A backdoor also known as: Backdoor/Bifrose.sxu Win32.Trojan.WisdomEyes.16070401.9500.9583 W32/Backdoor.BVIJ-4494 BKDR_BIFROSE_0000025.TOMA Win.Trojan.Bifrose-3481 Trojan.Win32.Bifrose.isow Backdoor.Win32.A.Bifrose.51712.B[h] Trojan.MulDrop.16295 Backdoor.Bifrose.Win32.79774 W32/Backdoor2.BVUS Backdoor/SdBot.ees WORM/IrcBot.353792 Trojan[Backdoor]/Win32.Bifrose Trojan:Win32/Mdrop.A Backdoor/Win32.Bifrose.C64544 Backdoor.Bifrose!Gi2ynDtXmII Backdoor.Win32.Bifrose


A backdoor also known as: Trojan.PDF.Phishing.UX Trojan.PDF.Phish.ve Trojan.PDF.Phishing.UX Trojan.PDF.Phishing.UX EXP/Pidief.EB.523 Trojan.PDF.Phishing.UX Trojan.PDF.Phish.ve Trojan.PDF.Phishing.UX Trojan.PDF.Phishing.UX


A backdoor also known as: W32.FamVT.ExpiroPC.PE Worm/W32.Small.6084.H Email-Worm.Win32.Zhelatin!O Email-Worm.Win32.Zhelatin.h W32.W.Zhelatin.l03u TrojWare.Win32.Small.DBY Worm.Zhelatin.Win32.4001 Downloader-BAI.dam Worm/Zhelatin.ok TR/Small.DBY.Y Worm[Email]/Win32.Zhelatin Email-Worm.Win32.Zhelatin.h Win32/Luder.O Downloader-BAI.dam Email-Worm.Win32.Zhelatin W32/DldBAI.H!dam Trj/Alanchum.PH


The Locky ransomware has been very active since its return which we documented in a previous blog post.


About two-thirds of these apps show some kind of malicious behavior, including displaying ads and downloading apps without the user's consent.


However, we just recently found new Sage samples that, while they appear to still be Sage 2.2, now have added tricks focused on anti-analysis and privilege escalation.


A backdoor also known as: W32/Spamtool.Y Trojan.Dropper Win32/Mendrem.A Win.Trojan.Proxy-4705 Troj.Proxy.W32!c Trojan.MulDrop.4012 BehavesLike.Win32.Backdoor.cm Trojan-Downloader.Win32.LoadAdv W32/Spamtool.LPPN-6055 Spammer:Win32/Kukunefo.A TScope.Malware-Cryptor.SB Trj/CI.A


When the files are encrypted they DO NOT change file name or extensions and appear normal to the victim until you try to open them.


During the installation , the malware asks for the following permissions : READ_PHONE_STATE - Allows read-only access to the phone state , including the current cellular network information , the status of any ongoing calls , and a list of any PhoneAccounts registered on the device .


A backdoor also known as: Trojan/W32.NForwarded.401408.F Trojan.Beaugrit.A.mue Trojan/Spy.Banhguo.a Win32.Trojan-Spy.Banhguo.a Trojan.Win32.KillFiles.dmlrmm Trojan.Win32.PSWIGames.401408.J TrojWare.Win32.Lmir.RL Trojan.KillFiles.17459 Backdoor.PePatch.Win32.55641 BehavesLike.Win32.Dropper.fc TR/Banhguo.aone Trojan.Symmi.DBA11 Trojan/Win32.OnLineGames.R127640 W32/Banhguo.A!tr


A backdoor also known as: W32.FamVT.ExpiroPC.PE Virus.W32.Hupigon.Fqm!c BehavesLike.Win32.RAHack.fc KIT/Mac.Walrus.121 HackTool[Constructor]/Win32.Walrus Constructor:W97M/Walrus.1_21.dam#2 Trj/CI.A Win32/Trojan.488


This information can give the attacker access to personal and business bank accounts , personal and business data , and more .


A backdoor also known as: Uds.Dangerousobject.Multi!c Win32.Trojan.WisdomEyes.151026.9950.9988 Heur.AdvML.C Trojan.Win32.MulDrop5.dbmdce BehavesLike.Win32.BrowseFox.nh W32/CoinMiner.QR!tr Trojan.Zusy.D17C80 PUP/Win32.BitCoinMiner.C350160 Trojan:Win32/Figyek.A Win32.Trojan.Adware.Wnmi Trojan.CoinMiner CoinMiner.BLK Trojan.Win32.CoinMiner.QR Win32/Trojan.713


A backdoor also known as: Win32.Packed.Krap.b.3 Packer.Malware.NSAnti.1 Trojan:Win32/Inhoo.A Packer.Malware.NSAnti.1 Trojan-GameThief.Win32.Magania.aigw


A backdoor also known as: Trojan.Dropper.Axesoft.A Trojan-Dropper/W32.Axesoft.800094 Trojandropper.Axesoft Trojan.Dropper.Axesoft.A Trojan/Dropper.Axesoft TROJ_AXESOFT.A TROJ_AXESOFT.A Trojan.Dropper.Axesoft.A Trojan-Dropper.Win32.Axesoft Trojan.Dropper.Axesoft.A Trojan.Win32.Axesoft-Drp.fdro Troj.Dropper.W32.Axesoft!c Trojan.Dropper.Axesoft.A Trojan.Dropper.Axesoft.A Trojan.MulDrop.216 Dropper.Axesoft.Win32.2 BehavesLike.Win32.Dropper.bc Trojan-PWS.Win32.QQPass W32/Trojan.RHJF-8903 TrojanDropper.Axesoft W32.Trojan.Dropper-AxeSoft BDS/GWGirl.12.C Trojan.Dropper.Axesoft.A Trojan-Dropper.Win32.Axesoft BackDoor-SP.dr TrojanDropper.Axesoft Win32/TrojanDropper.Axesoft Win32.Trojan-dropper.Axesoft.Apde Trojan.DR.Axesoft!crjcgQTkDRg W32/Bdoor.SP!tr Win32/Trojan.Dropper.d68


Initial reports of a new variant of ransomware called LockCrypt started in June of this year.


But the 3rd ASEAN-United States Summit on 21 November 2015 did not disappoint.


A backdoor also known as: W32.OnGamesLT180912HKGHAAI.Trojan Trojan-Downloader.Win32.Losabel!O Downloader.Losabel.Win32.540 Trojan/Downloader.Losabel.nx Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Popwin BehavesLike.Win32.Trojan.fh TrojanDownloader.Losabel.cx Trojan[Downloader]/Win32.Losabel TrojanDropper:Win32/Idicaf.A Trojan/Win32.OnlineGameHack.C187141 Trojan.DL.Losabel!C2fG9tSV6gk Trj/Pupack.A


It appears to be run by a Russian-speaking group of hackers.


A backdoor also known as: Trojan.Kazy.D54BC4 Win32.Trojan.WisdomEyes.16070401.9500.9993 Tool.PassView.859 Trojan/Blocker.jhq Win32.Troj.Foxhiex.a.kcloud Trojan/Win32.Zbot.C284570 Trojan.MSIL.CryptoObfuscator Trj/GdSda.A


A backdoor also known as: P2P-Worm.Win32.Krepper!O Worm.Krepper.A.mue Worm.Krepper.Win32.1 W32/Krepper.c W32.IRCBot Win32/Sndc.A WORM_SHAREBOT.A Win.Worm.Poom-1 P2P-Worm.Win32.Krepper.c Trojan.Win32.Krepper.dqeaqt Troj.GameThief.W32.OnLineGames.lgKp Win32.Worm-p2p.Krepper.Ljjq Worm.Win32.Krepper.C Win32.HLLW.Krepper WORM_SHAREBOT.A BehavesLike.Win32.PUPXAX.lz W32/Pcbot.A@p2p Trojan/Krepper.ad WORM/Krepper.C Worm[P2P]/Win32.Krepper Worm:Win32/Krepper.B Trojan.Win32.Krepper.11808 P2P-Worm.Win32.Krepper.c Worm.Krepper I-Worm.Krepper.C Win32/Krepper.C Worm.P2P.Krepper!dcAWP425Bzk P2P-Worm.Win32.Krepper W32/Krepper.C!worm


Mobile developers have recently begun eschewing traditional app stores and instead want to deliver their software directly through their own means .


This sort of conversion allows Python code to be run in a Windows environment without pre-installed Python binaries .


Through our on-going investigation and monitoring of this targeted attack campaign, we found suspicious URLs that hosted a newly discovered zero-day exploit in Java now identified by Oracle as CVE-2015-2590.


The campaign was identified starting with the registration on 2023-04-05 16:04:51 up to the latest registration on 2023-04-10 08:33:28.


It has been attacking Iranian users.


A backdoor also known as: Trojan/W32.Makecall.20484 Trojan.Makecall Trojan.Makecall.Win32.5 TROJ_MAKECALL.A W32/MalwareF.VJTB W32.Makecall.Trojan TROJ_MAKECALL.A Trojan.Win32.Makecall.a Trojan.Win32.Makecall.fkdu Trojan.Win32.S.Makecall.20484 Troj.W32.Makecall.a!c Trojan.MulDrop.717 BehavesLike.Win32.VBObfus.mz W32/Risk.QDBN-9051 Trojan/MakeCall.d TR/Makecall.a Trojan/Win32.Makecall Trojan:Win32/Makecall.A Trojan.Win32.Makecall.a Trojan/Win32.Makecall.R109087 SScope.Trojan.VBRA.3284 Win32/Makecall.A Win32.Trojan.Makecall.Ecul Trojan.Makecall!Hu8pme7fStI Trojan.Win32.Makecall W32/Makecall.A!tr


A backdoor also known as: Win32/Sipay.ADV Trojan.Crypt.GU Trojan/W32.Small.15872.S Trojan.Small.Win32.4658 Trojan/Small.xut Trojan.Win32.Small.glefu Win32/TrojanDownloader.FakeAlert.JI WORM_SMALL.MDA Trojan.Small-8598 Trojan.Crypt.GU Trojan.Crypt.GU Trojan.Small!AZKO6qCeQTg Trojan.Win32.Small.15872.Q[h] Trojan.Dropper/AdobeFake Trojan.Crypt.GU TrojWare.Win32.Small.~YE Trojan.Crypt.GU Trojan.DownLoader10.48865 WORM_SMALL.MDA W32/Trojan2.EQHY Trojan/Small.fnb Trojan/Win32.Small Win32.Troj.Small.kcloud Trojan.Crypt.GU Win-Trojan/Downloader.15872.GU TrojanDownloader:Win32/Bofang.C Trojan.Crypt.GU Trojan.Small Trojan-Downloader.HG W32/FakeAlert.JI!tr.dldr


In addition, Xbot will steal all SMS messages and contact information, intercept certain SMS messages, and parse SMS messages for mTANs Mobile Transaction Authentication Number from banks.


Using both the Elknot and BillGates DDoS malware, these attackers have continued to infect vulnerable Elasticsearch servers in order to enhance their DDoS capabilities.


A backdoor also known as: Trojan/KillAV.a TROJ_SPNR.38J614 Backdoor.Trojan TROJ_SPNR.38J614 Uds.Dangerousobject.Multi!c Trojan.Patched.Win64.2566 W64/Trojan.HLJR-4976 Trojan.KillAV!apRF/prfUvc Trojan.Win64.Killav W64/KillAV.A!tr Trj/CI.A


It now appears to be in the league of full-blown banking trojans such as Dyreza, Neverquest/Vawtrak, Zeus, etc.


DIMNIE is a modular information stealer profiled earlier this year by security researchers at PaloAlto s Unit 42, who found the malware in targeted phishing attacks against open-source developers.


History has shown us that , in time , these attacks will use zero-day vulnerabilities , exploits or a combination of techniques .


A backdoor also known as: W32.UserinitWininit.Trojan Trojan.Delf.QEO Trojan.Bancteian.CB4 Trojan.Delf.QEO Trojan/Spy.Delf.qgs Trojan.Delf.QEO Win32.Virus.Delf.c W32/Delf.UD TROJ_BANCTEIAN.SM Win.Trojan.Bancteian-0-6418983-0 Trojan.Delf.QEO Trojan.Delf.QEO Trojan.Win32.Delf.3301398 Trojan.Delf.QEO Backdoor.Win32.Delf.~DD Trojan.Delf.QEO Adware.BrowseFox.Win32.220566 TROJ_BANCTEIAN.SM BehavesLike.Win32.Trojan.wh Trojan.Win32.Bancteian W32/Delf.CERT-0413 Trojan.Reconyc.apf W32.Trojan.Delf TR/BAS.Samca.lsswh Trojan/Win32.Delf.nbw Trojan:Win32/Bancteian.B Trojan/Win32.Bancteian.R174475 Trojan.Reconyc Trojan.Win32.Delf.qgs W32/Delf.QGS!tr.spy


Depending on the intent triggered , one of two Receivers would be called , in this instance they are called Boot or Time but the name is somewhat immaterial .


Text message and call logs were transmitted every 72 hours to the Shanghai server , and once a day for other personally identifiable data , the company says .


Until now , we haven ’ t seen targeted attacks against mobile phones , although we ’ ve seen indications that these were in development .


In one of our previous blog entries, we covered how the threat actor known as Winnti was using GitHub to spread malware – a development that shows how the group is starting to evolve and use new attack methods beyond their previous tactics involving targeted attacks against gaming, pharmaceutical, and telecommunications companies.


A backdoor also known as: Trojan.MSIL.Downloader.AD Trojan.MSIL.Downloader.AD Trojan.MSIL.Downloader.AD Trojan.MSIL.Downloader.AD Trojan.Win32.Inject.ewmdhe Troj.MSIL.Disfa.mCrY Trojan.MSIL.Downloader.AD TrojWare.MSIL.Inject.TEQ Trojan.MSIL.Downloader.AD TR/Inject.xbeihg TrojanDownloader:MSIL/Datsup.A Trojan.MSIL.Downloader.AD Trj/CI.A MSIL/Dloader.AWE!tr Win32/Trojan.cd2


A backdoor also known as: Exp.RTF.CVE-2017-8759.D Trojan.Mdropper Win32/Exploit.CVE-2017-8759.A TROJ_ARTIEF.JEJOWP Rtf.Downloader.CVE_2017-6336326-3 Exploit.MSOffice.CVE-2017-8759.a Exploit.Ole2.CVE-2017-8759.estduh RTF.S.Exploit.44738 Exploit.Msoffice.Cve!c Exploit.CVE-2017-8759.5 TROJ_ARTIEF.JEJOWP RTF/Trojan.BGKX-2 HEUR:Exploit.MSOffice.CVE-2017-8759.a Exploit.CVE-2017-8759 Office.Exploit.Cve-2017-8759.Ajle Trojan.Win32.Exploit Malicious_Behavior.SB Win32/Trojan.Exploit.024


A backdoor also known as: Trojan.Downloader.Farfly.L Multi.Threats.InArchive W32/Risk.NCBB-0700 Trojan.Farfli Win.Trojan.Downloader-2275 Trojan.Downloader.Farfly.L Trojan.Downloader.Farfly.L Trojan.Win32.Crypted.dkwpfn Trojan.Win32.Z.Downloader.266845 Trojan.Downloader.Farfly.L Trojan.DownLoader4.59614 Downloader.Selvice.Win32.747 TROJ_DLOADR.SMQ Trojan-Downloader.Win32.Selvice W32/MalwareS.ASNW Trojan.Downloader.Farfly.L TrojanDownloader:Win32/Caxnet.B Worm.WhiteIce Trojan.Downloader.Farfly.L Trojan.Downloader.Farfly.L Trojan.DL.Selvice!qQfZyIPcdpU Win32/Trojan.Downloader.6fb


A backdoor also known as: Trojan.Win32.Hijacker.kvdpi TROJ_DYER.BMC Trojan.Enfal-7 HEUR:Trojan.Win32.Invader Trojan.Hijacker!h2YIjU+BiQU Trojan.DownLoader7.14277 TROJ_DYER.BMC Trojan/Invader.exe W32/Bfr.2!tr Trojan[:HEUR]/Win32.Invader Win-Trojan/Inject.16896.IT Win32.Trojan.Hijacker.Ebqw Trojan.Win32.Sanpec Win32/Trojan.1da


The attacks we attribute to Scarlet Mimic have primarily targeted Uyghur and Tibetan activists as well as those who are interested in their causes.


This new threat also uses a macro to infect the target's computer, but rather than retrieving a binary payload, it relies on various scripts to maintain its presence and to communicate via hacked websites, acting as proxies for the command and control server.


A backdoor also known as: Downloader.Myxa.Win32.113 Trojan/Downloader.Myxa.cit Trojan.Kazy.D6034 TROJ_MONKIF.SMKP Win32.Trojan.WisdomEyes.16070401.9500.9999 Downloader.Monkif TROJ_MONKIF.SMKP Win.Downloader.100478-1 Trojan.Win32.Myxa.bqhvc Trojan.Win32.A.Downloader.22672.B Trojan.DownLoad3.32720 Trojan-Downloader.Win32.Myxa TrojanDownloader.Myxa.cx TrojanDownloader:Win32/Monkif.T Downloader/Win32.Monkif.R1925 TrojanDownloader.Myxa Trj/Myxa.A Trojan.DL.Myxa!oB3ehXmv9m8


When we talk about the attackers, there is this misconception that they are these super villains who can only do evil, but keep in mind they are humans too.


His repository proves that he is indeed an Android developer , but it contained no publicly available code of the Ashas adware at the time of writing of this blogpost .


This macro comes into users' systems through a spam email with subjects such as My Resume, Openings, Internship, etc.


A backdoor also known as: Android.FakeToken.B A.H.Pay.Erop.YG Android.Trojan.SMSBot.B AndroidOS/FakeToken.B HEUR:Trojan-Banker.AndroidOS.Faketoken.a Android.Trojan.SMSBot.B Trojan.Android.SMSBot.b Android.Malware.Trojan Trojan:Android/SmsSpy.K Android.SmsSend.419.origin AndroidOS/FakeToken.B Trojan[Banker]/Android.Faketoken Android.Troj.at_Stealer.g.kcloud HEUR:Trojan-Banker.AndroidOS.Faketoken.a Android.Trojan.SMSBot.B Trojan.AndroidOS.SendSMS Android/FkToken.B


The actor can even take his malicious activities to the next level by installing a remote application from a designated server , thus allowing him to install new malware once it is required .


Android malware creators have recently been mixing business with play.


DNS is an ideal fit for frequently exporting small chunks of custom encoded data i.e. credit card track 1 and track 2 data to an external, remote location.


We have recently encountered very aggressive jabber spam campaign, advertising the Philadelphia ransomware.


A backdoor also known as: Trojan.Zusy.D39A16 Win32.Trojan.WisdomEyes.16070401.9500.9800 Backdoor.Trojan TSPY_REALTIME.A Trojan.RealSpy TSPY_REALTIME.A W32/Risk.KQTT-6320 Trojan/Win32.HDC.C24097


A backdoor also known as: Trojan/Downloader.Delf.quw Win32.Trojan.WisdomEyes.16070401.9500.9770 Win.Trojan.Downloader-57555 Trojan.DownLoad2.37645 BehavesLike.Win32.PUPXAS.ch Trojan.Graftor.D1EFD7 TrojanDownloader:Win32/Blortios.C Trojan/Win32.Downloader.R18903 Win32/Trojan.88b


In recent weeks, Unit 42 has been analyzing delivery documents used in spear-phishing attacks that drop a custom downloader used in cyber espionage attacks.


But over the past week, while performing research using Palo Alto Networks AutoFocus, we noticed a large uptick in the delivery of the Hancitor malware family as they shifted away from H1N1 to distribute Pony and Vawtrak executables.


Ransomware sure has had an uptick the past years; more and more variants appear while some have been leading the pack for the past years.


A backdoor also known as: Trojan/Clicker.Small.ht Win32/TrojanClicker.Small.HT W32/TrojanX.MXY Smalltroj.BDN Win32.Small.ht Trojan-Clicker.Win32.Small.ht Trojan.Clicker.Small.HT TrojWare.Win32.TrojanClicker.Small.HT Trojan-Clicker.Win32.Small.ht Win32/TrojanClicker.Small.HT TR/Click.Small.HT W32/TrojanX.MXY Trojan-Downloader.Win32.Small!IK Trojan.Click.Small.HT TrojanClicker:Win32/Small.BB Trojan.Clicker.Small.HT Win-Trojan/Downloader.120895 Trojan-Clicker.Win32.Small.ht Trojan-Clicker.Small.HT Trojan-Clicker.Small.HT Trojan.Clicker.Autoit Trojan-Downloader.Win32.Small W32/Small.HT!tr Trj/Downloader.MDW


A backdoor also known as: Trojan.Win32.Badur!O Win32.Trojan.WisdomEyes.16070401.9500.9996 TR/Rogue.1517892 Trojan/Win32.Badur TrojanDownloader:MSIL/Balamid.A Trojan.Zusy.D13D03 Trojan.Badur Trojan.Badur!


The company later released a whitepaper which described Qbot version 910 in great detail.


The investigation found a supply chain-focused attack at M.E.Doc software that delivered a destructive payload disguised as ransomware.


There were several things that struck us as both interesting and concerning about the details; a threat actor known to operate in South East Asia is now using secure sockets layer SSL encryption in their malware.


A backdoor also known as: Downloader.Banload.10000 Trojan.Banker Win32.Trojan.WisdomEyes.16070401.9500.9955 Trojan.DownLoader13.22599 W32/Banker.ABCU!tr


A backdoor also known as: Trojan.Downloader.Braidupdate.C Trojan.Downloader.Braidupdate.C Trojan.Win32.Braidupdate.frhy W32/Downloader.AAJ Adware.BrowserAid Win32/TrojanDownloader.Braidupdate.C TROJ_BRAIDUPDT.C Worm.WinUpToDate Trojan-Downloader.Win32.Braidupdate.c Trojan.Downloader.Braidupdate.C Trojan.DL.Braidupdate!ucpSRQWfQfk Win32.Trojan-downloader.Braidupdate.Tayo Trojan.Downloader.Braidupdate.C TrojWare.Win32.TrojanDownloader.Braidupdate.C Trojan.Downloader.Braidupdate.C Trojan.Braid Downloader.Braidupdate.Win32.3 TROJ_BRAIDUPDT.C W32/Downloader.IZKY-4160 TR/Dldr.Braidupda.C W32/Braidupdate.C!tr.dldr Trojan[Downloader]/Win32.Braidupdate Trojan.Downloader.Braidupdate.C Troj.Downloader.W32.Braidupdate.c!c Trojan/Win32.Braidupdate TrojanDownloader:Win32/Braidupdate.C Trojan.Downloader.Braidupdate.C TrojanDownloader.Braidupdate not-a-virus:AdWare.Win32.Cash Trojan.Downloader.Braidupdate.C Downloader.Braidupdate.C Win32/Trojan.Downloader.2d9


The Angler Exploti Kit has integrated CVE-2015-5119 leaked from HackingTeam.


Gafgyt botnet attacking Netcore routers


During our continued research on Sofacy's Komplex Trojan, we have found a sample of a backdoor Trojan that we believe the Sofacy group uses when targeting individuals running macOS systems.


There are two variations of the emails: one is an order confirmation from a Japanese equipment supplier and the other pretends to come from a local printing company.


This post will start to explore some of these obfuscations to get a better understanding of how FormBook works.


[Zscaler] has covered Dridex Banking Trojan being delivered via various campaigns involving Office documents with malicious VBA macros in the past.


A backdoor also known as: Trojan-GameThief.Win32.OnLineGames!O Win32.Trojan.WisdomEyes.16070401.9500.9987 Trojan.Drondog Win.Downloader.29758-2 Worm.Win32.Downloader.bldi Trojan.Win32.MLW.xzlu W32.W.Downloader.hq!c Trojan.MulDrop.15154 Trojan.Win32.KillAV Worm/Downloader.fd TR/Sorri.O Worm/Win32.Downloader Win32.Troj.DownLoaderT.hu.147456 Trojan:Win32/Wiessy.A Worm/Win32.Downloader.R2522


The malware is able to control banking transactions conducted using Internet Explorer, and harvest email credentials, which are in turn used to spread the malware further.


A backdoor also known as: Trojan.DownLoader4.13271


Other variants use other names and logos , as described later .


A backdoor also known as: Trojan.DelfiDelfi.Win32.301 Trojan.Win32.DelfiDelfi.cho Trojan.Win32.DelfiDelfi.etgljb W32/Trojan.AITA-6805 Trojan.Win32.DelfiDelfi.cho TrojanDownloader:Win32/Banavkill.A Trj/GdSda.A Trojan.DelfiDelfi! W32/Banker.AEAY!tr.spy Win32/Trojan.af4


A backdoor also known as: Trojan-PWS/W32.WebGame.37860.B Trojan-PSW.Win32.Yahu.YPager!O Trojan/PSW.Yahu.YPager.r Trojan.Kazy.D15AC9 Win32.Trojan.WisdomEyes.16070401.9500.9973 W32/Pws.BHSA Win32/YPager.D Trojan.Win32.Scar.kjpu Troj.W32.Scar!c TrojWare.Win32.PSW.YahooPager.R0 Trojan.DownLoader6.48717 Trojan.Yahoo.Win32.38 BehavesLike.Win32.Virus.nt Trojan-PWS.Win32.Yahoo W32/PWS.TYKP-7651 Trojan/PSW.Yahu.y Trojan[PSW]/Win32.Yahu Trojan.Win32.Scar.kjpu Trojan/Win32.Jorik.C1078 Win32/PSW.Yahoo.YPager.R Win32.Trojan.Scar.Pfsz W32/Yahoo_YPager.R!tr.pws


The samples we identified target the ATM vendor Diebold.


A backdoor also known as: Trojan-Dropper.Win32.Taob.ag Trojan.DR.Taob!NlMVsECgQGE Trojan.MulDrop4.3634 TR/PSW.OnlineGames.wtog TrojanDropper.Taob.o Win32.Troj.Taob.ag.kcloud Trojan:Win32/Cortheaper.A Trojan-GameThief.Win32.OnLineGames


At the time it was removed, the plugin was installed on more than 200,00 sites, albeit we cannot be sure how many of these were updated to a version that included the malicious behavior.


Finished ! * * * End translation * * * Referring again to bit.ly , we can see click statistics for this campaign ( Figure 6 ) .


Twitter user @hkashfi posted a Tweet saying that one of his friends received a file US Travel Docs Information.jar from someone posing as USTRAVELDOCS.COM support personnel using the Skype account ustravelidocs-switzerland notice the i between travel and docs .


Successful exploitation typically results in malware calling back to one or more Uyghur themed domain names.


Banking Trojans continue to evolve and threat actors are using them in new ways, even as the massive Dridex campaigns of 2015 have given way to ransomware and other payloads.


A backdoor also known as: Trojan.Vburses Trojan.Win32.Vburses


In this analysis , we get into the capabilities of the new variant and what we found to be a “ kill switch ” that can eliminate the malware remotely from an infected device .


During the operation, the malware was used to dox 400,000 members of Vietnam Airlines.


The Trojan deletes Volume Shadow Copies.


The MuddyWater attacks are primarily against Middle Eastern nations.


It is important to note that the data won ’ t be uploaded to C & C server automatically .


Elirks, less widely known than PlugX, is a basic backdoor Trojan, first discovered in 2010, that is primarily used to steal information from compromised systems.


Through our research on the Windows KLRD keylogger from the Odinaff report, we were able to discover several new keyloggers.


A backdoor also known as: Hacktool.Mapiget W32/MalwareF.HUIZ Trojan.Badname HackTool.Win32.MapiGet.a Trojan.Win32.MapiGet.cwwjwt Hacktool.W32.Mapiget!c Trojan.KeyLogger.28306 Tool.MapiGet.Win32.1 W32/Risk.LFSI-6446 HackTool.MapiGet.a Misc.HackTool.MailLogger TR/Spy.Mail.G HackTool/Win32.MapiGet Trojan.Graftor.D3C87F HackTool.Win32.MapiGet.a Win32.Hacktool.Mapiget.Iso TrojanSpy.Mail!RGqYbEAheeQ HackTool.Win32.MapiGet Win32/Trojan.Hacktool.eb5


A backdoor also known as: BackDoor-FHS.dr Trojan/Witthy.a Trojan.Win32.Clicker.crbxjx Trojan.Click2.48783 BehavesLike.Win32.VirRansom.cc Trojan.Win32.Merlos TR/Rogue.7786243 Trj/CI.A Win32/Witthy.A W32/Witthy.A!tr.bdr


Recent samples of the malware have now included the ability to use Google services for command-and-control C&C communication.


A backdoor also known as: TROJ_RAMDO.SM0 Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_RAMDO.SM0 BehavesLike.Win32.Virut.fh Trojan.Win32.Ramdo Trojan.Ramdo.1 Trojan:Win32/Ramdo.H Backdoor/Win32.Necurs.R100690 Malware-Cryptor.Limpopo Trj/Dtcontx.K Win32/Redyms.AF


A backdoor also known as: HW32.Packed.3AEC Win32.Trojan.WisdomEyes.16070401.9500.9901 Trojan.Win32.Inject.ctprfv W32.Sality.l8GK Trojan.KillProc.28723 Trojan/Nimnul.b Trojan[Ransom]/Win32.PornoAsset Ransom:Win32/Dircrypt.C Trojan.Graftor.D199D8 Trojan.Crypt Trojan.Win32.VB Trj/Dtcontx.G


A backdoor also known as: Trojan.Crypt.Delf.AL Trojan-Downloader.Win32.Banload!O Downloader.Banload.Win32.27568 TROJ_DELF.NOR Win32.Trojan.WisdomEyes.16070401.9500.9934 W32/Downldr2.ATJF Backdoor.Trojan Win32/Pigeon.AYDG Win.Downloader.20057-1 Trojan.Crypt.Delf.AL Trojan-Downloader.Win32.Banload.evb Trojan.Crypt.Delf.AL Trojan.Win32.Drop.dzdiyr Trojan.Win32.A.Downloader.214016.H Troj.Downloader.W32.Banload!c Trojan.Crypt.Delf.AL Backdoor.Win32.Remote.~N Trojan.Crypt.Delf.AL Trojan.MulDrop.12358 BehavesLike.Win32.Worm.dc Trojan/Downloader.Banload.evb TrojanDownloader.Banload.jwv TR/Delf.18944 Trojan[Backdoor]/Win32.Ceckno Trojan.Crypt.Delf.AL Trojan-Downloader.Win32.Banload.evb Trojan.Crypt.Delf.AL TrojanDownloader.Delf Bck/Hupigon.KPG Win32/Delf.NXK Win32.Trojan-downloader.Banload.Dxnj Backdoor.Ceckno!iv4t9tSa5f0 Trojan-Dropper.Delf W32/Delf.NIP!tr.bdr Win32/Trojan.823


Bitter APT is a South Asian threat group that commonly targets energy and government sectors; they have been known to target Pakistan, China, Bangladesh, and Saudi Arabia.


A backdoor also known as: Joke.Melter.A Win32.Trojan.WisdomEyes.16070401.9500.9752 W32/Joke.SXAT-7954 Joke.Melter.A Joke.Melter.A Joke.Melter.A Heur.Corrupt.PE Joke.Melter.A Joke.Finger.5 not-a-virus:BadJoke.Win32.Melter W32/Joke.BY Joke.Melter.A Joke:Win32/Melter.dam#4 Joke.Melter.A Trj/CI.A


Prometei, a highly modular botnet with worm-like capabilities that primarily deploys the Monero cryptocurrency miner, has been continuously improved and updated since it was first seen in 2016, posing a persistent threat to organizations.


A backdoor targetting Linux also known as: Possible_BASHLITE.SMLBN1 Unix.Trojan.Mirai-5607483-0 Linux.Trojan.Gafgyt.A HEUR:Backdoor.Linux.Gafgyt.y Trojan.Unix.Gafgyt.eikqfj Backdoor.Linux.Gafgyt!c Linux.BackDoor.Fgt.44 Possible_BASHLITE.SMLBN1 Backdoor.Linux.hxx LINUX/Gafgyt.klnbe Trojan.Backdoor.Linux.Gafgyt.1 HEUR:Backdoor.Linux.Gafgyt.y backdoor.linux.gafgyt.y Trojan.Linux.Gafgyt ELF/Gafgyt.WN!tr.bdr Win32/Backdoor.3e0


A backdoor also known as: Trojan/W32.Feedel.28672 Trojan.Feedel Troj.W32.Feedel!c Trojan.Feedel.f TR/RedCap.ocnbv Trojan/Win32.Feedel Trj/CI.A Win32.Trojan.Feedel.Ecjy Win32/Trojan.ada


A backdoor also known as: W32.OscoleF.Trojan Trojan.AutoIT.Injector.AP Trojan/W32.Cossta.95232.B Trojan.Napolar.A1 Trojan.Cossta.Win32.8040 Win32.Trojan.Napolar.b Infostealer.Napolar Win32/Tnega.dYPTOW BKDR_NAPOLAR.SM0 Win32.Backdoor.Napolar.B Trojan.AutoIT.Injector.AP Trojan.Win32.Cossta.cqikyo Trojan.AutoIT.Injector.AP TrojWare.Win32.Kryptik.BLGK Trojan:W32/Napolar.A Trojan.Hottrend.355 BKDR_NAPOLAR.SM0 BehavesLike.Win32.Trojan.nh Trojan.Win32.Napolar TrojanDropper.Dapato.nxc TR/BAS.Zusy.2144567 Trojan/Win32.Cossta Trojan.AutoIT.Injector.AP Trojan:Win32/Napolar.A Trojan/Win32.Cossta.C211827 Trojan.AutoIT.Injector.AP TScope.Malware-Cryptor.SB Trojan.Napolar Trj/Napolar.A Win32/Napolar.A Trojan.Win32.Cossta.a W32/Cossta.A!tr Win32/Trojan.235


A longstanding cyberespionage campaign has been targeting mainly Japanese organizations with its own, custom-developed, malware Backdoor.Daserf.


JPCERT/CC has been observing malicious shortcut files that are sent as email attachments to a limited range of organisations since around October 2015.


Devices infected by these malicious programs usually form a kind of advertising botnet via which advertising Trojans distribute each other as well as the advertised apps.


We have named this tool that generates these documents DealersChoice.


As it continues to evolve and develop, Proofpoint researchers have detected it distributing a new remote access Trojan RAT.


This blog dives into the specifics of the ransomware used by the gang, as well as some information regarding their victim naming and shaming website, filled with non-paying victims and stolen data.


Qakbot has been around for years, but it's nothing to be complacent about.


In 2019, Cl0p Ransomware surfaced as a Ransomware-as-a-Service RaaS model and became notorious due to its advanced techniques.


These indicator include the use of the same infrastructure for the attacks, similar Tactics, Techniques and Procedures TTPs, the targeting of demographically similar victims and operating geographically within the Indian Subcontinent


The email message test : the message as written ( left ) and as available in the database ( right ) Third , we documented the trojan retrieving the Google Authenticator 2FA code .


A backdoor also known as: W32.VAsidBackup.Worm Worm.Win32.AutoRun!O Worm.Hupigon Win32.Trojan.WisdomEyes.16070401.9500.9977 Worm.Win32.AutoRun.hht Backdoor.W32.IRCBot.lebE Trojan.Packed.650 Trojan.Sasfis.Win32.3750 Backdoor.Win32.Hupigon Worm/AutoRun.kwf Worm/Win32.AutoRun Win32.Virut.ce.57344 Worm.Win32.AutoRun.hht Worm:Win32/Hupigon.D HEUR/Fakon.mwf TScope.Malware-Cryptor.SB W32/Sohanat.JC Win32/AutoRun.Hupigon.L Win32.Worm.Autorun.Dxcn Worm.AutoRun!oW5oVN0v9nU W32/Packed.2D18!tr Win32/Trojan.ce1


A backdoor also known as: W32.AutorunSubot.Worm HackTool.Hoylecann Win.Trojan.HackTool-55 HackTool:Win32/Hoylecann.B Trojan/Win32.HackTool.C178639 Trj/CI.A


A backdoor also known as: Trojan.Mbro Ransom_Molock.R004C0DAU18 Ransom_Molock.R004C0DAU18 Trojan-Ransom.Win32.Mbro.bbjy Trojan.Win32.Wecod.eoemqo Trojan.Win32.Z.Wecod.2575498 Win32.Trojan.Mbro.Wnwf BackDoor.Bifrost.30406 Trojan.Magania.Win32.70995 PUA.DRMSoft Trojan.Inject.zdn TR/Ransom.Molock.dkaaw Trojan/Win32.Wecod Ransom:Win32/Molock.A!bit Trojan-Ransom.Win32.Mbro.bbjy Trojan/Win32.Mbro.C2386226 TScope.Trojan.Delf Trojan.PWS.Magania!koUXbeUVt9s


A backdoor also known as: Trojan/W32.Maudi.41880 Trojan.Maudi.ahd Trojan/Maudi.ahd Trojan.Win32.Obfuscated.bbgart Celesign.A Trojan.Win32.Maudi.ahi Trojan.Win32.A.Maudi.41880 Trojan.Obfuscated.based.1 TR/Maudi.C Trojan/Maudi.f Trojan:Win32/Tusmed.A Trojan/Win32.Maudi Trojan.Maudi Trojan.Win32.Tusmed W32/Maudi.AHD!tr


A backdoor also known as: Trojan.Barkiofork Trojan/Barkiofork.b Trojan.Zusy.D14CE BKDR_INJECT.SMA Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Barkiofork BKDR_INJECT.SMA BackDoor.WebDor.55 TR/Barkiofork.A.28 Trojan:Win32/Barkiofork.A Trojan/Win32.Dllbot.R92635


These malicious Excel files use a number of different lures, providing evidence of what attackers are using to entice victims into executing them.


Displaying HTML pages We ’ ll now look at the HTML pages that Rotexy displays and the actions performed with them .


A backdoor also known as: Trojan.Razy.D3DB80 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Ursu.exohow BehavesLike.Win32.Backdoor.jm TR/Dropper.MSIL.hfzet Trojan:MSIL/CeeInject.AE!bit Win-Trojan/MSILKrypt02.Exp Trj/GdSda.A Win32.Trojan.Inject.Auto Trojan.MSIL.Injector MSIL/Injector.QGP!tr


Recently , the ThreatLabZ research team came across a fake Netflix app , which turned out to be a new variant of SpyNote RAT ( Remote Access Trojan ) .


A backdoor also known as: W32.Clod8eb.Trojan.3030 Trojan.Downloader.Clisser.B Trojan.Downloader.Clisser.B Downloader.Clisser.Win32.1 Trojan/Downloader.Clisser.b Win32.Trojan.WisdomEyes.151026.9950.9999 W32/Downldr2.BOY Heur.AdvML.C Win32/TrojanDownloader.Clisser.B Trojan-Downloader.Win32.Clisser.b Trojan.Downloader.Clisser.B Trojan.Win32.Clisser.ddmj Trojan.Win32.Downloader.54784.AO[h] Troj.Downloader.W32.Clisser.b!c Trojan.Downloader.Clisser.B TrojWare.Win32.TrojanDownloader.Clisser.B Trojan.Downloader.Clisser.B BehavesLike.Win32.AdwareTopMoxie.qh W32/Downloader.TUUE-5046 TrojanDownloader.Clisser.b TR/Dldr.Clisser.B.1 W32/Clisser.B!tr.dldr Trojan[Downloader]/Win32.Clisser Trojan.Downloader.Clisser.B Trojan/Win32.Clisser.N2115772 TrojanDownloader:Win32/Clisser.B Trojan.Downloader.Clisser.B TrojanDownloader.Clisser Win32.Trojan-downloader.Clisser.Sxeg Trojan.DL.Clisser!glWq8gdbz3E Trojan-Downloader.Win32.Clisser Trojan.Downloader.Clisser.B Downloader.Clisser.A


The Italian language email had a weird attachment: ordine_065.js it would be Order Form in English which appeared quite malicious to me.


The malware may download and execute other binaries.


A backdoor also known as: NetTool.Tor Backdoor.Bot Tool.Tor.Win32.4 Win32.Trojan.WisdomEyes.16070401.9500.9989 Backdoor.Trojan not-a-virus:NetTool.Win32.Tor.f Trojan.Win32.MLW.dbcsxd Trojan.DownLoader8.56801 Sefnit.ag W32/Trojan.OTFO-7506 HackTool[NetTool]/Win32.Tor TrojanDropper:Win32/Sefnit.A not-a-virus:NetTool.Win32.Tor.f TrojanDropper.Sefnit Riskware.NetTool! Win32/Trojan.07c


Never forget to update your system .


A backdoor also known as: Win32.Floxif.A W32.Pioneer.CZ1 Virus.W32.Pioneer!c PE_FLOXIF.E Win32.Virus.Floxif.a W32/Floxif.B W32.Fixflo.B!inf Win32.Floxif.F PE_FLOXIF.E Win32.Floxif.A Virus.Win32.Pioneer.cz Win32.Floxif.A Virus.Win32.Pioneer.bvrqhu Win32.Floxif.A Virus.Win32.Floxif.A Win32.FloodFix.7 Virus.Floxif.Win32.1 W32/Floxif.B Win32/Pioneer.l Virus/Win32.Pioneer.cz TrojanDropper:Win32/Floxif.A Virus.Win32.Pioneer.cz Win32.Floxif.A Virus.Pioneer.4129 W32/Floxif.A Win32.Floxif.A Win32/Floxif.H Virus.Win32.Pionner.tt W32/Pioneer.CZ!tr Virus.Win32.Pioneer.C


On top of all this , one of the malicious developer ’ s YouTube videos – a tutorial on developing an “ Instant Game ” for Facebook – serves as an example of operational security completely ignored .


A backdoor also known as: W32.eHeur.Malware11 Trojan.Inject.Small.C Hacktool.Radinject Trojan.Inject.Small.C Trojan.Inject.Small.C Win32.Trojan.WisdomEyes.16070401.9500.9926 Trojan.Inject.Small.C W32.Cabanas.lmfo Trojan.Inject.Small.C W32/Trojan2.MAPI Trojan/Win32.Inject.R14211 Trojan.Inject.Small.C Trj/CI.A Trojan.Hijacker Win32/Trojan.913


A backdoor also known as: Trojan/W32.Morkus.73728 Trojan.Gambee.BB3 Trojan.Kazy.D13FF6 Trojan.Win32.Morkus.bcz Win32.Trojan.Morkus.Tayq TrojWare.Win32.TrojanClicker.VB.IDP Trojan.DownLoader5.64540 BehavesLike.Win32.Trojan.lt TR/VB.Click.idpmnua Win32.Troj.Undef.kcloud TrojanDownloader:Win32/Gambee.A Trojan.Win32.Morkus.bcz Trojan/Win32.OnlineGameHack.R30007 Win32/TrojanClicker.VB.NYI Trojan-Clicker.Win32.VB W32/VBClicker.NY!tr


After the installation , an application named “ Conference ” appears on the desktop : If the victim launches this app , he will see text which “ enlightens ” the information about the upcoming event : The full text reads follows .


This ransomware is currently being spread by a social engineering exploit kit to trick the user in downloading a malicious executable.


The group's activities show that foreign and domestic espionage and influence on geopolitics are the group's main motives, and not financial gain.


Recently Bedep has been observed as the payload dropped by the Anger EK in a series of malvertising campaigns.


Finally , since publishing the 9002 blog , Unit 42 has also seen the aforementioned 9002 C2 used as a Poison Ivy C2 with a Myanmar political-themed lure .


It has the same functionality as the one described above but contains different text .


A backdoor also known as: Joke.Kokegift JOKE_GESCHENK.A W32/Trojan4.EDF Joke.Geschenk JOKE_GESCHENK.A Win.Joke.CokeGift-2 Riskware.Win32.Geschenk.bdflz Joke.Geschenk BehavesLike.Win32.FakeAlertSecurityTool.cc Trojan-Spy.Win32.Zbot W32/Trojan.OREK-1496 JOKE/CokeGift.1 Joke:Win32/Kokegift.A Joke.Geschenk Win32.Trojan.Geschenk.Wvkp Win32/Trojan.2ff


A recently disclosed data breach suffered by Mexican fast food restaurant Chipotle was carried out by hackers linked to a group known as FIN7 or Carbanak Group, CyberScoop has learned.


A backdoor also known as: W32.IEPassVH.Trojan Tool.NetPass.Win32.6782 not-a-virus:PSWTool.Win32.NetPass.wkh Riskware.Win32.NetPass.sphcx Win32.PSWTool.NetPass.~BAAD Program.PwdFind.5 Packed.PePatch.uw Trojan[PSWTool]/Win32.NetPass Application.Heur.cmKfbOVNU5lO not-a-virus:PSWTool.Win32.NetPass.wkh Riskware.PSWTool! not-a-virus:PSWTool.Win32.NetPass


The domain ‘ addroider [ .


As can be seen , the possibilities offered by the bot are pretty common .


Recently we detected new samples and Infrastructure of ISMAgent, a trojan in use by Iranian Threat Group GreenBug.


Searching its name or one of its aliases Bebloh or Shiotob reveals a good deal of press from that time period along with a few technical analyses in 2009 2012 and 2013


This posting is a follow-up of my previous work on this subject in Pulling Back the Curtains on EncodedCommand PowerShell Attacks


It also includes SSL certificate checking aka SSL pinning, allowing it to evade scenarios in which an SSL man-in-the-middle is present.


ThreatLabZ has been keeping an eye on RIG and in this post we will cover an example of a full RIG infection cycle.


The Check Point research team identified a new mobile malware targeting millions of Android users.


The target is CERT in the military domain.


To illustrate the level of threat the DEFENSOR ID app posed , we performed three tests .


The FakeSpy malware has been found to masquerade as any of the following companies : United States Postal Service - An independent agency of the executive branch of the United States federal government .


We have found evidence that the actors use a combination of legitimate tools and batch scripts to deploy the Disttrack payload to hostnames known to the attackers to exist in the targeted network.


Eventually , the screen PIN preferences will be saved to an additional XML file in the shared preferences folder .


A backdoor also known as: Trojan.Downloader.JSTL TrojanDownloader.Mabjet Trojan.Downloader.JSTL Backdoor.W32.PcClient.lpjJ Trojan/Downloader.FlyStudio.az Trojan.Downloader.JSTL Win.Trojan.Flystudio-2191 Trojan.Downloader.JSTL Trojan.Downloader.JSTL Trojan.Win32.FlyStudio.cxpswl Trojan.Downloader.JSTL Adware.Downware.4022 Downloader.FlyStudio.Win32.2885 Trojan-Downloader.Flystudio TR/Dldr.FlyStudio.AZ Win32.Trojan.Fakeapp.Dvfy Win32/Trojan.51f


A backdoor also known as: Trojan.Emotet.CD Trojan/W32.Dovs.159744.B Win32.Malware!Drop Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.KZPI-4363 Trojan.Emotet TSPY_EMOTET.THAOIAL Win.Trojan.Emotet-6421984-0 Trojan.Win32.Dovs.frh Trojan.Emotet.CD Trojan.Win32.Dovs.exinig Win32.Trojan.Dovs.Wwnx Trojan.Emotet.CD Trojan.Emotet.CD TSPY_EMOTET.THAOIAL BehavesLike.Win32.Upatre.ch Trojan.Dovs.bke TR/Crypt.ZPACK.blsak W32/Kryptik.GBTT!tr Trojan.Emotet.CD Trojan.Win32.Z.Emotet.159744.B Trojan.Win32.Dovs.frh Trojan/Win32.Dovs.C2353482 Trojan.Emotet.CD Win32.Malware!Drop Trojan.Emotet Win32/Emotet.AZ Trojan-Banker.Emotet PE.Heur.InvalidSig Win32.Trojan-Spy.Emotet.KA Trj/RnkBend.A


While we monitor phishing campaigns used to distribute threats such as Dridex, Upatre, and Cryptowall, targeted phishing attacks are more convincing because the format of the message is personalized to the targeted user.


A backdoor also known as: HW32.Packed.AB1B MemScan:Trojan.Spy.Togfer.S Trojan-Dropper/W32.Small.45568.F TrojanDropper.Small Dropper.Small.Win32.1780 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Wingua.B Backdoor.Trojan MemScan:Trojan.Spy.Togfer.S Trojan-Dropper.Win32.Small.ep MemScan:Trojan.Spy.Togfer.S Trojan.Win32.Small.unzq Trojan.Win32.Z.Small.45568.Z Troj.Dropper.W32.Small.ep!c MemScan:Trojan.Spy.Togfer.S TrojWare.Win32.TrojanDropper.Small.EP MemScan:Trojan.Spy.Togfer.S Trojan.MulDrop.752 TROJ_SMALL.EP BehavesLike.Win32.Sdbot.pc Trojan/Dropper.Small.ep Worm.Win32.Randex.a W32/Wingua.TBPD-6936 Packed.Morphine.a DR/Small.EP.1 Trojan[Dropper]/Win32.Small Trojan.Spy.Togfer.S Trojan-Dropper.Win32.Small.ep MemScan:Trojan.Spy.Togfer.S TrojanSpy.Tofger Trj/Small.A Win32/TrojanDropper.Small.EP Win32.Trojan-dropper.Small.Amvx Trojan.DR.Small!QLjE4qGURJY W32/Small.EP!tr


At the time of writing , to our knowledge no other third-party app stores , nor the official Google Play store , were or are hosting this malicious HenBox variant masquerading as DroidVPN .


A backdoor also known as: Trojan.Delf.Win32.49957 Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Adclicker Trojan-Spy.Win32.Delf.tr TrojWare.Win32.PSW.QQPass.~HYJ Trojan.DownLoader.origin BehavesLike.Win32.Dropper.lc Trojan-Dropper.Delf Trojan[Spy]/Win32.Delf Trojan-Spy.Win32.Delf.tr Trojan/Win32.OnlineGameHack.R233 Trojan.PWS.Ceekat!HLFjv+sb6fY


Researchers with Tencent Security recently disclosed details about Swearing Trojan, a mobile banking malware that attacked users in China.


A backdoor also known as: Backdoor.Dolan.fam Backdoor/W32.Dolan.20480.D Backdoor.Dolan.fam Backdoor.Aoldoor Dolan.AA BKDR_AOLDOOR.A Backdoor.Win32.Dolan Backdoor.Dolan.G Backdoor.Win32.A.Dolan.20480[h] PE:Backdoor.Dolan.b!1173745952 Backdoor.Dolan.fam Backdoor.Win32.Dolan Backdoor.Dolan.fam BackDoor.Dolan Backdoor.Dolan.Win32.52 BKDR_AOLDOOR.A W32/Risk.PEXC-1723 BDS/Dolan.A.27 Trojan[Backdoor]/Win32.Dolan Backdoor.Dolan.fam Win-Trojan/Dolan.20480.D Backdoor.Dolan.fam Trojan.VBRA.01573 Backdoor.Win32.Dolan W32/Bdoor.ARY!tr.bdr BackDoor.Dolan.S Backdoor.Win32.Dolan.Alrb


A backdoor also known as: Trojan.PWS.AlLight.1.0.A Trojan-PWS/W32.AlLight.140800 PWS-LamLite.cfg Trojan.AlLight.Win32.34 Trojan/PSW.AlLight.10.a TROJ_LAMLITE.A TROJ_LAMLITE.A Trojan.PWS.AlLight.1.0.A Trojan-PSW.Win32.AlLight.10.a Trojan.PWS.AlLight.1.0.A Trojan.Win32.AlLight.dbgt Trojan.Win32.PSWAlLight.140800 Troj.PSW32.W.AlLight.10.a!c Trojan.PWS.AlLight.1.0.A TrojWare.Win32.PSW.AlLight.A Trojan.PWS.AlLight.1.0.A BackDoor.AntiLame.10 BehavesLike.Win32.Dropper.cc W32/Risk.CXII-8326 Backdoor/Antilam.10 W32.Trojan.Phisher-LamLite TR/PSW.AlLight.10.A Trojan[PSW]/Win32.AlLight Trojan.PWS.AlLight.1.0.A Trojan-PSW.Win32.AlLight.10.a PWS:Win32/LammerLight.B Backdoor.RAT.AntiLamer TrojanPSW.AlLight Win32/PSW.AlLight.10.A Win32.Trojan-qqpass.Qqrob.Pjxn Trojan.PWS.AlLight!3dq9kq5oal8 Backdoor.Win32.Antilam W32/EQSteal.A!tr


A backdoor also known as: Trojan.FlyStudio.Win32.14198 Trojan/FlyStudio.onh Win32/Oflwr.A!crypt Win32.Trojan.FlyStudio.F Riskware.Win32.ProcPatcher.djqzww Trojan.Win32.Z.Zusy.1400832.C Trojan.NtRootKit.18405 W32/Trojan.VHRL-9383 Variant.Zusy.hm RiskWare[RiskTool]/Win32.ProcPatcher.a Trojan.Zusy.D1CA4C TrojanDownloader:Win32/Nefhop.A Trj/CI.A Riskware.ProcPatcher! Win32/Trojan.Spy.6da


The Dyre financial Trojan has emerged over the past year to become one of the most potent financial fraud tools in operation.


For all registered domains we could identify NameCheap, Inc. as the registrar based in the United States.


The timestamp seems valid and close to the documented infection timeline.


A backdoor also known as: TR/Dropper.MSIL.fdxny PWS:MSIL/Stimilina.R!bit Trojan/Win32.Bladabindi.R203992 Spyware.PasswordStealer Trojan.MSIL.Spy


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9986 BackDoor.Msft.1 BehavesLike.Win32.SoftPulse.dc Virus.Win32.Virut Trojan.Zusy.D2EADF Worm:Win32/Chir.D@mm


Keep Google Play Protect on .


A backdoor also known as: Trojan-PSW.Win32.Dybalom!O Trojan/Downloader.Small.almj W32/Downldr2.GCMU Win32/SillyPWS.T Win.Downloader.74007-1 Trojan-PSW.Win32.Dybalom.g Trojan.Win32.Small.vtda Trojan.Win32.Downloader.20992.MH TrojWare.Win32.TrojanDownloader.Small.~ZBL Trojan.DownLoad.41539 Downloader.Small.Win32.13741 W32/Downloader.UMUW-8666 TR/Dldr.Small.almk Trojan[PSW]/Win32.Dybalom Trojan-PSW.Win32.Dybalom.g PWS:Win32/Strpasseal.B Trojan/Win32.Downloader.R17920 TrojanPSW.Dybalom Win32.Trojan-qqpass.Qqrob.Pcsc Trojan.PWS.Strpasseal.P Trojan-Downloader.Win32.Small W32/Dybalom.SMA!tr Win32/Trojan.PSW.99c


A backdoor also known as: HW32.Packed.9AE7 Trojan.Regrun TROJ_DDOS.SMA Win.Trojan.VBDos-1 Trojan.Win32.Regrun.zft Trojan.Win32.Regrun.ewhpgb Trojan.DownLoader5.32190 TROJ_DDOS.SMA BehavesLike.Win32.Adware.dc Trojan.Regrun.aj Trojan/Win32.Regrun Trojan:Win32/Tocofob.A Trojan.Win32.Regrun.zft Trojan/Win32.Buzus.C23616 SScope.Trojan.VBRA.11870 Trojan.Heur.VP2.E3BBE8 Trojan.Win32.VB


As such, FastPOS's update does not come as a surprise—in time for the oncoming retail season to boot.


Triada steals the money either from the users — if they haven ’ t succeeded in purchasing whatever they wanted , or from the app developers , in case the user has completed the purchase successfully .


From what I can tell its still under development, this article will tell the story of this ransomware.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Bloodhound.Morphine BehavesLike.Win32.RAHack.qc Trojan.Win32.Hrup Packed.Morphine.a Backdoor:Win32/Wurdux.A.dll Trj/CI.A Packed/Morphine.B


The Postal Group is active since at least 2013 and was responsible for multiple different malware


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9995 W32/Trojan.OTQR-6881 Backdoor.Win32.Elirks.o Trojan.Win32.Elirks.evicnk Trojan.Win32.Z.Zbot.5650944 Trojan.DownLoader25.56963 Backdoor.Elirks.Win32.6 Trojan.Zbot.7 Backdoor.Win32.Elirks.o Trojan:Win32/Ralminey.A Backdoor.Elirks Win32/Trojan.BO.56e


This blogpost reveals many details about the Diskcoder.C aka ExPetr, PetrWrap, Petya, or NotPetya outbreak and related information about previously unpublished attacks.


The group has access to zero-day exploits, most likely obtained through the Elderwood framework, and uses custom-developed back door malware.


The group behind this operation has been launching targeted and possibly politically-motivated attacks to spy on individuals.


In October 2016 Forcepoint Security Labs™ discovered new versions of the MM Core backdoor being used in targeted attacks.


These samples all displayed their typical respective malware characteristics and contacted known command and control C2 servers from those families.


Back in July 2015, a new ransomware as a service named Encryptor RaaS detected by Trend Micro as RANSOM_CRYPRAAS.SM entered the threat scene, rivaling or at least expecting to succeed the likes of similar get-rich-quick schemes from Tox and ORX Locker.


A backdoor also known as: Banker/W32.Bancos.688128 Trojan.Bancos W32/Trojan.VUPB-6515 Trojan-Banker.Win32.Bancos.vdfd W32.Virut.mACM Win32.HLLW.Autoruner2.26648 Dropper.Daws.Win32.12598 Trojan.Banker.Bancos.sn Trojan[Dropper]/Win32.Daws Trojan-Banker.Win32.Bancos.vdfd Trj/CI.A Trojan.Daws Win32.Worm.Autorun.Pepg Trojan.DR.Daws!WW+h/Y0MkUk Worm.Win32.WBNA Win32/Trojan.355


A backdoor also known as: Webtoolbar.Dealply Trojan.FakeAV not-a-virus:HEUR:WebToolbar.Win32.DealPly.heur Riskware.Win32.Estapa.ewzewu Trojan.Win32.Z.Dealply.1110121 Trojan.MulDrop7.57701 BehavesLike.Win32.BadFile.tc ADWARE/DealPly.rlhsh Ransom:MSIL/Hasadcrypt.A not-a-virus:HEUR:WebToolbar.Win32.Estapa.heur Trojan/Win32.Fakeav.C939114 BScope.Trojan.DiskWriter Trj/GdSda.A Trojan-Downloader.Win32.IstBar


A backdoor also known as: Worm.Win32.AutoRun!O Worm.Wofopey.A4 Trojan.Bodegun.1 TSPY_AUTORUN_CD1027DD.RDXN Win32.Worm.AutoRun.ek W32/Worm.BLGL W32.SillyDC TSPY_AUTORUN_CD1027DD.RDXN Win.Trojan.Clicker-4047 Trojan.Win32.Fsysna.dilg Trojan.Win32.AutoRun.buecr Worm.Win32.A.AutoRun.329559 W32.W.AutoRun.lnZm Win32.HLLW.Autoruner.57463 BehavesLike.Win32.Virut.cz W32/Worm.PEBZ-4739 Worm/Win32.AutoRun Worm:Win32/Wofopey.A Trojan.Win32.Fsysna.dilg Worm/Win32.AutoRun.R1864 Trojan-Dropper.Serv.21221 W32/Autorun.KBE Win32/AutoRun.AEZ Win32.Trojan.Fsysna.Wqmj Worm.AutoRun!UZZkfeUh6N8 Win32/Trojan.c29


Its authors claim that it was used for private operations for two years preceding the start of the rental .


The document contains a malicious macro, which attempts to download the same executable file 65g3f4.exe from multiple remote locations.


] com w3.changeip [ .


The group has quietly deployed zero-day in the past, effectively spearphished targets, and maintains a modular toolset.


A backdoor also known as: Backdoor.Sdbot.AE4 RDN/Sdbot.worm!cc Backdoor.SDBot Win32.Trojan.WisdomEyes.16070401.9500.9979 RDN/Sdbot.worm!cc Trojan[Backdoor]/Win32.Sdbot Trojan.Zusy.D1B318 Backdoor:MSIL/Getob.D Backdoor.SDBot Msil.Worm.Arcdoor.Pgda Worm.MSIL.Arcdoor W32/SDBot.DPZ!tr


A backdoor also known as: Win32.Malware.Bucaspys.A W32.Malware.Bucaspys!c Trojan.PWS.Banker1.23491 BehavesLike.Win32.BadFile.rh W32/Trojan.MCYT-4284 Trojan:Win32/Bypass.D!bit Trj/GdSda.A W32/Banker.ADYA!tr.spy


A backdoor also known as: Exploit.Win32.Nuker!O W32/Trojan.Divine Win.Trojan.Nuker-3 Exploit.Win32.Nuker.Divine Exploit.Win32.Nuker.htqe Trojan.Divine Exploit.Nuker.Win32.284 W32/Trojan.Divine TR/Nuker.Divine Trojan[Exploit]/Win32.Nuker Exploit.Win32.Nuker.Divine Exploit.Nuker Nuker.Win32.Divine W32/Divine.3AD2!tr


PassiveTotal New discovered infrastructure from the Satellite Turla actor.


A backdoor also known as: Trojan.VBCrypt.MF.66 Trojan.Razy.D15523 Win32.Trojan.VB.iw W32/VBTrojan.Downloader.1D!Maxi Troj.Dropper.W32.Dinwod.mmkC TrojWare.Win32.Rimod.JO Trojan.MulDrop4.62548 Trojan.Win32.Scar W32/VBTrojan.Downloader.1D!Maxi Trojan:Win32/Bewter.A HEUR/Fakon.mwf Win32/VB.RBU Win32/Trojan.741


A backdoor also known as: Spyware.Zbot.ED WS.Reputation.1 Krypt.GB TROJ_SIGEKAF.SM Trojan:W32/Kamala.A Trojan:Win32/Hilasy.B BScope.TrojanPSW.Zbot.2716 Trojan.Win32.Hilasy W32/ZBOT.HL!tr Trj/CI.A


This iteration is targeted towards victims in Vietnam and still maintains extremely low AV detection almost a year after it was first discovered.


A backdoor also known as: W32.Sality.PE Win32.Sality.3 Virus/W32.Sality.D Worm.Win32.AutoIt!O W32.Sality.U W32/Autorun.worm.bcb Win32.Sality.3 PE_SALITY.RL W32/Autorun.TX W32.Harakit Win32/Sality.AA PE_SALITY.RL Win.Trojan.Autoit-150 Worm.Win32.AutoIt.aei Win32.Sality.3 Virus.Win32.Sality.beygb Trojan.Win32.FakeFolder.avr Win32.Sality.3 Win32.Sector.30 Virus.Sality.Win32.25 BehavesLike.Win32.Evasion.jc W32/Autorun.OHSM-3021 Win32/HLLP.Kuku.poly2 W32/Sality.AT Worm:Win32/Katar.A W32.Virut.lns0 Worm.Win32.AutoIt.aei Win32.Virus.Sality.A HEUR/Fakon.mwf Win32.Sality.3 Virus.Win32.Sality.bakc Win32/Sality.NBA Win32.Sality.BL Worm.Win32.Passma W32/Sality.AA Virus.Win32.Sality.I


We assess it is highly likely that these attacks were conducted by a Chinese cyberespionage actor related to the Operation Soft Cell campaign.


A backdoor also known as: Riskware.Win32.MyBeeSearch.euqqpm Adware.Mybeesearch.17920 Adware.MyBeeSearch.Win32.35 W32/Trojan.ZETF-8401 ADWARE/MyBeeSearch.yttss Adware.BeeSearch/Variant Trj/GdSda.A Msil.Adware.Mybeesearch.Ednu PUA.MyBeeSearch! AdWare.MSIL.Mybeesearch


Exploitation is being attempted via the usual tactic of spear phishing containing malicious attachments to targets.


It spreads within networks through PsExec and WMIC commands, using credentials stolen by a tool similiar to Mimikatz.


The installer files contained custom action commands which used PowerShell to download and execute payloads Redline Stealer, Ursnif, etc. hosted on legitimate websites.


A backdoor also known as: Trojan.Win32.Dropper.Zyon.1 Trojan.Win32.Dropper.Zyon.1 TROJ_ZYON.A TROJ_ZYON.A Trojan-Dropper.Win32.Zyon Trojan.Win32.Dropper.Zyon.1 Trojan.Win32.Zyon.hmat Troj.Dropper.W32.Zyon!c Trojan.Win32.Dropper.Zyon.1 TrojWare.Win32.Runner.Zyon Trojan.Win32.Dropper.Zyon.1 Trojan.MulDrop.103 Dropper.Zyon.Win32.4 BehavesLike.Win32.Dropper.dc W32/Trojan.AJWD-0098 TrojanDropper.Win32.Zyon W32/Zyon.A!tr Trojan[Dropper]/Win32.Zyon Trojan.Win32.Dropper.Zyon.1 Constructor/Zyon.261120 MultiDropper.cfg Win32/Runner.Zyon Win32.Trojan-dropper.Zyon.Lhdl Trojan.DR.Zyon!KwrmMz3+t6M Trojan.Win32.Runner Trojan.Win32.Dropper.Zyon.1 Dropper.Zyon.C Win32/Trojan.769


A backdoor also known as: Exp.SWF.DC Exp.Flash.Pubenush.E!c Trojan.Swifi SWF/Exploit.ExKit.A Swf.Exploit.Angler-6 Exploit.Swf.CVE20130634.efwsmo Exploit.SWF.1232 HEUR_SWFDEC.SC2 BehavesLike.Flash.Exploit.nb Trojan[Exploit]/SWF.Neclu Exploit.SWF Win32/Trojan.a4a


It is an email with the subject of Copy of Invoice 79898702coming or pretending to come from noreply@random email addresses with a semi-random named zip attachment in the format of 79898702.zip random 8 digits The zip matches the subject.


Overall , Cerberus has a pretty common feature list and although the malware seems to have been written from scratch there does not seem to be any innovative functionality at this time .


The .js file in the email attachment is a PowerShell script and there are no other files involved.


Malware, or CHM, disguised as a North Korea-related questionnaire is being distributed by the Kimsuky group, which is believed to have created and distributed the same type of malware.


A TrickMo Kill Switch One of the most interesting features of the TrickMo malware is having its own kill switch .


The authors were probably trying to make a joke by referencing the act of getting infected with ransomware, hinting that it is uninvited and unavoidable, just like fate.


A backdoor also known as: Backdoor.Win32.Poison!IK W32/Smallworm.EEA BKDR_POISON.OM W32.SillyFDC Backdoor.Win32.Poison Dropper.VB.3.AX


A backdoor also known as: Trojan.Sisproc.A Trojan.Sisproc Adware.Antivirus2008.Win32.13 Trojan/Jorik.Vobfus.fodz Win32.Trojan.Kryptik.gz Trojan.Malcol Win32/Tnega.cTBOJZC TROJ_REDONC_EK030008.UVPM Trojan.Win32.Antivirus2008.babyvq Trojan.DownLoader6.50299 TROJ_REDONC_EK030008.UVPM BehavesLike.Win32.Downloader.qc Trojan/Jorik.esyb Trojan/Win32.Vobfus TrojanDownloader:Win32/Redonc.D Trojan.Heur.D.E8DF45 Adware.Antivirus2008!VhbgDcClaWU


Then , it sends it to the C2 server using the URL that ends with /servlet/ContactUpload .


A backdoor also known as: Trojan/W64.Crypt.785568 Trojan.YarripCS.S244731 Trojan/Kryptik.bbq TROJ_KRYPTIK_FF070297.UVPM Win32.Trojan.WisdomEyes.16070401.9500.9998 TROJ_KRYPTIK_FF070297.UVPM Trojan.Win64.Crypt.gp Trojan.Win64.Kryptik.euskem Trojan.Win32.Z.Crypt.785568 Troj.Win64.Crypt!c Trojan.Crypt.Win64.20 Trojan.Crypt.ld Trojan.Win64.Crypt.gp Trojan.Bedep Trj/CI.A Win64.Trojan.Crypt.Wnms Trojan.Crypt!D766Elbq30w Trojan.Win64.Bedep


An Android backdoor also known as: Trojan.MAC.Dok.E MacOS/Aptordoc.A HEUR:Trojan-Spy.OSX.Aptordoc.b Trojan.MAC.Dok.E Trojan.Mac.Mlw.eowttl Troj.Spy.Osx!c Win32.Trojan-spy.Aptordoc.Syhr Trojan.MAC.Dok.E Mac.BackDoor.Dok.5 Trojan.Aptordoc.OSX.7 MacOS/Aptordoc.A OSX/Spy.Aptordoc.jlgtm HEUR:Trojan-Spy.OSX.Aptordoc.b Trojan.MAC.Dok.E OSX/Spy.Dok.A Trojan-Banker.OSX.Aptordoc


Talos has discovered an unknown Remote Administration Tool that we believe has been in use for over 3 years.


In this respect, Vawtrak now has a 2-tier C2 discovery infrastructure.


A backdoor also known as: Trojanproxy.Hioles.19337 Trojan.Graftor.D4C0E TSPY_PROXY_BK082A47.TOMC Win32.Trojan.WisdomEyes.16070401.9500.9968 TSPY_PROXY_BK082A47.TOMC Trojan.Proxy.23012 TrojanProxy:Win32/Hioles.B Troj.W32.Scar.lrnw Win32/TrojanProxy.Hioles.AA


However , there is also an English version of the DEFENSOR ID app ( see Figure 3 ) besides the Portuguese one , and that app has neither geographical nor language restrictions .


In the beginning of April 2016, we found evidence that the attacks against Israel have been renewed as well.


The Turla group use a range of tools and techniques, many of which are custom.


A backdoor also known as: Trojan.Kazy.D64E1 Win32.Trojan.WisdomEyes.16070401.9500.9929 Adware.Iefeats Trojan.Win32.Yabector.ddsrdc Adware.Yabector/Variant Heur.Packed.Unknown Adware.Adon Trj/CI.A Win32.Trojan.Kazy.Alij Trojan.CL.Yabector!M4hXuPydivM Win32/Trojan.e93


A backdoor also known as: Trojan.Sicil.AA3 Win32.Trojan.WisdomEyes.151026.9950.9999 W32/Sicil.A TROJ_SICIL_0000009.TOMA Trojan-Dropper.MSIL.Smaba.sg Trojan.Win32.Click1.ctoram BehavesLike.Win32.Dropper.zt W32/Sicil.YGNC-5779 W32/Malware_fam.NB Trojan.Buzy.D8E9 Trojan:MSIL/Sicil.A Trojan.Msil PSW.ILUSpy Trj/CI.A Win32/Trojan.132


A backdoor also known as: Trojan.Win32.Z.Shellcode.403968 Troj.W32.Tpyn!c BehavesLike.Win32.PWSZbot.fh Backdoor.Win32.Kbotrep W32/Trojan.FHRX-8606 Trojan.Heur.LP.E7F983 Backdoor:Win32/Kbotrep.A Trj/CI.A Win32.Trojan.Hijacker.Hzj Win32/Trojan.e04


A backdoor also known as: W32.HfsAdware.B36E Application.Bundler.DomaIQ.Q PUP.Optional.BundleInstaller Adware.DomaIQ.Win32.132 Adware.DomaIQ/Variant Application.Bundler.DomaIQ.Q Win32.Adware.DomnIQ.b Infostealer.Limitail Win32/DomainIQ.eOTUWS Win.Adware.Domaiq-1 not-a-virus:AdWare.MSIL.DomaIQ.clek Application.Bundler.DomaIQ.Q Trojan.Win32.DomaIQ.ctadmg Adware.Win32.Lollipop.f Application.Bundler.DomaIQ.Q Application.Win32.DomaIQ.URT Trojan.DownLoader9.21779 AdWare/MSIL.ps Pua.Tuguu GrayWare[AdWare]/MSIL.DomaIQ TrojanDownloader:Win32/Tugspay.A not-a-virus:AdWare.MSIL.DomaIQ.clek Win32.Application.DomalQ.G PUP/Win32.DomaIQ.R99208 BScope.Downware.DomaIQ PUA.DomaIQ! Trj/CI.A


In the analysis that follows , we describe in detail the capabilities of this new variant and a “ kill switch ” that can remotely eliminate the malware from a mobile device .


Between December 2021 and July 2022, the Mandiant Managed Defense and Incident Response teams responded to three UNC961 intrusions at different organizations that each started in similar fashion.


Thanks to this data leak , we were able to confirm that the malware really worked as designed : the attacker had access to the victims ’ entered credentials , displayed or written emails and messages , etc .


When the user tries to open one of these legitimate apps, the malware replaces the genuine app window with a phishing window that asks for banking information.


A backdoor also known as: W32.TikoraxaDSB.Trojan Trojandownloader.Script W32/Snojan.OHXS-3777 VBS/TrojanDownloader.Small.NGH Trojan.Win32.Mlw.evnleg Troj.Downloader.Script!c BehavesLike.Win32.Downloader.dh Trojan-Downloader.VBS.Small W32/Snojan.Q Trojan.Pincav.aer VBS/Dldr.Small.vxbdh Trojan.DL.Alien! Trojan.Snojan Trj/CI.A Script/Virus.72d


A backdoor also known as: W32.DownLoadRiniLTN.Trojan Trojan.Win32.Scar!O Trojan.Popureb.B4 Trojan/Scar.ejkj Trojan.Zusy.D2E760 TROJ_POPUREB.SM Win32.Trojan.Scar.i Win32/Scar.ZF TROJ_POPUREB.SM Win.Trojan.Scar-8452 Trojan.Win32.Scar.bccuvv Trojan.Win32.A.Scar.86016.F Backdoor.Win32.Popwin.~IT Trojan.DownLoader11.5691 Trojan.Scar.Win32.75436 BehavesLike.Win32.Dropper.mm Backdoor.Win32.Poison TR/Popureb.B.20 Trojan/Win32.Scar Win32.Troj.Poison.b.29696 Trojan:Win32/Popureb.B Trojan/Win32.PbBot.R3997 Trojan.Scar Trojan.Scar Trojan.Win32.Scar.tgh Trojan.Ghodow!qzMoVFGUIfc W32/Scar.ENA!tr Win32/Trojan.285


In the past, we investigated TorLocker and its flawed encryption, which was created and negotiated worldwide by a Brazilian cybercriminal.


The Trojan itself is well known and contained x32 and x64 rootkits.


The multiple downloads is probably a redundancy measure in case some sources are taken down.


In this case it capitalized on the recent terrorist attack in New York City.


A backdoor also known as: BackDoor-CYK.srv Backdoor/VB.alk Backdoor.VB!XZJVRUVgqYg W32/Backdoor.LPS TROJ_MALKZR.A Backdoor.Win32.VB.alk Backdoor.Win32.VB.37168 Backdoor.Win32.VB!IK Backdoor.Win32.Delf.~EC TROJ_MALKZR.A Heuristic.BehavesLike.Win32.Downloader.D Backdoor/VB.rj Backdoor:Win32/Norachs.A W32/Backdoor.LPS Win-Trojan/Xema.variant Trojan.Win32.VB.ALK Win32/VB.ALK Backdoor.Win32.VB W32/VB.ALK!tr BackDoor.VB.FLP


Our analysis reveals connections between these attacks, recent strategic web compromises against Burmese government websites, and previous campaigns targeting groups in the Tibetan community.


In past revivals, the botnet has been distributed through malicious emails containing attachments or links to compromised websites hosting exploit kit content.


This was probably done for debugging purposes , indicating the malware may be an early prototype version .


A backdoor also known as: PWS-Xema.dr PWS-Xema.dr Trojan.Win32.Malware.4 W32/Smalltroj.IUNZ Win32.TRCrypt.XPACK Trojan.Win32.Pincav.cay Trojan.MulDrop.29150 Trojan:Win32/Cinject.B Win-Trojan/Ristix.8192 Trojan.Win32.Pincav.cay Packer.Win32.UnkPacker.a Trj/Downloader.MDW


However, after reverse analysis, we found that it to be part of a brand new family, which we called Alice.


A backdoor also known as: W32.OnGameZLEU.Worm Trojan.Reval.28280 TROJ_SPNR.05AD13 TROJ_SPNR.05AD13 Worm.MSIL.Autorun Trojan/MSIL.hcf TR/BAS.Samca.22510458 Trojan/MSIL.Hor Trojan:MSIL/Reval.A Trojan.Zusy.D53EB


These analysts were linked by their coverage of the telecommunications industry, making this targeting very similar to, and likely a continuation of, activity described in our In Pursuit of Optical Fibers and Troop Intel blog.


Perhaps the most interesting aspect of the Snake Wine group is the number of techniques used to obscure attribution.


A backdoor also known as: Trojan.Dumpy.A6 Trojan.Zusy.DFB8F W32.Dompie WORM_DUMPY.SM23 Trojan.Win32.Hesv.apqe Trojan.Win32.AVKill.dqemmh Troj.W32.Scar.tnl2 TrojWare.Win32.Injector.XYNZ Trojan.AVKill.33151 WORM_DUMPY.SM23 WORM/Taranis.2225 Trojan.Win32.Hesv.apqe HEUR/Fakon.mwf Trojan.Scar Worm.AutoRun Worm.Win32.Dumpy


SEND_SMS - Allows the application to send SMS messages .


It mainly targets Chinese users, but has also successfully affected people and organizations in the United States, United Kingdom, Thailand, Spain, and Ireland.


A backdoor also known as: Trojan.Win32.Swisyn!O VirTool.VBInject.DZ Trojan.Swisyn.Win32.11562 Troj.W32.Swisyn.lsGr Win32.Worm.IRCBot.ad W32/MalwareS.BHPN Win32/Swisyn.DJ TROJ_SWISYN.SMK Trojan.Win32.Swisyn.ahwe Trojan.Win32.Swisyn.btyha Trojan.Win32.A.Swisyn.327680 Trojan.VbCrypt.68 TROJ_SWISYN.SMK BehavesLike.Win32.VBObfus.fm Trojan.Win32.Swisyn Trojan/Swisyn.lxc Trojan.Symmi.D2474 Trojan.Win32.Swisyn.ahwe Trojan/Win32.Swisyn.R2925 Trojan.VBRA.03646 W32/Swisyn.F.worm Win32/AutoRun.IRCBot.FL Virus.Win32.Virut.ue Win32/RootKit.Rootkit.7e5


In our 9002 blog we noted some additional infrastructure used either as C2s for related Poison Ivy samples , or domain registrant overlap with those C2 domains .


) You should also avoid the temptation to play games from sources other than legitimate app stores ; such games are not safe and may bring harm to your reputation and your bank account .


The malware has functionality to steal user credentials, provide shell access, and persist through firmware upgrades.


A backdoor also known as: Zum.Razy.1 Win32.Trojan.WisdomEyes.16070401.9500.9999 Zum.Razy.1 Zum.Razy.1 BehavesLike.Win32.Trojan.dh Zum.Razy.1


According to our telemetry , that was the year the distribution campaign was at its most active .


A backdoor also known as: Worm.NSIS.NeksMiner.A WORM_CO.331300D2 Win32.Trojan.WisdomEyes.16070401.9500.9766 W32/Adware.DEZV-3749 Trojan.Coinbitminer WORM_CO.331300D2 Win.Trojan.Virtob-1633 Worm.NSIS.BitMin.d Trojan.Win32.BitCoinMiner.ddjqfi Trojan.BtcMine.1665 BehavesLike.Win32.TrojanCoinMiner.vc Trojan-PSW.Win32.Tepfer W32/Adware.ALRW RiskTool.BitCoinMiner.bf Trojan[PSW]/Win32.Tepfer Worm:Win32/NeksMiner.A Trojan.Strictor.D1B5F4 Worm.NSIS.BitMin.d Trojan/Win32.BitCoinMiner.C931392 TScope.Malware-Cryptor.SB RiskWare.BitCoinMiner NSIS/CoinMiner.T Trj/CI.A


In addition to official banking applications , the target list includes 111 other global financial applications for banking and credit card management , money transfers , and cryptocurrency wallets and exchanges .


Recently observed initial threat activities targeting the telecommunication sector.


We decided to check the original plugin package and, to our surprise, found the file in the source! We also discovered that we were not the only ones that found this file although people on the forum seemed to believe that the file was just vulnerable .


It is interesting to see that the group has expanded their operation to other regions , such as the United States and Europe .


This way, the HTA effectively serves as a wrapper to try and slip passed traditional file type-based scanning in the network as well as anti-spam services.


In addition to the look and feel of DroidVPN , this HenBox variant also contained a legitimate DroidVPN app within its APK package as an asset , which could be compared to a resource item within a Windows Portable Executable ( PE ) file .


ESET researchers discovered a campaign that we attribute with high confidence to the APT group Tick.


A backdoor also known as: Trojan.Win32.Small.eivvce Trojan.Inject2.21676 BehavesLike.Win64.BadFile.wc PUA.Zzinfor TrojanDropper.Dinwod.aml Dropper/Win32.Dinwod.C1833968 Trojan.Mikey.D1229E Rootkit.Small!LMZdSa8k9cE Win32/Trojan.45a


The injected DLL then downloads the fileless Gootkit and saves it in the registry as binary data, then loading it in memory only.


This article mainly analyzes the controlling end, the generator and Windows and Linux variants in controlled end of this tool and makes a display of the homologous analysis and network infection of these samples.


A backdoor also known as: Trojan.Zlob Adware.NetAdware.BD


If brother.apk application is removed , mcpef.apk reinstalls brother.apk from assets .


A backdoor also known as: W32.FakeSvchostXKRB.Trojan Trojan-Downloader.Win32.Geral!O Downloader.Dogrobot.20415 Win32/SillyDl.QAC Trojan-Dropper.Win32.Injector.paib Trojan.Win32.Vilsel.iini Troj.Downloader.W32.Geral.kYTA Trojan.Win32.Downloader.wzh BackDoor.Guan.14 Downloader.Geral.Win32.1376 BehavesLike.Win32.StartPage.lm W32.Malware.Downloader Trojan[Dropper]/Win32.Injector Trojan.Win32.Downloader.16384.BHH Trojan-Dropper.Win32.Injector.paib TrojanDownloader:Win32/Dogrobot.D Trojan.Win32.Qhost


A backdoor also known as: Trojan.Win32.Dialer!O Trojan.Zenshirsh.SL7 Trojan.Dialer Win32.Trojan.WisdomEyes.16070401.9500.9746 Win32/Startpage.RT TROJ_CJ.A Win.Trojan.Dialer-61 Trojan.Win32.Dialer.cj Trojan.Win32.MLW.wvye Troj.W32.Diamin.l3NB TrojWare.Win32.Dialer.A Dialer.Virgilio TROJ_CJ.A Trojan/Dialer.cio Trojan/Win32.Dialer Trojan.Win32.Dialer.cj Trojan/Win32.Dialer.R2306 MalwareScope.Dialer.Small.1 Dialer.LBU Win32.Trojan.Dialer.Pgxd Trojan.Win32.Dialer.cj


Thanks to Bulwarkz for additional Forensic Analysis: - Clears the windows event log - Clears the journal log - Drops executables to the windows directory and starts them - Shows the ability to spread by using its contained functionality to enumerate network shares of other attached devices - Uses shutdown.exe to shutdown or reboot the system - Contains functionality to register a low level keyboard hook - Contains functionality to infect the boot sector.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9894 Trojan.Win32.CsDown.bdcfvq Trojan.CsDown.25 TrojanDropper:Win32/Waltrodock.B Trojan.Graftor.D4ACD Trojan.CsNowDown!qDe+BhsdQ1Y W32/WDockDrp.A!tr Trj/CI.A Win32/Trojan.8ea


The decoy documents and filenames used in the attacks suggest the intended targets include organisations with political interests or influence in Israel and Palestine.


A lot of additional anti-sandbox checks are performed in this exact order : Check that the malware is not executed under the root folder of a drive Check that the malware file is readable from an external source Check that the hash of base path is not 3D6D62AF1A7C8053DBC8E110A530C679 Check that the full malware path contains only human readable characters ( “ a-z ” , “ A-Z ” , and “ 0-9 ” ) Check that no node in the full path contains the MD5 string of the malware file Fingerprint the system and check the following registry values : HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid should not be “ 6ba1d002-21ed-4dbe-afb5-08cf8b81ca32 ” HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DigitalProductId should not be “ 55274-649-6478953-23109 ” , “ A22-00001 ” , or “ 47220 ” HARDWARE\Description\System\SystemBiosDate should not contain “ 01/02/03 ” Check that the mutex WininetStartupMutex0 does not already exist Check that no DLL whose base name has hash value of 0xC9CEF3E4 is mapped into the malware address space The hashes in these checks are most likely correspond to sandbox or security products that the FinFisher authors want to avoid .


Halloween is still a month from now and yet Android users are already being haunted by the previously reported Ghost Push malware, which roots devices and makes them download unwanted ads and apps.


Last March, we reported on Operation C-Major, an active information theft campaign that was able to steal sensitive information from high profile targets in India.


Custom Content Type Manager CCTM is a relatively popular plugin with three years of development, 10,000+ active installs, and a satisfaction rating of 4.8. It helps create custom post types.


A backdoor also known as: Trojan.Heur.AutoIT.13 Win32/Fynloski.STBTHUD Trojan.Win32.DarkKomet.dokuem Trojan.DownLoader12.11337 Trojan.Script.abcv Trojan:Win32/Manger.A Trojan.Autoit.Wirus Win32/TrojanDropper.Autoit.IC Win32/Trojan.Script.ed4


Moreover, the Sednit group has a special interest in Eastern Europe, where it regularly targets individuals and organizations involved in geopolitics


This virus ransomware arrives via email in a malicious attachment or by usurping an Adobe Flash Player installation.


Within a few minutes of installing one of these Trojans, all other active malware on the network is enabled on the victim's device.


This particular application/game from Google Play Store is certainly not a system application, as the name seems intended to suggest.


The bank then shared indicators of compromise IOCs with other institutions and a number of other institutions confirmed that they too had been compromised.


A few of these organizations have specifically been targeted by OceanLotus since early 2015.


A backdoor also known as: W32.MurLoDll1.Trojan Trojan-Downloader.Win32.Murlo!O Downloader.Murlo.Win32.5244 Trojan/Downloader.Murlo.nn TROJ_MURLO.BA Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Downloader.EKMU-1740 Win32/TrojanDownloader.Murlo.NN TROJ_MURLO.BA Win.Trojan.Murlo-7 Trojan-Downloader.Win32.Murlo.nn Trojan.Win32.Murlo.cpwkr Trojan.Win32.Downloader.5632.AY Trojan.DownLoader.62110 Trojan-Downloader.Win32.Murlo W32/Downldr2.CIAF TrojanDownloader.Murlo.hb Trojan[Downloader]/Win32.Murlo TrojanDownloader:Win32/Almanahe.A Trojan-Downloader.Win32.Murlo.nn Win32/SillyDl.EPI TrojanDownloader.Murlo W32/Murlo.NN!tr.dldr


A backdoor also known as: Worm.Wabbin Win32.Trojan.WisdomEyes.16070401.9500.9773 W32.Wabbin Win.Worm.Wabbin-1 Email-Worm.Win32.Wabbin Trojan.Win32.Wabbin.eoih Email.Worm.W32!c IM-Worm.Win32.VB W32/Trojan.TLKW-6882 Worm[Email]/Win32.Wabbin Trojan.Heur.VP.E513A3 Email-Worm.Win32.Wabbin Worm:Win32/Wabbin.A@mm Worm.Wabbin Trj/CI.A Win32.Worm-email.Wabbin.Dxnb Worm.Wabbin! W32/Wabbin.A@mm Win32/Trojan.97a


A backdoor also known as: I-Worm.Music.C W32/Music.40960.B Music.H WORM_MUSIC.B Email-Worm.Win32.Music.B Worm.Win32.Email-Worm.Music.B BACKDOOR.Trojan WORM_MUSIC.B W32/Music.40960.B I-Worm/Music.b WORM/Music.B Worm:Win32/Music.C@mm I-Worm.Win32.Music.B[h] W32/Music.B Win32/Music.B Email-Worm.Win32.Music.A W32/Music.B@mm Worm.Win32.Music.Abh


A backdoor also known as: Trojan/W32.Hijack.356352.M VirTool.DelfInject Trojan.DelfInject Dropper.Injector.Win32.25443 Trojan/Dropper.Injector.dyha Win32.Trojan.Delf.k TROJ_NEOJIT.SMAR Trojan.Win32.Buzus.rfedr Trojan.DownLoader6.1239 TROJ_NEOJIT.SMAR BehavesLike.Win32.Worm.fh TrojanDropper.Injector.taw Trojan/Win32.Buzus TrojanDownloader:Win32/Neojit.A Trojan/Win32.Injector.R23295 BScope.Trojan-Dropper.Injector Win32/Delf.OEN Trojan-Downloader.Win32.Neojit Win32/Trojan.dee


A backdoor also known as: Win32.MTX.B@mm W95.MTX Win32.MTX.B@mm W32/MTX@M.dll WORM_MTX.D W32/MTX.9244.B WORM_MTX.D Win.Trojan.MTX-5 Win32.MTX.B@mm Email-Worm.Win32.MTX.D Win32.MTX.B@mm Virus.Win32.MTX.hfxi Win32.MTX Win32.MTX.B@mm Win32.MTX.B@mm Win95.Matrix.9307 W95/MTX.dll@M W32/MTX.9244.B I-Worm/MTX.d W95/Mtx.B Win32.MTX.E2C45E Email-Worm.Win32.MTX.D Worm:Win32/MTX.B.dll W95/MTX.dll@M W32/MTX.D!worm


A backdoor also known as: Trojan/W32.Small.9728.KQ Win32.Trojan.WisdomEyes.16070401.9500.9990 Backdoor.Teambot Win.Trojan.Zapchast-130 Trojan.Win32.TeamBot.ctspsr BackDoor.TeamBot.60 Trojan/Zapchast.exm W32/Sheldor.NAB!tr Win32.Troj.Undef.kcloud Trojan.Graftor.Elzob.950 Troj.W32.Zapchast.lhAn Trojan:Win32/Availmetre.B Trojan/Win32.Zapchast.R17936 SScope.Backdoor.Mudak Trojan.Win32.Availmetre


A backdoor also known as: Backdoor.Win32!O Backdoor.Small.MUE.A11 RiskWare.SpySoft Trojan.Udr.Win32.1 W32/BackdoorX.GMX Backdoor.Trojan Win32/BackMan.A BKDR_NEWHEUR.IZ Win.Trojan.Udr-1 Backdoor.Win32.Udr.a Trojan.Win32.Udr.csnpza Backdoor.Win32.Udr.aa BackDoor.Udr.1 BKDR_NEWHEUR.IZ BehavesLike.Win32.Backdoor.fc W32/Backdoor.COLY-8496 Backdoor/Udr.d BDS/Udr.A Trojan[Backdoor]/Win32.Udr Win32.Hack.Udr.B5.kcloud Backdoor.Win32.Udr.692018 Backdoor.Win32.Udr.a Trojan/Win32.Udr.R577 OScope.Backdoor.Udr Backdoor.JYfi Backdoor.Udr!EwW5NHJTxmo Backdoor.Win32.Udr W32/Udr.A!tr.bdr Dialer.CKP


It also has a general purpose-proxy and a module for sending spam messages.


The attackers attempted to steal $951m, of which $81m is still unaccounted for.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9828 Win32.Trojan.Kriskynote.Ozic Trojan.Win32.Kriskynote Backdoor:Win32/Kriskynote.A BScope.Trojan.SvcHorse.01643 W32/Dropper.TMP!tr


Before that patch was released, the groups launched phishing campaigns against multiple companies in the aerospace and defense, construction and engineering, education, energy, health and biotechnology, high tech, non-profit, telecommunications, and transportation industries.


A backdoor also known as: Trojan.Ollexos Win32.Trojan.Heur.Lhdl Trojan.Heur.Win32.9371 BehavesLike.Win32.Spyware.jc TR/RedCap.xrytt Trojan.Heur.OmNfrrOwGgmOh Trojan.Win32.Z.Redcap.655360 Trojan:Win32/Ollexos.A Win32/Trojan.7b0


A backdoor also known as: W32.OnGamesHEXW32AH.Trojan Trojan.Win32.Scar!O BackDoor.Boomie.A3 Trojan.Scar.Win32.63773 Trojan/Scar.fvka Win32.Trojan.Scar.d Win.Trojan.Scar-895 Trojan.Win32.Scar.fvka Trojan.Win32.Scar.bbmdmf Troj.W32.Scar.fvka!c Trojan.Win32.Scar.ft Trojan.DownLoad2.52794 Backdoor.Win32.Boomie Trojan/Scar.azbo Trojan/Win32.Scar Backdoor:Win32/Boomie.A Trojan.Win32.Scar.fvka Win-Trojan/Boomie.40960 Trojan.Scar!AGwL0r/7hW4 Win32/Trojan.Spy.81b


A backdoor also known as: Trojan.Shamoon.A Trojan/W32.Shamoon.192000 Trojan.Depriz Trojan/DistTrack.d Trojan.Shamoon.A Win32.Trojan.WisdomEyes.16070401.9500.9987 W32.Disttrack.B TROJ64_DISTTRACK.D Win.Malware.DistTrack-5743117-1 Trojan.Shamoon.A Trojan.Shamoon.A Trojan.Win64.DistTrack.elcfal Trojan.Win32.Z.Disttrack.192000 Trojan.Shamoon.A Trojan.Shamoon.A Trojan.DistTrack.Win32.9 TROJ64_DISTTRACK.D W64/Trojan.BOAO-0112 Trojan:Win64/Depriz.E!dha Trojan.DistTrack.A Trj/CI.A W64/DistTrack.D!tr


FastPOS was true to its moniker—pilfer data as fast as possible, as much as it can, even at the expense of stealth.


A backdoor also known as: Trojan-Downloader.Win32.Banload!O Trojan/Downloader.Banload.qku Trojan.Graftor.D3222 Win32.Trojan.WisdomEyes.16070401.9500.9991 Trojan.DownLoad2.52025 Downloader.Banload.Win32.37297 Trojan.Win32.Spy TrojanDownloader:Win32/Spycos.B TrojanDownloader.Banload


A backdoor also known as: Backdoor.KVM.B Backdoor/W32.KWM.70656 PWS-Susanin.dr Backdoor.KVM.B Trojan.KWM.B2 Infostealer.KMW.B KWM.B Win32/PSW.KWM.B BKDR_KWM.B Backdoor.Win32.KWM.b Trojan.Win32.KWM.baukx PE:Trojan.KWM.b!1073777723 Backdoor.KVM.B TrojWare.Win32.PSW.Susanin.B Backdoor.KVM.B BackDoor.KWM Backdoor.KWM.Win32.11 BKDR_KWM.B PWS-Susanin.dr W32/Risk.SBUI-3175 Backdoor/KWM.b TR/WebMoney.2 Trojan[Backdoor]/Win32.KWM Win32.Hack.KWM.b.kcloud PWS:Win32/Susanin.B Backdoor.Win32.KWM.70656[h] Win-Trojan/KWM.70656 Backdoor.KVM.B Backdoor.KVM.B Dropper.PSW.Liz.17 Trj/PSW.Susanin Win32/PSW.Susanin.B Backdoor.Win32.Kwm.B W32/Contract.B!tr.bdr PSW.Susanin Backdoor.Win32.KWM.aWbC


A backdoor also known as: W32.Raxlogon.Trojan Worm.Win32.AutoRun!O Worm.Autorun.ZI8 Worm.AutoRun.Win32.22949 Win32.Worm.FakeFolder.b Win32/QQPass.NNE Worm.AutoRun Worm.Win32.AutoRun.hit Trojan.Win32.AutoRun.uaado Worm.Win32.Autorun.81108 Worm.Win32.Pronny.BL Trojan.PWS.Qqpass.5627 BackDoor-CCT.dll Worm/AutoRun.wxz Trojan:Win32/Hideproc.E Trojan[Monitor]/Win32.ActualSpy Win32.Troj.Undef.kcloud HEUR/Fakon.mwf Trojan.AVKill W32/Autorun.KBC Trojan.Win32.FakeFolder.pb Worm.AutoRun!PDL9JmhYC4g Backdoor.Win32.DarkMoon


New campaign involving PoSeidon/FindPOS point of sale malware


This morning Mozilla released security updates that fix the vulnerability.


A backdoor also known as: Trojan.Notepices Win32.Trojan.WisdomEyes.16070401.9500.9871 not-a-virus:AdWare.Win32.ICLoader.alpu Riskware.Win32.Hpdefender.ekfhpl Trojan.StartPage1.28867 Trojan.Win32.Notepices Pua.Downloader GrayWare[AdWare]/Win32.Hpdefender not-a-virus:AdWare.Win32.ICLoader.alpu Adware.HPDefender Win32/Adware.HPDefender.JG


A backdoor also known as: W32.FamVT.RsLpTTc.Worm Ransom.Lyposit.S3755 W32.Sality.lak4 Trojan/Lyposit.a Trojan.Zusy.D382F1 Ransom_Lyposit.R002C0CAT18 Win32.Trojan.WisdomEyes.16070401.9500.9902 Ransom_Lyposit.R002C0CAT18 Win.Trojan.Updays-1 Trojan.Win32.Clicker.efvwpu TrojWare.Win32.Lyposit.C Trojan.Click2.50933 Trojan.Lyposit.Win32.25 Trojan-Ransom.Lyposit Ransom:Win32/Lyposit.B Trojan/Win32.Lyposit.R188188 W32/Lyposit.A70!tr


The malware used in email campaigns is often ransomware or banking malware.


A backdoor also known as: Trojan.Injector.AutoIt Trojan.StartPage1.24074 TrojanClicker:Win32/Rubalotalow.A Win32/Trojan.ab1


A backdoor also known as: W32.eHeur.Virus02 Virus.Win32.Sality!O Win32.Trojan.WisdomEyes.16070401.9500.9989 Win.Trojan.Zusy-6041926-0 Trojan.Win32.Scar.okvf Win32.Trojan.Scar.Wwek Trojan.DownLoader24.19336 Trojan.Scar.kws Trojan/Win32.Cosmu PWS:Win32/Sapbexts.B Trojan.Win32.Scar.okvf Trojan/Win32.Cosmu.R214802 Trojan.Vilsel Trojan.Cosmu!F9mC6Li+PNw Win32/Trojan.Scar.C


You may mistakenly download and run TrojanDropper:Win32/Gepys.A, thinking it is an update for Java.


If the attack succeeds, the malware changes the addresses of the DNS servers in the router's settings, thereby rerouting all DNS queries from devices in the attacked Wi-Fi network to the servers of the cybercriminals such an attack is also known as DNS-hijacking.


It means the phone can be unblocked in some cases when it has been blocked by one of the above HTML pages .


Each time a rented malware reaches the end of its life it provides the opportunity for other actors a to take over the malware rental market-share .


Interestingly, the attackers camouflage one of their delivery domains by redirecting visitors to El Universal, a major Mexican newspaper.


These emails are mainly sent to Colombians who may work in the accounting or finance departments of various-sized organizations.


A Communication Channel via Stolen SMS In addition , TrickMo has an automatic mechanism to send SMS messages to its C & C server .


A backdoor also known as: Trojan.Downloader Trojan/Downloader.Boaxxe.aa Win32.TRDldr.JeRips TR/Dldr.JeRips.A W32/Boaxxe.AB!tr


Service Name Purpose AndroidAlarmManager Uploading last recorded .amr audio AndroidSystemService Audio recording AndroidSystemQueues Location tracking with movement detection ClearSystems GSM tracking ( CID , LAC , PSC ) ClipService Clipboard stealing AndroidFileManager Uploading all exfiltrated data AndroidPush XMPP С & C protocol ( url.plus:5223 ) RegistrationService Registration on C & C via HTTP ( url.plus/app/pro/ ) Interestingly , a self-protection feature was implemented in almost every service .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.MulDrop5.40693 TR/Downloader.A.7912 Trojan[Ransom]/Win32.Blocker Trojan:MSIL/Dubfot.A Trojan.FakeMS Trojan.MSIL.IRCBot


New ransomware using the .ipygh extension.


How do you know if your Google account is breached ? You can check if your account is compromised by accessing the following web site that we created : https : //gooligan.checkpoint.com/ .


BLOCKER_BANKING_START – display phishing HTML page for entry of bank card details .


The most recently discovered Microsoft SQL server being used as Escalar infrastructure contained records of 1660 infections that all connected in a two-day time frame.


Later on, we found evidence of the same attack perpetrated on May 3.


A backdoor also known as: Win32.Worm.Lemoor.A Worm/W32.Lemoor.1981 Trojan-Downloader.Win32.Small!O Win32.Worm.Lemoor.A Worm.Lemoor.Win32.2 W32.W.Lemoor.a!c W32/Lemoor.a Win32.Worm.Lemoor.A WORM_LEMOOR.D Win32.Trojan.WisdomEyes.16070401.9500.9995 W32/Lemoor.A W32.Lemoor.A WORM_LEMOOR.D Win.Worm.Lemoor-3 Win32.Worm.Lemoor.A Worm.Win32.Lemoor.a Win32.Worm.Lemoor.A Win32.Worm.Lemoor.A Worm.Win32.Lemoor.B Win32.Worm.Lemoor.A Win32.Ephem.24 W32/Lemoor.JDMS-3575 I-Worm/Lemoor.a WORM/Lemoor.A Worm/Win32.Lemoor Worm.Win32.Lemoor.a Worm/Win32.Lemoor.R37765 Worm.Lemoor W32/Lemoor.B.worm Win32/Lemoor.B Win32.Worm.Lemoor.Ahos Worm.Lemoor!V5CZ/YV1RTs Worm.Win32.Lemoor W32/Lemoor.A!worm Win32/Worm.857


User-agent: Go-http-client/1.1


A backdoor also known as: Trojan.Skeeyah Trojan.KillDisk.Win32.208 Trojan/KillDisk.nbh Win32.Trojan.WisdomEyes.16070401.9500.9834 Trojan.Disakil Win.Trojan.KillDisk-3 Trojan.Win32.KillDisk.fw Win32.Trojan.Killdisk.Pgmq Trojan:Win32/KillDisk.N!dha Trojan.KillDisk.1 Trojan.Win32.KillDisk.fw Trojan/Win32.KillDisk.C1706046 Trojan.KillDisk Win32/KillDisk.NBH Trojan.KillDisk!B1yc+Gvh2zs Trj/CI.A


Most of the samples we found date from the last half of 2017 , fewer samples date from 2016 , and a handful date back to 2015 .


The normal lifecycle of an Office exploit starts with the initial use in targeted attacks.


A backdoor also known as: Trojan-PSW.Win32.LdPinch!O TrojanPWS.Ldpinch Win32.Trojan.WisdomEyes.16070401.9500.9997 Win32/Tnega.YML TSPY_LDPINCH_DD3005CF.UVPA Trojan-PSW.Win32.LdPinch.guf Trojan.Win32.LdPinch.crgdkw Trojan.LdPinch.Win32.5281 BehavesLike.Win32.Trojan.fz Trojan.Win32.Vilsel W32/Trojan.JQPI-8861 Trojan/PSW.LdPinch.pxf Trojan[PSW]/Win32.LdPinch Trojan.Heur.E4E165 Troj.Psw.W32.Ldpinch!c Trojan-PSW.Win32.LdPinch.guf PWS:Win32/Phorex.A Trojan/Win32.LdPinch.R68731 Trojan.PWS.LdPinch!MPU8gCWOSOw W32/LdPinch.GUF!tr.pws TrojanPSW.Pinch Win32/Trojan.PSW.b93


A backdoor also known as: Trojan.PWS.QQRob.NBU Trojan-PSW.Win32.QQPass!O PSW.QQPass.13953 Trojan.PWS.QQRob.NBU Trojan/PSW.QQPass.ban Win32.Worm.Autorun.ar Infostealer.QQRob.A WORM_AUTORUN.EDD Win.Trojan.QQPass-84 Trojan.PWS.QQRob.NBU Trojan-PSW.Win32.QQPass.ban Trojan.PWS.QQRob.NBU Trojan.Win32.QQPass.btqyi Trojan.Win32.Z.Qqpass.73427 Trojan.Tencent/Variant Trojan.PWS.QQRob.NBU TrojWare.Win32.PSW.QQPass.~GK Trojan.PWS.Qqpass.1364 WORM_AUTORUN.EDD BehavesLike.Win32.PWSQQGame.lh W32/Pws.VYB Trojan/PSW.QQPass.bhp Win32.Troj.QQPswT.bs.116858 Trojan.PWS.QQRob.NBU Troj.Psw.W32.Qqpass!c Trojan-PSW.Win32.QQPass.ban MalwareScope.Trojan-PSW.Game.7 Trj/QQPass.AOI Win32.Trojan-qqpass.Qqrob.Pcsk Trojan-Dropper.Win32.Delf W32/Dropper.DLF!tr


A backdoor also known as: Trojan/W32.BHO.89848 Trojan/BHO.gzx TSPY_BZUB.CN Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan2.FNXB TSPY_BZUB.CN Win.Trojan.Bho-4826 Trojan.Win32.BHO.gzx Trojan.Win32.BHO.cqlbw TrojWare.Win32.BHO.SR Trojan.MulDrop.20001 Trojan.BHO.Win32.3053 BehavesLike.Win32.Backdoor.mc W32/Trojan.RKCQ-8049 Trojan/BHO.csn Win32.Troj.BHO.kcloud Trojan.Heur.RP.E89CDE Trojan.Win32.BHO.gzx PWS:Win32/Cimuz.J Trojan/Win32.Inject.C94649 Trojan.BHO Win32/Spy.BZub.NFS Trojan.BHO!Tkmwppjy1xw


A backdoor also known as: Trojan-Downloader.Win32.VB!O TrojanDownloader.VB Troj.Banker.W32.Bancos.lgUF Trojan/Downloader.VB.iro Win32.Trojan.WisdomEyes.16070401.9500.9935 Win32/SillyDl.GEF Win.Trojan.Downloader-37507 Trojan-Downloader.Win32.VB.iro Trojan.Win32.VB.vrga Trojan.Win32.Downloader.69122.B TrojWare.Win32.Banker.etk74 Trojan.Show.34817 Downloader.VB.Win32.114 WORM_IRCBOT.SMOK BehavesLike.Win32.YahLover.ct TrojanDownloader.VB.gvh Trojan[Downloader]/Win32.VB Trojan-Downloader.Win32.VB.iro DoS:Win32/Pokanti.A Downloader/Win32.VB.R6537 TScope.Trojan.VB Win32.Trojan-downloader.Vb.Pdmc Trojan.DL.VB!zHigarbFEUc Trojan-Downloader.Win32.VB Win32/Trojan.Downloader.b8b


A backdoor also known as: W97M.Dropper.GO W97M/Downloader.aho W2KM_DLOADE.VHC Trojan.Script.MLW.dsmnja W2KM_DLOADE.VHC W97M/Downloader.aho HEUR.VBA.Trojan macro.ole.encodedownload.g


A backdoor also known as: Trojan-Ransom.Win32.PornoBlocker!O Trojan/PornoBlocker.adki Win32.Virus.Krap.a HV_RANSOM_CA222F78.TOMC Win.Trojan.Kryptik-1359 Trojan-Ransom.Win32.PornoBlocker.adki Trojan.Win32.Butirat.wyaex Trojan.Win32.A.PornoBlocker.197120.B ApplicUnwnt.Win32.Hoax.ArchSMS.SG BackDoor.Butirat.51 BehavesLike.Win32.PUPXAG.ch Trojan/PornoBlocker.chv Trojan[Ransom]/Win32.PornoBlocker Trojan.Kazy.DCA1D Trojan-Ransom.Win32.PornoBlocker.adki Trojan:Win32/Waprox.A Trojan/Win32.PornoBlocker.C156437 Hoax.PornoBlocker Trj/Pacrypt.D Trojan.PornoBlocker!0B81yxGeAIw Trojan.Win32.Waprox W32/Zbot.RO!tr


A backdoor also known as: Trojan.VBS.UAJ Trojan.VBS.UAJ Win32.Trojan.WisdomEyes.16070401.9500.9853 Trojan.VBS.UAJ Vbs.Trojan.Vbs.Ljjs Trojan.VBS.UAJ Trojan.VBS.UAJ Trojan.DownLoader19.25627 BehavesLike.Win32.Downloader.qh Trojan.Barys Trojan.MSIL.amcc Trojan.VBS.UAJ Trojan.VBS.UAJ Trojan.MSIL.Zapchast VBS/Shutdown.NAH


A backdoor also known as: RTKT_SMALL.NLA RTKT_SMALL.NLA Trojan.Win32.Small.dplckv Adware.AdLoad.Win32.8710 BehavesLike.Win32.PUPXAX.lc Trojan.Zusy.D2BE63 Rootkit.Small!rTi0K4xzlKc


A backdoor also known as: W32.VodyDmpA.Worm Trojan/W32.Small.9265 RiskWare.Tool.CK Trojan/Pakes.c Win32.Trojan.WisdomEyes.151026.9950.9983 W32/Trojan.WZX TROJ_PAKES.JV Virus.Win32.Xorer.a Trojan.Win32.Pakes.bovph Trojan.Win32.Pakes.9261[h] Trojan.Dropper/Packed Win32.Virus.Xorer.Pkqs TrojWare.Win32.Patched.KSU Trojan.Rox Virus.Xorer.Win32.101 TROJ_PAKES.JV BehavesLike.Win32.Downloader.zc W32/Trojan.YUJV-5997 W32/Pakes.C!tr W32.Xorer.a!c Win-Trojan/Pakes.9265 Trojan.Pakes Virus.Win32.Xorer Clicker.BEHT


A backdoor also known as: W32.GamesonTBDll1.Trojan Trojan.PWS.OnlineGames.ZLU Trojan-PWS/W32.WebGame.229376.BS Trojan.Tilcun.B7 Trojan.PWS.OnlineGames.ZLU Trojan/OnLineGames.arus TSPY_ONLINEG.FGF Win32.Trojan-PSW.OLGames.cc Infostealer.Gampass TSPY_ONLINEG.FGF Win.Spyware.45047-2 Trojan.PWS.OnlineGames.ZLU Trojan.PWS.OnlineGames.ZLU Trojan.Win32.OnLineGames.bemmm Trojan.Win32.PSWIGames.229376.Q Trojan.PWS.OnlineGames.ZLU TrojWare.Win32.PSW.OnLineGames.NOA Trojan.PWS.OnlineGames.ZLU Trojan.PWS.Gamania.11506 BehavesLike.Win32.Downloader.dh Trojan.Win32.Tilcun TR/Tilcun.B Win32.Troj.OnlineGameT.na.218624 Trojan.PWS.OnlineGames.ZLU Troj.GameThief.W32.OnLineGames.arus!c Trojan/Win32.OnlineGameHack.R2107 PWS-OnlineGames.br BScope.Trojan-PSW.Gomex.22 Win32/PSW.OnLineGames.NOA Win32.GamePsw.OnlineGame.bscx W32/OnLineGames.AKLO!tr.pws


BlackMoon Trojan is a banking trojan that is designed to phish user credentials from various South Korean banking institutions.


A backdoor also known as: Trojan.Script.9271 BAT.Trojan.KillFiles.h Win.Worm.530490-1 BAT.Conwonk BehavesLike.Win64.Downloader.qh BAT/KillWin.NAR Trojan.BAT.KillWin BAT/KillWin.NAR!tr


A backdoor also known as: Trojan.Patched.Shopperz.1 Trojan.DllPatcher.A6 PTCH64_NOPLE.SM Trojan.Mentono!inf PTCH64_NOPLE.SM Trojan.Patched.Shopperz.1 Trojan.Win64.Patched.qw Trojan.Patched.Shopperz.1 Trojan.Patched.Shopperz.1 Trojan.Hosts.37524 Trojan.Patched.Shopperz Trojan/Win64.Patched.ap Trojan.Patched.Shopperz.1 Trojan.Win64.Patched.qw W64/Patched.AP!tr Win32/Trojan.133


A malicious Word document targeting Mac users.


It also targets Ahnlab by killing processes and deleting files specific to the software.


BlackTech is a cyber espionage group operating against targets in East Asia, particularly Taiwan, and occasionally, Japan and Hong Kong.


A backdoor also known as: Trojan.Affpach.A4 Trojan.Graftor.D6130 Win32.Trojan.StartPage.a W32/Trojan2.NTSB TROJ_SPNR.30BF13 Trojan.Win32.AVKill.bfnuts Trojan.Win32.Inject.tja Trojan.AVKill.27746 TROJ_SPNR.30BF13 W32/Trojan.ZXAC-7369 Variant.Graftor.xm Win32/StartPage.OKV Trojan.StartPage!m0gBcMRinXU Trojan.Hijacker W32/StartPage.OKV!tr


Threat Actors TAs employ sophisticated techniques to create phishing websites that are designed to appear legitimate and attractive to users.


BianLian continues to exhibit a high level of operational security and skill in network penetration, seeming to have also found their stride in the pace of their operations.


A backdoor also known as: VEX8687.Webshell Backdoor.PHP.RST.H HTML.BackDoor.A Backdoor.Php.Rst!c PHP.Backdoor.WebShell.al PHP/Rst.H PHP.RSTBackdoor PHP/Small.NAL PHP_R57SHELL.SM Win.Trojan.R57-2 Script.Trojan.PHPShellRST.A Backdoor.PHP.RST.H Trojan.Html.Rst.bgzarv PHP.S.Rst.87741 Backdoor.PHP.RST.H Backdoor.PHP.Rst.~BBA Backdoor.PHP.RST.H PHP.R57Shell.12 PHP_R57SHELL.SM PHP/Rst.H PHP/Rst.H.95982 Backdoor.PHP.RST.H PHP/Rst.A Backdoor.PHP.r57Shell.A BPX.Shell Backdoor.PHP.Rst.ai Php.Backdoor.Rst.Ssgx PHP.RST.G Trojan.PHP.Rst PHP/Rst.AI!tr php.script.c99shell.6


Symantec first reported on this group back in January 2017, detailing their operations and using a custom information stealing Trojan called ISMDoor.


A backdoor also known as: W32/Adware.AMRL Trojan.DownLoader22.55869 BehavesLike.Win32.Worm.th W32/Adware.OAXQ-2836 Worm:Win32/Imafly.AC Trojan.Strictor.D19956 Trojan/Win32.Cosmu.R158790 Win32/Autoit.LH Worm.Win32.AutoIt W32/Autoit.EQP!tr


A backdoor also known as: W32.FakeW7Folder.Fam.Trojan Worm.Goldrv.A7 Trojan-Ransom.Win32.Blocker.jaic Trojan.Win32.Dapato.dbzcxx W32.Virut.lMey Trojan.Win32.Dapato.a TrojWare.Win32.Dapato.DFS Trojan.DownLoader11.18798 Trojan-Dropper.Win32.Dapato TrojanDropper.Dapato.peb Trojan[Dropper]/Win32.Dapato Worm:Win32/Goldrv.A Trojan-Ransom.Win32.Blocker.jaic HEUR/Fakon.mwf Trojan-Ransom.Blocker Backdoor.Bot W32/Dapato.EDU!tr Win32/Trojan.df8


The malware used in this campaign has similar features to that distributed earlier in 2017 with the following changes: A new decoy document copy/pasted from an article published on the 3rd of July by Yonhap News Agency in Korea;


It leverages webinjects and SMS reading capabilities to bypass two-factor authentication , and is clearly targeting financial applications .


The Computer Incident Response Center Luxembourg CIRCL has recently uncovered malicious files attached to an email through the use of Pandora Document and File Analysis.


New variant of the Android rootnik malware that disguises itself as a legal app.


Using google translate, I found that the language is Armenian and translates to The Law on Banks and Banking 27.07.2015.doc VirusTotal intelligence spotted the decoy in the wild as an email attachment with the subject name Law changes which gave me a suspicion that the attempt was made to specifically target the employees of Central bank of Armenia.


It appears that the attackers are somewhat familiar with the language and mountain-trekking culture of the targets – the meaning of “ chuli ” is “ summit ” : The command-and-control server and parameters can be easily seen in the decompiled source code : Command and control server interaction code Throughout the code , the attackers log all important actions , which include various messages in Chinese .


Everything started from a well edited Italian language email given to me from a colleague of mine, thank you Luca! reaching out many Italian companies.


BEBLOH is a banking Trojan that has been around since as early as 2009.


The actor utilizes spear phishing campaigns to deliver NetTraveler, also known as TravNet.


A backdoor also known as: Backdoor/W32.PcClient.409260 Trojan.Pincav.9356 Backdoor.PcClient.Win32.5 Backdoor/PcClient.alqk Trojan.Buzy.D10B5 W32/Backdoor.MMJP-0040 Backdoor.Trojan Trojan.Win32.PcClient.ihgd Trojan.MulDrop3.45818 Backdoor.Win32.PcClient W32/Backdoor2.FUIH Trojan:Win32/Wisp.A BDS/Pcclient.alqk Trojan[Backdoor]/Win32.PcClient Backdoor.Win32.A.PcClient.386732 Trojan/Win32.PcClient.R55121 Backdoor.PcClient Backdoor.PcClient!4LPCxDv4AHg Win32/Backdoor.851


A backdoor also known as: Trojan.Mauvaise.SL1 BehavesLike.Win64.MysticCompressor.ch Trojan:Win64/Jifcapi.A Win32/Trojan.03e


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.PWS.Steam.12700 BehavesLike.Win32.Trojan.bc TR/Dropper.MSIL.dhgqe Spyware.AzorUlt Trj/GdSda.A Trojan.MSIL.Krypt MSIL/Kryptik.MPY!tr


Those are not the only system functions Triada modifies .


A backdoor also known as: W32.AlustinH.Trojan Trojan.Diacam.KL3 Trojan.VB.Win32.96905 Trojan/VB.qms TROJ_DIACAM_BK0846C6.TOMC Win32.Trojan.WisdomEyes.16070401.9500.9992 TROJ_DIACAM_BK0846C6.TOMC Win.Trojan.Mokes-11 Trojan.Win32.Dwn.coomze TrojWare.Win32.VB.QMS Trojan.DownLoader6.45576 Trojan/Jorik.glae Trojan/Win32.Mokes Trojan:Win32/Diacam.A Trojan.Symmi.D23C3 Win32.Trojan.VB.BE Trojan/Win32.VBKrypt.C161437 Trojan.Mokes Win32/VB.QMS Win32.VBCrypt W32/VBKrypt.MBSX!tr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Packed.16 Win32/Pigeon.AZTT Win.Trojan.Packed-77 Backdoor.Win32.Hupigon.oqk Trojan.Win32.Crypt.mkur Backdoor.Win32.Hupigon.412672.K Win32.Backdoor.Hupigon.cuda Packed.Win32.Klone.~KMF BackDoor.Pigeon.20533 Backdoor.Hupigon.Win32.100099 BehavesLike.Win32.Fujacks.fc Backdoor/Hupigon.af Win32.Troj.Klone.ab.389660 Trojan/Win32.Malpacked5.R134022 Trojan-Dropper.Kaos Trojan.Win32.Pincav


In some cases, it appeared to be a single use domain shadowing which is incredibly difficult to stop by using blacklisting.


A backdoor also known as: Trojan.Heur.VP.ED105D0 Win32.Trojan.WisdomEyes.16070401.9500.9911 Trojan.MulDrop4.19536 BehavesLike.Win32.VBObfus.nt TR/Spy.36864.1691 Win32/VB.OIX


Since our first published analysis of the OilRig campaign in May 2016 Unit42 has continued to monitor this group for new activity.


A backdoor also known as: Trojan-Dropper.Win32.Dapato!O Trojan.Symmi.D6404 Win32.Trojan.WisdomEyes.16070401.9500.9991 Trojan-Dropper.Win32.Dapato.buqu Trojan.Win32.Dapato.bcmajb Trojan.DownLoader7.19485 BehavesLike.Win32.BadFile.mm W32/Trojan.IAVK-8796 TrojanDropper.Dapato.mbp TR/Dapato.AG Win32.Troj.Dapato.bu.kcloud Trojan:Win32/Omdork.A Trojan-Dropper.Win32.Dapato.buqu Trojan/Win32.Inject.R46970 Trojan.Win32.Swisyn W32/Dapato.B!tr


More and more we've been seeing references to a malware family known as FormBook.


] net , negg1.ddns [ .


A backdoor also known as: W32.HfsAdware.6632 PUP.Optional.Nosibay TROJ_GE.FF4D51A5 Adware.Downware.11318 virus.win32.sality.at PUA/BubbleDock.A PUP.Nosibay/Variant NSIS.Application.SilentInstaller.A Win32.Trojan.Bubbledock.Huzb


Anti-emulator code .


Several days ago , the e-mail account of a high-profile Tibetan activist was hacked and used to send targeted attacks to other activists and human rights advocates .


These apps are not hosted inside the Google Play store, but are distributed via third party distribution mechanisms in China.


A backdoor also known as: W32.eHeur.Virus02 Trojan.PWS.Banker1.23807 TR/Crypt.ZPACK.qkbzo Trojan:Win32/Ahriynoteemo.A Trojan-Spy.Win32.Noon Trj/CI.A Win32/Trojan.1fa


A backdoor also known as: W32.FakeW7Folder.Fam.Trojan Trojan.Mauvaise.SL1 Trojan.Skeeyah W32.SillyFDC Trojan.Win32.Bulknet.eljnif TrojWare.Win32.Imwee.A Trojan.DownLoader11.19812 Trojan.Zusy.D38629 TrojanDownloader:Win32/Gratem.A HEUR/Fakon.mwf Trj/Downloader.WKR


A worm Madang infects files across all drives, and installs itself as serverx.exe


A backdoor also known as: W32.MosquitoQKB.Fam.Trojan Trojan.Kryptik.Win32.93516 Trojan/Kryptik.kuf BKDR_QAKBOT.SMG Win32.Trojan.WisdomEyes.16070401.9500.9999 BKDR_QAKBOT.SMG Win.Trojan.5453446-1 Trojan-Ransom.Win32.Gimemo.dtt Trojan.Win32.Crypted.efbdjj Trojan.Packed.21485 BehavesLike.Win32.HLLP.dc Trojan:Win32/Dishigy.B Trojan-Ransom.Win32.Gimemo.dtt Trojan/Win32.Zbot.R2835 Trojan.Flasher.xr Worm.Win32.Slenfbot


This attack was specifically targeting a well-known financial services firm.


Cmstar was named for the log message CM**' used by the downloader.


] 6 , was previously hosting the domain next.nextuptravel [ .


A backdoor also known as: Backdoor.ASP.Ace.B Backdoor.ASP.Ace.B ASP/Ace.C Backdoor.Trojan Ace.B HTML_Haiyasp.a Backdoor.ASP.Ace.b Backdoor.ASP.Ace.B Backdoor.ASP.Ace.b Backdoor.ASP.Ace.B BDS/ASP.Ace.E HTML_Haiyasp.a Backdoor/ASP.Ace.b Backdoor/ASP.Ace Backdoor:ASP/Ace.B Backdoor.ASP.Ace.B ASP/Ace.C Backdoor.ASP.Ace.b Backdoor.Trojan ASP/Ace.B Script.haiyang.a Bck/Ace.B


This research gives a rare look into the process improvements malware authors make when optimizing before launch .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.NtRootKit.bozxzq TrojWare.Win32.Rootkit.Festi.AA Trojan.NtRootKit.15667 BehavesLike.Win32.Dropper.mm Trojan.Win32.Rootkit Trojan[Rootkit]/Win32.Tent TrojanDropper:Win32/Festi.C SScope.Trojan.CLR.18907 W32/Rootkit_Festi.AA


In-depth reverse engineering revealed the APK contained an Android variant of X-Agent, the command and control protocol was closely linked to observed Windows variants of X-Agent, and utilized a cryptographic algorithm called RC4 with a very similar 50 byte base key.


A backdoor also known as: Trojan-Ransom.Win32.Cidox!O Trojan/Cidox.bpa TROJ_VUNDO.SMFQ Win32.Trojan.WisdomEyes.16070401.9500.9988 TROJ_VUNDO.SMFQ Trojan.Win32.Mayachok.esnzar Trojan.Mayachok.1 Dropper.Cidox.Win32.14633 BehavesLike.Win32.PUPXDR.ph Trojan-Dropper.Win32.Cidox Trojan.Symmi.DD688 TrojanDownloader:Win32/Vundo.HIY Trojan/Win32.Cidox.R20237 Trojan-Ransom.Cidox.1212 Win32/Trojan.1b7


A backdoor also known as: W32.Virut.G W32/Trojan3.ATP W32.Virut.CF W32/Virut.BS Win32/Virut.17408 PE_VIRUX.A-3 Virus.Win32.Virut.ce Win32.Virut.AM Virus.Win32.Virut.Ce Win32.Virut.56 PE_VIRUX.A-3 Heuristic.BehavesLike.Win32.ModifiedUPX.J Win32/Virut.bn Win32.Virut.nd.53248 Virus:Win32/Virut.BN Win32/Virut.F W32/Trojan3.ATP Virus.Virut.06 Win32/Virut.NBP Win32.Obduran.a W32/Sality.AO


It then uses open-sourced Android root exploit tools to gain root access on an Android device.


The actors weaponized the delivery document to install a variant of the 9002' Trojan called 3102' that heavily relies on plugins to provide functionality needed by the actors to carry out on their objectives.


Spearphishes impersonating RAND


KeyRaider targets jailbroken iOS devices and is distributed through third-party Cydia repositories in China.


The malware, dubbed CopyCat by researchers, uses a novel technique to generate and steal ad revenues.


The criminal gangs of the Carbanak/FIN7 syndicate have been attributed to numerous intrusions in the banking, hospitality, retail and other industrial verticals, collecting financial information of all kinds.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 LNK/Trojan.XMFH-4 Worm.Win32.AutoIt.aku Worm.W32.Autoit!c LNK_DORKBOT.SMF Trojan/Win32.Autoit Trojan.Autoit.DHZ Worm.Win32.AutoIt.aku Trojan:Win32/Chinqincin.A Win32.Worm.Autoit.Lndx Trj/CI.A Win32/Trojan.1e1


However, only the Georgian language portion of the website was impacted and used in an effort to distribute malware.


A backdoor also known as: Heur.Win32.Veebee.1!O Trojan.Dyname.r3 Trojan.Dropper Trojan.VB.Win32.118717 Trojan.VB!K6eQMCc/nZg Trojan.Win32.VB.ckbb Worm.Win32.WBNA.ROC TR/Dynamer.dtc.17594 W32/Trojan.MKPV-4364 Trojan/Win32.VB Trojan.VB Win32/AutoRun.VB.BDM Trojan-Banker.Win32.Bancos W32/VB.CKBB!tr


] net The overlaps between the Henbox , PlugX , Zupdax , and Poison Ivy malware families involves a web of shared C2s and IP resolutions centered around the below : 59.188.196 [ .


A backdoor also known as: W32.eHeur.Virus02 Trojan/W32.Cobalt.196608 Trojan.Conbea Win.Tool.CobaltStrike-6336852-0 HackTool.Win32.Cobalt.k Trojan.Win32.Cobalt.egtrej BackDoor.Meterpreter.42 BehavesLike.Win32.Backdoor.ch HackTool.CobaltStrike HackTool/Win32.Cobalt Trojan.Application.HackTool.CobaltStrike.1 HackTool.Win32.Cobalt.k HackTool/Win32.Cobalt.R197271 TrojanDownloader.Agresbeak RiskWare.HackTool Riskware.HackTool!t96XHdFe7u4 W32/CobaltStrike_Beacon.A!tr Win32/Application.Hacktool.e79


A backdoor also known as: Trojan.Graftor.D1A90 Win32.Trojan.Kryptik.afz Trojan.Proxy2.1039 BehavesLike.Win32.BadFile.lc Trojan-Dropper.Win32.Injector TR/Obfuscated.sarli Trojan:Win32/Riern.M TScope.Malware-Cryptor.SB Win32/Trojan.Downloader.9c1


Talos has named this malware KONNI.


A backdoor also known as: Application.MiniFtp.A Server-FTP.Win32.MiniFTP!O Backdoor.Banito.Win32.283 Backdoor/Banito.nk Application.MiniFtp.A Win32.Trojan.WisdomEyes.16070401.9500.9964 W32/VirTool.CJ Win.Trojan.Miniftp-1 Application.MiniFtp.A not-a-virus:Server-FTP.Win32.MiniFTP.c Application.MiniFtp.A Trojan.Win32.Banito.xnaq Backdoor.Win32.Banito.81920[h] Application.MiniFtp.A Backdoor.Win32.Banito.nk0 BackDoor.Bandito.2207 W32/Tool.XUIH-6856 Hacktool.Miniftp APPL/MiniFTP.A RiskWare[Server-FTP]/Win32.MiniFTP.c Backdoor.W32.Banito.lx25 Backdoor:Win32/Shesmi.A Unwanted/Win32.MiniFTP.R63415 Backdoor.Sdbot!9v31gLa9+gE Backdoor.Win32.Formador.b W32/FTPMini.A!tr Bck/Formador.B Win32/Backdoor.662


Table 5 describes the latest variant seen in AutoFocus .


This pulse includes indicators from this analysis, and indicators from other campaigns that employ related malware.


READ_SMS - Allows the application to read text messages .