This is done by sending “ 3458 ” in an SMS to the blocked device – this will revoke the administrator privileges from the Trojan .


Social networking sites Facebook and Twitter are primarily being used to spread a shortened URL using bit.ly service that points to a Google Cloud Server hosting the malicious payload with .COM or .EXE file extensions.


This report documents some of our recent findings regarding its cryptography, network behavior,and banking targets.


Earlier this year, the SpiderLabs team at Trustwave investigated a series of bank breaches originating from postSovietstates.


This banking malware can steal login credentials from 94 different mobile banking apps.


In a newly-identified campaign, FIN7 modified their phishing techniques to implement unique infection and persistence mechanisms.


We also discovered two previously unknown payloads.These payloads contained backdoors that we have named BYEBY and PYLOT respectively.


EventBot infected device to be sent to the C Information gathered about the infected device to be sent to the C2 .


Our research showed that the spear phishing emails came from multiple compromised email accounts tied to a legitimate domain in North East Asia.


A backdoor also known as: TrjnDwnldrMSIL.Ranos.A4 MSIL.Trojan.Injector.q BKDR_RANOS.SM TrojWare.MSIL.TrojanDownloader.Small.DS Trojan.Starter.2890 BKDR_RANOS.SM Trojan.Jintor.1 TrojanDownloader:MSIL/Ranos.A Trojan.Win32.Fsysna MSIL/Injector.CKC!tr Trj/GdSda.A Win32/Trojan.e2d


La Poste - La Poste is a public limited postal service company in France .


Some of the tactics used in APT attacks die hard.


Therefore , our team managed to generate the public key and craft an SMS message that activated the kill switch .


How does Gooligan work ? The infection begins when a user downloads and installs a Gooligan-infected app on a vulnerable Android device .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9931 W32/Trojan.MNLT-0240 TR/Crypt.Xpack.rxrlk Trojan.Symmi.D136A2 Win32/Trojan.859


This new process downloads and executes the final stage: a Remote Administration Tool RAT based on Gh0st RAT.


In 2018 , we have already observed a small but consistent number of samples .


Until mid-2015 , Rotexy used a plain-text JSON format to communicate with its C & C .


A backdoor also known as: Trojan-Spy.Win32.TravNet.vmq Trojan.PWS.Spy.17858 Trojan.Win32.Webprefix Trojan.Zusy.D124FE Trojan-Spy.Win32.TravNet.vmq TrojanDownloader:Win32/Travnet.B Trojan/Win32.Travnet.R99919 Trojan.Farfli!4lB/nc8HSss W32/Farfli.LI TrojanSpy.TravNet Win32/Trojan.Multi.daf


The oldest sample we found was created in 2009, indicating this tool has been in use for almost seven years.


Earlier this year, we talked about how cybercriminals took advantage of the popularity of Pokemon Go to launch their own malicious apps.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Krypt.drmwlo BehavesLike.Win32.Backdoor.gh TR/Krypt.503296 Trojan.MSIL.Bladabindi.1 Trj/CI.A Trojan.VB.Inject MSIL/Bbindi.W!tr


Mozilla products that don't contain the PDF Viewer, such as Firefox for Android, are not vulnerable.


we are currently working with Adobe to confirm the CVE number for this exploit


The malware likely required a significant amount of time and knowledge to create.


A backdoor also known as: Trojan.Crack2000.Win32.1 Trojan/.hack Win.Trojan.HackDream-1 Trojan.IRC.Hack Trojan.Win32.Hack.fvvy TrojWare.IRC.Hack.A Trojan.IrcHack BehavesLike.Win32.Dropper.tc Trojan/IRC.Hack JS/IRC.bdmlu Trojan/IRC.Hack Trojan.Win32.IRCHack.546218 Trojan.IRC.Hack Trojan.2000Cracks IRC/Hack.A IRC/Hack.A!tr


The addition of DNS-based exfiltration is new for this malware family; however, other POS malware families such as BernhardPOS and FrameworkPOS have used this technique in the past.


How does the malware work without code for these key components ? As is characteristic for obfuscated threats , the malware has encrypted binary code stored in the Assets folder : When the malware runs for the first time , the static block of the main class is run .


A backdoor also known as: Trojan-GameThief.Win32.OnLineGames!O Trojan.OnLineGames.Win32.215966 Trojan.Heur.RP.cmIfaG!Q79i TSPY_ONLINEG.TGV Win32.Trojan.WisdomEyes.16070401.9500.9941 Win32/Zuten.DK TSPY_ONLINEG.TGV Trojan-GameThief.Win32.OnLineGames.afmb Trojan.Win32.OnLineGames.cvmqrs Troj.GameThief.W32.OnLineGames.afmb!c TrojWare.Win32.Magania.~D Trojan.PWS.Gamania.9849 BehavesLike.Win32.Sytro.nc Virus.Win32.Onlinegames.BBH TrojanDownloader.Small.unq Trojan[GameThief]/Win32.OnLineGames Trojan:Win32/Hookja.A Trojan-GameThief.Win32.OnLineGames.afmb Trojan/Win32.OnlineGameHack.R70066 Trojan.Win32.OnlineGames.10068 Win32.Trojan-gamethief.Onlinegames.Wvkq W32/Onlinegames.KKW!tr.pws


One of the most profitable cyber crimes in recent years is ATM robbery, where the cyber criminals extract cash directly from automated teller machines that have already been infected with malware, causing millions of dollars in loss for the banks worldwide.


A backdoor also known as: Ransome.Crowti.OB4 Tool.Patcher.Win32.14244 Trojan/Filecoder.CryptoWall.d Win32.Trojan.Filecoder.h Ransom.Cryptodefense Ransom_HPCRYPTESLA.SM2 Trojan.Win32.Encoder.dytusk Trojan.Encoder.514 Win32.Malware!Drop Ransom_HPCRYPTESLA.SM2 Variant.Symmi.bop TR/AD.Crowti.Y.580 Packed.Win32.Tpyn Win32.Trojan-Ransom.TeslaCrypt.N Win-Trojan/Inject.249861 Win32.Malware!Drop Win32/Filecoder.CryptoWall.D Trojan.Filecoder!cG6QHMIV+ig Trojan.Win32.Filecoder


A backdoor also known as: Adware.DLBoost.A4 Win32.Trojan.WisdomEyes.16070401.9500.9658 Exploit.Win32.Simadona.b Exploit.Win32.Simadona.eqnhht Trojan.RoboInstall.6 BehavesLike.Win32.Backdoor.wc Trojan.Win32.HackTool HackTool:Win32/Skipun.A!bit Exploit.Win32.Simadona.b PUP/Win32.DLBoost.C1760189 Win32/Trojan.Exploit.09b


Over the course of the last year, ESET has detected and analyzed several instances of malware used for targeted espionage – dubbed SBDH toolkit.


This article discusses a group of PlugX samples which we believe are all used by the same attackers, and the measures they have taken to attempt to bypass security mechanisms.


A backdoor also known as: Trojan.Win32.Obfuscated.en!O Trojan.Obfuscated.Win32.70479 Troj.W32.Obfuscated.tpfc Trojan/Obfuscated.a1 Win32.Trojan.WisdomEyes.16070401.9500.9999 Adware.Lop Win.Trojan.Obfus-22 Trojan.Win32.Obfuscated.en Virus.Win32.Sality.bgiylc Trojan.Win32.Obfuscated.3771904 TrojWare.Win32.Obfuscated.en Trojan.Packed.149 BehavesLike.Win32.Dropper.jh Trojan-Downloader.Win32.Swizzor Trojan/Win32.Obfuscated Win32.Troj.ObfuscatedT.cz.545792 Trojan:Win32/C2Lop.C Adware.Lop-Variant Trojan.Win32.Obfuscated.en MalwareScope.Trojan-Downloader.Obfuscated.2 Win32/Obfuscated.A1 W32/Swizzor.B!tr Win32/Trojan.Obfus.A


We are uncertain of its objectives but estimate it is criminally motivated.


The new text ( in Chinese , about relations between China , Japan and the disputed “ Senkaku Islands / Diaoyudao Islands / Diaoyutai Islands ” ) is shown to the victims and reads as following : When opened in a browser , this is what the command-and-control index page looks like : The text on the top means “ Title Title Title ” in Chinese , while the other strings appear to be random characters typed from the keyboard .


These attacks are themed around Middle Eastern political issues and the motivation appears to relate to espionage, as opposed to opportunistic or criminal intentions.


A backdoor also known as: BackDoor-CUR.svr Win32.Backdoor.Detarmal.b Backdoor.Trojan Backdoor.Win32.Delf.NBJ BackDoor.Cae.7 BehavesLike.Win32.Upatre.qh Backdoor:Win32/Detarmal.A Win32/Delf.NBJ W32/Detarmal.A!tr Bck/Furaxdoor.B Backdoor.Win32.Detarmal.A


A backdoor also known as: TROJ_GE.71380BE1 Trojan.Java.Crypt


However in this campaign, the binary payload, which was later found to be a NanoCore RAT client, is actually embedded in the obfuscated HTA.


This event triggers archive downloading thread .


A backdoor also known as: HW32.Packed.5B76 Trojan.Win32.Yakes.vpjr Trojan.Fakealert.49835 BehavesLike.Win32.PUPXAX.gc W32/Trojan.TMDY-2947 TR/Crypt.ZPACK.mnboo Trojan.Razy.D13B86 Trojan.Win32.Yakes.vpjr W32/Kryptik.EZWB!tr Trj/GdSda.A


LeakerLocker claims to have made an unauthorized backup of a phone's sensitive information that could be leaked to a user's contacts unless it receives a modest ransom.


We have made the connection to Bitter APT through tactics, techniques, and procedures TTPs that have been observed in other publications, such as the use of Microsoft Office exploits through Excel files, and the use of CHM and Windows Installer MSI files.


Pawn Storm is an active cyber espionage actor group that has been very aggressive and ambitious in recent years.


Telegram using IP address from Spain.


Today RSA is reporting GlassRAT, a previously undetectable Remote Access Tool RAT which was discovered by the RSA Incident Response Team and investigated by RSA Research during an engagement with a multi-national enterprise.


A backdoor also known as: Worm.Nanspy Worm.Nanspy.Win32.9 Win32.Trojan.WisdomEyes.16070401.9500.9990 W32/Nanspy.TXTE-7172 W32.Kassbot.B Win.Worm.Nanspy-1 Net-Worm.Win32.Nanspy.e Trojan.Win32.Nanspy.fwie W32.W.Bagle.kZt7 Heur.Packed.MultiPacked BackDoor.Pyev BehavesLike.Win32.HLLPPhilis.nc Trojan-Dropper.Delf W32/Nanspy.O I-Worm/Nanspy.d WORM/Nanspy.E Backdoor:Win32/Nanspy.D Worm.Win32.Net-Nanspy.34368.B Trojan/Win32.Lydra.R96925 Net-Worm.Win32.Nanspy.e Worm.Nanspy


As such, this new attack represents a dangerous new hybrid combining the work of a notorious cyber criminal gang with Chinese cyber espionage group to attack a financial services firm.


FireEye recently discovered a new variant of a point of sale POS malware family known as NewPosThings.


A backdoor also known as: Trojan/W32.Imiserv.245760 Trojan.Imiserv.c Trojan/Imiserv.c Trojan.Win32.Malware.1 Win32/Imiserv.C Adware.IEPlugin Trojan.Win32.Imiserv.c Trojan.Win32.Imiserv.B TrojWare.Win32.Imiserv.C Trojan.Win32.Imiserv.c TROJ_IMISERVER.A Trojan.Win32.Imiserv!IK Trojan.Win32.Imiserv.B Win-Trojan/Imiserv.245760 Trojan.Win32.Imiserv.c Trojan.Imiserv.G Trojan.Win32.Imiserv W32/Imiserv.C!tr Trj/Imiserv.M


A backdoor also known as: Trojan-Clicker.Win32.VB!O Trojan.VB.al3 Trojan.VB.Win32.56708 W32/Clicker.VB.fli TROJ_LNKIEB.SMI Win32/VB.BHE TROJ_LNKIEB.SMI Win.Trojan.Clicker-4258 Trojan-Clicker.Win32.VB.fli Trojan.Win32.VB.cnwqrx Trojan.Win32.A.Clicker.36892 Win32.Trojan.Vb.Angm TrojWare.Win32.Injector.AMXL TrojanClicker.VB.ffy TR/Lnkiebes.A.6 Trojan[Clicker]/Win32.VB Trojan.Buzy.D6DC Trojan-Clicker.Win32.VB.fli Trojan:Win32/Lnkiebes.A Trojan/Win32.VB.R5515 Trojan.VBRA.03765 Win32/Spy.Chekafev.AD Trojan.CL.VB!fBU5Dy6sJXo Trojan-Clicker.Win32.VB W32/VB.F!tr


A backdoor also known as: Trojan-Spy/W32.Small.9216.J Trojan/TopAntiSpyware.i TROJ_ANTISPY.B Win32.Trojan.WisdomEyes.16070401.9500.9859 W32/Trojan.QAS Adware.Topantispyware Win32/DlExaw.E TROJ_ANTISPY.B Html.Trojan.ClickerSmall-71 Trojan.Win32.TopAntiSpyware.j Trojan.Win32.TopAntiSpyware.ehkl Troj.W32.TopAntiSpyware.j!c Win32.Trojan.Topantispyware.Wsju TrojWare.Win32.TopAntiSpyware.~BAAB Trojan.DownLoader.2049 BehavesLike.Win32.Virut.zh Trojan.Win32.TopAntiSpyware.J W32/Trojan.MSMO-2253 Trojan/TopAntiSpyware.c Trojan/Win32.TopAntiSpyware Trojan:Win32/TopAntiSpyware.J Trojan.Win32.TopAntiSpyware.j Trojan/Win32.Adload.C82279 Adware.WarSpy.G


This example is from a later version of EventBot , and in other versions the naming convention is very similar , with bot IDs such as word100 , word101 , word102 , and test2005 , test2006 etc .


Locky .diablo6 campaign


What follows are some of the features exhibited by SpyNote RAT .


At the time of writing this research , four versions of the EventBot malware were observed : Version 0.0.0.1 , 0.0.0.2 , and 0.3.0.1 and 0.4.0.1 .


A backdoor also known as: Trojan.Injector.FC.81 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Dwn.dzugvc TrojWare.MSIL.Disfa.B Trojan.DownLoader17.15248 BehavesLike.Win32.Trojan.fc Trojan.MSIL.Crypt Trojan.Razy.D1AD5 Spyware.Imminent MSIL/Kryptik.EAN!tr Win32/Trojan.982


Using this and other dangerous applications uploaded by Linux.PNScan.1 to the compromised device, cybercriminals can hack administrative control panel of PHPMyAdmin, which is used to manage relational databases, and brute-force authentication credentials to get unauthorized access to various devices and servers via the SSH protocol.


During our analysis of this malware we uncovered interesting code paths and other artifacts that may indicate a Mac or Unix variant of this same tool also exists.


Aside from this campaign's motivation, what grabbed our attention was the way it utilizes pCloud, a free cloud service, for data storage and communication.


In this third part of Unit 42's Cybercrime Underground blog series, we're taking a slightly different approach.


These deceptive sites are carefully crafted to trick unsuspecting users into downloading and executing malware, which can result in stealing the victim's sensitive data.


A backdoor also known as: Trojan-PSW.Win32.QQPass!O Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/QQPass.ZQ Trojan-PSW.Win32.QQPass.gkd Trojan.Win32.QQPass.vwban Backdoor.W32.DsBot.l5eP Trojan.PWS.Lineage.10130 BehavesLike.Win32.RAHack.cm Trojan/PSW.QQPass.fng Trojan[GameThief]/Win32.Lmir Win32.Troj.QQPswT.bs.116858 Trojan.Graftor.Elzob.D486F Trojan.Tencent/Variant Trojan-PSW.Win32.QQPass.gkd SScope.Trojan-PSW.Win32.Delf.bav Worm.Win32.AutoRun


In May and June 2017, FireEye observed a phishing campaign targeting at least seven global law and investment firms.


A backdoor also known as: Trojan.Injector Trojan.Win32.Dwn.edybnj Trojan.Win32.Z.Razy.328168 Win32.Trojan.Falsesign.Phqf Trojan.DownLoader21.41335 Trojan.MSIL.Crypt TR/Dropper.MSIL.inryd Trojan.Razy.D11CB7 Trojan:Win32/Censer.A Trj/CI.A MSIL/Kryptik.GLN!tr Win32/Trojan.Dropper.32d


A strong relationship between previously identified malware samples attributed to these campaigns and the newly discovered samples examined in this report.


We have already seen large campaigns targeting Europe and other parts of the world in 2014 and 2015.


A backdoor also known as: Worm/W32.Chet.20484 W32/Chet.c@MM W32/Chet.e Trojan.Win32.Chet.emgc W32.Chet@mm Win32/Chet.E Email-Worm.Win32.Chet.e I-Worm.Chet!g52sFTlFeyo I-Worm.Win32.Chet.20484.C[h] Worm.Win32.Chet.E Win32.HLLM.Otchet.20484 Worm.Chet.Win32.4 W32/Chet.c@MM W32/Risk.ZNRZ-7753 I-Worm/Chet.a W32/Chet.E!worm Worm[Email]/Win32.Chet W32.W.Chet.e!c Win32/Chet.worm.20484.C Worm:Win32/Chet.E@mm Win32/Chet.E Worm.Chet Win32.Worm-email.Chet.Szlk Email-Worm.Win32.Chet I-Worm/Chet.C Worm.Win32.Chet.e


A backdoor also known as: Downloader.Small.Win32.7020 Trojan/Downloader.Small.bdc Win32.Trojan.WisdomEyes.16070401.9500.9963 W32/Downloader.DXO TROJ_TENGADL.A Win.Downloader.Tenga-1 Trojan-Downloader.Win32.Small.bdc Trojan.Win32.Small.glqe Trojan.Win32.Downloader.3072.B Troj.Downloader.W32.Small.bdc!c TrojWare.Win32.TrojanDownloader.Small.BDC Trojan.DownLoader.3449 TROJ_TENGADL.A W32/Downloader.GWIH-8231 TrojanDownloader.Small.bqb W32.Malware.Downloader TR/Dldr.Small.bdc.2 Trojan[Downloader]/Win32.Small TrojanDownloader:Win32/Gael.A Trojan-Downloader.Win32.Small.bdc Trojan/Win32.Downloader.C22709 Trojan-Downloader.Win32.Utenti Trj/Downloader.DNX Win32/TrojanDownloader.Small.BDC Win32.Trojan-downloader.Small.Wrpx Trojan.DL.Small!rnjf8eX9OeE Trojan-Downloader.Win32.Small W32/Small.BDC!tr


In order to infect the victims, the attackers distributed spear-phishing email, which purports to have been sent from NIC's Incident response team, the attackers spoofed an email id that is associated with Indian Ministry of Defence to send out email to the victims.


A backdoor also known as: Trojan.Paramcud TROJ_UMPER.SMSE Backdoor.Win32.3Para.e TROJ_UMPER.SMSE W32/Adware.KYIR-6825 Trojan.Adware.Symmi.D781 Trojan:Win32/Umper.A


A backdoor also known as: Trojan/IllNotifier.d TROJ_ILLNOTIF.D Win32.Trojan.WisdomEyes.16070401.9500.9964 TROJ_ILLNOTIF.D Trojan-Notifier.Win32.IllNotifier.d Trojan.Win32.IllNotifier.diak Trojan.Win32.IllNotifier.4096 Troj.Notifier.W32.IllNotifier.d!c Win32.TrojanNotifier.IllNotif.D Trojan.Illnot TrojanNotifier.IllNotifier.b TR/IllNotifier.D.1 Trojan-Notifier.Win32.IllNotifier.d Trojan:Win32/IllNotif.D TrojanNotifier.IllNotifier Trj/Notifier.C Win32/TrojanNotifier.IllNotif.D Trojan.IllNotifier!nSHIqsfdJ3I W32/IllNotifier.D!tr


EventBot requests permissions to always run in the background .


A backdoor also known as: W32.IrcbotFamTMS.Worm W32/CubsPewt.worm Backdoor.RBot.Win32.1857 Trojan.Heur.VP2.Cy2aaWGg!Jbi WORM_CUBSPEW.SMD Win32.Trojan.WisdomEyes.16070401.9500.9943 W32/Worm.ATKB W32.SillyFDC Win32/Cubspewt.E WORM_CUBSPEW.SMD Win.Trojan.Mybot-11593 Trojan.Win32.Rbot.baglt Win32.Worm.Autorun.Wqwe Win32.HLLW.Autoruner.7400 BehavesLike.Win32.Dropper.gc W32/Worm.ZJYN-5347 Backdoor/RBot.jco Trojan[Backdoor]/Win32.Rbot Worm:Win32/Cubspewt.A Backdoor.Win32.IRCBot.425984.C Worm/Win32.IRCBot.R7984 Backdoor.Rbot Backdoor.Rbot


Threat actors are now using this previously unseen executable, created by Samsung, to load variants of the PlugX Trojan.


Poison Ivy has a convenient graphical user interface GUI for managing compromised hosts and provides easy access to a rich suite of post-compromise tools.


A direct trail was established over a period of years that would lead competent researchers to finger CN operators as responsible for this new activity as well.


A backdoor also known as: Dropped:Trojan.Downloader.JKFJ Dropped:Trojan.Downloader.JKFJ Trojan.Downloader.JKFJ Trojan.DownLoad.6115 Dropped:Trojan.Downloader.JKFJ Trj/Downloader.MDW


A backdoor also known as: Trojan.Llac BKDR_COMDAR.SMI Win32.Trojan.WisdomEyes.16070401.9500.9967 BKDR_COMDAR.SMI Win.Trojan.Killav-107 Trojan.Win32.Llac.dpis Trojan.Win32.Hupigon.bjsvj Trojan.Win32.Z.Hupigon.631808 Troj.W32.Llac!c Backdoor.Win32.Amtar.~dkc1 BackDoor.Comet.345 Backdoor.Hupigon.Win32.87925 BehavesLike.Win32.Dropper.jh Trojan/Scar.bmme Trojan[Backdoor]/Win32.Hupigon TrojanDownloader:Win32/Hupigon.C Trojan.Win32.Llac.dpis Trojan/Win32.Hupigon.C98989 TScope.Trojan.Delf Win32.Trojan.Llac.Swuk Virus.Win32.Delf.DTW Win32/Trojan.713


A backdoor also known as: Dropped:Backdoor.SchoolBus.C Backdoor.Schoolbus BackDoor-BL.dr Backdoor.W32.Schoolbus!c W32/Backdoor2.XLL Backdoor.Trojan BKDR_SCHOOLBUS.C Dropped:Backdoor.SchoolBus.C Backdoor.Win32.SchoolBus.15 Dropped:Backdoor.SchoolBus.C Backdoor.Win32.Z.Schoolbus.257515 Dropped:Backdoor.SchoolBus.C Dropped:Backdoor.SchoolBus.C BackDoor.SchoolBus Email-Worm.Win32.GOPworm.196 BKDR_SCHOOLBUS.C BehavesLike.Win32.Dropper.dc W32/Backdoor.CDSN-7186 BDS/SchoolBus.C.DR.8 Backdoor:Win32/Schoolbus.C.dr Backdoor.Win32.SchoolBus.15 Backdoor/Win32.Trojan.C197204 Dropped:Backdoor.SchoolBus.C Email-Worm.Win32.GOPworm.196 Backdoor.Schoolbus Bck/Iroffer.BG Backdoor.SchoolBus.C Win32/SchoolBus.C Win32.Backdoor.Schoolbus.pfo Backdoor.SchoolBus.C Win32/Trojan.374


A backdoor also known as: Trojan.Downloader.JKVR Backdoor.Pingbed Trojan.Downloader.JKVR Win32.Trojan.WisdomEyes.16070401.9500.9987 W32/Backdoor2.HAEI BKDR_PINGBED.A Trojan.Downloader.JKVR Trojan.Downloader.JKVR Trojan.Downloader.JKVR Trojan.Downloader.JKVR BKDR_PINGBED.A BehavesLike.Win32.PWSOnlineGames.pt W32/Backdoor.DODB-2037 Backdoor:Win32/Pingbed.A Trojan/Win32.Dllbot.R15525 Trojan.Downloader.JKVR Win32/Trojan.Downloader.d4d


Mad Max is a targeted trojan that uses a domain generation algorithm DGA


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9987 Win.Trojan.Enfal-36 DLOADER.Trojan BehavesLike.Win32.BadFile.qt Trojan.Heur.EED22D0 Backdoor.Win32.PcClient


A backdoor also known as: W32.PgxviewI.Trojan Win32.Worm.Donked.b Win32/Donked.A Win.Worm.Autorun-7941 Win32.Worm.Donked.A Trojan.Disabler.64 W32/Autorun.worm.he Worm:Win32/Donked.A Win32/Autorun.worm.40960.DM W32/Autorun.worm.he I-Worm.Donked.A Win32/Donked.A Worm.Donked!DgcwScp6hHo W32/Donked.BB!tr Win32/Trojan.88a


A backdoor also known as: Trojan.MulDrop7.11292 Trojan.Injector.Win32.494093 Trojan.Fsysna.guw TR/AD.NETCryptor.xslwu Trojan.MSILPerseus.D15D13 Trojan/Win32.MSILKrypt.R210547 Trj/GdSda.A Trojan.Injector!cLW3TSG0Mi8


A backdoor also known as: W32.Flashy.Trojan Packed.Win32.TDSS!O Trojan.Disabler.Win32.3 Trojan/Disabler.i WORM_FLASHY.SM Win32.Trojan.WisdomEyes.16070401.9500.9999 W32.Glupzy.A Win32/Glupzy.A WORM_FLASHY.SM Win.Trojan.Disabler-3 Trojan.Win32.Disabler.i Trojan.Win32.Disabler.reit Trojan.Win32.Disabler.21185 Win32.Trojan.Fakedoc.Auto Trojan.Flashy BehavesLike.Win32.Dropper.cz Trojan/Disabler.al TR/Disabler.I Trojan/Win32.Disabler Worm:Win32/Glupzy.A W32.W.VB.kZz1 Trojan.Win32.Disabler.i Trojan/Win32.HDC.C51559 Trojan.Flasher.2913 RiskWare.Tool.CK Win32/Disabler.I Trojan.Disabler!sfd9qm983h8 Virus.Win32.Virut W32/Disabler.I!tr Trj/Flashy.A


A backdoor also known as: BehavesLike.Win32.Conficker.mc Trojan.Razy.D1B4E2


A backdoor also known as: Android.Trojan.Gamex.A Android.FakeUpdate.B Android.Trojan.Gamex.A Android.Trojan.Gamex.e AndroidOS/Gamex.A Android.Mobigapp A.H.Rog.Gamex.B Trojan:Android/Gamex.C Android.DownLoader.1561 AndroidOS/Gamex.A ANDROID/Mobigapp.A Android.Trojan.Gamex.A Android-Trojan/Gamex.1cbc Trojan.AndroidOS.FakeSite.A Android.Trojan.Gamex.A


The ransomeware also leaves the notes README_HOW_TO_UNLOCK.html and README_HOW_TO_UNLOCK.txt throughout the system.


A backdoor also known as: Trojan.Win32.Jorik.Banker!O Trojan.Zusy.D689D Win32.Trojan.WisdomEyes.16070401.9500.9545 W32/Trojan.WDRL-5915 Trojan-Banker.Win32.TuaiBR.edq Trojan.Win32.Zusy.dckfkl Troj.W32.Jorik.Banker.dnz!c Win32.Trojan-banker.Tuaibr.Wlfg Trojan.Jorik.Win32.164763 TR/Spy.Banker.UV Trojan/Win32.Banker TrojanProxy:MSIL/Banker.G Trojan-Banker.Win32.TuaiBR.edq Trojan/Win32.Proxy.C910983 MSIL/Banker.AK!tr.spy


A backdoor also known as: Trojan.Boaxxe.E Win32.Trojan.WisdomEyes.16070401.9500.9985 TROJ_ZBOT.SMUI Packed.Win32.Krap.iu Win32.Trojan.Falsesign.Dvgf TrojWare.Win32.Kryptik.ZLB Trojan.DownLoad3.832 TROJ_ZBOT.SMUI Trojan.Win32.Cleaman Trojan/Menti.sbs Trojan[Packed]/Win32.Krap Trojan:Win32/Cleaman.B Packed.Win32.Krap.iu Trojan/Win32.Menti.R20809 SScope.Malware-Cryptor.SB.01798 Bck/Qbot.AO Trojan.Conjar.8 Trojan.Kryptik!pGFdk5FNPhE Win32/Trojan.0ce


A backdoor also known as: SMSFraud.d Win32/Hoax.ArchSMS.KC Hoax.Win32.ArchSMS.hsgx Trojan.SMSSend.520 SMSFraud.d Hoax/Win32.ArchSMS Program:Win32/Pameseg.U Hoax.Win32.ArchSMS


A backdoor also known as: W32.ShitOverVBx.PE Trojan.Win32.Cosmu!O W32.Lamer.EL3 Trojan.Downloader Downloader.VB.Win32.9689 Troj.Downloader.W32.VB.l4ji Trojan/Downloader.VB.eex TROJ_DLOADR.SMM Win32.Virus.VBbind.a W32/Worm.BAOX W32.Besverit Win32/VB.P TROJ_DLOADR.SMM Virus.Win32.Lamer.el Trojan.Win32.VB.csnpye Worm.Win32.VB.kp Win32.HLLW.Autoruner.6014 BehavesLike.Win32.Dropper.rh W32/Worm.EMYS-2108 Trojan/VB.kro WORM/VB.NVA Virus/Win32.Lamer.el Trojan:Win32/Dorv.A Trojan.Win32.Downloader.90650.B Virus.Win32.Lamer.el Win32.Application.Unwanted.B Dropper/Win32.Cosmu.R14017 SIM.Trojan.VBO.0859 Trojan.Cosmu Win32/AutoRun.VB.JP Worm.VB.FMYJ Worm.Win32 W32/OverDoom.A Worm.Win32.VB.C


Starting on October 28, we found that these two vulnerabilities were being targeted by the Angler and Nuclear exploit kits.


Unfortunately, the attack is still active and the number of victims has been increasing.


An email with the subject of UK Fuels Collection pretending to come from invoices@ebillinvoice.com with a malicious word doc attachment delivers some sort of malware.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9805 Trojan.MulDrop7.45925 BehavesLike.Win32.Trojan.hc W32/Trojan.OQZZ-1308 TR/Ransom.JigsawLocker.dneeo Trojan.MSILPerseus.D1E5AF Ransom:MSIL/JigsawLocker.A Ransom.Jigsaw Trj/GdSda.A


A backdoor also known as: WS.Reputation.1 TROJ_SPNR.08JS11 TROJ_SPNR.08JS11 Trojan:MSIL/Reploxar.A Trj/CI.A


A backdoor also known as: W97M.Downloader.EAC O97M.Downloader.GQ W97M.Downloader.EAC W2KM_FAREIT.YYSVN W97M.Downloader.EAC W97M.Downloader.EAC Trojan.Script.MLW.egddty W97M.Downloader.EAC W97M.Downloader.EAC W2KM_FAREIT.YYSVN W97M/Downloader.bhi HEUR/Macro.Downloader Trojan:O97M/Macrobe.D W97M.Downloader.EAC W97M/Downloader.bhi virus.office.obfuscated.1


This group is known to have targeted U.S. government agencies, defense contractors, aerospace firms and foreign militaries since 2009.


Unfortunately, at any given point in time, there are thousands of sites that allow users to illegally stream pirated content, and they often manage to devise strategies that allow them to monetize their illegally sourced content with programmatic advertising.


A backdoor also known as: Downloader.Small.Win32.7325 Dialer.DialerPlatformLimited Win32.Trojan.WisdomEyes.16070401.9500.9994 W32/Downloader.AULY Trojan.Packed.14 Win32/TrojanDownloader.Small.CXG TROJ_OBFUSCAT.EY Win.Trojan.Dialer-266 Trojan.Win32.Busky.cvqace TrojWare.Win32.TrojanDownloader.Small.CXG Trojan.DownLoader.based Trojan-Downloader.Win32.Busky W32/Downloader.MCGP-7971 Trojan[Downloader]/Win32.Busky TrojanDownloader:Win32/Beenut.A Win32/SillyDl.PW MalwareScope.Trojan-Downloader.Obfuscated.1


We first detected members of this family back in March 2018 .


A backdoor also known as: Trojan.Potential.A Trojan/DownloaderKrap.ii Trojan.Zbot.6 Win32.Trojan.Kryptik.b W32.Priter Win32/SillyDl.YFM Packed.Win32.Krap.ii Virus.Win32.CrazyPrier.lrspi Packer.W32.Krap!c TrojWare.Win32.PkdKrap.II BehavesLike.Win32.HLLPPhilis.nh Packed.Krap.dqky Win32.Troj.fo.40176 TrojanDownloader:Win32/Potentialdownloader.A Packed.Win32.Krap.ii Trojan/Win32.Downloader.R3327 Trojan.Win32.Small.pck Trojan.Win32.Crazyman1649.A


A backdoor also known as: Win32.Lassab.A@mm Email-Worm.Win32!O W32/Lassa.b Worm.Lassorm.Win32.1 W32/Lassa.B Win32.Lassab.E90817 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Lassie.B Win.Worm.Lassorm-1 Win32.Lassab.A@mm Email-Worm.Win32.Lassorm Win32.Lassab.A@mm Trojan.Win32.Lassorm.emyb Win32.Lassab.A@mm Win32.Lassab.A@mm W32/Lassa.b Email-Worm.Win32.Lassorm Worm[Email]/Win32.Lassorm Worm:Win32/Lassab.A@mm Email-Worm.Win32.Lassorm Worm/Win32.Lassorm.C1532344 Win32.Lassab.A@mm Worm.Lassorm


A backdoor also known as: W32.HfsAutoB.DF97 Win32.Zafi.B@mm W32/Zafi.b@MM W32.W.Otwycal.l4av Win32.Zafi.B@mm Win32.Zafi.E2C45E Win32.Trojan.WisdomEyes.16070401.9500.9999 W32.Erkez.B@mm Email-Worm.Win32.Zafi.b Trojan.Win32.Zafi.icie Win32.Zafi.B@mm Win32.Hazafi.30720 BehavesLike.Win32.RAHack.mm I-Worm/Zafi.b Worm[Email]/Win32.Zafi Worm:Win32/Zafi.B@mm Email-Worm.Win32.Zafi.b Win32.Zafi.B@mm Win32.Zafi.B@mm W32/Zafi.B.worm Win32/Zafi.B


TA569 is a prolific threat actor primarily known for its deployment of website injections leading to a JavaScript payload known as SocGholish.


Accessibility Service is long known to be the Achilles ’ heel of the Android operating system .


Here is a nice example that my spam trap captured a few days ago.


A backdoor also known as: Trojan.Bebloh.Win32.427 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Injector.CMX TROJ_HPISDA.SM2 Trojan.Win32.NaKocTb.eiktob Trojan.Win32.Inject.213504 Troj.W32.Inject.tn8S BackDoor.Bebloh.272 TROJ_HPISDA.SM2 BehavesLike.Win32.Downloader.ch W32/Injector.UCTI-2382 Trojan.Inject.tpn Trojan/Win32.Inject Trojan.Strictor.D1C966 Backdoor:Win32/Carrotime.A Trojan/Win32.Inject.C1667127 Trj/RansomCrypt.J W32/Kryptik.FJVT!tr


A backdoor also known as: Worm.Downloader Worm.Downloader.Win32.3750 Win32.Trojan.WisdomEyes.16070401.9500.9984 Trojan.Dropper Win.Exploit.Fnstenv_mov-1 Worm.Win32.Downloader.am Trojan.Win32.Rubbish.evjgzp Trojan.Win32.Z.Downloader.135168.A Troj.GameThief.W32.OnLineGames.kZce Worm.Win32.Jalous.K Win32.HLLW.Rubbish BehavesLike.Win32.Downloader.ct Trojan.Win32.KillAV Worm/Downloader.ays EXP/Flash.EB.625 Worm/Win32.Downloader Win32.Troj.DwonLoaderT.xy.133203 Trojan:Win32/Elfapault.A Worm.Win32.Downloader.am Worm/Win32.Downloader.R2522 Win32/Jalous.K Win32.Worm.Downloader.Szlf


This can be anywhere from using the same strings, to weak obfuscation routines, or re-using the same snippet of code.


In July 2017 we discovered a malicious email sample delivering a new variant of Ursnif, attached within an encrypted Word document with the plaintext password within the email body.


A backdoor also known as: Trojan.Maener.A5 Trojan/CoinMiner.uy Trojan.Zusy.D19BD4 Win32/Tnega.AHKfcVD Win.Trojan.Maener-1 Trojan.Win32.BitCoinMiner.dfdxgr TrojWare.Win32.Graftor.PQIF Trojan.DownLoader11.43085 BehavesLike.Win32.AdwareLinkury.dm Trojan.Win32.CoinMiner Trojan:Win32/Maener.C!bit Trojan.BitCoinMiner Trojan.CoinMiner!oi2LJpWWJQU W32/CoinMiner.TY!tr Win32/Trojan.9e3


One of the packages after initial launch The iOS variant is not as sophisticated as the Android version , and contained a subset of the functionality the Android releases offered .


You can find a full list of targeted models in the Appendix .


Recently, the Winnti group, a threat actor with a past of traditional cybercrime -particularly with financial fraud, has been seen abusing GitHub by turning it into a conduit for the command and control C and C communications of their seemingly new backdoor detected by Trend Micro as BKDR64_WINNTI.ONM.


A backdoor also known as: Backdoor.Vinself.B Trojan.Vinself Trojan.PWS.DPD.8 BehavesLike.Win32.VTFlooder.ch Trojan.Symmi.DA32B Backdoor:Win32/Wakbot.B Trj/CI.A


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Win32.Banker.evqhye BehavesLike.Win32.Dropper.ph W32/Trojan.SNBX-9361 TR/Spy.Banker.fyxgc Trojan.Symmi.DC916 Trj/GdSda.A Win32/Trojan.e6d


A backdoor also known as: W32.eHeur.Virus02 Win32.Trojan.WisdomEyes.16070401.9500.9888 Trojan.Giku.Win32.37 BehavesLike.Win32.Ransomware.fc TrojanDownloader:Win32/Gladgerown.B Trojan-Proxy.AOSK


While Panda Banker has become more prevalent in recent weeks, we have been tracking a large campaign this week targeting banks in Europe and Australia and, interestingly, UK online casinos and international online payment systems.


Information about the C & C domain used by the Ashas adware Knowing that the information provided to a domain registrar might be fake , we continued our search .


A backdoor also known as: Trojan.Zusy.D22B33 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Hijacker.evkwtm Trojan.DownLoader25.54001 Trojan.Win32.Pastraw Trojan:Win32/Nibagem.A Trojan/Win32.Asprox.C718808 SScope.Backdoor.Sdbot W32/Pastraw.A!tr Win32/Trojan.d54


A backdoor also known as: Trojan.YakesCS.S1573857 Trojan.Ransom.Sage Trojan.Filecoder.Win32.6418 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.HXTV-7683 Ransom.Cry!g2 Trojan.Win32.Filecoder.etsgeu TrojWare.Win32.Filecoder.GT Trojan.DownLoader25.46287 BehavesLike.Win32.Downloader.gc Trojan.Yakes.xat TR/Crypt.ZPACK.hzbag Trojan.Win32.Sage.442368 Trojan.Yakes Ransom.FileCryptor Win32/Filecoder.NHQ Trojan.Yakes!0Hl2Fx4Uudk


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9912 Backdoor:Win32/Ptiger.A


A backdoor also known as: Trojan.Vreikstadi Trojan.Win32.Inject.evlgqj Trojan.Win32.Injector W32/Trojan.HMUN-3172 TR/Injector.avgqa Trj/GdSda.A


A backdoor also known as: W32.LogoOneR.PE Worm.Win32.Viking!O W32/HLLP.Philis.ba Worm.Viking.Win32.8 Trojan/PSW.Delf.qo Win32.Worm.Viking.a W32/PWStealer.AOC W32.Looked.P PE_LOOKED.FX Win.Spyware.11941-2 Worm.Win32.Viking.mi Trojan.Win32.Viking.btggzy Worm.Win32.Viking.49152 Worm.Win32.Viking.ae Win32.Viking.AT~clean Win32.HLLW.Gavir.93 PE_LOOKED.FX BehavesLike.Win32.HLLPPhilis.dz Worm.Win32.Viking Worm/Viking.el Worm/Win32.Viking.mi Win32.Viking.av.49152 Virus:Win32/Viking.JB Backdoor.W32.Bifrose.lz9q Worm.Win32.Viking.mi MalwareScope.Worm.Viking.4 Win32/Viking.AT Worm.Viking.FP W32/Viking.WH.worm


A backdoor also known as: Trojan.Downloader.Sherlol.A Trojan-Downloader/W32.Sherlol.4608 Trojan/StartPage.cj Trojan.Downloader.Sherlol.A Trojan.DL.Sherlol!c8F6ghXOM0o Win32/TrojanDownloader.Sherlol Trojan-Downloader.Win32.Sherlol Trojan.Win32.Sherlol.dngr Trojan.Win32.Downloader.4608.EN[h] Trojan.Downloader.Sherlol.A TrojWare.Win32.TrojanDownloader.Sherlol Trojan.Downloader.Sherlol.A Trojan.DownLoader.4608 Downloader.Sherlol.Win32.3 BehavesLike.Win32.Downloader.xt TrojanDownloader.Satray.k TR/Dldr.Sherlol W32/Sherlol.CJ!tr Trojan[Downloader]/Win32.Sherlol Trojan.Downloader.Sherlol.A Troj.Downloader.W32.Sherlol!c Win-Trojan/Sherlol.4608 Win32/Startpage.CJ!downloader Trojan.Downloader.Sherlol.A Trj/Downloader.CET Trojan.Win32.StartPage Trojan.Downloader.Sherlol.A Downloader.Sherlol.B


A backdoor also known as: Trojan.Sirefef.FR Trojan.Sirefef.FR Win32.Trojan.Sirefef.b Trojan.Sirefef.FR Trojan.Sirefef.FR BackDoor.Maxplus.5220 BehavesLike.Win64.Ramnit.pt Trojan.Win64 Trojan[Backdoor]/Win64.ZAccess Trojan.Sirefef.FR Trojan:Win64/Sirefef.F Trojan.Sirefef.FR Win64/Sirefef.W


HenBox appears to primarily target the Uyghurs – a minority Turkic ethnic group that is primarily Muslim and lives mainly in the Xinjiang Uyghur Autonomous Region in North West China .


A backdoor also known as: Trojan.BAT.Starter.bn Bat.Trojan.Starter.Aliq Backdoor:Win32/Teldoor.C Trojan.BAT.Starter.bn Trojan/Win32.Dropper.C406140 Trojan.Horst.0315 Trj/GdSda.A


A backdoor also known as: Trojan.Symmi.D2391 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Neshgaig-1 BehavesLike.Win32.Worm.gc W32/Trojan.MVJF-1155 Heur:Trojan/PSW.Dnf TrojanDownloader:Win32/Somex.B TrojanSpy.TravNet Trj/GdSda.A


The operation remains active at the time of writing this post, with attacks reported as recently as February 2017.


The malware authors are currently targeting users of Mexico s second largest bank, Banamex, but it is capable of updating the configuration file to include more financial institutions.


A backdoor targetting Linux also known as: Trojan.Linux.ChinaZ.D Trojan-DDoS.Linux.Znaich.A Trojan.Linux.ChinaZ.D ELF_ZANICH.SMB Trojan.Linux.ChinaZ.D HEUR:Trojan-DDoS.Linux.Znaich.a Trojan.Linux.ChinaZ.D Trojan.Znaich.exfzmb Troj.Ddos.Linux!c Trojan.Linux.ChinaZ.D Trojan.Linux.ChinaZ.D Linux.DDoS.73 Trojan.ChinaZ.Linux.14 ELF_ZANICH.SMB Linux/DDoS-Flood.B ELF/Trojan.ULZK-7 TrojanDDoS.Linux.ax LINUX/ChinaZ.eevfy Trojan[DDoS]/Linux.Znaich.a Trojan.Linux.ChinaZ.D Linux/Ddos.1806356 HEUR:Trojan-DDoS.Linux.Znaich.a Linux/DDoS-Flood.B Trojan.Linux.Znaich.aaac DDOS.Linux.CinaZ Win32/Trojan.9b6


Bartalex is a name that continues to appear in a cyberthief's arsenal as one of the most popular mechanisms for distributing banking Trojans, ransomware, RATs, and other malware.


It is no surprise it's now being used against pro-democracy organizations and supporters in Hong Kong that have long been a target of advanced attack campaigns.


A backdoor also known as: W32.OnGameBTP.Worm Trojan-PWS/W32.WebGame.34816.CL Trojan-GameThief.Win32.OnLineGames!O Trojan.Downloader.E9C186 Win32.Trojan.WisdomEyes.16070401.9500.9991 W32/Pws.AHAF Trojan.Win32.OnLineGames.cwndth Trojan.Win32.Z.Onlinegames.34816.AS Trojan.PWS.Gamania.10257 Trojan.OnLineGames.Win32.121510 Trojan-GameThief.Win32.OnLineGames Trojan/PSW.OnLineGames.aibk Trojan[GameThief]/Win32.OnLineGames Win32.Troj.Downloader.gy.kcloud Trojan/Win32.OnlineGameHack.C55967 W32/OnlineGames.SOI!tr.pws Win32/Trojan.2ff


Version 2, also referred to as Globe2, appeared two months later, in October, but both versions were no match for Emsisoft's team, who released free decrypters for both variants shortly after Globe and Globe2 started hitting users.


A backdoor also known as: JS:Trojan.JS.Redirector.BS JS.Redirector.DE JS:Trojan.JS.Redirector.BS JS/Redir.WI Trojan.Malscript!html JS:Trojan.JS.Redirector.BS JS:Trojan.JS.Redirector.BS Trojan.Script.Expack.drqfka JS:Trojan.JS.Redirector.BS JS:Trojan.JS.Redirector.BS BehavesLike.PDF.Trojan.db JS/Redir.WI TrojanDownloader.JS.aufd JS/Redirector.OA.1 JS:Trojan.JS.Redirector.BS


Other samples were also noticed , posing as a client of a ticket-finding service or as an app store for Android .


A backdoor also known as: TSPY_WHITEICE_BK22015F.TOMC Win32.Worm.WhiteIce.a TSPY_WHITEICE_BK22015F.TOMC Trojan.Win32.WhiteIce.cyctb Win32.Virus.Whiteice.Tcvt Win32.HLLW.Bice.8 BehavesLike.Win32.Trojan.jh Virus.Win32.Whiteice WORM/Darksnow.37953.2 Worm/Win32.WhiteIce.R35142 Worm.WhiteIce Win32/Whiteice.B Worm.WhiteIce!tYiT3Eh27BE Trj/CI.A Virus.Win32.BlackIce.C


A backdoor also known as: JS/ProxyJack.C1!Eldorado JS.Downloader JS/ProxyChanger.BF BehavesLike.JS.Exploit.mm JS/ProxyJack.C1!Eldorado TrojanProxy:JS/Kovonionz.A JS/Nemucod.io Trojan.JS.ProxyChanger JS/ProxyChanger.BF!tr


This software is free and distributed under LGPL license .


The Trojan uses the Windows Management Instrumentation Command-line WMIC to start processes remotely on other Windows computers.


New OSX_DOK.C variant performing MiTM.


A backdoor also known as: W32.SwenA.Worm Worm/W32.Swen.151552 Email-Worm.Win32!O W32.Swen.A W32.W.Swen!c Win32.Trojan.WisdomEyes.16070401.9500.9969 W32/Swen.A@mm W32.Swen.A@mm Win32/Swen.A Win.Worm.Gibe-4 Trojan.Win32.Scar.fcci Trojan.Win32.Swen.gicl I-Worm.Win32.Swen.106496 Win32.Trojan.Scar.Wofg Worm.Win32.Swen.A Win32.HLLM.Gibe.2 Worm.Swen.Win32.3 Email-Worm.Win32.Swen W32/Swen.A@mm Trojan/Win32.Scar Trojan.Win32.Scar.fcci Worm:Win32/Swen.A@mm Email-Worm.Win32.Swen W32/Gibe.C.worm I-Worm.Swen.A Win32/Swen.A I-Worm.Swen.A1 W32/Swen.A@mm


Information about all actions performed by Rotexy is logged in the local database and sent to the C & C .


A backdoor also known as: W32.GekasiK.Trojan Worm.Foler.E5 WORM_SILLY.WXXZLDR Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Hangove WORM_SILLY.WXXZLDR Virus.Win32.Renamer.u ApplicUnwnt.Win32.ArchSMS.DRPA Worm.Renamer.Win32.2 BehavesLike.Win32.Virus.gm Trojan.Win32.Webprefix Virus/Win32.Renamer.u Trojan.Zusy.D15B99 Virus.Win32.Renamer.u Worm:Win32/Foler.C Worm.Win32.Foler.a W32/Foler.A!worm Win32/Worm.b18


Looking closer at the structure of this attack, we were surprised when we realized this was the infamous Blackhole.


In May we also observed an Office 365 credential phishing attack leading to iSpy Keylogger but the combination of OWA with this infection chain takes a different approach.


New activity from NewPOSThings and the You Chung actor.


A backdoor also known as: W32.OnlineGameNAKSD.Trojan Trojan-Downloader.Win32.VB!O Trojan.VBCrypt.MF.90 Downloader.VB.Win32.66970 Trojan/Downloader.VB.zqs Trojan.Heur.ZGY.5 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan3.BYE Backdoor.Trojan Win32/Axespec.C TSPY_ZBOT.BVV Trojan-Downloader.Win32.VB.zqs Trojan.Win32.VB.bcwli Trojan.Win32.Downloader.71680.CE Trojan.Oficla.59 TSPY_ZBOT.BVV BehavesLike.Win32.PWSAxespec.wc Trojan-Ransom.Win32.PornoBlocker TrojanDownloader.VB.dfho PWS:Win32/Axespec.C Troj.Downloader.W32.VB.tnTN Trojan-Downloader.Win32.VB.zqs Trojan/Win32.FakeAV.R51073 PWS-Axespec.f SScope.Trojan.VB.0862 Trojan.Dropper.VB Trojan.Injector.SOC W32/Injector.VOX!tr


A backdoor also known as: Trojan.VB.bjci Trojan.Win32.VB.bkqmep VBTroj.MYNR Trojan.Win32.VB.bjci Trojan.DL.VB!OZxgAC/E/K8 Trojan.Win32.A.VB.1289216[ASPack] TrojWare.Win32.VB.baur Trojan.DownLoader5.27404 Trojan/Win32.VB W32/Trojan.SXSN-1674 Trojan.VB Trojan-Downloader.VB Downloader.VB.7.BG Trj/CI.A


A backdoor also known as: Heur.Corrupt.PE BehavesLike.Win32.Rontokbro.nc TrojanDownloader.Femad.at HackTool[Constructor]/Win32.Bom Constructor:Win32/Bom.7_0.dam#2


Unit 42 has discovered a new malware family we've named Reaver with ties to attackers who use SunOrcal malware.


This article will walk through an incident where Tomcat is used and what critical artifacts you should collect.


Check Point Research's new report on Chinese cyber-espionage attacks against Southeast Asian government entities shows that a previously undisclosed toolset used by an APT group has been linked to a new family of malware.


A backdoor also known as: WORM_RBOT.AS Win32.Trojan.WisdomEyes.16070401.9500.9761 W32/Backdoor2.DNGR Win32/SillyAutorun.AIH WORM_RBOT.AS Packed.Win32.CPEX-based.ht Trojan.Win32.CPEXbased.bregf Trojan.MulDrop.23017 W32/Backdoor.MVUH-2689 Backdoor/VB.nkv Packed.Win32.CPEX-based.ht Trojan/Win32.Xema.R61630


The actors involved seem to be the same as the ones behind the self sufficient Flash malverts/exploits we've documented before and also reported by security researcher Kafeine Spartan EK.


A backdoor also known as: Trojan.NSIS.Miner.SD Trojan.Strictor.D1B5F4 Multi.Threats.InArchive W32/Trojan.RYKP-1781 WORM_CO.331300D2 Win.Trojan.Virtob-1633 Trojan.Win32.CoinMiner.bn Trojan.Win32.BitCoinMiner.ddjqfi AdWare.W32.OneInstaller.lZ9E Win32.Trojan.Miner.Wwen Trojan.BtcMine.1033 WORM_CO.331300D2 BehavesLike.Win32.TrojanCoinMiner.vc Trojan.NSIS.Coinminer W32/Trojan2.OZCV Trojan/PSW.Tepfer.cbjx Trojan/Win32.Miner.ayf Trojan:Win32/CoinMiner.AQ Trojan.Win32.CoinMiner.bn Trojan/Win32.BitCoinMiner.C931392 RiskWare.BitCoinMiner NSIS/CoinMiner.N W32/Miner.AYF!tr Trj/CI.A


A backdoor also known as: W32.OnlinegameXMQB.Trojan Trojan.FlyStudio.UJ W32/AutoRun.soq Win32.Trojan.FlyStudio.hd W32.SillyFDC Win32/Nuj.AD WORM_FLYSTUDI.B Win.Worm.FlyStudio-23 Trojan.Win32.Crypted.wjgrc Worm.Win32.Autorun.175133 W32.W.AutoRun.l8Zk Trojan.Click2.51706 Worm.AutoRun.Win32.2576 WORM_FLYSTUDI.B BehavesLike.Win32.Autorun.bc Trojan.Win32.FlyStudio Worm/AutoRun.fpz Worm/Win32.FlyStudio Worm:Win32/Regul.B Worm.FlyStudio Trj/FlyStudio.CR Trojan.FlyStudio.NAQ Win32/FlyStudio.NAQ Trojan.Win32.FakeFolder.t


In this blog entry, we will introduce and analyze the other tools and malware used by Earth Preta.


This IP address has been observed attempting to bruteforce SSH server credentials, SSH, which stands for Secure Shell, is a [network protocol]https://null-byte.wonderhowto.com/how-to/networking-basics/ that allows for encrypted communication over an insecure network.


Facebook profile of the C & C domain registrar ( cover picture and profile picture edited out ) Linked on the malicious developer ’ s Facebook profile , we discovered a Facebook page , Minigameshouse , and an associated domain , minigameshouse [ .


A backdoor also known as: W32.FakeDirC.Worm Win32.Tyhos.A Virus.Win32.Tyhos!O Trojan.Malex.F2 Virus.Tyhos.Win32.4 Win32.Tyhos.A W32.Virut.CF Win32/Tyhos.A Virus.Win32.Tyhos.a Win32.Tyhos.A Trojan.Win32.Tyhos.bdclx Packer.W32.Tibs.l4Hz Trojan.Win32.FakeFolder.mgge Win32.Tyhos.A Win32.Tyhos.A Trojan.Styho BehavesLike.Win32.VirRansom.ph Win32/Virut.bv Virus/Win32.Tyhos.a Worm:Win32/Nestog.A Virus.Win32.Tyhos.a Win32.Tyhos.A HEUR/Fakon.mwf Win32.Tyhos.A Win32.Virut.NAB Win32/Virut.NBP Virus.Win32.Tyhos Trj/Tyghos.A Win32/Virus.4bd


A backdoor also known as: Trojan.Tapslix RDN/Autorun.worm!e Win32.Trojan.WisdomEyes.16070401.9500.9995 W32/Trojan.PONZ-7153 Trojan.DownLoader5.52616 RDN/Autorun.worm!e Trojan/Win32.Unknown Trojan.Strictor.D4F65 Trojan:Win32/Tapslix.A HEUR/Fakon.mwf Win32.Trojan.Fakedoc.Auto Trojan.CFI!dl5uaEh6TdQ W32/Yoddos.AG!tr


THURSDAY , OCTOBER 11 , 2018 GPlayed Trojan - .Net playing with Google Market Introduction In a world where everything is always connected , and mobile devices are involved in individuals ' day-to-day lives more and more often , malicious actors are seeing increased opportunities to attack these devices .


Operation Black Atlas has already spread to a multi-state healthcare provider, dental clinics, a machine manufacturer, a technology company focusing on insurance services, a gas station that has a multi-state presence, and a beauty supply shop.


Within the framework of the analyzes, however, the BSI has not discovered any malicious software; infections are also not known to the BSI.


+86.01078456689 Fax .


A backdoor also known as: Backdoor/W32.Death_Packed.439808 BackDoor-FP.cli Backdoor.Death!/0dScPy2Eok Win32/Death.23 W32/Death.C Backdoor.Trojan W32/Death.2_3 Trojan.Win32.Heur.089 Win32.Death.23 Backdoor.Win32.Death.23 Backdoor.Death.23 Backdoor.Win32.Death.23 Backdoor.Death.23 BackDoor.Death.23 TR/Dearh.23.Cli Backdoor.Win32.Death!IK Backdoor/Death.23 Backdoor/Win32.Death Backdoor.Win32.Death_23.Client Backdoor.Death.23 W32/Death.C Win-Trojan/Death.439808 Backdoor.Trojan Backdoor.Win32.Death W32/Backdoor.LamersDeath-FP BackDoor.Death Bck/Death.23.I


A backdoor also known as: Trojan.Fareit W32/Injector.GFG Trojan.Win32.Stealer.ewulwv Trojan.Win32.Z.Injector.999936 Trojan.PWS.Stealer.20566 Trojan.Win32.Injector W32/Injector.NZPO-0886 DR/Delphi.pzjjj Trojan[Backdoor]/Win32.Androm Trojan/Win32.Inject.R217517 Backdoor.Androm Trj/CI.A Win32.Trojan.Delf.Swaz W32/Injector.DVFA!tr Win32/Trojan.986


A backdoor also known as: Backdoor.Temratanam Trojan.MaskedTeamViewer Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.SCHM-2542 TROJ_GE.52AE4DE2 Backdoor.Win32.TeamBot.cq Trojan.Win32.TeamBot.eutqba BackDoor.TeamViewer.45 TROJ_GE.52AE4DE2 BehavesLike.Win32.Backdoor.tc Backdoor:Win32/Temratanam.A Backdoor.Win32.TeamBot.cq PUP/Win32.StartSurf.R196040 Backdoor.TeamBot Trj/GdSda.A


A backdoor also known as: W32.RugoAd.Fam.Trojan TrojanDropper.Purgodoor.A5 TROJ_DROPR.SMD1 Adware.Rugo TROJ_DROPR.SMD1 AdWare.W32.BHO.lhD4 ApplicUnsaf.Win32.AdWare.BHO.AM Trojan.MulDrop1.42303 BehavesLike.Win32.Downloader.gc Adware/MsLock.akh GrayWare[AdWare]/Win32.BHO TrojanDropper:Win32/Purgodoor.A Dropper/Win32.Cadro.R1482 Adware-Rugo.f AdWare.BHO Trj/CI.A Win32.Trojan.Obfuscator.Ajla not-a-virus:AdWare.Win32.BHO Win32/Trojan.b5d


A backdoor also known as: Backdoor/W32.InfecDoor.746584 Backdoor.InfecDoor!stFv1Z+nlTE Win32/Infector.20.A Backdoor.Surgeon BKDR_INFDOOR20.A Win32.InfecDoor.20.a Trojan.Infector-17 Backdoor.Win32.InfecDoor.20.a Backdoor.Win32.InfecDoor!IK Backdoor.Win32.Infector.20.A BackDoor.Infector.20 BDS/Infect.20.Srv2 BKDR_INFDOOR20.A Win32/Theinf.20.B Backdoor/Infector.20.a Backdoor:Win32/Infector.2_0 Backdoor.Win32.InfecDoor_20 Win-Trojan/Infecdoor.746584 Backdoor.Surgeon Backdoor.Win32.InfecDoor BackDoor.Infector Bck/Infector.20


We believe the threat actors behind the attack don't use exploit kits and automated installers to instantly compromise and infect victims.


A backdoor also known as: Win32.Trojan-Downloader.Small.alkd.3.Pack W32/Downldr3.EY Trojan-Downloader.Win32.Small.aowd Trojan.DownLoad1.37207 TROJ_DOWGAV.SMF Win32/SillyDl.NUS W32/Downldr3.EY TrojanDownloader.Small.aqlm Trojan-Downloader.Win32.Small!IK TrojanDownloader:Win32/Dowgav.A Trojan-Downloader.Win32.Small.aowd Trojan-Downloader.Win32.Small Trj/CI.A


Presumably , this was done to make the app seem more credible to targeted users in different countries .


Using their advanced toolkit, the Turla group compromise networks for the purposes of intelligence collection.


A backdoor also known as: Trojan.Zenshirsh.SL7 Packer.W32.Krap.lFn4 Win32.Trojan.WisdomEyes.16070401.9500.9995 TSPY_EMOTET.SMD12 Trojan.Win32.Gozi.euritn BackDoor.Gozi.135 TrojanSpy.Ursnif.afo TR/Crypt.Xpack.ekgur Trojan:Win32/Trriloa.A Trj/CI.A Trojan.Win32.Krypt Win32/Trojan.8ad


The infection vector is a Hangul Word Processor document HWP, a popular alternative to Microsoft Office for South Korean users developed by Hancom.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 BehavesLike.Win32.Trojan.cc TR/Crypt.ZPACK.oltlq Trojan.Barys.DD8C9 HackTool:Win64/Mimikatz.A Win-Trojan/MSILKrypt02.Exp Trojan.MSIL.Inject MSIL/Injector.QOT!tr Trj/GdSda.A


This document likely marks the first observed use of this technique by APT28.


The adversaries appear to have evolved their tactics and techniques throughout the tracked time-period, iterating through a diverse toolset across different waves of attacks.


A day before the controversial United States Presidential elections, an email was distributed to inform the recipients of a possible attack during election day as mentioned in a manifesto, allegedly from the ISIS terrorist group, entitled The Murtadd Vote


The C2 backend url looks like this : https : //evilhost/c2folder/njs2/ ? fields [ ] .


A backdoor also known as: Rootkit.Win32.Stuxnet!O Trojan/Stuxnet.a Win32/PcClient.ACH RTKT_STUXNET.SMA Win.Worm.Stuxnet-10 Rootkit.Win32.Stuxnet.a Trojan.Win32.Stuxnet.ioljg Trojan.Win32.Stuxnet.19968 Rootkit.W32.Stuxnet!c Win32.Rootkit.Stuxnet.Hxqi Trojan:W32/Stuxnet.A Trojan.Stuxnet.1 Rootkit.Stuxnet.Win32.5 RTKT_STUXNET.SMA Rootkit.Stuxnet.b W32.Stuxnet Trojan[Rootkit]/Win32.Stuxnet Win32.Troj.LnkExploit.aa.26616 Trojan.Graftor.DB580 Rootkit.Win32.Stuxnet.a Trojan:WinNT/Stuxnet.A Win-Trojan/Stuxnet.26872 SScope.Rootkit.TmpHider.2 Rootkit.Stuxnet.Z Rootkit.Win32.Stuxnet W32/Stuxnet.A!tr.rkit Win32/RootKit.Rootkit.f73


Also , the botnet IDs increment over time as they are submitted .


A backdoor also known as: Trojan/Fleercivet.aa Win.Trojan.Fleercivet-3 BackDoor.Fleercivet.42 Trojan.Fleercivet.Win32.81 Trojan:Win64/Fleercivet.A Win64/Fleercivet.AA Trojan.Fleercivet!


The threat group amassed a significant amount of data, from Skype account databases to planning documents and spreadsheets to photos.


Instead of running its service only at boot time , it registers a receiver that listens to the “ android.intent.action.SCREEN_ON ” and “ android.provider.Telephony.SMS_DELIVER ” broadcast actions .


A backdoor also known as: Trojan.Spinfy.A4 Trojan/Injector.uni TROJ_FINSPY.A Win32.Trojan.WisdomEyes.16070401.9500.9985 W32/FinFish.ZBVH-2442 Backdoor.Finfish TROJ_FINSPY.A Win.Trojan.FinFisher-1 Backdoor.Win32.Finfish.a Backdoor.W32.Finfish.a!c TrojWare.Win32.FinSpy.A Trojan.MulDrop3.31380 Backdoor.Finfish.Win32.3 W32/FinFish.A Trojan[Backdoor]/Win32.Finfish Trojan:Win32/Spinfy.A Trojan.FinFisher.1 Backdoor.Win32.Finfish.a Backdoor/Win32.Finfish.C198683 Trj/CI.A Win32.Backdoor.Finfish.Eeri Backdoor.Finfish!glcRlW9Rsiw Trojan.Win32.Finspy W32/Finfish.A!tr.bdr Win32/Trojan.5ec


Philadelphia has many features, including the ability to generate PDF reports and charts of victims to track the campaigns, as well as the ability to plot victims around the world using Google Maps.


Is UrlZone still a threat and if so, how has it changed?


In this version of Rotexy , dynamic generation of lowest-level domains was not used .


JPCERT/CC has been observing attacks using Datper since around June 2016.


A backdoor also known as: TrojanDropper.Dapato.S8172 TROJ_INDIGOROSE_FC140186.UVPM TROJ_INDIGOROSE_FC140186.UVPM Trojan.Win32.IndigoRose.eujbip Trojan.Win32.Z.Indigorose.2334813 Trojan.DownLoader21.23836 BehavesLike.Win32.BadFile.vh TR/Dldr.IndigoRose.xrkh TrojanDownloader:Win32/Inros.A Downloader.AdLoad Trj/CI.A Win32/TrojanDownloader.IndigoRose.AI Trojan-Downloader.Win32.Indigorose Win32/Trojan.b3d


A backdoor also known as: VB:Trojan.Valyria.1019 O97M.Dropper.BS VB:Trojan.Valyria.1019 VB:Trojan.Valyria.1019 Trojan.Ole2.Vbs-heuristic.druvzi VB:Trojan.Valyria.1019 VB:Trojan.Valyria.1019 HEUR_VBA.D TrojanDownloader:O97M/Crosspim.A VB:Trojan.Valyria.D3FB VB:Trojan.Valyria.1019 VBA/TrojanDownloader.DZN!tr virus.office.qexvmc.1075


Unit 42 has recently discovered a new keylogger, named NexusLogger, being used in attempted unsuccessful attacks against Palo Alto Networks customers.


They seem to use the same technique of mimicking a website associated with well-known software like Notepad++ and Blender 3D.


A backdoor also known as: Trojan.Razy.D39F0E Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.DownLoader25.65030 BehavesLike.Win32.Trojan.bh TrojanDropper:MSIL/Muldalun.A!bit


In May 2017, Palo Alto Networks Unit 42 identified a limited spear phishing campaign targeting various individuals across the world.


A backdoor also known as: Trojan.Win32.Androm.drayhs Trojan.DownLoader18.10874 Downloader.Banload.Win32.64034 Trojan/Inject.axyw TrojanDownloader:Win32/BrobanLaw.A Trojan.Strictor.D15B7B Trojan/Win32.MDA.R160449 Trojan.Banker.IGF


A backdoor also known as: W32.LibarokI.Trojan Trojan/Scar.ejki Win32.Trojan.WisdomEyes.16070401.9500.9609 Trojan.Badlib Win.Downloader.Delf-12262 Trojan.Win32.Scar.256000.B Trojan.DownLoader4.22959 Trojan.Scar.Win32.50666 Backdoor.Win32.Bafruz Backdoor:Win32/Bafruz.C Trojan.Delf.01357 Bck/Koobface.AA


A backdoor also known as: Trojan.Bagsu.S31234 Trojan/IRCBot.nhr BKDR_IRCBOT.SMB Backdoor.IRC.Bot BKDR_IRCBOT.SMB BehavesLike.Win32.Dropper.cm Backdoor.Win32.Ursap Backdoor.Athena Win32/IRCBot.NHR


It is mainly an information stealer and malware downloader network which installs other malware on infected machines.


A backdoor also known as: Trojan.PSW.FakeAIM.C Trojan.PSW.FakeAIM.C Trojan.PSW.FakeAIM.C W32/PWS.BXQR-8711 Infostealer.Snatch Trojan.PSW.FakeAIM.C Trojan-PSW.Win32.FakeAIM.d Trojan.PSW.FakeAIM.C Trojan.Win32.FakeAIM.dgtt Trojan.Win32.PSWFakeAIM.78848 Troj.PSW32.W.FakeAIM.c!c Trojan.PSW.FakeAIM.C TrojWare.Win32.PSW.FakeAIM.D Trojan.PSW.FakeAIM.C Trojan.PWS.Fakeaim Trojan.FakeAIM.Win32.6 BehavesLike.Win32.Trojan.lc W32/Pws.TXC Trojan/PSW.FakeAIM.c TR/PSW.FakeAIM.C.1 Trojan[PSW]/Win32.FakeAIM PWS:Win32/FakeAIM.C Trojan-PSW.Win32.FakeAIM.d Trojan/Win32.Xema.R89227 TScope.Trojan.VB Win32/PSW.FakeAIM.D W32/AIMFake.C!tr.pws Win32/Trojan.PSW.ee5


On March 9 2016, Cyphort Labs discovered an infection on a porn site keng94dotcom redirecting visitors to an exploit kit and installing a Ransom Locker.


One good thing about having a lot of Facebook friends is that you simply act as a honey pot when your friends click on malicious things.


The malicious script fingerprints the victim's machine and can receive any command that will run via PowerShell.


Instead, an accurate assessment is that a previously active Windows botnet is spreading a Mirai bot variant.


ESET researchers analyzed a preference file that was used to compromise the system when Uploader! is launched.


These campaigns not only represent an uptick in our observed instances of Kronos banker but also a new application of the malware that was first introduced in June 2014 and that we most recently described in relation to campaigns targeting Canada.


The Anthem attack is only one of multiple campaigns that Symantec has attributed to this group.


This blog post describes details that we discovered during our analysis of malware that focuses on a specific country — Libya.


This Zscaler ThreatLabz research article investigates the latest malware campaign of DBatLoader, which is being used by threat actors to target various businesses in European countries with Remcos RAT and Formbook.


A backdoor also known as: VBA.Trojan.Obfuscated.af W2KM_DLOADR.YYSQK Trojan.Ole2.Vbs-heuristic.druvzi W2KM_DLOADR.YYSQK Trojan:X97M/ShellHide.C virus.office.obfuscated.1


We detect the malware used in this attack as “ Backdoor.AndroidOS.Chuli.a ” .


A backdoor also known as: W32.HfsAutoB.F21F W32/Trojan2.MVJQ Trojan.Win32.Ace.cxham Win32.Backdoor.Ace.ciih Trojan.DownLoader1.8121 Backdoor.Ace.Win32.86 BehavesLike.Win32.Dropper.hh W32/Trojan.QDLI-0337 Trojan[Backdoor]/ASP.Ace TrojanDownloader:Win32/Pluzoks.A Backdoor/Win32.Ace.C78643 Backdoor.ASP.Ace Adware.Ezipop Win32/Adware.AdTrigger W32/ASP_Ace.MF!tr.bdr


A backdoor also known as: Worm/W32.Rahima.28672 Win32.Trojan.WisdomEyes.16070401.9500.9607 W32/Rahima.QDHZ-4096 W32.Fourseman.B@mm P2P-Worm.Win32.Rahima Trojan.Win32.Rahima.enoe Worm.Win32.P2P-Rahima.28672 W32.W.Rahima!c Worm.Rahima W32/Rahima.A I-Worm/Himera.i WORM/Rahima.A Worm[P2P]/Win32.Rahima P2P-Worm.Win32.Rahima Worm.Rahima Win32.Worm-p2p.Rahima.Pefs Worm.P2P.Rahima W32/Himera.J!worm.p2p Win32/Worm.IM.a16


The use of Lua modules, which we'll discuss later, is a technique that has previously been used by Flamer.


In August 2012, an attack campaign known as Shamoon targeted a Saudi Arabian energy company to deliver a malware called Disttrack.


A backdoor also known as: Trojan-Downloader.Win32.Geral!O TrojanDownloader.Begseabug.A5 Trojan/Downloader.Geral.aazb Trojan.Graftor.D540C W32.SillyDC Win.Trojan.Downloader-22789 Trojan-Downloader.Win32.Geral.aazb Trojan.Win32.Geral.dkhaf Trojan.Win32.A.Downloader.50176.GE Troj.Downloader.W32.Geral.aazb!c Trojan.Swizzor.18871 Downloader.Geral.Win32.7037 BehavesLike.Win32.Backdoor.ph Trojan-Downloader.Win32.Geral TrojanDownloader.Geral.cjc TrojanDownloader:Win32/Begseabug.A Trojan-Downloader.Win32.Geral.aazb Trojan/Win32.Scar.R4495 TrojanDownloader.Geral Trojan.KillAV Win32.Trojan-downloader.Geral.Sqtn Trojan.DL.Geral!qBECnW5XLLM W32/Pincav.SNS!tr Win32/Trojan.836


Other configuration data is located elsewhere , and some of it can been seen here : The encrypted library path The output folder on the device for the dropped library The name of the library after it is loaded eventBot name string Version number A string used as an RC4 key , both for decrypting the library and as a part of the network data encryption ( hasn ’ t changed from the previous version ) The C2 URLs A randomized class name using the device ’ s accessibility services EventBot extracted configuration Part of the extracted configuration of the new version .


A backdoor also known as: W32.HfsAdware.1F0C Adware.SearchSafer.A Adware.OutBrowse/Variant Win32.Trojan.WisdomEyes.16070401.9500.9922 Downloader.Sesafer TROJ_GE.24FE3DBE not-a-virus:Downloader.Win32.SearchSafe.a Adware.SearchSafer.A Trojan.Nsis.SearchSafe.dyoiec Adware.SearchSafer.A Adware.Downware.3008 Downloader.SearchSafe.Win32.2 TROJ_GE.24FE3DBE TR/AD.Uascape.myjsl Trojan:Win32/Uascape.A Adware.SearchSafer.A not-a-virus:Downloader.Win32.SearchSafe.a Adware.SearchSafer.A Downloader.SearchSafe PUP.Optional.SearchSafer PUA.Downloader!


A backdoor also known as: W32.ScaraNV.Trojan Trojan/W32.Scar.1611453 Trojan.Win32.Scar!O TrojanDropper.Scudy.S12799 Trojan.Scar.Win32.11534 Trojan.Zusy.D382CD WORM_SCUDY.SMA WORM_SCUDY.SMA Trojan.Win32.A.Scar.876573 Trojan:W32/Scar.O Trojan.Click1.19227 Trojan/Scar.flx TrojanDropper:Win32/Scudy.A Trojan/Win32.Scar.R45219 Trojan.Scar Trojan.Dropper Trojan.Scar!3JbHUSbGsGc Trojan.Win32.Scar


On April 19, Cyphort hardware sandbox trolled over a site www.49lou.com that served up 83 pieces of Windows executable files EXE and DLL binaries with zero user interaction.


A backdoor also known as: Trojan.Vake BehavesLike.Win32.BadFile.mt Trojan.Win32.Vake TR/Vake.onkgl Trojan.Heur.RX.EDF54F Trojan:Win32/Vake.D Trj/GdSda.A


Another interesting artifact part of the EK flow is the use of an XML configuration file which contains JScript code.


A backdoor also known as: TrojanDownloader.Votos Trojan.Zusy.D151C6 Win32.Trojan.WisdomEyes.16070401.9500.9956 Trojan.Win32.Clicker.cqsnmq Trojan.Win32.Z.Zusy.314880.BK Trojan.Click2.61352 Trojan-Downloader.Win32.Votos W32/Trojan.OORK-3033 TR/Taranis.2482 Trojan[Dropper]/Win32.Dinwod TrojanDownloader:Win32/Votos.A Trojan/Win32.Votos.R105546 TrojanDropper.Dinwod Trj/CI.A Win32/Trojan.ac2


A backdoor also known as: W32/Trojan.OXFE-7365 Backdoor.Chilurat Trojan.Win32.Trochil.a BehavesLike.Win32.Downloader.mz Trojan.Trochil.a Trojan.Win32.Trochil.a Trojan:Win32/Trochil.A Win32.Trojan.Trochil.Wrqj Win32/Trojan.369


The application downloads the file and dynamically loads it using dalvik.system.DexClassLoader and invokes class and method specified in json .


Threat Source newsletter March 2, 2023 — Little victories in the fight against ransomware


This round of FIN7 phishing lures implements hidden shortcut files LNK files to initiate the infection and VBScript functionality launched by mshta.exe to infect the victim.


In 2014, TrendMicro began seeing attacks that abused the Windows PowerShell.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9944 TSPY_EMOTET.SMD3 Trojan.Win32.Inject.exldsx Trojan.Encoder.24431 TSPY_EMOTET.SMD3 BehavesLike.Win32.Backdoor.dc Trojan.Jorik.afpv TR/Crypt.ZPACK.uxhop Trojan[Dropper]/Win32.Scrop Ransom:Win32/Pulobe.A Trojan.Midie.DA9F2 Trojan.SmokeLoader Win32/Trojan.9b7


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9961 Trojan-Dropper.Win32.Dapato TrojanDropper:Win32/Ambler.F Trojan.Zusy.953


[clearskysec] Attacks against all targets in the Middle East stopped at once, after we published our first report.


Thanatos is being marketed as a service with both short and long-term subscriptions and support and the authors claim it is under ongoing development with new plugins and functionality being actively added


Details about the sample, including a hash are available at the end of this writeup.


A backdoor also known as: Trojan-Spy.MSIL.KeyLogger!O TrojanSpy.Moorest Trojan/KeyLogger.iec Win32.Trojan.WisdomEyes.16070401.9500.9996 W32/Trojan2.NZWO TSPY_MOOREST.SMJJ Trojan-Spy.MSIL.KeyLogger.iec Trojan.Win32.Clicker.dkktnp IM-Flooder.W32.Delf.l2lu Msil.Trojan-spy.Keylogger.Pito Trojan.Click2.7338 TSPY_MOOREST.SMJJ W32/Trojan.CJSE-3516 Trojan-Spy.MSIL.KeyLogger.iec TrojanSpy:MSIL/Moorest.A TrojanSpy.MSIL.KeyLogger MSIL/Spy.Keylogger.GT Win32/Trojan.Spy.9b9


A backdoor also known as: Pwstool.Cain Application.Pwcrack.Cain.GL not-a-virus:PSWTool.Win32.Cain.s Application.Pwcrack.Cain.GL Riskware.Win32.Cain.ewvhjq Application.Pwcrack.Cain Tool.Cain PUA.CainAbel PSWTool.Cain.c DR/PSW.Cain.284.47 not-a-virus:PSWTool.Win32.Cain.s Trj/CI.A Win32/Trojan.Dropper.0c3


A backdoor also known as: Worm.Ainslot.A3 Win32.Trojan.WisdomEyes.16070401.9500.9999 BKDR_BLADABI.SMC Trojan.Win32.Drop.dcmduv Trojan.Win32.Z.Fraudrop.205824 Backdoor.MSIL.Parama.RANG BKDR_BLADABI.SMC BehavesLike.Win32.Trojan.dh Trojan-Dropper.Win32.Dorifel Trojan[Dropper]/Win32.FrauDrop Win32.Troj.FrauDrop.kcloud PWS:MSIL/Mintluks.A Trojan/Win32.FrauDrop.R127506 TrojanDropper.FrauDrop MSIL/Blocker.PAN!tr


A backdoor also known as: Application.Webcrack.A Trojan/WebCracker.a W32/Trojan.NDIN-1455 Application.Webcrack.A Application.Webcrack.A Riskware.Win32.WebCrack.bbira Application.Webcrack.A TrojWare.Win32.WebCracker.A Application.Webcrack.A Tool.WebCrack Trojan.WebCracker.Win32.2 W32/Trojan2.MHTV HackTool.WebCrack.40 Win32.Troj.WebCracker.A.kcloud Application.Webcrack.A Trojan/Win32.Webcracker.R66570 Trojan.Webcracker Win32/WebCracker.A Trojan.Win32.WebCracker.tfe Trojan.Win32.Webcracker Trojan.Win32.WebCraker.A


A backdoor also known as: Trojan/W32.Cossta.152000 Trojan.Cossta W32/Trojan.OSNY-0798 Backdoor.Cruprox Win32/NukeSped.AK Trojan/NukeSped.ak Trojan.Win32.Cossta.akea Trojan.Win32.Cossta.erwfkk Troj.W32.Cossta!c Trojan.DownLoader25.21345 Trojan.Cossta.Win32.10320 BehavesLike.Win32.MysticCompressor.cm Trojan.Win32.Cossta Worm/AutoIt.nml Trojan/Win32.Cossta Trojan.Win32.Cossta.akea Trojan/Win32.Cossta.C2091223 Win32.Trojan.Cossta.Syrj Trojan.Cossta!Kqe4w1x4ygI W32/Cossta.AKEA!tr Trojan.Cossta Trj/CI.A Win32/Trojan.b36


This simulation shows that FakeSpy behaves differently on a physical device versus an emulator .


Preferences such as the FTP hostname and username are stored in a file named uploadpref.dat.


There has been no evidence found yet that funds have been stolen from any infected banks.


A backdoor also known as: W32.Clode7b.Trojan.1410 Virtool.6143 Virtool.6143 Flooder.Piaoyes!YL6KHAf2k3Q Flooder.AG Flooder.Win32.Piaoyes.40 Virtool.6143 Virtool.6143 TrojWare.Win32.Flooder.Piaoyes.40 Virtool.6143 TR/Flood.Piaoyes.40.2 HackTool.Piaoyes Win32.Hack.Piaoyes.40.kcloud Win-Trojan/Piaoyes.171008 Virtool.6143 W32/Risk.PMPJ-1484 Win32/Flooder.Piaoyes.40 Flooder.Win32.Piaoyes.40 W32/Piaoyes.40!tr Flooder.DTA Trojan.Win32.Flooder.aS Win32/Trojan.Flood.199


A backdoor also known as: Worm.Ivruat.A11 Worm.AutoRun.Win32.120028 Win32.Trojan.WisdomEyes.16070401.9500.9986 W32/Trojan.TNXK-0638 Trojan.Win32.Autoruner2.cvshvv Win32.HLLW.Autoruner2.20037 BehavesLike.Win32.BadFile.fh Trojan.Win32.Spy W32/Trojan2.OYTC W32.Worm.Pqk Worm:Win32/Ivruat.A Worm/Win32.AutoRun.R140023 Win32.Worm.Autorun.Dxwf Trojan.Scar


Push notifications were also used to control audio recording .


A backdoor also known as: Backdoor/W32.Optix.340187 Backdoor.Win32.Optix!O Trojan.Madtol.C Backdoor.Optix Packer.W32.NSAnti.kZ85 Backdoor/Optix.f W32/OptixPro.I Backdoor.OptixPro.13 Win32/OptixPro.F BKDR_OPTIXPRO.H Win.Trojan.Optix-5 Backdoor.Win32.Optix.b Trojan.Win32.Optix.bslhnb Backdoor.Win32.Optix_Pro.340203 Trojan.DownLoader.60627 BKDR_OPTIXPRO.H BehavesLike.Win32.Dropper.fc W32/OptixPro.WZQS-7361 Backdoor/Optix.Pro.bd BDS/Optix.Pro.13.7 Trojan[Backdoor]/Win32.Optix Backdoor:Win32/Optixpro.T Backdoor.Win32.Optix.b Trojan/Win32.Xema.C66170 Backdoor.Optix Bck/OptixPro.C Win32/Optix.Pro.13 Backdoor.Optix.Pro.BD Backdoor.Win32.Optix


A backdoor also known as: Trojan.Win32.Hider!O W32/Backdoor.BVFG TROJ_HIDER.I Win.Trojan.Hider-4 Trojan.Win32.Hider.234496 Troj.W32.Hider.toFP Trojan.Hidn Trojan.Hider.Win32.266 TROJ_HIDER.I Trojan-Dropper.Delf Trojan/Win32.Hider.gh Win32.Troj.Hider.i.234496 Trojan.Win32.Hider.gh Trojan.Hider Win32/Trojan.0bc


Over the past few months, new strains of this infamous Android malware family have surfaced in third-party APK markets, as well as in the official Google Play store.


A backdoor also known as: Trojan/W32.VBKrypt.315392.AK Trojan.Win32.VBKrypt!O Trojan/Injector.wms Win32.Trojan.Inject.bh HV_VBKRYPT_CG092B3E.RDXN Trojan.Win32.VBKrypt.nrzc Trojan.Win32.VBKrypt.dzjqpk Trojan.MulDrop4.8756 Trojan.VBKrypt.Win32.180705 BehavesLike.Win32.BadFile.fh Trojan-PWS.Win32.Zbot Trojan.VBKrypt.amiu Trojan/Win32.VBKrypt Trojan.Symmi.D4542 Trojan.Win32.A.VBKrypt.315392.CI Trojan.Win32.VBKrypt.nrzc Worm:Win32/Secrar.A Trojan/Win32.Jorik.R37626 BScope.Worm.Gamarue.1191 W32/VBKrypt.MBW!tr


A backdoor also known as: Trojan-Proxy/W32.Mitglieder.8304 Trojan/Proxy.Mitglieder.af TrojanProxy.Mitglied!TVlYB86T2l0 Trojan.Mitglieder.G Win32/Mitglieder.Z TSPY_TARNO.D Trojan.Win32.Mitglieder.dkdz TrojWare.Win32.TrojanProxy.Mitglieder.AF Trojan.Mitglieder.Win32.173 TSPY_TARNO.D BehavesLike.Win32.Downloader.xc W32/Mitglieder.M TrojanProxy.Mitglieder.h Win32.Troj.Mitglieder.af.kcloud TrojanProxy:Win32/Mitglieder.DK Win-Trojan/Mitglieder.8304 Trojan-Proxy.Win32.Mitglieder.e Trojan.Win32.Mitglieder.aTNT Win32/TrojanProxy.Mitglieder.AF Win32.Trojan-proxy.Mitglieder.Ectn Trojan-Proxy.Win32.Mitglieder.CL W32/Tarno.D!tr Proxy.4.AZ Win32/Trojan.63b


SilentPush investigates a recent Facebook phishing campaign targeting social media users on Facebook Messenger, but what do we know about the attack's tactics and what can we do about it?


A backdoor also known as: Trojan.Win32.VB!O Trojan.VB Trojan.Symmi.DFDA4 Win32.Trojan.WisdomEyes.16070401.9500.9858 Trojan.Win32.VB.ckrm Trojan.Win32.VB.edplzz Troj.W32.Vb!c Trojan:W32/Kilim.P Trojan.VB.Win32.164816 TR/Kecix.ztie Trojan/Win32.VB Trojan:Win32/Kecix.A Trojan.Win32.VB.ckrm Trojan.VB Trj/CI.A Win32.Trojan.Vb.Pdlo Trojan.VB!Qw/pqsBL6E0 Win32.Outbreak Win32/Trojan.b08


Security Without Borders has recently published an analysis of this family , independently , through their blog .


A backdoor also known as: Tool.PassView.Win32.702 Win.Trojan.Lmir-87 not-a-virus:PSWTool.Win32.PassView.vly Win32.Trojan.Psw.Szlj Application.Win32.PassView.1_51 BehavesLike.Win32.Dropper.mh not-a-virus:PSWTool.Win32.PassView W32/Application.YMHQ-2387 Backdoor/Prorat.fxr TR/PSW.Dumaru Trojan[PSWTool]/Win32.PassView Worm:Win32/Dumaru.H@mm Application.Heur.E5E9B8 not-a-virus:PSWTool.Win32.PassView.vly PassDump.b PUP.Optional.PassView Riskware.PSWTool!


While some criminals blow up ATMs to steal cash, others use less destructive methods, such as infecting the ATM with malware and then stealing the money.


A backdoor also known as: W32.Pinfi.B Win32.Parite.B Virus/W32.Parite.C Virus.Win32.Parite.b!O W32.Perite.A W32/Pate.b W32/Pate.B Win32.Virus.Parite.d W32/Parite.B@mm W32.Pinfi.B Win32/Pinfi.A PE_PARITE.A Heuristics.W32.Parite.B Virus.Win32.Parite.b Win32.Parite.B Virus.Win32.Parite.bgvo W32.Parite.b!c Win32.Parite.B Win32.Parite.B Win32.Parite.2 Virus.Parite.Win32.9 PE_PARITE.A BehavesLike.Win32.Pate.gc Trojan.Win32.FakeAV W32/Parite.LAQX-0866 Win32/Parite.b Virus/Win32.Parite.c Win32.Parite.b.5756 TrojanDownloader:Win32/Grogsas.A Win32.Parite.B Win32.Parite.A Virus.Win32.Parite.b Win32.Parite.B Win32.Parite.B Virus.Win32.Parite.b Win32.Parite.B Win32/Parite.B Win32.Parite.B W32/Parite.B W32/Parite.B Virus.Win32.Parite.H


Use mobile threat detection solutions for enhanced security .


A backdoor also known as: Backdoor.Suslix.C Backdoor/W32.PlxT.20480 Backdoor.Suslix.C Win32.Trojan.WisdomEyes.16070401.9500.9991 W32/Backdoor.NXX Backdoor.Trojan Win32/Paltry.C Win.Trojan.Delf-473 Backdoor.Suslix.C Backdoor.Win32.PlxT.a Backdoor.Suslix.C Backdoor.Win32.Z.Suslix.20480 Backdoor.Suslix.C W32/Backdoor.PGXD-0378 Backdoor/PlxT.b Trojan[Backdoor]/Win32.Suslix Backdoor.Suslix.C Backdoor.Win32.PlxT.a Backdoor:Win32/Suslix.A Backdoor.Suslix.C Trj/CI.A Win32/Suslix.NAA Win32.Backdoor.Plxt.Ejez Trojan.Win32.Spy W32/Suslix.NAA!tr


Cyber4Sight has analyzed the malware distributed via the compromised Polish Financial Supervision Authority webpage and used in targeted attacks against a number of large banks and telecommunication companies.


A backdoor also known as: Trojan/W32.Small.38400.AY Trojan-Spy.Win32.Brospa!O Trojan.Witkinat Trojan/Spy.Brospa.cm TROJ_BROSPA.SMC Win32.Trojan.WisdomEyes.16070401.9500.9979 Backdoor.Trojan Win32/Witkinat.AY TROJ_BROSPA.SMC Win.Spyware.78717-2 Trojan.Win32.Brospa.bpglj Trojan.Win32.A.Brospa.38400.N Trojan.PWS.iThink.16 Trojan.Brospa.Win32.159 Trojan.Win32.Scar TrojanSpy.Brospa.o W32.Trojan.Witkinat.A Trojan[Spy]/Win32.Brospa Trojan:Win32/Witkinat.A Trojan/Win32.Brospa.R4351 TrojanSpy.Brospa Win32.Trojan-spy.Brospa.Wrqa W32/Witkinat.Q!tr


Targeting Postal and Transportation Services Companies One of the most significant findings is that new versions of FakeSpy target not only Korean and Japanese speakers , but also almost any postal service company around the world .


It appears to have evolved from the NewPOSthings family of malware first discovered by Dennis Schwarz and Dave Loftus at Arbor Networks.


It 's also raising eyebrows because of the connection with China , which has frequently sparred with the U.S. over cyber espionage .


This new variant, dubbed HummingWhale,' includes new, cutting edge techniques that allow it to perform ad fraud better than ever before.


Checking this Minigameshouse page further indicates that this person is indeed the owner of the minigameshouse [ .


SANS mail server quarantined this file FautraPago392023.gz and extracted the file to find there was no .exe extension associated with the file.


When installed, GreenDispenser may display an out of service' message on the ATM -- but attackers who enter the correct pin codes can then drain the ATM's cash vault and erase GreenDispenser using a deep delete process, leaving little if any trace of how the ATM was robbed.


Interestingly , there is an allowlist of tapped activities : ui.ConversationActivity ui.ConversationListActivity SemcInCallScreen Quadrapop SocialPhonebookActivity The listener can operate with only coordinates , so it calculates pressed characters by matching given values with hardcoded ones : Additionally , if there is a predefined command , the keylogger can make a screenshot of the tapped display area : Manual access and operator menu There is a hidden menu ( Activity ) for controlling implant features that looks like it was created for manual operator control .


A backdoor also known as: Trojan.DeltreeY Trojan:BAT/DeltreeY.CA Trojan.BAT.DeltreeY


A backdoor also known as: Application.Miner.CB Application.Miner.CB Linux/RubyMiner.A BAT_COINMINE.WIPX Application.Miner.CB Troj.Downloader.Shell!c Application.Miner.CB Linux.DownLoader.684 BAT_COINMINE.WIPX Trojan.RubyMiner Win32/Trojan.Downloader.72e


The malware is a reflection of how PoS threats, though no longer novel, are increasingly used against businesses and their customers.


A backdoor also known as: Trojan.Skeeyah.19132 Win32.Trojan.WisdomEyes.16070401.9500.9934 not-a-virus:HEUR:Monitor.Win32.BeyondKeyLogger.heur System.Monitor.Relytec.All-in-o TR/Spy.arobe not-a-virus:HEUR:Monitor.Win32.BeyondKeyLogger.heur Trojan:Win32/Dhodareet.A


Actors related to the Operation Lotus Blossom campaign continue their attack campaigns in the Asia Pacific region.


Based on the data we have acquired since October 2016, about 500 organizations from 50 countries were affected by the attack.


The AES key is generated using a SHA256 hash and due to the keys being stored on the infected machine, victims in many cases could likely decrypt files without paying the ransom.


A backdoor also known as: W32.Clod2e7.Trojan.3dab Backdoor/W32.Bifrose.737280.H Backdoor/Bifrose.chym BKDR_BIFROSE.DMQ W32/Trojan2.NEIM Backdoor.Trojan Win32/Tnega.UYbaRd BKDR_BIFROSE.DMQ Trojan.Win32.Bifrose.crakl Backdoor.W32.Bifrose.chym!c BackDoor.Bifrost.16023 Backdoor.Bifrose.Win32.49130 Backdoor.Bifrose W32/Trojan.TWKO-3939 BDS/Bifrose.chym W32/Bifrose.CHYM!tr.bdr Trojan[Backdoor]/Win32.Bifrose Backdoor/Win32.Bifrose.R127707 Backdoor.Bifrose Backdoor.Bifrose!bEtmoN1K0yI


The affected educational organizations, for instance, are used to deliver employment exams for government employees.


A backdoor also known as: W32.DusbyetorLTS.Trojan Trojan/W32.Kriskynote.442892.B Backdoor.Kriskynote.A4 Trojan/Rootkitdrv.w Trojan.Graftor.D35150 Win32.Trojan.WisdomEyes.16070401.9500.9510 W32/Trojan.HHCY-2846 Backdoor.Korplug.B Win32/Rootkitdrv.W BKDR_WINNT.SMD Trojan.Win32.Kriskynote.ay Trojan.Win32.Kriskynote.dkkllk Trojan.Win32.Z.Kriskynote.442892 BackDoor.Korplug.18 Trojan.Kriskynote.Win32.1 BKDR_WINNT.SMD Trojan.Win32.Kriskynote Trojan/Kriskynote.a Trojan/Win32.Kriskynote Trojan.Win32.Kriskynote.ay Trojan:Win64/Kriskynote.A!dha Win32/Tnega.aacQTM Trojan.Kriskynote Win32.Trojan.Kriskynote.Lkmz W32/Kriskynote.AY!tr Win32/Trojan.6da


A backdoor also known as: Trojan/Crypt.qk Win32.Trojan.WisdomEyes.16070401.9500.9532 TROJ_KRYPTIK.VTG Trojan.MSIL.Crypt.qk Trojan.Win32.Crypt.djsue BackDoor.Cybergate.1727 Trojan.Crypt.Win32.2613 TROJ_KRYPTIK.VTG Trojan.MSIL.Crypt Trojan/MSIL.bms TR/MSIL.Crypt.qk Trojan.MSIL.Krypt.2 Trojan.MSIL.Crypt.qk TrojanDownloader:Win32/Radet.A Msil.Trojan.Crypt.Swvd Trojan.Crypt!QtVXUF+C8/k Win32/Trojan.b12


A backdoor also known as: W32.Vetor.PE W32.Virut.G Win32/Virut.17408 PE_VIRUX.J Win.Trojan.Clicker-3135 Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg Virus.Win32.Virut.Ce Win32.Virut.56 PE_VIRUX.J BehavesLike.Win32.Virut.mm Win32/Virut.bn Virus/Win32.Virut.ce Win32.Virut.ce.53248 TrojanClicker:Win32/Sadbick.A W32.Virut.l4o5 Virus.Win32.Virut.ce Win32/Virut.F Virus.Virut.06 Win32/Virut.NBP Worm.Win32.VBNA W32/Sality.AO


A backdoor also known as: HW32.Packed.9ED0 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32.HLLM.Reset.493 BehavesLike.Win32.Ransomware.cc Backdoor.Poison Trojan.Midie.DA81B Backdoor/Win32.Poison.R217323 Trojan.Nymaim


Mandiant, working in partnership with SonicWall Product Security and Incident Response Team PSIRT, has identified a suspected Chinese campaign that involves maintaining long term persistence by running malware on an unpatched SonicWall Secure Mobile Access SMA appliance.


A backdoor also known as: Antivirus2008.DN MemScan:Trojan.Peed.JRX Trojan.Win32.Pakes.czg


This ransomware encrypts files and uses .braincrypt as file name extension for encrypted files.


The first example, a campaign observed on May 17, 2016, uses a fake Microsoft security alert social engineering lure to trick the victim into opening a link that leads to an executable download.


This blog details CNACOM, a web-based campaign that appears to be related to a well-known nation-state actor more commonly associated with spear-phishing attacks.


A backdoor also known as: Trojan.Dyloader Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Win32.Injector TR/Dropper.gjdjj Trojan.Graftor.D4C89C W32/Injector.DHHK!tr Trj/GdSda.A


A backdoor also known as: Trojan.Win32.Demp.cxoswz TrojanDropper.Demp.aao Trojan[Dropper]/Win32.Injector


The effects were broad reaching, with Ukraine Cyber police confirming over 2000 affected companies in Ukraine alone.


A backdoor also known as: RDN/Gaobot.worm!f Backdoor.Agobot.Win32.5073 Backdoor.W32.Agobot.svu!c Trojan.Heur.RP.EDFC38 Win32.Trojan.WisdomEyes.16070401.9500.9986 TROJ_ADAMOL.A Trojan.Win32.Agobot.dikwjo Win32.Backdoor.Agobot.Wlfl TROJ_ADAMOL.A BehavesLike.Win32.Downloader.gh Trojan.ATRAPS Backdoor/Agobot.bnd W32/AgoBot.SVU!tr.bdr Trojan[Backdoor]/Win32.Agobot Trojan:Win32/Adamol.A Trojan/Win32.Hupigon.C48593 Trj/Chgt.L


On the heels of recent disclosures of ATM malware such as Suceful Plotus and Padpin aka Tyupkin, Proofpoint research has discovered yet another variant of ATM malware, which we have dubbed GreenDispenser.


Initial reports of the attacks, published April 26 in Hebrew by the Israel National Cyber Event Readiness Team CERT-IL and The Marker, confirm that the attack was delivered through compromised email accounts at Ben-Gurion University and sent to multiple targets across Israel.


A backdoor also known as: Trojan.Small Trojan.Win32.Small Trojan.Win32.Small.cva Trojan.Win32.Crypted.dxzuxb Troj.W32.Small!c Trojan.PWS.Banker1.19315 Trojan/Win32.Small Trojan.Win32.Small.cva Trojan.Win32.Small Trojan.Small Trj/CI.A Trojan.Win32.Clipbanker W32/ClipBanker.F!tr Win32/Trojan.65e


This is the summary of an analysis by an IT security researcher, which we publish in full.


The malicious library is loaded from Eventbot ’ s assets that contain a font file called default.ttf which is actually the hidden library and then decoded using RC4 .


Carbanak also known as Anunak are a group of financially motivated criminals first exposed in 2015.


It spread via a recompiled version of the otherwise legitimate open source BitTorrent client application Transmission and distributed on their official website.


A backdoor also known as: Trojan-PWS/W32.QQPass.757760.Q Trojan.Win32.Badur!O Risktool.Flystudio.16885 Trojan/AddUser.q TROJ_ADDUSER_EJ19018D.UVPM Win32/Tnega.CEGPWM TROJ_ADDUSER_EJ19018D.UVPM Trojan-Ransom.Win32.Snocry.yj Trojan.Win32.QQPass.cqivxp Backdoor.W32.Hupigon.lHRl Worm.Win32.Dropper.RA Trojan:W32/DelfInject.R Trojan.DownLoader10.35182 Trojan.QQPass.Win32.21864 Exploit.Win32.MS Trojan/PSW.QQPass.qla TR/Strictor.38430 Trojan[PSW]/Win32.QQPass Trojan.Zusy.D2B925 Trojan-Ransom.Win32.Snocry.yj Trojan:Win32/Casus.A Trojan/Win32.QQPass.C217887 Trojan.Badur Win32/AddUser.Q Trojan.Win32.QQPass.i Trojan.PWS.QQPass!VhZvRiUJbao W32/QQPass.ELG!tr.pws Trojan.Win32.Extortioner.Q


A backdoor also known as: TrojanDownloader.Unruy.C3 Downloader-BPA.d Trojan.Cosmu.Win32.1584 Trojan/Cosmu.fzo Win32.Trojan-Clicker.Cycler.a W32.Unruy.A Win32/Unruy.NaMNFGC HT_UNRUY_GF0601E8.UVPM Win.Trojan.Unruy-5876 Trojan.Win32.Drop.bcagho Troj.Spy.W32.BZub.l2bS TrojWare.Win32.TrojanSpy.BZub.~IP Trojan.MulDrop1.276 HT_UNRUY_GF0601E8.UVPM BehavesLike.Win32.Downloader.rt Trojan-Downloader.Win32.Unruy Trojan/Cosmu.bhh TR/Dldr.Unruy.C Worm/Win32.Unknown TrojanDownloader:Win32/Unruy.C Trojan.Unruy.1 Trojan/Win32.Cosmu.R39186 TrojanClicker.Cycler Trojan.CL.Cycler!gZ0c9KQr9Uk W32/ZAccess.Y!tr W32/OverDoom.B.worm Win32/Trojan.688


The malware authors seem to be putting a lot of effort into improving this malware , bundling it with numerous new upgrades that make it more sophisticated , evasive , and well-equipped .


Also seen in other Exploits Kits: - Neutrino - Nuclear - Magnitude - RIG - Hanjuan


A backdoor also known as: Trojan.PSW.Qwak.A Trojan-PWS/W32.Qwak.24576 PSWTool.Win32.Pqwak!O Trojan.Pqwak Trojan.Qwak.Win32.2 Trojan.PSW.Qwak.A W32/HackTool.AZN TROJ_PQWAK.A Trojan.PSW.Qwak.A not-a-virus:PSWTool.Win32.Pqwak.10 Trojan.PSW.Qwak.A Riskware.Win32.Pqwak.hqlb Trojan.Win32.Z.Qwak.24576 Trojan.PSW.Qwak.A TrojWare.Win32.PSW.Qwak.A Trojan.PWS.Qwak.10 TROJ_PQWAK.A Trojan.Win32.PSW W32/Tool.QTCZ-8948 TR/Pqwak.A Trojan[PSWTool]/Win32.Pqwak not-a-virus:PSWTool.Win32.Pqwak.10 Win-Trojan/Qwak.24576 Trojan.PSW.Qwak.A TrojanPSW.Qwak Trj/CI.A Win32/PSW.Qwak.A Win32.Trojan.Pqwak.Eeha Trojan.PSW.Qwak!llR4IBPnUH0 Win32/Trojan.006


For example , we found several suspicious strings written in the Chinese language in a function called isNetworkAvailable , previously discussed in this blog : An almost identical function is mentioned in an earlier research , that ties FakeSpy and other malware to the Roaming Mantis group .


Stretching back to April 2016, she d befriended a lot of individuals, as many as 500, with similar interests.


Based on received commands, it can either download malicious apps or switch the C C Twitter account to another one.


A backdoor also known as: TrojanDropper.Goominer Win32.Trojan.WisdomEyes.16070401.9500.9958 Trojan.Win32.Kazy.dbtlfz Trojan.Win32.Z.Kazy.939008.A Trojan.Kazy.D607AA TrojanDropper:Win32/Goominer.A Trj/GdSda.A Win32.Trojan.Kazy.Pciu Trojan.Win32.Comitsproc Win32/Trojan.013


We dubbed this activity Operation Wilted Tulip


A backdoor also known as: Trojan.Win32.Swisyn!O Trojan.Starpage.A.mue Trojan/Swisyn.bhyk Win32.Trojan.Delf.it Trojan.Win32.Fsysna.djck Trojan.Win32.A.Swisyn.97827[UPX] Worm.Win32.Pronny.BL Trojan.PWS.Qqpass.6162 Trojan.Swisyn.Win32.21499 Trojan.Crypt Trojan/Win32.Swisyn HEUR/Fakon.mwf Worm.AutoRun Trojan.Win32.FakeFolder.pb Trojan.Swisyn!4rRLtK78L7s


Some samples talk to compromised South Korean server at 203.250.148.63 and communicate in port 30000.


The new GozNym hybrid takes the best of both the Nymaim and Gozi ISFB malware to create a powerful Trojan.


The people behind the attacks are likely attempting to gain access to computers where banking transactions are performed, in order to steal banking credentials.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9982 Trojan.Win64 Trojan[Backdoor]/Win32.Simda Trojan:Win64/Claretore.B W64/Simda.BD!tr


One of them was of particular interest because we'd never seen the backdoor before and it leveraged a relatively unique German dynamic DNS provider for command and control.


A backdoor also known as: Application.Htool.WKE Application.Htool.WKE W32/Risk.IUUB-2604 HKTL_DUMPSEC.TOMA Application.Htool.WKE Application.Htool.WKE Trojan.MulDrop3.34925 HKTL_DUMPSEC.TOMA W32/MalwareS.ITI Packed.Multi.rq HackTool:Win32/Dumpsec.A Application.Htool.WKE


Marcher inspects its infected devices carefully by using a dedicated, hard-coded configuration in each Android Package Kit APK, Google's file format for distributing and installing application software like mobile banking apps on the Android OS.


A backdoor also known as: W32/Downldr2.IYLF Trojan.Starter.1949 Riskware/Win32.Krap.ii Win32.Hack.Undef.kcloud TrojanDropper:Win32/Kidtok.A W32/Downloader.LQFG-1421 Virus.Win32.Heur.g BScope.Trojan-Spy.Zbot PE:Malware.FakeDOC@CV!1.9C3B Trojan-Dropper.Win32.Kidtok


Therefore we instead discuss a number of ways to detect and analyse these documents using freely available tools.


PDFs with download links


A backdoor also known as: PSWTool.Win32.NetPass!O HackTool.Dialupas Tool.NetPass.Win32.1002 Win32.Trojan.WisdomEyes.16070401.9500.9825 W32/Risk.DWIG-1726 Trojan-Spy.IEPV not-a-virus:PSWTool.Win32.NetPass.atx Trojan.Win32.Ool.cjzhzi Tool.PassView.277 BehavesLike.Win32.Downloader.gc W32/MalwareS.AKEN APPL/PSWTool.Pass.A Application.Heur.BmNfbCuqfGoO not-a-virus:PSWTool.Win32.NetPass.atx Trojan/Win32.Klone.C127582 PUP.Optional.Dialupass Trojan.PSWTool!vbtNAUr+Slw


The email, first of them submitted from Middle East, purports to be coming from a Turkish trading company, which might further indicate the geographic area where the attacks were active.


A backdoor also known as: W32.Cleanmg.Trojan Trojan-Spy.Win32.TianYan!O BackDoor-YA.dr Trojan/Spy.TianYan.b TSPY_TIANYAN.SMD Win32.Backdoor.Prisos.b W32.Killaut.A Win32/TianYan.A TSPY_TIANYAN.SMD Win.Spyware.35814-2 Trojan.Win32.TianYan.xbqa Trojan.Win32.TianYan.40960 Troj.Spy.W32.TianYan.m9ks TrojWare.Win32.TrojanSpy.TianYan.~A Win32.HLLP.Nemesis.28687 BackDoor-YA.dr TrojanSpy.TianYan.a Trojan[Spy]/Win32.TianYan Win32.Troj.TianYan.b.kcloud Trojan.Symmi.D7121 Backdoor:Win32/Prisos.A Worm/Win32.Mabezat.R26794 TrojanSpy.TianYan Win32/Prisos.A Trojan-Spy.Win32.TianYan.b Win32/Trojan.Dropper.e23


Our documentation points to a campaign that started somewhere in late February 2015 and ended in mid-March.


A backdoor also known as: W32.LRQwegierExe.Trojan Trojan/W32.Small.14848.CH Trojan.Daws.17020 Trojan.Kazy.D192B Win32.Trojan.Dalixi.f Trojan-Dropper.Win32.Daws.dyru Troj.W32.KillAV.lCzy BehavesLike.Win32.VTFlooder.lh Trojan:Win32/Ghodow.A Trojan-Dropper.Win32.Daws.dyru Win32/Dalixi.A Trojan.Dalixi!sYT5S6B5t8c W32/Dloader.IQS!tr.dldr Win32/Trojan.b7f


A new ransomware called CryptoLuck has been discovered by Proofpoint security researcher and exploit kit expert Kafeine that is being distributed via the RIG-E exploit kit.


Error Registration Ok Empty SendSMS RequestGoogleCC Wipe OpenBrowser SendUSSD RequestSMSList RequestAppList RequestLocation ShowNotification SetLockPassword LockNow MuteSound LoadScript LoadPlugin ServerChange StartApp CallPhone SetPingTimer SMSBroadcast RequestContacts AddInject RemoveInject Evaluate Another feature of this trojan is the ability to register injects , which are JavaScript snippets of code .


Ransomware in its various forms continues to make headlines as much for high-profile network disruptions as for the ubiquity of attacks among consumers.


A backdoor also known as: Trojan.Win32.Staget!O Trojan.Vb.AB2 Trojan.Injector Trojan/Staget.fk Trojan.Zusy.D381B TROJ_CHEKAF.SMIA Win32.Trojan.U-Staget.a TROJ_CHEKAF.SMIA Win.Trojan.Staget-28 Trojan.Win32.SelfDel.cdyc Trojan.Win32.Staget.btpvn Trojan.Win32.A.Staget.98334 Troj.W32.SelfDel.tnPD Trojan.MulDrop1.56405 Trojan.Staget.Win32.367 BehavesLike.Win32.Swisyn.nm Trojan/Staget.hg Trojan/Win32.Staget Win32.Troj.Staget.fk.kcloud Trojan.Win32.SelfDel.cdyc Trojan/Win32.Staget.R21060 Trojan.VBRA.09701 Trojan.Staget!A6l5b/HpLEg Trojan.Win32.Staget W32/Staget.EG!tr


A backdoor also known as: Trojan/CoinMiner.td not-a-virus:RiskTool.Win32.BitCoinMiner.wzo Riskware.Win32.BitCoinMiner.dktqwy Tool.BtcMine.479 Trojan.CoinMiner.Win32.1509 Trojan.Win32.CoinMiner RiskWare[RiskTool]/Win32.BitCoinMiner Trojan:Win32/Dimnir.A Application.Heur2.EE0329 not-a-virus:RiskTool.Win32.BitCoinMiner.wzo W32/CoinMiner.TD!tr


A backdoor also known as: Backdoor.Hotdog.A Backdoor.Hotdog.A Trojan.Win32.Hotdog.chmwe W32/Hotdog.B Spyware.Hotra TROJ_HOTDOG.A Backdoor.Win32.Hotdog Backdoor.Hotdog.A Backdoor.Hotdog!YGk3IGmjo+U Backdoor.Win32.Hotdog.B Backdoor.Hotdog.A Trojan.Hotdog.49152 TROJ_HOTDOG.A Win32.Hack.Hotdog.8F.kcloud Backdoor:Win32/Hotdog.A Trojan.Win32.Hotra.49152 Backdoor.Hotdog.A W32/Hotdog.OZIJ-0895 Win-Trojan/Hotra.57344 Spyware.Hotra Win32/Hotdog.B Backdoor.Win32.Hotdog W32/Hotdog.A!tr.bdr BackDoor.Hotdog.A


malware used by the HiddenCobra threat group


A backdoor also known as: TrojanPWS.Dexter.A4 Trojan.Poxters.Win32.176 Win32.Trojan.WisdomEyes.16070401.9500.9999 BKDR_DEXTR.SMM HEUR:Trojan.Win32.Invader Trojan.Win32.Invader.elqaga Trojan.FakeAV.19781 BKDR_DEXTR.SMM BehavesLike.Win32.VTFlooder.nh Trojan.Invader.aqk Trojan/Win32.Invader HEUR:Trojan.Win32.Invader Trojan.Invader! Trojan.Win32.Poxters W32/Poxters.E!tr Trj/GdSda.A


A backdoor also known as: Trojan.Dynamer.FC.316 Win32.Trojan.WisdomEyes.16070401.9500.9957 MSIL.Backdoor.Orcus.A Troj.Spy.Msil!c Trojan.DownLoader25.14345 BehavesLike.Win32.Backdoor.dc TrojanSpy.MSIL.sam TR/Dropper.MSIL.yknpx PWS:MSIL/Orcus.A!bit Win-Trojan/OrcusRAT.Exp Trj/CI.A Win32/Trojan.Spy.c29


A year later, a more dangerous version was released.


“ jackhex ” is not a common word or phrase and , as noted above , was also seen in the beacon activity with the previously discussed 9002 sample .


The malware spreads very fast using Telegram messenger application in smartphones, targeting high-profile Libyan influential and political figures.


Much of the contents of that report are reproduced here.


A backdoor also known as: Win32.Stration PUA.Packed.MEW-1 IM-Worm.Win32.Sumom.C


In a seven-hour window, Raytheon | Websense stopped over 16,000 malicious email messages from being delivered to customers, all of which appear to have been Japanese targets.


The exploit code attached used for dropping the malware is older – CVE-2012-0158 – and from our vantage point, we have no indication of successful or failed exploitation.


A backdoor also known as: Trojan/W32.OptixKill.31744 Trojan/OptixKill.10 TROJ_OPTIXKILL.F Win32.Trojan.WisdomEyes.16070401.9500.9985 W32/Trojan.HEHF-6024 TROJ_OPTIXKILL.F Win.Trojan.Killer-4 Trojan.Win32.OptixKill.10 Trojan.Win32.OptixKill.dkur Trojan.Win32.A.OptixKill.31744 TrojWare.Win32.OptixKill.10 Trojan.OptixKiller Trojan.OptixKill.Win32.20 Trojan/Win32.OptixKill.10 W32.Trojan.Backdoor-Ealim TR/OptixKill.10 Trojan/Win32.OptixKill Trojan:Win32/Optixkiller.A Troj.W32.OptixKill.10!c Trojan.Win32.OptixKill.10 Trojan/Win32.HDC.C1938 Trojan.OptixKill Trj/OptixKill.10 Win32/OptixKill.10 Win32.Trojan.Optixkill.Wsat Trojan.OptixKill!RjZYoc6lQeg Trojan-PWS.Win32.Lmir.wj W32/OptixKill.10!tr


While threat actors using the PlugX Trojan typically leverage legitimate executables to load their malicious DLLs through a technique called DLL side-loading, Unit 42 has observed a new executable in use for this purpose.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 BehavesLike.Win32.Conficker.lh Trojan.Win32.Spy Win32.Troj.Undef.kcloud Trojan.Kazy.D2002F


Although Banker has been in the wild for years, this time we see it using a Dynamic Loading Library DLL with malicious exported functions.


It was first reported in 2013 under the version number 2.0-LNK where it used the tag BaneChant in its command-and-control C2 network request.


Due to its ability to intercept SMS communications, the malware is also able to bypass SMS-based two-factor authentication.


In 2019, X-Force IRIS incident responders observed ITG03 conducting a campaign against a financial institution in Southeast Asia targeting the institution's SWIFT environment.


The targets and capabilities of HenBox , in addition to the ties to previous activity using four different Windows malware families with political-themed lures against several different South East Asian countries , indicates this activity likely represents an at least three-year-old espionage campaign .


A backdoor also known as: Trojan.Zenshirsh.SL7 W32/Small.WMNN-1529 TSPY_ONLING.SMIF Trojan.Win32.OnLineGames.vmk Trojan.DownLoader4.46724 TSPY_ONLING.SMIF W32/Small.IH TR/Fakealert.39719 TrojanDownloader:Win32/Rarcon.B Trojan.Graftor.D46F5 Trojan-Downloader.Win32.Small Win32/Trojan.add


A backdoor also known as: Android.SmForw.AE Android.Trojan.SMSSend.IA AndroidOS/Trojan.DPEF-9 Android.Trojan.SMSSend.IA A.H.Int.SmsThief.DBA Trojan.Android.SmsForward.duiqpk Android.SmsSpy.672.origin Trojan[SMS]/Android.SmForw.aa Android.Trojan.SMSSend.IA Android-Trojan/SmsSend.915f Trojan.AndroidOS.Lockerpin


SageCrypt downloaders, often poorly detected at the network level due to the usage of LetsEncrypt certificates.


A backdoor also known as: Packer.Morphine.B Packer.Morphine.B Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Conhook-11 Packer.Morphine.B Packer.Morphine.B Packer.Morphine.B TrojWare.Win32.PkdMorphine.~AN Packer.Morphine.B Trojan.Click.3614 BehavesLike.Win32.Pykse.gc Trojan.Win32.BHO Packed.Morphine.a Trojan:Win32/Bohojan.A Packer.Morphine.B W32/BHO.BO!tr


A backdoor also known as: Trojan.Newspy W32/NionSpy.e!dr TROJ_MEWSPY.CE Trojan.Win32.MewsSpy.drsazo TrojWare.Win32.TrojanDownloader.Geral.A Win32.MewsSpy.47 TROJ_MEWSPY.CE BehavesLike.Win32.DocumentCrypt.cc Virus.Win32.MewsSpy W32/Trojan.OBEZ-9322 Trojan.Kazy.D2524 Trojan:Win32/Newspy.A Trj/CI.A Win32.Virus.Mewsspy.Hroy W32/MewsSpy.AE Win32/Trojan.22f


A backdoor also known as: Exp.SWF.CVE-2014-8439.A Trojan.Swifi TROJ_FRS.PMA000B515 Swf.Exploit.Angler-4 Trojan.Swf.CVE20140515.dsfxmi SWF.Z.CVE-2014-0515.87352 Exploit.SWF.376 TROJ_FRS.PMA000B515 BehavesLike.Flash.Exploit.cb Exploit:SWF/Axpergle.B SWF/Exploit.ExKit.H Exploit.SWF


Command execution Command execution can create havoc for victim if the malware developer decides to execute commands in the victim ’ s device .


A backdoor also known as: Trojan:Win32/Plugx.B


A backdoor also known as: Downloader.Zlob.Win32.16141 Trojan.Kazy.D15115 Win32.Trojan.WisdomEyes.16070401.9500.9987 TROJ_ZLOB.HRX Win.Trojan.Zlob-2206 Trojan-Downloader.Win32.Zlob.vjl Trojan.Win32.Zlob.cvogpg TrojWare.Win32.TrojanDownloader.Zlob.~YG Trojan.Popuper.7315 TROJ_ZLOB.HRX Trojan.Zlob TrojanDownloader.Zlob.lui TR/Dldr.Zlob.pea.1 Trojan[Downloader]/Win32.Zlob Trojan-Downloader.Win32.Zlob.vjl Trojan/Win32.Zlob.R23708 Trojan.Zlob.23616 Win32/TrojanDownloader.Zlob.CHF


For five months, Check Point mobile threat researchers had unprecedented, behind the scenes access to a group of cybercriminals in China.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Zusy.D3C813 Trj/GdSda.A


A backdoor also known as: W32.FamVT.KolabcK.PE Net-Worm.Win32.Kolabc!O W32.Futu.A2 Win32.Virus.Probably.c W32.Blaster.Worm PE_FUTU.A Win.Exploit.DCOM-5 Win32.Trojan-Dropper.Rbot.A Virus.Win32.Kolabc.brlvjf W32.W.Kolabc.m0xC Virus.Win32.Kolabc.aab BackDoor.Swz.125 Worm.Kolabc.Win32.2973 PE_FUTU.A BehavesLike.Win32.Backdoor.wz Worm[Net]/Win32.Kolabc Worm.Kolabc.gu.kcloud Worm/Win32.Kolabc.R68544 BackDoor.Swz! Trojan-Proxy.Win32.Ranky W32/Kolabc.GU!worm.im Worm.Kolabc W32/BadFuture.A


A backdoor also known as: W32.HfsAdware.4A43 Trojan.Application.LoadMoney.Razy.8 Win32.Adware.Kryptik.c Infostealer.Limitail Win.Trojan.Loadmoney-12443 not-a-virus:Downloader.Win32.Plocust.dwa Trojan.Win32.LoadMoney.cspznv TrojWare.Win32.Kryptik.BAJ Trojan.LoadMoney.15 Trojan/StartPage.pch RiskWare[Downloader]/Win32.Plocust.dwa not-a-virus:Downloader.Win32.Plocust.dwa PUP/Win32.LoadMoney.R99289 TScope.Malware-Cryptor.SB Trojan.Win32.Spy Win32/Application.a8e


An unknown attacker gained access to the Bangladesh Bank's BB SWIFT payment system and reportedly instructed an American bank to transfer money from BB's account to accounts in The Philippines.


The Stegoloader malware family also known as Win32/Gatak.DR and TSPY_GATAK.GTK despite not sharing any similarities with the Gataka banking trojan was first identified at the end of 2013 and has attracted little public attention.


A backdoor also known as: Trojan.Graftor.D2B9C9 Trojan.Delf.Win32.71682 BehavesLike.Win32.BadFile.hh PUA.Toolbar.TB Trojan:Win32/Waqlop.A


A backdoor also known as: Trojan.Win32.Scar!O Trojan.Scar Win.Trojan.Scar-8271 Trojan.Win32.Scar.evwf Trojan.Win32.A.Scar.53248.I W32.W.WBNA.lJwt Trojan.Scar.Win32.68398 BehavesLike.Win32.VBObfus.lz Trojan.Win32.Scar Trojan/Scar.azur Trojan/Win32.Scar Trojan.Win32.Scar.evwf Trojan/Win32.Scar.R55318 Trojan.Scar Win32/VB.ROS Win32.Trojan.Scar.Pbfp Trojan.Scar!dNffxsGO4PU W32/Scar.EVWF!tr Win32/Trojan.b39


Fidelis Cybersecurity analysis has identified unrelated cyber criminal activity leveraging the vulnerability cited in CVE-2014-4114, which was initially exploited by advanced persistent threat APT actors in October 2014.


A backdoor also known as: Trojan.Downloader.E1FFDC Trojan.Win32.Delf.cxivds BehavesLike.Win32.Trojan.gh TR/Dldr.Slarkic.H.4 Trojan[Downloader]/Win32.Unknown TrojanDownloader:Win32/Notorgatro.B Trojan/Win32.CSon.R2885 Downloader.Delphi Trj/CI.A Win32/Trojan.BO.0a3


A backdoor also known as: Backdoor.Protux Backdoor/Protux.wz Trojan.Win32.Protux.pdpbh Backdoor.Trojan Protux.AO Backdoor.Win32.Protux.ws Backdoor.Protux!x0RB0sLZXQU Win32.HLLW.Autoruner1.4496 BDS/Protux.ws Heuristic.BehavesLike.Win32.Backdoor.H Backdoor/Protux.ht Win32.Troj.Undef.kcloud Backdoor.Win32.A.Protux.102400.A Backdoor/Win32.Trojan Backdoor.Protux Backdoor.Trojan Backdoor.Win32.Protux W32/Protux.WS!tr.bdr Trj/CI.A


A backdoor also known as: W32/Obfuscated.FA Trojan.Win32.Zapchast!IK Dropper.Win32.Mnless.fxg Trojan.Win32.Zapchast


The reader looked at the config and realized that his router got a new, suspicious entry in the NTP server name field, namely


A backdoor also known as: W32.Nimda.E Win32.Trojan.HotKeysHook.b W32/NetWorm.YYMQ-0484 Win32/Nimda.E Win.Worm.N-74 Win32.Trojan.HotKeysHook.A Net-Worm.Win32.Nimda.e Trojan.Win32.Nimda.glkx Win32.HLLW.Nimda.57344 Worm.Nimda.Win32.79 W32/NetWorm.BF W32/Nimda.3 Worm[Net]/Win32.Nimda.e Trojan.Strictor.D1109F Net-Worm.Win32.Nimda.e Trojan/Win32.HDC.C61626 Worm.Nimda Worm.Nimda!YOZDpQiibZo Trojan.I-Worm.Nimda Trj/CI.A


Here is a list of broadcast actions : android.provider.Telephony.SMS_RECEIVED android.net.conn.CONNECTIVITY_CHANGE android.intent.action.BATTERY_CHANGED android.intent.action.USER_PRESENT android.intent.action.PHONE_STATE android.net.wifi.SCAN_RESULTS android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.SCREEN_OFF android.intent.action.SCREEN_ON android.media.RINGER_MODE_CHANGED android.sms.msg.action.SMS_SEND android.sms.msg.action.SMS_DELIVERED Creating a Web Server to Phish XLoader creates a provisional web server to receive the broadcast events .


A backdoor also known as: Java/Jacksbot.W Backdoor.Trojan Java.Jacksbot.136 BehavesLike.Win32.Trojan.wc Java/Jacksbot.W Trojan.Java.ce Trj/CI.A Win32/Trojan.407


The targeting of state and local government agencies as well as the distribution methods are very similar to a CryptFile2 campaign we described in August.


We detected yet another 51 Trojan porn clickers accessible for the users to download.


EVENTBOT VERSION 0.3.0.1 Additional Assets Based on Country / Region EventBot-23aEventBot Spanish and Italian Images in Spanish and Italian added in version 0.3.0.1 .


After launch , it downloads a codec for MP3 encoding directly from the C & C server : http : //54.67.109.199/skype_resource/libmp3lame.dll The skype_sync2.exe module has a compilation timestamp – Feb 06 2017 and the following PDB string : \\vmware-host\Shared Folders\dati\Backup\Projects\REcodin_2\REcodin_2\obj\x86\Release\REcodin_2.pdb network.exe is a module for submitting all exfiltrated data to the server .


Dell SecureWorks Counter Threat Unit™ CTU researchers analyzed spam campaigns that distributed the AdWind remote access trojan RAT.


Following a previous discovery, FireEye Labs mobile researchers discovered another malicious adware family quickly spreading worldwide that allows for complete takeover of a user's Android device.


This campaign was focused on various South American banks in an attempt to steal credentials from the user to allow for illicit financial gain for the malicious actors.


Ironically, Ben-Gurion University is home to Israel's Cyber Security Research Center.


First Signs in September 2019 In September 2019 , a tweet by CERT-Bund caught the attention of the IBM Trusteer Mobile Security Research team .


A backdoor also known as: Trojan-Dropper.Win32.Typic!O Downldr.TonickCS.S543700 Dropper.Typic.Win32.736 Trojan/Dropper.Typic.arx Win32.Trojan-Downloader.VB.p Win32/Fruspam.GF Win.Trojan.Typic-1 Trojan-Downloader.Win32.Dapato.stb Trojan.Win32.Typic.dvexc TrojWare.Win32.TrojanDownloader.VB.OSNA TrojanDropper.Typic.me Trojan[Dropper]/Win32.Typic Dropper/Win32.Typic.R2031 TrojanDownloader.VB Trojan.Downloader.WCA Win32/TrojanDownloader.VB.OSN Trojan.DR.Typic!OCnhzJxHb3A Backdoor.Win32.Bifrose Trj/Downloader.XOR


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Shylock Trojan.Win32.Inject1.dkmayz Trojan.Win32.Z.Matrix.5088483 Trojan.Inject1.30662 Trojan.Blocker.Win32.12010 Trojan.Win32.Trxa W32/Trojan.SIWU-6483 Backdoor/Androm.ayy Trojan/Win32.Unknown Trojan.Matrix.1 Trojan:Win32/Trxa.A Backdoor.Androm Trj/CI.A Msil.Trojan.Kryptik.Lnej Trojan.Kryptik!0hVPn+vQuN8 MSIL/Kryptik.OR!tr Win32/Trojan.edc


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9967 Trojan.VB.Win32.113731 Backdoor.Win32.Cinasquel Backdoor:Win32/Cinasquel.A Backdoor/Win32.RemoteAccess.R125850


Comodo Threat Research Labs CTRL identified a new phishing email, that contains a malware file, and spread to email user with subject Dossier M978885982A -