.Virus.Virut.U Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg Virus.Win32.Virut.CE Win32.Virut.56 Virus.Virut.Win32.1938 BehavesLike.Win32.Virut.qh W32/Virut.AM Virus/Win32.Virut.ce Win32.Virut.dd.368640 W32.Virut.lqR9 Virus.Win32.Virut.ce Trojan:Win32/QHosts.BR Win32/Virut.F Virus.Virut.14 W32/Sality.AO Win32/Virut.NBP Trojan.Win32.Downloader.toh Trojan.Win32.Scar Virus.Win32.VirutChangeEntry.A


This organization was formerly known as the East Turkestan Islamic Party and is purported to be an Islamic extremist separatist organization founded by Uyghur jihadists .


All of these attacks leveraged CVE-2014-4114 and were delivered via malicious Microsoft PowerPoint Slideshow files *.pps.


Brambul and Joanap appear to be used to download extra payloads and carry out reconnaissance on infected computers.


] com was a C2 for Poison Ivy samples associated with attacks on Myanmar and other Asian countries discussed in a blog published by Arbor Networks in April 2016 .


A backdoor also known as: Packed.Win32.Tibs!O Worm.Zhelatin Trojan.Heur.RP.fqWcaaXp5um Win32.Trojan.WisdomEyes.16070401.9500.9882 W32/Trojan.LQOD-4441 Trojan.Dropper Email-Worm.Win32.Zhelatin.rn Trojan.Win32.Z.Zhelatin.88576 MalCrypt.Indus! Trojan.Spambot.2559 Email.Worm.W32!c Email-Worm.Win32.Zhelatin.rn Worm/Win32.Zhelatin.R38109 BScope.Trojan.Zhelatin.12 Trj/CI.A Win32/Nuwar.BH Win32.Worm-email.Zhelatin.Sxxs Worm.Win32.Nuwar Win32/Worm.Email-Worm.43d


A backdoor also known as: Backdoor.Rustock.NDU Backdoor.Win32.Rbot!O Backdoor.Rustock.NDU Backdoor.Rbot Win32.Trojan.WisdomEyes.16070401.9500.9989 W32/Trojan.TDBQ-4167 Backdoor.Rustock.B Win.Trojan.Crypt-278 Backdoor.Rustock.NDU Backdoor.Win32.Rbot.szn Backdoor.Rustock.NDU Backdoor.Win32.A.Rbot.70656.J Backdoor.Rustock.NDU Backdoor.Rustock.NDU Trojan.Fakealert.33205 BehavesLike.Win32.Downloader.kt Rootkit.KernelBot.m TR/Tiny.705 Backdoor.Rustock.NDU Backdoor.Win32.Rbot.szn Trojan:Win32/Silentbanker.B Worm/Win32.IRCBot.C36854 Backdoor.Rbot Trj/CI.A Win32.Backdoor.Rbot.Aiik Virus.Win32.Virut.n W32/RBot.SZN!tr.bdr Win32/Backdoor.0a5


During a recent United States Secret Service investigation, Trustwave encountered a new family of POS malware, that we named Punkey.


A backdoor also known as: Trojan/W32.FakeAV.29696.H Backdoor.Ziyazo Trojan.Graftor.D21706 TROJ_FAKEAV.ORH Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan.B TROJ_FAKEAV.ORH Win.Trojan.Ziyazo-1 Trojan.Win32.FakeAv.cuscpt Troj.W32.FakeAv.rxda!c Trojan.Fakealert.45728 Trojan.FakeAV.Win32.293288 BehavesLike.Win32.Backdoor.mc W32/Trojan.TSSV-1630 Trojan/Fakeav.blva Trojan/Win32.FakeAv Backdoor:Win32/Ziyazo.A Trojan/Win32.FakeAV.R94861 Trj/Dynamer.A Trojan.FakeAv!73pMuD6/3rE Trojan.Win32.FakeAV W32/FakeAv.RXDA!tr


Subsequent to the publishing of this article, through cooperation with the parties responsible for the C2 domains, Unit 42 researchers successfully gained control of multiple C2 domains.


A backdoor also known as: Hacktool.Superscan Trojan.Win32.XFMP5368.dfvidz HackTool:Win32/SuperScan.A


Lurk was believed to have siphoned over $45 million from financial organizations, ultimately disrupting the victims' operations, reputation, and bottom line.


While Empire RIG-E disappeared at the end of December after 4 months of activity on 2017-02-17 an advert for a new exploit kit dubbed Nebula appeared underground.


A powerful threat actor known as Wild Neutron also known as Jripbot and Morpho has been active since at least 2011, infecting high profile companies for several years by using a combination of exploits, watering holes and multi-platform malware.


A backdoor also known as: Application.Hacktool.Pipecmd.B HackTool.Pipecmd Win32.HackTool.Pipecmd.a Application.Hacktool.Pipecmd.B Application.Hacktool.Pipecmd.B Application.Hacktool.Pipecmd.B Trojan.Starter.5008 BehavesLike.Win32.PUP.lc Application.Hacktool.Pipecmd.B Trojan/Win32.Inject.C500093


Once installed , the application requests permissions so that it may control SMS messages and steal sensitive data on the device , as well as proliferate to other devices in the target device ’ s contact list .


Following a three-month hiatus, Emotet spam activities resumed in March 2023, when a botnet known as Epoch 4 began delivering malicious documents embedded in Zip files that were attached to the emails.


A backdoor also known as: Ransom.Sage.S1609000 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.TNMG-4793 Ransom.Cry Trojan.Win32.Yakes.etrgag BehavesLike.Win32.Ramnit.fc TR/AD.MalwareCrypter.zdeue Trojan.Zusy.D3FCFB Trojan/Win32.Yakes.C2201035 Trojan.Yakes Trojan.Yakes!KiOJwMzaTlA


Bots can use various methods to establish a line of communication between themselves and their command-and-control C C server.


Knowledge of the threat landscape and implementation of the right detection tools remains crucial to be able to protect yourself from fraud ; Cerberus is yet a new Trojan active in the wild ! Appendix Samples Some of the latest Cerberus samples found in the wild : App name Package name SHA 256 hash Flash Player com.uxlgtsvfdc.zipvwntdy 728a6ea44aab94a2d0ebbccbf0c1b4a93fbd9efa8813c19a88d368d6a46b4f4f Flash Player com.ognbsfhszj.hqpquokjdp fe28aba6a942b6713d7142117afdf70f5e731c56eff8956ecdb40cdc28c7c329 Flash Player com.mwmnfwt.arhkrgajn ffa5ac3460998e7b9856fc136ebcd112196c3abf24816ccab1fbae11eae4954c Flash Player com.wogdjywtwq.oiofvpzpxyo 6ac7e7ed83b4b57cc4d28f14308d69d062d29a544bbde0856d5697b0fc50cde4 Flash Player com.hvdnaiujzwo.fovzeukzywfr cfd77ddc5c1ebb8498c899a68ea75d2616c1c92a0e618113d7c9e5fcc650094b Flash Player com.gzhlubw.pmevdiexmn 3f2ed928789c200e21fd0c2095619a346f75d84f76f1e54a8b3153385850ea63 Target list The actual observed list of mobile apps targeted by Cerberus contains a total of 30 unique applications .


CVE-2015-5122 was the second Adobe Flash zero-day revealed in the leak of HackingTeam's internal data.


At the peak of procrastinators filing their taxes at the last minute, those who send in their tax forms are exactly the technically less-sophisticated users these kinds of campaigns target.


A backdoor also known as: Worm/W32.Vesenlosow.1237156 Worm.Vesenlosow Worm.VB.Win32.13725 W32.W.Vesenlosow.luZW Trojan/VB.nzt WORM_VESENLO.SMA Win32.Worm.VB.m W32.Winiga WORM_VESENLO.SMA Trojan.Win32.Vesenlosow.bclidy Worm.Win32.A.Vesenlosow.909312 Trojan.MulDrop3.6950 BehavesLike.Win32.Rontokbro.tm Trojan.Win32.VB Worm/Vesenlosow.q WORM/VB.argu Trojan/Win32.VB Worm:Win32/Vesenlosow.A Trojan/Win32.VB.R46099 Trojan.Keylogger.1021 W32/Vobfus.GEP.worm Win32.Virut.NBP Win32/VB.NZT Win32.Worm.Vb.Akzk Worm.Win32.Msmm.A


A backdoor also known as: VB:Trojan.Valyria.1034 VBS/Downldr.IA W97M.Dropper TROJ_RUBREG.SM VB:Trojan.Valyria.1034 Trojan.Script.ExpKit.evbkht Troj.Downloader.Script!c VB:Trojan.Valyria.1034 VB:Trojan.Valyria.1034 VBS.DownLoader.1040 TROJ_RUBREG.SM VBS/Downloader.ea VBS/Downldr.IA TrojanDownloader:VBS/Vibrio.P VB:Trojan.Valyria.D40A VBS/Downloader.ea virus.vbs.houdini.b


A backdoor also known as: Trojan.Win32.Mydse!O TrojanDropper.Goriadu Win32.Trojan.WisdomEyes.16070401.9500.9578 TROJ_GORIADU.SMX Trojan.Win32.Mydse.az Trojan.Win32.Click.tdtvg TROJ_GORIADU.SMX BehavesLike.Win32.BadFile.fh Trojan-Clicker.ANTO TR/Clicker.9984610 Win32.Troj.AntiCloudAV.d.kcloud TrojanDropper:Win32/Goriadu.A!bit Trojan.Zusy.D38CD Trojan.Win32.Mydse.az W32/GORIADU.SMX!tr


Who is affected ? Gooligan potentially affects devices on Android 4 ( Jelly Bean , KitKat ) and 5 ( Lollipop ) , which is over 74 % of in-market devices today .


Around 2011 , the infamous Zeus Trojan started using web injects that tricked users into downloading a mobile component called “ ZitMo ” ( Zeus in the Mobile ) .


Figure 1 shows embedded URL in an Elirks sample found in early 2016.


This malware is well-known for its ability to steal credentials and quickly spread through an enterprise over network shares.


A backdoor also known as: W32.eHeur.Virus02 Adware.Heur.E101B3 Win32.Trojan.BHO.r Trojan.Win32.BHO.bropxr Adware.Softomate.603 Trojan:Win32/Jifcapi.A


A backdoor also known as: Trojan.Kromebit TROJ_KROMEBIT.SM Win32.Trojan.WisdomEyes.16070401.9500.9982 TROJ_KROMEBIT.SM Trojan.Win32.Dwn.eurwpx Trojan.Win32.Z.Kromebit.1068032 Trojan.DownLoader25.50889 BehavesLike.Win32.Dropper.tt W32/Trojan.EJDN-0785 Trojan:Win32/Kromebit.B Trj/CI.A Trojan.Win32.Kromebit W32/KROMEBIT.SM!tr


The report closes with some security suggestions, highlighting the importance of two-factor authentication.


This week the spam party did not just include CERBER, but also decided to invite an old friend – the KOVTER family.


Tofsee, also known as Gheg, is another botnet analyzed by CERT Polska.


It ’ s possible , as with other Android malware , that some apps may also be available on forums , file-sharing sites or even sent to victims as email attachments , and we were only able to determine the delivery mechanism for a handful of the apps we have been able to find .


A backdoor also known as: Trojan/W32.Small.15616.H Trojan.Bibei.A6 Bibei.a Win.Trojan.Rootkit-3954 Trojan.Win32.NtRootKit.rigfr TrojWare.Win32.Olmarik.AWI Trojan.NtRootKit.12543 Bibei.a TR/Offend.69286423 Trojan.Zusy.D27F7 Trojan:WinNT/Bibei.A


The service continues by loading an ELF , created by Baidu , which is capable of tracking the device location before setting up a monitor to harvest phone numbers associated with outgoing calls for those numbers with a country code “ +86 ” prefix , which relates to the People ’ s Republic of China .


A backdoor also known as: Trojan/W32.Propas.110663 Trojan.Heur.RP.EDD84E Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/Trojan.AQD TROJ_PASSPRO.C Win.Trojan.Enfal-62 Trojan.PWS.Winlog TROJ_PASSPRO.C BehavesLike.Win32.Dropper.ch W32/Trojan.IWQS-9238 Trojan:Win32/Propas.A Trojan:Win32/Propas.A Trojan.Propas!M9i4NRQV2R8 W32/Propas.A!tr


A backdoor also known as: Backdoor.Syph.B Backdoor/W32.Syph.361984 Backdoor.Syph Backdoor.W32.Syph.b!c Trojan/Syph.b Backdoor.Syph.B Backdoor.Trojan BKDR_SYPH.B Win.Trojan.Syph-2 Backdoor.Syph.B Backdoor.Win32.Syph.b Backdoor.Syph.B Trojan.Win32.Syph.bfjuy Backdoor.Win32.Syph.361984 Win32.Backdoor.Syph.cyqv Backdoor.Syph.B Backdoor.Win32.Syph.B BackDoor.Syph BKDR_SYPH.B W32/Risk.GBZV-6047 Backdoor/Syph.b BDS/Syph.b.Srv Trojan[Backdoor]/Win32.Syph Backdoor:Win32/Syph.B Backdoor.Win32.Syph.b Backdoor.Syphillis Backdoor.Syph.b Bck/Syphillis.1.18 Win32/Syph.B Backdoor.Syph!hEmUZuSaZVQ Win32/Backdoor.e16


From April 19-24, 2017, a politically-motivated, targeted campaign was carried out against numerous Israeli organizations.


Although this technique has been used before by other malware campaigns, it is still not a common strategy.


It also targets devices made by Chinese manufacturer Xiaomi and those running MIUI , an operating system based on Google Android made by Xiaomi .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9692 TR/Brysay.A PWS:Win32/Enesbot.A Trojan-Downloader.MSIL.Banload


Yet I recently uncovered evidence that suggests it was the work of a well-known Chinese threat group.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9982 Trojan.Win32.Farfli Backdoor:Win32/Dorbop.B!bit Trj/GdSda.A


A backdoor also known as: Trojan.Win32.AD.eqoszf TR/AD.PSLoader.kykon Trojan.Razy.D1F16C Win32/Powerless.F Trojan.Powerless! W32/Powerless.F!tr


We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013.


In our previous research, we detailed how an information stealer Trojan was deployed via a Word macro, in order to spy on its victims various parts of the Saudi Government.


A backdoor also known as: W32.FakeMsHelpCenter.Trojan Trojan.Graftor.D67ED Win32.Trojan.WisdomEyes.16070401.9500.9997 TROJ_ALTHUMS_EI030112.UVPM Trojan.Win32.DownLoad2.rlsdn Trojan.Win32.A.Downloader.84626 Trojan.DownLoad2.63614 Trojan.Allthumbs.Win32.1 TROJ_ALTHUMS_EI030112.UVPM BehavesLike.Win32.Worm.tz Trojan:Win32/Althums.A Trojan/Win32.Goz.R10705 Trj/CI.A Trojan.Graftor!H+8m5ivUpKY Win32/Trojan.0be


Such data includes contact and location information , phone and message activity , the ability to record from the microphone , camera , and other sensors as well as the capability to access data from many popular messaging and social media apps .


A backdoor also known as: BKDR_MATSNU.SM0 Win32.Trojan.WisdomEyes.16070401.9500.9999 BKDR_MATSNU.SM0 BehavesLike.Win32.Ransom.ch TR/Crypt.ZPACK.8577 Trojan/Win32.Trapwot.R152769 Trojan.FakeAV.01657


This finding was listed in our Anthem blog, and we have continued to monitor it in ThreatConnect since mid February.


A backdoor also known as: W32.JapiletAA.Trojan Trojan.Dropper.Delf.BB Worm.Win32.Fesber!O Worm.Fesber Worm.Fesber.Win32.3 Trojan/Fesber.a W32/Fesber.A Win32/Fesber.A WORM_YERO.A Win.Worm.Yero-1 Worm.Win32.Fesber.g Trojan.Dropper.Delf.BB Virus.Win32.Fesber.iiof Worm.Win32.A.Fesber.13116[UPX] Virus.Win32.Fesber.k Trojan.Dropper.Delf.BB Win32.HLLW.FSB WORM_YERO.A BehavesLike.Win32.Fesber.vh W32/Fesber.QPGQ-0002 Worm/Fesber.g Worm/Win32.Fesber.g Worm.Fesber.kcloud Worm:Win32/Fesber.A Trojan.Dropper.Delf.BB Troj.PSW32.W.QQPass.lgj2 Worm.Win32.Fesber.g Trojan.Dropper.Delf.BB Worm/Win32.Fesber.R4309 Trojan.Dropper.Delf.BB Virus.Fsb.1 I-Worm.Fesber.A Win32/Fesber.A Worm.Fesber!I2XPvd5yXYs Worm.Win32.Fesber W32/Cosmu.H.worm Worm.Win32.Fesber.A


What is special about it is that it comes as a Windows link file, .LNK, that downloads and runs a malicious HTML application, .HTA, that drops and executes a malicious binary.


We report them to Google and take other steps to disrupt malicious campaigns we discover .


Our analysis of the Adobe Flash zero-day vulnerability used in the latest Pawn Storm campaign reveals that the previous mitigation techniques introduced by Adobe were not enough to secure the platform.


The actors behind Dridex 220 and Locky Affid=3 have introduced a new ransomware called Bart


A backdoor also known as: Application.Joke.Flipped.E Joke.Flipped Riskware.Win16.Flipped.yzsd Joke.Flipped JOKE_FLIPPED.A Joke.Flipped Application.Joke.Flipped.E Joke.Flipped Application.Joke.Flipped Joke.Flipped JOKE_FLIPPED.A Joke.Flipped Backdoor/IRC.IRC Joke:Win32/Flipped.A Trojan.Win32.A.Zbot.4128 Application.Joke.Flipped.E Joke.Flipped Joke.Flipped


Komplex shares a significant amount of functionality and traits with another tool used by Sofacy – the Carberp variant that Sofacy had used in previous attack campaigns on systems running Windows.


In 2014, our colleagues at Crowdstrike wrote an exposé about a long-standing Chinese APT threat group they self-named Putter Panda, which Mandiant/FireEye refers to as APT2.


Apache Tomcat is a java based web service that is used for different applications.


Among the 153 configuration files, 54 distinct command and control C C servers were detected.


A backdoor also known as: Trojan.Win32.RedCap.ewfcku BehavesLike.Win32.VBobfus.gc Trojan.CopyKittens TR/RedCap.eevfy Trojan.Razy.D33AF6 TrojanDropper:Win32/Noratops.B!dha Trj/GdSda.A


According to a blog article by Microsoft, the malware is associated with an attacker group identified as DarkHotel Microsoft calls it as Dubnium .


A backdoor also known as: W32.Lamer.KL8 PE_LAMER_EL150191.UVPM Win32.Trojan.WisdomEyes.16070401.9500.9987 PE_LAMER_EL150191.UVPM Virus.Win32.Lamer.kl Virus.W32.Lamer!c ApplicUnsaf.Win32.ScreenMate.AA Backdoor.PePatch.Win32.75884 Virus.Win32.Lamer TR/Taranis.2787 Trojan[Ransom]/Win32.CryFile Virus.Win32.Lamer.kl Hoax.CryFile Virus.Win32.Lamer.j Win32/Virus.HideDoc.L


Google's security team recently identified a new domain masquerading as an official EFF site as part of a targeted malware campaign.


A backdoor also known as: W32.OnGameELAIUZAC.Trojan Trojan.Zusy.D3B59 Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Win32.Clicker.cwyjjr Trojan.Click2.34240 Win32.Troj.Undef.kcloud Trojan:MSIL/Ainscomp.A Trj/CI.A Trojan.Ainscomp!KTuN3cZslCo Trojan.Msil Win32/Trojan.bfc


EventBot parsing of grabbed SMS messages Parsing of grabbed SMS messages .


The three InPage exploit files are linked through their use of very similar shellcode, which suggests that either the same actor is behind these attacks, or the attackers have access to a shared builder.


A new type of macOS-based stealer is being sold on the dark web for $100 £70.


BLOCKER_EXTORTIONIST_START – display HTML page of the ransomware .


The emails sent by this campaign may look spartan to the professional eye but, as ever, the human point of interaction with systems is the most vulnerable: by potentially reaching so many individuals, campaigns such as this can - and do - succeed in infecting people.


Most custom backdoors used by advanced attackers have limited functionality.


EVENTBOT INFRASTRUCTURE By mapping the C2 servers , a clear , repeated pattern emerges based on the specific URL gate_cb8a5aea1ab302f0_c .


We anticipate this malware to continue to evolve with additional new features ; the only question now is when we will see the next wave .


A backdoor also known as: Trojan/Bifrose.nel Win.Trojan.AutoIT-6333854-0 Trojan-Dropper.Win32.Autoit.bvg Trojan.Win32.AutoIt.expdpu BehavesLike.Win32.Backdoor.tc Trojan.Win32.Z.Autoit.1633763 Dropper/Win32.Androm.C2387785 Win32/Injector.Autoit.DFJ Backdoor.MSIL W32/Injector.CYH!tr Win32/Trojan.38f


MALWARE UNDER ACTIVE DEVELOPMENT EventBot “ cfg ” class EventBot “ cfg ” class .


Over the past couple of months McAfee Labs has seen an increase in the usage of macros to deliver malware.


We mostly observe attacks using Elirks occurring in East Asia.


We observed an anomaly when approximately 60 domains all [.]top TLDs registered on April 7, 2016 started serving a coin mining malware – to mine BitMonero, a form of digital currency – on their main page under the mime-type of html/text.


A backdoor also known as: W32.HfsAutoB.E147 Trojan.Banker.Win32.5895 Trojan/Banker.ju W32/Banker.AJC Win.Trojan.Bancos-852 Trojan-Banker.Win32.Banker.ju Trojan.Win32.Banker.bmncx Trojan.PWS.Banker.based Trojan-Spy.Win32.Banker W32/Banker.WTGS-4277 Trojan/Banker.Banker.ufm Trojan[Banker]/Win32.Banker Trojan-Banker.Win32.Banker.ju TrojanBanker.Banker Trojan.Banker!qguLAzH8AII W32/Banker.DUU!tr Trj/Banker.FWD Win32/Trojan.a46


At least two different stealers, Rhadamanthys and RedLine, were abusing the search engine promotion plan in order to deliver malicious payloads to victims' machines.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9925 Trojan.Win32.Graftor.bovqdb TrojWare.Win32.GameThief.Nilage.~CRSH TR/Graftor.Elzob.6117.1 Backdoor:Win32/Parcim.A Trj/CI.A Trojan.Graftor.Elzob.D17E5


It has been in the news the past few weeks as it is the bot that was used in the DDoS attack on Brian Kreb's security blog.


A backdoor also known as: Trojan.Jevafus.A Trojan.Jevafus.A Trojan.Jevafus.A Trojan.Win32.Drop.euelge Trojan.Jevafus.A Trojan.Jevafus.A BehavesLike.Win32.BadFile.vh TrojanDropper:Win32/Jevafus.A Trojan.Jevafus.A


So far, all theories regarding the spread of ExPetr/Petya point into two directions:


The CatB ransomware family, sometimes referred to as CatB99 or Baxtoy, was first observed in late 2022, with campaigns being observed steadily since November.


A backdoor also known as: Trojan.Svectas.Win64.1 Packer.Win32.Katusha TR/Svectas.smnlb W64/Svectas.B!tr


PaloAltorecently discovered a new Android Trojan called SpyNote which facilitates remote spying.


A backdoor also known as: W32.HfsAutoB.F81D Trojan.Mikhail.Win32.4 Trojan.Ransom.Mischa.2 Ransom_MISCHA.SM Win32.Trojan.WisdomEyes.16070401.9500.9999 Ransom_MISCHA.SM Win32.Trojan-Ransom.Petya.D Trojan-Ransom.Win32.Mikhail.a Trojan.Win32.Petya.96256 Trojan.Encoder.4544 Trojan.Petr.a TR/AD.Petya.Y.rxxx Trojan[Ransom]/Win32.Mikhail Ransom:Win32/Mischa.A Trojan-Ransom.Win32.Mikhail.a Trojan/Win32.Mischa.C1478164 Hoax.Mikhail Trojan.Mikhail!


A backdoor also known as: Doc.Exploit.DDEautoexec-6346603-0 Exploit.Xml.DDEAuto.euqmxe Trojan[Exploit]/MSOffice.DDE.c Win32.Outbreak


The end result is a new banking Trojan in the wild.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9899 HV_ROGUE_CG152C85.RDXN Heur.Packed.Unknown TR/Spy.Banker.45879 TrojanProxy:BAT/Banker.G Win32/RiskWare.PEMalform.E


A backdoor also known as: Trojan-Proxy/W32.Steredir.504832 Trojan/Proxy.Steredir.c Trojan-Proxy.Win32.Steredir.c Trojan.Win32.Steredir.fqli Troj.Proxy.W32.Steredir.c!c TrojWare.Win32.TrojanProxy.Steredir.C Trojan.Stedir.11 Trojan.Steredir.Win32.7 Trojan-Dropper.Delf W32/Risk.RESM-4501 TrojanProxy.Steredir.c TR/Proxy.Steredir.C Trojan[Proxy]/Win32.Steredir Win32.Troj.Steredir.c.kcloud Trojan.Heur.EFD23B1 Trojan.Win32.Proxy.504832 Trojan-Proxy.Win32.Steredir.c TrojanProxy:Win32/Steredir.C Win32/TrojanProxy.Steredir.C Trojan.PR.Steredir!cYzY1isGQt0 W32/Steredir.C!tr


Do not download mobile apps from unofficial or unauthorized sources .


Attitude Change The disinterest in the issues appears to have changed with The New York Times report , which lit a fire underneath Adups and BLU .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 BehavesLike.Win32.Trojan.gc Trojan.MSIL.Bladabindi.1 HackTool:MSIL/Injector.A Trojan.LVBP.ED Backdoor.Win32.DarkKomet


A backdoor also known as: Backdoor.Win32.Hupigon!O TrojanDropper.Dowque.A8 Backdoor.Hupigon.Win32.182 Backdoor/Hupigon.dkwt TROJ_DOWQUE.NY Win32.Trojan.Delf.b W32/Backdoor2.CWRX Backdoor.Graybird TROJ_DOWQUE.NY Win.Worm.Autorun-12451 Backdoor.Win32.Hupigon.56864 Backdoor.W32.Hupigon.l9fO BackDoor.Graybird.75 BehavesLike.Win32.SpywareLyndra.tc W32/Backdoor.DAWT-3367 Backdoor/Huigezi.2008.qny BDS/Farfli.kj.2 Win32.TrojDownloader.dl.kcloud TrojanDropper:Win32/Dowque.A Trojan/Win32.Hupigon.C29670 Backdoor.Bot Win32/Delf.NSN Backdoor.Win32.Hupigon.dkw Backdoor.Hupigon!hgCryiT987Y Backdoor.Win32.HacDef W32/Injector.fam!tr Trojan.Win32.Downloader.M


The file is named in such a way as to confuse WordPress administrators who are familiar with XML-RPC.


Conclusion The days when one needed in-depth coding knowledge to develop malware are long gone .


A backdoor also known as: HackTool.Win64.PSWDump.f BehavesLike.Win64.SoftPulse.lh HackTool.Mimikatz HackTool.Win64.PSWDump.f


The story was about a new vulnerability for *nix-based systems – EternalRed aka SambaCry.


There have been an emegerence of new domains for FighterPOS recently and I discovered a whole load of other possible domains that could be used for the command and control.


FakeSpy uses an anti-debugging technique by creating another child process of itself .


The service connects back to the attacker machine and waits for commands which will be given by the attacker.


Crooks behind MajikPOS have various tricks up their sleeves.


TA473 has continuously leveraged an unpatched Zimbra vulnerability in publicly facing webmail portals that allows them to gain access to the email mailboxes of government entities in Europe.


Presumably from the same author of Petya, which was first seen in December 2016, and the Petya-Mischa combo, which hit users back in July 2016, Janus Cybercrime Solution's latest creation is another step in the evolution of their ransomware-as-a-service expansion.


Our research indicates that the group has sufficient financial resources to purchase the source code of a widely available malware tool, and the human resources to design improved versions of its own backdoors based on this.


A backdoor also known as: Trojan.Downloader.JRQH Trojan.Downloader.JRQH Win32.Trojan.WisdomEyes.16070401.9500.9945 Win32.Trojan-Downloader.Banload.J Trojan-Downloader.MSIL.Banload.bgr Trojan.Downloader.JRQH Trojan.Win32.Banload.dzssxt Trojan.Downloader.JRQH Trojan.Downloader.JRQH Trojan-Downloader.MSIL.Banload.bgr TrojanDownloader:MSIL/Banload.T Trojan/Win32.Banload.C829219 Trojan.Banker.ABR Trj/GdSda.A Msil.Trojan-downloader.Banload.Efkz Trojan-Downloader.MSIL.Banload


Trigona ransomware is a relatively new strain that security researchers first discovered in late October 2022.


update.exe module and Xenotix Python Keylogger code comparison ‘ addStartup ’ method from msconf.exe module ‘ addStartup ’ method from Xenotix Python Keylogger Distribution We found several landing pages that spread the Android implants .


A backdoor also known as: HW32.Packed.A537 Packed.Win32.TDSS!O RiskWare.Tool.CK BehavesLike.Win32.Downloader.dc TR/Bumat.A.2896 Win32.Troj.Undef.kcloud Win-Trojan/Xema.variant PE:Malware.XPACK-HIE/Heur!1.9C48 Trojan.Crypt W32/Malware_fam.NB Win32/Trojan.648


We observed legitimate exfiltrated files of the following types of data : Contact information Compressed recorded audio in the Adaptive Multi-Rate ( amr ) file format Images captured from the device camera Images stored on both internal device and SDCard storage that are listed in the MediaStore Device geolocation information SMS content Chrome browser search history and bookmarks Call log information Cell tower information Device network metadata ; such as phone number , device software version , network country , network operator , SIM country , SIM operator , SIM serial , IMSI , voice mail number , phone type , network type , data state , data activity , call state , SIM state , whether device is roaming , and if SMS is supported .


This post describes the new campaign.


A backdoor also known as: HW32.Packed.2431 Trojan.MSIL.FKV WS.Reputation.1 Stimilik.S Trojan.Win32.Confuser.dkqarl BehavesLike.Win32.Kudj.gc Trojan/Win32.Stealer PUA.MSIL.Confuser


Attackers also used the name of the top NIC official in the signature of the email, this is to make it look like the email was sent by a high ranking Government official working at NIC National Informatics Centre.


PaloAlto observed a targeted attack in November directed at an individual working for the French Ministry of Foreign Affairs.


HMRC taxes application with reference L4TI 2A0A UWSV WASP received


The infection attempts occurred in September and October of 2015 as public frustration grew at the Mexican government's seemingly contradictory statements about the Narvarte case


A backdoor also known as: Worm/W32.Mydoom.28864 W32.Mydoom.M W32/Mydoom.o@MM W32/Mydoom.m I-Worm.Mydoom!qBn5HU3v+Lw W32/Mydoom.O@mm W32.Mydoom.M@mm MyDoom.L@mm Win32/Mydoom.O Win32.Mydoom.m Worm.Mydoom-27 Email-Worm.Win32.Mydoom.m I-Worm.Win32.Mydoom.28864.A Email-Worm.Win32.Mydoom!IK Worm.Win32.Mydoom.R Win32.HLLM.MyDoom.54464 Worm/Mydoom.O.1 W32/Mydoom.o@MM Worm/Sramota.bef Worm/Win32.Mydoom Worm:Win32/Mydoom.O@mm W32/Mydoom.O@mm Win32/Mydoom.worm.49344.B Email-Worm.Win32.Mydoom.m Win32/Mydoom.R Worm.Mail.Mydoom.dh Email-Worm.Win32.Mydoom W32/Mydoom.M!dam I-Worm/Mydoom.O W32/Mydoom.N.worm


The news organization provides reporting on its website in English, Georgian, and Russian.


Mandiant suspects UNC2970 specifically targeted security researchers in this operation.


jhfrte.jar : This is a java archive file downloaded from server .


A backdoor also known as: W32.FamVT.LoringK.Trojan Backdoor.Bot.158614 Trojan-Dropper.Win32!O TrojanDropper.Loring.A11 Backdoor.Bot.158614 Backdoor.IRCBot Trojan/IRCBot.ov WORM_KWBOT.AR W32/Risk.VXNU-4867 W32.Kwbot.Worm Win32/Loring.A WORM_KWBOT.AR Win.Trojan.Obfuscated-1662 Backdoor.Bot.158614 Trojan.Win32.Reconyc.gunk Backdoor.Bot.158614 Trojan.Win32.IRCBot.dmigck Dropper.Loring.291411 Backdoor.Bot.158614 Backdoor.Bot.158614 Trojan.MulDrop5.7150 Trojan.Reconyc.Win32.6040 WORM/IrcBot.86875 Trojan[Backdoor]/Win32.IRCBot Win32.Troj.Loring.EA.kcloud Backdoor.Bot.D26B96 Troj.Dropper.W32.Loring.l8Ew Worm/Win32.IRCBot.R3593 TScope.Trojan.Delf Trojan.IRCBot.OV Win32/IRCBot.OV Trojan.DR.Loring!O3IAMVgzzx8 Trojan-Dropper.Win32.Loring


A backdoor also known as: Trojan/Injector.iuc Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Pushbot.AJZ WORM_PALEVO.SMA Win.Trojan.Ircbrute-54 Trojan.Win32.Ircbrute.eqsrw Trojan.Spambot.9818 Trojan.Injector.Win32.53831 WORM_PALEVO.SMA BehavesLike.Win32.PWSZbot.lh Backdoor.Win32.IRCBot Trojan/Win32.Unknown Trojan:Win32/Ircbrute.B Trojan.Graftor.DCFC Worm/Win32.Ckbface.R16129 Trojan.Injector!aNdlYeuOVuU


While the malware was not detectable by endpoint antivirus products, RSA Security Analytics was able to identify and alert on its network traffic, and RSA ECAT subsequently identified the malware.


A backdoor also known as: Trojan.Script.400873 Exploit/PDF-URI2.AS Exploit-PDF.f Exploit.W32.Pidief!c PDF.Exploit.Pidief.an Bloodhound.PDF.9 Trojan.Script.400873 Exploit.Win32.Pidief.asz Trojan.Script.400873 Exploit.Script.Pidief.ibwe PDF.S.Exploit.10714 Win32.Exploit.Pidief.Anfp Trojan.Script.400873 Exploit.JS.Pdfka.MJ Trojan.Script.400873 Exploit.PDF.303 HEUR_PDFEXP.B BehavesLike.PDF.Trojan.lr Exploit:Win32/Pdffir.A Trojan.Script.D61DE9 Exploit.Win32.Pidief.asz PDF/Pidief.EI Trojan.Script.400873 Exploit.Win32.Pidief.asz JS.Crypt.BSP Exploit.JS.Pdfka JS/Pdfka.BSP!exploit virus.pdf.20090837.1


A backdoor also known as: W32.DropperZbotS.Trojan Trojan-Spy.Win32.Zbot!O Trojan.AutoIt.Pik.A Backdoor/Poison.evja Trojan.Zbot Trojan.Win32.Autoit.pik Trojan.Win32.Autoit.exoora Trojan.Win32.Z.Autoit.955563 Troj.W32.Autoit!c BehavesLike.Win32.Dropper.dc Trojan.Win32.Injector Trojan.Autoit.kzp TR/AD.Zbot.cgaww Trojan.Win32.Autoit.pik Trojan:Win32/Krilog.A Trojan.Autoit.F Win32/Injector.Autoit.AOI Win32.Trojan.Autoit.Edne W32/Autoit.NWS!tr


Several hardcoded applications targeted by the MDM-grabbing command ‘ wifi ’ – this command creates a new Wi-Fi connection with specified configurations from the command and enable Wi-Fi if it is disabled .


A backdoor also known as: W32.DakusarDRW.Trojan Trojan.Blocker.Win32.34866 Trojan.DownLoader24.32105 BehavesLike.Win32.Shodi.tc Worm:Win32/Icorimg.A Trojan.Strictor.D1C7BA HEUR/Fakon.mwf Trojan.Worm!33g50yRKTx8 Trojan.FLCM!tr


Upon further inspection, the RAT appeared to share many similarities with an old Chinese backdoor known as Hacker's Door first released publicly in 2004 and updated in 2005.


Due to the current absence of maintained and supported Android banking Malware-as-a-Service in the underground community , there is a certainly demand for a new service .


A backdoor also known as: BackDoor-CMQ.dldr Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_HORST.SMPE Monitor.W32.WebWatcher.lt5Y TROJ_HORST.SMPE BackDoor-CMQ.dldr Trojan.Graftor.D476C BScope.Malware-Cryptor.Win32.313 Trojan.Win32.Cosmu W32/Dloader.BOW!tr.dldr


The campaign was active between November 2016 and January 2017, targeting a limited number of people.


In this particular case , the bot abuses the accessibility service privilege to obtain the package name of the foreground application and determine whether or not to show a phishing overlay window , as shown in the following code snippet : Targets Some examples of phishing overlays are shown below .


Quasar is a .NET Framework-based open-source RAT.


A backdoor also known as: Trojan.Win32.Z.Delf.2373896 Troj.Spy.W32.Zbot.lw7D Win32.Trojan-downloader.Rakhni.Html Trojan-Downloader.Win32.Delf W32/Application.AJYX-3726 TrojanDownloader.Rakhni.ec TR/Dldr.Delf.tbxxd W32/Dloader.CDW!tr Trojan[Downloader]/Win32.Rakhni Trojan.Application.Bundler.InstallMonster.392 Trojan-Downloader.Win32.Rakhni.jqc Trj/CI.A Win32/Trojan.036


) If the application hasn ’ t received instructions about the rules for processing incoming SMSs , it simply saves all SMSs to a local database and uploads them to the C & C .


While it is not clear whether the primary goal of the attack was delivering the malicious payload or capturing the targets OWA credentials, this attack uses an OWA phish to additionally pushes a malicious document with a Veil-Framework payload capable of downloading further malware.


Installed with backdoored software, for example:- Telegram.exe - mech_korolya_artura_2017.HDRip.exe


Founded in 2013, the Android Marcher mobile malware has widely been targeting Google Play -- harvesting user credentials and credit card data.


Ransomware persists as one of the top crimeware threats thus far into 2016.


A backdoor also known as: W32.FamVT.AxVDb.Trojan Trojan.Rincux.AW Trojan.Injector.26488 Trojan.Rincux.AW Trojan.Injector Tool.StormAttack.Win32.10 Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan Win.Trojan.Rincux-6417593-0 Trojan-DDoS.Win32.StormAttack.c Trojan.Rincux.AW Trojan.Win32.Tdss.bziyas Trojan.Rincux.AW TrojWare.Win32.Magania.~AAC DDoS.Storm.156 BehavesLike.Win32.Backdoor.km TrojanDDoS.StormAttack.a Trojan[Rootkit]/Win32.TDSS DDoS:Win32/Stormser.A Trojan.Rincux.AW Trojan-DDoS.Win32.StormAttack.c BScope.Trojan.Win32.Inject.2 Trojan-Downloader.Win32.Pangu W32/ServStart.AS!tr


That version flags messages " containing certain language associated with junk texts and flags numbers associated with junk calls and not in a user 's contacts , '' the company says .


Daserf's main purpose is information stealing and the Trojan is capable of gathering information from infected computers and relaying it back to attacker-controlled servers.


A backdoor also known as: Trojan-Dropper.Win32.Flystud!O Trojan.Hookmoot.S217748 Trojan.Symmi.D7D5 Win32.Worm.FlyStudio.mc Trojan.Dropper Win32/SillyAutorun.ALB Win.Trojan.Rootkit-7763 Win32.Trojan.FlyStudio.A Trojan-GameThief.Win32.OnLineGames.boif Trojan.Win32.QQPass.esaped Troj.Dropper.W32.Flystud.lBWL Trojan.MulDrop5.5320 Dropper.Flystud.Win32.139 BehavesLike.Win32.Autorun.vc Trojan/PSW.OnLineGames.cvvq RKIT/Tiny.BK.2 Trojan:Win32/Englov.A Trojan-GameThief.Win32.OnLineGames.boif HEUR/Fakon.mwf Rootkit.Tiny Trojan.AutoRun Win32/FlyStudio.A Trojan.TenThief.QQPsw.tss Worm.Autorun!1DOkY6YfgQ8 Rootkit.Win32.Tiny W32/BDoor.DRV!tr Win32/Trojan.dd5


But we recently identified an app that demonstrated new ways of successfully evading Apple's code review.


The stolen credentials may be used for remote access into the victim network if applicable.


A backdoor also known as: Trojan.Darkshell BehavesLike.Win32.Ipamor.nm Trojan[Downloader]/Win32.Delf Trojan:WinNT/Darkshell.C Trojan/Win32.CSon.R1800 Trojan.Win32.Scar.mg


A backdoor also known as: W32.HfsAutoB.B01D Troj.Crypt.Tpm!c BehavesLike.Win32.PWSQQPass.vc Trojan:Win32/Valan.A


It can also imitate a legitimate website to lure you into revealing your sensitive information.


Dyreza originally focused on intercepting end-user bank logins, and later expanded to job hunting, file hosting, domain registration, website hosting, file hosting, tax services, and online retail categories


Brain Test has been removed from Google Play since September 24.


A backdoor also known as: W32.FamVT.DinwoodAATTC.Worm Trojan.Zenshirsh.SL7 TSPY_EYDROP.SMA Win32/Oflwr.A!crypt TSPY_EYDROP.SMA Win.Worm.Allaple-5 Trojan-Dropper.Win32.Dinwod.acqn Trojan.Win32.Dinwod.ejafor Troj.Dropper.W32.Dinwod.toVw TrojWare.Win32.TrojanDropper.Dinwod.A Trojan.Inject1.58305 BehavesLike.Win32.Dropper.wh TrojanDropper.Dinwod.ale Worm[NET]/Win32.Nimda.gic Trojan-Dropper.Win32.Dinwod.acqn Trojan/Win32.OnlineGameHack.C33730 TrojanDropper.Dinwod Trojan.Dropper Trojan.DR.Dinwod!dCCk6/8cSJk


A backdoor also known as: Trojan.Win32.Symmi!O WS.Reputation.1 OnLineGames.IRMW Win32/Oflwr.A!crypt Riskware.Win32.FakeLPK.cwuava BackDoor.BlackHole.21297 TR/Obfuscated.XZ.937 HackTool.Sniffer.WpePro PSW.OnlineGames4.BEIZ


A backdoor also known as: Trojan.Connapts Trojan/Small.ndx Trojan.Heur.LP.EDC094 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.MLW.dylhy W32/Trojan.CISW-8628 Backdoor.Bot/Variant Trojan/Win32.Xema.C93063 W32/Small.NDX!tr Win32/Backdoor.796


This spring, the author of the NukeBot banking Trojan published the source code of his creation.


A backdoor also known as: Adware.ELEXCRTD.Win32.5604 Trojan.Johnnie.D709 not-a-virus:AdWare.Win32.Elex.sgn Adware.Mutabaha.1819 RiskTool.Uncheckit.l TR/Chuckenit.dglxl Trojan:Win32/Chuckenit.A not-a-virus:AdWare.Win32.Elex.sgn


This blog post highlights the technical innovations that we found in the latest versions of Carbon we have discovered.


A backdoor also known as: Backdoor.Slingup BKDR_SLINGUP.M W32/Zbot.AAJD Backdoor.Trojan BKDR_SLINGUP.M Trojan.Win32.Yakes.pqep Trojan.Win32.Inject.ecmohu Trojan.Win32.Z.Yakes.672768 Troj.W32.Yakes.tn6w BackDoor.Tordev.8 Trojan.Win32.Injector W32/Zbot.EUMY-8878 TR/Injector.juol Trojan/Win32.Yakes Trojan:Win32/Casidel.A Trojan.Win32.Yakes.pqep Trojan.Yakes Trojan.Yakes Trj/CI.A Win32/Injector.CXUT Win32.Trojan.Yakes.Ehid Trojan.Yakes!YuLYvE8ikp0 W32/Injector.CGQK!tr Win32/Trojan.621


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G Virus.Virut.Win32.27 W32/Virut.AI W32.Virut.CF Win32/Virut.17408 PE_VIRUX.A-1 Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg Virus.Win32.Virut.tt Virus.Win32.Virut.CE Trojan.MulDrop1.57199 PE_VIRUX.A-1 BehavesLike.Win32.Virut.dc W32/Virut.AI Win32/Virut.bn Trojan[Dropper]/Win32.Injector Win32.Virut.nc.53248 Virus.Win32.Virut.ce Win32/Virut.F Virus.Virut.06 Win32.Virut.E Win32/Virut.NBP IM-Worm.Win32.Zeroll W32/Sality.AO Virus.Win32.VirutChangeEntry.A


Spreads via password guessing over networks


A backdoor also known as: Trojan.Kitoles Trojan.Ransom.Scarab Win32.Trojan.WisdomEyes.16070401.9500.9547 W32/Trojan.LUOM-4097 Ransom.CryptXXX Win.Ransomware.Scarab-6336012-1 Win32.Trojan-Ransom.Amnesia.J52DUW Trojan.Win32.Encoder.ewdzie Trojan.Win32.Z.Securityshield.193058 Trojan.Encoder.23898 Trojan-Ransom.FileCoder Trojan.Purga.w Trojan.Ransom.Scarab.3 Ransom:Win32/Kitoles.A Trojan/Win32.Scarab.R213792 Trojan-Ransom.Purga Win32.Trojan.Filecoder.Phqc Win32/Trojan.Ransom.089


This specific downloader, Cmstar, is associated with the Lurid downloader also known as Enfal'.


Recently Malwarebytes got access to several elements of the espionage toolkit that has been captured attacking Vietnamese institutions.


I am not entirely sure what it is but it has some indications of fareit Trojan.


A backdoor also known as: Trojan.Dos.Bonk.C DoS.Win32.Bonk!O Dos.Bonk Win32.Trojan.Bonk.Tcwa W32/Tool.FPXO-2436 DoS.Win32.Bonk.c Trojan.Dos.Bonk.C Trojan.Win32.Bonk.ddda TrojWare.Win32.DoS.Bonk.C Trojan.Dos.Bonk.C Trojan.Inject.654 BehavesLike.Win32.ExploitMydoom.mm Backdoor.Win32.HacDef W32/VirTool.RO TR/RedCap.kudtu DoS:Win32/Bonk.C Trojan.Dos.Bonk.C DoS.Win32.Bonk.c Trojan.Dos.Bonk.C Trojan.Asthma.23305 Trojan.Dos.Bonk.C Trojan.Dos.Bonk.C Win32/DoS.Bonk.C DoS.Bonk!CFlP7tiJI8A DoS/Bonk.A


A backdoor also known as: Trojan.Duqu Trojan.Duqu.Win32.13 TROJ_DUQU.DEC Win32.Trojan.WisdomEyes.16070401.9500.9587 Win32/Duqu.A TROJ_DUQU.DEC Win.Trojan.Duqu-14 Trojan.Win32.Duqu.evvbpp Trojan.Duqu.2 W32/Trojan.CVVB-9378 TR/Offend.6750706 W32/Duqu.A!tr Trojan:Win32/Duqu.C Worm/Win32.Stuxnet.R608 Trojan.Duqu!ZB0mf9vKpU8 Trojan.Win32.Urelas Win32/Trojan.d72


r1-r4 : This is a local privilege escalation ( root ) exploit , which includes : CVE-2013-6282 , camerageroot ( http : //www.77169.org/exploits/2013/20130414031700 ) , a rooting tool for mtk6592 and addtional exploit .


A backdoor also known as: W32.HfsAutoB.10E5 Trojan-Dropper.Win32.Decay!O Troj.Dropper.W32.Decay.fvr!c Trojan/Dropper.Decay.dst Trojan.Razy.DD584 W32/Dropper.ANEZ TROJ_DECAY.SM Trojan-Dropper.Win32.Decay.fvr Trojan.Win32.Decay.biarma TrojWare.Win32.TrojanDropper.Decay.ghu Trojan.MulDrop6.60922 TROJ_DECAY.SM BehavesLike.Win32.Virut.lc W32/Risk.RTXX-1196 TrojanDropper.Decay.bo TR/Drop.Decay.ayb Trojan[Dropper]/Win32.Decay TrojanDropper:Win32/Decay.A Dropper.Decay.47104.B Trojan-Dropper.Win32.Decay.fvr Win32.Trojan.Yoybot.A Dropper/Win32.Decay.R2060 TrojanDropper.Decay Backdoor.Win32.Poison W32/Decay.FVR!tr


It was an existing business model when computer-based banking malware was the only form of banking malware and has shifted to the Android equivalent a few years later .


Uptycs research team has discovered a malware family that controls its operations over the messaging service Telegram.


Dolkun lsa Chairman of the Executive Committee Word Uyghur Congress ” While the victim reads this fake message , the malware secretly reports the infection to a command-and-control server .


A backdoor also known as: Ransom_Blulock.R002C0CKC17 Trojan.Ransomlock.AI Ransom_Blulock.R002C0CKC17 Win32.Worm.FlyStudio.C not-a-virus:RiskTool.Win32.FlyStudio.awnz Trojan.Win32.Z.Strictor.901632.H TrojWare.Win32.FlyStudio.~UJ Trojan.Winlock.11779 TR/Strictor.901632.1 Trojan.Strictor.DC183 not-a-virus:RiskTool.Win32.FlyStudio.awnz Ransom:Win32/Blulock.A Trojan/Win32.Ransomlock.R135596 Trojan.FlyStudio Trj/CI.A Trojan.Win32.Winlock.f Ransom.FUL!tr


SpyNote RAT builder The SpyNote Remote Access Trojan ( RAT ) builder is gaining popularity in the hacking community , so we decided to study its pervasiveness .


A backdoor also known as: Trojan.Pucedoor.Win32.63 Troj.W32.Pucedoor!c W32/Trojan.MNET-5041 Trojan.Pucedoor Trojan.Win32.Pucedoor.aa Trojan.Win32.AD.eoqlfa Trojan.Win32.Z.Pucedoor.15360 Trojan.Pucedoor.d TR/Pucedoor.hopld Trojan/Win32.Pucedoor Trojan:Win32/Mirsonk.A Trojan.Mikey.D109B5 Trojan.Win32.Pucedoor.aa Trojan/Win32.Pucedoor.R216811 Trj/CI.A Win32.Trojan.Pucedoor.Sxxz Win32/Trojan.Proxy.62e


A backdoor also known as: Trojan/MSILPack.a Trojan.MSIL.VB!/kGPqcrNINQ TROJ_FAM_0000b54.TOMA Packed.MSIL.MSILPack.a Worm.Win32.Rebhip!IK Packed:W32/DonutCrypt.A Trojan.MulDrop1.40622 TROJ_FAM_0000b54.TOMA Packed.MSIL.is TrojanDropper:MSIL/VB.K Packed/Win32.MSILPack Worm.Win32.Rebhip MSIL/AntiAV.NET!tr Trj/Dropper.AJX


A backdoor also known as: Backdoor.Senna KIT/SennaSpy.30 HackTool[Constructor]/Win32.SennaSpy VTool.SennaSpy.30.kcloud Constructor:Win32/Sennaspy.3_0 Constructor.Win32.SennaSpy Win32/Constructor.Spy.58d


We also discovered, based on the samples we gathered, that the malware, which we call CloudTap, has been in use for over a year.


Last week Forcepoint tracked an interesting e-mail campaign that was distributing double zipped files with Windows Script Files WSFs inside.


Symantec has blocked attempts to infect customers in Poland, Mexico and Uruguay by the same exploit kit that infected the Polish banks.


A backdoor also known as: Backdoor/Small.acc Backdoor.Trojan Backdoor.Win32.Small.acc Trojan.Win32.Small.gcwll Backdoor.W32.Small.acc!c Win32.Backdoor.Small.Egnw Backdoor.Small.Win32.7271 Backdoor/Small.dwv BDS/Dalbot.147456 Trojan[Backdoor]/Win32.Small Backdoor.Win32.A.Small.147456 Backdoor.Win32.Small.acc Trojan/Win32.Dalbot.C330242 Backdoor.Small W32/Small.ACC!tr.dldr


They are known to run watering hole and spearphishing campaigns to better pinpoint their targets.


An investigation by Wiz Threat Research has revealed that tens of thousands of websites in East Asia have been hijacked, redirecting users to adult-themed content over the last few months.


A backdoor also known as: W32.FamVT.ExpiroPC.PE Trojan.Symmi.D5257 Troj.Downloader.W32!c Trojan.Click2.53876 BehavesLike.Win32.Comame.pc TrojanProxy:Win32/Potukorp.A Trj/CI.A W32/Farfli.WF!tr


A backdoor also known as: Trojan.Dynamer.S467543 Trojan.Injector.Win32.474808 Trojan/Injector.dkps Trojan.Zbot.191 Win32.Trojan.WisdomEyes.16070401.9500.9969 Ransom_NATAS.SM1 Win.Ransomware.Satan-5713061-0 Trojan.Win32.DKPS.elolak Trojan.Win32.Z.Satan.189345 TrojWare.Win32.Lepoh.A Trojan.Packed2.39908 Ransom_NATAS.SM1 BehavesLike.Win32.Trojan.cc Ransom:Win32/Nasan.B!bit Ransom.Satan/Variant Trojan.Packed Ransom.Satan Win32/Filecoder.Natas.A Win32.Trojan.Filecoder.Hqlr Trojan-Ransom.Satan Win32/Trojan.BO.91d


A backdoor also known as: Trojan.Selfdel.B7 PUP.Optional.InstallMonster Win32.Trojan.Kryptik.zv Trojan.Win32.InstallCube.echedc Application.Win32.ICLoader.VAL Trojan.InstallCube.1058 Trojan.Win32.Crypt Trojan.ExtenBro.od Pua.Downloadmanager GrayWare[AdWare]/Win32.SmartInstaller Trojan.Barys.DD4DA Trojan:Win32/Selfdel.B PUP/Win32.ICLoader.R181040 TScope.Malware-Cryptor.SB Trj/CI.A Trojan.ExtenBro! Win32/Trojan.d13


A backdoor also known as: Ransom.SintaCry BehavesLike.Win32.Trojan.tc Ransom:Win32/SintaCry.A Win32.Trojan-Ransom.CryPy.C Trojan/Win32.CryptXXX.C1966139 Python/Filecoder.AB Trojan.Win32.CryPy.a


A backdoor also known as: HW32.Packed.7656 Spyware.OnlineGames Trojan.Barys.156 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32.Application.PUPStudio.A BehavesLike.Win32.Backdoor.tc TrojanDownloader:Win32/Neglemir.A PUA.RiskWare.DYAMAR


A backdoor also known as: W97M/Downloader.clk W97M.Downloader W2KM_POWLOAD.UHAOEBF Macro.Trojan.Dropperd.Auto W2KM_POWLOAD.UHAOEBF W97M/Downloader.ciz Malicious_Behavior.SB virus.office.qexvmc.1070


A backdoor also known as: TrojanDownloader.Rovnix.AB4 Trojan.Rovnix Trojan/Rovnix.af Trojan.Cidox.E TROJ_ROVNIX.SMA0 Win.Trojan.Rovnix-7 Trojan.Win32.Rovnix.dxtqfl Trojan.Win32.Z.Rovnix.78336.D[h] Trojan.Rovnix.Win32.624 TROJ_ROVNIX.SMA0 Trojan.Rovnix.cl W32/Rovnix.AG!tr Trojan/Win32.Rovnix Trojan.Razy.D3C8A Troj.W32.Rovnix!c Trojan/Win32.Rovnix TrojanDownloader:Win32/Rovnix.A Trojan.Win32.Rovnix.jg Trojan.Rovnix!Bc+f/jzbrBg Trojan.Win32.Rovnix Atros2.AGYW Trj/Rovnix.B Win32/Trojan.bb6


While we do not know for sure the source of these details, they frequently appear on public websites, such as LinkedIn or the company's own website.


A backdoor also known as: TrojanDownloader.Delf Downloader.Delf.Win32.55939 Win.Trojan.Delf-6394424-2 Trojan-Downloader.Win32.Delf.kqql Trojan.Win32.Delf.evdbxm Trojan.Win32.Z.Delf.912896 Troj.Downloader.W32.Delf!c Trojan.DownLoad3.47593 Trojan-Downloader.Win32.Delf W32/Trojan.NTEF-5615 TR/Downloader.lpmfp Trojan-Downloader.Win32.Delf.kqql Downloader/Win32.Delf.C2285081 Trj/GdSda.A Win32.Trojan-downloader.Delf.Ammc W32/Delf.CGH!tr.dldr


In this case , the device should be re-flashed with an official ROM .


The Trojan stores information about C & C servers and the data harvested from the infected device in a local SQLite database .


A backdoor also known as: Exp.SWF.CVE-2017-11292.1 Trojan.Maljava SWF/Exploit.CVE-2017-11292.A DOC.Z.CVE-2017-1129.10752 Exploit.CVE-2017-11292.1 SWF_EXPLOIT.YYRZ Trojan.DWCI-31 EXP/CVE-2017-11292.B Trojan[Exploit]/SWF.CVE-2017-11292.a Trojan:O97M/Gamafeshi.A Trojan.SWF.Exploit


The hacker proceeded to leak archives of internal Hacking Team tools and communications.


This means that the malware can do anything from harvest the user 's banking credentials , to monitoring the device 's location .


addWifiConfig method code fragments ‘ camera ’ – this command records a video/capture a photo using the front-facing camera when someone next unlocks the device .


A backdoor also known as: Backdoor/W32.Small.8192.U Backdoor.Win32.Small!O Backdoor.Small Backdoor/Small.aad BKDR_SMALL.LIY Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/MalwareS.BJDC BKDR_SMALL.LIY Win.Trojan.Small-15022 Backdoor.Win32.Small.aad Trojan.Win32.Small.cgfnz Backdoor.Win32.A.Small.8192.J Backdoor.Win32.Small.~C W32/Risk.EHGV-6738 Backdoor/Small.cqd W32.Malware.Downloader BDS/Small.L Trojan[Backdoor]/Win32.Small Backdoor.W32.Small.aad!c Backdoor.Win32.Small.aad Backdoor:Win32/Neporoot.A Trojan/Win32.Downloader.C113283 Backdoor.Small Trj/CI.A Win32.Backdoor.Small.Eckj Trojan.DL.Troxen!zKvgG9AM1Ro Backdoor.Win32.Small W32/CMDer.AA!tr


A backdoor also known as: Worm.Skypii Trojan/Injector.aech Trojan.Johnnie.D5D69 W32.Phopifas Win.Trojan.Zbot-63011 Trojan-Dropper.Win32.Injector.tsab Trojan.Win32.Zbot.crqlec Trojan.Win32.Z.Johnnie.44972 Trojan.MulDrop2.64582 Trojan.Win32.Injector W32/Trojan.GAQU-5890 TR/Buzus.A.287 Worm:Win32/Skypii.A Trojan-Dropper.Win32.Injector.tsab Trojan/Win32.Inject.R57535 BScope.Adware.Softpulse Win32.Trojan-dropper.Injector.Hyah W32/Inject.AEC!tr Win32/Trojan.Downloader.31f


Note that in almost all cases , this payload file , contained in zip archives , is named ‘ setting ’ or ‘ setting.o ’ .


A backdoor also known as: Trojan.Brancud Dropper.Wlord.Win32.197 Trojan/Dropper.Wlord.vg Trojan.Barys.D14BD W32/Backdoor2.FFAV Win.Trojan.Delf-10381 Trojan.Win32.Pigeon.edgwvf NetWorm.Win32.Kolab.~F BackDoor.Pigeon.14364 BehavesLike.Win32.HLLP.vc Trojan.Win32.ProcessHijack W32/Backdoor.UDBV-8754 Win32.Troj.Wlord.vg.kcloud Spyware.Wlord.Dr.2888704 TrojanDropper.Wlord Win32/TrojanDropper.Delf.NQG Win32.Trojan-dropper.Wlord.Wncj Trojan.DR.Wlord!ooBDWiiijA4 Win32/Trojan.f50


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9947 Trojan.Razy.D1B384 Backdoor:MSIL/Gataspi.A Backdoor.NanoCore Trj/GdSda.A


A backdoor also known as: Backdoor.Win32.Proxyier!O DNSChanger.cw Trojan.Zusy.Elzob.D136F TROJ_DNSCHANGER_0000063.TOMA Win32.Trojan.WisdomEyes.16070401.9500.9713 TROJ_DNSCHANGER_0000063.TOMA Win.Trojan.B-445 Backdoor.Win32.Simda.ph Trojan.Win32.Simda.bxootp Backdoor.Proxyier.Win32.9 BehavesLike.Win32.Backdoor.fc Backdoor/Proxyier.o Trojan/Win32.Proxyier Trojan:Win64/Simda.A Backdoor.Win32.Simda.ph Trojan/Win32.Jorik.R13830 SScope.Trojan-Proxy.1821 Trojan.FakeAlert Trojan.Win32.FakeAV W32/Binder.RZ!tr


The malware infected a wide spread of Android users in China, stealing their bank credentials and other sensitive personal information.


Like many other bankers , they were disguised as apps for popular free ad services in Russia .


UrlZone is a banking trojan that appeared in 2009.


There has been considerable discussion about domain fronting following the release of a paper detailing these techniques.


This attack was dubbed Dark Seoul'; it involved wreaking havoc on affected systems by wiping their hard drives, in addition to seeking military intelligence.


Last week, Patrick Wardle published a very nice analysis of a new Backdoor and Dropper used by HackingTeam, which is apparently alive and well.


Indicators imply an exploitation attempt, that may not have been successful.


A backdoor also known as: Pdf.Fareit.A PDF/PowerShell.C Exploit.PDF.16243 HEUR_PDF.PS TrojanDownloader:Win32/Perferd.A PDF/Exploit.S3 PDF/PowerShell.ECC!tr


A backdoor also known as: Trojan.Python.Simplified.b Trojan.Py2Exe.HackSpy.ekhfvk Trojan.DownLoader25.20169 Trojan.Python.Simplified.b Trojan:Win32/Pitroj.A Trj/CI.A Win32.Trojan.Simplified.Dxmm W32/Python_Simplified.B!tr Win32/Trojan.IM.2b4


Over the past month, Palo Alto Networks has observed two spam campaigns targeting users residing in Italy.


possibly working independently while sharing information between themselves, are exploiting the Elasticsearch vulnerability primarily to establish widespread DDoS botnet infrastructures.


A cross-platform win32-based Mirai spreader and botnet is in the wild and previously discussed publicly.


When DualToy began to spread in January 2015, it was only capable of infecting Android devices.


This group is well known for a widely publicized attack involving the compromise of Forbes.com, in which the site was used to compromise selected targets via a watering hole to a zero-day Adobe Flash exploit.


For example, intended victims frequently have titles of Chief Financial Officer, Head of Finance, Senior Vice President, Director and other high level roles.


Links returned by a Google search, however, are not guaranteed to be safe.


This paper has already stated that we believe the Dukes to be a Russian state-sponsored cyberespionage operation .


This file contains all HTML , CSS and PNG files necessary to create overlays . However , the group behind MuddyWater has been known to target other countries in the Middle East , Europe and the US . Derusbi : File Type :P E32 executable ( DLL ) Intel 80386, for MS Windows . UNC2639 was first identified exploiting multiple zero - day vulnerabilities in Microsoft Exchange in early March 2021 .


The technique PLATINUM uses to inject code via hot patching was first documented by security researchers in 2013.7 Administrator permissions are required for hot patching , and the technique used by PLATINUM does not attempt to evade this requirement through exploitation . Based on Kaspersky Lab 's analysis of NetTraveler 's C&C data , there were a total of 350 victims in 40 countries across including the United States , Canada , United Kingdom , Russia , Chile , Morocco , Greece , Belgium , Austria , Ukraine , Lithuania , Belarus , Australia , Hong Kong , Japan , China , Mongolia , Iran , Turkey , India , Pakistan , South Korea , Thailand , Qatar , Kazakhstan , and Jordan .


The implant can log in to the attackers email inbox , parse emails for commands in a special “ Cmd ” folder and save any payloads to a device from email attachments . Bankshot was first reported by the Department of Homeland Security on December 13 , 2017 , and has only recently resurfaced in newly compiled variants . APT33 : 6401abe9b6e90411dc48ffc863c40c9d9b073590a8014fe1b0e6c2ecab2f7e18 S-SHA2 SniffPass . This enables GOGETTER to maintain persistence across reboots .


PROMETHIUM is an activity group that has been active since at least 2012 . The attackers have targeted a large number of organizations globally since early 2017 , with the main focus on the Middle East and North Africa ( MENA ) , especially Palestine .


We expect it to churn out new variants with even more sophisticated techniques . traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors . TAU modified the original HexRaysDeob to make it work for APT10 ANEL obfuscations . In the case of a traditional ProxyNotShell exploit chain , the attack sequence is done in two steps :


It has several protections in place , both in the C2 and the malware 's code . An additional campaign has also been observed targeting Japanese entities . The actor behind the ShadowPad incident has been publicly identified by Microsoft in court documents as BARIUM . Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns ( e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s ) ) .


This vulnerability was found in a document named Trump's_Attack_on_Syria_English.docx” . OurMine is well known : They hijacked WikiLeaks' DNS last month shortly after they took over HBO 's Twitter account ; last year , they took over Mark Zuckerberg 's Twitter and Pinterest accounts ; and they hit both BuzzFeed and TechCrunch not long after that .


Decrypting the assets After being decrypted , the asset turns into the .dex file . RoyalDNS - required APT15 . The image file “order.jpg” contained in the first ZIP structure is actually a non-malicious PNG formatted image . Therefore , there are cases where these vulnerabilities are accessible via the internet .


The infographic in Figure 1 traces the earliest known dates on which TA505 began distributing particular malware strains , beginning with Dridex in 2014 and most recently when they elevated GlobeImposter and Philadelphia from small , regionally targeted ransomware variants to global threats .


For more information related to HIDDEN COBRA activity , go to https://www.us-cert.gov/hiddencobra .


Dubbed ‘Operation Sheep’ , this massive data stealing campaign is the first known campaign seen in the wild to exploit the Man-in-the-Disk vulnerability revealed by Check Point Research earlier last year . The targets and themes of Bahamut 's campaigns have consistently fallen within two regions – South Asia ( primarily Pakistan , specifically Kashmir ) and the Middle East ( from Morocco to Iran ) .


] net is not awfully well maintained or updated to the latest apps available . Henkel confirms the Winnti incident and issues the following statement: The cyberattack was discovered in the summer of 2014 and Henkel promptly took all necessary precautions . While attribution of the first two spear phishing attacks is still uncertain , we attribute the second December phishing campaign to the China-based APT group that we refer to as APT16 .


Donot , named and tracked by PatchSky , is an attack group that mainly targets countries such as Pakistan in South Asia . Early in Q2 , Kaspersky identified an interesting Lazarus attack targeting a mobile gaming company in South Korea that we believe was aimed at stealing application source code . In a recent campaign , Kaspersky observed ScarCruft using a multi-stage binary to infect several victims and ultimately install a final payload known as ROKRAT – a cloud service-based backdoor . ESET recently analyzed a new Mac OS sample from the OceanLotus group that had been uploaded to VirusTotal . The threat actor behind the campaign , which Kaspersky believes to be the PLATINUM APT group , uses an elaborate , previously unseen , steganographic technique to conceal communication . FireEye defined APT40 as the Chinese state-sponsored threat actor previously reported as TEMP.Periscope , Leviathan and TEMP.Jumper . In January , Kaspersky identified new activity by the Transparent Tribe APT group aka PROJECTM and MYTHIC LEOPARD , a threat actor with interests aligned with Pakistan that has shown a persistent focus on Indian military targets . OceanLotus was another actor active during this period , using a new downloader called KerrDown , as reported by Palo Alto . ESET recently uncovered a new addition to OceanLotus’s toolset targeting Mac OS . In mid-2018 , Kaspersky's report on Operation AppleJeus” highlighted the focus of the Lazarus threat actor on cryptocurrency exchanges . Kaspersky also observed some activity from Gaza Team and MuddyWater . Kaspersky wrote about LuckyMouse targeting national data centers in June . Kaspersky also discovered that LuckyMouse unleashed a new wave of activity targeting Asian governmental organizations just around the time they had gathered for a summit in China . Kaspersky have observed similar activity in the past from groups such as Oilrig and Stonedrill , which leads us to believe the new attacks could be connected , though for now that connection is only assessed as low confidence . In August 2019 , FireEye released the Double Dragon” report on our newest graduated threat group , APT41 . Today , FireEye Intelligence is releasing a comprehensive report detailing APT41 , a prolific Chinese cyber threat group that carries out state-sponsored espionage activity in parallel with financially motivated operations . Group-IB experts continuously monitor the Silence’ activities . Group-IB has uncovered a hacker group , MoneyTaker , attacking banks in the USA and Russia . Group-IB reveals the unknown details of attacks from one of the most notorious APT groups , Lazarus . Finally , Kaspersky produced a summary report on Sofacy’s summertime activity . Kaspersky were also able to produce two reports on Korean speaking actors , specifically involving Scarcruft and Bluenoroff . Analysis of the payload allowed us to confidently link this attack to an actor Kaspersky track as BlackOasis . Kaspersky first became aware of BlackOasis’ activities in May 2016 , while investigating another Adobe Flash zero day .


Threat Actor Profile : TA505 , From Dridex to GlobeImposter .


November 16 , 2016 In what 's being chalked up as an apparent mistake , more than 120,000 Android phones sold in the U.S. were shipped with spying code that sent text messages , call logs and other sensitive data to a server in Shanghai . This slight delay may point to the handing over of active exploitation duties to other operator(s) in a multi-team APT10 effort within the Ministry of State Security for the attack . The actor embedded malicious code to a resource section of the legitimate SFX file created by a file encryption tool , and modified the entry point of the program for jumping to the malicious code soon after the SFX program starts .


Also , by creating this type of API access , Turla could use one accessible server as a single point to dump data to and exfiltrate data from . Since late 2018 , based upon the most-recent posting , FireEye appears to have " walked back " the previously-used terminology of TEMP.Veles and instead refers rather cryptically to the " TRITON actor " , while Dragos leveraged identified behaviors to consistently refer to an activity group , XENOTIME .


] databit [ . In late September 2015 Mofang used the website of Myanmar 's national airline hosted at www.flymna.com for an attack against an organization in Myanmar . The sample 832f5e01be536da71d5b3f7e41938cfb shares code with an older Aumlib variant with the hash cb3dcde34fd9ff0e19381d99b02f9692 . Based on our telemetry , we have identified an array of affected victims including US - based retailers , local governments , a university , and an engineering firm .


It is also possible that this functionality is under development , making this placeholder code incomplete . Cylance determined that the ‘Ghost Dragon’ group utilized specifically tailored variants of Gh0st RAT , which the group modified from the 3.6 version of the source code released in 2008 . The first three are generated by rand() and the fourth is computed based on the first and third .


As the previous picture demonstrated , the followed Vector object ’s length field being overflowed as 0x80007fff , which enables the attacker to read/write arbitrary data within user space .


The malware basically provides a remote CMD/PowerShell terminal for the attackers , enabling them to execute scripts/commands and receive the results via HTTP requests . During the months that followed in which we tracked Confucius' activities , we found that they were still aiming for Pakistani targets .


The Hillary Clinton email leak was the center of the latest scandal in the news caused by Threat Group-4127 ( TG-4127 ) .


The bootkit Android.Oldboot has infected more than 350,000 android users in China , Spain , Italy , Germany , Russia , Brazil , the USA and some Southeast Asian countries . It was a targeted attack we are calling " Machete " . In seeking to identify the organization behind this activity ,our research found that People ’s Liberation Army ( PLA ’s ) Unit 61398 is similar to APT1 in its mission , capabilities , and resources . Clients using Internet Explorer version 8 are served with “ about.htm ” , for other versions of the browser and for any other browser capable of running Java applets , the JavaScript code loads “ JavaApplet.html ” .


NOVEMBER 2016 , The OSCE confirmed that it had suffered an intrusion , which a Western intelligence service attributed to APT28 .


The group Magic Hound is linked via infrastructure and tools to the Rocket Kitten threat actor group although Palo Alto cannot confirm the extent of any relationship between the two groups .


APT35 typically targets U.S. and the Middle Eastern military , diplomatic and government personnel , organizations in the media , energy and defense industrial base ( DIB ) , and engineering , business services and telecommunications sectors . In wake of these events , a security firm Resecurity reached out to NBC news and claimed that they had reasons to believe that the attacks were carried out by Iranian-linked group known as IRIDIUM .


It appears that the group values hardcoded into the malware is associated with the targeted organization , as several are Saudi Arabian organizations within the telecommunications and defense industries . From our first malicious sample encounter back in mid-September until now , we have observed 12 infected applications , the majority of which are in the system utility category .


Additional capabilities of the More_eggs malware include the download and execution of files and scripts and running commands using cmd.exe . Dokument 09.06.2017.zip .


Cannon acknowledges the receipt of file download by sending an email to sahro.bella7@post.cz with l.txt ( contains 090 string ) as the attachment , ok2 within the body and a subject with the unique system identifier via SMTPS from one of the three accounts from Step 1 .


These malware pose as legitimate Facebook or Chrome applications . The targeting of Pakistan , Bangladesh , Sri Lanka , Maldives , Myanmar , Nepal , and the Shanghai Cooperation Organization are all historical espionage targets by India . Generic : aafa83d5e0619e69e64fcac4626cfb298baac54c7251f479721df1c2eb16bee7 Trojan S-MAL/Downloader ( Executable file ) .


One method , which was popular in Germany , is known as mobile TAN ( mTAN ) . Related or not , one thing is certain : the actor ( s ) using these customized BlackEnergy malware are intent on stealing information from the targets . Since May 2016 , we have continued to monitor and uncover various attacks and tools associated with the OilRig group .


QiAnXin identified this APT group coded as ‘APT-C-35’ in 2017 , who is mainly targeting Pakistan and other South Asian countries for cyber espionage . In total , Scattered Canary received more than 3 , 000 account credentials as a result of their phishing attacks . For over eighteen months from March 2017 until November 2018 , Scattered Canary’s frequent enterprise-focused credential phishing campaigns almost exclusively targeted businesses in the United States and Canada . In July 2018 , following a trend we have observed across the entire BEC threat landscape , Scattered Canary changed their preferred cash out mechanism from wire transfers to gift cards . Instead of using fake Google Docs phishing pages to collect personal email login credentials , Scattered Canary began using phishing pages of commonly used business applications to compromise enterprise credentials . Using personal information obtained from various sources , Scattered Canary started perpetrating fraud against US federal and state government agencies . In total , 35 actors have been tied to Scattered Canary’s operations since the group emerged in 2008 . Just as with romance scams , actors make use of scripts and templates they can copy-and-paste without having to create something on their own . When it comes to engaging targets , Scattered Canary frequently maximized efficiencies through the use of scripts , or as some members of the group call them , formats.” These formats are templated text documents that can contain several layers of phishing messages to send to potential victims . Recently , we unveiled the existence of a UEFI rootkit , called LoJax , which we attribute to the Sednit group . If Scattered Canary can be seen as a microcosm for the rapidly evolving organizations behind today’s most pernicious email scams , this report demonstrates that a much more holistic approach—one based on threat actor identity rather than type of fraudulent activity—is required to detect email fraud and protect organizations . This is a first for an APT group , and shows Sednit has access to very sophisticated tools to conduct its espionage operations . Three years ago , the Sednit group unleashed new components targeting victims in various countries in the Middle East and Central Asia . In the past , Sednit used a similar technique for credential phishing . At the end of August 2018 , the Sednit group launched a spearphishing email campaign where it distributed shortened URLs that delivered the first stage of Zebrocy components . As we explained in our most recent blogpost about Zebrocy , the configuration of the backdoor is stored in in the resource section and is split into four different hex-encoded , encrypted blobs . The past iteration of SLUB spread from a unique watering hole website exploiting CVE-2018-8174 , a VBScript engine vulnerability . It used GitHub and Slack as tools for communication between the malware and its controller . On July 9 , we discovered a new version of SLUB delivered via another unique watering hole website . This malicious site used CVE-2019-0752 , an Internet Explorer vulnerability discovered by Trend Micro’s Zero Day Initiative ( ZDI ) that was just patched this April .


At the time of writing , to our knowledge no other third-party app stores , nor the official Google Play store , were or are hosting this malicious HenBox variant masquerading as DroidVPN . Far from attacking Henkel and the other companies arbitrarily , Winnti takes a highly strategic approach . APT16 actors sent spear phishing emails to two Taiwanese media organizations .


The oldest app of the second campaign was last updated in April 2016 , meaning that the malicious code hid for a long time on the Play store undetected . Their operations against gaming and technology organizations are believed to be economically motivated in nature . It starts by initializing a random number generator and reading 100 bytes inside the ZxShell Dll at a hardcoded location . Using tools that are more lightweight and generic than those observed in prior OT incidents , the actor likely decreased the time and resources required to conduct a cyber physical attack .


Mobile devices are at the frontier of cyber espionage , and other criminal motives . Also our visibility as a vendor does not cover every company in the world ( at least so far ; ) ) and the Kaspersky Security Network ( KSN ) did not reveal other attacks except those against gaming companies . The plugin registry key HKLM\SYSTEM\CurrentControlSet\Control\zxplug is opened and each value is queried . RA Group , in its ongoing campaigns , has targeted the U.S. , South Korea , Taiwan , the U.K. and India across several business verticals , including manufacturing , wealth management , insurance providers , pharmaceuticals and financial management consulting companies .


further straining the relationship between Hamas and the Palestinian Authority who governs the West Bank .


The result of the password validation will always be wrong , but after the apparent validation attempt , the decoy PDF document is opened .


In the examined version , it was downloaded from : hxxp : //url [ . The malware starts communicating with the C&C server by sending basic information about the infected machine . Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates ( UAE ) government , but that has not been confirmed .