The iframe leads to Angler EK which downloads Bedep ad-fraud which then downloads a Gootkit loader.


A backdoor also known as: Trojan.Razy.D3D173 Win32.Trojan.WisdomEyes.16070401.9500.9961 Ransom_Nymaim.R002C0DAT18 Ransom_Nymaim.R002C0DAT18 Ransom:Win32/Nymaim.F Win32/Trojan.160


Based on our investigation, the actors behind Operation C-Major were able to keep their Android malware on Google Play for months and they advertised their apps on Facebook pages which have thousands of likes from high profile targets.


A backdoor also known as: Trojan/W32.MMTask.59905 Trojan/PSW.Mmtask.a Trojan.Heur.GM.040605A000 Win32.Trojan.WisdomEyes.16070401.9500.9759 W32/Trojan.ALHG-3475 Win.Trojan.Mmtask-1 Trojan-PSW.Win32.Mmtask.a Trojan.Win32.Mmtask.glty Trojan.Win32.MMTask.59905 Troj.PSW32.W.Mmtask.a!c TrojWare.Win32.PSW.MMTask.A Trojan.MMTask.1 BehavesLike.Win32.PWSZbot.qc Trojan/PSW.MMTask.a TR/PSW.MMTask.A1 Trojan[PSW]/Win32.Mmtask PWS:Win32/MMTask.A Trojan-PSW.Win32.Mmtask.a TrojanPSW.Mmtask Win32/PSW.MMTask.A Win32.Trojan-qqpass.Qqrob.Wuhe Trojan.PWS.Mmtask!shxUVb0b7bE Trojan-PWS.Win32.Mmtask W32/Bdoor.BG!tr


Usually , when users are already infected with malware like TrickBot on their desktop , they will see a web injection asking for their mobile device operating system ( OS ) type and phone number .


A backdoor also known as: Heur.Corrupt.PE W32.Backdoor.Rbot Trojan:Win32/Damingvat.A.dam#2 Backdoor/Win32.Graybird.C918907


REQUEST_IGNORE_BATTERY_OPTIMIZATIONS - whitelist the app to allow it to ignore battery optimizations .


As Riltok shows , cybercriminals can apply the same methods of infection to victims in different countries with more or less the same success .


A backdoor also known as: Trojan-Spy/W32.Banker.113430.B Heur.Win32.VBKrypt.3!O Trojan.Tinba.F3 Trojan.Tinba.Win32.1756 Trojan/Injector.bzpp Win32.Trojan.WisdomEyes.16070401.9500.9974 W32.Cridex.B TROJ_TINBA.SMH Win32.Trojan.Emotet.U Trojan.Win32.VB.dmqp Trojan.Win32.Tinba.euqtlz Troj.W32.VBKrypt.tpek Trojan.PWS.Tinba.161 TROJ_TINBA.SMH BehavesLike.Win32.Emotet.cm Trojan/Banker.Tinba.amp TR/Tinba.A.843 Trojan[Banker]/Win32.Tinba Trojan.Win32.VB.dmqp Trojan/Win32.Cridex.R197444 TrojanBanker.Tinba Trojan.PWS.Tinba! Trojan-Banker.Emotet W32/Injector.BZJE!tr


A backdoor also known as: W32.HfsAutoB.CD60 Downloader.Bagle.Win32.491 Trojan/Downloader.Bagle.atn Trojan.Win32.Bagle.dswqdy Troj.Downloader.W32.Bagle.atn!c Trojan.Packed.650 Trojan-Downloader.Win32.Bagle TrojanDownloader.Bagle.bfu Worm/Win32.Bagle.R767 Trojan.DL.Bagle!+mahMemQ9a4 W32/Bagle.ATN!tr.dldr Trj/CI.A Win32/Trojan.2ff


Although this injector is new, there are some connections to its older version sharing some similarities.


Proofpoint calls the two new variants recently identified Forked and Lite IcedID.


Blackhole's author, Paunch, was arrested in October 2013 and while criminals kept using the kit for the next few months, the exploits slowly deprecated and lost value because of lack of development.


We named this family Kemoge due to its command and control CnC domain


According to its profile at Google Play ( see Figure 2 ) the app reached a mere 10+ downloads .


Rotexy may start requesting device administrator privileges again in an infinite loop ; in that case , restart the device in safe mode and remove the malicious program .


A new campaign is up and running using newly improved , significantly more powerful malware as compared to previous versions .


There has been significant media attention around a campaign likely by a nation-state actor targeting energy organizations in the U.S. including entities operating nuclear facilities.


A backdoor also known as: W97M.Downloader.XL W97M/Downloader.buv W97M.Downloader W2KM_DLOADER.AUSUAY Trojan.Ole2.Vbs-heuristic.druvzi W97M.S.Downloader.217088 W97M.MulDrop.158 W2KM_DLOADER.AUSUAY W97M/Downloader.buv TrojanDropper:O97M/Turla.A!dha virus.office.qexvmc.1080


A backdoor also known as: Trojan.Delfinject.18174 Win32.Trojan.WisdomEyes.16070401.9500.9930 Trojan.Win32.Banker.dnoogt Trojan.DownLoader12.55999 BehavesLike.Win32.Dropper.dm W32/Trojan.XESH-6077 TrojanDownloader.Banload.bimh TR/Dldr.Banload.ybjwz TrojanDownloader:Win32/BrobanKew.A TrojanBanker.Banker Trj/CI.A Win32/TrojanDownloader.Banload.VDB Trojan-Downloader.Win32.Banload W32/Banload.VGG!tr.dldr Win32/Trojan.994


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9840 Trojan:Win32/ShadowPad.E!dha


A backdoor also known as: Trojan.Win32.FakeAv.exgvmw Virus.W32.Virus!c TROJ_KRYPTIK_HA230029.UVPM Trojan.Win32.Crypt Trojan.Banker.GozNym.ey Trojan[Banker]/Win32.GozNym TrojanDownloader:Win32/Nymaim.K Trj/GdSda.A W32/Kryptik.GCCW!tr


The current phase of the Pawn Storm attack campaign started a little over a month ago, and the overall campaign was first identified in an October 2014 report from Trend Micro PDF.


The Security Service of Ukraine SBU is continuously investigating this active threat, and has issued statements attributing the attacks to specific branches of the Russian Federal Security Service FSB.


A backdoor also known as: Adware.Msidebar TSPY_STARTPAGE_CD100271.RDXN Win32.Trojan.WisdomEyes.16070401.9500.9721 Trojan.ADH.2 TSPY_STARTPAGE_CD100271.RDXN not-a-virus:AdWare.Win32.Loadwar.wmx Riskware.Win32.Loadwar.epwdej Win32.Trojan.Multiple.drwj Trojan.DownLoader7.8701 BehavesLike.Win32.Dropper.cc TR/Msidebar.C.39 GrayWare[AdWare]/Win32.Loadwar not-a-virus:AdWare.Win32.Loadwar.wmx Trojan:Win32/Msidebar.C Trj/CI.A Trojan.Win32.Msidebar Win32/Trojan.1a4


A backdoor also known as: Backdoor.Ehdoor Trojan/Win32.Sharik.R208903 Trj/GdSda.A


A backdoor also known as: Hoax.Win32.ArchSMS!O Tool.ArchSMS.Win32.7363 Trojan/ArchSMS.otfk Trojan.Zusy.D4232C Win32.Trojan.SMSSend.a PUA.PremiumSMSScam!g14 Hoax.Win32.ArchSMS.cpmhw Riskware.Win32.galh.eaqeda Hoax.W32.Archsms!c ApplicUnwnt.Win32.Hoax.ArchSMS.TP Trojan.SMSSend.7500 BehavesLike.Win32.Dropper.vc Hoax.Win32.ArchSMS W32.Trojan.Archsms HackTool[Hoax]/Win32.ArchSMS Trojan:Win32/Tarifarch.AO Hoax.Win32.ArchSMS.cpmhw Unwanted/Win32.ArchSMS.R216870 Win32.Trojan-psw.Archsms.Htcd Trojan.ArchSMS!vRB02EvsodQ Win32/Trojan.SMS.604


Once we reached the non-secured database , we were able to directly observe the app ’ s malicious behavior .


From the beginning of 2015, a malicious spear-phishing campaign dubbed Pony, has been actively luring victims.


Adups addressed the issue in a Nov. 16 news release , writing that some products made by BLU were updated in June with a version of its FOTA that had actually been intended for other clients who had requested an ability to stop text spam .


A backdoor also known as: Trojandownloader.Script W32/Trojan.EMGI-1028 Trojan.Win32.Banload.evocsm Troj.Downloader.Script!c TR/AD.Banload.jxcsg Trj/GdSda.A Win32/Trojan.Downloader.251


] pw/6 * * * * * 5 ” ( It .


When required , the Trojan sends an SMS to the specified phone number with the information it has received from the intercepted message .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9866 Ransom.BTCware Win.Ransomware.BTCWare-6329927-0 Win32.Trojan-Ransom.BTCWare.E Trojan.Win32.Filecoder.eplmfi Trojan.Encoder.11958 BehavesLike.Win32.FDoSBEnergy.dh AdWare.ConvertAd.qjt Ransom.Filecoder/Variant Trojan/Win32.Ransom.R208332 Ransom.BTCWare Trj/GdSda.A Trojan.Win32.BTCWare.a


] net app store henbox_3 Figure 2 HenBox app installed , purporting to be DroidVPN Depending on the language setting on the device , and for this particular variant of HenBox , the installed HenBox app may have the name “ Backup ” but uses the same DroidVPN logo .


File encryption utilized asymmetric Elliptic Curve Cryptography ECC with Curve SECT233R1 a.k.a. NIST B-233 using the Tiny-ECDH open source library combined with a per file Salsa20 symmetric key.


A backdoor also known as: Trojan.Heur.kmGfrjraeapm2 W32/Trojan-Gypikon-based.DM2!Ma BehavesLike.Win32.Downloader.cc W32/Trojan-Gypikon-based.DM2!Ma Trojan/Banker.Banker.zmm Worm:Win32/Xtrat.B!A BScope.Trojan-Spy.Zbot Trj/GdSda.A


The malicious application da.hao.pao.bin ( Chunghwa Post ) loads a library file libmsy.so used to execute the packed mycode.jar file .


An unknown threat actor is leveraging an evasive threat campaign distributed via Discord that features the PureCrypter downloader and targets government entities.


A backdoor also known as: W32.DroxpesLTAN.Trojan Trojan.Qhost Trojan/Qhost.niv TROJ_SPNR.0BFE11 Win32.Trojan.Qhost.d W32/Trojan2.LITU Win32/Tnega.ATUN TROJ_SPNR.0BFE11 Win.Trojan.6761663-1 Trojan.BAT.Qhost.abp Trojan.Win32.KKQP3298.dkyjvz Trojan.Win32.Z.Qhost.33750 Troj.Bat.Qhost!c Trojan.Hosts.43761 BehavesLike.Win32.BadFile.nh Trojan-Dropper.Win32.StartPage W32/Trojan.KKQP-3298 TR/Qhost.mju.53 Trojan.BAT.Qhost.abp Trojan/Win32.Qhost.R77387 Trojan.BAT.Qhost Trj/CI.A BAT/Qhost.NTH Bat.Trojan.Qhost.Lnya Trojan.Comisproc!uAYBYZyFk6g Win32/Trojan.34d


What Does SimBad Do ? ‘ SimBad ’ has capabilities that can be divided into three groups – Show Ads , Phishing , and Exposure to other applications .


A backdoor also known as: W32.VidemoY.Trojan Win32.Trojan.WisdomEyes.16070401.9500.9988 Backdoor.Trojan Win.Trojan.Bifrose-17928 Trojan.Win32.Bifrost.csybxh Troj.W32.Jorik.Arcdoor.bjr!c BackDoor.Bifrost.15005 Trojan.Inject.Win32.22484 Worm.Win32.Msil Trojan:MSIL/Harvbot.B TrojanDropper.Injector Trj/CI.A W32/Jorik_Arcdoor.BJR!tr


A backdoor also known as: Ransom.FireCrypt.A3 Ransom.BleedGreen Ransom_BleedGreen.A Win32.Trojan.WisdomEyes.16070401.9500.9560 Ransom.FireCrypt Ransom_BleedGreen.A Trojan-Ransom.Win32.Crypmodadv.xee Trojan.Win32.Z.Ransom.18432.C[h] Trojan.Encoder.10088 Trojan.Crypmodadv.Win32.90 trojanspy.msil.neos.a W32/Trojan.RPJE-7166 Trojan.Crypmodadv.en TR/Dropper.MSIL.owdes MSIL/Filecoder.DZ!tr Trojan.Ransom.HiddenTears.1 Ransom:Win32/Firecrypt.A Trojan.Ransom.FireCrypt Win32.Trojan.Crypmodadv.Pbpb Trojan.Crypmodadv! Trojan.VB.Inject Atros4.BUNV Trj/GdSda.A Win32/Trojan.Ransom.786


SUSPECTED DETECTION TESTS BY THE THREAT ACTOR In searching for EventBot , we ’ ve identified multiple submissions from the same submitter hash , 22b3c7b0 : EventBot 22b3c7b0 submitter hash The 22b3c7b0 submitter hash that submitted most of the EventBot samples to VirusTotal .


We dubbed this campaign Operation Electric Powder


) Following is the snippet of code in these older Exodus One samples showing the connection to the Command & Control : Below is the almost identical composition of the request to the Command & Control server in mike.jar ( also containing the path 7e661733-e332-429a-a7e2-23649f27690f ) : To further corroborate the connection of the Exodus spyware with eSurv , the domain attiva.exodus.esurv.it resolves to the IP 212.47.242.236 which , according to public passive DNS data , in 2017 was used to host the domain server1cs.exodus.connexxa.it .


The attack comes as an email containing a malicious Google Docs link.


Beginning in early 2008, Iranian security entities have engaged in operations to identify and arrest administrators of illicit websites and social media groups.


The spear phishing emails had Myanmar political-themed lures and , if the 9002 C2 server responded , the Trojan sent system specific information along with the string “ jackhex ” .


The Cybereason Nocturnus team has concluded that EventBot is designed to target over 200 different banking and finance applications , the majority of which are European bank and crypto-currency exchange applications .


to eSurv S.R.L .


Musical Chairs is a multi-year campaign which recently deployed of new variant Gh0st we've named Piano Gh0st.


Odinaff is typically deployed in the first stage of an attack, to gain a foothold onto the network, providing a persistent presence and the ability to install additional tools onto the target network.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9993 W32/Trojan.VVLV-9156 MSIL.Packed.Kryptik.JH Trojan.Win32.Razy.exgpmg BehavesLike.Win32.Trojan.gc Trojan.Razy.D2685F Trojan/Win32.Randrew.C2365157 Trojan-Dropper.MSIL.Small Trj/CI.A Win32/Trojan.24d


Due to TrickMo ’ s persistence implementation mentioned earlier , this lockdown screen persists after a restart and is re-initiated every time the device becomes interactive .


The payload will execute shell code to steal data from various applications .


A backdoor also known as: W97M_DLOADR.XTRQ W97M_DLOADR.XTRQ


A backdoor also known as: Trojan.Kazy.DC9EF Win32.Trojan.WisdomEyes.16070401.9500.9996 W32/Trojan.QFDJ-7788 Backdoor.Trojan Trojan.DownLoader5.32593 Trojan.Small Win32.Troj.Disfa.cv.kcloud Backdoor:MSIL/Sootbot.B Trj/CI.A Win32.Trojan.Downloader.Dyzw BackDoor.WE!tr Win32/Trojan.018


A backdoor also known as: Packer.FSG.A Packer.FSG.A Downloader.WebDown.Win32.23 Troj.Downloader.W32.WebDown.10!c Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Downloader.BFIA TROJ_APHER.A Win.Trojan.Small-10534 Trojan-Downloader.Win32.WebDown.10 Packer.FSG.A Trojan.Win32.WebDown.buycqa Win32.Trojan-Downloader.Webdown.bfes Packer.FSG.A Trojan.DownLoader.2103 TROJ_APHER.A W32/Downloader.MUZI-7025 Trojan/Downloader.WebDown.10 Trojan/Win32.Unknown TrojanDownloader:Win32/Aphex.2_4 Packer.FSG.A Trojan-Downloader.Win32.WebDown.10 Packer.FSG.A Win-Trojan/Apher.1312 Win32/TrojanDownloader.Apher.070 Trojan.DL.WebDown!Zgs3lnw1FbY Trojan-Downloader.Win32.WebDown Trj/Downloader.GE


A backdoor also known as: Trojan.Multi Trojan.MalPack.VB Uds.Dangerousobject.Multi!c Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan-Spy.Win32.SpyEyes.bdxs Trojan.Win32.Z.Fareitvb.933888 BehavesLike.Win32.BadFile.dh Trojan.VB.Crypt TR/Dropper.VB.dtffd Trojan[Spy]/Win32.SpyEyes Trojan-Spy.Win32.SpyEyes.bdxs Trojan/Win32.VBKrypt.R218990 Trj/GdSda.A Win32.Trojan.Inject.Auto Win32/Trojan.Spy.8cb


A backdoor also known as: Trojan.StrictorCS.S483160 Trojan.Graftor.D21F45 Win32.Application.PUPStudio.A HEUR:Trojan.Win32.KillFiles Trojan.Win32.Drop.eaoavd Trojan.Win32.Z.Graftor.614400.AJ Trojan.MulDrop5.12779 Trojan.KillFiles.Win32.6511 W32/Trojan.XBKC-8948 TR/Graftor.905216.18 TrojanDownloader:Win32/WebToos.A HEUR:Trojan.Win32.KillFiles Trojan/Win32.Krap.R106509 TrojanDropper.Sysn Trj/CI.A Trojan.DownLoader! Win32/Trojan.0cb


A backdoor also known as: BackDoor.Dande.52 Trojan.Dande.Win32.1 Trojan.Win32.Dande BDS/Dande.xihzl Trojan.Zusy.D3503B Win32/Dande.A


A backdoor also known as: Trojandropper.Scrop TROJ_DROPPR.YYYJ Trojan-Dropper.Win32.Scrop.cxq Trojan.Win32.Autoit.euuwjs Troj.Dropper.W32.Scrop!c Trojan.DownLoader25.53180 TROJ_DROPPR.YYYJ Trojan.ECCW-6 TR/Autoit.wkswc Trojan[Exploit]/OLE.CVE-2014-6532 Trojan:O97M/Tanequalyn.A Trojan/Win32.AutoIt.C2019675 Win32.Trojan-dropper.Scrop.Pavt W32/Scrop.CO!tr


Interestingly enough, Sourcefire was the only security vendor directly referenced in the Powershell script.


This malware attempts to collect a user's online banking data and sends out information to a control server.


This is what the spear phishing e-mail looked like : In regards to the message text above , multiple activist groups have recently organized a human rights conference event in Geneva .


Since the beginning of 2017, ESET researchers have been conducting an investigation into a complex threat mainly targeting Russia and Ukraine.


A backdoor also known as: AdClicker-O.dr Trojan.Win32.Revop.nbqd W32/TrojanX.HJO Adware.Winpup TROJ_REVOP.A Trojan-Downloader.Win32.VB.ca Trojan.Win32.A.Revop.251830[h] TROJ_REVOP.A AdClicker-O.dr W32/Trojan.MQHB-1521 Win32/TrojanDownloader.VB.CA SPR/Commercials.1 Trojan/Win32.Revop Win32.Troj.Undef.kcloud TrojanDownloader:Win32/VB.CA TrojanDownloader.VB Trj/Multidropper.BJ Win32.Trojan.Revop.cxum Trojan-Downloader.Win32.VB.CA W32/REVOP.A!tr Downloader.VB.EC Trojan.Win32.VB.AhnP


A backdoor also known as: BackDoor-EDY.b Trojan.ExeDot.Win32.325 Trojan/ExeDot.cra Win32.Trojan.WisdomEyes.16070401.9500.9965 TROJ_EXEDOT.SMA Win.Trojan.Exedot-43 Trojan.Win32.ExeDot.dsmyq TrojWare.Win32.ExeDot.L TROJ_EXEDOT.SMA BackDoor-EDY.b Trojan/ExeDot.bs Trojan:Win32/Evadiped.A Trojan/Win32.Unknown Win32.Troj.ExeDot.kcloud Trojan.Heur.E8C832 Trojan:Win32/Evadiped.A Trojan/Win32.ExeDot.R4137 Trojan.ExeDot Trojan.BHO!WIw+XSz27Q8 Trojan.Win32.ExeDot


The main goal of this malware is to steal banking credentials from the victim's device.


Honkbox is an active threat with at least three variants and multiple components, some of which have not been previously documented.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9985 Infostealer.Limitail TSPY_INFILOG.SM TSPY_INFILOG.SM TrojanSpy:MSIL/Grieftylo.A


The iOS and Android apps for Netflix are enormously popular , effectively turning a mobile device into a television with which users can stream full movies and TV programs anytime , anywhere .


The actor responsible for this campaign utilized legitimate digital certificates to sign their tools and employed innovative techniques to cloak their command and control traffic.


A backdoor also known as: W32.TonersyASC.Trojan Ransom/W32.Dcryptor.2415104 Ransom.Mambretor.A5 Trojan.Dcryptor.Win32.2 Troj.Ransom.W32.Dcryptor.toNk Trojan/Filecoder.DCryptor.b Win32.Trojan.WisdomEyes.16070401.9500.9975 W32/HDD_Cryptor.A!Eldorado Ransom.HDDCryptor Win.Ransomware.HDDCryptor-2 Win32.Trojan-Ransom.Mamba.A Trojan-Ransom.Win32.Dcryptor.b Trojan.Win32.Filecoder.elaurk Trojan.Win32.Z.Dcryptor.2415104 Tool.PassView.841 Ransom_HDDCRYPTOR.SM Trojan-Ransom.Mamba W32/HDD_Cryptor.A!Eldorado Trojan.Dcryptor.a TR/FileCoder.rrsau Trojan[Ransom]/Win32.Blocker Trojan.Ransom.HDDCrypt.1 Trojan-Ransom.Win32.Dcryptor.b Ransom:Win32/Mambretor.A Trojan/Win32.Dcryptor.C1564580 Hoax.Dcryptor Ransom.HDDCryptor Trj/CI.A Win32/Filecoder.DCryptor.B Win32/Trojan.f14


These attackers have used additional malware families in previous activity dating to at least 2015 that include PlugX , Zupdax , 9002 , and Poison Ivy .


Disturbingly , the malware establishes a rootkit on the device , allowing it to download and execute any code a cybercriminal would want to run on a device .


A backdoor also known as: Trojan.DL.Banload!wDurcHh4EfA Spyware.Keylogger TROJ_BANLOAD.AET Win32.TRCrypt.Fkm PUA.Packed.PECompact-1 Trojan-Downloader.Win32.Banload.blpr Trojan-Spy.Win32.Bancos!IK Trojan.DownLoader3.52680 TROJ_BANLOAD.AET TrojanDownloader.Banload.awii Downloader/Win32.Banload TrojanDownloader.Banload.blmr Spyware.Keylogger!rem Trojan-Spy.Win32.Bancos W32/Banload.BLPR!tr.dldr Downloader.Banload.BKYW


A backdoor also known as: Trojan.Pugeju Trojan.Win32.Crypt.raab TrojWare.Win32.Inject.~AT BehavesLike.Win32.PUPXAC.lm Trojan-GameThief.Win32.OnLineGames Trojan/Crypt.acz Trojan/Win32.Invader Trj/CI.A Win32/Obfuscated.NBX Win32/Trojan.be7


A backdoor also known as: Trojan.Beaugrit.S16628 Trojan/Spy.Shiz.ncd Win32.Trojan-Spy.Shiz.b Backdoor.Trojan HT_SIMDA_GA310E71.UVPM Trojan.Win32.Ibank.vuhyo TrojWare.Win32.Spy.Shiz.ZV Trojan.PWS.Ibank.373 Trojan.Shiz.Win32.571 HT_SIMDA_GA310E71.UVPM BehavesLike.Win32.Backdoor.fh TR/BAS.Dorkbot.20619344 Trojan.Zusy.Elzob.D21CE PWS:Win32/Simda.K Win32/Spy.Shiz.NCD TrojanSpy.Shiz!qC77/NFCWBg Backdoor.Win32.Simda W32/Shiz.NCD!tr


The cause for this uptick appears due to widespread WordPress site compromises.


A backdoor also known as: W32.Clodfd4.Trojan.50bd Spyware.PasswordStealer TROJ_FRS.0NA000J416 TROJ_FRS.0NA000J416 Trojan.Win32.Z.Securityxploded.418304[h] BehavesLike.Win32.PWSZbot.gh W32/Trojan.ZJJQ-6216 Unwanted/Win32.Passview.C1588969 Riskware.Win32.PassDumper Trj/GdSda.A


This malware abuses the Android accessibility feature to steal user information and is able to update its code and release new features every few days .


A backdoor also known as: W32.Cloda21.Trojan.c461 DLoader.QYW Win32/SillyDl.ACS Trojan.Win32.A.Downloader.146388 Trojan.DownLoader.6702 BehavesLike.Win32.Downloader.cm TrojanDownloader:Win32/Pusrac.A Trojan.Win32.Downloader.AE


Late in the summer of 2016, CrowdStrike Intelligence analysts began investigating a curious Android Package APK named Попр-Д30.apk' which contained a number of Russian language artifacts that were military in nature.


This malware gives attackers an avenue into internal networks which compromised devices are connected to—a notable risk if the device is used to connect to company networks.


In some samples , starting from January 2016 , an algorithm has been implemented for unpacking the encrypted executable DEX file from the assets folder .


Combining timebombs , dynamic code loading , and use of reflection to complicate reverse engineering of the malware .


The Trojan may perform a man-in-the-middle MitM attack on the browser installed on the compromised computer.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9670 Backdoor.Felismus Trojan/Win32.Skeeyah.C1905486 Trj/GdSda.A Trojan.Win32.Tomyjery


A backdoor also known as: Trojan/W32.VBKrypt.208896.AN Trojan.Win32.VBKrypt!O WORM_VOBFUS.SMIA Trojan.Packed.21297 WORM_VOBFUS.SMIA Trojan.Barys.266 Trojan/Win32.VBKrypt.R2844 Worm.Win32.Vobfus


Beginning in July 2015 and possibly earlier, the attack continued into August and is currently ongoing.


A backdoor also known as: Trojan.Constructor.Macro.Ultras.A Constructor.Win32.Ultras.10!O WM/Uck.kit Constructor.W32.Ultras!c Trojan/Constructor.Ultras.10.a Trojan.Constructor.Macro.Ultras.A Ultras.Kit Win.Tool.Macro-8 Trojan.Constructor.Macro.Ultras.A Constructor.Win32.Ultras.10.a Trojan.Constructor.Macro.Ultras.A Riskware.Win32.Ultras-10.hpwc Trojan.Constructor.Macro.Ultras.A Constructor.Macro.Ultras.A Trojan.Constructor.Macro.Ultras.A VirusConstructor.Ultras.2 Tool.Ultras.Win32.1 WM/Uck.kit W32/Tool.QHJM-3031 Constructor.Macro.Ultras.10 TR/ConKit.UltrasUck Constructor.Win32.Ultras.10.a HackTool/Win32.Constructor.C218755 Trojan.Constructor.Macro.Ultras.A Constructor.Ultras Win32.Trojan.Ultras.Pegg Constructor.Win32.Ultras Win32/Trojan.5bd


A backdoor also known as: Win32.Worm.Stration.D Win32.Worm.Stration.D Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32.Worm.Stration.D Email-Worm.Win32.Warezov.k Win32.Worm.Stration.D Win32.Worm.Stration.D Heur.Packed.Unknown Win32.Worm.Stration.D Win32.HLLM.Limar Backdoor.Win32.IRCBot Trojan:Win32/Stration.K Win32.Worm.Stration.D Email-Worm.Win32.Warezov.k


Recently, we detected Carbanak campaigns attempting to:Target high level executives in financial companies or in financial/decision-making roles in the Middle East, U.S. and Europe ,Spear-phishing emails delivering URLs, macro documents, exploit documents,Use of Spy.Sekur Carbanak malware and commodity remote access Trojans RATs such as jRAT, Netwire, Cybergate and others used in support of operations.


A backdoor also known as: W32.QueryexXAAF.Worm Application.Hacktool.AW Worm.Win32.Zombaque!O Worm.Zombaque.A3 WORM_BIZOME.SMD W32.Spybot.Worm Win32/Zombaque.A WORM_BIZOME.SMD Win.Worm.Zombaque-12 Application.Hacktool.AW Worm.Win32.Zombaque.a Application.Hacktool.AW Trojan.Win32.Zombaque.bzuxu Worm.Win32.Zombaque.318464.A Application.Hacktool.AW Application.Hacktool.AW Win32.HLLW.RAhack Worm.Zombaque.Win32.2 BehavesLike.Win32.Sality.fc Worm.Win32.Zombaque Worm/Zombaque.l Worm/Win32.Zombaque Worm:Win32/Zombaque.A Application.Hacktool.AW Worm.Win32.Zombaque.a Worm/Win32.Zombaque.R3338 Worm.Zombaque Win32/Zombaque.A Worm.Win32.Zombaque.a Worm.Zombaque!23w9coTlBlo W32/Zombaque.A.worm


Figure 12 .


In a quick Google search you can find practically anything you need to know.


A backdoor also known as: Trojan.Wdfload.89 Trojan.Win64.Wdfload Trojan.Wdfload.cqq TR/Wdfload.slana Trojan/Win64.Wdfload Trojan/Win64.Wdfload.C2364123 Trj/CI.A W32/Wdfload.AA!tr Win32/Trojan.bfd


A backdoor also known as: Trojan.Downloader Win32.Trojan.WisdomEyes.16070401.9500.9691 Trojan-Downloader.Win32.Injecter.vxy BehavesLike.Win32.PWSZbot.fc W32/Trojan.SBIX-6310 Trojan.Heur.TP.E5F612 Trojan-Downloader.Win32.Injecter.vxy Trj/CI.A Win32/Trojan.03f


A backdoor also known as: Trojan.Pandex Heur.Packed.Unknown Trojan.DownLoad.3750 Heuristic.LooksLike.Win32.Morphine.I VirTool:Win32/Obfuscator.EK Voronezh.1600.A Packed.Morphine.C Trj/CI.A


The threat actor leveraged the CVE-2017-0199 Microsoft Word Office/WordPad Remote Code Execution Vulnerability with carefully crafted decoy content customized for each target recipient.


The first stage would be a malicious link within the e-mail or attachment, containing malicious code, in this case Pony.


Mobile app creators are often looking for ways to monetize their software.


The attackers deliver malware through topically titled spearphises, for example Energy_Data_Meeting_fall_2016.


The source code for Linux.Mirai bot was released a few weeks ago.


A backdoor also known as: Trojan.Graftor.D27EA8 Win32.Trojan.WisdomEyes.16070401.9500.9999 BehavesLike.Win32.Expiro.hc Trojan.Win32.Scar TrojanDropper:Win32/Binko.A W32/Cbot.NCN!tr.bdr Win32/Trojan.Dropper.007


The PureCrypter campaign uses the domain of a compromised non-profit organization as a Command and Control C2 to deliver a secondary payload.


Despite recent progress, the country is subject to ongoing conflict with ethnic rebels and an ongoing civil war.


A backdoor also known as: Backdoor/W32.Bancodor.482816 Backdoor/Bancodor.b BKDR_BADCODOR.A W32/Bancodor.C@bd Backdoor.Badcodor Win32/PSWSpider.G BKDR_BADCODOR.A Win.Trojan.Bancodor-22 Backdoor.Win32.Bancodor.b Trojan.Win32.Bancodor.fzet Backdoor.Win32.A.Bancodor.455260 Backdoor.Win32.Bancodor.~B Trojan.Bancdo Backdoor.Bancodor.Win32.150 W32/Bancodor.NOXQ-3353 Backdoor/Bancodor.b BDS/Badcodor.B.6 Trojan[Backdoor]/Win32.Bancodor Win32.Hack.Bancodor.b.kcloud Backdoor:Win32/Badcodor.B Backdoor.W32.Bancodor.b!c Backdoor.Win32.Bancodor.b Backdoor/Win32.Bancodor.R145952 Backdoor.Bancodor Win32/Bancodor.B Backdoor.Badcodor.A Backdoor.Win32.Bancodor Bck/Bancodor.I


The Trojan drops a PowerPoint presentation that contains details about the 2nd Myanmar Industrial Human Resource Development Symposium.


A backdoor also known as: Trojan.Rincux.AV Trojan.Rincux.AV Win32.Trojan.WisdomEyes.16070401.9500.9998 TROJ_DLOAD.KKK Trojan.Rincux.AV Trojan.Rincux.AV BackDoor.Attack.594 TROJ_DLOAD.KKK Backdoor/Ceckno.awl W32/Downloader.L Trojan.Rincux.AV Trojan.Rincux.AV Backdoor.Ceckno!6jtmdMg8Vqs Virus.Win32.Small


Recently, TrendMicro uncovered a new cyber-espionage attack by a well-funded and organized group targeting companies close to governments and in key industries mostly in Asia.


A backdoor also known as: Win32/AutoRun.Delf.RF Trojan.Win32.Autoruner2.czfwpa Win32.HLLW.Autoruner2.13746 BehavesLike.Win32.Dropper.dc Trojan.Graftor.D22611 Worm:Win32/Kerm.A Worm/Win32.AutoRun.C332941 Win32.Worm.Autorun.Wted Worm.Win32.Kerm


The Trojans designed to steal money from bank accounts pose a serious threat to Android users.


Sending the command sh to TCP port 6200 results in a full terminal being dropped : Sending the command cmd followed by a proper terminal command will execute it and print the output ( in the example we use id which displays the identity of the system user running the issued commands ) : Doing the same as above but with command sucmd will run the terminal command as root : Other commands supported by rootdaemon on TCP port 6200 are su ( which in our tests did n't properly work ) , loadsocketpolicy , loadfilepolicy , remount and removeroot .


A backdoor also known as: Trojan.Razy.D10C13 Trojan-Downloader.Win32.Sysdrop.am Trojan.Win32.Z.Sysdrop.598528 Troj.Downloader.W32!c Trojan.DownLoader22.41648 Adware.BrowseFox.Win32.397064 W32/Trojan.VFXM-3248 TrojanDownloader.Sysdrop.h BDS/Ananlog.okrph Trojan[Downloader]/Win32.Sysdrop Backdoor:Win32/Ananlog.A Trojan-Downloader.Win32.Sysdrop.am Trj/GdSda.A Win32.Trojan-downloader.Sysdrop.Eok Trojan.DL.Sysdrop! Win32/Backdoor.773


A backdoor also known as: W32.LethicKAAB.Trojan Trojan.VB Win32.Trojan.VB.bj Trojan.KillFiles.29071 BehavesLike.Win32.VBObfus.cm Trojan.Win32.VB Trojan.Ursu.DFEE TScope.Trojan.VB Win32/VB.OCY Win32/Worm.VB.X


This is done by redirecting victim traffic through a malicious proxy server.


After the the first instance of BrainTest was detected , Google removed the app from Google Play .


After collecting the changed PIN code , it is sent back to the C2 .


A backdoor also known as: W32.HfsAutoB.2B84 Worm.Esjey Win32.Trojan.WisdomEyes.16070401.9500.9938 Trojan.Win32.CFI.dcbjxv Trojan.DownLoader12.30909 BehavesLike.Win32.BadFile.wh Worm:Win32/Esjey.A Trojan.Graftor.D299B4 HEUR/Fakon.mwf Virus.Win32.VB


PackageInstaller shows the app ’ s permission access and asks for the user 's approval , which then installs the application .


When in doubt , check the APK signature and hash in sources like VirusTotal before installing it on your device .


PluginPhantom is a new class of Google Android Trojan: it is the first to use updating and to evade static detection.


Recent blogs by the Zscaler research team explain how some variants of Android malware are exploiting the popularity of this game and tricking Android users into downloading a fake version .


This is a read only mode which can help end users remain protected from malicious document files.


We suspect the updated PIN is sent to the C2 , most likely to give the malware the option to perform privileged activities on the infected device related to payments , system configuration options , etc .


] net app store showing the current DroidVPN app Virtual Private Network ( VPN ) tools allow connections to remote private networks , increasing the security and privacy of the user ’ s communications .


A backdoor also known as: Trojan/Delf.rdv Trojan.Win32.Qhost.afmj Trojan.AVKill.28805 TR/Rogue.kdz.976325 Trojan/Win32.Qhost Trojan.Graftor.D1154C Trojan.Win32.Qhost.afmj TrojanDownloader:Win32/Qhost.A Trj/CI.A


A backdoor also known as: Trojan/Turla.a BKDR64_TURLA.YKV Win32.Trojan.WisdomEyes.16070401.9500.9968 Backdoor.Trojan BKDR64_TURLA.YKV Win64.Rootkit.Uroburos.A Backdoor.Win64.Turla.e Trojan.Win64.Turla.dflvfq Backdoor.Win64.Turla!c Trojan:W64/Turla.B BackDoor.Turla.20 Trojan.Turla.Win64.3 BDS/Turla.OE Backdoor.Win64.Turla.e Backdoor.Turla Trj/CI.A Win64/Turla.A Win32.Trojan.Url.Xqlp Win32/Trojan.URL.5b6


Detailed Malware Structure Malware Strucutre com.mile.brain ( SHA256 : 135d6acff3ca27e6e7997429e5f8051f88215d12351e4103f8344cd66611e0f3 ) : This is the main application found on Google Play .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32.Trojan-Ransom.Cryptolocker.AB Trojan.DownLoader25.64138 W32/Trojan.QFWN-8242 TR/Injector.pegqr Trojan.Graftor.D472BE TrojanDownloader:Win32/Zdowbot.B Heur.Malware-Cryptor.Filecoder Trojan.Win32.Zlader W32/Injector.DASN!tr


A backdoor also known as: Exploit.BypassUAC Win.Tool.Win7Elevate-1 Exploit.Win32.BypassUAC.bfo ApplicUnsaf.Win64.Win7Elevate Exploit.BypassUAC.Win32.550 W64/Trojan.SZNL-6335 Exploit.BypassUAC.ny SPR/Welevate.A Trojan[Exploit]/Win32.BypassUAC HackTool:Win64/Welevate.A Exploit.Win32.BypassUAC.bfo HackTool/Win32.Win7Elevate.R27568 Trj/CI.A Win32.Exploit.Bypassuac.Dyqu Trojan.Win32.Webprefix


A backdoor also known as: Win32.Randex.B@mm Backdoor.IRCBot W32/Randex.worm.B Win32.Trojan.WisdomEyes.16070401.9500.9811 W32/Randex.B W32.Randex Win32/Lioten.F Win.Worm.Randex-2 Worm.Win32.Randex.b Win32.Randex.B@mm Trojan.Win32.Randex.glyj W32.W.Randex.b!c Win32.Worm.Randex.Ajbc Win32.Randex.B@mm Worm.Win32.Randex.B Win32.Randex.B@mm Win32.HLLW.Randex.45056 Worm.Randex.Win32.3 BehavesLike.Win32.PWSZbot.lc W32/Randex.B Worm/Randex.b Worm/Win32.Randex Win32.Randex.E2C45E Worm.Win32.Randex.18432 Worm.Win32.Randex.b Worm:Win32/Randex.FN Trojan/Win32.HDC.C82152 Win32.Randex.B@mm Backdoor.IRCBot Worm.Randex Win32/Randex.B Worm.Win32.Randex!jlps7ds/blM W32/Randex.B!worm


The combination of these capabilities makes JSocket a unique and serious threat to the electronic and physical security of victims.


The EternalBlue exploit MS017-010 was initially used by WannaCry ransomware and Adylkuzz cryptocurrency miner.


SELECTED SAMPLES Package Name SHA-256 Digest com.rabbit.artcamera 18c277c7953983f45f2fe6ab4c7d872b2794c256604e43500045cb2b2084103f org.horoscope.astrology.predict 6f1a1dbeb5b28c80ddc51b77a83c7a27b045309c4f1bff48aaff7d79dfd4eb26 com.theforest.rotatemarswallpaper 4e78a26832a0d471922eb61231bc498463337fed8874db5f70b17dd06dcb9f09 com.jspany.temp 0ce78efa764ce1e7fb92c4de351ec1113f3e2ca4b2932feef46d7d62d6ae87f5 com.hua.ru.quan 780936deb27be5dceea20a5489014236796a74cc967a12e36cb56d9b8df9bc86 com.rongnea.udonood 8b2271938c524dd1064e74717b82e48b778e49e26b5ac2dae8856555b5489131 com.mbv.a.wp 01611e16f573da2c9dbc7acdd445d84bae71fecf2927753e341d8a5652b89a68 com.pho.nec.sg b4822eeb71c83e4aab5ddfecfb58459e5c5e10d382a2364da1c42621f58e119b Exobot ( Marcher ) - Android banking Trojan on the rise February 2017 Introduction The past months many different banking Trojans for the Android platform have received media attention .


A backdoor also known as: W32.FilodasD.Trojan Backdoor/W32.Small.19968.AH Backdoor.Win32.Small!O Trojan.Downloader.slowblog Backdoor/Small.klk Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Small-13891 Backdoor.Win32.Small.klk Trojan.Win32.Small.reykq Backdoor.Win32.A.Small.19968 Backdoor.W32.Small.klk!c Trojan.DownLoad2.37573 Backdoor.Small.Win32.7582 BehavesLike.Win32.Downloader.lm Backdoor/Small.hcp W32/Cowsid.A!tr Trojan[Backdoor]/Win32.Small Win32.Hack.Small.kcloud Trojan.Heur.RP.E95DD0 Backdoor.Win32.Small.klk TrojanDownloader:Win32/Coswid.A Downloader/Win32.Small.C65823 Backdoor.Small Win32/TrojanDownloader.Coswid.A Backdoor.Small!nWa7meIxFMI Trojan-Downloader.Win32.Small


A backdoor also known as: Udsdangerousobject.Multi Win32.Trojan.WisdomEyes.16070401.9500.9998 BackDoor.Bulknet.780 W32/Trojan.JPON-8649 TrojanDropper:Win32/Insup.A Win32.Trojan.Spnr.Afhv Win32/Trojan.9d8


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.DownLoader25.45618 Trojan:Win32/Relnicar.A!dha Trj/GdSda.A


Ahnlab is a popular antivirus software in South Korea.


A backdoor also known as: Trojan.Ransom.Cerber.1 Trojan.Ransom.Cerber.1 Trojan.Dropper Trojan.Ransom.Cerber.1 Ransom_HPCERBER.SMALY5A Win32.Trojan.Kryptik.anp Ransom_HPCERBER.SMALY5A Trojan.Ransom.Cerber.1 Trojan.Ransom.Cerber.1 Trojan.Ransom.Cerber.1 Trojan.Ransom.Cerber.1 Trojan.Ssebot.2 BehavesLike.Win32.Dropper.vc Spammer:Win32/Rowdab.A Trj/GdSda.A W32/Kryptik.EXLK!tr


The themes of the messages used in the attacks are related to IT Infrastructure such as a log of Server Status Report or a list of Cisco Iron Port Appliance details.


Last week on October 7, Raytheon | Websense® Security Labs™ noticed an interesting email campaign distributing what at first appeared to be Dridex botnet 220.


Decompiled APK resources .


A backdoor also known as: Adware.Toolbar.Win32.2435 Trojan.Win32.Spraxeth.elldrz RemoteAdmin.Dexn.v Worm:Win32/Spraxeth.A


Although the threat actor responsible for the development of EventBot is still unknown and the malware does not appear to be involved in major attacks , it is interesting to follow the early stages of mobile malware development .


A backdoor also known as: HT_PATCHER_FC170076.UVPA Win32.Trojan.WisdomEyes.16070401.9500.9787 Backdoor.Graybird HT_PATCHER_FC170076.UVPA Tool.Patcher.140 BehavesLike.Win32.Dropper.pm not-a-virus:RiskTool.Win32.Patcher HackTool:Win32/Patcher.D HackTool/Win32.Patcher.C862855 Trj/CI.A


With the capability to open market applications , such as Google Play and 9Apps , with a specific keyword search or even a single application ’ s page , the actor can gain exposure for other threat actors and increase his profits .


A backdoor also known as: W32.W.Otwycal.l4av not-a-virus:NetTool.Win32.TCPScan.a Win-AppCare/Tcpscan.108750 HackTool.Win32.TCPScan.fge


We have notified Google of the abuse and are working with them to share additional information.


Here the list of the files potentially dropped during the installation stage : FILE NAME STAGE DESCRIPTION d3d9.dll Stage 4 Malware loader used for UAC environments with limited privileges ; also protected by VM obfuscation aepic.dll , sspisrv.dll , userenv.dll Stage 4 Malware loader used in presence of administrative privileges ; executed from ( and injected into ) a fake service ; also protected by VM obfuscation msvcr90.dll Stage 5 Malware payload injected into the explorer.exe or winlogon.exe process ; also protected by VM obfuscation .cab Config Main configuration file ; encrypted setup.cab Unknown Last section of the setup executable ; content still unknown .7z Plugin Malware plugin used to spy the victim network communications wsecedit.rar Stage 6 Main malware executable After writing some of these files , the malware decides which kind of installation to perform based on the current privilege provided by the hosting process ( for example , if a Microsoft Office process was used as exploit vector ) : Installation process under UAC When running under a limited UAC account , the installer extracts d3d9.dll and creates a persistence key under HKCU\Software\Microsoft\Windows\Run .


In cooperation with Cisco Advanced Services Incident Response, Talos identified several key aspects of the attack.


A backdoor also known as: Trojan-Dropper.Win32.StartPage!O TrojanDownloader.Small.DF3 Trojan/Dropper.StartPage.bdz TROJ_FAVADD.SMI Win32.Trojan.WisdomEyes.16070401.9500.9719 TROJ_FAVADD.SMI Win.Downloader.134775-1 Win32.Trojan.Favadd.A Trojan.Win32.Alien.bnu Trojan.Win32.Zbot.dydfgj Trojan.Win32.Z.Startpage.69632.D Troj.Downloader.W32.VB.lkln TrojWare.Win32.Pasta.SAB Trojan.MulDrop1.43517 Dropper.StartPage.Win32.220 BehavesLike.Win32.VBObfus.km TrojanDropper.StartPage.ty Trojan[Downloader]/Win32.VB Trojan.Buzy.114 Trojan.Win32.Alien.bnu Trojan:Win32/Favadd.C Trojan/Win32.StartPage.R6041 Trojan.VBRA.06132 Trojan.DL.VB!NOyJWQLVTJg Win32/Trojan.835


A backdoor also known as: TrojanDownloader.Hegel TROJ_SHIZ.SMP6 W32/Shiz.MU TROJ_SHIZ.SMP6 Trojan.Win32.A.Downloader.53760.HN Trojan.Packed.20771 BehavesLike.Win32.Cutwail.qh W32/Shiz.FQWK-1945 TrojanDownloader:Win32/Hegel.F Trojan/Win32.ADH.R23078 W32/Shiz.NCF!tr Win32/Trojan.74e


Android/Twitoor is a backdoor capable of downloading other malware onto an infected device. It has been active for around one month.


RIG exploit kit sends Ramnit payloads via VBScript CVE-2016-0189


Some applications rely on SMS when it comes to in-app purchases — the transaction data is transferred via a short text message .


Angler began exploiting CVE-2015-3090 about two weeks after Adobe released a patch.


So let's make a level-headed assessment of what is really out there.


Three distinctive elements of BAIJIU drew and held our attention: the unusual complexity of the attack; the appropriation of web hosting service GeoCities of 1990s fame; and the use of multiple methods of obfuscation.


We assume that these two elements were chosen to trick security products.


The stealer is disguised as a legitimate Google Drive extension and it can monitor browsing history, capture screenshots, and inject malicious scripts to steal funds from cryptocurrency exchanges.


A backdoor also known as: Trojan/W32.Mansabo.389120.B Win32.Trojan-Spy.Trickbot.F Trojan.Win32.Mansabo.aiu Trojan.Win32.Mansabo.evnqvj Trojan.Inject2.64433 Trojan.Mansabo.ni TR/AD.Inject.jyiec Trojan/Win32.Mansabo Trojan.Win32.Mansabo.aiu Trojan/Win32.Inject.C2278939 TScope.Trojan.VB Trojan.TrickBot Trj/GdSda.A Win32.Trojan.Mansabo.Ljab W32/Mansabo.AIU!tr


A backdoor also known as: Trojan-Exploit/W32.Pidief.6283.GLW JS/Pdfcm.AQ Exploit-PDF.sd Bloodhound.Exploit.196 EXPL_EXECOD.A Pdf.Exploit.CVE_2009_0927-1 Exploit.Win32.Pidief.bni PDF.Exploit.CVE-2009-0927.A Exploit.W32.Pidief!c Trojan-Dropper:JS/PdfDropper.A EXPL_EXECOD.A BehavesLike.PDF.Exploit.xn EXP/Pidief.arl Exploit.Win32.Pidief.bni Trojan.JS.Downloader.BEZ Exploit.Win32.Pidief.bni Win32.Exploit.Pidief.Hupr Trojan.Js.Exploit virus.pdf.pdfjs.1


All Firefox users are urged to update to Firefox 39.0.3. The fix has also been shipped in Firefox ESR 38.1.1.


The malware documented in this post was predominantly 64-bit, however, there are 32-bit versions of the malware in the wild.


First off , it registers the infected device in the administrative panel by sending a GET request to the relative address gate.php ( in later versions gating.php ) with the ID ( device identifier generated by the setPsuedoID function in a pseudo-random way based on the device IMEI ) and screen ( shows if the device is active , possible values are “ on ” , “ off ” , “ none ” ) parameters .


A backdoor targetting Linux also known as: TrojanXor.Linux.DDos.A Linux/DDoS-Xor.A ELF/Trojan.JWZU-2 Linux.Xorddos ELF_XORDDOS.SM Unix.Trojan.DDoS_XOR-1 HEUR:Trojan-DDoS.Linux.Xarcen.a Trojan.Unix.Xarcen.eftmox Troj.Ddos.Linux!c Linux.DDoS.Xor.4 Trojan.Xorddos.Linux.34 Linux/DDoS-Xor.A TrojanDDoS.Linux.ff LINUX/Xorddos.tmifd Trojan[DDoS]/Linux.Xarcen.a Trojan.Trojan.Linux.XorDDoS.2 Linux/Xorddos.625867 HEUR:Trojan-DDoS.Linux.Xarcen.a Trojan.Linux.XorDdos.a Trojan.Linux.DDoS ELF/DDoS.BH!tr ELF/XorDDos.A Win32/Trojan.DDoS.ee7


A backdoor also known as: Trojan.Tibrun Trojan/Kryptik.bwcw Trojan.Razy.D3CCE1 W32/Trojan2.ODQP Trojan.Bruterdep TROJ_TIBRUN.B Trojan-Spy.Win32.POSBrut.b Trojan.Win32.Crypt.ctwfbi Troj.W32.Crypt.csx!c Trojan.DownLoader9.55744 Trojan.Crypt.Win32.14169 TROJ_TIBRUN.B Trojan.Krypt-POS W32/Trojan.WWSD-0234 Trojan/Crypt.eom TR/Spy.13824.412 Trojan/Win32.Crypt.csx Trojan:Win32/Tibrun.A Trojan-Spy.Win32.POSBrut.b Trojan/Win32.Tibrun.C287165 Trojan.Crypt Trj/CI.A Win32/Kryptik.BWCW Win32.Trojan-spy.Posbrut.Sxxp Trojan.Crypt!ZT6l9g/i+CQ W32/BrutPOS.B!tr Win32/Trojan.2d6


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9846 Win32/Droplet.YK Trojan.NtRootKit.9406 TR/Horse.QWS Trj/CI.A W32/Malware_fam.NB Win32/RootKit.Rootkit.43e


The infection happens in multiple stages and the dropper is very similar to many common worm that targets embedded devices from multiple architectures.


BOT UPDATES EventBot has a long method called parseCommand that can update EventBot ’ s configuration XML files , located in the shared preferences folder on the device .


Yesterday, our colleagues from Symantec published their analysis of Longhorn, an advanced threat actor that can be easily compared with Regin, ProjectSauron, Equation or Duqu2 in terms of its complexity.


A backdoor also known as: Trojan/W32.Waldek.3342336 Trojan.Mauvaise.SL1 Backdoor.Trojan Trojan.Win32.Waldek.wvv Trojan.Win32.Waldek.elvbza Troj.W32.Waldek!c Trojan.Waldek.exr Trojan:Win32/Waldek.A!bit Trojan.Win32.Waldek.wvv Backdoor.Andromeda Trj/Gamarue.A Win32/Worm.5d8


A backdoor also known as: Win32.Worm.AutoRun.bo W32.SillyFDC Trojan.DownLoader8.34261 Worm:Win32/Metibh.A Rootkit.Ressdt


However the registrar NameCheap, Inc. covers a pool of 287.411.506 domains where at least 0.10% can be considered as potentially malicious.


A backdoor also known as: W32.FakeWinlogonXIA.Trojan Trojan.Win32.Swisyn!O Trojan.Swisyn.Win32.25583 Trojan/Swisyn.alai Win32.Worm.VB.qn W32.SillyFDC Win32/SillyAutorun.EYX TROJ_SWISYN.AJ Trojan.Win32.Swisyn.alai Trojan.Win32.Vb.btqbl Trojan.Win32.Swisyn.36864.C Trojan.KillFiles.12035 TROJ_SWISYN.AJ Trojan/Swisyn.vmn Worm/Win32.WBNA.mjv Worm:Win32/Roopirs.A Trojan.Win32.Swisyn.alai Trojan/Win32.Swisyn.R2752 Trojan.VBRA.04943 Trojan.PoorVirus I-Worm.VB.NUV Win32/VB.NUV Trojan.Win32.Swisyn


A backdoor also known as: MemScan:Backdoor.Turkojan.BM Trojan.PWS.VKont!NjMVuhwtYR0 BKDR_TURKOJN.SMD Win32.Backdoor.Turko PUA.Packed.Themida-2 Packed.Win32.Black.a MemScan:Backdoor.Turkojan.BM Packed.Win32..Black.~A MemScan:Backdoor.Turkojan.BM Trojan.Packed.650 BKDR_TURKOJN.SMD Heuristic.BehavesLike.Win32.Fake.O Trojan:Win32/Turkojan.B!dll MemScan:Backdoor.Turkojan.BM Packed/Win32.Black Trojan.Win32.Nodef.dqw Trj/Thed.A


This report analyzes a campaign of targeted attacks against an NGO working on environmental issues in Southeast Asia.


The developers refer to this tool by the name Kazuar, which is a Trojan written using the Microsoft .NET Framework that offers actors complete access to compromised systems targeted by its operator.


A backdoor also known as: BackDoor-AZF.dll BKDR_BITS.B W32/Backdoor.FPJ Backdoor.Trojan Win32/Bits.A BKDR_BITS.B Backdoor.Win32.Bits Trojan.Win32.Bits.dlhcqc Backdoor.Win32.Bits.A BackDoor.Bits Backdoor.Bits.Win32.9 BackDoor-AZF.dll W32/Backdoor.SUAV-1947 Backdoor/Bits.b Backdoor:Win32/Bits.B Backdoor.Win32.Bits Bck/Bits.A Backdoor.Bits!2M7xWD4MAec


A backdoor also known as: W32.HfsAutoB.B13C Trojan.Blouiroet Trojan.Win32.Blouiroet.au Trojan.Win32.Blouiroet.evaxpp Trojan.Win32.Z.Symmi.3033600 Troj.W32.Blouiroet!c Win32.Trojan.Blouiroet.Wvkk BehavesLike.Win32.Trojan.vc Trojan.Blouiroet.s Trojan.Symmi.D1371C Trojan.Win32.Blouiroet.au Trojan:Win32/Blouiroet.A Trojan/Win32.Blouiroet.C2267836 Trojan.Blouiroet Trj/CI.A Win32/Trojan.c10


From a single instance of the encoded JavaScript discovered in one version of this malware, we pivoted on the Command and Control C2 IPv4 address discovered during static analysis and deobfuscation, using our Threat Intelligence Service AutoFocus, unearthed many more versions of the malware and found that the versions seen to date were delivering a credential-stealing Trojan as the final payload.


We found no other information stolen from the victims to be accessible .


A backdoor also known as: VirTool.VBInject Trojan.Win32.Clicker!BT Trojan.Kazy.D6D077 Win32.Trojan.Trojan-Clicker.e Trojan.Win32.VB.dwztex Trojan.Win32.Z.Kazy.28676 Win32.HLLW.VBNA.based BehavesLike.Win32.Trojan.mz Trojan.Win32.TrojanClicker TrojanClicker.VB.fwe TR/Kazy.446583.222 TrojanClicker:Win32/Wimg.A Trojan.Win32.Clicker!BT TScope.Trojan.VB Trj/GdSda.A W32/TrojanClicker.OFQ!tr Win32/Trojan.de7


The SpyNote RAT registers a service called AutoStartup and a broadcast receiver named BootComplete .


These attacks are targeted, but not spear-phished.


CVE-2017-0199 was originally a zero-day remote code execution vulnerability that allowed attackers to exploit a flaw that exists in the Windows Object Linking and Embedding OLE interface of Microsoft Office to deliver malware.


By performing a deep analysis of the malware , we were able to extract the unpacked JAR file mycode.jar and reveal some very interesting code .


A backdoor also known as: Trojan.Triosir.682 Backdoor:Win32/Rupski.A Trojan.Triosir! AdWare.AddLyrics Win32/Virus.Adware.cd5


sendAll function used to spread malicious messages to the contact list .


It turns out that those smaller Trojans face serious problems trying to get root access on Android 4.4.4 and above , because a lot of vulnerabilities were patched in these versions .


A backdoor also known as: HackTool.Win32.Injecter


He also used his email account to log into various services in the video , which identifies him as the adware domain owner , beyond any doubt .


A backdoor also known as: Trojanpws.Ginapass Trojan.Win32.Figina.ewevus Trojan.PWS.Figina Tool.DYAMAR.Win32.193 BehavesLike.Win32.Ransom.bc PWS:Win32/GinaPass.D Downloader.Delphi Trj/CI.A


Bitdefender Labs has issued a technical advisory to warn the public about a new wave of opportunistic attacks using a vulnerability in Zoho ManageEngine servers, which could affect tens of thousands of businesses.


A backdoor also known as: Trojan.Win32.Clicker!BT Win32.Trojan.WisdomEyes.16070401.9500.9503 Uds.Dangerousobject.Multi!c trojanclicker.msil.fakeie.a TR/Dropper.MSIL.138467 Trojan.MSIL.Krypt.2 TrojanClicker:MSIL/FakeIE.A Trojan.Win32.Clicker!BT Downloader.MSIL.ASXS Win32/Trojan.d60


A backdoor also known as: Win32.Worm.Fujacks.AB Packed.Win32.TDSS!O W32/Fujacks.s Worm.Fujack.Win32.6 W32/Fujacks.aa.2 PE_FUJACKS.EA Win32.Worm.BMW.b W32/Fujack.R W32.Fujacks.E Win32/Emerleox.CO PE_FUJACKS.EA Win.Worm.Fujack-8 Worm.Win32.Fujack.aa Win32.Worm.Fujacks.AB Trojan.Win32.Fujack.nsvf W32.W.Fujack.kZ4V Virus.Win32.Viking.a Win32.Worm.Fujacks.AB Win32.HLLP.Whboy.80 BehavesLike.Win32.MultiPlug.th W32/Fujack.R Worm/Viking.Tail TR/Drop.Hupigon.kmx Trojan[Packed]/Win32.CPEX-based Win32.WhBoy.aa.183492 Trojan:WinNT/Kangkio.A Win32.Worm.Fujacks.AB Win32.WhBoy.AJ Worm.Win32.Fujack.aa Win32.Virus.Neshta.D Win32/Dellboy.Z Win32.Worm.Fujacks.AB Win32.HLLW.Whboy RiskWare.Tool.CK Win32.Fujacks.AD Win32/Fujacks.AD Win32.HLLP.WHBoy.AP Worm.Win32.Fujack W32/BoyhW.V Virus.Win32.Viking.LB


A backdoor also known as: Trojan.Heur.E05F81 Win32.HLLW.Autoruner2.27649 BehavesLike.Win32.Fake.dc Worm:Win32/Namepuk.A HEUR/Fakon.mwf Trojan.FKM!1pKOHJnJsdU


Open source reporting recently indicated new activity from the Iranian actor publicly known as Greenbug targeting Saudi Arabia.


Following on from our post on Angler EK we are going to expose the mechanics behind the Bedep ad-fraud malware.


The exploit files involved were identical to the Hacking Team's leaked exploit HTML, JavaScript, and ShockWave Flash 0-day files.


Since then we have identified a number of attacks over a two-year period, beginning in April 2014, which we attribute to Suckfly.


A backdoor also known as: Backdoor.Win32.Koutodoor!O Trojan.Koutodoor.E Win32.Rootkit.Koutodoor.a Trojan.Koutodoor TROJ_DLOADR.SMOM Backdoor.Win32.Koutodoor.aihc Trojan.Win32.RKDoor.evaszd Backdoor.Win32.Koutodoor.HC Trojan.DownLoader3.76 Trojan.Koutodoor.Win32.5401 TROJ_DLOADR.SMOM Trojan.Rootkit.Pakes W32.Backdoor.Koutodoor Trojan[Backdoor]/Win32.Koutodoor Win32.Troj.JunkcodeT.a.188672 Trojan.Koutodoor.12 Backdoor.Win32.Koutodoor.aihc TrojanDropper:Win32/Minmal.A Backdoor/Win32.Koutodoor.R1785 Trojan.PSW.Win32.OnlineGame.d Trojan.Win32.Koutodoor.AN


A backdoor also known as: Exploit.MSIL Exploit.Win32.CVE20130074.eupinx W32/Trojan.QBBK-0155 Exploit.MSIL.cn EXP/CVE-2013-0074.cpsmi Exploit:MSIL/CVE-2016-0034.B Trj/GdSda.A Trojan.Win32.Exploit W32/CVE_2013_0074.GW!tr Win32/Trojan.Exploit.d89


A backdoor also known as: TrojanSpy.VBChuchelo.bk Trojan/Spy.VBChuchelo.g Trojan-Spy.Win32.VBChuchelo TrojanSpy.VBChuchelo.G Win32/Spy.KeyLogger.NDE Trojan-Downloader.Win32.Noesis.11.B!IK W32/VBTroj.WTX Trojan.VB-7191 Trojan-Spy.Win32.VBChuchelo.g Backdoor.VB.1 TrojWare.Win32.TrojanSpy.VB.~FJ Trojan-Spy.Win32.VBChuchelo.g TrojanSpy.VBChuchelo.v Backdoor.Trojan Backdoor:Win32/Zumamumy.A Trojan.Win32.VBChuchelo.106667 Backdoor.VB.1 Win-Trojan/Vbchuchelo.106658 Trojan-Spy.Win32.VBChuchelo.g Trojan-Downloader.Win32.Noesis.11.B Dropper.Tiny Trj/Downloader.MDW


That is actually how the bad guys decided to monetize the Trojan .


The bulk of the victims were predominantly based out of Ecuador, Venezuela, Peru, Argentina, and Columbia; however, other victims were identified in Korea, the United States, the Dominican Republic, Cuba, Bolivia, Guatemala, Nicaragua, Mexico, England, Canada, Germany, Russia, and Ukraine.


A backdoor also known as: TrojanDropper.Yabinder.2.0 Trojan.DR.Yabinder!OrBzj5WtPwc Win32/Yabinder.20 W32/Yabinder.C W32.Slackor.dr Slacke.A TROJ_YABINDER.20 Trojan.Yabinder.20B TrojanDropper.Yabinder.2.0 TrojWare.Win32.Yabinder.20 TrojanDropper.Yabinder.2.0 Trojan.MulDrop.310 TR/Yabinder.20.B TROJ_YABINDER.20 Win32/TrojanRunner.Yab.200 W32/Yabinder.C TrojanDropper:Win32/Yabinder.2_0 Backdoor.Win32.Bifrose.168361 TrojanDropper.Yabinder.2.0 Dropper/Yabinder.9728 Backdoor.Win32.Bifrose.bco Malware.Slackor Trojan.Yabinder.a Trojan-Dropper.Win32.Yabinder.20 W32/Yabinder.C!tr Dropper.Yabinder.A Trj/Yabinder.A


A backdoor also known as: Ransom_YUHAK.A Trojan.MulDrop7.49600 Ransom_YUHAK.A BehavesLike.Win32.PWSZbot.dh TR/RedCap.cgaww Trojan.Heur.RP.E93A3E Ransom:Win32/Wagcrypt.A


A backdoor also known as: W32.FamVT.ExpiroPC.PE BehavesLike.Win32.Trojan.cc Trojan[Dropper]/Win32.Gluer TrojanDropper:Win32/Gluer.dam#2


A backdoor also known as: Trojan.DOS.Filemaker.A Trojan.DOS.Filemaker.A Filemaker.b Trojan.DOS.Filemaker Trojan.DOS.Filemaker.A TrojWare.DOS.Filemaker Trojan.DOS.Filemaker.A Trojan.Filemaker TR/Filemaker.A Filemaker.b Trojan/DOS.DOS Trojan.DOS.Filemaker.A Filemaker.A Trojan.DOS.Filemaker Malware_fam.B


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9985 W32/Trojan2.OWYQ Trojan.Msil W32/Trojan.FRCA-1486 Trojan.Spacekito Trojan.Zusy.D177A1 Trojan:MSIL/Spacekito.E PUP/Win32.Vittalia.R124797 Trj/CI.A


A backdoor also known as: Trojan.DownLoader25.42759 BehavesLike.Win32.BadFile.gh


A backdoor also known as: Trojan.Banker.Win32.82933 Win32.Trojan.WisdomEyes.16070401.9500.9712 Trojan.Zbot Trojan-Spy.MSIL.Banker.jc Trojan.Win32.Banker.datvyw Troj.Spy.MSIL.Banker.jc!c Trojan-Spy.MSIL.CliBanker TR/Spy.Clipug.A.11 Win32.Troj.Banker.kcloud TrojanSpy:MSIL/Clipug.A Trojan.Kazy.D5F205 Trojan-Spy.MSIL.Banker.jc Trojan/Win32.ClipBanker.C415793 Trj/Dtcontx.M Msil.Trojan-spy.Banker.Ecua Trojan.ClipBanker! MSIL/ClipBanker.A!tr Win32/Trojan.Spy.b4a


A backdoor also known as: Worm.AutoRun Worm.W32.Autorun!c Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/MalwareF.OZHN Worm.Win32.AutoRun.bhzt Trojan.Win32.DownLoad2.dfarbo Win32.Worm.Autorun.Wvuf Trojan.DownLoad2.11039 Trojan.Patched.Win32.123715 BehavesLike.Win32.Downloader.nt W32/Risk.AVZF-7617 Worm/AutoRun.yjm Trojan.Graftor.D1B4A5 Worm.Win32.AutoRun.bhzt Worm/Win32.AutoRun.C2342249 Trojan.Meredrop!NKOc3oKULjk Worm.Win32.AutoRun W32/AutoRun.BHZT!worm Trj/CI.A Win32/Trojan.e1e


Once the event is triggered , it registers a timer .


The report analyzed the entirety of the purported attack campaign, beginning in 2009 using a family of tools dubbed Troy'.


The payload installed in attacks using this lure is a variant of the Emissary Trojan that we have analyzed in the past, which has direct links to threat actors associated with Operation Lotus Blossom.


Strazzere advises that consumers should look at the pedigree of mobile manufacturers and take a close look at their security track record before making a decision on what device to buy .


A backdoor also known as: Packed.Win32.TDSS!O Nettool.Ultrasurf Trojan/AutoRun.VB.axp Win32.Trojan.WisdomEyes.16070401.9500.9864 W32/Trojan4.MDT Win.Trojan.7355760-1 TrojWare.Win32.Patched.KSU Tool.UltraSurf.Win32.14 BehavesLike.Win32.FakeAlertSecurityTool.hc W32/Trojan.VIDV-4226 Win32.Troj.Undef.kcloud Trojan.Heur.VB.KieddGFnVEmi Trojan:Win32/Cossta.A Trojan/Win32.Cossta.C77631 Trojan.Dynamer!q0c68r1YFqw W32/VB.AXP!tr Trojan.VBRA.02198 Trj/CI.A


The Cybereason Nocturnus team will continue to monitor EventBot ’ s development .


A backdoor targetting Linux also known as: TROJ_MINER.AUSC TROJ_MINER.AUSC JS/Coinminer.EFAB!tr.dldr


A backdoor also known as: Backdoor.Bladabindi.FC.1799 Trojan.Zusy.D17364 Win32.Trojan.WisdomEyes.16070401.9500.9949 TrojWare.MSIL.Dynamer.AS Trojan.DownLoader12.58576 Trojan.Msil W32/Trojan.PPUX-1583 Trj/GdSda.A Win32/Trojan.744


Secondly, PowerShell can be used to steal usernames, passwords, and other system information without an executable file being present.


A backdoor also known as: Trojan-PSW.Win32.YahuPass!O Worm.Zaphal Trojan/PSW.YahuPass.jo Trojan.Graftor.D3448 Win32.Trojan.Delf.ff Win.Trojan.Yahupass-1 Trojan.Win32.Scar.oeuq Trojan.Win32.YahuPass.cthys Trojan.Win32.Z.Yahupass.575793 Trojan/PSW.YahuPass.y Trojan[PSW]/Win32.YahuPass Worm:Win32/Zaphal.B Troj.W32.Scar!c Trojan.Win32.Scar.oeuq Trojan/Win32.Losel.C65535 Trojan.Scar Win32/Spy.Delf.OPX Win32.Trojan.Scar.Alis Trojan.PWS.YahuPass!c1rtyKxFJLA Win32/Trojan.57c


As this is not the first time that CVE-2017-0199 was exploited for an attack, we thought it fitting to analyze this new attack method to provide some insight into how this vulnerability can be abused by other campaigns in the future.


A backdoor also known as: Trojan/Dropper.Neblso W32/Dropper.CPO Trojan.Dropper TROJ_MULTIDRP.LA Trojan-Dropper.Win32.Neblso Trojan.Win32.Neblso.dkkt Trojan.Win32.PSWLdPinch.41277 Troj.Dropper.W32.Neblso!c Trojan.MulDrop.911 Dropper.Neblso.Win32.7 TROJ_MULTIDRP.LA BehavesLike.Win32.VirRansom.pc Trojan-Dropper.Win32.Neblso W32/Risk.OJSS-0633 TrojanDropper.Ichitaro.Tarodrop.g Trojan[Dropper]/Win32.Neblso Trojan-Dropper.Win32.Neblso Dropper/Win32.Xema.C62110 TrojanDropper.Neblso Win32/TrojanDropper.Neblso Trojan.MultiDrop!Nb+sQh+u4tI W32/Dropper.BBBT!tr


Bitcoin was the preferred transaction currency.


A backdoor also known as: Backdoor.RedSpy.Win32.12 Trojan.Heur.E7FD56 Win32.Trojan.WisdomEyes.16070401.9500.9966 W32/Backdoor2.WQR Backdoor.Trojan Backdoor.Win32.RedSpy.12 Trojan.Win32.RedSpy.bnfsv Backdoor.Win32.A.RedSpy.407552 BackDoor.Redspy.12 W32/Backdoor.ZOHG-8805 Trojan[Backdoor]/Win32.RedSpy Backdoor:Win32/RedSpy.1_2 Backdoor.Win32.RedSpy.12 Trojan/Win32.Banker.C143433 Backdoor.RedSpy Backdoor.RedSpy!KQ5NSrZfjaE W32/RedSpy.V12!tr.bdr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9917 Trojan.Cridex Trojan.Win64.PackedENT.exqnqt Trojan.PackedENT.61 BehavesLike.Win64.PdfCrypt.bm W64/Trojan.WJME-6640 Trojan.Mikey.D1231F Trojan.Dridex Trojan.Win64.Krypt Trj/CI.A Win32/Trojan.cb1


One more targeted attack against Ukraine that used spear phishing to deliver the DarkTrack backdoor through a fake prescription of the Minister of Defense of Ukraine.


These kinds of threats will become more common , as more and more companies decide to publish their software directly to consumers .


A backdoor also known as: Trojan.Win32.Tvt!O Trojan/Korplug.j Win32.Trojan.WisdomEyes.16070401.9500.9991 Backdoor.Trojan BKDR_THOPER.SMZTDE Trojan.Korplug.Win32.8 BKDR_THOPER.SMZTDE W32/Trojan.LEDO-1330 Trojan/Tvt.ay Trojan/Win32.Tvt Trojan.Kazy.D1C8B5 Backdoor:Win32/Thoper.F!dha Backdoor/Win32.Etso.R19357 Trojan.Tvt!rB4pBoPmMmk Trojan.Kazy Win32/Trojan.9b1


Since then, the number of cases using PoisonIvy in such attacks decreased, and there was no special variant with expanded features seen in the wild.


Android bots have also already been found being controlled via other non-traditional means – blogs or some of the many cloud messaging systems like Google ’ s or Baidu ’ s – but Twitoor is the first Twitter-based bot malware , according to Štefanko .


A backdoor also known as: W32.OnGamesLTMSTRI.Trojan Trojan/Qhost.admt Win32.Trojan.WisdomEyes.16070401.9500.9983 Trojan.Qhosts Trojan.Win32.Qhost.rfrep Troj.W32.Qhost.admt!c Trojan.FakeAV.10958 Trojan.Qhost.Win32.9572 W32/Trojan.AEUL-0771 Trojan/Qhost.eht TR/Qhost.eozdy Trojan/Win32.Qhost Trojan.Graftor.Elzob.D22D4 Trojan.Qhost Trojan.HostsMod Trj/CI.A Win32/Qhost.ORK Trojan.Qhost!OWegFrReFAQ Trojan.Win32.Qhost


The backdoor Trojan authors have called it XAgentOSX, which shares the name XAgent with one of Sofacy's Windows-based Trojan and references Apple's previous name for macOS, OS X.


Trend Micro first discovered the Alice ATM malware family in November 2016 as result of our joint research project on ATM malware with Europol EC3.


After launching , it hides its presence on the system and checks the defined Twitter account at regular intervals for commands .


A backdoor also known as: Trojan.Veediem Trojan.Razy.D212D5 Win32.Trojan.WisdomEyes.16070401.9500.9585 HackTool.Win32.AllinOne.g Tool.Allinone.1 BehavesLike.Win32.Fujacks.tm HackTool.Win32.AllinOne.g Trj/CI.A


A backdoor also known as: Trojan.Ismdoor W32/Ismdoor.A Trojan.MSIL.Ismdoor.a Trojan.Win32.Ismdoor.euvcaa Troj.Msil.Ismdoor!c Trojan.Ismdoor.Win32.2 Trojan.MSIL.Ismdoor W32/Trojan.WGWW-8625 Trojan.MSIL.hjyc Trojan/MSIL.Ismdoor Trojan.MSIL.Ismdoor.a Trojan/Win32.Ismdoor.C2249090 Trojan.MSIL.Ismdoor Trj/WLT.D Trojan.Ismdoor MSIL/Ismdoor.A Msil.Trojan.Ismdoor.Efax Trojan.Ismdoor! W32/Ismdoor.A!tr


A backdoor also known as: W32.eHeur.Virus02 Backdoor.PCClient.TCH Backdoor.PcClient Backdoor.PCClient.TCH BKDR_PCCLIEN.AFR Win32.Trojan.WisdomEyes.16070401.9500.9973 Backdoor.Formador BKDR_PCCLIEN.AFR Backdoor.PCClient.TCH Backdoor.Win32.PcClient.gehc Backdoor.PCClient.TCH Trojan.Win32.PcClient.evwdyc Trojan.Win32.Z.Pcclient.617695.A Backdoor.W32.Pcclient!c Backdoor.PCClient.TCH Backdoor.PCClient.TCH Trojan.Proxy.20157 Backdoor.PcClient.Win32.30956 BehavesLike.Win32.PWSZbot.jc Trojan.Win32.Enigma W32/Trojan.MPTU-6658 Trojan[Backdoor]/Win32.PcClient Backdoor.PCClient.TCH Backdoor.Win32.PcClient.gehc Trojan/Win32.PcClient.C22919 TScope.Malware-Cryptor.SB Win32.Backdoor.Pcclient.Ebqc W32/Bckdr.Z!tr Win32/Backdoor.599


Most legitimate Android apps are available on the Google Play Store .


A backdoor also known as: TROJ_GE.3396767B Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_GE.3396767B Win.Tool.Winactivator-1 Win32.Riskware.WinActivator.A Trojan.Win32.Kryptik.ernenh BehavesLike.Win32.PUPXAG.tc W32/Trojan.PMWL-5504 HackTool.WinActivator Trj/CI.A Trojan.MSIL.Crypt


The PC version has the ability to achieve complete remote control over the victim machine, including monitoring webcams and microphones.


A backdoor also known as: Trojan.Razy.D19050 Trojan.Powerduke Trojan:Win32/Yedob.A!dha


As an example, the following email was sent to a Turkish government organization using a lure of purported new portal logins for an airline's website.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9992 TR/Crypt.ZPACK.wqbfr Trojan[Downloader]/Win32.MapsGory Trojan.Razy.D3751F Trojan/Win32.MapsGory.C2205147 Malware-Cryptor.Limpopo


After launching, it hides its presence on the system and checks the defined Twitter account at regular intervals for commands.


Found bundled with a repackaged app , the spyware ’ s surveillance capabilities involve hiding its presence on the device , recording phone calls , logging incoming text messages , recoding videos , taking pictures and collecting GPS coordinates , then broadcasting all of that to an attacker-controlled C & C ( command and control ) server .


A backdoor also known as: TrojanDownloader.Putabmow.RF5 Trojan.Downloader.Wmbatupd Win.Adware.Graftor-5699 Variant.Adware.Graftor.mrlb Adware.Wombat.1 Trojan.FakeAV.Win32.319646 BehavesLike.Win32.BrowseFox.fh Trojan-Downloader.Win32.Putabmow TR/Dldr.Putabmow.AC TrojanDownloader:Win32/Putabmow.A PUP/Win32.Graftor.R158727 Win32/Trojan.a6d


A backdoor also known as: Backdoor.Win32.EggDrop.u BackDoor.EggDrop.16 Backdoor.Win32.EggDrop Trojan[Backdoor]/Win32.EggDrop.u Backdoor.Win32.EggDrop.u Backdoor:Win32/Dropegg.K Trojan/Win32.Eggdrop.R129522 Backdoor.EggDrop Win32/EggDrop.16


Once installed the bootkit infects the operating system with a backdoor at the early booting stage.


A backdoor also known as: Backdoor.Notpa Backdoor.Win32!O Backdoor.Notpa Backdoor.Notpa.Win32.4 Backdoor.W32.Notpa.l1pr Backdoor.Notpa W32/Backdoor.YTLZ-6459 Backdoor.Trojan BKDR_NOTPA.A Win.Trojan.NotPad-1 Backdoor.Win32.Notpa Backdoor.Notpa Trojan.Win32.Notpa.dkrv Backdoor.Notpa Backdoor.Win32.BackDoor.2_02 Backdoor.Notpa BackDoor.Zemac.200 BKDR_NOTPA.A W32/Backdoor2.EGAF TR/Notpad.Srv_#1 Trojan[Backdoor]/Win32.Notpa Win32.Hack.Notpa.kcloud Backdoor.Win32.Notpa.10240 Backdoor.Win32.Notpa Backdoor.Notpa Win-Trojan/Notpa.10240 Backdoor.Notpa Win32/BackDoor.2_02 Win32.Backdoor.Notpa.Wwoe Backdoor.Notpa!UhKbM28gXZk Backdoor.Win32.Notpa


A backdoor also known as: Ransom.Ninja Win32.Trojan.WisdomEyes.151026.9950.9999 Trojan-Ransom.Win32.Democry.a Trojan.Encoder.4608 Trojan.Filecoder.Win32.2542 BehavesLike.Win32.BadFile.tz TR/Symmi.sqfb W32/Filecoder.NGQ!tr Trojan.Symmi.D1F61 Trojan/Win32.Filecoder Ransom:Win32/SieteCrypto.A BScope.P2P-Worm.Palevo Win32.Trojan.Symmi.Wskd Trojan.Democry! Trojan.Win32.Filecoder Trj/CI.A


operation targeting individuals in Ukraine.


A backdoor also known as: W32.FakeDocD.fam.Trojan Worm.Hybris.PLI Worm.Win32.AutoRun!O Worm.AutoIt.Yuner.A Worm.Hybris.PLI Trojan/Yuner.b Worm.Hybris.PLI Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Worm.SEDY-1174 W32.Badday.A WORM_AUTORUN.BWK Worm.Hybris.PLI Worm.Win32.AutoIt.r Worm.Hybris.PLI Worm.Win32.AutoIt.261440 W32.W.AutoIt.l3OL Worm.Hybris.PLI Worm.Win32.AutoIt.~AN Trojan.AVKill.31317 Worm.AutoIt.Win32.2853 WORM_AUTORUN.BWK BehavesLike.Win32.YahLover.dc W32/Worm.MWD TrojanDownloader.JS.hi WORM/Autorun.55698 GrayWare[AdWare]/Win32.Yuner.a Worm:Win32/Yuner.A Worm.Win32.AutoIt.r Win32/Hybris.worm.261539 W32/YahLover.worm Worm.Autoit.Autorunner Trojan.Injector.AutoIt W32/Sohanat.GW.worm I-Worm.Yuner.B Win32/Yuner.B Worm.Win32.AutoRun.f Worm.Win32.AutoRun Trojan.Win32.AutoIt.D


A backdoor also known as: Win32.Yarner.D@mm Worm/W32.Yarner.437760.D W32.Yarner Trojan.Win32.Yarner.eokq W32/Yarner.D@mm Win32.Yarner Worm.Yarner.D Email-Worm.Win32.Yarner.d Win32.Yarner.D@mm I-Worm.Yarner.D I-Worm.Win32.Yarner.D Worm.Win32.Yarner.D Win32.Yarner.D@mm Win32.HLLM.Yarner.3 W32/YaW-Setup.3 I-Worm/Yarner.d Worm.Yarner.d.kcloud Worm:Win32/Yarner.C@mm Win32/Yarner.worm.437760.C Win32.Yarner.D@mm W32/Yarner.D@mm Worm.Yarner.d Malware.Yarner Win32/Yarner.D Worm.Yarner.d Email-Worm.Win32.Yarner.D W32/Yarner.D@mm


A backdoor also known as: W32.OnGameRWALXAF.Worm Trojan.Win32.VB!O Trojan.Mofksys.A Worm.Mofksys Trojan/VB.osk Win32.Trojan.VB.kc W32.Gosys Win32/Mofksys.C Trojan-Ransom.Win32.Blocker.oow Trojan.Win32.Blocker.covlpo Troj.W32.Swisyn.mzNn Trojan.VbCrypt.250 Trojan.VB.Win32.59196 BehavesLike.Win32.Swisyn.dh Trojan.Win32.VB Trojan[Ransom]/Win32.Blocker Worm:Win32/Mofksys.A Trojan.Win32.A.VB.192512.N Trojan-Ransom.Win32.Blocker.oow Trojan/Win32.Swisyn.R1452 W32/Swisyn.ag MAS.Trojan.VB.01047


Neutrino Exploit Kit EK appeared on the scene around March of 2013 and continues to remain active and incorporate new exploits.


We immediately contacted psychcentral about this infection as early as we have discovered it.


Yesterday morning, August 5, a Firefox user informed us that an advertisement on a news site in Russia was serving a Firefox exploit that searched for sensitive files and uploaded them to a server that appears to be in Ukraine.


A backdoor also known as: Trojan.Welranax Trojan/Delf.sjo Win32.Trojan.Delf.iv not-a-virus:AdWare.Win32.Delf.gum Trojan.Win32.Z.Delf.409600.D Adware.Delf.Win32.2253 Trojan-Dropper.Delf W32/Trojan.ZLEU-3835 GrayWare[AdWare]/Win32.Delf not-a-virus:AdWare.Win32.Delf.gum Trojan:Win32/Welranax.A Trojan/Win32.Hupigon.C979817 AdWare.Delf Trj/CI.A Win32/Delf.SJO Win32.Adware.Delf.Wrgd PUA.Delf! Win32/Trojan.e91


A backdoor also known as: W32.HfsAutoB.94C0 Trojan.Barys.DE38F


Foreign policy, future of the US Army Officer Corps, and economic development are only a few of the keywords that threat actors have been using in spear-phishing attacks against directors and project managers of technology-inclined US government contractors.


This extensive campaign infected over 14 million devices, rooting 8 million of them with an unprecedented success rate.


Affiliates only had to dole out at least 5% of their revenue to continue distributing the ransomware.


A backdoor also known as: TROJ_DROPPR.SMC Win32.Trojan.WisdomEyes.16070401.9500.9967 TROJ_DROPPR.SMC Win.Downloader.54186-1 Trojan.Win32.Small.depzsf Trojan.MulDrop4.31372 BehavesLike.Win32.FakeAlertSecurityTool.cc Trojan[Downloader]/Win32.Dadobra TrojanDropper:Win32/Preald.A Trojan/Win32.Vilsel.C888605 TrojanDownloader.Dadobra Trj/CI.A


In January of 2016, a tiny downloader named Godzilla Loader was advertised in the Damagelab forum.


A backdoor also known as: Trojan.FakeTC.Win32.3 W32/Trojan2.OZHB Win32/FakeTC.A Win32.Trojan.FakeTC.A Trojan.FakeTC.3 W32/Trojan.MTLD-1219 Trojan/FakeTC.c Trojan/Win32.FakeTC Trojan.FakeTC Backdoor.Bot Trojan.Win32.Faketc


] net , negg2.ddns [ .


Typically, attackers do not use patterns for very long, because security professionals eventually identify and subsequently block these patterns.


A backdoor also known as: Joke.Winerror Joke.Winerror Trojan.Winerror Hoax.W16.BadJoke.WinError!c Joke.Winerror WinError.Trojan Joke.WinError Hoax.Win16.BadJoke.WinError Riskware.Win16.WinError.hwcm Joke.Winerror ApplicUnwnt.Win16.BadJoke.WinError Tool.BadJoke.Win16.8 not-virus:Joke.Win16.WinError JOKE/Winerror.A HackTool[Hoax]/Win16.WinError Joke.Winerror Hoax.Win16.BadJoke.WinError Trojan.Win16.BadJoke.WinError Win16.Trojan-psw.Badjoke.Dygs Hoax.Win16.BadJoke.WinError Joke.Winerror


A backdoor also known as: Trojan.PackedCRTD.Win32.9317 Win32.Trojan.WisdomEyes.16070401.9500.9843 Win32.Trojan.Falsesign.Taoo Trojan.PWS.Banker1.22573 Trojan:Win32/Banker.AF Win32/Trojan.115


The malware comes equipped with a variety of features and can be purchased for $50 directly from the author.


A backdoor also known as: Ransom.Nemesis.S1305933 Trojan.Deshacop.Win32.847 Trojan.Ransom.Nemesis.8 Win32.Trojan.WisdomEyes.16070401.9500.9551 Win32.Trojan-Ransom.Nemesis.B Trojan-Ransom.Win32.Cryptoff.xe Heur.Packed.Unknown Trojan.Encoder.15133 Trojan[Ransom]/Win32.Snocry Ransom:Win32/CryptoLemPiz.A Trojan-Ransom.Win32.Cryptoff.xe Trojan/Win32.Snocry.C1923609 BScope.Trojan-Ransom.Snocry Ransom.Cerber Trojan.Win32.Filecoder Trj/CI.A


In the case of the CVE-2017-0199 Word exploit, we have observed this in a much more accelerated time scale.


The grabScreenPin method has separate conditioning to handle screen lock events in Samsung devices .


BlackBerry researchers have observed a new campaign by the Russian state-sponsored threat group, known as APT29, targeting European Union countries and their diplomatic systems, including that of Poland's ambassador to the United States.


So the system doesn ’ t see any strange processes running and thus does not cry the alarm .


Fortinet detects this threat as W32/Miner.


ProGuard Obfuscation As with many other Android applications , EventBot is now using obfuscation .


A backdoor also known as: TrojanAPT.Duberath.B3 Backdoor.VB.Win32.14561 Backdoor.W32.VB.mtc!c Backdoor/VB.mtc BKDR_VBBOT.AM W32/VBBot.A Trojan.Dosvine BKDR_VBBOT.AM Win.Trojan.Hydraq-30 Backdoor.Win32.VB.mtc Trojan.Win32.VB.cuyqz Backdoor.Win32.VBbot.118784 Trojan.DownLoader2.62750 Backdoor.IRCBot BehavesLike.Win32.VBObfus.ct Trojan.Win32.Duberath W32/VBBot.DXMJ-6902 Trojan[Backdoor]/Win32.VB Backdoor.Win32.VB.mtc Trojan:Win32/Duberath.B Backdoor.VBbot.A Backdoor.IRCBot Trojan.Crypted.18705 Win32.Backdoor.Vb.Wrha Trojan.VBbot!c3mtyEoqCqM Win32/Backdoor.fdf


A backdoor also known as: W32.Clod3af.Trojan.e4b3 Trojan-Downloader/W32.Zlob.62877 Trojan.Dropper W32/Trojan2.NNPL Downloader.HJFG TROJ_SPNR.15L411 Trojan.Downloader.NSIS-3 Trojan-Downloader.Win32.NSIS.hn Trojan.DownLoader3.61765 TROJ_SPNR.15L411 Heuristic.BehavesLike.Win32.Downloader.D TrojanDownloader:Win32/Ocibt.A Win-Trojan/Downloader.62877 W32/Trojan.MONE-7612 TrojanDownloader.hn Trj/CI.A W32/Dloader.HG!tr.NSIS Dropper.Instaler.F


A backdoor also known as: Trojan.Patpoopy.Win32.18 Win32.Trojan.WisdomEyes.16070401.9500.9989 W32/Trojan.MPOM-1589 Win.Trojan.PupyRat-5710268-0 Trojan.Win32.Patpoopy.ewuxjt Trojan.Win32.Z.Zusy.3419648.Q Python.PuPy.20 BehavesLike.Win32.Injector.wc Trojan.Zusy.D4035B Trojan/Win32.Shelma.C2361381 Trojan.Win64.Shelma Trj/CI.A Win32.Trojan.Patpoopy.Lpky Trojan.Win64.Shelma RAT.Pupy W32/Patpoopy.E!tr Win32/Trojan.2c0


We call this new group RTM- it uses custom malware, written in Delphi, that we cover in detail in later sections.


The report includes a review of the malware's sales procedure and customer reviews, as well as a full technical analysis of its multiple plugins.


Since February this year Antiy CERT has detected a new round of phishing activities using GuLoader to deliver the AgentTesla secret-stealing Trojan.


Four of them had more than 10,000 installs and one of them had more than 50,000 installs.


This ‘ versatility ’ was present in the first version of Rotexy and has been a feature of all the family ’ s subsequent representatives .


A backdoor also known as: Trojanpws.Win64 Win32.Trojan.WisdomEyes.16070401.9500.9986 Win64.Trojan-qqpass.Qqrob.Lmug BehavesLike.Win32.Rootkit.dh HackTool.Mimikatz Trojan.PSW.Mimikatz.acm Trojan[PSW]/Win64.Mimikatz HackTool:Win32/Mimikatz.A!dha Troj.Psw.Win64.Mimikatz!c BScope.TrojanPSW.Mimikatz Win32/Trojan.PSW.a2b


A backdoor also known as: W32.Kinkisc.Worm Trojan.Dropper.SRY TrojanDownloader.Zlob.A4 Trojan.Fanny.MB TROJ_ZLOB.SMFM W32.Fanni Win32/Zlob.PL TROJ_ZLOB.SMFM Win.Worm.Autorun-7948 Trojan.Dropper.SRY Trojan.Win32.EquationDrug.n Trojan.Dropper.SRY Trojan.Win32.Downloader.184320.CW Trojan.Dropper.SRY Trojan.DownLoad2.36935 BehavesLike.Win32.Backdoor.ch Worm.Win32.Funny Worm/Win32.AutoRun Worm:Win32/Fanys.A Trojan.Win32.EquationDrug.n Trojan.Dropper.SRY Worm.Fanny Trojan.Dropper.SRY Trojan.Win32.Downloader.tyo Worm.Win32.Fanny.A


Archive files ZIP, RAR, ACE, and ISOs containing EXE payloads


A backdoor also known as: Trojan.Autoit Trojan.Symmi.D10095 Trojan.Win32.Autoit.exnvng Trojan.Win32.Z.Autoit.1079042 Troj.W32.Autoit!c Trojan.Inject1.38999 Trojan.AutoIt.Win32.7 BehavesLike.Win32.Trojan.th Trojan.Win32.Eupuds Trojan.Autoit.ixi Trojan:Win32/BrobanEup.A Trojan.Autoit.Banker Win32.Trojan.Autoit.Szbl W32/Autoit.AAV!tr Win32/Trojan.839


A backdoor also known as: Backdoor/W32.Mirleg.24544 Backdoor/Mirleg.a TROJ_LEMIR.KM Win.Trojan.Mirleg-1 Backdoor.Win32.Mirleg.a Trojan.Win32.Mirleg.dkdm Backdoor.Win32.Mirleg.24544 Backdoor.W32.Mirleg.a!c BackDoor.Mirshell Backdoor.Mirleg.Win32.3 TROJ_LEMIR.KM BehavesLike.Win32.VTFlooder.mc Trojan[Backdoor]/Win32.Mirleg Backdoor.Win32.Mirleg.a Backdoor:Win32/Mirle.A Backdoor.Mirleg Bck/Lmir.D Win32.Backdoor.Mirleg.Tbik Trojan.PSW.LMir!RFMQExC82yY Backdoor.Win32.EggDrop W32/BDoor.BCV!tr.bdr


We have named this tool BBSRAT.


A backdoor also known as: Backdoor.VB.EV Heuristic.Crypted


A backdoor also known as: Backdoor.Farfli.20223 Win32.Trojan.Farfli.t W32/Trojan.LJSX-0343 Backdoor.Trojan BKDR_ZEGOST.SM44 Trojan.Win32.Dwn.dxihqn TrojWare.Win32.AntiAV.~D Trojan.DownLoader16.26781 Trojan.Farfli.Win32.30753 BKDR_ZEGOST.SM44 BehavesLike.Win32.Backdoor.kc BDS/Backdoor.davcs Trj/CI.A Trojan.Farfli!Hj4dzX9BZUM Trojan-PWS.Win32.Bjlog


A backdoor also known as: Backdoor.Hanove W32/Trojan.BLPJ-3540 Backdoor.Trojan Trojan-Dropper.Win32.Dapato.degm Trojan.Win32.Drop.ddlhu Trojan.MulDrop2.26538 BehavesLike.Win32.Trojan.fh TrojanDropper.Dapato.owp Trojan-Dropper.Win32.Dapato.degm Backdoor:Win32/Hanove.A Trojan/Win32.Hanove.C240436 Win32.Trojan-dropper.Dapato.Ebhb


Its name originates from the Arabic word maktub which means this is written or this is fate


For most of its history it operated as a government department or public corporation .


In this version of Ursnif I have also encountered an internal peer-to-peer communication which could possibly add the ability for the sample to communicate with other Ursnif peers over the same network.


A backdoor also known as: W32.DownloaderHC.Trojan Trojan-Ransom.Win32.FraudBlocker!O Trojan/VB.bn TROJ_RANSVB.SMA Win32.Trojan.WisdomEyes.16070401.9500.9983 W32/MalwareS.U TROJ_RANSVB.SMA Trojan-Ransom.Win32.Chameleon.gfl Trojan.Win32.Chameleon.edluzm Trojan.Win32.A.FraudBlocker.9216.A[UPX] Win32.Trojan.Chameleon.Phqb Trojan.Winlock.364 Trojan.FakeAV.Win32.150033 W32/Risk.WDRB-6022 Trojan.Chameleon.c TR/Ransom.VB.BN Trojan:Win32/SMSer.F Troj.Downloader.W32.Small.l5Bd Trojan-Ransom.Win32.Chameleon.gfl Trojan/Win32.Chameleon.C2304852 SScope.Trojan.Validium.va Trojan.FraudBlocker!3BdV5QfTi3g Trojan-Ransom.Win32.Fullscreen W32/LockScreen.CH!tr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9993 Win32/Tnega.THZ BehavesLike.Win32.Downloader.hh PWS:Win32/Tibia.BB Trojan.Zusy.Elzob.D6208 Trojan/Win32.Scar.R8662


A backdoor also known as: Trojan-Exploit/W32.CAN.28672 Exploit.CAN Trojan/Exploit.CAN.2002-0649.a TROJ_SQLEXP.A TROJ_SQLEXP.A Win.Trojan.Exploit-173 Exploit.Win32.CAN.2002-0649.a Exploit.Win32.CAN-2002-0649.gpav Trojan.Win32.Exploit.28672.A Exploit.W32.CAN.2002-0649.a!c Exploit.Sqlck Exploit.CAN.Win32.23 W32/Risk.DCEZ-2564 Exploit.CAN.g TR/Expl.CAN-2002-0649.A Trojan[Exploit]/Win32.CAN Exploit.Win32.CAN.2002-0649.a Exploit:Win32/CAN20020649.A Exploit.CAN Win32/Exploit.CAN-2002-0649.A Win32.Exploit.Can.Eeqq W32/ThcSQL.A!exploit Win32/Trojan.Exploit.96c


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9998 Backdoor.Trojan Trojan.Win32.DownLoad3.evepic Win32.Trojan.Spy.Pgde Trojan.DownLoad3.47177 BehavesLike.Win32.Downloader.lm W32/Trojan.XTOU-1556 Trojan:Win32/Netfosor.A!dha Trojan/Win32.Netfosor.C1246582 Trj/GdSda.A


A backdoor also known as: Win32.Deborm.AC@mm Worm.Win32.Deborm!O Worm.Deborm Win32.Deborm.AC@mm Win32.Trojan.WisdomEyes.16070401.9500.9895 W32.HLLW.Deborms Win.Downloader.88-1 Win32.Deborm.AC@mm Worm.Win32.Deborm.ac Win32.Deborm.AC@mm Trojan.Win32.Deborm.fvmw Worm.W32.Deborm!c Win32.Deborm.AC@mm Win32.HLLW.Deborm.27 BehavesLike.Win32.Downloader.nz BehavesLike.Win32.ExplorerHijack WORM/Deborm.AC Worm:Win32/Deborm.AC Win32.Deborm.E5BBB3 Worm.Win32.Deborm.ac Worm.Deborm Win32.Deborm.AC@mm Trj/CI.A Win32.Worm.Deborm.Pjxe


A backdoor also known as: Trojan.Dynamer.10163 Trojan.Barys.DE0C3 Win32/Tnega.CfKWaYC Trojan.Click2.60391 BehavesLike.Win32.Autorun.vc Trojan-Banker.Win32.Banker HackTool:Win32/Asoka.A Unwanted/Win32.HackTool.R76574


Talos has identified an email-based attack targeting the energy sector, including nuclear power, that puts a new spin on the classic word document attachment phish.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9926 Trojan-Downloader.Win32.Delf.koxi Trojan.Win32.Delf.eurqqv Trojan.Win32.Z.Delf.2321408 Downloader.Delf.Win32.55823 BehavesLike.Win32.Dropper.vh W32/Trojan.VVSX-7495 TR/Dldr.Delf.xofbe Trojan-Downloader.Win32.Delf.koxi Trj/GdSda.A Trojan-Downloader.Win32.Delf W32/Delf.CFW!tr.dldr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9963 W32.Mytob@mm Net-Worm.Win32.Mytob.bf W32.W.VBNA.tni6 TrojWare.Win32.TrojanDownloader.Delf.accr Win32.HLLM.MyDoom.based BehavesLike.Win32.Trojan.pc Net-Worm.Win32.Mytob Worm/Mytob.atd WORM/Mytob.MD Trojan/Win32.Rukap.C17970 Win32.Trojan.Hoster.Heur


Since in Android 8.0 ( SDK API 26 ) the system is able to kill idle services , this code raises a fake update notification to prevent it : Cybercriminals have the ability to control the implant via HTTP , XMPP , binary SMS and FirebaseCloudMessaging ( or GoogleCloudMessaging in older versions ) protocols .


A backdoor also known as: Trojan-Dropper.Win32.Small!O Win32.Trojan.WisdomEyes.16070401.9500.9996 Backdoor.Trojan BKDR_PUDORATE.A Win.Trojan.Pudorat-2 Trojan-Dropper.Win32.Small.ix Trojan.Win32.Pudorat.uvlp BackDoor.PudoRat Dropper.Small.Win32.205 BKDR_PUDORATE.A W32/Trojan.ATSN-3573 Backdoor/Pudorat.e BDS/Pudorat.E.Srv Trojan[Backdoor]/Win32.Pudorat Trojan.Graftor.Elzob.D2736 Trojan-Dropper.Win32.Small.ix Backdoor:Win32/Pudorat.E Trojan/Win32.Small.R102192 Backdoor.Pudorat Trojan.DR.Small!n8WI7XFkeRA Backdoor.Win32.Pudorat.G W32/Pudorat.E!tr.bdr


A backdoor also known as: Trojan.Katusha.Win32.25040 Win.Trojan.357100-1 Trojan.Win32.Abacab.zfokj BackDoor.Abacab.102 Trojan[Backdoor]/Win32.Revell Backdoor:Win32/Revell.1_02 Win32.Virus.Temcac.A@dam W32/Revll.102!tr.bdr


A backdoor also known as: W32.TrodowsLTK.Trojan Trojan/Cosmu.atqv BehavesLike.Win32.AdwareRBlast.dm Trojan.Zusy.Elzob.D560E Trojan.Win32.A.Cosmu.83456[h] Dropper/Malware.253952.FL TrojanDropper:Win32/Blmoon.A


DOC and XLS files with malicious macros


A backdoor also known as: Dropped:Trojan.Downloader.VU TrojanDownloader.Podcast Trojan/Downloader.Adload.ci Win32.Trojan.WisdomEyes.16070401.9500.9963 W32/Downloader.AIEZ TROJ_DLOADR.CH Win.Downloader.Adload-85 Dropped:Trojan.Downloader.VU Trojan-Downloader.Win32.Adload.amn Dropped:Trojan.Downloader.VU Trojan.Win32.Delf.epwf Trojan.Win32.Downloader.140800.D Dropped:Trojan.Downloader.VU TrojWare.Win32.TrojanDownloader.Adload.CI Dropped:Trojan.Downloader.VU Trojan.DownLoader6.4157 TROJ_DLOADR.CH BehavesLike.Win32.Fujacks.cc Downloader.Delphi W32/Downloader.RKBR-2696 TrojanDownloader.Adload.hk Adware.DollarRevenue TR/Drop.Start.abk.4 Trojan[Downloader]/Win32.Adload Trojan.Downloader.VU Troj.Downloader.W32.Adload.amn!c Trojan-Downloader.Win32.Adload.amn Trojan/Win32.Banload.R41470 Dropped:Trojan.Downloader.VU Trojan-Downloader.Win32.10213 Win32/TrojanDownloader.Adload.CI Win32.Trojan-downloader.Adload.Pkqr Trojan.DL.Adload!u3IAhoIxyiU


A backdoor also known as: W32.FamVT.FcodeNHc.Trojan Trojan.Dorv.S8319 Ransom.FileLocker Trojan.Foreign.Win32.9536 Ransom.FileLocker/Variant Trojan/Kryptik.aykk Win32.Trojan.Filecoder.u RANSOM_CRYPNAN_GA250444.UVPM Trojan.Win32.Encoder.egvznv Trojan-Ransom.Win32.FileCoder.nan Backdoor.Win32.Hlux.NAN Trojan.Encoder.217 RANSOM_CRYPNAN_GA250444.UVPM BehavesLike.Win32.PWSZbot.dh Trojan/Foreign.ewc Trojan[Ransom]/Win32.Foreign Ransom:Win32/Haperlock.A Trojan.Symmi.D4C7E Trojan/Win32.Foreign.R61679 BScope.Malware-Cryptor.Hlux Win32/Filecoder.NAN Trojan.Foreign!VfdOCZ5FB8A Trojan.Win32.Sisron Trj/Dtcontx.D


This report contains indicators of compromise IOCs and technical details on the tactics, techniques, and procedures TTPs used by APT actors on compromised victims' networks.


List of PlugX Command And Control servers used to attack targets in Asia.


A backdoor also known as: Backdoor.Win32.Chyopic!O Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_OGRAN.A Win.Trojan.Downloader-30022 Trojan.Win32.Chyopic.bksyf Trojan.Win32.S.Downloader.9984.A Backdoor.W32.Chyopic.bu!c Backdoor.Win32.Chyopic.A BackDoor.ClDdos.6 TROJ_OGRAN.A BehavesLike.Win32.FDoSBEnergy.zh TrojanDownloader.Ogran.j Trojan:Win32/Chcod.A Trojan[Backdoor]/Win32.Chyopic Trojan:Win32/Chcod.A Trojan/Win32.HDC.C33704 Trojan.Chcod!5jj9mkC/wqU Backdoor.Win32.Chyopic Win32/Backdoor.7b0


The customization doesn t end with the lure; the malware used in the campaigns is also targeted by region and vertical.


A backdoor also known as: Risktool.Flystudio.17330 DDOS_NITOL.SMD DDOS_NITOL.SMD Win.Trojan.7486152-1 Backdoor.Win32.Sethift.a Trojan.Win32.Spambot.wpwqo Trojan.Spambot.10932 BehavesLike.Win32.Downloader.qc Trojan.Win32.MicroFake Backdoor.Win32.Sethift.a Backdoor:Win32/Payduse.A!bit Trojan/Win32.PbBot.R11181 Trojan.Cosmu Trj/CI.A W32/Nitol.C Win32/Trojan.b7f


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G W32.Virut.CF Win32/Virut.17408 PE_VIRUX.Q Win.Trojan.Virut-377 Virus.Win32.Virut.q Virus.Win32.Virut.hpeg Win32.Virut.5 Virus.Virut.Win32.1938 PE_VIRUX.Q BehavesLike.Win32.Ipamor.lh Win32/Virut.bn Virus/Win32.Virut.ce Win32.Virut.cr.61440 Virus:Win32/Virut.BN W32.Virut.l5he Virus.Win32.Virut.q Win32/Virut.F Virus.Virut.13 Win32/Virut.NBP Backdoor.Win32.DsBot W32/Sality.AO


A backdoor targetting Linux also known as: Android.Trojan.FakeApp.FC Trojan:Fakebank.B Android.Trojan.FakeApp.FC HEUR:Trojan-Banker.AndroidOS.Asacub.ab A.H.Ste.Banker.B Android.BankBot.221.origin HEUR:Trojan-Banker.AndroidOS.Asacub.ab Android-Trojan/Banker.5d288 a.privacy.spiderbank Trojan-Banker.AndroidOS.RuBank Android/SpyBanker.HH!tr


Some of the settings include : The URL of the C & C server Service wake-up intervals Important package names Accessibility permissions status Lockdown screen status Recording status SMS app status Kill switch status Stealth To keep its resources safer and make analysis more difficult for researchers , TrickMo uses an obfuscator to scramble the names of its functions , classes and variables .


A backdoor also known as: Trojan-PWS.Win32.Banker.1!O Trojan/Kryptik.adfi Win32.Trojan.WisdomEyes.16070401.9500.9985 Infostealer.Bancos TROJ_BANKPTCH.SMA Trojan.PWS.Banker1.4670 TROJ_BANKPTCH.SMA Trojan-PWS.Win32.Banker Trojan/Menti.uci W32.Infostealer.Banker TR/Menti.A.2 Trojan/Win32.Unknown PWS:Win32/Banjori.A Trojan.Kazy.DFB0D TScope.Malware-Cryptor.SB W32/Krypt.CLE!tr


A backdoor also known as: PDF/Dropper.C!Camelot Bloodhound.PDF.24 PDF/Exploit.Pidief.PIT Heuristics.PDF.ObfuscatedNameObject Trojan.Script.ExpKit.esqnwi Exploit.PDF.Pidief.f Exploit.PDF.889 HEUR_PDFEXP.D BehavesLike.PDF.BadFile.dx PDF/Dropper.C EXP/Pidief.akc Exploit:Win32/Pdfdrop.D JS/SARS.S139 possible-Threat.PDF.Acmd VBS/BanLoader.BBAF!tr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9772 Win32.Worm.Autorun.R Trojan.Win32.Inject.srauk Heur.Packed.Unknown Trojan/Jorik.bmit TrojanDownloader:Win32/Roker.A W32/Llac.SHV!tr


And in an unusual reversal of typical bank phishing social engineering tactics, the phishing emails purport to be from the bank's customers.


A backdoor also known as: HW32.Packed.B01F Ransom_Troldesh.R011C0DB318 Win32.Trojan.WisdomEyes.16070401.9500.9997 Ransom_Troldesh.R011C0DB318 Trojan-Ransom.Win32.Shade.onr Troj.Ransom.W32.Shade!c Trojan.MulDrop7.59017 BehavesLike.Win32.ObfusRansom.dc TR/Injector.cjsif Ransom:Win32/Troldesh.A Trojan-Ransom.Win32.Shade.onr Trojan/Win32.Shade.R219897 TrojanRansom.Shade Ransom.Shade Trj/CI.A NSIS/Injector.YO Win32.Trojan.Shade.Szbw W32/Injector.YD!tr Win32/Trojan.Ransom.c29


A backdoor also known as: W32.ServicesIpripA.Trojan Trojan.Ripinip.C Backdoor/W32.Ripinip.20480.L Backdoor.Win32.Ripinip!O Backdoor.Ripinip.28625 Trojan.Ripinip.C Backdoor/Ripinip.eea Trojan.Ripinip.C Win32.Backdoor.Ripinip.b Backdoor.Ripinip BKDR_RIPNIP.SMIA Win.Trojan.Ripnip-3 Trojan.Ripinip.C Backdoor.Win32.Ripinip.eea Trojan.Ripinip.C Trojan.Win32.Ripinip.buwod Backdoor.Win32.A.Ripinip.20480 Trojan.Ripinip.C Backdoor.Win32.Ripinip.~eea Trojan.Ripinip.C Win32.HLLW.Autoruner.28406 BackDoor-EVC.a Backdoor.Win32.Ripinip BDS/Ripinip.BN Trojan[Backdoor]/Win32.Ripinip Backdoor:Win32/Ripinip.C Backdoor/Win32.Ripinip.R1964 Backdoor.Win32.Ripinip.eea Win32/Ripinip.AP BackDoor-EVC.a TScope.Malware-Cryptor.SB Backdoor.Win32.Rip.tji Backdoor.Win32.Ripinip.B


Recently a new Carbanak attack campaign dubbed Digital Plagiarist was exposed where the group used weaponized office documents hosted on mirrored domains, in order to distribute malware.


For instance, Sphinx ZeuS has enhanced its capabilities because of the Olympics.


Like BlackEnergy, the malware used by the so-called Sandworm APT group also known as Quedagh, Potao is an example of targeted espionage malware directed mostly at targets in Ukraine and a number of other post-Soviet countries, including Russia, Georgia and Belarus.


With their assistance, we have confirmed over 76 additional messages containing NSO exploit links.


The RC4 key is hardcoded in EventBot .


A backdoor also known as: Troj.Downloader.W32.AutoIt Trojan.Win32.Pasta.ztb Trojan.DownLoader11.57616 Trojan.Strictor.DE515 Trojan/Win32.Inject Trojan.Pasta IM-Worm.Win32.Sohanad


This ransomware is developed using the Go programming language.


A backdoor also known as: Trojan.Zusy.D3D963 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.PWS.Stealer.17779 BehavesLike.Win32.PUPXAG.fc Trojan.MSIL.gotl Trojan:MSIL/Elmb.A!bit Trj/GdSda.A


Electronicfrontierfoundation.org was not the only domain involved in this attack.


ITG03 used several previously unreported malwares, including backdoor and PowerShell scripts suggesting continued ITG03 interest in exploiting SWIFT three years after its initial campaign in 2016.


A backdoor also known as: TrojanPWS.Kelopol.A3 W32/Application.USPT-4138 Hacktool.Keylogger PWS:MSIL/Kelopol.B Trojan.Win32.KeyLogger.ctnnso Trojan.KeyLogger.14630 TSPY_KELOPOL.SM TR/Habbo.skdh Trojan.MSIL.Krypt.5 Trojan/Win32.Vapsup.R122716


In 2015, many of these techniques and activities remain in use.


In today's article, AnyRun look at LimeRAT, a modular piece of malware designed to give attackers control over a victim's computer and use it for crypto-mining or DDoS attacks.


We have dubbed the groups latest campaign Digital Plagiarist for its signature practice of mirroring legitimate sites using Tenmaxs TelePort Pro and TelePort Ultra site mirroring software onto similarly named domains, on which the TelePort Crew would host and serve up malware laden Office documents.


A backdoor also known as: Trojan.Win32.Kolweb!O Trojan.Lokrodem.25745 Trojan.Kolweb.Win32.139 Troj.W32.Kolweb.mBu8 Trojan/Kolweb.a Win32.Trojan.WisdomEyes.16070401.9500.9687 Adware.Margoc Win32/Startpage.SK Win.Trojan.Kolweb-96 Trojan.Win32.Kolweb.a Trojan.Win32.Kolweb.cxqwlv Trojan.Win32.A.Kolweb.224389[ASPack] Trojan.PWS.Mirka BehavesLike.Win32.Sality.fc Trojan/Kolweb.cm TR/Delf.CF.13 Trojan/Win32.Kolweb Trojan:Win32/Lokrodem.A.dll Trojan.Win32.Kolweb.a Trojan/Win32.Kolweb.C12167 Trojan.Kolweb Trojan.Graftor.D33DE Win32.Trojan.Kolweb.Edns Trojan.PWS.Delf!+6OEG1VoGF8 Win32/Trojan.f0c


In the case of Hancitor, it still seen as a favourite carrier of very much active malware families such as Pony and Vawtrak.


We believe that the operators of the Bunitu botnet are selling access to infected proxy bots as a way to monetize their botnet.


In May 2018, ITG03 actors stole $10 million from the Banco de Chile.


Our telemetry shows that H-W0rm is one of the most active RATs we ve seen, with infections observed across virtually all enterprise verticals and geographies in which Fidelis Cybersecurity products are deployed.


Its price starts around $2500 which is more than double the price of another recent entry to the market.


In April 2017 we started observing new rooting malware being distributed through the Google Play Store.


Within days , the Check Point research team detected another instance with a different package name but which uses the same code .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan:MSIL/Ploprolo.A


In order to infect the victims, the attackers distributed spear-phishing emails containing malicious word document, the email purported to have been sent from legitimate email ids.


A backdoor also known as: W32.MTSysAntiD.Worm Packed.Win32.Klone!O PWS-OnlineGames.es PE_MAGOVEL.A Win32.Virus.Induc.b W32/Induc.A Trojan.Packed.16 PE_MAGOVEL.A Win.Trojan.Packed-77 Virus.Win32.Induc.b Trojan.Win32.Downloader.85504.AX Backdoor.Win32.Delf.~DD Win32.HLLP.Lagic Backdoor.Hupigon.Win32.100099 BehavesLike.Win32.MultiPlug.nc W32/Induc.A Win32.Troj.Klone.ab.389660 W32.Induc.tnqE Virus.Win32.Induc.b PWS:Win32/Magovel.A Backdoor/Win32.Hupigon.C61571 Virus.Win32.Induc.c RiskWare.NakedPack Win32.Induc.A Backdoor.Rbot Virus.Win32.Viking.AV


We have seen this threat access online content, including:JDUDUIFIB.exe


A June 23 FireEye blog post titled Operation Clandestine Wolf discussed a cyber espionage group, known as APT3, that had been exploiting a zero-day vulnerability in Adobe Flash.


We collected a list of hashes and the files corresponding to those hashes were then retrieved from VirusTotal for further analysis.


A backdoor also known as: Trojan.VBKrypt Spyware.Pony Downloader.Ponik TSPY_HPFAREIT.SMB Trojan.Win32.VBKrypt.ymio Trojan.Win32.VBKrypt.evkxoj Trojan.VBKrypt.Win32.291698 BehavesLike.Win32.Fareit.ch Trojan.VBKrypt.cgbs TR/Dropper.VB.ocnhj Trojan.Win32.VBKrypt.ymio Trojan/Win32.VBKrypt.R213345 Trojan.VBKrypt Trj/GdSda.A Win32.Trojan.Vbkrypt.Amwf Trojan.VBKrypt!wORN5qK9fN4 Trojan.VB.Crypt W32/FareitVB.BEOK!tr


A week later, an anonymous user, supposedly the author of AES-NI ransomware the XData is based on, released the master private key.


A backdoor also known as: W32.Clod8cd.Trojan.9e70 Backdoor/W32.BlackAngel.780304 W32/Backdoor.AAVE-7405 Backdoor.Trojan BKDR_BLAKANGEL.A Backdoor.Win32.BlackAngel.05 Trojan.Win32.BlackAngel.hiov Backdoor.Win32.BlackAngel.780304 Backdoor.W32.BlackAngel.05!c Backdoor.Win32.BlackAngel.05 BackDoor.BlackAngel.5 Backdoor.BlackAngel.Win32.6 BKDR_BLAKANGEL.A BehavesLike.Win32.PWSZbot.bc W32/Backdoor.DMA Backdoor/BlackAngel.05 BDS/BlackAngel.05 W32/BlackAn.05!tr.bdr Trojan[Backdoor]/Win32.BlackAngel Backdoor.Win32.BlackAngel.05 Backdoor:Win32/BlackAngel.0_5 Backdoor.BlackAngel Win32/BlackAngel.05 Win32.Backdoor.Blackangel.Lndw Backdoor.Win32.BlackAngel


Since late November 2016, the Shamoon 2 attack campaign has brought three waves of destructive attacks to organizations within Saudi Arabia.


Only this time, it's a Hangul Word Processor HWP document leveraging the already known CVE-2015-2545 Encapsulated PostScript EPS vulnerability.


A backdoor also known as: Trojan/Sacto.e Trojan.Graftor.D1DEE6 BKDR_SACTO.SM0 Win32.Trojan.WisdomEyes.16070401.9500.9983 Backdoor.Trojan BKDR_SACTO.SM0 TrojWare.Win32.Sacto.A Trojan.PWS.Multi.1194 Backdoor:Win32/Sacto.A!dha W32/Sacto.E!tr


A backdoor also known as: Java.Exploit.CVE-2015-2590.A Java.Exploit.CVE-2015-2590.A Java.Exploit.CVE-2015-2590.A Exploit.Java.CVE20120507.cqxpdq Java/Downloader.BM Exp.CVE-2015-2590 JAVA_DLOADR.EFD Java.Exploit.CVE-2015-2590.A Java.Exploit.CVE-2015-2590.A Java.Downloader.1103 JAVA_DLOADR.EFD BehavesLike.Java.Downloader.zj Java/Downloader.BM Java.Exploit.CVE-2015-2590.A TrojanDownloader:Java/Reamshunt.A Java.Exploit.CVE-2015-2590.A Java.Exploit.CVE-2015-2590.A Exploit.Java_c.QQT


For the past several weeks, Forcepoint Security Labs have been tracking a seemingly low-profile piece of malware which piqued our interest for a number of reasons: few samples appear to be available in the wild; there is no previous documentation referring to the C2 domains and IP addresses it uses despite the domains appearing to be at least twelve months old; and, if its compilation timestamps are to be trusted, the campaign itself may have been active for at least six months before samples started to surface...


A backdoor also known as: Trojan.Zenshirsh.SL7 Trojan.DDur.Win32.4 Trojan/DDur.n Win32.Trojan.WisdomEyes.16070401.9500.9937 Trojan.Zlob Win.Trojan.Dnschanger-1136 Trojan.Win32.DDur.xjyd Trojan.Win32.Z.Ddur.16289 Trojan.Packed.253 BehavesLike.Win32.Vundo.lc Trojan.Win32.DNSChanger Win32.Troj.DNSChangerT.kg.14848 Trojan:Win32/Remetrac.C Trojan/Win32.Monder.C72152 BScope.Trojan.Sawbones.vf Win32/Trojan.e0c


The malware ’ s creators had used obfuscation to upload the new piece of malware to Google Play .


A group known as the Cutting Sword of Justice took credit for the Saudi Aramco attack by posting a Pastebin message on the day of the attack back in 2012, and justified the attack as a measure against the Saudi monarchy.


The fact the trojan can steal both the victim ’ s credentials and also can control their SMS messages and generated 2FA codes means DEFENSOR ID ’ s operators can bypass two-factor authentication .


A backdoor also known as: Trojan.Downloader.Murlo.FK Downloader.Murlo.Win32.1632 Trojan/Downloader.Murlo.fk Trojan.Downloader.Murlo.FK Trojan.DL.Murlo!u+ZN6N7ySiY W32/Downldr2.HWY Trojan.Downloader-8985 Trojan-Downloader.Win32.Murlo.fk Trojan.Win32.Murlo.kadq Trojan.Win32.Downloader.2560.J[h] NORMAL:Trojan.DL.Win32.Murlo.c!1185532 Trojan.Downloader.Murlo.FK TrojWare.Win32.TrojanDownloader.Murlo.FK Trojan.Downloader.Murlo.FK Trojan.DownLoader.26702 BehavesLike.Win32.Mamianune.xh TrojanDownloader.Murlo.ar Trojan[Downloader]/Win32.Murlo Win32.TrojDownloader.Murlo.fk.kcloud Win-Trojan/Murlo.2560.J Trojan.Downloader.Murlo.FK Win32/TrojanDownloader.Murlo.FK Trojan-Downloader.Win32.Tiny.hn Win32/Ngvck.BP


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9818 Riskware.Win32.FileTour.ednjdc Trj/GdSda.A


Trojan architecture and capabilities This malware is written in .NET using the Xamarin environment for mobile applications .


A backdoor also known as: HW32.Packed.EA17 Trojan.Tibs.BJ Worm/W32.Nuwar.31364 I-Worm.Zhelatin.eo.n1 Worm.Zhelatin.Win32.1360 W32/Zhelatin.eo Trojan.Tibs.BJ W32/EmailWorm.KUL Trojan.Packed.13 Trojan.Small-2710 Email-Worm.Win32.Zhelatin.eo Trojan.Win32.Zhelatin.chkpnw I-Worm.Win32.Zhelatin.31364[h] PE:Worm.Mail.Win32.Zhelatin.eu!1074243991 Trojan.Tibs.BJ Email-Worm.Win32.Zhelatin.eo Trojan.Tibs.BJ Trojan.Packed.140 Trojan.Vxgame.z TROJ_FORUCON.BMC W32/Worm.YFRS-1205 I-Worm/Zhelatin.cna W32/Tibs.EO@mm Worm[Email]/Win32.Zhelatin Worm.Zhelatin.eo.kcloud Trojan.Tibs.BJ Spammer:Win32/Clodpuntor.A Virus.Win32.Heur.d Trojan.Tibs.BJ Trojan.Vxgame.z Trojan-Downloader.Revelation.Tibs.B Worm.Win32.Zhelatin.Az Win32.Worm-email.Zhelatin.Hwwo Packer.Win32.Tibs Trojan.Tibs.BJ Downloader.Tibs.5.BO Trj/Spammer.ABX Win32/Trojan.be3


A backdoor also known as: W32.OnGameELXIAUS.Trojan Trojan.Win32.Buzy!O Backdoor.Tenrite.A4 Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_TENRITE_0000000.TOMA Trojan.Win32.Tens.as Trojan.Win32.Buzy.ikstz Trojan.Win32.A.Tens.13312 TrojWare.Win32.Tenrite.A Trojan.Click2.12702 BehavesLike.Win32.BadFile.lz Trojan.Win32.Tenrite TR/Buzy.3083.1 Trojan/Win32.Tens Trojan.Buzy.DC0B Trojan.Win32.Tens.as Backdoor:Win32/Tenrite.A Win32/Tenrite.A


A backdoor also known as: Adware.BrowseFox.Win32.220089 Trojan.Razy.D2BA2D Win32.Trojan.WisdomEyes.16070401.9500.9546 Win.Trojan.Server-24 Riskware.Win32.Server.ctchyk Program.Server.260 BehavesLike.Win32.HLLP.fz SPR/SmallHTTP.F GrayWare[Server-Web]/Win32.SmallHTTP Riskware.SmallHTTP! not-a-virus:Server-Web.Win32.SmallHTTP


A backdoor also known as: Trojan/OnLineGames.pmt Trojan.Win32.OnLineGames.djktr W32.Gammima.AG Win32/Pebox.Y Trojan-GameThief.Win32.OnLineGames.ajibj Trojan.PWS.OnLineGames!PDfLLBwapmw Trojan.PWS.Wsgame.37257 TR/PSW.OnlineGames.xbkj Trojan/PSW.OnLineGames.bylz PWS:Win32/DNFOnline.A Malware.Gammima!rem Win32/PSW.OnLineGames.PMT Trojan-GameThief.Win32.OnLineGames W32/Onlinegames.AJIBJ!tr PSW.OnlineGames3.ATWL Trj/CI.A


The Nyetya attack was a destructive ransomware variant that affected many organizations inside of Ukraine and multinational corporations with operations in Ukraine.


A backdoor also known as: Trojan.Win32.Pincav!O Trojan/Pincav.awm Win.Trojan.Pincav-604 Trojan.Win32.Pincav.awn Trojan.Win32.Pincav.drkdnm Trojan.Win32.A.Pincav.1185236 Troj.Clicker.W32.Small.kZ0E Trojan.Pincav.Win32.12742 Trojan/Pincav.chh Trojan/Win32.Pincav Trojan.Graftor.D836A Trojan.Win32.Pincav.awn Backdoor:Win32/Losfondup.A Trojan/Win32.Pincav.R42635 TScope.Trojan.Delf Backdoor.Losfondup!Ng6K/s6DvsI Trojan-PWS.Win32.Delf


If not , the application downloads a pack of exploits from the server and runs them one-by-one up until root is achieved .


Although the use of free web-services as a C2 channel is not new, the use of a Github issue for a command/response channel was interesting.


A backdoor also known as: W32.WinwebA.Trojan TrojanDropper.Henbang.A6 Win32.Worm.AutoRun.c W32/Adware.PXAH-3010 W32.Virut.CF Win32/SillyBHO.OL Worm.Win32.AutoRun.ibh Trojan.Win32.AutoRun.cqpmwl Trojan.MulDrop.32523 BehavesLike.Win32.AdwareBetterSurf.gh W32/Adware.ACXN Win32.Virut.cr.61440 TrojanDropper:Win32/Henbang.A Worm.Win32.AutoRun.ibh Win32.Trojan.Webdat.A Worm/Win32.AutoRun.R56346 Backdoor.WinNT.PcClient Win32/Worm.FakeFolder.FF


Instead , in Version 0.0.0.2 , EventBot dynamically loads its main module .


A backdoor also known as: W32.RansomwareTQB.Trojan Trojan.ServStart.A Troj.W32.StartServ.tnEy Trojan/ServStart.io Win32.Trojan.ServStart.aj Backdoor.Trojan TROJ_SERVSTART_GJ1000AC.UVPN Trojan.Win32.StartServ.xer Trojan.Win32.Heuristic131.dcnfpc Trojan.Win32.Z.Servstart.196709.QO TrojWare.Win32.ServStart.CA Trojan.Mrblack.3 Trojan.StartServ.Win32.135 TROJ_SERVSTART_GJ1000AC.UVPN Trojan.Win32.ServStart Trojan.Zusy.D23C29 Trojan.Win32.StartServ.xer Backdoor/Win32.Zegost.R117606 Trojan.StartServ Win32/ServStart.IO Win32.Trojan.Startserv.Huzb Win32/Trojan.a35


A backdoor also known as: Win32.Society.A W32/Society.DR Win32.Trojan.WisdomEyes.16070401.9500.9997 W95.Sosume.3363 PE_ALCAUL.H Win.Trojan.Alcaul-8 Virus.Win32.Alcaul.h Win32.Society.A Virus.Win32.Alcaul.ue W32.Alcaul.h!c Win32.Society.A Virus.Win32.Alcaul.h Win32.Society.A Win95.Necromancer.3363 PE_ALCAUL.H BehavesLike.Win32.Mental.xz W32/Risk.GISN-1213 Win32/Alcaul.h W32/Alcaul.H W32/Alcaul.H!tr.dr Virus/Win32.Alcaul Win32.Society.A Backdoor:Win32/Society.A Virus.Win9x.Repus Win32.Society.A W32/Alcal.F


A backdoor also known as: Trojan-Downloader.Win32.Dapato!O TrojanClicker.Baffec.A10 Trojan.Downloader Downloader.Dapato.Win32.1470 Trojan/Downloader.Dapato.fxd Win32.Trojan.WisdomEyes.16070401.9500.9610 TROJ_DAPATO_CA08278A.TOMC Trojan-Downloader.Win32.Dapato.fxd Trojan.Win32.Dapato.bxnvih Trojan.Downloader-Dapato Win32.Trojan-downloader.Dapato.Srdc TrojWare.Win32.Downloader.Dapato.FXD Trojan.DownLoad3.2529 TROJ_DAPATO_CA08278A.TOMC Trojan-Downloader.Win32.Dapato TrojanDownloader.Dapato.atd Trojan[Downloader]/Win32.Dapato TrojanClicker:Win32/Baffec.A Trojan.Delf.28 Trojan-Downloader.Win32.Dapato.fxd Downloader/Win32.Dapato.R22620 TrojanDownloader.Dapato Trojan.DL.Dapato!K0jxx5EHs9Y


Ongoing reporting by ClearSky


The users of this app include many well known celebrities who eventually post the dubbed videos on popular social networking platforms like Facebook and Twitter.