The choice of a lesser known currency with a good exchange rate allows the attackers to rapidly gain money while the sophisticated use of safeguards makes it resilient to most disruption attempts, potentially leaving victims infected for years.


A backdoor also known as: Trojan.Dembr Trojan.MBR.Killer Trojan/KillDisk.nas TROJ_KILLMBR.SM Win32.Trojan.WisdomEyes.16070401.9500.9964 W32/Jokra.DWCJ-4354 Trojan.Jokra Win32/Tnega.ASFM TROJ_KILLMBR.SM Trojan.Win32.EraseMBR.b Trojan.Win32.EraseMBR.cqzdgw Trojan.Win32.S.KillMBR.24576 Troj.W32.EraseMBR.b!c Trojan.KillFiles.10563 Trojan.EraseMBR.Win32.4 W32/Jokra.A Trojan/EraseMBR.h TR/KillMBR.Y.2 Trojan/Win32.EraseMBR Trojan.Win32.EraseMBR.b Trojan:Win32/Dembr.A Trojan.KillDisk.MBR OScope.Trojan.KillMBR.2113 Trojan.KillDisk.NAS Win32/KillDisk.NAS Trojan.Win32.DataWiper.b Trojan.EraseMBR!+80n0qBNT48 Trojan.Win32.EraseMBR W32/Kast.A!tr Win32/Trojan.c81


What makes the Turla group special is not just the complexity of its tools, which include the Uroboros rootkit, aka Snake as well as mechanisms designed to bypass air gaps through multi-stage proxy networks inside LANs, but the exquisite satellite-based C C mechanism used in the latter stages of the attack.


A backdoor also known as: W32.FamVT.ExpiroPC.PE Win32.Trojan.WisdomEyes.16070401.9500.9647 Heur.Corrupt.PE Trojan.MulDrop3.4445 TrojanDownloader:Win32/Cordmix.A


To achieve persistence, the malware creates a Run key Registry entry on the system.


Skygofree : Following in the footsteps of HackingTeam 16 JAN 2018 At the beginning of October 2017 , we discovered new Android spyware with several features previously unseen in the wild .


This industry initiative was created to share information and potentially disrupt the infrastructure and tools from an actor named the Lazarus Group.


Primarily targets South Korea.


A backdoor also known as: Trojan/W32.Inject.79360.B Trojan.Jinto Trojan/Inject.nzs Trojan.Heur.TP.EDF4BE Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan2.IJVQ TROJ_INJECT.AQT Trojan.Win32.Inject.79360 Troj.W32.Inject.nzs!c TrojWare.Win32.Inject.nzs Win32.HLLW.Recycler.8 Trojan.Inject.Win32.2004 TROJ_INJECT.AQT BehavesLike.Win32.PWSZbot.lh W32/Trojan.PLGK-4123 Trojan/Inject.dyx Win32.Troj.Inject.kcloud Trojan:WinNT/Jinto.A BScope.P2P-Worm.Palevo Trojan.Win32.Tdss Win32/Trojan.c68


A backdoor also known as: Trojan-Downloader.NSIS.FraudLoad.hd BackDoor.RMS.111 BehavesLike.Win32.Dropper.vc W32/Trojan.KGYI-2902 TR/RedCap.ntnqc Backdoor:Win32/Kitpolap.A Trojan-Downloader.NSIS.FraudLoad.hd Trojan/Win32.Downloader.C2123311 Trj/CI.A NSIS/Radmin.B Win32.Trojan.Ratenjay.Umsg Riskware.RemoteAdmin!


This domain is similar to the one the malware author used for his adware C & C communication , minigameshouse [ .


A backdoor also known as: W32.eHeur.Malware00 Backdoor.Sharat TROJ_TROXEN.CHU Win32.Trojan.WisdomEyes.16070401.9500.9995 TROJ_TROXEN.CHU Win.Trojan.Downbot-3 Trojan.DownLoader5.18587 Trojan.Heur.RP.EA89AF Downloader/Win32.Small.R1708 Win32/Sharat.A


Talos has found a new SPAM campaign that is using multiple layers of obfuscation to attempt to evade detection.


Package Name App Name com.whatsapp WhatsApp Messenger com.pugna.magiccall n/a org.telegram.messenger Telegram com.facebook.katana Facebook com.twitter.android Twitter jp.naver.line.android LINE : Free Calls & Messages com.instanza.cocovoice Coco com.beetalk BeeTalk com.gtomato.talkbox TalkBox Voice Messenger - PTT com.viber.voip Viber Messenger com.immomo.momo MOMO陌陌 com.facebook.orca Messenger – Text and Video Chat for Free com.skype.rover Skype ; 3rd party stores only Most of these apps are well established and available on Google Play , however , com.skype.rover appears to be available only on third-party app stores .


The spear-phishing campaigns we detected use links to RAR-compressed executables and Microsoft Word attachments that exploit the CVE-2012-0158 vulnerability.


FireEye Labs recently identified a previously unobserved version of Ploutus, dubbed Ploutus-D, that interacts with KAL's Kalignite multivendor ATM platform.


This feature was enabled only in newer versions of TrickMo that were tailored specifically for German banks and use a special application for implementing TAN-based 2FA .


A backdoor also known as: W32.HfsAdware.6E79 Application.Bundler.InstallBrain.A Application.Bundler.InstallBrain.A Win32.Adware.InstallBrain.d Win.Adware.Installbrain-35 Win32.Application.InstallBrain.B not-a-virus:AdWare.Win32.BrainInst.u Application.Bundler.InstallBrain.A Trojan.Win32.Adw.crasga Application.Bundler.InstallBrain.A Application.Win32.InstallBrain.BL Trojan:W32/InstallBrain.A Adware.Downware.1295 Adware.BrainInst.Win32.32 AdWare.Win32.InstallBrain AdWare/BrainInst.dz W32.Adware.Installbrain GrayWare[AdWare:not-a-virus]/Win32.BrainInst.u TrojanDownloader:Win32/Brantall.B PUP.InstallBrain/Variant not-a-virus:AdWare.Win32.BrainInst.u AdWare.BrainInst PUP.Optional.InstallBrain Win32.Adware.Braininst.Wvas Adware.BrainInst!


Beyond the Android app itself , other components such as the aforementioned ELF libraries have additional data-stealing capabilities .


Interestingly, as part of the delivery mechanism, the malware is disguised as a base64 digital certificate and decoded via certutil.exe.


A backdoor also known as: Win32.Backdoor.Zegost.B.5 Trojan/Redosdru.aw Backdoor.Bapkri TrojWare.Win32.GameThief.Magania.~NWABI Dialer.Bjlog Backdoor.Win32.Zegost!IK Backdoor/Win32.Bapkri Backdoor.Win32.Drwolf.fep Backdoor.Win32.Zegost W32/Bjlog.SMC!tr PSW.OnlineGames3.WQF


A backdoor also known as: Trojan-Downloader.Win32.Banload.bppx Trojan.Win32.A.Downloader.279193 Trojan.Qhost.3874 Downloader.Banload.Win32.43263 Trojan[Downloader]/Win32.Banload Trojan-Downloader.Win32.Banload.bppx TrojanDownloader:Win32/Servi.A


'' We determined that the " eCommon '' file contains support code and structures that are platform independent .


A backdoor also known as: Win32.Trojan.Kryptik.qb Trojan:Win32/Sopinar.D SScope.Malware-Cryptor.Drixed


A backdoor also known as: Trojan/W32.FakeGom.13314 Backdoor.Miancha.r5 Backdoor.Miancha! W32/Backdoor2.HTKG Backdoor.Miancha TROJ_DROPPR.YZ Backdoor.Win32.Miancha.b Trojan.Win32.Miancha.dxrsks Backdoor.W32.Miancha.b!c Win32.Backdoor.Miancha.Jcq Backdoor:W32/Miancha.A BackDoor.Miancha.1 Backdoor.Miancha.Win32.4 TROJ_DROPPR.YZ W32/Backdoor.IZWZ-3837 Backdoor/Miancha.a TR/Miancha.A.1 Trojan:Win32/Miancha.A Backdoor.Miancha Backdoor.Win32.Miancha Backdoor.Win32.Miancha.b Win32/Backdoor.3e8


To evade detection, this app was concealed as a legitimate app.


In recent months, Unit 42 has observed a number of attacks that we attribute to this group.


A backdoor also known as: W32.System3YM.Worm Worm.Win32.AutoRun!O Worm.Tupym.A5 W32/Tupym.worm Worm.AutoRun.FLD Worm.Autorun.Win32.63738 Trojan.Heur.AutoIT.2 Win32.Trojan.WisdomEyes.16070401.9500.9892 W32.Svich Win32/Yahlover.PT WORM_SOHAND.SM Win.Worm.Autorun-313 Worm.Win32.AutoRun.fnc Trojan.Script.Autorun.ddaffd W32.W.AutoRun.llU2 TrojWare.Win32.Injector.XEM Trojan.StartPage.31354 WORM_SOHAND.SM BehavesLike.Win32.Tupym.tz Worm.Win32.AutoRun Worm:Win32/Tupym.A Worm:Win32/Tupym.A Worm.Win32.AutoRun.fnc HEUR/Fakon.mwf Worm.Win32.Autorun.fnc Trojan.Autorun!VgV/xk+eV94 W32/AutoVt.AAAD!tr


A backdoor also known as: Backdoor.G.Door.2.0 Backdoor/W32.Hupigon.495616.Q Backdoor.G.Door.2.0 Backdoor/G_Door.20 Backdoor.G.Door.2.0 Trojan.Win32.GDoor.dhmh W32/GDoor.HMGD-8120 Backdoor.Trojan Win32/G_Door.A BKDR_GLACIER.A Trojan.G_Door.E Backdoor.Win32.G_Door.83 Backdoor.G_Door!J6XAtZWeqBw Backdoor.Win32.G-Door_20.Svr[h] Backdoor.W32.G_Door.20!c Backdoor.G.Door.2.0 Backdoor.Win32.G_Door.A Backdoor.G.Door.2.0 BackDoor.GDoor.20 Backdoor.GDoor.Win32.23 BKDR_GLACIER.A BackDoor-FR.svr W32/GDoor.D TR/GDoor.Srv W32/Gdoor.F!tr.bdr Trojan[Backdoor]/Win32.G_Door Backdoor.G.Door.2.0 BackDoor-FR.svr Backdoor.G_Door Bck/G_Door.I Win32.Backdoor.G_door.Szbj Backdoor.Win32.G_Door Backdoor.G.Door.2.0 Backdoor.Win32.G_Door.83 Win32/Trojan.a6d


Before we start dishing the details, there is going to be one main takeaway from this blog post: If you haven't already, update/patch your Adobe Flash now.


A backdoor also known as: Exploit/W97.CVE-2012-0158 Exp.OLE.CVE-2012-0158.E Win32.Exploit.CVE-2012-0158.l Doc.Exploit.CVE_2012_0158-17 Exploit.MSWord.CVE-2012-0158.de Exploit.ComObj.CVE-2012-0158.hzuf Exploit.WORD.CVE-2012-0158.A EXPL_MSCOMCTL.A Trojan.EKOP-3 EXP/CVE-2012-0158.hgyuv Trojan[Exploit]/MSWord.CVE-2012-0158.de Exploit.MSWord.CVE-2012-0158.de Exploit.CVE-2012-0158 MSWord/Toolbar.A!exploit virus.exp.20120158


A backdoor also known as: Backdoor.Banito.AQ Backdoor.Banito.ae.n3 Backdoor/Banito.aq Backdoor.Banito!msfCf/FWzGs W32/Banito.AI BKDR_BANITO.BE Backdoor.Win32.Banito.bt Backdoor.Banito.AQ Backdoor.Win32.Banito Backdoor.Banito.AQ BackDoor.Faggoty BKDR_BANITO.BE Backdoor.Win32.Banito!IK Backdoor/Banito.ao Backdoor:Win32/Banito.D Backdoor.Win32.Banito.54784.F[UPX] Backdoor.Banito.AQ Win-Trojan/Banito.54784.D OScope.Backdoor.Banito.1 Backdoor.Win32.Banito W32/Banito.AJ!tr.bdr Bck/Banito.AT


W32/NionSpy is a family of malware that steals information from infected machines and replicates to new machines over networks and removable thumb drives.


Domain names registered by the Fancy Bear actor


Early in March, while studying the ChinaZ threat, it became readily apparent that default passwords were being used for more than just a supplementary attack vector.


The vulnerability does not enable the execution of arbitrary code but the exploit was able to inject a JavaScript payload into the local file context.


A backdoor also known as: Virus.Multi.Moridin!O W32.Moridin.B PE_MORIDIN.A Win32.Trojan.WisdomEyes.16070401.9500.9999 W32.Morodi.A PE_MORIDIN.A Win.Trojan.Morid-5 Virus.Multi.Moridin.b Win32.Moridin.A Virus.Multi.Moridin!c Heur.Packed.Unknown Win32.Moridin Virus.Moridin.Win32.2 BehavesLike.Win32.Ipamor.cm W32/Trojan.BIOB-8512 TR/Moridin.B.2 Win32.Multi.b.106496 Trojan.Heur.FU.EB24AD Virus.Multi.Moridin.b Virus.Multi.Moridin W32/Moridin.72192 Win32.Virus.Moridin.Dzkb IRC.Moridin.B Trojan-Dropper.Win32.Loring W32/Moridin.B


Multiple versions of Regin were found in the wild, targeting several corporations, institutions, academics, and individuals.


System application installed by mcpef.apk .


A backdoor also known as: W32.Clod90c.Trojan.0a13 Trojan.BHO.ODS Trojan-Clicker/W32.BHO.20480.L TrojanDropper.Nonaco Trojan.BHO Riskware.Win32.E404.fyxw W32/Downldr2.HQQK Win32/Puper.RK Trojan.BHO.ODS Adware.BHO!Ut7EPOdXbSM Adware.E404.20480.B Trojan.BHO.ODS Trojan.BHO.ODS Trojan.Popuper.43732 Spyware[AdWare:not-a-virus]/Win32.BHO TrojanDropper:Win32/Nonaco.C Trojan.BHO.ODS W32/Downloader.GJMR-1771 Trojan.Win32.Dbg AdWare.Win32.BHO.aNN Win32/BHO.NHP not-a-virus:AdWare.Win32.E404


A backdoor also known as: W32.FamVT.RazyNHmA.Trojan Win32.Trojan.Kryptik.ayq TSPY_HPZBOT.SM1 TrojWare.Win32.DorkBot.LB TSPY_HPZBOT.SM1 BehavesLike.Win32.RansomTescrypt.ch Trojan.Win32.Crypt TR/Crypt.Xpack.itdny Trojan.Symmi.D1129F Trj/GdSda.A


Based on our research that we will further outline below, attackers behind the outages in two power facilities in Ukraine in December likely attempted similar attacks against a mining company and a large railway operator in Ukraine.


The group behind these attacks is known as Dragonfly.


A backdoor also known as: Application.iStartSurf.1 Application.iStartSurf.1 Win32.Trojan.WisdomEyes.16070401.9500.9915 NSIS/TrojanDownloader.Adload.AQ not-a-virus:HEUR:AdWare.Win32.AdLoad.heur Application.iStartSurf.1 Riskware.Nsis.Adload.dtchzc Adware.W32.Adload!c Trojan.Vittalia.1482 BehavesLike.Win32.AdwareAdload.tc TR/Dldr.Adload.1839597.7 TrojanDownloader:Win32/Quireap.A not-a-virus:HEUR:AdWare.Win32.AdLoad.heur PUP/Win32.Adload.R155445 Trj/CI.A NSIS.Adware.Adload.V


We have seen multiple Elirks variants using Japanese blog services for the last couple of years.


C & C communications The default C & C address is hardwired in the Rotexy code : The relative address to which the Trojan will send information from the device is generated in a pseudo-random manner .


Symantec telemetry revealed an exploit hosted on the compromised site, which was used to infect visitors with the Korplug back door detected by Symantec as Backdoor.Korplug.


This campaign uses obfuscated variants of the HTTPBrowser tool that use DNS as a control channel.


STRONTIUM has been active since at least 2007.


Check Point informed the Google Security team about the apps, which were then removed from Google Play.


Finally, this variant also contains an interesting piece of comment by the malware author written in the macro code, which made us feel obliged to take a closer look in the first place.


APT groups from multiple countries - including China - have been known to target organizations of strategic interest with aggressive malware-based espionage campaigns.


Back then, MELANI already took appropriate action together with the affected financial institutions and ISPs in Switzerland to mitigate the threat.


The credentials were immediately available in the leaky database – see Figure 6 .


Arsenal is currently developing a detailed case study related to our analysis of computers essential to the Odatv case in Turkey.


Another day, another ransomware gang.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9780 BehavesLike.Win32.StartPage.th Trojan-Dropper.Win32.Autoit Trojan.AutoIT.7 TrojanDropper.Autit Autoit.Trojan.Heur.Sxyf


This is the exact scenario we witnessed this week during an incident response procedure and that is detailed in this diary.


Buckeye also known as APT3, Gothic Panda, UPS Team, and TG-0110 is a cyberespionage group that is believed to have been operating for well over half a decade.


Looking at the characteristics of the tool, we suspect that it has been prepared for the purpose of corporate espionage.


A backdoor also known as: W32.HfsAutoA.29F2 Backdoor.Win32.Poison!O TrojanDropper.VB BKDR_POISON.IRE Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan Win32/IRCBot.ACS BKDR_POISON.IRE Trojan-Dropper.Win32.VB.cwek Trojan.Win32.Poison.cqxwv Backdoor.Win32.Poison.146621 Backdoor.W32.Poison.bfjd!c Backdoor.Win32.Poison.fh Trojan.VbCrypt.68 Backdoor.Poison.Win32.31435 BehavesLike.Win32.Autorun.ch Backdoor/Poison.goa Trojan[Backdoor]/Win32.Poison Trojan-Dropper.Win32.VB.cwek Worm:Win32/Neubreku.C SIM.Trojan.VBO.02298 Bck/Poison.AK Win32.Trojan-dropper.Vb.Aenv Backdoor.Win32.Bifrose W32/VBInjector.W!tr Win32/Trojan.Dropper.b73


RATs, such as H-W0rm, njRAT, KilerRAT, DarkComet, Netwire, XtremeRAT, JSocket/AlienSpy/Adwind and others, hold special interest for the Threat Research Team at Fidelis Cybersecurity.


A backdoor also known as: Android.Trojan.RootSmart.A Android.GGSmart.A Android.Malware.Trojan A.H.Rog.RootSmart.B Android.Trojan.GGSmart.d AndroidOS/GGSmart.A AndroidOS_RootSmart.D Android.Trojan.RootSmart.A HEUR:Backdoor.AndroidOS.RootSmart.a Android.Trojan.RootSmart.A Trojan.Android.RootSmart.bdbwsm Riskware.Android.FakeInstall.jab Trojan-Downloader:Android/RootSmart.A Android.Smart.4.origin AndroidOS_RootSmart.D AndroidOS/GGSmart.A Backdoor/AndroidOS.erl ANDROID/GGSmart.D.4 Trojan[Backdoor]/Android.RootSmart Android.Troj.GacBlocker.a.kcloud Android.Trojan.RootSmart.A HEUR:Backdoor.AndroidOS.RootSmart.a Android-Backdoor/RootSmart.1bb6 Android/GGSmart.D Trojan.AndroidOS.GGSmart Android/GGSmart.D!tr


A backdoor also known as: Exp.XML.CVE-2017-8570 W97M.Downloader Win32/Exploit.CVE-2017-8570.A TROJ_CVE20170199.JEJOPP Exploit.Xml.CVE-2017-0199.equmby PPT.S.Exploit.1356909 TROJ_CVE20170199.JEJOPP ZIP/Trojan.CGYR-2 XML/Dloader.S2 Exploit.CVE-2017-8570 MSOffice/Dloader!exploit.CVE20170199


A backdoor also known as: Trojan.PasswordStealer Trojan.Win32.Ric.exqwlt Trojan.Win32.Z.Evrial.35328.F Trojan.MulDrop7.60168 Trojan.MSIL.PSW TrojanSpy:MSIL/Evrial.A!bit TScope.Trojan.MSIL Trj/GdSda.A


Some emulators build their phone number out of the default number created in the emulator software and the port number : 5554. getMachine function using anti-emulator technique .


A backdoor also known as: Abuse-Worry/W32.NetPass.466944 Trojanspy.Vlogger.A3 Trojan/Spy.VB.nwb Trojan.Heur.RX.EB6D33 Win32.Trojan.WisdomEyes.16070401.9500.9997 Win32/VBInject.Stub Trojan.Win32.Diss.susqi Tool.NetPass.Win32.2684 Trojan[PSWTool]/Win32.NetPass PWS:Win32/Sifre.A Trojan.Win32.Diss.susqi Trojan/Win32.Sifre.R148157 Win32.Trojan.Diss.Lplb Riskware.PSWTool! Trojan.Win32.VB


A backdoor also known as: Exploit-CVE2012-0158.u Trojan.Mdropper TROJ_CVE20120158.MESD Exploit.Win32.CVE-2012-0158.aw Exploit.ComObj.CVE-2012-0158.hzuf Exploit.W32.Cve!c Exploit.Mht.1 TROJ_CVE20120158.MESD Trojan:Win32/Knonyme.CS!dha Exploit.WORD.CVE-2012-0158 Exploit.MSWord.CVE-2012-0158 Win32/Trojan.Exploit.a11


As 2016 comes to a close, we observe the same thing happening to another of Nintendo's game properties: Super Mario.


According to SimilarWeb, these sites have a combined total of at least 50 million visitors per month.


These emails contain misleading links that download malicious Zip files, which, in turn, contain a JavaScript file that downloads the TorrentLocker ransomware.


At this time , the Trojan also began actively using different methods of obfuscation .


Unit 42 has discovered a new cluster of malware samples, which targets Samsung devices and Korean language speakers, with relationships to the malware used in Operation Blockbuster.


A backdoor also known as: Win.Trojan.Secrar-3 W32.W.Otwycal.l4av PUA.RiskWare.PEMalform Trojan:Win32/Secrar.A Win32/RiskWare.PEMalform.E


A backdoor also known as: Trojan.Scache.A Trojan.Scache.A Trojan.Scache.A Trojan.Scache.A Trojan.Dos.Scache.fnss TROJ_SCACHE.A Trojan.DOS.Scache Troj.DOS.Scache!c Trojan.Scache.A TrojWare.DOS.Scache Trojan.Scache.A Trojan.Cashe Trojan.Scache.DOS.2 TROJ_SCACHE.A TR/Scache.A W32/Scache.A!tr Trojan/DOS.Scache Trojan.Scache.A Dos.Trojan.Scache.Aguy Trojan.Scache.A Trojan.DOS.Scache.aa


One of the unique features of the malware is that it retrieves its C2 address by accessing a pre-determined microblog service or SNS.


This makes it a powerful tool for attackers.


The calls are almost certainly a pro-Russia propaganda effort designed to create negative political content about those who have spoken out against Russian President Vladimir Putin and, in the last year, opposed Russia's invasion of Ukraine.


While these attacks were covered extensively in the media, how the attackers stole these credentials and introduced W32.Disttrack on targeted organizations' networks remains a mystery.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9990 W32.Sand.12300 Virus.Win32.HLLP.Alcaul.c Virus.Win32.HLLP.Alcaul.D Win32.HLLP.Alcopaul.12296 Win32.NGVCK.TTD Win32/HLLP.Alcaul.c W32/Alcaul.D Virus.Win32.HLLP.Alcaul.c Worm:Win32/Lopy.A


A backdoor also known as: Backdoor.Nioupale Trojan/Daserf.b Trojan.Heur.PT.E6A39B BKDR_DASERF.ZCEG-A Win32.Trojan.WisdomEyes.16070401.9500.9999 BKDR_DASERF.ZCEG-A Trojan.Win32.Scar.hnib Trojan.Win32.Invader.ervtpc Troj.Dropper.W32.Small.kZ2V Trojan.Inject1.18880 BehavesLike.Win32.Backdoor.kh W32/Trojan.MWNM-9354 Trojan/Win32.Scar Backdoor:Win32/Nioupale.A Trojan.Win32.Scar.hnib Trojan/Win32.Scar.R68534 Trojan.Scar Win32.Trojan.Scar.Llhd W32/Scar.HNIB!tr Win32/Trojan.97a


A backdoor also known as: MemScan:Backdoor.Hupigon.APH Win32.Backdoor.Hupigon.axbr.10 Backdoor.Graybird BKDR_HUPIGON.ASJ Backdoor.Win32.Hupigon.aha MemScan:Backdoor.Hupigon.APH MemScan:Backdoor.Hupigon.APH BackDoor.Pigeon.194 BKDR_HUPIGON.ASJ Backdoor.Win32.Hupigon!IK MemScan:Backdoor.Hupigon.APH Backdoor.Win32.Hupigon.cmpw Backdoor.Win32.Gpigeon2008.acj Backdoor.Win32.Hupigon BackDoor.Hupigon5.ARLC


A backdoor also known as: WS.Reputation.1 Trojan.Strictor.D148BF


It says those were sent in the report to the FBI.


The experts of G DATA's SecurityLabs analyzed a specially crafted Microsoft Word document the attackers used to install a rather famous banking Trojan called Dridex.


Decompiled exploit function code fragment run_with_mmap function from the android-rooting-tools project As can be seen from the comparison , there are similar strings and also a unique comment in Italian , so it looks like the attackers created this exploit payload based on android-rooting-tools project source code .


Attackers, regardless of their skills and motives, often attempt to wrap malicious code in a way that will seem innocuous to practitioners and security products.


The vulnerability bypassed most mitigations prior to patch availability; however, FireEye email and network products detected the malicious documents.


This incident happened on an Android 6.0.1 device, owned by one of the company's Vice Presidents.


Morphisec researchers began investigating the attacks on April 24 and continue to uncover more details.


This means the attacker can craft a phishing website without the user knowing it is visiting a phishing site.


A backdoor also known as: PSWTool.Win32.Ophcrack!O Tool.Ophcrack.Win32.15 W32/MalwareF.MTNL not-a-virus:PSWTool.Win32.Ophcrack.a Application.PassView.BE Tool.PassSteel.1076 BehavesLike.Win32.Dropper.rc W32/Risk.YHKN-9333 RiskWare[PSWTool]/Win32.PWDump.at Application.PassView.BE not-a-virus:PSWTool.Win32.Ophcrack.a Application.PassView.BE Trojan.PSWTool!8KQf3yAIaxc not-a-virus.PSWTool.ophCrack


A university class student list including the C & C domain registrant Due to poor privacy practices on the part of our culprit ’ s university , we now know his date of birth ( probably : he seemingly used his birth year as part of his Gmail address , as further partial confirmation ) , we know that he was a student and what university he attended .


The ransom note contains the following text:


A backdoor also known as: Heur.Corrupt.PE Worm:Win32/Fanta@mm.dam#2 Worm.Win32.Fanta


Dridex is a banking trojan, which is a bot that communicates with a C&C server through HTTP.


URL Status IP Domain registration date http : //ora.studiolegalebasili [ .


A backdoor also known as: W32.Virut.G W32/Trojan2.MPL W32.Virut.CF W32/Virut.GE Virus.Win32.Virut.ce Win32.Virut.AM Trojan.Opclose TR/VB.EWS Worm.Win32.SillyFDC!IK Worm/Kolab.jfi Virus:Win32/Virut.BN Win32/Virut.F W32/Trojan2.MPL Virus.Virut.13 Win32.Virut.dz Worm.Win32.SillyFDC W32/Sality.AO


After further investigation, we realized that its infrastructure for exfiltrating credentials was still operational and that Ebury was still being actively used by the Windigo gang.


The attackers compromised two legitimate Thai websites to host the malware, which is a tactic this group has used in the past.


A backdoor also known as: Trojan.SMSHoax Dropper.Dapato.Win32.20900 Win32.Trojan.WisdomEyes.16070401.9500.9953 TROJ_GE.CFDA1E9F Win.Trojan.Inject-14546 Trojan.Win32.InstallMonster.cxzobk Win.Troj.mzIo TrojWare.Win32.Injector.BCBA Trojan.InstallMonster.120 TROJ_GE.CFDA1E9F BehavesLike.Win32.Backdoor.rc Hoax.Win32.ArchSMS Trojan/Inject.awic TR/Rogue.11221316.14 Win32.Troj.Undef.kcloud Trojan.Injector!UXjGJT5Czj8 W32/Injector.BCBB!tr


A backdoor also known as: TrojanDownloader.Small.AIA4 Trojan.Buzy.518 TROJ_DLOADR.SMUS Win32/Small.QR TROJ_DLOADR.SMUS Trojan.DownLoader6.35083 BehavesLike.Win32.RansomWannaCry.mz Trojan.Win32.Malex TrojanDownloader:Win32/Onitab.B Trojan/Win32.Downloader.R33065 Trj/CI.A Win32/TrojanDownloader.Small.PAL


A backdoor also known as: Trojan/W32.Scar.499712.C Trojan-Ransom.Win32.Blocker!O TrojanDropper.Dwonk.A Trojan/Chydo.cdh TROJ_RENOS.SM Win32.Worm.AutoRun.bj W32/Trojan2.JXKJ Win32/SillyAutorun.CCQ TROJ_RENOS.SM Trojan-Ransom.Win32.Blocker.ckeq Trojan.Win32.Drop.ihult Trojan.Win32.Chydo.1032192 TrojWare.Win32.Scar.AB Trojan.MulDrop.46689 Backdoor.Klon.Win32.955 BehavesLike.Win32.Backdoor.gc Trojan.Win32.Chydo W32/Trojan.GFJX-4360 Trojan/Scar.cym Trojan/Win32.Scar Trojan-Ransom.Win32.Blocker.ckeq TrojanDropper:Win32/Dwonk.A Trojan/Win32.Chydo.R3468 Trojan.Chudik.28205 Trojan-ransom.Win32.Blocker.ckeq Trojan.Chydo!nNe8FVSDJ+I Win32/Trojan.16c


The second phase is when an attachment from the malspam retrieves ransomware from a web server.


These malicious installers were then uploaded to Baidu's cloud file sharing service for used by Chinese iOS/OS X developers.


( It is specified in the interception template whether a reply must be sent , and which text should be sent to which address .


The Trojan waits for incoming SMS messages ( the “ alarmReceiver.class ” ) and checks whether these messages contain one of the following commands : “ sms ” , “ contact ” , “ location ” , “ other ” .


The technical details of the attack have yet to be made public, however we've recently identified tools uploaded to online malware repositories that we believe are linked to the heist.


A backdoor also known as: Backdoor/W32.Visel.41946 Backdoor.Visel.Win32.404 Backdoor.W32.Visel.asz!c Backdoor/Visel.asd Win32.Trojan.WisdomEyes.16070401.9500.9969 Backdoor.Trojan Trojan-GameThief.Win32.Magania.tqse Trojan.Win32.Visel.bqjxis BackDoor.Darkshell.270 BehavesLike.Win32.Downloader.ph Backdoor.Win32.Visel Backdoor/Visel.sw TR/Drop.Strigy.A.2 Trojan[Backdoor]/Win32.Visel TrojanDropper:Win32/Strigy.A Backdoor.Win32.A.Visel.39424 Trojan-GameThief.Win32.Magania.tqse Backdoor/Win32.CSon.R885 Win32.Trojan-gamethief.Magania.Pfju Trojan.DR.Strigy!SJEu21JfMbU W32/Visel.ASZ!tr.bdr Trj/ByShell.C Win32/Trojan.b7f


In 2016, from September through November, an APT campaign known as menuPass targeted Japanese academics working in several areas of science, along with Japanese pharmaceutical and a US-based subsidiary of a Japanese manufacturing organizations.


Attacks originating from this threat group have not ceased since our previous report from April of 2017 and have continued through July of 2017.


It searches the Android and Google Chrome browsers for stored sensitive information.


The malicious capabilities observed in the second stage include the following : Upload attacker-specified files to C2 servers Get list of installed applications Get device metadata Inspect itself to get a list of launchable activities Retrieves PDF , txt , doc , xls , xlsx , ppt , pptx files found on external storage Send SMS Retrieve text messages Track device location Handle limited attacker commands via out of band text messages Record surrounding audio Record calls Record video Retrieve account information such as email addresses Retrieve contacts Removes copies of itself if any additional APKs are downloaded to external storage .


However , it has begun to target users all around the world , especially users in countries like China , Taiwan , France , Switzerland , Germany , United Kingdom , United States , and others .


] net linkdatax [ .


Royal Mail - British postal service and courier company .


The functionality of Pro PoS seems fairly extensive according to recent press releases.


The summer months dawn on us and the financial year comes to a close.


Today, we are releasing the full whitepaper on the Potao malware with additional findings, the cyberespionage campaigns where it was employed, and its connection to a backdoor in the form of a modified version of the TrueCrypt encryption software.


Dropped by the Nuclear exploit kit, further investigation showed that the malware was a new Trojan called Thanatos by its developers and that we refer to internally as Alphabot


The second stealing function is the onStartCommand , which steals infected device data and additional information .


A newly patched zero-day vulnerability in Internet Explorer has already been exploited in attacks involving a compromised website belonging to an evangelical church in Hong Kong.


A backdoor also known as: W32.Clod748.Trojan.b154 Trojan.DR.Cutwail!zuYZ2Zvwu1k Trojan.Zlob PE:Trojan.Win32.DNSChanger.drb!1075148351 TrojWare.Win32.Trojan.DNSChanger.~CRSD Trojan.Packed.194 Win32.Troj.DNSChangerT.dx.14848 Trojan:Win32/Zlob.AS Trojan/Win32.Monder Virus.Win32.Heur.c Trojan.Inject Downloader.Tiny.D


Webinjects : According to the bot ’ s configuration , if a webinject is set for a given application , it will be executed .


Indeed, the past few months seem to be quite busy for the Andromeda botnet and its recent activity indicates intent in the United States.


A backdoor also known as: Trojan.Symmi.D13DDA Win.Trojan.Delf-6394424-2 Trojan-Downloader.Win32.Delf.krvg Trojan.Win32.Delf.evdbqw BehavesLike.Win32.BadFile.th Trojan-Downloader.Win32.Delf TR/Downloader.sfpmb Trojan-Downloader.Win32.Delf.krvg Trojan/Win32.Tiggre.C2290717 Trj/GdSda.A W32/Delf.CGH!tr.dldr


These artifacts indicate that FakeSpy 's campaign is still live and under development .


A backdoor also known as: Trojan.MSIL.BindEx.A3 Trojan.MSIL.BindEx.a Win32.Risk.Malware.Szbo Trojan.InstallCube.49 Trojan.Zusy.D3BCBB Trojan.MSIL.BindEx.a Trojan:MSIL/Torwofun.A Trj/CI.A


A backdoor also known as: Trojan/Qhost.pml Win32/Jeefo.A Virus.Win32.Hidrag.a Win32.Jeefo.B Virus.Win32.Hidrag.clfcen Win32.Jeefo.B Win32.HLLP.Jeefo.36352 Trojan:Win32/Vb.At W32/Hidrag.E Virus/Win32.Hidrag.a Win32.Jeefo.B Virus.Win32.Hidrag.a Win32.Jeefo.B


This feature is designed to block one application from accessing the data of other applications without rooting the device .


The identification of cyber crime actors, particularly Nigerian 419 scam operators, attempting to exploit CVE-2014-4114 demonstrates how quickly cyber criminals are trying to exploit a vulnerability previously associated with espionage actors, using similar tactics, techniques, and procedures TTP to maximize their chances of success, with additional innovation as seen with these samples.


This assessment is supported by both previous X-Force research and open source reporting on ITG08, although X-Force lacks definitive data that verifies this was the initial access vector.


A backdoor also known as: W32.Winlogonxe.Trojan Trojan-PSW.Win32.Papras!O Trojan.Fsysna Win32.Trojan.WisdomEyes.16070401.9500.9984 Trojan.Win32.Fsysna.dikb Trojan.Win32.Papras.bsmtj Trojan.Win32.A.PSW-Papras.39982 Troj.PSW32.W.QQPass.l2mO Trojan.DownLoader.origin Trojan.OnLineGames.Win32.77881 BehavesLike.Win32.SpywareLyndra.nh Backdoor.Win32.DarkMoon Trojan/PSW.Papras.ut Trojan[PSW]/Win32.Papras Win32.PSWTroj.Papras.kcloud Trojan.Win32.Fsysna.dikb Backdoor:Win32/Votwup.B Trojan/Win32.Papras.R7955 Win32.Trojan.Fsysna.Edxa Win32/Trojan.b7e


A backdoor also known as: Trojan.Kazy.D26B7F Win32.Trojan.WisdomEyes.16070401.9500.9941 W32/Trojan.ITVV-3454 Trojan.MulDrop4.59905 BehavesLike.Win32.Trojan.fh Trojan:Win32/Yangxiay.A Win32/Trojan.6f6


GET_TASKS - Allows the application to get information about current or recently run tasks .


A backdoor also known as: Trojan.Skeeyah.5634 Trojan.Zusy.D38734 TROJ_FASTREK.SM Win32.Trojan.WisdomEyes.16070401.9500.9982 TROJ_FASTREK.SM Trojan.Win32.Dwn.dqtjmk Trojan.DownLoader12.58274 W32/Trojan.UUJD-8445 Worm:Win32/Pemtaka.A Win32/Trojan.562


EventBot Listening to TYPE_VIEW_TEXT_CHANGED accessibility event Listening to TYPE_VIEW_TEXT_CHANGED accessibility event .


A backdoor also known as: W32.Clod9fb.Trojan.3b9b Joke.MoveDesktop W32/MoveDesktop.A TROJ_SPNR.04CJ11 Joke.Slidescreen.4 JOKE/MoveDesktop.A TROJ_SPNR.04CJ11 Win32.Troj.Hoax.kcloud Joke:Win32/Crazyscr.A Joke.Win32.Metro Trj/CI.A Win32/Joke.SlideScreen Joke.Win32.ShakeScreen.b Virus.Win32.BHO Joke.BR Trojan.Win32.BadJoke.Ar


On October 26, 2015, Cyphort Labs discovered that psychcentral[.]com has been compromised and is currently infecting visitors via drive-by-download malwares.


READ_SMS - allow the application to read text messages .


In earlier versions , it operated with shell commands like this : Stealing WhatsApp encryption key with Busybox Social payload Actually , this is not a standalone payload file – in all the observed versions its code was compiled with exploit payload in one file ( ‘ poc_perm ’ , ‘ arrs_put_user ’ , ‘ arrs_put_user.o ’ ) .


A previously unknown group called Strider has been conducting cyberespionage-style attacks against selected targets in Russia, China, Sweden, and Belgium.


Terracotta's network of 1500+ VPN nodes throughout the world are primarily obtained by hacking into inadequately protected Windows servers in legitimate organizations, without the victim's knowledge or permission.


There , they are prompted to download a new version of the mobile app , under which guise the Trojan is hidden .


Multiple owners of Github repositories received phishing emails.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Kryptik.UMVM-2214 TrojWare.MSIL.Kryptik.ACD Trojan.KillProc.49202 BehavesLike.Win32.Trojan.fh W32/Kryptik.PD Trojan.Zusy.D33DFF Trojan/Win32.Dynamer.C2272217 Trojan.ScreenLocker Trj/GdSda.A


A few days ago I got a message on Facebook from a person I very rarely speak to, and I knew that something fishy was going on.


We found two vulnerabilities that were now being targeted by exploit kits, with one being the recent Pawn Storm Flash zero-day.


Even without capabilities to exploit a device , the packages were able to exfiltrate the following types of data using documented APIs : Contacts Audio recordings Photos Videos GPS location Device information In addition , the packages offered a feature to perform remote audio recording .


While we do not have complete targeting , information associated with these Poison Ivy samples , several of the decoy files were in Chinese and appear to be part of a 2016 campaign targeting organizations in Taiwan with political-themed lures .


The malware was distributed from infected devices via SMS in the form “ % USERNAME % , I ’ ll buy under a secure transaction .


Continuing with the never ending series of malware email attachments is an email with the subject of payment slip coming or pretending to come from random companies, names and email addresses with an ACE attachment ACE files are a sort of zip file that normally needs special software to extract.


A backdoor also known as: W97m.Downloader.GBT W97M.Downloader.BHA W97M.Downloader W2KM_POWLOAD.AUSJQU W97m.Downloader.GBT W97m.Downloader.GBT Trojan.Ole2.Vbs-heuristic.druvzi W97m.Downloader.GBT W97m.Downloader.GBT W2KM_POWLOAD.AUSJQU HEUR.VBA.Trojan.e virus.office.qexvmc.1095


A backdoor also known as: W32.HfsAutoB.E388 Trojan.Zusy.D3675 Backdoor.Trojan Win32/Talwadig.A Spammer:Win32/Talwadig.A W32/Talwadig.SPM!tr Win32/Trojan.49c


A backdoor also known as: Trojan/Spy.Burda.vq W32/Trojan2.LHHI Trojan-Spy.Win32.Burda.bun TrojWare.Win32.Spy.Burda.A Trojan.Packed.1027 TROJ_BURDA.SM Win32/SinoMBR.A W32/Trojan2.LHHI Virus.Win32.SinoMBR!IK Trojan:Win32/Riggin.B Trojan-Spy.Win32.Burda.r Virus.Win32.SinoMBR Downloader.Small.61.BV


The recent vulnerability of MS15-093 revealed that attackers were using it distribute the Korplug/Plugx RAT.


HenBox Roosts HenBox has evolved over the past three years , and of the almost two hundred HenBox apps in AutoFocus , the vast majority contain several native libraries as well as other components in order to achieve their objective .


The brazen attack used chained 0-days against Adobe Flash and Microsoft Internet Explorer 9 to attempt to gain access to internal networks at these companies.


A backdoor also known as: Trojan.Ransom.MSIL.1 Win32.Trojan.WisdomEyes.16070401.9500.9592 Ransom_HEROPOINT.A Trojan.Win32.Ransom.ewrnqz Trojan.Win32.S.Ransom.29184.B Ransom_HEROPOINT.A Trojan-Ransom.Heropoint Trojan.MSIL.ieap TR/Ransom.gohtu Ransom:MSIL/Crypute.C Trojan.Ransom.Filecoder Trj/GdSda.A Win32/Trojan.Ransom.935


A backdoor also known as: Trojan/Kryptik.myh Win32.Trojan.WisdomEyes.16070401.9500.9688 Trojan.Win32.Click1.cpofr Trojan.Click1.34698 TR/Taranis.3998 Win32.TrojDownloader.Unknown.kcloud TrojanDownloader:Win32/Mimho.A Trj/CI.A


The worst affected were companies in the smelting, electric power generation and transmission, construction, and engineering industries.


Spread via hacked Aeria games offered on unofficial websites, the modular malware can download and install virtually any other malicious code on the victim's computer.


A backdoor also known as: Trojan.Emotet.MUE.A5 Backdoor.PePatch.Win32.40158 Trojan/Urelas.u Win32.Trojan.Urelas.a Backdoor.Graybird TROJ_URELAS.SMC Win.Trojan.Urelas-212 Trojan.Win32.demmsd.eaqemx Ransom.Win32.CryLock.a Trojan.AVKill.33464 TROJ_URELAS.SMC BehavesLike.Win32.Gupboot.hc Trojan.Win32.Toga Backdoor/Plite.ah Trojan.Zusy.D1C63F Trojan/Win32.Urelas.R92523 BScope.Backdoor.Gulf Trojan.Urelas.U Trojan.Urelas!2wQyqHhm58c W32/Urelas.AB!tr


The analysis starts with a Microsoft Word document named 2017 Q4 Work Plan.docx with a hash of 292843976600e8ad2130224d70356bfc, which was created on 2017-10-11 by a user called Admin'', and first uploaded to VirusTotal, a website and file scanning service, on the same day, by a user in South Africa.


A backdoor also known as: Trojan.Estiwir.S21079 Trojan.Win32.Estiwir Trojan:Win32/Estiwir.A Trj/CI.A Win32/Trojan.87b


We also learned that an Android malware known as GhostCtrl was stored in their infrastructure, which might be used for cyberespionage or cybercrime.


A backdoor also known as: W32.OnGameExQSJKAH.Trojan Backdoor.Pahador.Win32.1 Backdoor/Pahador.t BKDR_PAHADOR.AB Win32.Trojan.WisdomEyes.16070401.9500.9967 W32/Backdoor.QCR Win32/Spybot.AEZ BKDR_PAHADOR.AB Win.Trojan.Delf-939 Trojan.Win32.Fsysna.dhnu Trojan.Win32.Pahador.dkwu Backdoor.Win32.Pahador.801128 Troj.W32.Fsysna!c Backdoor.Win32.Pahador.T Program.Vskeylogger Backdoor.Win32.Pahador W32/Backdoor.PLOG-4776 Backdoor/Pahador.ai Trojan[Backdoor]/Win32.Pahador Win32.Hack.Pahador.t.kcloud Backdoor.Pahador Trojan.Win32.Fsysna.dhnu Trojan/Win32.Pahador.R2394 TScope.Trojan.Delf Win32/Pahador.T Win32.Trojan.Fsysna.Dyzz Backdoor.Pahador!aVEw4P0RDQo W32/Sfmybd.C3E3!tr Win32/Trojan.05c


] com ’ was registered via GoDaddy , and uses privacy protection service .


However, getting 83 pieces in one shot is way too generous by any account and it surely peaked the interest of our researchers.


A backdoor also known as: Trojan.Mauvaise.SL1 Adware.TOVus.Win32.1 HT_TOVKATER_GC31024C.UVPM Win32.Trojan.WisdomEyes.16070401.9500.9998 HT_TOVKATER_GC31024C.UVPM AdWare.TOVus Trojan.Win32.Tovkater.emvdzi Trojan.InstallMonster.2420 Pua.Downloadmanager TrojanDownloader:Win32/Katerav.A!bit Trojan.Zusy.D37F51 PUP.Optional.BundleInstaller Win32/TrojanDownloader.Tovkater.D Trojan-Downloader.Win32.Tovkater W32/Tovkater.F!tr.dldr


A backdoor also known as: W32/Bindo.worm W32/Malas.LPWD-1696 W32.Linkfars Win.Worm.AutoRun-1 P2P-Worm.Win32.Malas.r Heur.Corrupt.PE P2P-Worm:W32/Malas.A W32/Bindo.worm W32/Malas.A WORM/Khanani.A Worm:Win32/Malas.A P2P-Worm.Win32.Malas.r W32/Nahkos.D.worm P2P-Worm.Win32.Malas W32/Malas.R!worm


To be installed , it needs the victim to allow installation of apps from unknown sources in the device settings .


A backdoor also known as: Trojan.MSIL Trojan.MSILPerseus.DE1E5 Trojan.MSIL.Fakesupport W32/Trojan.VUDL-1796 Trojan.MSIL.idlr W32.Bsodscam.Locker SupportScam:MSIL/TechscamBSOD.A PUP/Win32.FakeBSOD.R192454 Trojan.TechSupportScam


The operation seems to originate from Saudi Arabia mostly; seeing its C2 IP is a home IP address and njRat does not support proxying C2 communciations over infectees.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9802 Trojan.Win32.VkHost.aeys Trojan.Win32.Delf.wgpjk Troj.W32.Vkhost!c Win32.Trojan.Vkhost.Wtxk Trojan.PWS.Spy.14811 BehavesLike.Win32.BadFile.fh W32/Trojan.HSNN-1750 Trojanspy:Win32/Fitmu.A BDS/Delf.aegx W32/VkHost.AEYS!tr Trojan[Backdoor]/Win32.Delf Trojan.Graftor.D754C Trojan.Win32.Z.Graftor.401229 Trojan.Win32.VkHost.aeys Trojan:Win32/Kuta.A Trojan/Win32.Delf.C161449 Backdoor.Delf Win32/Bicololo.D Backdoor.Win32.Delf


We first learned of Locky through Invincea and expanded on qualifying this threat with the help of PhishMe. Locky has also gained enough traction to find its way onto Dynamoo's Blog and Reddit.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9638 Trojan.Dropper Win32/SillyDl.XVX Win.Trojan.Msupdater-1 Trojan-Ransom.Win32.Blocker.cfzl Trojan.Win32.Inject.cmocx Trojan.MulDrop3.62588 Trojan.Blocker.Win32.31495 BehavesLike.Win32.Backdoor.cc Trojan[Ransom]/Win32.Blocker Trojan-Ransom.Win32.Blocker.cfzl Trojan:Win32/Ovoxual.B Trojan.Che.xc Win32.Trojan.Blocker.Stua Trojan.Blocker!XrooD1Mdx9Q Win32/Trojan.Dropper.cd7


A backdoor also known as: Heur.Corrupt.PE HackTool[DoS]/Win32.Fedup DoS:Win32/Fedup.2_0.dam Hoax.Win32.BadJoke.FakeDel


A backdoor also known as: Vbs.Trojan.Qhost.Lpbo Trojan/Bicololo.a Win32.Trojan.WisdomEyes.16070401.9500.9869 Trojan.VBS.Qhost.gc Trojan.Script.Qhost.dbtszl TrojWare.Win32.Bicololo.DI Trojan.Hosts.6838 W32.Trojan.Bat.Qhost Trojan:BAT/Qhost.AF Trojan.SMHeist.1 Trojan.VBS.Qhost.gc Trojan/Win32.Bicololo.R82150 Win32/Bicololo.A Trojan.BAT.Qhost W32/Bicololo.A!tr Trj/CI.A


A backdoor also known as: Virus.Win32.Plutor!O Worm.Plutor W32/Lutor.b Virus.W32.Plutor!c PE_PLUTOR.A Win32.Trojan.WisdomEyes.16070401.9500.9838 W32.Lutor PE_PLUTOR.A Win.Trojan.Win-25 Virus.Win32.Plutor.b Trojan.Win32.Plutor.cxgc BackDoor.Jeff Virus.Plutor.Win32.2 BehavesLike.Win32.Virus.bh Trojan-Dropper.Win32.Joiner W32/Trojan.RQNC-0214 TR/Win32.HDDKill Virus/Win32.Plutor Backdoor:Win32/Plutor.B Virus.Win32.Plutor.b Virus.Win32.Plutor.b W32/Plutor.B Win32/Plutor.B Win32.Virus.Plutor.Htby Worm.Plutor!yPZ/v8ChneU W32/Plutor.B Win32/Trojan.3db


EventBot permissions EventBot ’ s permissions as seen in the manifest file .


A backdoor also known as: W32.eHeur.Virus02 Trojan.Gamarue.29491 HT_GAMARUE_GI0705DA.UVPM Win32.Trojan.WisdomEyes.16070401.9500.9995 W32/Trojan3.FQX W32.Shadesrat HT_GAMARUE_GI0705DA.UVPM Trojan.Win32.Inject.bxpwvz W32.W.Palevo.lJR8 Trojan.DownLoader5.4594 Backdoor.DarkKomet.Win32.11962 W32/Trojan.FEOJ-4670 TR/Drop.Gamarue.J TrojanDropper:Win32/Gamarue.I Trojan.Symmi.D5EBC Backdoor/Win32.DarkKomet.R72424 SScope.Malware-Cryptor.Winlock.1513 Trojan.Injector!eYQevBEYEJs Trojan-PWS.Win32.Zbot


The attackers sent multiple emails containing macro-enabled XLS files to employees working in the banking sector in the Middle East.


A backdoor also known as: Trojan/W32.Opus.175136 Trojan.Win32.Opus!O Trojan.Opus.Win32.6 Trojan/Opus.gd Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Opus-1 Trojan-Dropper.Win32.Dinwod.aeuh Trojan.Win32.Opus.iiuoo W32.W.AutoRun.l6Zu BehavesLike.Win32.Ransomware.ch Trojan.Win32.Opus Trojan/Opus.e Trojan/Win32.Opus Trojan.Zusy.D53A5 Trojan-Dropper.Win32.Dinwod.aeuh Trojan.Opus Win32/Swimnag.B Trojan.Opus!SLndS2cINJM


A backdoor also known as: not-a-virus:AdWare.Win32.BHO.bgvh Riskware.Win32.BHO.ewirij Adware.Spigot.139 ADWARE/BrowserIO.nylnh GrayWare[AdWare]/Win32.BHO Trojan.Razy.D36397 not-a-virus:AdWare.Win32.BHO.bgvh PUP.Optional.SearchBar


] us domain : the phone number registered with this domain is the same as the phone number appearing on the Facebook page .


It has been operating since November 2016 at least.


A backdoor also known as: TrojanDownloader.Tandfuy Trojan.Symmi.DA610 BehavesLike.Win32.Dropper.lt Trojan-Downloader.Win32.Tandfuy W32/Trojan.ZKSQ-8249 TR/Bipamid.dnrhz TrojanDownloader:Win32/Tandfuy.B Trojan/Win32.AVKill.R107811 Trj/GdSda.A Win32/Bipamid.C


A backdoor also known as: Trojan.Cuegoe.18812 Trojan.Dropper Win.Trojan.Cuegoe-6336261-0 Application.Win32.Amonetize.NE BehavesLike.Win32.BrowseFox.gc Trojan/Win32.Unknown Trojan.Zusy.D41B27 Trojan/Win32.Cuegoe.R208534 TrojanDropper.Cuegoe Win32/Trojan.85a


A backdoor also known as: Backdoor.VB.1 Trojan/W32.Cospet.81730 Trojan.Win32.Cospet!O TrojanPWS.VB.CX Trojan.Cospet.Win32.97 Backdoor.VB.1 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Spy.VB.NFL Backdoor.VB.1 Trojan.Win32.Cospet.ha Backdoor.VB.1 Trojan.Win32.Cospet.bjyzt Trojan.Win32.A.Cospet.81728[UPX] Troj.PSW32.W.QQPass.l9CX Backdoor.VB.1 TrojWare.Win32.Spy.VB.NFL0 Backdoor.VB.1 Win32.HLLW.Autoruner.46782 BehavesLike.Win32.Trojan.lc Trojan/Cospet.gz Trojan.Win32.Cospet Trojan/Cospet.av Trojan/Win32.Cospet Trojan/Win32.Cospet.R2764 Trojan.Win32.Cospet.ha Backdoor.VB.1 Trojan.Cospet!9xWgZWamXaI RAT.LostDoor W32/Cospet.HA!tr Win32/Backdoor.4a9


It uses a flash exploit that targets the recent vulnerability in Adobe flash.


If one of the applications is deleted , the second application downloads and re-installs the removed one .


A backdoor also known as: Rootkit.TDss.F Win32.Trojan.WisdomEyes.16070401.9500.9996 Rootkit.TDss.F Packed.Win32.Krap.e Rootkit.TDss.F Rootkit.TDss.F Rootkit.TDss.F Win32.Troj.Krap.c.35328 Rootkit.TDss.F Packed.Win32.Krap.e Trojan/Win32.Alureon.R61580 Rootkit.TDss.F W32/PackTdss.Y!tr


Cybercriminals are cashing in on advertising and installing legitimate applications.


We analyze multiple versions of KeyBoy revealing a development cycle focused on avoiding basic antivirus detection.


A backdoor also known as: Trojan.Tinba.WR4 Trojan/Tinba.be Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Win32.Tinba.dqteol TrojWare.Win32.Roitamit.BE Trojan.PWS.Tinba.153 Trojan.Tinba.Win32.1916 TR/Crypt.ZPACK.137753 Trojan/Win32.Skeeyah.R216296 Trojan.Tinba Win32/Tinba.BE Trojan.Tinba!GN4G+jbMfD0 Trojan.Win32.Tinba W32/Tinba.BE!tr Win32/Trojan.6ed


A backdoor also known as: Trojan.Razy.D167A7 Win32.Trojan.WisdomEyes.16070401.9500.9977 TrojWare.Win32.TrojanDownloader.Small.SGE Trojan.Yakes.uzd Trojan/Win32.Yakes.C2360515 Trojan.Yakes Win32.Trojan.Yakes.Pgcz Win32/Trojan.483


One ELF library , libloc4d.so , handles amongst other things the loading of the app-decoded ELF library file “ sux ” , as well as handling connectivity to the C2 .


A backdoor also known as: W32.OnGamesGNOLAH.Trojan Worm.Win32.VB!O Trojan.Jinra.A3 Worm.VB.Win32.2511 W32/VB.bem Win32.Worm.VB.kz W32.SillyFDC Win32/SillyAutorun.CKX WORM_VB.JSE Worm.Win32.VB.bem Trojan.Win32.VB.csfhed W32.W.VB.tnRc Win32.Worm.Vb.Szvd WORM_VB.JSE Worm/VB.pbz Worm/Win32.VB Worm:Win32/Jinra.A Trojan.Symmi.D5113 Worm.Win32.A.VB.184320 Worm.Win32.VB.bem Worm/Win32.VB.R125768 Trojan.VBRA.010736 Worm.Email Win32/VB.NUR Worm.VB!cXQoycDN5vU Worm.Win32.AutoRun


If the Trojan cannot find this file, it attempts to register itself in autorun.


Called HummingBad, this malware establishes a persistent rootkit with the objective to generate fraudulent ad revenue for its perpetrator, similar to the Brain Test app discovered by Check Point earlier this year.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9564 Trojan.Razy.D37E6E TrojanDownloader:Win32/Aentdwn.B!bit


On Aug.23, 2016, FireEye detected a potentially new ATM malware sample that used some interesting techniques not seen before.


on Feb 28 , 2016 .


A backdoor also known as: Trojan.Downloader.JKVR Trojan.Win32.Scar!O Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Downloader-56615 Trojan.Downloader.JKVR Trojan.Downloader.JKVR Trojan.Downloader.JKVR Trojan.Downloader.JKVR Trojan.Click2.2601 Trojan.Scar.Win32.55928 BehavesLike.Win32.Backdoor.kh Trojan.Win32.Scar TR/Dldr.Pingbed.A.33 TrojanDownloader:Win32/Pingbed.A Trojan.Scar Trojan.Downloader.JKVR W32/Nutiliers.AA!tr


The payload uses the Android Accessibility Service to get information directly from the displayed elements on the screen , so it waits for the targeted application to be launched and then parses all nodes to find text messages : Note that the implant needs special permission to use the Accessibility Service API , but there is a command that performs a request with a phishing text displayed to the user to obtain such permission .


The FBI and Cuba's Infrastructure Security Agency CISA have issued a joint cybersecurity advisory, warning about the threat posed by Cuba's cyber actors and the #StopRansomware.


It performs a privilege check once every second ; if unavailable , the Trojan starts requesting them from the user in an infinite loop : If the user agrees and gives the application the requested privileges , another stub page is displayed , and the app hides its icon : If the Trojan detects an attempt to revoke its administrator privileges , it starts periodically switching off the phone screen , trying to stop the user actions .


This encryption algorithm is an extra security layer for communicating with the C2 , an improvement over the previous version of a plain RC4 encryption .


A backdoor also known as: Trojan.Multi Win32/Jorik.KJ Trojan.Win32.Lofumin.exefpy Trojan.MulDrop7.58418 BehavesLike.Win32.Dropper.tc PUA.CoinMiner TR/AD.Lofumin.zzzlc Trojan:Win32/Lofumin.A Trojan.MulDrop Trj/CI.A BAT/CoinMiner.YC BAT/CoinMiner.YC!tr Win32/Trojan.9b2


A backdoor also known as: W32.Sality.PE Win32.Sality.OG Win32.Sality.OG Trojan.Win32.Krap.1!O W32.Sality.R W32/Autorun.worm.zzh Trojan.Win32.AutoRun.wazcf W32.SillyFDC AutoRun.BI Win32/Sality.AA WORM_AUTORUN.SMZ Worm.Autorun-1783 Win32.Sality.OG Win32.Sality.L Virus.Win32.TuTu.A.200000 Win32.Sality.OG Win32.Sality.OG Win32.HLLW.Autoruner.6138 Virus.Sality.Win32.15 WORM_AUTORUN.SMZ BehavesLike.Win32.Sality.fm W32/Sality.AA Win32.Sality.ab.173464 Worm:Win32/Hikjav.A Win32/Kashu.B Win32.Sality.OG Virus.Win32.Sality.baka Virus.Win32.Heur W32/AutoRun.FT!tr Win32/Sality.AJ


A backdoor also known as: W32.VotwupD.fam.Trojan Trojan.Downloader.JNGS Trojan.Win32.Krap.3!O Trojan.Bredolab.AA Trojan.LdPinch.Win32.14316 Trojan/PSW.LdPinch.apfl TROJ_BURNIX.SMEP Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan2.NKYP Trojan.Bubnix TROJ_BURNIX.SMEP Win.Trojan.Downloader-36570 Trojan.Downloader.JNGS Packed.Win32.Krap.ao Trojan.Downloader.JNGS Trojan.Win32.Krap.dccehe Troj.PSW32.W.LdPinch.apfl!c TrojWare.Win32.PkdKrap.AO Trojan.Downloader.JNGS Trojan.DownLoader1.19419 W32/Trojan.DTIT-2576 Trojan/PSW.LdPinch.wcs W32.Trojan.Trojan-Downloader.Ge Trojan[Packed]/Win32.Krap Trojan.Downloader.JNGS Packed.Win32.Krap.ao TrojanDownloader:Win32/Bubnix.A Win-Trojan/Bredolab.55808 Trojan-Downloader.Ver54 Trojan.Downloader.JNGS Trojan.Downloader.JNGS Trojan.Downloader Win32.Packed.Krap.Efao Trojan.DL.JNGS!S940SQYc1R4 W32/Krap.AON!tr


A backdoor also known as: Joke/W32.BadJoke.63153 JOKE_BADGAME.A Joke.Badgame JOKE_BADGAME.A Win.Worm.BadGameA-1 Hoax.Win32.BadJoke.Badgame Riskware.Win32.Badgame.hxed Joke.Win32.FakeFormat.63153 Joke.Win32.BadGame Joke.BadGame W32/Joke.XWVG-6884 HackTool[Hoax]/Win32.Badgame Win32.Joke.Badgame.kcloud Hoax.W32.BadJoke.Badgame!c Hoax.Win32.BadJoke.Badgame Win-Joke/FFormat.63488 Win32.Trojan-psw.Badjoke.Apdb Joke.Badgame.A not-a-virus:BadJoke.Win32.Badgame


When we found the exploit it appeared to be under development and evidence suggests it was deployed in Georgia.


Dridex utilizes an improved version of GoZ's peer-to-peer architecture to protect its command-and-control C2 servers against detection by security researchers and law enforcement.


A backdoor also known as: W32.VariantBarysR.Trojan Troj.Zeleffo.Sma!c TROJ_ZELEFFO.SMA Trojan.Win32.Nitol.115301 Trojan.Zeleffo.Win32.2 TROJ_ZELEFFO.SMA Trojan.Win32.Nitol Trojan:Win32/Nitol.C SScope.Trojan-Downloader.16517


Latest Trickbot's module called shareDll32 used for malware spreading in network shares.


Some of the settings are Boolean values that act as switches .


A backdoor also known as: PUA.Packed.ASPack Trojan/Win32.HDC


A backdoor also known as: Trojan.DoS.Doraah.A Trojan/W32.DoS.959488 Trojan.DoS.Doraah.A DoS.Doraah!A/vo/IPDx2c W32/Rado.A@bd Backdoor.Trojan Smalldoor.BASU DoS.Win32.Doraah Trojan.Win32.Doraah.dgjf Trojan.DoS.Doraah.A DoS.Win32.Doraah Trojan.DoS.Doraah.A BackDoor.IRC.Dostan Tool.Doraah.Win32.4 W32/Rado.SFME-6858 DDoS.Doraah DDOS/Doraah.A.1 HackTool[DoS]/Win32.Doraah Win32.Hack.Doraah.kcloud Win-Trojan/Doraah.959488 Trojan.DoS.Doraah.A Trojan.DoS.Doraah.A DoS.Doraah Win32/DoS.Doraah.A Win32.Trojan.Doraah.Egyh W32/Murscat.A!tr DoS.HX Trojan.Win32.Doraah.aa


The Tick group has conducted cyber espionage attacks against organizations in the Republic of Korea and Japan for several years.


A backdoor also known as: Trojan-PWS/W32.WebGame.16032.D Trojan-PSW.Win32.Mapler!O PWS.OnLineGames.MY65 PWS-OnlineGames.lf Trojan/PSW.Mapler.vm Win32.Trojan-PSW.OLGames.bx HV_ONLINEGAMES_CI194C7D.RDXN Trojan.Win32.Mapler.tpzmc Trojan.Win32.PSWIGames.16032.G Trojan.NtRootKit.13695 Trojan.Mapler.Win32.112 PWS-OnlineGames.lf Trojan-PWS.OnlineGames Trojan/PSW.Mapler.fj Trojan[PSW]/Win32.Mapler PWS:WinNT/OnLineGames.E TrojanPSW.Mapler Win32/PSW.OnLineGames.QDG Trojan.PWS.Mapler!9tj8NfYyp+s


After encrypting popular file types with the AES-256 encryption algorithm, TeslaCrypt holds the files for a ransom of $250 to $1000.


A backdoor also known as: Ransom.Autoit.Stampado.A Trojan.Blocker.Win32.37081 Ransom_Stampado.R055C0DAS18 Trojan.Encoder.10337 Ransom_Stampado.R055C0DAS18 BehavesLike.Win32.Ransom.fc W32/Trojan.ULQL-2410 Ransom:Win32/Stampado.A Trojan/Win32.Blocker.C1763564 Worm.Win32.Filecoder


A backdoor also known as: Exploit.CVE-2016-0034 Trojan.Crypt.RV Exploit.CVE.Win32.1627 Trojan/Exploit.CVE-2016-0034.p Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Packed2.37654 W32/CVE160034.OKEY-4732 Exploit.CVE-2016-0034.d EXP/Silverlight.AN Trojan[Exploit]/Win32.CVE-2016-0034 Trojan/Win32.MSIL.C1374172 Exploit.CVE20160034 Trj/GdSda.A Win32/Exploit.CVE-2016-0034.P Exploit.CVE-2016-0034!


The Trojan sends these digits to the C & C , which in turn sends a command to display a fake data entry window to check the four digits .


This brand new malware has real potential to become the next big mobile malware , as it is under constant iterative improvements , abuses a critical operating system feature , and targets financial applications .


As many people use their mobile devices for online shopping and even to manage their bank accounts , the mobile arena became increasingly profitable for cyber criminals .


The first copying of the exploit code we spotted was from the Sundown exploit kit EK, followed closely by Magnitude and a resurgent KaiXin EK.


A backdoor also known as: Backdoor.Graybird Win.Trojan.HackersDoor-6351576-1 Backdoor:Win64/Hackdoor.A!dll Backdoor/Win32.Hackdoor.R28108 Trj/CI.A Win32/Backdoor.14f


This delay means that a typical testing procedure , which takes less than 10 minutes , will not detect any unwanted behavior .


Note that the affected sites have consistent followers given the nature of their content.


A backdoor also known as: Trojan.NTPacker Trojan.NTPacker Trojan.NTPacker Win32.Trojan.WisdomEyes.16070401.9500.9936 Bloodhound.NTPacker Win.Trojan.Hydraq-9 Packed.Win32.PolyCrypt.b Trojan.NTPacker Trojan.NTPacker TrojWare.Win32.TrojanDropper.ErPack Trojan.NTPacker BackDoor.Ser.4 Trojan/PSW.QQPass.fk TrojanDropper:Win32/MultiDropper.B Packed.Win32.PolyCrypt.b Trojan.NTPacker Trojan/Win32.Delf.R33596 TScope.Malware-Cryptor.SB Win32.Packed.Polycrypt.Lndy W32/PolyCrypt.B!tr Win32/Trojan.267


IOCs for today Jaff ransomware run


A backdoor also known as: Trojan.Mjaka.A4 TROJ_MJAKA.C Win32.Trojan.WisdomEyes.16070401.9500.9762 TROJ_MJAKA.C Trojan.Win32.FC.euumqd W32/Trojan.EEMC-0397 Trojan:MSIL/Mjaka.A Spyware.InfoStealer Trj/Mjaka.A Win32/Trojan.9a1


Reverse shell payload The payload is started by the main module with a specified host and port as a parameter that is hardcoded to ‘ 54.67.109.199 ’ and ‘ 30010 ’ in some versions : Alternatively , they could be hardcoded directly into the payload code : We also observed variants that were equipped with similar reverse shell payloads directly in the main APK /lib/ path .


There have also been cases of users in Ukraine , Germany , Turkey and several other countries being affected .


A backdoor also known as: JS.Exploit.ShellCode.c Backdoor.Chches PowerShell/Kryptik.A BKDR_ChChes.SMZJEA-A BKDR_ChChes.SMZJEA-A Trojan.UPLT-5 Trojan:Win32/Posploi.A JS.S.Exploit.121732 Trojan.Win32.Chches Win32/Trojan.76d


A backdoor also known as: Trojan-Spy/W32.Banker.902656.L Trojan.Win32.Malware.1 Win32/PSW.Delf.NUI Banker.FEDD Trojan-Banker.Win32.Banker.aqtj Win32.HLLM.Sowsat.92 Win32/SillyDl.PVN Backdoor.Win32.Rbot!IK Trojan-Banker.Win32.Banker.aqtj Backdoor.Win32.Rbot PSW.Delf.EFZ Trj/Banker.FWD


Logcat logs show FakeSpy uses libmsy.so to execute the malicious packed mycode.jar file .


Here are just some of them : ngglobal – FirebaseCloudMessaging topic name Issuer : CN = negg – from several certificates negg.ddns [ .


The attack exploited an Adobe Flash vulnerability that stems from the zero-day vulnerabilities exposed from this month's Hacking Team data breach.


In addition, our data showed that there had been a high volume of spam runs during the weekdays and then a decreased volume during the weekends.


A backdoor also known as: W97M.Downloader.CZH O97M.Downloader.DI W97M.Downloader.CZH W97M.Downloader.CZH W97M.Downloader.CZH W97M.Downloader.CZH HEUR_VBA.CN TrojanDownloader:W97M/Ursnif.A W97M.Downloader.CZH W97M.Downloader.CZH virus.office.qexvmc.1100


This list is expected to expand : Package name Application name com.android.vending Play Market com.boursorama.android.clients Boursorama Banque com.caisseepargne.android.mobilebanking Banque com.chase.sig.android Chase Mobile com.clairmail.fth Fifth Third Mobile Banking com.connectivityapps.hotmail Connect for Hotmail com.google.android.gm Gmail com.imo.android.imoim imo free video calls and chat com.infonow.bofa Bank of America Mobile Banking com.IngDirectAndroid ING com.instagram.android Instagram com.konylabs.capitalone Capital One® Mobile com.mail.mobile.android.mail mail.com mail com.microsoft.office.outlook Microsoft Outlook com.snapchat.android Snapchat com.tencent.mm WeChat com.twitter.android Twitter com.ubercab Uber com.usaa.mobile.android.usaa USAA Mobile com.usbank.mobilebanking U.S. Bank - Inspired by customers com.viber.voip Viber com.wf.wellsfargomobile Wells Fargo Mobile com.whatsapp WhatsApp com.yahoo.mobile.client.android.mail Yahoo Mail – Organized Email fr.banquepopulaire.cyberplus Banque Populaire fr.creditagricole.androidapp Ma Banque jp.co.rakuten_bank.rakutenbank 楽天銀行 -個人のお客様向けアプリ mobi.societegenerale.mobile.lappli L ’ Appli Société Générale net.bnpparibas.mescomptes Mes Comptes BNP Paribas org.telegram.messenger Telegram Triout - Spyware Framework for Android with Extensive Surveillance Capabilities August 20 , 2018 No operating system is safe from malware , as cyber criminals will always want to steal , spy or tamper with your data .


Developed by ksoft, Uploader! allows its user to upload files to the internet via FTP.


In some cases , sophisticated web injects were used to trick victims into entering their 2FA codes directly into the web forms controlled by the malware to eliminate the need for the mobile malware component .


The modus operandi for all three investigations were very similar and appear to be a new Carbanak gang attack methodology, focused on the hospitality industry.


A backdoor also known as: TrojWare.Win32.TrojanDownloader.Tibs.1 Riskware.PSWTool.Win32.IEPassView.m!IK not-a-virus:PSWTool.Win32.IEPassView.m


A backdoor also known as: Trojan.Injector.Win32.400028 Trojan.Johnnie.D3FAD Trojan.Win32.Kovter.rky Trojan.Win32.Kovter.efkdwr Troj.Dropper.W32.Nail.ldEa Trojan.Kovter.297 PUA.Win32.Dlhelper Trojan.Kovter.axf Trojan:Win32/Kometage.A Trojan.Win32.Kovter.rky Trojan/Win32.Kovter.R186277 Trojan.Kovter Trojan.Kovter!DsLwWELZUiM W32/Injector.DDXC!tr


So far, no AV has given any meaningful identification to this malware—it is detected under generic names.


In early February 2015, Dell SecureWorks Counter Threat UnitTM CTU researchers investigated a new file-encrypting ransomware family named TeslaCrypt, which was distributed by the popular Angler browser exploit kit.


] ru/7 * * * * * 3 ” or “ % USERNAME % , accept 25,000 on Youla youla-protect [ .


A complete list of sample hashes is available here .


We believe that the main goal of attackers using these tools is cybersabotage.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9955 Win.Trojan.Alina-5 Trojan.Win32.Alinaos.ewvxne BehavesLike.Win32.Dropper.qc Trojan.Win32.Alinaos W32/Trojan.ZTVS-0655 TrojanSpy:Win32/Alinaos.G Trojan.Win32.Z.Alinaos.57344 Win32.Worm.Alinaos.C Trj/GdSda.A Win32/Trojan.3de


We have been presented with a rare opportunity to see some development activities from the actors associated with the OilRig attack campaign, a campaign Unit 42 has been following since May 2016.


Here are some of the most notable : ‘ geofence ’ – this command adds a specified location to the implant ’ s internal database and when it matches a device ’ s current location the malware triggers and begins to record surrounding audio .


A backdoor also known as: TrojanAPT.DarkHotel.A5 Trojan/Inexsmar.b Win32.Trojan.WisdomEyes.16070401.9500.9940 W32/Trojan.WHDF-1534 Trojan.Munidub TROJ_ASRUEX.B Trojan.Win32.Zapchast.ahgo Trojan.Win32.Zapchast.eavzfr Troj.W32.Zapchast!c TrojWare.Win32.UMal.chn Trojan.Inexsmar.Win32.1 TROJ_ASRUEX.B BehavesLike.Win32.Downloader.th Trojan.Zapchast.x Trojan/Win32.Zapchast Trojan.Zusy.D2AD58 Trojan.Win32.Zapchast.ahgo Trojan/Win32.Asruex.R175438 Trojan.Zapchast.pk Trojan.Zapchast Trj/GdSda.A Win32/Inexsmar.B Trojan.Zapchast!JP2wAgi6V+c Trojan.Win32.Inexsmar Win32/Trojan.2cb


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9923 Backdoor.MSIL TR/Ticker.A Trojan/Win32.Unknown Trojan:MSIL/Ticker.A Trojan.Ticker!i0gQR/g7sH4


A backdoor also known as: Backdoor.Y3krat.25 Backdoor/W32.Y3krat.236032 Backdoor/Y3KRat.25 Backdoor.Y3krat.25 Trojan.Win32.Y3KRat.fqmw W32/Backdoor.CMH Backdoor.Trojan Win32/Y3KRat.25 BKDR_GQ.B Trojan.Y3K-3 Backdoor.Win32.Y3KRat.25 Backdoor.Y3KRat.AS!AU Backdoor.Win32.Y3KRat.236032[h] Win32.Backdoor.Y3krat.Ambw Backdoor.Y3krat.25 Backdoor.Win32.Y3KRat.25 Backdoor.Y3krat.25 BackDoor.Y3krat.18 Backdoor.Y3KRat.Win32.115 BKDR_GQ.B BehavesLike.Win32.Dropper.dc W32/Backdoor.PBIC-7717 Backdoor/Y3KRat.25.a BDS/Y3kRat.25.5 W32/Y3krat.25!tr.bdr Trojan[Backdoor]/Win32.Y3KRat Backdoor.Y3krat.25 Backdoor.W32.Y3KRat.25!c Win-Trojan/Y3KRat.236032 Backdoor:Win32/Y3KRat.2_5 Backdoor.RAT.Y3Backdoor.RAT.V1.8.a Backdoor.Y3KRat Bck/Y3KRat.H Backdoor.Win32.Y3KRat Backdoor.Y3krat.25 Backdoor.Win32.Y3KRat.25


A backdoor also known as: Trojan-PWS/W32.WebGame.161447 TrojanPSW.OnLineGames.adem Trojan-PSW.Win32.OnLineGames.adem Win32/PSW.OnLineGames.NNU Trojan.Packed.NsAnti Trojan.Spy-35117 Packer.Malware.NSAnti.1 TrojWare.Win32.PSW.OnLineGames.NNU Trojan.PWS.Gamania.9247 Win32/PSW.OnLineGames.NNU Packer.Malware.NSAnti.AL!IK Worm:Win32/Taterf.B Packer.Malware.NSAnti.1 Packer.Win32.Mian007.a Packer.Malware.NSAnti.AL W32/OnLineGames.fam!tr.pws


A backdoor also known as: Trojan.Vundo Win.Downloader.8632-1 MalwareScope.Trojan-PSW.Pinch.1 Trojan.Click.4067 BehavesLike.Win32.Dropper.lc Trojan/Win32.QQPass.R1885


A backdoor also known as: Trojan/Exploit.DCom.naf Exploit.Win32.DCom.khbzi Win.Trojan.Dcom-2 Trojan.Peed!mca6fnIo2DU Exploit.DCom.6 Exploit.DCom.Win32.185 EXP/DCom.Y.13 Win-Trojan/Berbew.51712 Exploit:Win32/Dcom.Y Exploit.DCom Trj/CI.A Net-Worm.Win32.Kolab Exploit.DCOM.RPC Trojan.Win32.DCom.NAF Win32/Trojan.Exploit.3e3


Technical Analysis The malware consists of 2 applications : The Dropper : Brain Test ( Unpacked – com.mile.brain , Packed – com.zmhitlte.brain ) This is installed from Google Play and downloads an exploit pack from the server to obtain root access on a device .


A backdoor also known as: Backdoor.Win64 Win32.Trojan.WisdomEyes.16070401.9500.9643 W64/Trojan.JENW-7287 Trojan.Uboat BKDR64_UBOAT.A BKDR64_UBOAT.A Backdoor:Win64/UBoatRAT.A Trj/CI.A Backdoor.Rat.UBoatRat


The Gh0st malware is a widely used remote administration tool RAT that originated in China in the early 2000s.


A popular mobile messaging application, LINE was used as a bait to lure targets in a targeted attack which hit Taiwan government.


A backdoor also known as: Trojan/W32.Karba.24576 TrojanAPT.Garveep.DL4 Win32.Trojan.WisdomEyes.16070401.9500.9996 Trojan.Win32.Karba.ai Trojan.Win32.DownLoad3.cztnhk Win32.Trojan.Karba.Pdvp TrojWare.Win32.Dialer.AFXP Trojan.DownLoad3.18105 Trojan.Karba.Win32.9 W32/Trojan.DWPP-4593 TR/Spy.mulkf Trojan.DarkHotel.23 Trojan.Win32.Karba.ai Win32/Trojan.7fa


A backdoor also known as: Trojan.TDss.ET Trojan.TDSS Trojan.TDss.ET WORM_TDSS.SMY Win32.Trojan.WisdomEyes.16070401.9500.9999 WORM_TDSS.SMY Trojan.TDss.ET Packed.Win32.TDSS.f Trojan.TDss.ET Trojan.Win32.Tdss.btyvr Trojan.Win32.Z.Tdss.23552.A Packer.W32.Tdss.kYT0 Trojan.TDss.ET Win32.PkdTdss Trojan.Packed.365 Trojan.Kryptik.Win32.1293691 BehavesLike.Win32.FakeAlert.mh Trojan.Win32.Alureon Trojan[Packed]/Win32.TDSS Win32.Troj.TdssT.jr.102400 Trojan.TDss.ET Packed.Win32.TDSS.f TrojanDownloader:Win32/Rugzip.A Packed/Win32.Tdss.C53201 Trojan.TDSS.01414 Win32.Packed.Tdss.Pgdn W32/PackTDssfilter.I!tr Win32/Trojan.d9b


Not long after this variant was public , newer variants of HenBox were seen , and some had significant increases in the number of targeted apps .


On the 27th of June 2017, a new cyberattack hit many computer systems in Ukraine, as well as in other countries.


The stolen data fields are : Mobile - The infected device phone number Machine - The device model ( in our example : Google Pixel 2 ) Sversion - The OS version Bank - Checks if there are any banking-related or cryptocurrency trading apps Provider - The telecommunication provider ( IMSI value in device settings ) npki - Checks if the folder named NPKI ( National Public Key Infrastructure ) might contain authentication certificates related to financial transactions onStartCommand function for stealing device information and additional sensitive data .


A backdoor also known as: W32.RansomeDNZ.Trojan Ransom/W32.crysis.94720 Ransom.Crysis.S162740 Trojan/Filecoder.Crysis.l Win32.Trojan.WisdomEyes.16070401.9500.9991 W32/Wadhrama.B Win32.Trojan-Ransom.VirusEncoder.A Trojan-Ransom.Win32.Crusis.to Trojan.Win32.Filecoder.emdnxn Trojan.Win32.Ransom.94720.F Troj.Ransom.W32.Crusis.tpcS TrojWare.Win32.Crysis.D Trojan.Encoder.3953 Trojan.Crusis.Win32.806 BehavesLike.Win32.Ransom.nc Trojan-Ransom.Crysis W32/Trojan.ILHO-9216 Trojan.Crypren.ic Trojan.Ransom.Crysis.6 Ransom.Crysis/Variant Trojan-Ransom.Win32.Crusis.to Trojan.Ransom.Crysis Hoax.Crusis Trj/GdSda.A Trojan-Ransom.Win32.Crysis.a W32/Crysis.L!tr.ransom Win32/Trojan.Ransom.f44


A backdoor also known as: Trojan.Nagoot.FC.161 MSIL.Trojan.Injector.l W32/Trojan.MIPO-0322 Downloader.Ponik Trojan.Win32.Inject1.exqnlv Trojan.Win32.Z.Nagoot.68608.A Trojan.Inject1.54664 Trojan.MSIL.Nagoot TR/Dropper.MSIL.rjbya Trojan.MSIL.Bladabindi.1 Trojan:MSIL/Nagoot.A Trojan.PasswordStealer Trj/GdSda.A MSIL/Injector.IFP!tr Win32/Trojan.62b


This malware-life-cycle has been observed to reoccur every few years , bringing new malware families into light .


In recent years , some malicious Android applications abused these accessibility services in various attack scenarios .


A backdoor also known as: W32.XhglJIK1DLL.Rootkit Trojan/W32.Cariez.32768.AU BackDoor-DTL.a Trojan.Cariez.Win32.270 Trojan/Koutodoor.dx TROJ_CARIEZ.SMA Win32.Trojan.WisdomEyes.16070401.9500.9997 TROJ_CARIEZ.SMA Win.Trojan.Cariez-189 Trojan.Win32.Cariez.a Trojan.Win32.Cariez.byufu TrojWare.Win32.Zybr.A Trojan.RKDoor.59 BackDoor-DTL.a Trojan.Win32.Cariez Trojan/Win32.Cariez Adware.Heur.E02D22 Trojan.Win32.Cariez.a Trojan:Win32/Cariez.A Backdoor/Win32.Koutodoor.R1208 TScope.Malware-Cryptor.SB Trj/Cariez.A Trojan.Win32.Cariez.bhg


While Japan is still the most heavily targeted geographic region by this particular actor, we also observed instances where individuals or organizations in Taiwan, Tibet, and Russia also may have been targeted.


This report describes an extensive malware, phishing, and disinformation campaign active in several Latin American countries, including Ecuador, Argentina, Venezuela, and Brazil.


This blog links this recent activity with previous isolated public reporting on similar attacks we believe are related.


Collection of payloads being delivered via the Apache Struts vulnerability - CVE-2017-5638


A backdoor also known as: Backdoor.Gargamel.A Backdoor.Gargamel.A Backdoor.Trojan BKDR_GARGAM.A Backdoor.Win32.Gargamel.a Backdoor.Gargamel.A Backdoor.Gargamel!8hABCfPKz0o Backdoor.Win32.Gargamel.Downloader Backdoor.Gargamel.A BackDoor.Gargamel BDS/Gargamel.A.10 BKDR_GARGAM.A Win-Trojan/Gargamel.17717 Backdoor.Gargamel.A Backdoor.Trojan Win32/Gargamel.Downloader Backdoor.Win32.Gargamel W32/Uploade.B!tr.bdr BackDoor.Gargamel.B


A backdoor also known as: KillCMOS.K Trojan.KillCMOS.O Trojan.KillCMOS.O Trojan.KillCMOS.O Trojan.KillCMOS.O TROJ_KILLCMOS.L Win.Trojan.KillCMOS-14 Trojan.KillCMOS.O Trojan.DOS.KillCMOS.k Trojan.Dos.KillCMOS.blmit Troj.DOS.KillCMOS.k!c Trojan.KillCMOS.O Trojan.KillCMOS.O TROJ_KILLCMOS.L KillCMOS.h TR/KillCMOS.J Trojan:DOS/KillCMOS.remnants Trojan.DOS.KillCMOS.k KillCMOS.h Dos.Trojan.Killcmos.Ebgc Trojan.KillCMOS Trj/KillCMOS.K Win32/Trojan.8f3


A backdoor also known as: W97M.Downloader.DF HEUR.VBA.Trojan.e W2KM_DLOADR.YYSQD Trojan-Dropper:W97M/MaliciousMacro.B W2KM_DLOADR.YYSQD TrojanDropper:W97M/Miskip.B!dha Trojan-Dropper.W97M.Miskip heur.macro.infect.l


A backdoor also known as: W32.OnGameELIYTAAD.Trojan Trojan-Ransom.Win32.Blocker!O Backdoor.Bustem.A5 Trojan.BCMiner Troj.Ransom.W32.Blocker!c Trojan.Johnnie.D545 TSPY_DOWNLOADER_CA0827C3.TOMC Trojan-Ransom.Win32.Blocker.jcku Trojan.Win32.AVKill.dqatba Trojan.Win32.A.Scar.118272.A Trojan.AVKill.11731 TSPY_DOWNLOADER_CA0827C3.TOMC BehavesLike.Win32.LoadMoney.ch Backdoor.Win32.Bustem Trojan/Win32.Unknown Backdoor:Win32/Bustem.A Trojan-Ransom.Win32.Blocker.jcku Trojan/Win32.Downloader.R14675 Hoax.Blocker Trojan-ransom.Win32.Blocker.cwfe Win32/RootKit.Rootkit.7e5


The growing number of samples demonstrate that criminals are actively adopting this malware.


A backdoor also known as: Hoax.Win32.BadJoke!O W32/Joke.O Joke.Irritan JOKE_IRRITAN.A Hoax.Win32.BadJoke.Irritan Riskware.Win32.Irritan.hrfs Joke.Win32.Irritan.A FDOS.Winskill Backdoor.PePatch.Win32.34151 JOKE_IRRITAN.A W32/Joke.ASXP-0124 not-virus:Joke.Win32.Irritan JOKE/Irritan.A HackTool[Hoax]/Win32.Irritan Win32.Joke.Irritan.kcloud Win-AppCare/Irritan.248877 Trojan.Win32.BadJoke.AD Win32/Irritan.A Hoax.Win32.BadJoke.Irritan Win32/Joke.bee


Threat actors are taking advantage of Microsoft OneNote's ability to embed files and use social engineering techniques, such as phishing emails and lures inside the OneNote document, to get unsuspecting users to download and open malicious files.


The pushTAN method has a clear advantage : It improves security by mitigating the risk of SIM swapping attacks and SMS stealers .


With this group being active for roughly one year, we decided to revisit this threat to determine what, if any, changes had been made to their toolset.


A backdoor also known as: Trojan-Dropper/W32.Stabs.90045 TrojanDropper.Stabs.cvo Trojan/Dropper.Stabs.dka Win32/Bifrose.NDU W32/Trojan2.HEAS W32/Smalltroj.QFFP BKDR_BIFROSE.SMC BackDoor.IRC.Sdbot.3713 BKDR_BIFROSE.SMC Trojan-Downloader.Win32.Buzus!IK W32/Trojan2.HEAS TrojanDownloader:Win32/Buzus.F Trojan-Downloader.Win32.Buzus W32/Injector.IA!tr Trj/Buzus.AH


These components include a unique loader, downloader, and not one but two different trojan components.


ALLCONTACTS – send all contacts from phone memory to C & C .


URL — update C & C address .


] com are or were intended for malicious use .


**Dump Domain Registration Patterns:*From about 2015 to at least October 2018 possibly longer, IBM X-Force assesses that ITG08's POS malware used the same notable domain naming convention: all known dump domains used by FrameworkPOS and GratefulPOS contained the same base name -akamaitechnologies.com. In fact, all said domains are nearly identical looking to a legitimate Akamai content delivery network CDN domain, differing only by a single character replacing a .' with - .


A backdoor also known as: Script.SWF.C603 Exp.SWF.Rig.EK.4476 Exploit.SWF.Downloader SWF_EXKIT.THAAEH Script.SWF.C603 Script.SWF.C603 SWF.S.Exploit.13894 Script.SWF.C603 Script.SWF.C603 Exploit.SWF.1232 SWF_EXKIT.THAAEH SWF/Exploit-Rig.h SWF/Trojan.VJFQ-3 Script.SWF.C603 SWF/Exploit-Rig.h Trojan.SWF.Exploit swf.cve-2015-8651.rig.a


Adobe independently patched the vulnerability CVE-2015-3043 in APSB15-06.


INTERNET - Allows the application to open network sockets .


The KOVTER malware embeds a JavaScript into the registry and executes a PowerShell script which eventually loads the main KOVTER binaries.


It indicates perhaps an interesting trend which is exploiting the trust relationships between the two communities .


CSIS has been informed about a number of targeted spear phishing attacks against Danish chiropractors.


The attackers send fake text messages to lure the victims to click on a malicious link .


The developer of the code , Shanghai Adups Technology Co. , has apologized , contending that the code was intended for another one of its clients who requested better blocking of junk text messages and marketing calls .


The group focuses on companies that have intellectual property or sensitive information like those in the Defense and High-Tech industries.


A backdoor also known as: TjnDownldr.SmaCod.S162507 Downloader.Tiny.Win32.8086 Win32.Trojan.WisdomEyes.16070401.9500.9968 Trojan.Win32.Tiny.elyeva TrojWare.Win32.TrojanDownloader.Tiny.NNO Trojan-Downloader.Win32.Tiny Trojan.Mikey.DECAC Trojan/Win32.Downloader.R193768 OScope.Trojan.0216 W32/Tiny.NNO!tr Win32/Trojan.823


A backdoor also known as: Uds.Dangerousobject.Multi!c Win32.Trojan.WisdomEyes.16070401.9500.9999 TR/Downloader.A.2357 Trojan.Kazy.D60565 TrojanDownloader:MSIL/Muxtart.A Win32.Trojan.Downloader.Szlu


Despite having a reputation of evolution, there doesn't seem to be very many recent updates on this malware family though.


The latest round of attacks in 2015 uses a stolen code signing certificate belonging to Taiwanese electronics maker Acer and an unknown Flash Player exploit.


However, in addition to new variants of malicious .hta, we find new victims, .rar attachments with RTLO spearphishing, and the deployment of a 0day from Hacking Team.


A backdoor also known as: W32.eHeur.Malware14 Win32.Malware!Drop Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan-Downloader.Win32.Upatre.gqes Trojan.Win32.KillProc.expayv TrojWare.Win32.GozNym.AA Trojan.KillProc.54838 Downloader.Upatre.Win32.65195 Trojan.Win32.Tofsee Trojan.Banker.GozNym.gs TR/Crypt.Xpack.sqizh Backdoor:Win32/Tofsee.T Trojan-Downloader.Win32.Upatre.gqes Win32.Malware!Drop Backdoor.PasswordStealer Trj/GdSda.A Win32/Tofsee.BJ W32/Kryptik.GCVH!tr


The attack leveraged malware we called BlackLambert', which was used to target a high profile organization in Europe.


A backdoor also known as: BDS/Flood.IRC.2 MemScan:Trojan.Flooder.I IRC.Flood Trojan.Flood BackDoor.Ircbot.BCV IRC.Flood IRC.Flood Trojan.Backdoor.Flood.IRC.2


A backdoor also known as: Trojan/W32.Scar.28672.J Win32.Trojan.Scar.aeru.4.Pack Trojan/Scar.aeru Trojan.Scar.AEY W32/Tibs.DOHY Trojan.Win32.Scar.aeru TrojWare.Win32.Scar.BA Win32/SillyAutorun.CVZ Trojan/Scar.axz Trojan/Win32.Scar Trojan.Win32.Scar!IK TrojanDownloader:Win32/Yibohbin.A Trojan.Win32.Scar.28672.I Win-Trojan/Scar.28672.AH Trojan.Win32.Scar.aeru Trojan.DL.Win32.Tiny.bug Trojan.Win32.Scar Trj/Scar.A


First , it will get the “ nativenumber ” variable from the “ telmark ” value of “ AndroidManifest.xml ” .


Figure 4 – Checking for installed apps Based on a thorough analysis of the code , the most interesting technical capabilities include : Capturing screenshots Enabling or changing administration settings Opening and visiting any URL Disabling Play Protect Recording audio Making phone calls Stealing the contact list Controlling the device via VNC Sending , receiving and deleting SMS Locking the device Encrypting files on the device and external drives Searching for files Retrieving the GPS location Capturing remote control commands from Twitter and Telegram Pushing overlays Reading the device ID The malware includes a keylogger that works in every app installed on the Android device .


A backdoor also known as: Android.Trojan.WipeLocker.A Android.Habey.A Trojan.Wipelock..1 A.H.Fra.Elite Android.Trojan.Wipelock.b Android/Wipelock.A HEUR:Trojan.AndroidOS.Soceng.f Android.Trojan.WipeLocker.A Trojan.Android.Elite.dmubjt Troj.Androidos.Habey!c Trojan-Spy:Android/SmsSpy.FW Android.Elite.1.origin ANDROID/Elite.A Android/Wipelock.A!tr Trojan/Android.Habey Android.Trojan.WipeLocker.A HEUR:Trojan.AndroidOS.Soceng.f Android-Trojan/WipeLocker.8493 Trojan.Android.Locker.c Trojan.AndroidOS.Wipelock Android.Trojan.WipeLocker.A


One of the samples we looked at SHA256:e154e62c1936f62aeaf55a41a386dbc293050acec8c4616d16f75395884c9090 contained a family of backdoor that hasn't been referenced in public documents.


A backdoor also known as: Trojan/W32.KRBanker.615936 Trojan.Sehijak.A7 Adware.Kraddare Adware.Kraddare.Win32.3892 Trojan.Zusy.D2CF65 W32/Banki.A Backdoor.Win32.Servidor.ac Trojan.Win32.RDN.eatfup Win32.Backdoor.Servidor.Pboq TrojWare.Win32.Sehijak.DA Trojan.DownLoader21.32804 BehavesLike.Win32.MultiPlug.jc W32/Banki.DFFU-6658 Backdoor.Servidor.b Trojan:Win32/Sehijak.A Backdoor.Win32.Servidor.ac Trojan/Win32.Banki.R175311 Backdoor.Servidor Win32/Adware.Kraddare.LP PUA.Kraddare! PUA.Kraddare W32/Servidor.AC!tr.bdr Win32/Backdoor.c5c


CrowdStrike has released two blog posts detailing Sakula campaigns and continues to investigate its usage.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9978 Trojan.Win32.ExtenBro.evtqgw Trojan.MSIL.ExtenBro Trojan/MSIL.fqcj TR/ExtenBro.vezgg Trojan:MSIL/ExtenBro.A Trj/GdSda.A Win32/Trojan.444


Escelar originally surfaced in January of this year, and has since had roughly 100,000 instances of attempted infections.


At the same time, the group has been improving their ability to operate the business side of a ransomware organization.


A backdoor also known as: BehavesLike.Win32.BackdoorNJRat.qm Trojan.Kazy.DEF49 Trojan/Win32.Llac.R18525


A backdoor also known as: Trojan.DLDrop.NSIS Trojan.Injector.Win32.385163 Trojan/Injector.cuom Trojan.Razy.D7CE0 W32/Injector.AKD Trojan.Win32.CUOM.ebfhyw W32/Injector.OIMQ-3591 TR/AD.Enestedel.ubzhk Ransom:Win32/Enestedel.B!rsm Trj/GdSda.A Win32/Injector.CUOM Trojan.Injector!1PtHxYGwvhY


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9829 Backdoor.Ehdoor


A backdoor also known as: Trojan-Dropper.Win32.Dorifel!O Trojan.FakeMS.ED Trojan/Dropper.Dorifel.eav Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/Trojan.GTVK-8195 W32.IRCBot.NG Trojan.MSIL.Crypt.fqbo Trojan.DownLoader6.25796 Dropper.Dorifel.Win32.1316 TrojanDropper.Dorifel.afo Trojan[Dropper]/Win32.Dorifel Win32.Troj.Dorifel.kcloud Trojan.Zusy.D115D1 Trojan.MSIL.Crypt.fqbo Trojan:MSIL/Belfusba.A TrojanDropper.Dorifel Trj/CI.A MSIL/Selenium.A Trojan.Kryptik!LBVVyRsvO34 MSIL/Selenium.A!tr


A backdoor also known as: Virus.W32.Virus!c Trojan/Spy.KeyLogger.au Trojan.Raw.KeyLog.epwywq BehavesLike.Win32.Cutwail.tc Trojan.Shelma.bbh Trojan/Win32.Shelma Trojan:Win32/Ronohu.A Trj/CI.A Python/Spy.KeyLogger.V Trojan.Python.Spy Python/KeyLogger.V!tr.spy


Usually, these are done via HTTP or other TCP/IP connections.


Recently, while reading a blog post from security vendor Akamai, we spotted a similar situation.


The forum provides members with tools to patch RDP Remote Desktop Protocol servers to support multiple user logins, as well as other hacking tools, such as proxy installers and sysinfo collectors.


A backdoor also known as: Trojan/W32.KRSign.810456 Win32.Trojan.WisdomEyes.16070401.9500.9958 Spyware.BL Trojan.ZxShellCRTD.Win32.10098 Backdoor:Win32/Zxshell.A!dha Win32/Backdoor.c4c


Petya is a form of ransomware that overwrites the master boot record MBR in order to block access to both the user's files and operating system.


A backdoor also known as: HW32.Packed.7F39 Trojan.Podjot.A Trojan.Kazy.D2D8D TROJ_PODJOT.SM1 Win32.Trojan.WisdomEyes.16070401.9500.9924 TROJ_PODJOT.SM1 MalCrypt.Indus! Trojan:Win32/Podjot.A Trojan/Win32.Zapchast.R21212 Virus.Win32.Cryptor


EventBot VirusTotal search for the malicious IP address VirusTotal search for the malicious IP address .


The threat actor behind Duqu appears to have launched attacks at the venues for some of these high level talks.


The attackers behind this campaign went to some lengths to disguise their activities, including using domains names disguised as antivirus AV company websites for their command and control C C servers.


A backdoor also known as: Trojan-Dropper.Win32.Injector!O Trojan.Zusy.D2081E W32/MalwareS.BJCG Backdoor.Vinself.B Win32/Fuwu.A BKDR_COMFOO.SME Win.Trojan.Rootkit-9875 Trojan-Dropper.Win32.Injector.jndt Trojan.Win32.DPD.dxvfcr Trojan.PWS.DPD.5 BKDR_COMFOO.SME BehavesLike.Win32.RansomWannaCry.ch Trojan.Win32.Spy W32/Risk.KUNB-3887 Trojan:Win32/Netnam.B Trojan-Dropper.Win32.Injector.jndt Trj/Zbot.M


This one-time cost provides a malicious customer with access to all the data on the server and endless other possibilities, such as using the access to launch further attacks.


Instead, they first attempt to gain access to the machine, most likely through a more targeted attack or exploit, before manually triggering and executing the malware.


A backdoor also known as: HackTool.Stimilani.FC.1099 Trojan.Zusy.D2F64E HackTool:MSIL/Stimilani.A Trj/GdSda.A


During the last hours, ESET researchers noticed that Eltima, the makers of the Elmedia Player software, have been distributing a version of their application trojanized with the OSX/Proton malware on their official website.


It appears that these threat actors have begun using Palo Alto Networks upcoming Cyber Security Summit hosted on November 3, 2016 in Jakarta, Indonesia as a lure to compromise targeted individuals.


Afterward , it will start several timers to execute different tasks .


A backdoor also known as: Trojan/W32.DoS.26816 DDOS_DEPCHARG.11 Win32.Trojan.WisdomEyes.16070401.9500.9967 W32/Trojan.ROMV-7068 DDOS_DEPCHARG.11 Win.Trojan.Chubby-2 Trojan-DDoS.Win32.DepthCharge.c Trojan.Win32.DepthCharge.dfzl Trojan.Win32.Chubby.26816 Troj.W32.Chubby.11!c Trojan.Chubby.11 Trojan.Chubby.Win32.2 BehavesLike.Win32.Fake.mc Backdoor/VB.dc TR/Chubby.11 Trojan[DDoS]/Win32.DepthCharge Trojan.Heur.VB.bmLfcmhTrPni Trojan-DDoS.Win32.DepthCharge.c TrojanDDoS.DepthCharge Win32/Chubby.11 Win32.Trojan-ddos.Depthcharge.Lpbl Trojan.DDoS.DepthCharge!wR+hD336kwM Trojan-DDoS.Win32.DepthCharge W32/Chubby.11!tr


A backdoor also known as: Trojan-Dropper.Win32.Small!O Trojan.Vbcrypt Spyware.Zbot Dropper.Small.Win32.2729 Trojan/Dropper.Small.dil Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Droplet.GN Win.Trojan.VB-9953 Trojan-Dropper.Win32.Small.dil Trojan.Win32.Small.wfby TrojWare.Win32.TrojanDropper.Small.dil0 Trojan.MulDrop.30852 BehavesLike.Win32.Downloader.mc Trojan-Dropper.Win32.Delf Trojan[Spy]/Win32.Zbot Trojan.Heur.E2A3DF Dropper.Small.86866 Trojan-Dropper.Win32.Small.dil Trojan/Win32.Batat.R4771 W32/Dropper.DIL!tr


Package Name SHA256 digest SHA1 certificate com.network.android ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5 44f6d1caa257799e57f0ecaf4e2e216178f4cb3d com.network.android 3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86 516f8f516cc0fd8db53785a48c0a86554f75c3ba Additional digests with links to Chrysaor As a result of our investigation we have identified these additional Chrysaor-related apps .


The attacking IP addresses originated from very distinctive network ranges mostly associated with Chinese Internet service providers.


A backdoor also known as: Trojan.Multi Trojan.Win32.Inject.exdppy Trojan.Win32.Z.Kryptik.258107 Troj.W32.Virtumonde.mCBt Trojan.Inject.60399 Trojan.Kryptik.Win32.1344676 BehavesLike.Win32.Worm.dc Trojan:Win32/Kexject.A Spyware/Win32.Zbot.C145539 Trj/CI.A Win32.Trojan.Inject.Auto


A backdoor also known as: Backdoor/W32.Hekdor.88576 Backdoor/Hekdor.a Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Risk.EEXH-5977 Win32/Hekdor.A BKDR_HEKDOR.A Win.Trojan.HackersDoor-6351576-1 Backdoor.Win32.Hackdoor.12 Trojan.Win32.Hekdor.gtcj Backdoor.Win32.Hackdoor.88576 Backdoor.W32.Hackdoor.f!c Backdoor.Win32.Hackdoor.~dy001 BackDoor.Hackdoor.22 Backdoor.Hekdor.Win32.1 BehavesLike.Win32.Virut.mh Trojan.Win32.Hekdor Trojan[Backdoor]/Win32.Hackdoor Win32.Hack.Hekdor.a.kcloud Trojan.Graftor.Elzob.D2551 Backdoor.Win32.Hackdoor.12 Backdoor/Win32.Hackdoor.R101239 Bck/Iroffer.BG Win32.Backdoor.Hackdoor.Pegb Backdoor.Hekdor.A


They find and share readily available code and use those to make their own malware.


A backdoor also known as: Worm/Win32.AutoRun


This payload is also used by the earlier versions of the implant .


Lookout customers are also protected from this threat on both Android and iOS .


A backdoor also known as: Trojan.Win32.Clicker.cysqcu Trojan.Click2.41012 TR/Storup.D.158 Trojan:Win32/Storup.D Trojan.Graftor.DA5F2 TrojanSpy.Gaxfid!V9zv1PzO78E Trojan.Win32.Spy Trj/CI.A Win32/Trojan.b34


A backdoor also known as: Packer.W32.Katusha!c Win32.Trojan.WisdomEyes.16070401.9500.9997 TROJ_TRACUR.SMVB Packed.Win32.Katusha.ac Trojan.Win32.Tracur.csqtnd Trojan.Win32.Z.Tracur.476672 TrojWare.Win32.Kryptik.BJLP TROJ_TRACUR.SMVB TR/Tracur.ujeuv Trojan/Win32.Diple Trojan.Mikey.D823E Packed.Win32.Katusha.ac Trojan/Win32.Tracur.R87716 Trojan.Tracur Win32/Boaxxe.BB Win32.Packed.Katusha.Aljh Trojan.Win32.Boaxxe Win32/Trojan.2ed


A backdoor also known as: W32.DownloaderLTB.Trojan Trojan.Win32.Scar!O Trojan.Scar.20261 Trojan/Scar.gfdd Trojan.Graftor.Elzob.D3707 TROJ_DLOADE.SMEP Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Dropper Win32/SillyDl.HER TROJ_DLOADE.SMEP Win.Trojan.Scar-864 Virus.Win32.Lamer.vpqnl Trojan.DownLoader22.5119 TR/Taranis.2688 Trojan/Win32.Scar Trojan.Win32.A.Scar.100616 Trojan/Win32.Scar.R4127 Trojan.Scar Trojan.Win32.Sisproc


A backdoor also known as: Trojan.Cadlotcorg Trojan.DistTrack.stdr BKDR_DISTTRACK.E Win.Malware.StoneDrill-6012379-0 Trojan.Win32.Inject.wmyt Trojan.Win32.Inject.ekcbzj Trojan.Win32.Z.Inject.195072 Troj.W32.Inject!c Trojan.Stoned.5 Trojan.StoneDrill.Win32.2 BKDR_DISTTRACK.E W32/Trojan.CWLD-3265 Trojan.Inject.uoh TR/Injector.sgcfh Trojan/Win32.Inject Trojan.Razy.D1AF37 Trojan.Win32.Inject.wmyt Trojan:Win32/Cadlotcorg.A!dha Trojan/Win32.Injector.C1695778 Trojan.DiskWriter Trj/CI.A Win32/StoneDrill.A Win32.Trojan.Inject.Eddh Trojan.Inject!MGtoNAyL21Q Trojan.Win32.Cadlotcorg


A backdoor also known as: BehavesLike.Win32.VirRansom.pc


A backdoor also known as: Trojan/W32.Iframer.77312 Trojan.Iframer.aa Trojan.Win32.Iframer.aa Trojan/Iframer.aa Trojan.Iframer.X W32/DLoader.OAFQ Trojan.Win32.Iframer.aa TrojWare.Win32.Iframer.aa Trojan.Win32.Iframer.aa Trojan/Iframer.b Trojan.Win32.Iframer!IK Trojan:Win32/Ifrasif.A Trojan.Win32.Iframer.aa Trojan.Win32.Iframer


Highlights Samples of the malicious code found in BrainTest have been found on Google Play , and its creator has used multiple methods to evade detection by Google including Bypassing Google Bouncer by detecting if the malware is being run from an IP or domain mapped to Google Bouncer and , if so , it will not perform its intended malicious activities .


A backdoor also known as: Trojan.Kazy.D1DA5C Win32.Trojan.WisdomEyes.16070401.9500.9993 Trojan.Win32.Steam.cwybnb TrojWare.Win32.PSW.Steathie.B2 Trojan.PWS.Steam.292 TR/PSW.Steathie.B PWS:MSIL/Pasdael.A W32/Sc!tr.pws


A backdoor also known as: Trojan.PSW.Vorbeld.B Trojan/W32.Ikmet.307200 Trojan.PSW.Vorbeld.B Troj.IM.W32.Ikmet.e!c Trojan/Ikmet.e Trojan.PSW.Vorbeld.B TROJ_VORBELD.B TROJ_VORBELD.B Trojan.PSW.Vorbeld.B Trojan-IM.Win32.Ikmet.e Trojan.PSW.Vorbeld.B Trojan.Win32.Ikmet.diag Win32.Trojan-im.Ikmet.Lfzq Trojan.PSW.Vorbeld.B TrojWare.Win32.PSW.Vorbeld.B Trojan.PSW.Vorbeld.B Trojan.PWS.Special.11 Trojan.Ikmet.Win32.2 BehavesLike.Win32.Fareit.fz W32/Risk.ZFPE-4855 Trojan/PSW.Vorbeld.b TR/PSW.Vorbeld.b Trojan[IM]/Win32.Ikmet Win32.Troj.Vorbeld.b.kcloud PWS:Win32/Vorbeld.B Trojan-IM.Win32.Ikmet.e TScope.Trojan.VB Win32/PSW.Vorbeld.B Trojan.Ikmet!CCqyhhL0iag Backdoor.VB W32/Vorbeld.E!tr Win32/Trojan.IM.00b


EventBot Obfuscated class names Obfuscated class names using letters of the alphabet .


A backdoor also known as: Trojan.PWS.OnlineGames.AAGG Trojan.Magania.19302 Trojan.PWS.OnlineGames.AAGG TSPY_ONLINEG.IGO Win32.Trojan.WisdomEyes.16070401.9500.9932 Infostealer.Onlinegame Win32/Frethog.CIL TSPY_ONLINEG.IGO Win.Spyware.59235-2 Trojan-GameThief.Win32.OnLineGames.txbo Trojan.PWS.OnlineGames.AAGG Trojan.Win32.OnLineGames.lhee Troj.PSW32.W.QQPass.lpXN Trojan.PWS.OnlineGames.AAGG TrojWare.Win32.Trojan.Inject.~II Trojan.PWS.OnlineGames.AAGG Trojan.MulDrop4.15206 PWS-OnlineGames.co Trojan/PSW.OnLineGames.auru Trojan[GameThief]/Win32.WOW.gic Win32.Troj.OnlineGames.sd.kcloud Trojan.PWS.OnlineGames.AAGG Trojan.Win32.PSWIGames.11924.B Trojan.PWS.OnlineGames.AAGG Trojan/Win32.OnlineGameHack.C909 TrojanPSW.OnLineGames.nr Trojan-Spy.OnLineGames


Cyphort has been monitoring how threat actors are exploiting computing resources from compromised victims to mine various crypto currencies.


A backdoor also known as: Trojan-Ransom.Win32.Toxic.a BehavesLike.Win32.BadFile.jc Trojan.Win32.Ransom.a


“ These communication channels are hard to discover and even harder to block entirely .


A backdoor also known as: TrojanRansom.Blocker Ransom_Blocker.R0C1C0DHU17 Win32.Trojan.WisdomEyes.16070401.9500.9605 Ransom_Blocker.R0C1C0DHU17 Trojan-Ransom.Win32.Blocker.kgrm Troj.Ransom.W32.Blocker!c BehavesLike.Win32.RansomCerber.gh W32/Trojan.DOGS-7123 W32.Trojan.Backdoor TR/Crypt.ZPACK.hmkaa Trojan-Ransom.Win32.Blocker.kgrm Trojan/Win32.Dapato.C1720332 Hoax.Blocker Trojan.Dropper Trj/CI.A Win32.Trojan.Blocker.Akzg Trojan.Blocker!U13z+V78Arg Win32/Trojan.Ransom.acc


Since the start of the Russo-Ukrainian conflict, Kaspersky researchers and the international community at large have identified a significant number of cyberattacks executed in a political and geopolitical context.


network.exe submitting to the server code snippet Code similarities We found some code similarities between the implant for Windows and other public accessible projects .


In the image below , we see a log TrickMo sent to the attacker upon becoming the default SMS app .


A backdoor also known as: Win.Trojan.Dadobra-446 Trojan-Downloader.Win32.Banload.bnlx Trojan.Win32.Downloader.337408.M TrojWare.Win32.TrojanDownloader.Dadobra.~JK Trojan.DownLoader5.10443 Trojan-Downloader.Win32.Banload TrojanDownloader.Banload.bhs Trojan[Downloader]/Win32.Banload Trojan-Downloader.Win32.Banload.bnlx Trojan:Win32/Banload.A Downloader/Win32.Banload.C108589 Win32/Spy.Banker.WNS Win32.Trojan-downloader.Banload.Ebhk


SMS messages .


Let's examine a couple of interesting delivery techniques from an APT active for the past several years, the Spring Dragon APT.


] 16 lala513.gicp [ .


SunOrcal activity has been documented to at least 2013, and based on metadata surrounding some of the C2s, may have been active as early as 2010.


A backdoor also known as: TSPY_MALUMPOS.SM TSPY_MALUMPOS.SM Win.Trojan.MalumPOS-1 TR/AD.Siaacsia.ielmw Trojan:Win32/Malumpos.A Trojan/Win32.Malumpos.C1727078 Trojan-Spy.MalumPOS Win32/Trojan.Spy.958


] net app store was replaced with the malicious HenBox app ; however , some indicators point to the server running an outdated version of Apache Web Server on a Windows 32-Bit operating system .


An aside: the rootkit does appear to be named after the Pokémon of the same name.


A backdoor also known as: Application.Hacktool.EH Trojan/W32.HackTool.215552 Trojan.Mauvaise.SL1 Win.Tool.Wincred-6333920-0 Application.Hacktool.EH HackTool.Win64.WinCred.c Application.Hacktool.EH Application.Hacktool.EH Tool.WinCred.1 BehavesLike.Win64.BrowseFox.dh W64/Application.WFWG-6345 Application.Hacktool.EH HackTool.Win64.WinCred.c Application.Hacktool.EH HackTool.Win64 Trj/CI.A


A backdoor also known as: Trojan-Dropper/W32.Dapato.26112 Trojan-Dropper.Win32.Dapato!O BackdoorAPT.Hikiti.G4 Win32.Trojan.WisdomEyes.16070401.9500.9983 Backdoor.Trojan BKDR_FEXEL.MM Backdoor.Win32.Fexel.b Trojan.Win32.Dapato.ceuzkz Trojan.DownLoader10.12491 BehavesLike.Win32.Downloader.mc Trojan.Win32.Farfli W32/Backdoor.QCOF-8324 Trojan[Dropper]/Win32.Dapato Trojan.Heur.E97E22 Troj.Dropper.W32.Dapato.dawi!c Backdoor.Win32.Fexel.b Backdoor:Win32/Hikiti.G!dha Dropper/Win32.Dapato.C199271 Win32.Backdoor.Fexel.Wvkt Trj/CI.A


It is assumed that actors using the malware are targeting small- to medium-sized businesses given the malware's focus on VNC applications.


In spite of these commonalities, we have not identified any firm links between the two groups.


This new wave of attacks has also used some infrastructure that has previously been used in Carbanak campaigns.


“ The takeaway ? Internet users should keep on securing their activities with good security solutions for both computers and mobile devices. ” Hashes : E5212D4416486AF42E7ED1F58A526AEF77BE89BE A9891222232145581FE8D0D483EDB4B18836BCFC AFF9F39A6CA5D68C599B30012D79DA29E2672C6E Insidious Android malware gives up all malicious features but one to gain stealth ESET researchers detect a new way of misusing Accessibility Service , the Achilles ’ heel of Android security 22 May 2020 - 03:00PM ESET researchers have analyzed an extremely dangerous Android app that can perform a host of nefarious actions , notably wiping out the victim ’ s bank account or cryptocurrency wallet and taking over their email or social media accounts .


A backdoor also known as: Trojan.ArchSMS!Tf0HkXJW05g Hoax.Win32.ArchSMS.hqqg Hoax.ArchSMS.hqqg SecurityRisk.PremiumSMSScam Hoax.Win32.ArchSMS Trj/CI.A


The new family appears to have been in the wild since late 2016 and to date we have only identified 10 unique samples, indicating it may be sparingly used.


BLOCKER_STOP – block display of all HTML pages .


A backdoor also known as: Backdoor.Win32.Koutodoor!IK Backdoor:Win32/Koutodoor.B Backdoor.Win32.Koutodoor.da SHeur2.AIKX


It specifically targets financial banking applications across the United States and Europe , including Italy , the UK , Spain , Switzerland , France , and Germany .


The StreamEx family has the ability to access and modify the user's file system, modify the registry, create system services, enumerate process and system information, enumerate network resources and drive types, scan for security tools such as firewall products and antivirus products, change browser security settings, and remotely execute commands.


A backdoor also known as: Trojan.Comfold Trojan:Win32/Comfold.A


Third-party marketplaces or some other attacker-controlled domains are likely used to host the sample .


Indicators of Compromise SHA256 Package App label 332e68d865009d627343b89a5744843e3fde4ae870193f36b82980363439a425 ufD.wykyx.vlhvh SEX kr porn 403401aa71df1830d294b78de0e5e867ee3738568369c48ffafe1b15f3145588 ufD.wyjyx.vahvh 佐川急便 466dafa82a4460dcad722d2ad9b8ca332e9a896fc59f06e16ebe981ad3838a6b com.dhp.ozqh Facebook 5022495104c280286e65184e3164f3f248356d065ad76acef48ee2ce244ffdc8 ufD.wyjyx.vahvh Anshin Scan a0f3df39d20c4eaa410a61a527507dbc6b17c7f974f76e13181e98225bda0511 com.aqyh.xolo 佐川急便 cb412b9a26c1e51ece7a0e6f98f085e1c27aa0251172bf0a361eb5d1165307f7 jp.co.sagawa.SagawaOfficialApp 佐川急便 Malicious URLs : hxxp : //38 [ .


A backdoor also known as: Worm.Win32.AutoRun!O Worm.AutoRun.Win32.132231 Win32.Trojan.ServStart.a Win.Trojan.Qhost-160 Trojan.Win32.AutoRun.cvpwhj Trojan.DownLoader4.40333 BehavesLike.Win32.Ipamor.lm TR/Dldr.JKCN Trojan/Win32.Downloader.C40577 Trojan.Win32.Wc Win32/AutoRun.PT Trojan-Proxy.Win32.Ranky


The handful of malicious features densely packed in this new malware also includes the ability to drop other malware.


] net – C & C servers NG SuperShell – string from the reverse shell payload ngg – prefix in commands names of the implant for Windows Signature with specific issuer Whois records and IP relationships provide many interesting insights as well .


DOWNLOAD AND UPDATE THE TARGET CONFIGURATION FILE By analyzing and decoding the HTTP packets in EventBot Version 0.0.0.1 , we can see that EventBot downloads and updates a configuration file with almost 200 different financial application targets .


Once the malware can use accessibility services , it has the ability to operate as a keylogger and can retrieve notifications about other installed applications and content of open windows .


A backdoor also known as: W32.FamVT.ShipBHQc.Trojan Trojan.Win32.ShipUp!O TrojanPWS.Zbot.Y Trojan/Kryptik.awzk Trojan.Razy.D3C5B TROJ_KRYPTK.SML3 Win.Trojan.Redirect-6055402-0 Trojan.Win32.ShipUp.brmnrc Trojan.Redirect.140 Trojan.ShipUp.Win32.1152 TROJ_KRYPTK.SML3 BehavesLike.Win32.PWSZbot.dh Trojan.Win32.ShipUp Trojan/ShipUp.ix TR/Rogue.kdz.11287.3 Trojan/Win32.ShipUp TrojanDropper:Win32/Gepys.A Troj.W32.ShipUp.lINm Trojan/Win32.Shipup.R58491 TScope.Malware-Cryptor.SB Trojan.FakeMS.ED W32/Kryptik.AYTK!tr


A backdoor also known as: Trojan-Spy.Win32.Tibia!O Win32.Trojan.WisdomEyes.16070401.9500.9963 Trojan.Win32.Drop.cbndjf Trojan.MulDrop3.1226 BehavesLike.Win32.BadFile.rc Trojan-Dropper.Win32.Monya TR/Drop.Tibdef.B Trojan.Raldhep.1 TrojanDropper:Win32/Tibdef.B W32/Dropper.AAAI!tr


It is in use by the Molerats aka Gaza cybergang, a politically motivated group whose main objective, we believe, is intelligence gathering.


The Magnitude exploit kit has been using an XML configuration file critical to retrieving the malware payload Cerber for several months already.


Here is Forcepoint Security Labs we have seen a number of changes and improvements over the last few months.


The actors compromised the sites of a local television network, educational organizations, a religious institute, and a known political party in Taiwan; and a popular news site in Hong Kong.


List of package names of apps on events from which the Trojan opens a fake Google Play window ( for the Russian version of the Trojan ) Example of Trojan screen overlapping other apps When bank card details are entered in the fake window , Riltok performs basic validation checks : card validity period , number checksum , CVC length , whether the number is in the denylist sewn into the Trojan code : Examples of phishing pages imitating mobile banks At the time of writing , the functionality of most of the Western versions of Riltok was somewhat pared down compared to the Russian one .


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G PE_VIRUX.O W32/Trojan2.OALA W32.Virut.CF Win32/Virut.17408 PE_VIRUX.O Win32.Virus.Virut.Q Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg Virus.Win32.Virut.CE Win32.Virut.56 Virus.Virut.Win32.1938 BehavesLike.Win32.Virut.cc W32/Trojan.JXET-3602 Win32/Virut.bt Virus/Win32.Virut.ce Win32.Virut.cr.61440 W32.Virut.lM6H Virus.Win32.Virut.ce TrojanClicker:MSIL/Xobnff.A Win32/Virut.F Virus.Virut.14 W32/Sality.AO Win32/Virut.NBP Virus.Win32.Virut W32/Virut.CE Virus.Win32.Virut.M


A backdoor also known as: Backdoor.Zegost.FC.2167 Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.DownLoader22.48526 BehavesLike.Win32.Trojan.cc Trojan.MSIL.Bladabindi.1 MSIL/Injector.PJG!tr Trj/GdSda.A


This analysis dissects FakeSpy ’ s Chunghwa Post app version , which emerged in April 2020 .


Sinkhole data explained below shows just how quickly this campaign is impacting victims.


A backdoor also known as: Trojan.Netstop.A Trojan.Netstop.A Backdoor.Trojan Win32/Noshare.N TROJ_NETSTOPA.A Trojan.Netstop.A Trojan.Win32.Netstop.dyylkw Win32.Trojan-spy.Gc.Hsii Trojan.Netstop.A Worm.Win32.SpyBot.GC Trojan.Netstop.A Email-Worm.Win32.GOPworm.196 TROJ_NETSTOPA.A TR/Netstop.A Trojan.Netstop.A Trojan.Netstop.A Email-Worm.Win32.GOPworm.196 Win32/SpyBot.GC Worm.SpyBot!FiFtixQJKm8 W32/Netstop.A!tr Bck/Secur.A


FireEye assesses that APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests.


android.intent.action.restart A legacy intent used to indicate a system restart .