Ginp embeds the following set of features , allowing it to remain under the radar and successfully perform attacks : Overlaying : Dynamic ( local overlays obtained from the C2 ) SMS harvesting : SMS listing SMS harvesting : SMS forwarding Contact list collection Application listing Overlaying : Targets list update SMS : Sending Calls : Call forwarding C2 Resilience : Auxiliary C2 list Self-protection : Hiding the App icon Self-protection : Preventing removal Self-protection : Emulation-detection Update


10/03/2020 At the end of February the actors behind Ginp added screen capture capabilities to their Trojan .


Like previously added functionality , the code is borrowed from the leaked Anubis Trojan source code .


It enables the bot to stream screenshots and send them to the C2 so that actors can see what is happening on the screen of the infected device .


Overlay attack Ginp uses the Accessibility Service to check which application runs is the foreground .


If the package name of the foreground app is included in the target list , an overlay is shown .


The WebView-based overlay is loading an HTML page provided by the C2 in response to the package name provided by the bot .


Something that makes Ginp special is that all of its overlay screens for banking apps are consist of multiple steps , first stealing the victim ’ s login credentials , then stealing the credit card details ( to “ validate ” the user identity ) , as shown in the screenshots hereafter : The following code snippet shows that after the second overlay is filled-in and validated , it disappears and the targeted application is added to the list of packages names to be ignored for future overlays attacks .


Targets The initial version of Ginp had a generic credit card grabber overlay screen used for all targeted applications .


Still included in the last versions , this screen is only used to overlay the official Google Play Store app .


More apps could be added to the grabber target list in the future , such as the ones that were targeted in older versions : Facebook WhatsApp Skype Twitter Chrome Instagram Snapchat Viber The following screenshot shows the generic card grabber overlay screen : Ginp generic grabber The current active target list is available in the appendix , containing a total of 24 unique targets .


The following screenshots show what type of information is collected in both steps of the overlay attack : Ginp overlaysGinp overlaysGinp overlaysGinp overlays Based on Anubis Once the Anubis bot code got leaked , it was just a matter of time before new banking Trojans based on Anubis would surface .


When analyzing the Ginp ’ s recent samples , ThreatFabric analysts found some similarities with the famous Android banking Trojan .


Based on the evolution of Ginp it is clear that it isn ’ t based on Anubis , but rather reuses some of its code .


Below are some of the elements showing the relation .


The names used for Android components are similar : Similarities with AnubisSimilarities with Anubis When analyzing these components , similarities were found in the code of both malware families : Similarities with Anubis Another major change that indicated that the actor copied code from the Anubis Trojan is the way of handling configuration values .


Previous versions were storing config values within the variables of a class , while the latest version is using SharedPreferences with some of the keys being identical to those used by Anubis : isAccessibility time_work time_start_permission url_inj Conclusion Ginp is a simple but rather efficient banking Trojan providing the basic functionality to be able to trick victims into delivering personal information .


In a 5-month timespan , actor managed to create a Trojan from scratch which will presumably continue evolving offering new features such as keylogging , back-connect proxy or RAT capabilities .


Ginp ’ s unusual target selection is not just about its focus on Spanish banks but also the wide selection of targeted apps per bank .


The fact that the overlay screens are almost identical to the legitimate banking apps suggests that the actors might be very familiar with the Spanish banking applications and might even be accustomed to the language .


Although the current target list is limited to Spanish apps , it seems that the actor is taking into account that the bot should also be able to target other countries , seeing that the path used in the inject requests contains the country code of the targeted institution .


This could indicate that actor already has plans in expanding the targets to applications from different countries and regions .


Appendix Samples Some of the latest Ginp samples found in the wild : App name Package name SHA-256 hash Google Play Verificator sing.guide.false 0ee075219a2dfde018f17561467272633821d19420c08cba14322cc3b93bb5d5 Google Play Verificator park.rather.dance 087a3beea46f3d45649b7506073ef51c784036629ca78601a4593759b253d1b7 Adobe Flash Player ethics.unknown.during


5ac6901b232c629bc246227b783867a0122f62f9e087ceb86d83d991e92dba2f Adobe Flash Player solution.rail.forward 7eb239cc86e80e6e1866e2b3a132b5af94a13d0d24f92068a6d2e66cfe5c2cea Adobe Flash Player com.pubhny.hekzhgjty 14a1b1dce69b742f7e258805594f07e0c5148b6963c12a8429d6e15ace3a503c


Adobe Flash Player sentence.fancy.humble 78557094dbabecdc17fb0edb4e3a94bae184e97b1b92801e4f8eb0f0626d6212 Target list The current list of apps observed to be targeted by Ginp contains a total of 24 unique applications as seen below .


This list is expected to grow in the future .


We believe the TelePort Crew Threat Actor is operating out of Russia or Eastern Europe with the groups major motivations appearing to be financial in nature through cybercrime and/or corporate espionage.


The group behind the OilRig campaign continues to leverage spear-phishing emails with malicious Microsoft Excel documents to compromise victims.


A backdoor also known as: Trojan.WebToos.A6 Trojan.Gadoopt.Win64.4 Trojan/Gadoopt.aa Win64.Backdoor.Gadoopt.b TROJ_WEBTOOS_EL150244.UVPM Win.Trojan.Win64-93 BackDoor.Gates.19 TROJ_WEBTOOS_EL150244.UVPM TR/Gadoopt.maz Trojan:Win32/WebToos.A Win64/Gadoopt.AA Trojan.Win32.WebToos


A backdoor also known as: W32.Clodc4c.Trojan.f31e Win32.Packed.VMProtect.a Trojan.Win32.Zapchast.ajbs Trojan.Win32.Black.elkboj Trojan.Win32.Z.Vmprotbad.242576[h] W32/Trojan.TYMW-2040 Trojan/Win32.PcClient.R191990 Trojan.VMProtect! Trojan.Win32.VMProtect Trj/CI.A Win32/Trojan.f26


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9952 PWS:MSIL/Bahmajip.A


A backdoor also known as: Worm.Win32.Radminer!O TrojanDropper.Small.PQ4 Worm.Radminer.Win32.8 Trojan/Radmin.b TROJ_SPNR.03EF12 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.XJGC-7764 Remacc.Radmin TROJ_SPNR.03EF12 Dos.Trojan.RAdmin-17 Trojan-Dropper.RadmIns Worm.Win32.Radminer.d Trojan.Win32.Radminer.dxpafi Worm.Win32.A.Radminer.307200 Trojan.DownLoader9.15517 BehavesLike.Win32.Skintrim.fh W32/Trojan2.OCDS Trojan[RemoteAdmin]/Win32.RAdmin Backdoor:Win32/Radmin.B Worm.Win32.Radminer.d Trojan/Win32.RAdmin.R103271 Trj/CI.A Trojan.Radmin.B Win32/Radmin.B


A backdoor also known as: Trojan.Antavmu.Win32.50 Trojan/Antavmu.ejw Trojan.Heur2.RP.E5C8CC Win32.Trojan.WisdomEyes.16070401.9500.9564 W32/Trojan2.IKTO Downloader.Trojan Win.Trojan.Antavmu-74 Trojan-Downloader.Win32.Murlo.vqg Trojan.Win32.Antavmu.wseg Spyware.Antavmu.455005 TrojWare.Win32.Antavmu.~bar Trojan.1 Trojan.Win32.Antavmu W32/Trojan.ASFC-3590 Trojan.Antavmu.y Troj.W32.Antavmu.jf!c Trojan-Downloader.Win32.Murlo.vqg Trojan/Win32.Antavmu.R18411 Trojan.1 Trojan.Antavmu!m7hjC7OtKPY


A new online banking malware with the same technique used in Operation Emmental has been hitting users in Japan.


The name of this injector is based on its version information which is the same for both dotRunpeX versions, consistent across all samples we analyzed and containing ProductName – RunpeX.Stub.Framework.


If you want to know more about them — our researchers have an article about them on Securelist .


A backdoor also known as: TROJ_DROPPER.FK Win32.Trojan.WisdomEyes.16070401.9500.9995 Infostealer.Gampass TROJ_DROPPER.FK Trojan.Win32.XDR.euxmtw Trojan.MulDrop.18385 BehavesLike.Win32.Virut.cc Win32.Infect.a.124448 Win32/Trojan.5f3


A backdoor also known as: Backdoor.Delfsnif W32/Backdoor2.GYBX Backdoor.Trojan Trojan.Win32.Delphi.bjxrjc BehavesLike.Win32.Rontokbro.dm W32/Backdoor.XFVH-7108 Backdoor.Delfsnif Trj/CI.A Win32.Trojan.Crypt.Alih Hoax.Win32.BadJoke.FakeKAV Win32/Trojan.160


However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA.


The documents were found to drop the following malware families: The previously discussed CONFUCIUS_B malware family A backdoor previously not discussed in the public domain, commonly detected by some antivirus solutions as BioData A previously unknown backdoor that we have named MY24


The spammed attachments are using a RTF trick or a feature of Windows OS that allows dropping an executable – but not running it – simply by opening the RTF document


Every sample we found was different in size and activity from the others but the internal name and other identifiers were disturbingly similar.


The malware disguises itself as a file helper app and then uses very advanced anti-debug and anti-hook techniques to prevent it from being reverse engineered.


A backdoor also known as: Trojan/W32.KillAV.60689 Packed.Win32.TDSS!O Trojan.KillAV.Win32.3036 Trojan/KillAV.caq W32/Trojan2.GLAK Infostealer.Onlinegame Trojan.Win32.KillAV.60689 TrojWare.Win32.Patched.KSU Trojan.Click.28899 Trojan.1 W32/Trojan.ANJW-2244 Trojan/KillAV.qx Worm:Win32/QQnof.A Trojan.Zusy.D1B0EC Troj.W32.KillAV.caq!c Trojan/Win32.KillAV.C155326 Trojan.1 Trojan.Win32.Jhee W32/KillAV.CAQ!tr Trj/KillAV.FJ


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9979 Backdoor.Trojan Win32/Cyreho.A Trojan.DownLoad2.18592 W32.Trojan.Trojan-Backdoor-Cele TR/Dldr.Ftp.E Trojan/Win32.Unknown Trojan.Heur.VP.E82FB1 Trojan:Win32/Cyreho.A Trojan.VBRA.02524 Win32.Trojan.Dldr.Oyeu Trojan.Win32.Darkddoser W32/VB.NZ!tr Win32/Trojan.9b7


Additionally, we have observed instances of the IsSpace and TidePool malware families being delivered via the same techniques.


A backdoor also known as: Backdoor.Pccontrol.2.1 Backdoor.Pccontrol.2.1 Backdoor.PcControl!Vqgcs0rOUEs PcControl.C Backdoor.Win32.PcControl.21 Backdoor.Pccontrol.2.1 Trojan.Win32.PcControl.cbiyio Backdoor.Pccontrol.2.1 Backdoor.Win32.PcControl.21 Backdoor.Pccontrol.2.1 BackDoor.Control.21 BKDR_PCCONTROL.A W32/Risk.SRBI-7988 BDS/PcControl.21.1 Trojan[Backdoor]/Win32.PcControl Backdoor:Win32/PCControl.2_1 Backdoor.Pccontrol.2.1 Backdoor.Pccontrol.2.1 Backdoor.PcControl Backdoor.Win32.PcControl.aa Win32/PcControl.21 W32/PcCont.21!tr.bdr BackDoor.Pccontrol.C Bck/PcControl.21


A backdoor also known as: Trojan.Bacterio61.A Trojan.Bacterio61.A Trojan.Bacterio61.r3 Trojan.Bacterio61.A Trojan.Bacterio61.A Trojan.Bacterio61!xosA0+L/cz0 Trojan.Dropper TROJ_BACTERIO.61 Trojan.Win32.Bacterio61 Trojan.Win32.Bacterio61.fdse Trojan.Win32.RenAll[h] PE:Trojan.Bacterio61!1073791980 Trojan.Bacterio61.A TrojWare.Win32.RenAll Trojan.Bacterio61.A Trojan.Bacterio61.Win32.1 TROJ_BACTERIO.61 W32/Virus.NFQE-4477 Trojan/Win32.Bacterio61 Win32.Troj.Bacterio61.kcloud Win-Trojan/RenAll.94208 Trojan.Bacterio61.A Win32.Trojan.Bacterio61.ddnb W32/Bacterio61.A!tr Trojan.Win32.Bacterio61.aW


A backdoor also known as: HW32.CDB.3cb9 Virus.Win32.Patched


Finally , the Ashas adware family has its code hidden under the com.google.xxx package name .


A backdoor also known as: HW32.Packed.4CE7 Backdoor/W32.Tropoly.C Backdoor.CPEX.Win32.21496 Trojan/Inject.aisx Trojan.Heur.E7B492 Trojan.Win32.A.Inject.48640.F TrojWare.Win32.Pincav.N Trojan.PWS.Reggin.91 BehavesLike.Win32.Ramnit.pc Trojan.Win32.Inject Trojan/Inject.hnq Troj.W32.Inject.aisx!c Trojan/Win32.OnlineGameHack.R2669 PWS-OnlineGames.ge BScope.TrojanPSW.Magania.1314 Trojan.Inject!H2RbMIi2jvQ Trj/Inject.IR Win32/Trojan.65a


A backdoor also known as: W32.Tregwihc.Trojan Trojan.Inject.GK Worm/W32.AutoRun.114688 W32/Autorun.worm.dw W32/AutoRun.lrf TROJ_FAM_0000e93.TOMA Win32.Trojan.WisdomEyes.16070401.9500.9992 W32/Worm.FWLR-5025 Trojan.Minit Win32/Milsni.D TROJ_FAM_0000e93.TOMA Win.Worm.Autorun-376 Win32.Rootkit.Uroburos.C Trojan.Inject.GK Trojan.Win32.AutoRun.ftwn Worm.Win32.Autorun.114688.I W32.W.AutoRun.lrf!c Trojan.Inject.GK Worm.Win32.AutoRun.COB Trojan.Inject.GK Win32.HLLW.Autoruner.5122 Worm.AutoRun.Win32.35 W32/Autorun.worm.dw W32/Worm.AKXJ Worm/AutoRun.fma Worm:Win32/Yacspeel.A.dll WORM/Autorun.Byt.34 Worm/Win32.AutoRun Worm:Win32/Yacspeel.A.dll Worm/Win32.AutoRun.R1836 Trojan.Inject.GK Worm.Win32.AutoRun.byt Trj/Autorun.RN Win32/AutoRun.COB Win32.Worm.Autorun.Lohz Virus.Win32.AutoRun.sd W32/AutoRun.BDJ!tr


A backdoor also known as: LNK.Trojan.3171 LNK/Trojan.TPJW-5 LNK_ARGULONG.SMLNK HEUR:Trojan.WinLNK.Powecod.a LNK_ARGULONG.SMLNK LNK/Trojan.TPJW-5 HEUR:Trojan.WinLNK.Powecod.a Trojan.LNK virus.lnk.powershell.a


A backdoor also known as: W32.SasfisB.Worm Win32.Worm.Wukill.D Email-Worm.Win32.Rays!O Worm.WuKill Worm.Rays.Win32.1 Worm.Wukill Win32.Worm-Email.Rays.a W32.Wullik@mm Win.Worm.Rays-1 Email-Worm.Win32.Rays.d Win32.Worm.Wukill.D Trojan.Win32.Rays.cvmxdt W32.W.Basun.lwAE Trojan.Win32.FakeFolder.wid Win32.Worm.Wukill.D Win32.Worm.Wukill.D Win32.HLLM.Xgray Email-Worm.Win32.Rays Worm.Rays.d.49152 Win32.Worm.Wukill.D I-Worm.Win32.Rays.49152 Email-Worm.Win32.Rays.d Win32.Trojan.Wukill.B Win32/Rays.worm.15024 Win32.Worm.Wukill.D SScope.Trojan.VBRA.4977 I-Worm.Wukill.B W32/Fawkes.A!worm


The document contains an encoded Visual Basic Script VBScript typical of previous Carbanak malware.


A backdoor also known as: W32/Fynloski.H Win32.Trojan Trojan.MSIL.Crypt.cxp Trojan.Inject.54745 TR/PSW.Fignotok.LW Trojan-Dropper.Small!IK Trojan/Jorik.ovo TrojanDownloader:Win32/Batosecu.A Trojan/Win32.Jorik Trojan.Jorik.Fynloski.ft Trojan-Dropper.Small Trj/CI.A


A backdoor also known as: Joke.Jepruss Hoax.Win32.BadJoke!O Joke.Russianjep Joke.Jepruss Joke.Jepruss W32/Joke.NX Joke.JepRuss JOKE_ONLYGAME.A Win.Joke.Jep-1 Joke.Jepruss Hoax.Win32.BadJoke.JepRuss Joke.Jepruss Riskware.Win32.JepRuss.hybz Joke.Win32.FakeScreen Hoax.W32.BadJoke.JepRuss!c Joke.Jepruss Joke.Win32.Jep.Russ Joke.Jepruss Joke.Justgame Tool.BadJoke.Win32.23 JOKE_ONLYGAME.A W32/Joke.TMKA-5158 not-virus:Joke.Win32.JepRuss HackTool[Hoax]/Win32.JepRuss Win32.Joke.JepRuss.kcloud Hoax.Win32.BadJoke.JepRuss Win-Joke/Delete_Game.916512 Win32/Jep.Russ Win32.Trojan-psw.Badjoke.Lmkt Trojan.Jep!7Qg0TmyJLB0 Joke.Win32.RussianJep


A backdoor also known as: Trojan.Seimon.G Trojan.Seimon.G Trojan.Seimon.G Trojan.Seimon!4f7JwSpV94c Trojan.Seimon.G TrojWare.Win32.Trojan.Seimon.G0 Trojan.Seimon.G Trojan.DownLoad.3195 BehavesLike.Win32.PWSGamania.lh W32/PhishExe.B!tr.dldr Trojan[:HEUR]/Win32.Unknown Trojan.Seimon.G Trojan/Win32.Casino BScope.Trojan-Downloader.ILoveLanch.pj Virus.Win32.Cloaker Trojan.Seimon.G


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9563 W32/Application.THZK-5586 BehavesLike.Win32.BadFile.rc Trojan.Win32.PSW Trojan.Application.Zusy.D3D00C Trj/GdSda.A


The page was designed to steal users ’ bank card details : 2017–2018 From early 2017 , the HTML phishing pages bank.html , update.html and extortionist.html started appearing in the assets folder .


A backdoor also known as: Trojan.Win32.KillFiles!O Trojan.Birele Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Risk.GBTW-1754 Ransom_Birele.R038C0DLB17 Trojan-Ransom.Win32.Birele.gss Trojan.Win32.Dropper.rpje Trojan.Win32.Scar.56320.B Troj.Ransom.W32.Birele!c Worm.Win32.Autorun.GVIT Trojan.MulDrop1.6138 Trojan.Birele.Win32.7887 BehavesLike.Win32.Ransom.fc Virus.Win32.VBInject W32/MalwareS.BBSH Trojan/Scar.pgv Trojan/Win32.KillFiles PWS:Win32/Kiction.A Trojan.Zusy.DAEF Trojan/Win32.Scar.R18936 Trojan-Ransom.Win32.Birele.gss Worm.Spreader Worm.AutoRun Win32.Trojan.Birele.Pgda W32/KillFiles.GMU!tr Win32/Trojan.Ransom.f31


Here is a command and control protocol fragment : Commands from C2 server parsing In total , the malicious APK handles 16 different commands : Command Endpoint Description 1 reqsmscal.php Send specified SMS message 2 reqsmscal.php Call specified number 3 reqsmscal.php Exfiltrate device info , such as phone model and OS version 4 reqsmscal.php Exfiltrate a list of all installed applications 5 reqsmscal.php Exfiltrate default browser history ( limited to a given date ) 6 reqsmscal.php Exfiltrate Chrome browser history ( limited to a given date ) 7 reqsmscal.php Exfiltrate memory card file structure 8 reqsmscal.php Record surrounding sound for 80 seconds 1 reqcalllog.php Exfiltrate all call logs 2 reqcalllog.php Exfiltrate all SMS messages 3 reqcalllog.php Upload specified file from the device to the C2 4 reqcalllog.php Download file from specified URL and save on device 5 reqcalllog.php Delete specified file 6,7,8 reqcalllog.php Commands not yet implemented 9 reqcalllog.php Take photo ( muted audio ) with rear camera , send to C2 10 reqcalllog.php Take photo ( muted audio ) with front camera , send to C2 All observed samples with Smali injections were signed by the same debug certificate ( 0x936eacbe07f201df ) .


It will also report the version of Android that the phone is running and any additional capabilities .


In the beginning , this threat group mainly targeted Asian countries .


A backdoor also known as: Trojan.Jacard Win32.Trojan.WisdomEyes.16070401.9500.9987 W32/Trojan.YDYO-6019 Trojan-Banker.BestaFera Trojan-Banker.Win32.BestaFera.amyc Trojan.Win32.Banker.euxhdn Trojan.Win32.Z.Jacard.2528768 BehavesLike.Win32.BadFile.vh TR/Spy.Banker.vvhlz Trojan[Banker]/Win32.BestaFera TrojanDownloader:Win32/Qulkonwi.A Trojan.Jacard.D8CA Trojan-Banker.Win32.BestaFera.amyc Trj/GdSda.A Win32.Trojan-banker.Bestafera.Wmsm W32/Banker.ADUT!tr.spy Win32/Trojan.252


Recently the Mobile Malware Research Team of Intel Security found on Google Play a new campaign of Android/Clicker.G in dozens of published malicious apps.


AlienVault Labs has extracted related samples and located the infrastructure used by attackers


A backdoor also known as: Trojan.Brackash.C Trojan.Brackash.C Win32.Trojan.WisdomEyes.16070401.9500.9774 Trojan.Win32.Sadenav.b Trojan.Brackash.C Trojan.Brackash.C Brackash.dll Virus.Trojan.Win32.Sadenav Trojan/Sadenav.aic W32.Trojan.Brackash.C TR/Brackash.C100.2 Trojan/Win32.Sadenav Trojan.Brackash.C Trojan.Win32.Sadenav.b Trojan/Win32.Sadenav.R1894 Brackash.dll Trojan.Brackash.C


One of the most common ways to do this is by displaying advertisements to users or by offering in-app purchases IAPs.


This blog post outlines the details about the campaign that we discovered.


A new CC infrastructure consisting of a climbing club website.


A backdoor also known as: O97M.Dropper.BR W97M.Downloader W2000M/Dldr.Rogue.aipbta HEUR.VBA.Trojan.e virus.office.qexvmc.1095


A backdoor also known as: W32.BackdoorSlingup.Trojan Trojan/W32.Fsysna.77824.F Heur.Win32.VBKrypt.3!O Backdoor.Slingup.MF.150 Win32.Worm.VB.rt W32/Trojan.XMLD-4299 W32.Difobot BKDR_GORYNYCH.SM Trojan.Win32.Fsysna.ccit Trojan.Win32.Fsysna.dwujaf Troj.W32.Fsysna.tnPd Trojan.DownLoader14.15241 Trojan.Fsysna.Win32.7242 BKDR_GORYNYCH.SM BehavesLike.Win32.Backdoor.lt Worm.Win32.VB W32/Trojan3.TRB Trojan/Fsysna.dgo Trojan/Win32.Fsysna Trojan.Win32.Fsysna.ccit Trojan/Win32.VBInject.R158763 Trojan.Fsysna Trojan.Reconyc Win32/VB.OOB Win32.Trojan.Fsysna.Phgj


A backdoor also known as: Backdoor:MSIL/Hulpob.A


A backdoor also known as: Trojan.Fsysna Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.HAEY-9385 Trojan.Bisonal Trojan.Win32.Fsysna.ccap Troj.W32.Fsysna!c Trojan.DownLoad3.19183 BehavesLike.Win32.Dropper.vz Trojan.Win32.Fsysna.ccap Trojan:Win32/Korlia.C Win-Trojan/Biscon.3140 Trj/CI.A Win32.Trojan.Fsysna.Tayn W32/Fsysna.CCAP!tr Win32/Trojan.732


In addition, the compromised devices were pushed Trojan updates, which allowed the attackers to extend their capabilities.


In February 2016 one of the largest cyber heists was committed and subsequently disclosed.


Cyber espionage actors, now designated by FireEye as APT32 OceanLotus Group, are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists.


The infected apps in this campaign were downloaded several million times by unsuspecting users.


A backdoor also known as: Backdoor.Bot.MSIL Trojan.Win32.StartPage.czmqzt Trojan.DownLoader12.20620 BehavesLike.Win32.Backdoor.ch TR/Dropper.MSIL.47116 MSIL/StartPage.AI!tr Trj/CI.A Msil.Trojan.Dropper.Hqll Trojan.MSIL.StartPage MSIL3.BCNZ Trojan.MSIL.StartPage.AI


Primarily targets users in Brazil with fake attatchments, for example: Auto_De_Infracao_e_Sua_Notificacao_493275324.exe


This is named Red Leaves after strings found in the malware.


The malware first discovery was after a highly Libyan influential Telegram account compromised via web


Recently, we saw an app that leads to a third-party app store being offered on the official iOS App Store.


This paper presents ESET's findings about Operation Groundbait based on our research into the Prikormka malware family.


A backdoor also known as: Worm.Win32.AutoRun!O Worm.AutoRun.13924 W32.W.Fearso.kYUv HT_STARTPAGE_FB090419.UVPM Win32.Trojan.Delf.it HT_STARTPAGE_FB090419.UVPM Win.Trojan.Delf-1006 Trojan.Win32.Fsysna.digg TrojWare.Win32.Magania.~AD Worm.Delf.Win32.1099 Trojan[GameThief]/Win32.Nilage Trojan.Jacard.D150AA Trojan.Win32.Fsysna.digg HackTool.Win32.InjectDll.a Trojan.Crypt


In the course of our research we uncovered the activity of a hacking group which has Chinese origins.


A backdoor also known as: Win32/Darby.N Win32.Worm.P2p.Darby.N Worm/W32.Darby.140470 W32.W.Darby.n!c Win32.Worm.P2p.Darby.N Worm.P2P.Darby!NxHEqfnePM8 W32/Darby.M W32.HLLW.Darby Win32/Darby.N P2P-Worm.Win32.Darby.n Trojan.Win32.Darby.epif Worm.Win32.Darby.140470.B[h] Win32.Worm.P2p.Darby.N Worm.Win32.Darby.N Win32.Worm.P2p.Darby.N BehavesLike.Win32.MultiDropper.cc W32/Darby.KOEV-0225 Worm/Darby.f WORM/Darby.N W32/Darby.N!tr Worm[P2P]/Win32.Darby Win32.Worm.P2p.Darby.N Win32/Darby.worm.140470 Worm:Win32/Darby.N Virus.Win32.Heur.p Win32.Worm-p2p.Darby.Pdwh P2P-Worm.Win32.Darby Win32.Worm.P2p.Darby.N Worm/Darby.P


Yesterday, Microsoft patched CVE-2015-2424, a vulnerability in Microsoft Office discovered by iSIGHT Partners while monitoring the Russian cyber espionage team we call Tsar Team.


A backdoor also known as: W32.HfsIemusi.2209 W32/Trojan.GCQE-8180 DDOS_HPNITOL.SM Trojan.Boht Trojan.Win32.DownLoad.bfqxfq Troj.W32.Vilsel.lmbl Trojan.DownLoad3.40817 BehavesLike.Win32.HLLPPhilis.lc Backdoor:Win32/Bezigate.B Trj/CI.A Win32/Delf.AJG Backdoor.Win32.PcClient W32/Inject.VXTT!tr


The embedded app appears to be a media player .


During an incident response engagement in September 2016, SecureWorks® incident response analysts observed payment card data being collected by a generic remote access trojan RAT rather than typical memory-scraping malware.


The said attackers, who showed familiarity and in-depth knowledge of their agencies' network topology, tools, and software, were able to gain access to their targeted servers and install malware.


That attack was spearheaded by the malware ESET products detect as Diskcoder.C aka ExPetr, PetrWrap, Petya, or NotPetya.


Early September, Skycure Research Labs detected a fake app within one of our customer's organizations, identified through our crowd-sourced intelligence policies whereby anyone running the Skycure mobile app acts as a threat detecting sensor.


A backdoor also known as: Udsdangerousobject.Multi Trojan.Scar.Win32.107576 Uds.Dangerousobject.Multi!c Trojan.Win32.Scar.qiea Trojan.Win32.Scar.eujcfc BehavesLike.Win32.Downloader.vc Trojan.Win32.Scar W32/Trojan.TSAL-4013 Trojan.Scar.kdh TR/Scar.xdjbi Trojan/Win32.Scar Trojan.Win32.Scar.qiea TrojanDropper:Win32/NukeSped.V Trojan/Win32.Scar.C2237182 Trojan.Scar Trj/GdSda.A Win32.Trojan.Scar.Hnkz Trojan.Scar!JEdUZG9Z4dw Win32/Trojan.6bc


BlackSnake Ransomware is a new strain of malware that encrypts files and demands a ransom from victims, and is capable of performing clipper operations aimed at cryptocurrency users, according to Cyble Research and Intelligence Labs.


For bogus applications to be profitable, they should be able to entice users into installing them.


Desktop Trojans and Their Mobile Component The process by which Trojans attempt to infect mobile devices is at least a decade old .


The group is highly selective in its approach and only appears to deploy its full range of tools once it establishes that the compromised organization is an intended target.


It relies on spear-phishing emails sent to specific and strategic companies to conduct its campaigns.


VXRLcredit contacted us regarding an APT phishing email that included a download link to a malware being hosted on a Geocities website.


The group's activities have gained attention due to their ongoing use of DLL hijacking via Microsoft Distributed Transaction Coordinator MSDTC to extract and launch ransomware payloads.


Perhaps the most interesting part is that the attack e-mails had an APK attachment – a malicious program for Android .


A backdoor also known as: BKDR_KONUS.N Trojan.DownLoader24.32510 BKDR_KONUS.N BehavesLike.Win32.Trojan.fc Trojan.Razy.D27268 Trojan.Win32.Z.Razy.308742 Backdoor:Win32/Konus.A TScope.Malware-Cryptor.SB Trj/GdSda.A Win32/Trojan.797


A backdoor also known as: HW32.Packed.91D0 RiskWare.GameHack Win32.Trojan.WisdomEyes.16070401.9500.9693 Trojan.Adylkuzz Win32.Application.PUPStudio.B Trojan.Win32.PUPStudio.expchr BehavesLike.Win32.Downloader.rc Trojan.Win32.VMProtect TR/AvKill.fkiqo Trojan:Win32/Avkill.E Trj/CI.A


A backdoor also known as: Exp.OLE.CVE-2013-1331.A Exploit.OLE2.CVE-2013-1331.a!c Trojan.Mdropper Win32/Exploit.CVE-2013-1331.A TROJ_MDROPPR.ZMA Doc.Exploit.CVE_2013_1331-1 Exploit.OLE2.CVE-2013-1331.a Trojan.Dos.CVE-2013-1331.dftbiw DOC.S.CVE-2013-1331.115712 Win32.Exploit.Msoffice.Auto Exploit:W32/CVE-2013-1331.A TROJ_MDROPPR.ZMA EXP/CVE-2013-1331.A Exploit.OLE2.CVE-2013-1331.a Exploit.OLE2 MSWord/ScriptBridge.NT!exploit.CVE20131331 Win32/Trojan.Exploit.124


Malware Capabilities The Cybereason Nocturnus team has been following EventBot since the beginning of March 2020 .


The messages looked as follows : “ % USERNAME % , ti ho inviato il soldi sul subito subito-a [ .


By utilizing stolen credentials, the actor was able to manipulate the update server for M.E.Doc to proxy connections to an actor-controlled server.


A backdoor also known as: W32.FamVT.BrontokTiwiHV.Worm Worm/W32.Brontok.87061 Email-Worm.Win32.Brontok!O Worm.Rahiwi.A3 W32/Brontok.am Trojan.Heur.fmMfr5EYVjjib Win32.Trojan.VB.bb W32.Rahiwi.A Win32/Tnega.OPKOELC WORM_BRONTOK.SMB Email-Worm.Win32.Brontok.am Trojan.Win32.Brontok.dmfkjc I-Worm.Win32.A.Brontok.58368[UPX] Worm.Brontok.Win32.1133 WORM_BRONTOK.SMB BehavesLike.Win32.YahLover.mt Email-Worm.Win32.Brontok Worm.Brontok.bt W32.Worm.Rahiwi WORM/Brontok.AM.15 Worm[Email]/Win32.Brontok W32.W.Brontok.mjGp Email-Worm.Win32.Brontok.am Worm:Win32/Rahiwi.A Worm/Win32.Brontok.C47526 Worm.Brontok I-Worm.VB.ET Worm.Win32.Brontok.aab I-Worm.Brontok!pJaU4TE3gZk W32/AutoRun.RPV!worm


Traditionally, the group attacked organizations in the US as well as other targets.


Last month at the CERT-EU Conference in Brussels, Belgium, Volexity gave a presentation on a recent evolution in how attackers are maintaining persistence within victim networks.


A backdoor also known as: Trojandownloader.Tedekeh BehavesLike.Win32.AdwareDealPly.tc TrojanDownloader:Win32/Tedekeh.A PUP.Optional.BundleInstaller Trj/CI.A


MalwareBytes recently encountered an atypical case of Sundown EK in the wild – usually the landing page is obfuscated, but in this case there was plain JavaScript.


In late 2016 , versions of the Trojan emerged that contained the card.html phishing page in the assets/www folder .


Providing the app has registered an intent to process particular events from the system , and one of said events occurs , HenBox is effectively brought to life through external stimulus from another app on the system broadcasting a request , or the system itself broadcasting a particular event has occurred .


We have observed this group targeting defense, aerospace, and legal sector companies.


] com and appupdatemoremagic [ .


A backdoor also known as: Trojan/W32.Small.32256.ACD Trojan/PSW.Ruftar.pmc BAT/LockScreen.EB Virus.BAT.Disabler


A backdoor also known as: Trojan.PasswordStealer Trojan.Zusy.D40C66 Win32.Trojan.WisdomEyes.16070401.9500.9505 Trojan.Win32.Steam.exnrza Trojan.Win32.Z.Zusy.517120.A W32.W.AutoRun.lmJt Trojan.PWS.Steam.14964 BehavesLike.Win32.Dropper.hh Trojan.Win32.PSW W32/Trojan.OYNU-3017 PWS:Win32/PWSteal.R!bit Trj/CI.A W32/Delf.ORF!tr.pws


In recent weeks we've discovered that the group have been actively updating their Clayslide delivery documents, as well as the Helminth backdoor used against victims.


These attacks involved ITG03 actors inserting malware between an ATM and its home bank network, and likely required advanced knowledge of the ATM's network path or prior access to a bank's network.


A backdoor also known as: HackTool.Sileco.IM3 Worm.Palevo.Win32.123726 Trojan/Downloader.Small.aolo Win32.Trojan.Shellcode2EXE.a P2P-Worm.Win32.Palevo.fiqf Trojan.Win32.Palevo.etybtm TrojWare.Win32.TrojanDownloader.Small.aolo0 Trojan:W32/Shell2Exe.A Win32/PatchFile.gk Worm[P2P]/Win32.Palevo TrojanDownloader:Win32/Sileco.A P2P-Worm.Win32.Palevo.fiqf Downloader/Win32.Small.R3049 Worm.Palevo Trojan.Silvana Win32.Trojan.Manualpatched.Dkq Trojan-Downloader.Win32.Sileco Trj/CI.A Win32/Worm.P2P-Worm.fb5


The actors typically steal from financial institutions using targeted malware.


A backdoor also known as: Trojan.Nubuler.D Downloader.Small.Win32.102411 Win32.Trojan-Downloader.Small.cj TROJ_NEBULER.SMF Trojan.MulDrop.origin TROJ_NEBULER.SMF BehavesLike.Win32.PWSOnlineGames.kc BDS/WinO.A Trojan:Win32/Nebuler.D Trojan.Nebuler.1 Trojan/Win32.CSon.R566 Nebuler.b Trojan.Win32.Nebuler


How does Chrysaor work ? To install Chrysaor , we believe an attacker coaxed specifically targeted individuals to download the malicious software onto their device .


This is due to the fact that the exploit has been integrated into several exploit kits and many end users have not yet patched their machines.


This research note outlines what we know about the use of Hacking Team's Remote Control System RCS by South Korea's National Intelligence Service NIS.


The goal of this paper is to provide some updates to our previous FTA on AlienSpy, the predecessor of JSocket, and to discuss its Android capabilities in detail.


The first malware program belonging to this family was spotted in May 2016 and was dubbed Linux.DDoS.87.


A backdoor also known as: Trojan.Vbiframe Trojan/Refroso.cwic Trojan.Strictor.D1D61 TROJ_CLICKER.CAQ Win32.Trojan.WisdomEyes.16070401.9500.9939 TROJ_CLICKER.CAQ Win.Trojan.Clicker-3888 Trojan-Clicker.Win32.VBiframe.fgl Virus.Win32.Sality.bgiylc Trojan.Win32.A.Refroso.110901 Troj.Clicker.W32.Vbiframe!c TrojWare.Win32.Downloader.VBIFrame.IK Trojan.Click.25308 Trojan.VBiframe.Win32.382 BehavesLike.Win32.BadFile.cc Trojan-Clicker.Win32.VBiframe TrojanClicker.VBiframe.vg Trojan/Win32.Refroso Trojan:Win32/Punad.G Trojan-Clicker.Win32.VBiframe.fgl Trojan/Win32.Clicker.R3068 SScope.Trojan.VBRA.3659 Trj/Clicker.ARC Trojan.DL.Pacoheir!0uqYAwP2RQg Win32/Trojan.Clicker.bd6


This powerful corporate espionage threat is specifically designed to target large enterprises in the technology, pharma, commodities and legal sectors, penetrating their security and exfiltrating commercially sensitive information.


A backdoor also known as: W32.ConfickerIOC.Worm Win32.Worm.Conficker.A Worm/W32.Kido.12304 Net-Worm.Win32.Kido!O Worm.Kido.11922 Trojan/Conficker.dam Win32.Worm.Conficker.m W32/Conficker.G W32.Downadup Win32/Conficker.B Win.Trojan.Rootkit-58 Win32.Worm.Conficker.A Net-Worm.Win32.Kido.jq Win32.Worm.Conficker.A Trojan.Win32.Kido.ghbd Worm.Win32.Conficker.4096 Win32.Worm.Conficker.A Trojan:W32/Downadup.AL Win32.HLLW.Autoruner.5555 Worm.Conficker.Win32.405 Net-Worm.Win32.Kido W32/Conficker.UCIE-3981 Worm/Kido.hw Worm[Net]/Win32.Kido Win32.Worm.Conficker.A Net-Worm.Win32.Kido.jq Trojan:WinNT/Conficker.B Win32/Conficker.worm.4096 Win32.Worm.Conficker.A Net-Worm.Kido Rootkit/Conficker.C Win32/Conficker.AA Trojan.Win32.Conficker.dd Worm.Conficker!L/CdK4RT60g Win32/RootKit.Conficker.A


'' There are 27 response codes that the C2 can use to make requests to the trojan , which pretty much match what 's listed in the capabilities section .


Over the past seven months, Unit 42 has been investigating a series of attacks we attribute to a group we have code named Scarlet Mimic. The attacks began over four years ago and their targeting pattern suggests that this adversary's primary mission is to gather information about minority rights activists.


Recently McAfee labs came across a point-of-sale POS malware that spreads through malicious macros inside a doc file.


In October 2014, Kaspersky Lab started to research Blue Termite an Advanced Persistent Threat APT targeting Japan.


Just in May, we pointed out how it had gone through six separate versions with various differences in its routines.


A backdoor also known as: Trojan/Spy.Bancos.if Trojan.Heur.EED312 TROJ_BANKER.BTB Win32.Trojan.Bancos.a Infostealer.Bancos TROJ_BANKER.BTB Win.Trojan.Bancos-122 Trojan-Banker.Win32.Bancos.if Trojan.Win32.Bancos.gaxc Troj.Banker.W32.Bancos.if!c TrojWare.Win32.Spy.Bancos.U Trojan.Bancos.Win32.1340 Trojan:Win32/Vlight.A TR/Spy.Bancos.IF Trojan[Banker]/Win32.Bancos Win32.Troj.Bancos.if.kcloud Trojan:Win32/Vlight.A Trojan-Banker.Win32.Bancos.if Win32.Trojan-banker.Bancos.Eehf Trojan.PWS.Bancos.OGQ Trojan-Banker.Win32.Bancos W32/Bancos.NJN!tr


In the Windows space , Twitter , founded in 2006 , was first used to control botnets as early as in 2009 .


A backdoor also known as: Trojan.Dynamer.AP3 TROJ_VBNA.SMD Win32.Trojan.Paskod.a TROJ_VBNA.SMD Trojan.Win32.Dynamer.lpd Trojan.Win32.Dynamer.exrxxx Trojan.Win32.Z.Paskod.114692.A Troj.W32.Dynamer.mqvJ TrojWare.Win32.Paskod.D Trojan.DownLoader11.38900 Trojan.Dynamer.Win32.5199 Trojan.Win32.Paskod Trojan/Dynamer.cli TrojanDownloader:Win32/Tinub.A Trojan.Heur.VB.E4CDDB Trojan.Win32.Dynamer.lpd Trojan/Win32.VBCrypt.R122576 BScope.Trojan.Diple Trj/GdSda.A Win32.Trojan.Dynamer.Tcbz W32/Paskod.E!tr Win32/Trojan.ff1


In Version 0.0.0.1 , the communication with the C2 is encrypted using Base64 and RC4 .


One malware family seen in such attacks is known as SamSa', Samas', samsam', or most recently, MOKOPONI'.


It seems to be part of a larger campaign, known as Pawn Storm


Windows malware, also detected as: Trojan.Autoit, Trojan.Symmi.D10095, Trojan.Win32.Autoit.exnvng, Trojan.Win32.Z.Autoit.1079042, Troj.W32.Autoit!c, Trojan.Inject1.38999, Trojan.AutoIt.Win32.7, BehavesLike.Win32.Trojan.th, Trojan.Win32.Eupuds, Trojan.Autoit.ixi, Trojan:Win32/BrobanEup.A, Trojan.Autoit.Banker, Win32.Trojan.Autoit.Szbl, W32/Autoit.AAV!tr, Win32/Trojan.839,


The campaign has many stages of the infection chain and all needed to be unraveled before the final payload level was reached.


A backdoor also known as: W32.InterneC.Worm Trojan.Downloader.VB.VRF Trojan-PWS/W32.WebGame.24576.IS Trojan.VB.Win32.91134 Troj.GameThief.W32.OnLineGames.tqmr!c Trojan/VB.nti TROJ_DLOAD.FH W32/Worm.AUBX TROJ_DLOAD.FH Win.Spyware.56255-2 Trojan.Downloader.VB.VRF Trojan.Downloader.VB.VRF Trojan.Win32.OnLineGames.tibz Trojan.Win32.PSWIGames.24576.GZ Trojan.Downloader.VB.VRF Trojan.Downloader.VB.VRF Trojan.DownLoader.55879 BehavesLike.Win32.Trojan.mz W32/Worm.EUBY-4599 Trojan/PSW.OnLineGames.asrj TR/PSW.OnlineGames.tqmr Trojan[GameThief]/Win32.OnLineGames Trojan.Downloader.VB.VRF Trojan/Win32.OnlineGameHack.C140754 Trojan.Downloader.VB.VRF TrojanPSW.OnLineGames.a Win32.Trojan-GameThief.Onlinegames.inv Trojan.Mansund!mgpvcbFSAhU Trojan-GameThief.Win32.OnLineGames


Indicators of Compromise ( IoCs ) SHA256 Detection e394e53e53cd9047d6cff184ac333ef7698a34b777ae3aac82c2c669ef661dfe AndroidOS_SpyAgent.HRXB e8d4713e43241ab09d40c2ae8814302f77de76650ccf3e7db83b3ac8ad41f9fa AndroidOS_ProjectSpy.HRX 29b0d86ae68d83f9578c3f36041df943195bc55a7f3f1d45a9c23f145d75af9d AndroidOS_ProjectSpy.HRX 3a15e7b8f4e35e006329811a6a2bf291d449884a120332f24c7e3ca58d0fbbdb IOS_ProjectSpy.A URLs cashnow [ .


A backdoor also known as: Trojan.Downloader Win32/Tnega.CfCAeIB Win.Trojan.Downloader-64707 Application.Win32.Kuaiba.BC Trojan.DownLoader10.13268 BehavesLike.Win32.Downloader.tc Win32.Trojan-Downloader.GMUnpackerInstaller.B


Though there were multiple waves of messages following a similar tactic, each one carried the same malicious .doc file as an attachment SHA256: 6b9af3290723f081e090cd29113c8755696dca88f06d072dd75bf5560ca9408e.


The actor has used several notable techniques in these incidents such as sniffing passwords from Wi-Fi traffic, poisoning the NetBIOS Name Service, and spreading laterally via the EternalBlue exploit.


A backdoor also known as: Win32.Troj.Undef.kcloud Win32/Trojan.e6d


During our analysis, we determined that Komplex was used in a previous attack campaign targeting individuals running OS X that exploited a vulnerability in the MacKeeper antivirus application to deliver Komplex as a payload.


A backdoor also known as: W64/Risk.SHRD-0827 Riskware.Win64.Pwdump.bjsgmx Tool.Pwdump.80 W64/MalwareF.NVZY SPR/Tool.174080.1 Trojan[PSWTool]/Win32.CacheDump PUP.Optional.PasswordDump Trj/CI.A Riskware.Pwdump! not-a-virus:PSWTool.Win32.PWDump


A backdoor also known as: TROJ_DROPER.SMIA Win32.Trojan-Dropper.Delf.ay W32/Backdoor.WJXY-0415 Win32/Tnega.IX TROJ_DROPER.SMIA Trojan.Win32.Delf.cvuwsq Backdoor.Win32.ProRat.~O Trojan.Inject.5089 W32/Backdoor2.DVXL TrojanDropper:Win32/Amighelo.A Trojan.Heur.ED7518 Trojan.Win32.PSWIGames.1110528 Trojan.Amighelo Win32/TrojanDropper.Delf.NOD Trojan-Dropper.Win32.OnLineGames


Our team was also able to test other commands in the lab either by tampering with the HTTP traffic from the C & C or by sending crafted SMS messages .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9770 Trojan.FakeAV.13061 Worm:Win32/Gnoewin.A W32.W.Otwycal.l4av Win32/RiskWare.PEMalform.E


A backdoor also known as: Trojan.BitMiner Trojan.Zusy.D41F53 Tool.BtcMine.1195 Backdoor.PePatch.Win32.108542 BehavesLike.Win32.Backdoor.th PUA.CoinMiner RiskTool.BitMiner.au RiskWare[RiskTool]/Win32.BitCoinMiner Trojan:Win32/Optiminz.A Unwanted/Win32.BitCoinMiner.R215923 Trj/CI.A Win32/Virus.RiskTool.435


The malware checks for sinkholing of its control servers before each network communication session and does not initiate its malicious activities—such as downloading and running the malicious payloads—if it thinks the Domain Name Service DNS records have been sinkholed.


However, the recent activity caught our attention due to a change to the URL structure of the landing pages.


When running, the Kronos payload will download several other pieces of malware, but the one that caught our eye is a new credit card dumper with very low detection.


A backdoor also known as: Trojan.Ursnif.100315 Trojan.Filecoder.Win32.1880 Uds.Dangerousobject.Multi!c TROJ_HPROVNIX.SM Win32.Trojan.WisdomEyes.16070401.9500.9985 Ransom.Cryptolocker TROJ_HPROVNIX.SM Trojan-Ransom.Win32.Snocry.dmd Trojan.Win32.Encoder.eaaxms Trojan.Win32.Z.Razy.262660 Trojan.Encoder.3689 BehavesLike.Win32.VirRansom.dh W32/Trojan.RVGU-3177 Trojan.Cryptolocker.c TR/WinPlock.262656 Trojan[Ransom]/Win32.Cryptolocker Ransom:Win32/WinPlock.A Trojan.Razy.D2A0E Trojan-Ransom.Win32.Snocry.dmd Trojan/Win32.CryptoWall.R173903 Trojan.Ransom.cryptolocker Ransom.FileCryptor Trj/GdSda.A Win32/Filecoder.NFJ Win32.Trojan.Filecoder.Wncw Trojan.Cryptolocker! Trojan.Win32.Filecoder W32/HPROVNIX.SM!tr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9960 Virus.Win32.Virut W32.Dropper.Dunik


However, the malware is flexible enough to grant access to all the resources in the victim's computer.


A backdoor also known as: Trojan/W32.Hexzone.352256 Trojan-Ransom.Win32.Hexzone.1!O Trojan.Hexzone Win32.Trojan.WisdomEyes.16070401.9500.9952 Trojan.Hexzone Ransom_Hexzone.R002C0DAD18 Trojan.Win32.Hexzone.ewziqv Trojan.Win32.Hexzone.352256 Troj.Ransom.W32.Hexzone!c TrojWare.Win32.Ransom.Hexzone.~jap3 Trojan.Blackmailer.454 Ransom_Hexzone.R002C0DAD18 Trojan-Ransom.Win32.Hexzone Trojan.Hexzone.q Trojan[Ransom]/Win32.Hexzone Adware.Heur.E6B8C4 Adware.Vundo/Variant-LIB Trojan:Win32/Hexzone.A!dll Trojan/Win32.Hexzone.R6919 Win32/Hexzone.I Trojan.Hexzone!FZcXjlI3fIw


Further investigation of GhostPush revealed more recent variants, which, unlike older ones, employ the following routines that make them harder to remove and detect:


A backdoor also known as: Trojan/Downloader.Intexp.c Win32.Trojan.WisdomEyes.16070401.9500.9782 W32/Downloader.AJWJ Adware.IEPlugin Win.Downloader.64050-1 Trojan-Downloader.Win32.Intexp.c Trojan.Win32.Intexp.didb Trojan.Win32.Downloader.33280.AKE Troj.Downloader.W32.Intexp.c!c Win32.Trojan-downloader.Intexp.Alsx TrojWare.Win32.TrojanDownloader.Intexp.C Trojan.DownLoader.2369 Downloader.Intexp.Win32.13 BehavesLike.Win32.Koobface.nc Trojan-Downloader.Win32.OneClickNetSearch W32/Downloader.XUJA-4048 TrojanDownloader.Intexp.c W32.Malware.Downloader TR/Dldr.Intexp.B Trojan[Downloader]/Win32.Intexp Win32.TrojDownloader.Intexp.c.kcloud Trojan.Graftor.Elzob.DF6F Trojan-Downloader.Win32.Intexp.c TrojanDownloader:Win32/Intexp.C Trojan/Win32.HDC.C83257 TrojanDownloader.Intexp Win32/TrojanDownloader.Intexp.C Trojan.DL.Intexp!uQMofoaT248 W32/Malware_fam.NB


android.intent.action.CONNECTIVITY_CHANGE System notification that a change in network connectivity has occurred , either lost or established .


A backdoor also known as: Trojan.Multi Trojan.Win32.VB.dmoq Trojan.Win32.VB.ewrjie Trojan.Win32.Z.Camec.51712 Uds.Dangerousobject.Multi!c Win32.Trojan.Vb.Llgx BehavesLike.Win32.Trojan.qc Trojan/Win32.VB Trojan.Win32.VB.dmoq Trojan:Win32/Camec.B Trj/GdSda.A Trojan.Win32.Camec Win32/Trojan.7b5


A backdoor also known as: Trojan.Delf.Win32.27191 Trojan/Delf.ahzk Trojan.Zusy.D3A909 Win32.Backdoor.Lukicsel.c Win32/Bifrose.AAB Win.Spyware.80655-2 W32.Lamer.lwJ1 TrojWare.Win32.Trojan.Lukicsel.~Q Trojan.MulDrop1.48720 BehavesLike.Win32.Eggnog.fc Trojan/Delf.qyz Trojan/Win32.Delf TrojanDropper:Win32/Lukicsel.B Trojan.Win32.Delf.364544.B Trojan.Delf Win32/Lukicsel.Q W32/Crypt.NTAB!tr


The use of adult-themed content echoes the one-click billing fraud app we've covered a few years back.


SHA256 Package Name App Name a6c7351b09a733a1b3ff8a0901c5bde fdc3b566bfcedcdf5a338c3a97c9f249b com.android.henbox 备份 ( Backup ) Table 3 HenBox variant used in description Once this variant of HenBox is installed on the victim ’ s device , the app can be executed in two different ways : One method for executing HenBox is for the victim to launch the malicious app ( named “ Backup ” , in this instance ) from the launcher view on their device , as shown in Figure 3 below .


A backdoor also known as: Backdoor.MSIL Backdoor.Telebot BKDR_TELEBOT.VBV Win.Trojan.Nyetya-6332125-0 Backdoor.Msil.Teledoor!c Win32.Trojan.Telebot.Acxl BackDoor.Medoc.2 Trojan.TeleDoor.Win32.2 BKDR_TELEBOT.VBV Backdoor.Teledoor W32/Trojan.RZZO-3107 Backdoor.MSIL.ojt W32.Backdoor.Medoc TR/TeleDoor.ME.1 Trojan[Backdoor]/MSIL.TeleDoor Trojan/Win32.TeleDoor.C2029730 Backdoor.MSIL.Telebot Bck/Teledoors.A Trojan.TeleDoor!


A backdoor also known as: Trojan.BitMin.Win32.519 Trojan.Strictor.D1BA5D Trojan.Script.AutoIt.emewzp Trojan.BtcMine.1084 BehavesLike.Win32.BadFile.wc TR/BitCoinMiner.zzzlc Trojan/Win32.BitMin.C1728272 Trojan.Win32.Autoit Trj/CI.A


A backdoor also known as: Win32/PSWSpider.E Backdoor.Bancodor.M Backdoor.Bancodor.M Backdoor.Bancodor.M Backdoor/Bancodor.m Backdoor.Bancodor.M W32/Bancodor.T@bd Backdoor.Badcodor Win32/Bancodor.M BKDR_BANCODOR.M Win.Trojan.Bancodor-27 Backdoor.Win32.Bancodor.m Trojan.Win32.Bancodor.dbrs Backdoor.Win32.Bancodor.513024[h] Backdoor.W32.Bancodor.m!c Backdoor.Bancodor.M Backdoor.Win32.Bancodor.~O Backdoor.Bancodor.M Trojan.Bancdo Backdoor.Bancodor.Win32.40 BKDR_BANCODOR.M W32/Bancodor.UWGT-1776 Backdoor/Bancodor.ak BDS/Bancodor.M.1 Trojan[Backdoor]/Win32.Bancodor Backdoor.Bancodor.M Backdoor:Win32/Bancodor.M Win-Trojan/Bancodor.513024.C Backdoor.Bancodor Bck/Bancodor.E Win32.Backdoor.Bancodor.Oyep Backdoor.Bancodor!IZl0vEMNH4U Backdoor.Win32.Bancodor Backdoor.Bancodor.M BackDoor.Bancodor.AS Backdoor.Win32.Bancodor.m


We believe this indicates a fairly sustained campaign that has gained momentum over recent months .


A backdoor also known as: Trojan.Dropper.GreenStuff.1.7 Win32.Trojan.WisdomEyes.16070401.9500.9688 Trojan.Dropper Win32/Pasorot.D Win.Trojan.Greenstuff-3 Trojan.Dropper.GreenStuff.1.7 Trojan-Dropper.Win32.GreenStuff.17 Trojan.Dropper.GreenStuff.1.7 Troj.Dropper.W32.GreenStuff.17!c Win32.Trojan-dropper.Greenstuff.Ebgv Trojan.Dropper.GreenStuff.1.7 TrojWare.Win32.TrojanDropper.GreenStuff.17 Trojan.Dropper.GreenStuff.1.7 Trojan.MulDrop.365 Dropper.GreenStuff.Win32.14 BehavesLike.Win32.Trojan.dc W32/Trojan.KLUP-2808 TrojanDropper.Exebinder TR/Pasorot.g Trojan[PSW]/Win32.Pasorot Trojan.Dropper.GreenStuff.1.7 Trojan-Dropper.Win32.GreenStuff.17 TrojanDropper:Win32/GreenStuff.1_7 Trojan/Win32.Downloader.C112567 TScope.Malware-Cryptor.SB Trj/Dropper.WF Win32/TrojanDropper.GreenStuff.17 W32/GreenSt.B!tr.dr


A backdoor also known as: MemScan:Trojan.Downloader.Modgof.A MemScan:Trojan.Downloader.Modgof.A Trojan.Scar.daok Trojan.Win32.Scar.tlmwj TROJ_AZAH.A Trojan.Win32.Scar.daok MemScan:Trojan.Downloader.Modgof.A Trojan.Scar!ZI1ghG8RGXc MemScan:Trojan.Downloader.Modgof.A Trojan.MulDrop1.43719 TROJ_AZAH.A Win32.Troj.Scar.kcloud Trojan.Win32.A.Downloader.120320.DL MemScan:Trojan.Downloader.Modgof.A Worm.Win32.FakeFolder.b W32/AZAH.A!tr


The first function is used for contact information stealing : the function upCon steals all contacts in the contact list and their information .


A backdoor also known as: Trojan.FakeGina.X Trojan.Fakegina Trojan.FakeGina.X Trojan/FakeGina.b TROJ_FAKEGINA.AA Win32.Trojan.FakeGina.b W32/Risk.LOJP-2889 Trojan.Fakegina TROJ_FAKEGINA.AA Trojan.FakeGina.X Trojan.FakeGina.X Trojan.FakeGina.X TrojWare.Win32.FakeGina.~B Trojan.FakeGina.X Trojan.FakeGina.Win32.121 Trojan.Win32.FakeGina W32/MalwareF.NCOX Trojan/Win32.FakeGina Trojan.FakeGina.X Trojan:Win32/Fakegina.T Trojan/Win32.FakeGina.R77324 Win32/FakeGina.B Win32.Trojan.Fakegina.Wmst W32/FakeGina.AA!tr


The campaign targeted Japanese organizations by using at least two legitimate Japanese websites to host a strategic web compromise SWC, where victims ultimately downloaded a variant of the SOGU malware.


It connects to a certain URL, likely controlled by the attacker, using a specific Go user-agent:


The first phase is receiving malspam from a botnet.


A backdoor also known as: Trojan.Graftor.D49E51 W32/Trojan.ULWD-7621 Trojan.Win32.Drop.elkhrw BehavesLike.Win32.Sivis.kh Trojan-Dropper.Win32.Rubat W32/Win.G Trojan.SchoolGirl.er TR/Drop.Rubat.qlzld TrojanDropper:Win32/Rubat.A!bit Trojan.SchoolGirl


Unfortunately , for now we can ’ t say in what environment these landing pages were used in the wild , but according to all the information at our dsiposal , we can assume that they are perfect for exploitation using malicious redirects or man-in-the-middle attacks .


If the threat reappears on the device after the first installation , it means that the malware managed to install the persistency module in the System directory .


A backdoor also known as: W32.CominateU.Adware Trojan-GameThief.Win32.OnLineGames!O TrojanGameThief.OnLineGames Trojan.OnLineGames.Win32.78851 Trojan/OnLineGames.boaj Trojan.Zusy.Elzob.D484 W32/Risk.ADYI-1535 TSPY_ONLIN.SMUM Win.Spyware.82985-2 Trojan-GameThief.Win32.OnLineGames.boaj Trojan.Win32.OnLineGames.cptyo BackDoor.Sturf.170 TSPY_ONLIN.SMUM W32/MalwareF.AEIUQ Trojan/PSW.OnLineGames.cedq TR/Spy.671314 Trojan[GameThief]/Win32.OnLineGames Trojan-GameThief.Win32.OnLineGames.boaj Trojan/Win32.OnlineGameHack.R11892 TrojanPSW.OnLineGames.bo Win32/PSW.OnLineGames.QDP Trojan.PWS.OnLineGames!mLCnhslfoqM Trojan-GameThief.Win32.OnLineGames W32/Onlinegames.BOJI!tr.pws


A backdoor also known as: Trojan/W32.Timer.55808.B Trojan-Ransom.Win32.Timer!O Trojan/Kryptik.sot Trojan.Boigy.4 TROJ_RANSOM.SMMJ Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Ransom.GED TROJ_RANSOM.SMMJ Trojan-Ransom.Win32.Timer.icg Trojan.Win32.Timer.dqvge Trojan.Win32.A.Timer.55808 Trojan.Winlock.4005 Trojan/Timer.cnd TR/Ramson.TR TrojanDropper:Win32/Dinome.A Trojan-Ransom.Win32.Timer.icg Trojan/Win32.Ransomlock.R11433 BScope.Trojan.Winlock.01505 Trj/Hexas.HEU Trojan-Downloader.Win32.Karagany


A backdoor also known as: Ransom/W32.Foreign.409600.C Trojan.Foreign Ransom_Foreign.R002C0DB418 Trojan-Ransom.Win32.Foreign.nxzy Trojan.Win32.Spambot.exqsne Trojan.Win32.Z.Trubsil.409600 Troj.Ransom.W32.Foreign!c Trojan.Spambot.15075 Ransom_Foreign.R002C0DB418 BehavesLike.Win32.Ransom.gc TR/Crypt.ZPACK.lpngp Backdoor:Win32/Trubsil.C Trojan-Ransom.Win32.Foreign.nxzy Trojan/Win32.Foreign.C2394896 TrojanRansom.Foreign Trj/GdSda.A W32/Kryptik.FRKA!tr


A backdoor also known as: W32.DakusarDRAX.Trojan Trojan.Floxif Win32.Trojan.WisdomEyes.16070401.9500.9948 Win32/Flofix.D TROJ_FLOXIF_EK040354.UVPM Trojan.Win32.Floxif.cqjmcu Win32.FloodFix Trojan.Floxif.Win32.2 TROJ_FLOXIF_EK040354.UVPM TR/Spy.69337 Trojan:Win32/Floxif.E Virus/Win32.Fixflo.R204310 Trojan.Sly Win32/Floxif.E W32/Floxif.E


] com Malicious Twitter accounts : https : //twitter.com/lucky88755 https : //twitter.com/lucky98745 https : //twitter.com/lucky876543 https : //twitter.com/luckyone1232 https : //twitter.com/sadwqewqeqw https : //twitter.com/gyugyu87418490 https : //twitter.com/fdgoer343 https : //twitter.com/sdfghuio342 https : //twitter.com/asdqweqweqeqw https : //twitter.com/ukenivor3 Malicious Instagram account : https : //www.instagram.com/freedomguidepeople1830/ Malicious Tumblr accounts : https : //mainsheetgyam.tumblr.com/ https : //hormonaljgrj.tumblr.com/ https : //globalanab.tumblr.com/ C & C addresses : 104 [ .


Unit 42 discovered new activity that appears related to an adversary group previously called C0d0so0 or Codoso


As a result , no new instances of this app can be installed on iOS devices and existing installations can no longer be run .


We have observed download attempts from the following domains:


In 2022, they updated SysUpdate, one of their custom malware families, to include new features and add malware infection support for the Linux platform.


A backdoor also known as: HW32.Packed.3797 JS.Nemucod.LK VBS/DropExe.A!Camelot Trojan.Script.MLW.eafugn VBS.Dropper.102 TrojanDropper.VBS.aq TrojanDropper:VBS/Twexag.A


East Asian government agencies came under siege when attackers targeted several servers within their networks.


A backdoor also known as: W32/AutoRun.autv W32/Sohanad.G WORM_SOHANAD.DX Virus.Worm.AutoRun!IK Win32.HLLW.Autoruner.8327 WORM_SOHANAD.DX W32/Sohanad.G Worm/AutoRun.mky Malware.Imaut Virus.Worm.AutoRun SHeur.CIAA Trj/CI.A


A backdoor also known as: Trojan.RansomKD.6014218 Ransom.Chicrypt Ransom.Chimera Trojan/Kryptik.edes Trojan.RansomKD.D5BC50A Ransom_Chicrypt.R002C0DIL17 W32/Ransom.IF Trojan-Ransom.Win32.Chimera.q Trojan.RansomKD.6014218 Trojan.Win32.Encoder.esuyoq Troj.Ransom.W32!c Win32.Trojan.Chimera.Edei Trojan.RansomKD.6014218 Trojan.RansomKD.6014218 Trojan.Encoder.2774 W32/Ransom.KXVS-1328 W32.Ransom.Chimera Trojan[Ransom]/Win32.Chimera Ransom:Win32/Chicrypt.A Trojan.Win32.Z.Ransom.647242 Trojan-Ransom.Win32.Chimera.q Win32.Trojan-Ransom.Chimera.D Trojan/Win32.Chimera.C1182585 Trojan.RansomKD.6014218 Hoax.Chimera Trojan.Kryptik!1o3s7Z7mkiE W32/Chimera.EDES!tr Win32/Trojan.37c


A backdoor also known as: W32.ClickerAybn.Trojan Trojan-Spy.Win32.VB!O Trojan.Puzlice.A3 Win32.Trojan-Clicker.VB.c Win32/TrojanClicker.VB.NUE Win.Trojan.7640471-1 Worm.Win32.Autorun.gxay Trojan.Win32.VB2.cnioik Trojan.Win32.A.VB.55040 W32.Virut.lQTU TrojWare.Win32.Spy.VB.FRG Trojan.VbCrypt.68 Trojan.VB.Win32.83289 BehavesLike.Win32.Malware.nc Virus.Win32.Virut TrojanSpy.VB.cxx Trojan[Spy]/Win32.VB Worm.Win32.Autorun.gxay Trojan:Win32/Puzlice.A Win32/VB.BXL TScope.Trojan.VB Trojan.Vilsel TrojanSpy.VB!jmRymi1V2Tw W32/VBClicker.NUE!tr


A pro-democracy reform took place in 2011 which has helped the government create an atmopshere conducive to investor interest.


A backdoor also known as: Backdoor.Turla.B5 BKDR64_TURLA.NUS Trojan.Turla BKDR64_TURLA.NUS Win64.Rootkit.Uroburos.A Backdoor.Win64.Turla.c Trojan.Win64.Turla.dflvhj BackDoor.Turla.17 Trojan.Turla.Win64.1 BDS/Turla.fech Backdoor.Win64.Turla.c Backdoor:Win64/Turla.B!dha Trojan/Win64.Turla.C560438 Backdoor.Turla Trj/CI.A Win64/Turla.A Win32.Trojan.Url.Fdjm Trojan.Turla!2u6AW7YKCfw


A backdoor also known as: Trojan.Japik.6 TROJ_IKYTOK.SMI Win32.Trojan.WisdomEyes.16070401.9500.9979 Trojan.Ransomlock TROJ_IKYTOK.SMI Trojan.Packed.2232 Trojan.Kryptik.Win32.166130 BehavesLike.Win32.VTFlooder.fc Trojan-Downloader.Win32.Karagany TrojanDropper.Mudrop.cmh TrojanDropper:Win32/Sinmis.B Trojan/Win32.Menti.R9584 BScope.Malware-Cryptor.Tip


A backdoor also known as: Trojan.Dynamer.S23079 Win32.Trojan.Kryptik.bil Win.Malware.Zusy-5689799-0 Trojan.Inject2.38898 Trojan.Kryptik.Win32.992532 BehavesLike.Win32.PWSZbot.cm Trojan.Win32.Extenbro Backdoor.Androm.mnb TR/Crypt.ZPACK.pwvcr Trojan.Symmi.D10FCD Trojan/Win32.Androm.R192120


A backdoor also known as: PDF/Phish.ECM Win32.Exploit.Pidief.Aexw PDF/Phish.ECM EXP/Pidief.EB.494 Exp.Pidief.Eb!c Trojan.PDF.Phishing Win32/Trojan.Exploit.ec6


We 've seen that this has been the case for many years with spear-phishing campaigns on desktop and mobile platforms , so , unfortunately , it does n't seem that this will change any time soon .


HenBox checks whether this execution is its first by using Android ’ s shared preferences feature to persist XML key-value pair data .


MESSAGE – send SMS containing specified text to a specified number .


A backdoor also known as: HackTool.TSGrinder Trojan/Hacktool.TSGrinder.a W32/Tool.JPZP-4469 Crackin.0AC64262 HackTool.Win32.TSGrinder.a Trojan.Win32.TSGrinder.scgl HackTool.TSGrinder.192570 Hacktool.W32.Tsgrinder!c ApplicUnsaf.Win32.HackTool.TSGrinder.a Tool.TSGrinder W32/VirTool.AYV W32.Hack.Tool HackTool/Win32.TSGrinder HackTool.Win32.TSGrinder.a HackTool:Win32/Tsgrinder.A Win32.Hacktool.Tsgrinder.Stkm HackTool.TSGrinder!LpD0k7ExEpE HackTool.Win32.TSGrinder.a


A backdoor also known as: TrojanDownloader.Lorozoad.A3 Trojan.Razy.D2614 Win32.Trojan.WisdomEyes.16070401.9500.9997 Win.Trojan.Lorozoad-1 Trojan.MSIL.Disfa.mcnf Trojan.Win32.Tiny.etgbky Trojan.Win32.Z.Razy.4608.CD Troj.Msil.Disfa!c TrojWare.MSIL.TrojanDownloader.Tiny.MXA BehavesLike.Win32.Trojan.xz TR/Dropper.MSIL.nsnpx Trojan.MSIL.Disfa.mcnf Trj/GdSda.A Msil.Trojan.Disfa.Pctb Trojan.Disfa!3Wzl0Mq4C1c Trojan-Downloader.MSIL.Tiny MSIL/Tiny.MX!tr.dldr Win32/Trojan.85b


A backdoor also known as: W32.DownloadPdzLnrA.Trojan Worm.Win32.WBNA!O W32/WBNA.asj Win32.Trojan.WisdomEyes.16070401.9500.9988 Win.Trojan.Wbna-299 Worm.WBNA.Win32.2209 BehavesLike.Win32.VBObfus.qt W32/VB.PID!tr.dldr Worm/Win32.WBNA Worm.WBNA Win32/TrojanDownloader.VB.PID Trojan-Downloader.Win32.VB Win32/Trojan.c6e


A backdoor also known as: W32/Trojan.LNJS-3256 Trojan.Win32.Mazel.dsuwke BehavesLike.Win32.Sytro.lc TR/AD.Lentrigy.ejnsf RiskWare[Downloader]/NSIS.Mazel Trojan.Jaiko.851 TrojanDownloader:Win32/Rolkator.A Trj/CI.A Trojan.Win32.IRCBot Win32/Trojan.698


We have not identified any other public names for this malware, so rather than introduce a new name to the industry we'll refer to this family as Sarvdap.


This information may be useful to any incident responder or blue team looking to defend an organisation.


In addition , at this stage the app can process one of these commands : • Collect device info • Install app • Is online ? • Change server domain Out of these , the most interesting command is the “ install app ” command that downloads an encrypted zip file containing the second phase dex file , unpacks and loads it .


Infostealer.Banprox.B is a Trojan horse that may steal information from the compromised computer.


The incident used a Microsoft Excel file containing malicious macros which wrote a malicious executable and associated files to the victim machine.


A backdoor also known as: Trojan.Ransom.Locky.20 Win32.Trojan.WisdomEyes.16070401.9500.9879 Ransom_Falock.R002C0DAI18 Trojan.Win32.Z.Ransom.1819072 Ransom_Falock.R002C0DAI18 BehavesLike.Win32.Trojan.th W32/Trojan.CXBD-0386 Ransom:MSIL/Falock.A Trj/GdSda.A Trojan.MSIL.Crypt Win32/Trojan.Ransom.d73


In addition, unlike many cyber attacks, an actual physical person was present money mule to pick up the money from affected ATM machines.


EventBot C2 URLs C2 URLs and other settings in a nested class .


Trojan details Upon boot , the trojan will start by populating a shared preferences file with the configuration it has on its internal structures .


A backdoor also known as: Trojan.Spammer.Mail.Norin.A Trojan/W32.Spammer.606720 Email-Flooder.W32.Norin.30!c TROJ_NORIN.30 Hacktool.Spammer TROJ_NORIN.30 Trojan.Spammer.Mail.Norin.A Email-Flooder.Win32.Norin.30 Trojan.Spammer.Mail.Norin.A Trojan.Win32.Norin.dkrt Spyware.Email-Flooder.Norin.606720 Trojan.Spammer.Mail.Norin.A Win32.Spammer.Mail.Norin.30 Trojan.Spammer.Mail.Norin.A Trojan.PWS.Wmhack Tool.Norin.Win32.1 Virus.Win32.Spammer W32/Risk.SGYO-3478 Spammer.Mail.Norin.30 TR/Flood.Norin.30 HackTool[Flooder]/Win32.Norin Win32.Hack.Norin.kcloud Trojan.Spammer.Mail.Norin.A Email-Flooder.Win32.Norin.30 Trojan.Spammer.Mail.Norin.A EmailFlooder.Norin Win32/Spammer.Mail.Norin.30 Win32.Virus.Spammer.Syhs Flooder.Norin!cC98wqxpE9A W32/Spam_Norin.30!tr Win32/Trojan.Flooder.81a


This attack might also originate from China.


A backdoor also known as: W32.HfsAutoB.186B Worm.Dorkbot.A Backdoor.W32.Padodor.kZnr Trojan/Spy.qukart Win32.Trojan-Spy.Quart.a Backdoor.Berbew!g1 Win32/Webber.W Win32.Qukart BKDR_BERBEW.SMA Win.Trojan.Crypted-36 Trojan-Proxy.Win32.Qukart.vjh Trojan.Win32.Qukart.etuxeg Worm.Win32.Qukart.K BackDoor.HangUp.43784 BKDR_BERBEW.SMA BehavesLike.Win32.Backdoor.cc Trojan.Win32.Senta TrojanProxy.Qukart.tsk Trojan-Proxy.Win32.Qukart.vjh Win-Trojan/Berbew.51712 TrojanProxy.Qukart Trojan-Ransom.Win32.Pornoasset.a


A backdoor also known as: W32.FamVT.ExpiroPC.PE Heur.Corrupt.PE Tool.BtcMine.30 Backdoor.Win32.Cycbot


Equipped reverse shell payload with specific string After an in-depth look , we found that some versions of the reverse shell payload code share similarities with PRISM – a stealth reverse shell backdoor that is available on Github .


The server ’ s response is a json , containing a link to a .jar file , class name and method name to be executed with reflection API .


Using this SSH brute-forcing network, it took the attackers only a few days to gain root access and full control of the targeted server.


A backdoor also known as: Trojan/Cosmu.ajmd Trojan.Win32.Cosmu.cptjv Trojan.Win32.Cosmu.ajmd Win32.HLLW.Zebra.2 TR/PSW.Facepass.oina Trojan/Cosmu.fqh PWS:Win32/Facepass.B Trojan.Win32.A.Cosmu.436714 Trojan.Cosmu W32/Cosmu.AJMD!tr Trj/CI.A


When we first discovered the OilRig attack campaign in May 2016, we believed at the time it was a unique attack campaign likely operated by a known, existing threat group.


To date , Unit 42 has seen four of the seven ( the first three in the list below , along with cdncool [ .


Sundown is something of an outlier from typical exploit kits.


The failure of Silicon Valley Bank SVB is a good opportunity for scammers to make a buck out of the crisis, warns the SANS™ Internet Storm Center ISS in Washington DC.


We have examined all the detected versions , including the latest one that is signed by a certificate valid from September 14 , 2017 .


For example, one version of the Shade cryptor checks victim computers for signs of accounting activity; if it finds any, it doesn't encrypt the files, but instead installs remote control tools in the infected system.


This post intends to share the results of our research.


A backdoor also known as: Trojan-Spy/W32.KeyLogger.464896.C TrojanSpy.KeyLogger!s9RPvqhksKk Infostealer.Gampass Win32.BDSBackdoor Trojan-Spy.Win32.KeyLogger.gds BackDoor.Cyber Virus.Win32.Delf.DTW!IK TrojanSpy.KeyLogger.cquv Win-Trojan/Keylogger.464896.G Trojan.Win32.Scar.cmim Trojan-PSW.Gampass Virus.Win32.Delf.DTW W32/KeyLogger.GDS!tr PSW.Keylog.AE Trj/CI.A


The appearance of such forms is generated on cybercriminals' command.


CVE-2017-11882 Exploit 8b212ee2d65c4da033c39aebaf59cc51ade45f32f4d91d1daa0bd367889f934d is a Microsoft Word RTF document that exploits `CVE-2017-11882` stack buffer overflow vulnerability in the Microsoft Equation Editor`EQNEDT32.EXE`.


This IOC contains indicators for the BLACKCOFFEE malware family that is attributed to APT17.


] 102 2020-03-29 http : //ora.blindsidefantasy [ .


A backdoor also known as: Trojan.Neloweg TR/Drop.Elms.A PWS:Win32/Reder.B Trojan.Neloweg Trj/CI.A


A backdoor also known as: Trojan.Win32.Inject.cvmjon Trojan.Taidoor TROJ_DROPPE.FS Trojan-Dropper.Win32.Injector.jmli Virus.Win32.Part.a TROJ_DROPPE.FS BehavesLike.Win32.Downloader.qm TrojanDropper.Injector.bmtq Trojan[Dropper]/Win32.Injector Win32.Troj.Injector.JM.kcloud Dropper/Win32.Injector TrojanDropper.Injector W32/Injector.JMLI!tr Trojan.Win32.Injector.aJX


So we don't have a sensational hop from Linux Mirai to Windows Mirai just yet, that's just a silly statement.


A Trojan for Linux written in Go programming language.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Dropper.ALCD Win32/Rimecud.CU TROJ_DROPPR.SMF Win32.Worm.Peerfrag.Aojj Win32.HLLW.Lime.18 Worm.Palevo.Win32.18245 TROJ_DROPPR.SMF BehavesLike.Win32.Madangel.cc W32/Risk.KNKR-8810 Trojan.Zusy.D421A9 Win32/Peerfrag.DI P2P-Worm.Win32.Palevo


This variant, which we call MULTIGRAIN consists largely of a subset of slightly modified code from NewPosThings.


Whether this is a permanent return to locky or a one off, I don't know at this stage, but Locky have vanished for while before returned.


A backdoor also known as: Trojan.Win32.SamDump.emgukv Uds.Dangerousobject.Multi!c Tool.SamDump.Win32.1 W32/Trojan.PXMQ-2326 TR/Rogue.9140774 PUP/Win32.SamDump.C241237 Riskware.HackTool!GhRtS0e2yEc Win32/Trojan.f29


A backdoor also known as: Trojan.Win32.Dwn.ewbodt Trojan.Win32.Z.Starter.4103380 Trojan.DownLoader26.1573 BehavesLike.Win32.Dropper.wc Trojan.Win32.Chifrax W32/Trojan.BMGR-3693 Exploit:Win32/CplLnk.B Win32/Trojan.9b2


Because of the recent outbreak of the Locky ransomware, Dridex has become synonymous with the distribution of ransomware more generally.


PhotoMiner features a unique infection mechanism, reaching endpoints by infecting websites hosted on FTP servers while making money by mining Monero.


It includes recent incidents as well as older ones that have not been publicly reported; new malware; exploitation, delivery and command and control infrastructure; and the group s modus operandi.


That domain, electronicfrontierfoundation.org, is designed to trick users into a false sense of trust and it appears to have been used in a spear phishing attack, though it is unclear who the intended targets were.


Last week, Unit 42 came across new Disttrack samples that appear to have been used in an updated attack campaign.


The proliferation of Android devices – from smartphones to tablets and smart TVs – has opened up new possibilities for malware developers , as all these devices pack microphones , cameras and location-tracking hardware they can turn into the perfect spy tools .


For instance, its JHUHUGIT implant was delivered through a Flash zero-day and used a Windows EoP exploit to break out of the sandbox.


The group is well resourced, capable of infiltrating multiple targets simultaneously and will often operate outside the working hours of targeted organizations in order to maintain a low profile.


A backdoor also known as: TROJ_BREDLAB.SMD Trojan-Spy.Win32.Spenir.as Application.Win32.BlkIC.IMG TROJ_BREDLAB.SMD Backdoor/SdBot.prb HeurEngine.ZeroDayThreat Trojan.Win32.ProcessHijack


It continues to spread across small and medium-sized businesses across the globe, using the modular Gorynych/Diamond Fox botnet to exfiltrate stolen data.


A backdoor also known as: Hoax.Win32.ArchSMS!O Trojan.Mobsularch Trojan.ArchSMS.Win32.7426 Trojan/ArchSMS.nkit Win32.Trojan.WisdomEyes.16070401.9500.9644 TROJ_MALICIOUS_BK083028.TOMC Win.Trojan.Archsms-4649 Riskware.Win32.ArchSMS.cqmlwf TrojWare.Win32.Zusy.AJ Trojan.Fraudster.336 Trojan-Banker.Win32.Banbra Hoax.ArchSMS.jho HackTool[Hoax]/Win32.ArchSMS Win32.Troj.Hoax.kcloud Trojan:Win32/Mobsularch.A Trojan.Strictor.548 Win32.Trojan.ArchSMS.D Hoax.ArchSMS.nk Trojan.ArchSMS!pTXIElAMXBk W32/ArchSMS.VU!tr


Palo Alto Networks has collected over 20 samples of this particular malware family, and we have identified over $70,000 USD in Bitcoin payments to the attacker Cisco Talos yesterday reported this figure to be closer to $115,000 USD.


A backdoor also known as: Trojan.Pitit.A3 HV_ABTITU_CG093139.RDXN TR/Barys.2445.24 Win32.Troj.Undef.kcloud Trojan.Kazy Trojan.Win32.Loader.L


A collection of domains registered by Pawn Storm/Sofacy/APT28/Fancy Bear to target organisations


A backdoor also known as: W32.CoinMiner.A4 PUP.Optional.ChinAd W32.XiaobaMiner Win32/Oflwr.A!crypt Win.Trojan.Qhost-160 Trojan.Win32.BtcMine.exddfs Tool.BtcMine.1051 BehavesLike.Win32.Ransomware.th W32.Trojan.Qhost RiskWare/Win32.BitMiner.h Trojan.Forcud


While it has become common to see new ransomware variants being distributed daily, it is not as common to find new ransomware infections being distributed via exploit kits.


A backdoor also known as: HW32.Packed.1FBC Win32.Trojan.WisdomEyes.16070401.9500.9950 Win.Exploit.Countdown-1 BackDoor.Meterpreter.37 Troj.W32.Jorik.Skor.lrUS Trojan:Win64/Meterpreter.A Trojan/Win32.Swrort.C695042


We previously highlighted the dangers of installing apps that enable IAPs using SMS messages, as these apps typically have access to all SMS messages sent to the phone.


U.S. Allies and Rivals Digest Trump's Victory - Carnegie Endowment for International Peace.docm


During the course of our research, it became evident that this actor had not built uWarrior from scratch, but rather opted to borrow components from several off-the-shelf tools.


Hackers made a modified Linux Mint ISO, with a backdoor in it, and managed to hack the Linux Mint website to point to it.


A backdoor also known as: Trojan-Dropper.Win32.BindFile!O Trojan/Dropper.BindFile.a W32/Dropper.LIP Trojan.Spy-681 Trojan-Dropper.Win32.BindFile.e Trojan.Win32.BindFile.dcyo Trojan.Win32.BindFile.188416 PE:Dropper.BindFile.h!1173781522 TrojWare.Win32.TrojanDropper.BindFile.A Trojan.Progress.10 TrojanDropper.ExeBind.Mfc2 Dropper/Bindfile.496648 W32/Risk.SLHR-7237 Win32/TrojanDropper.BindFile.A Trojan-Dropper.Win32.BindFile W32/BindFile.A!tr Trojan.Win32.BindFile.bA


A backdoor also known as: Trojan/Kryptik.aspo JAVA_EXPLOIT.TCC JAVA_EXPLOIT.TCC Win.Trojan.Hydraq-219 Exploit.Java.CVE20131493.cqvzpg Java.S.EX-CVE-2013-1493.206981 Exploit.Java.509 EXP/Java.HLP.JM W32/Kryptik.ASPO Trojan.Graftor.D13511 Exploit.Java.CVE-2013-1493 Java/Exploit.CVE-2013-1493.AL Unk.Win32.Script.400440 Trojan.Plugax!dr/f2r5A7aY Exploit.Java.HLP virus.java.cve-2013-1493.c


We have seen Angler to be using bedep as its payload but adding vawtrak in its arsenal is something we haven't seen in the past until recently.


Attackers have been able to successfully implant JavaScript code on the login pages that enables them to surreptitiously steal employee credentials as they login to access internal corporate resources.


Since then , the implant ’ s functionality has been improving and remarkable new features implemented , such as the ability to record audio surroundings via the microphone when an infected device is in a specified location ; the stealing of WhatsApp messages via Accessibility Services ; and the ability to connect an infected device to Wi-Fi networks controlled by cybercriminals .


A backdoor also known as: Trojan.Dropper BKDR_QBOT.SM Win32.Trojan-Dropper.Small.s Win32/Qakbot.KR BKDR_QBOT.SM Trojan.Win32.Gamania.tghgw Trojan.Win32.A.Mbro.191488 Trojan.PWS.Gamania.36525 W32/Trojan.XMWQ-0223 Trojan[Backdoor]/Win32.QBot TrojanDropper:Win32/Qakbot.A Dropper/Win32.Injector.R30051 Win32/TrojanDropper.Small.NMS Trojan.Kryptik!nABTr99RVjs Backdoor.Win32.Qakbot W32/Dropper.NMS!tr Win32/Trojan.a58


As of September 17th Dyreza now counts an additional twenty organizations directly involved in Fulfillment and Warehousing; four software companies that support Fulfillment and Warehousing; five Wholesale Computer Distributors; and its credential theft triggers include Apple, Iron Mountain, OtterBox and Badge Graphics Systems and many other well-known consumer- and business-facing technology and service brands.


This malware possesses the ability to Collect information about an infected computer and transfer it to the command and control server.


Malware isn't usually thought to be old, but a recent phishing campaign using the MyDoom worm has shown that old tools can still be used to lure users into malware.


2015–2016 Starting from mid-2015 , the Trojan began using the AES algorithm to encrypt data communicated between the infected device and the C & C : Also starting with the same version , data is sent in a POST request to the relative address with the format “ / [ number ] ” ( a pseudo-randomly generated number in the range 0–9999 ) .


SSL is typically used to encrypt data between the client and the server, thus making the content unreadable by any systems sitting between the two end points, and significantly raising the cost of defence.


A backdoor also known as: Trojan/W32.Zapchast.113152 Backdoor.KeyBoy Trojan.Zapchast.Win32.29227 Trojan.Heur.LP.EDDB38 Win32.Trojan.WisdomEyes.151026.9950.9999 Backdoor.Kboy Trojan.Win32.Zapchast.afhn Trojan.Win32.Zapchast.cjltha Win32.Trojan.Zapchast.Htcu BehavesLike.Win32.GameVance.ch Trojan/Zapchast.iik TR/Spy.113152.29 Trojan/Win32.Zapchast Backdoor.Win32.KeyBoy.113152[h] Win-Trojan/Keyboy.113152 Trojan.Win32.Zapchast.afhn Trojan.Zapchast!0ThicNhZU3g Trojan.Win32.Zapchast W32/Zapchast.AFHN!tr Win32/Trojan.020


Bot communicates with the botmaster using non-standard protocol built on top of TCP.


A backdoor also known as: Trojan/W32.QQKiller.183808 Trojan.Qqkiller.A Trojan.QQKiller.Win32.2 Trojan.Qqkiller.A Trojan/QQKiller.a Trojan.QQKiller!Y2SikmBtqEk Win32/QQKiller.A TROJ_QQKILLER.A Trojan.Win32.QQKiller.a Trojan.Win32.QQKiller.erxn Trojan.Win32.A.QQKiller.183808[h] Trojan.Qqkiller.A TrojWare.Win32.QQKiller.A Trojan.Qqkiller.A Trojan.Nudeq TROJ_QQKILLER.A BehavesLike.Win32.HLLPPhilis.cc W32/Trojan.ELFE-7308 Trojan/Win32.QQKiller TR/QQKiller.2 W32/GWGhost.A!tr Trojan/Win32.QQKiller Trojan.Qqkiller.A Troj.W32.QQKiller.a!c Win-Trojan/QQKiller.183808 Trojan.QQKiller Win32.Trojan.Qqkiller.Szkz Trojan.Win32.QQKiller Trojan.Qqkiller.A Trojan.Win32.QQKiller.a


A backdoor also known as: Trojan/W32.Duqu.24960.B Trojan.Win32.Duqu!O Trojan/Duqu.a Trojan.Duqu.1 Win32.Trojan.WisdomEyes.16070401.9500.9896 W32/Duqu.C W32.Duqu Win32/Duqu.A RTKT_DUQU.SME Win.Trojan.Duqu-7 Trojan.Win32.Duqu.a Trojan.Win32.Duqu.eorzg Trojan.Win32.Duqu.24960 TrojWare.Win32.Duqu.A Trojan.Duqu.2 Trojan.Duqu.Win32.2 RTKT_DUQU.SME W32/Duqu.BOQU-9196 Trojan/Duqu.b TR/Duqu.A.1 Trojan/Win32.Duqu Trojan:WinNT/Duqu.B Troj.W32.Duqu.a!c Trojan.Win32.Duqu.a Trojan/Win32.Duqu.R13984 Trojan.Duqu.2102 Win32/Duqu.A Win32.Trojan.Duqu.Pjnh Trojan.Duqu!o6SU6/Pq/F4 Trojan.Win32.Duqu W32/Duqu.A!tr


We identified 42 apps on Google Play as belonging to the campaign , which had been running since July 2018 .


The malware takes these steps : Check if the system master boot record ( MBR ) contains an infection marker ( 0xD289C989C089 8-bytes value at offset 0x2C ) , and , if so , terminate itself Check again if the process is attached to a debugger ( using the techniques described previously ) Read , decrypt , and map the stage 5 malware ( written in the previous stage in msvcr90.dll ) Open winlogon.exe process Load user32.dll system library and read the KernelCallbackTable pointer from its own process environment block ( PEB ) ( Note : The KernelCallbackTable points to an array of graphic functions used by Win32 kernel subsystem module win32k.sys as call-back into user-mode .


A backdoor also known as: Trojan-Downloader.Win32.Gamarue.2!O Trojan.Shamoon.1 trojan.win32.skeeyah.a!bit Win32.Trojan.WisdomEyes.16070401.9500.9991 W32.Disttrack.B WORM_DISTTRACK.SMC Win.Dropper.DistTrack-5744784-0 Backdoor.Win32.RemoteConnection.d Trojan.Win32.RemoteConnection.ekxrsg WORM_DISTTRACK.SMC Backdoor.RemoteConnection.a Trojan[Backdoor]/Win32.RemoteConnection Trojan:Win32/Depriz.E!dha Backdoor/Win32.RemoteConnection.C1761738 Backdoor.RemoteConnection!lEVCTonUnuw Trojan.Win32.Depriz Trj/GdSda.A


A backdoor also known as: Trojan.Winsy Trojan.Win32.Winsy Trojan.Winsy Trojan.Winsy W32/Trojan.MBSD-8108 Trojan.Winsy Trojan.Win32.Winsy Trojan.Winsy Trj/CI.A


The DGA hosted site further serves up a list of domains that are cycled through for C2.


But it would appear that BLU only took action after Kryptowire notified it along with Google , Adups and Amazon .


Today's blog reviews recent activity from these EITest HoeflerText popups on August 30, 2017 to discover more about this recent change.


A backdoor also known as: Trojan.Exploit.DebPloit.A Trojan-Exploit/W32.DebPloit.45056 Exploit.DebPloit.Win32.4 Trojan/Exploit.DebPloit Trojan.Exploit.DebPloit.A Trojan.Exploit.DebPloit.A Exploit.DebPloit!VRtQm5q2mnY TROJ_DEPLOIT.A Exploit.Win32.DebPloit Exploit.Win32.DebPloit.yfoid Exploit.DebPloit.45056[h] Trojan.Exploit.DebPloit.A TrojWare.Win32.Exploit.DebPloit Trojan.Exploit.DebPloit.A BackDoor.Bifrost.634 TROJ_DEPLOIT.A W32/Risk.CTWU-4612 Exploit.WinNT.DebPloit Trojan[Exploit]/Win32.DebPloit WinNT.Hack.DebPloit.kcloud Win-Trojan/Debploit.45056.B Trojan.Exploit.DebPloit.A Trojan.Exploit.DebPloit.A Win32/Exploit.DebPloit Win32.Exploit.Debploit.Wptu W32/Debploit.B!tr Exploit.OY Trojan.Win32.DebPloit.aa Win32/Trojan.Exploit.672


Around New Year, the Emsisoft Lab team was alerted to the presence of a new Globe variant, Globe3, which was infecting users using a new mode of operation.


The DNS protocol is unlikely to be blocked allowing free communications out of the network and its use is unlikely to raise suspicion among network defenders.


UNIQUE FEATURES BY VERSION EventBot Version 0.0.0.1 RC4 and Base64 Packet Encryption EventBot RC4 and Base64 data decryption from the C2 RC4 and Base64 data decryption from the C2 .


henbox_2 Figure 1 Uyghurapps [ .


Phishing targeting Google Docs


A backdoor also known as: Backdoor/W32.Shiz.102400.S Backdoor.Win32.Shiz!O Backdoor/Shiz.fhrr Win32.Trojan.WisdomEyes.16070401.9500.9971 Win.Trojan.Shiz-787 Trojan.Win32.Shiz.whgln Trojan.KeyLogger.14845 Backdoor.Shiz.Win32.3116 BehavesLike.Win32.BadFile.cm Backdoor.Win32.Shiz Backdoor/Shiz.edz TR/Rogue.kdz.957021 Trojan[Backdoor]/Win32.Shiz Trojan.Zusy.D419A Trojan:Win32/Nahip.A Backdoor/Win32.Shiz.R34442 Win32/Spy.KeyLogger.NWE W32/KeyLogger.AFN!tr Backdoor.Shiz Win32/Trojan.460


] addroider.com ’ .


In one case, the casino website was a direct gateway to Angler EK.


Our analysis of the malware shows it uses multiple , advanced techniques to avoid Google Play malware detection and to maintain persistency on target devices .


We ’ ve documented several interesting attacks ( A Gift for Dalai Lamas Birthday and Cyber Attacks Against Uyghur Mac OS X Users Intensify ) which used ZIP files as well as DOC , XLS and PDF documents rigged with exploits .


A backdoor also known as: Trojan.JS.Redirector.xb Js.Trojan.Redirector.Amwl JS/BlacoleRef.CZ.26 Trojan/JS.Redirector.xb Trojan.JS.Redirector.xb Exploit.JS.Blacole JS/Iframe.WOR!tr


A backdoor also known as: Backdoor.Aphexdoor.Litesock.A Backdoor/W32.Aphexdoor.23040 Trojan.Suckspro Backdoor.Aphexdoor.Win32.24 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Backdoor.YGRL-7760 Backdoor.Trojan Win32/Porsux.A Win.Trojan.Aphexdoor-8 Backdoor.Aphexdoor.Litesock.A Backdoor.Win32.Aphexdoor.LiteSock Backdoor.Aphexdoor.Litesock.A Trojan.Win32.Aphexdoor.ebrvay Backdoor.W32.Aphexdoor.LiteSock!c Backdoor.Aphexdoor.Litesock.A Backdoor.Aphexdoor.Litesock.A BackDoor.LiteSock BehavesLike.Win32.Downloader.mm Backdoor.Win32.Aphexdoor.LiteSock W32/Backdoor2.EYIV Backdoor/Aphexdoor.LiteSock Trojan[Backdoor]/Win32.Aphexdoor Backdoor.Aphexdoor.Litesock.A Backdoor.Win32.Aphexdoor.LiteSock Worm/Win32.Fesber.C58465 Backdoor.Aphexdoor.Litesock.A BScope.Trojan.RSP Bck/Corsbot.B Win32.Backdoor.Aphexdoor.Airh Trojan.Suckspro!fID1dcqse2s W32/Aphexdoor.LITESOCK!tr.bdr


Interestingly , the command and control server includes a publicly accessible interface to work with the victims : Some of the commands with rough translations : The command-and-control server is running Windows Server 2003 and has been configured for Chinese language : This , together with the logs , is a strong indicator that the attackers are Chinese-speaking .


A backdoor also known as: Worm.Win32.Chiviper!O Worm.AutoRun.14759 W32/AutoRun.sdc Win32.Trojan.WisdomEyes.16070401.9500.9975 WORM_OTORUN.SMIF Win.Trojan.Qhost-160 Worm.Win32.Chiviper.gk Trojan.Win32.AutoRun.onby Trojan.AVKill.11726 Worm.AutoRun.Win32.23223 WORM_OTORUN.SMIF BehavesLike.Win32.Ipamor.qt Worm.Win32.AutoRun WORM/Autorun.rmr win32.troj.onlinegamest.bc.kcloud Worm.Win32.Chiviper.gk Trojan/Win32.CSon.R2002 Worm.Chiviper Worm.AutoRun!t3rz8tcZQ1A W32/Chiviper.GK!worm


A backdoor also known as: Trojan.Zbot.7 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Kazy-50 Trojan.Win32.Pamela.hnatv Trojan.Win32.A.Inject.75189 DDoS.Pamela Trojan.Inject.Win32.17142 BehavesLike.Win32.Dropper.pc Trojan.Win32.Inject Trojan/Inject.mra Trojan/Win32.Inject Trojan:Win32/Pucodex.A Trojan-Injector.191245


A backdoor also known as: Worm/W32.Sober.135968 Packed.Win32.TDSS!O Worm.Sober.Win32.7 WORM_SOBER.AM Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/Sober.DVXC-4063 W32.Sober.W@mm Win32/Sober.T WORM_SOBER.AM Win.Worm.Sober-43 Email-Worm.Win32.Sober.x Trojan.Win32.Sober.fxvm I-Worm.Win32.Sober.T Packer.W32.Tibs.l4Hz Worm.Win32.Sober.V Win32.HLLM.Sober BehavesLike.Win32.Autorun.cc Trojan.Win32.Pasta W32/Sober.V@mm I-Worm/Sober.p DR/Sober.T Worm[Email]/Win32.Sober Worm.Sober.t.kcloud Worm:Win32/Sober.Y@mm.dr Email-Worm.Win32.Sober.x Dropper/Win32.Sober.R86508 W32/Sober.s.dr TScope.Trojan.VB W32/Sober.AE.worm Win32/Sober.V Win32.Worm-email.Sober.Akew I-Worm.Sober.AF1 W32/Sober.T@mm


To their credit , both Google and Amazon appear to have put pressure on device manufacturers to fix their devices when flaws are found , Strazzere says .


Proofpoint is tracking this attacker, believed to operate out of China, as TA459


Data Encryption The Curve25519 encryption algorithm was implemented as of EventBot Version 0.0.0.2 .


360 Network Security Research Lab recently discovered a new botnet that is scanning the entire Internet on a large scale.


The malware has existed since at least 2012, with threat actors using it for mass-spreading malware campaigns and for ongoing targeted attacks.


Triada : organized crime on Android Second , it substitutes the system functions and conceals its modules from the list of the running processes and installed apps .


Fragment of the database with targeted devices and specific memory addresses If the infected device is not listed in this database , the exploit tries to discover these addresses programmatically .


A backdoor also known as: Win32.Trojan.CareFree.a Win32/Tnega.TaRMRTC Trojan.Win32.Graftor.dogten Trojan.KillFiles.21059 BehavesLike.Win32.Downloader.mc TR/Graftor.cpoyxe Trojan.Ursu.D2DC2 Trojan/Win32.StartPage.R131400 Win32/Trojan.e36


This group has been active since at least 2014 and uses spear-phishing campaigns to target enterprises.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9992 Trojan-Spy.MSIL.KeyLogger.ctnb Trojan.Win32.Z.Keylogger.91136.M Msil.Trojan-spy.Keylogger.Wqde Trojan.DownLoader9.24657 TrojanSpy.MSIL.vlt TR/Downloader.gldnp Trojan[Spy]/MSIL.KeyLogger Trojan.MSILPerseus.D9E17 Trojan-Spy.MSIL.KeyLogger.ctnb Backdoor:MSIL/Cooatut.A TrojanSpy.MSIL.KeyLogger Trj/CI.A MSIL/Troob.AA Trojan.MSIL.Troob MSIL/Troob.AA!tr Win32/Trojan.Spy.144


Instead, MacDownloader is a simple exfiltration agent, with broader ambitions.


Throughout 2016, Proofpoint researchers tracked a cyber-espionage campaign targeting victims in Russia and neighboring countries.


This threat actor has been very active in February and March 2023 targeting individuals in various South Korean organizations.


The Trojan is delivered in emails that mostly target corporate users.


We can trace activities of Pawn Storm back to 20041 and before our initial report in 2014 there wasn't much published about this actor group.


Backdoor.Win32.Denis uses DNS tunneling for communication


A few days before the Kuala Lumpur summit, a subdomain under asean.org for the ASEAN Secretariat Resource Centre ARC was compromised.


A backdoor also known as: Flooder.MailSpam.AnonMail.A Email-Flooder.Win32.AnonMail!O Win32.Trojan.Anonmail.Agkt Flooder.MailSpam.AnonMail.A W32/Backdoor.SPH Hacktool.Flooder Win.Tool.MailSpam-3 Email-Flooder.Win32.AnonMail.a Flooder.MailSpam.AnonMail.A Trojan.Win32.AnonMail.dbio TrojWare.Win32.Spammer.AnonMail Trojan.AnMail Tool.AnonMail.Win32.14 Email-Flooder.Win32.AnonMail.A W32/Backdoor.CDAV-2869 Spammer.Mail.AnonMail TR/Nuker.AnonMail HackTool[Flooder]/Win32.AnonMail Email-Flooder.Win32.AnonMail.a Flooder.MailSpam.AnonMail.A Spammer.AnonMail Flooder.MailSpam.AnonMail.A Flooder.MailSpam.AnonMail.A Trj/CI.A Win32/Spammer.AnonMail


the type of operation they are carrying out.


REQUEST_COMPANION_RUN_IN_BACKGROUND - let the app run in the background .


A backdoor also known as: Trojan.Win32.Mlw.eweujb Win32.Trojan.Inject.Auto BehavesLike.Win32.Trojan.hh TR/Dropper.MSIL.fkvxc Spyware.InfoStealer Trojan.MSIL.Inject MSIL/Injector.SZD!tr Trj/GdSda.A


In this research , we review common features of the malware and examine the improvements the threat actor made in each version .


Little has been published on the threat actors responsible for Operation Ke3chang since the report was released more than two years ago.


A backdoor also known as: PUP.Optional.VideiPlayer Trojan.ExtenBro! TROJ_SPNR.06HH14 Trojan-Downloader.MSIL.ExtInstall.o Trojan.Win32.Kivat.dfxucy TROJ_SPNR.06HH14 BehavesLike.Win32.Trojan.nt W32/Trojan.JMSU-4938 Variant.Kazy.doi W32/ExtenBro.E!tr Trojan.Kazy.D683A9 Uds.Dangerousobject.Multi!c TrojanDownloader:MSIL/Kivat.B Trojan.ExtenBro! Trj/Chgt.B Win32/Trojan.Multi.daf


Hashes of samples Type Package name SHA256 digest Custom ads com.targetshoot.zombieapocalypse.sniper.zombieshootinggame 5d98d8a7a012a858f0fa4cf8d2ed3d5a82937b1a98ea2703d440307c63c6c928 Click fraud com.counterterrorist.cs.elite.combat.shootinggame 84672fb2f228ec749d3c3c1cb168a1c31f544970fd29136bea2a5b2cefac6d04 Rooting trojan com.android.world.news bd233c1f5c477b0cc15d7f84392dab3a7a598243efa3154304327ff4580ae213 Zen trojan com.lmt.register eb12cd65589cbc6f9d3563576c304273cb6a78072b0c20a155a0951370476d8d Mobile Campaign ‘ Bouncing Golf ’ Affects Middle East We uncovered a cyberespionage campaign targeting Middle Eastern countries .


If it is the first execution , and if the app ’ s path does not contain “ /system/app ” ( i.e .


A backdoor also known as: Win32.Trojan.Kolweb.a.2.Pack Trojan/Delf.cf W32/Trojan.ORX Trojan.Kolweb.A W32/Startpage.AHU Win32/Startpage.LM TROJ_DOWNLOAD.E Trojan.Win32.Kolweb.a Trojan.Win32.Kolweb.A!IK TrojWare.Win32.Kolweb.A Trojan.DownLoader.1317 TROJ_DOWNLOAD.E Trojan/PSW.Almat.coi Adware:Win32/Adtomi.B Win-Spyware/Xema.171008 W32/Trojan.ORX Trojan.Win32.Kolweb.a Win32/Kolweb.A Trojan.Win32.Kolweb.A


A backdoor also known as: Trojan.Crypt.ES Trojan.Crypt.ES Win32.Trojan.WisdomEyes.16070401.9500.9996 Trojan.Crypt.ES Trojan.Win32.Crypt.ewgrry Trojan.Crypt.ES Trojan.Crypt.ES BehavesLike.Win32.BadFile.lm Backdoor:Win32/Huceqoo.A Trojan.Win32.Z.Crypt.73728.BQ Trojan/Win32.Scar.C8074 Trojan.Crypt.ES BScope.Trojan.Dropper.we Trj/GdSda.A Trojan.Crypt.ES Win32/Trojan.b63


msconf.exe is the main module that provides control of the implant and reverse shell feature .


However, this also leaves the C C traffic open for monitoring by others, including security researchers.


A backdoor also known as: Trojan.Pws.Watcher.A Trojan-PSW.Win32.Watcher!O Trojan.Pws.Watcher.A Trojan.Pws.Watcher.A Trojan.Pws.Watcher.A Trojan.Win32.Watcher.ejkr Trojan.Win32.A.PSW-Watcher.492035 Troj.PSW32.W.Watcher.a!c Trojan.Pws.Watcher.A Trojan.Pws.Watcher.A Trojan.PWS.Watcher Trojan.Watcher.Win32.8 Trojan-PWS.Win32.Watcher.i Trojan/PSW.Watcher.a TR/PSW.Watcher.B PWS:Win32/Watcher.A Trojan.Pws.Watcher.A TrojanPSW.Watcher Win32/PSW.Watcher.A Win32.Trojan-qqpass.Qqrob.Wqwh W32/PSWAtcher.A!tr


A backdoor also known as: Trojan.PSW.Barok.10 Trojan/W32.Barok.1056825 Trojan.Win32.Barok.bcusy W32/Pws.ZDD WS.Reputation.1 Barok.1_0 TROJ_BAROK.10 Trojan.Spy-11230 Trojan-PSW.Win32.Barok.10 Trojan.PSW.Barok.10 Trojan.PWS.Barok!QhmYol9M94M TrojWare.Win32.PSW.Barok.10 Trojan.PSW.Barok.10 TR/Barok.PSW.10 TROJ_BAROK.10 Trojan/PSW.Barok.10 Win32.Troj.Barok.kcloud PWS:Win32/Barok.1_0 Trojan.Win32.Barok_10.Setup Trojan.PSW.Barok.10 W32/Pws.ZDD Win-Trojan/Barok.Client.v10 PSW.Barok.A Hack.PSWbarok.10 Trojan-PWS.Win32.Barok.10 W32/Barok.10!tr.pws Trj/PSW.Barok.10


But , behind the scenes , the malware has not been removed ; instead it starts preparing its onslaught of attacks .


While the idea of malware as a service isn't a new one, with players such as Tox and Shark in the game, but it can be said that MacSpy is one of the first seen for the OS X platform.


A backdoor also known as: PUP.Optional.OpenCandy WS.Reputation.1 Trojan.DownLoader9.52502 TR/Dropper.A.23950 Win32.Troj.Undef.kcloud PE:PUF.OpenCandy!1.9DE5 Win32/Trojan.ca7


A backdoor also known as: W32.FamVT.Kykymber.P.Trojan Trojan.PWS.Onlinegames.KEGA Trojan-PWS.Win32.Kykymber.1!O PWS-OnlineGames.ke Trojan/PSW.Kykymber.kyz Win32.Trojan-PSW.OLGames.ay Infostealer.Gampass Win32/Gamepass.OQU Win.Spyware.79683-2 Trojan-PSW.Win32.Kykymber.kyz Trojan.PWS.Onlinegames.KEGA Trojan.Win32.OnLineGames.bkxdd Troj.PSW32.W.Kykymber.kyz!c Trojan.PSW.Win32.MiBao.a TrojWare.Win32.PSW.GamePass.A Trojan.PWS.Onlinegames.KEGA BehavesLike.Win32.PWSOnlineGames.pm TR/PSW.Kykymber.CD Trojan.Win32.A.PSW-Kykymber.43452[UPX] Trojan-PSW.Win32.Kykymber.kyz Trojan.PWS.Onlinegames.KEGA Trojan.PWS.Onlinegames.KEGA Win32/PSW.OnLineGames.QLR Trojan.PWS.Kykymber!KKmGLDbdY4I W32/OnLineGames.KY!tr.pws Trj/Kykymber.A Trojan.PSW.Win32.GameOnline.CP


Recently, in our never-ending quest to protect the world from malware, we found a misbehaving Android trojan.


A backdoor also known as: Backdoor:Win32/Binanen.A


The stolen parameters follow : ID IMSI IMEI Phone number Operator AID Model Brand Version Build Battery percentage Wi-Fi connection state Wake time Are logs enabled ? Is the malware already set as the default SMS application ? [ True/False ] Signal strength Screen active [ True/False ] Orientation Was accessibility permission granted ? [ True/False ] Screen size List of the installed applications SMS messages saved on the device It is not uncommon for banking malware to harvest extensive amounts of data from the victim ’ s device .


A backdoor also known as: W32.Clod912.Trojan.1f28 Win32.Trojan.WisdomEyes.16070401.9500.9823 Trojan.Munidub TROJ64_ASRUEX.A Trojan.Win64.MLW.eelpql TROJ64_ASRUEX.A BehavesLike.Win64.CrossRider.tm W64/Trojan.MCVO-8253 Trojan/Win32.Zapchast Trojan:Win64/Asruex.A!dha Trojan.Zapchast.pk Trj/CI.A


POS malware refers to malicious software that extracts payment card information from memory and usually uploads that data to a command and control CnC server.


However , when used maliciously , accessibility features can be used to exploit legitimate services for malicious purposes , like with EventBot .


A backdoor also known as: Trojan.Graftor.DD2BF Trojan.DownLoader.18943 BehavesLike.Win32.Msposer.nm Trj/Lozyt.A


A backdoor also known as: Trojan.Ransom.ANU Trojan.Enrume Ransom_Enrume.R00EC0DKG17 Trojan.Ransom.ANU Trojan.Ransom.ANU Trojan.Win32.Z.Ransom.6967658 Troj.Ransom.Anu!c Trojan.Ransom.ANU Trojan.Ransom.ANU Ransom_Enrume.R00EC0DKG17 BehavesLike.Win32.PUPXBC.vc TR/FileCoder.jtxjg Trojan.Ransom.ANU Trojan.Ransom.ANU Trj/CI.A Win32/Trojan.Ransom.2a7


A backdoor also known as: W32.SapinH.Trojan Trojan-Dropper.Win32.Injector!O Trojan.Mauvaise.SL1 Trojan.Chad Trojan.Packed.Win32.29983 Trojan.Application.Symmi.D73F9 Win32/Gamepass.HKIaME Trojan-Dropper.Win32.Injector.palw Trojan.Win32.KillProc.brmetk Troj.Dropper.W32.Injector.toQt Adware.Win32.Dropper.aaa Application.Win32.Kuaiba.BC Trojan.KillProc.22109 BehavesLike.Win32.VirRansom.fh TrojanDropper.Injector.ayai Trojan:Win32/Scoreem.A Trojan-Dropper.Win32.Injector.palw Dropper/Win32.Injector.R68328 TrojanDropper.Injector Trojan.DR.Injector!UEnRNWldneo Trojan.Win32.Senta W32/Injector.RREW!tr


A backdoor also known as: W32.SumanyaQZA.Worm Worm.AutoRun W32/Autorun.worm.j Worm.AutoRun.Win32.2713 TROJ_FAM_0001c56.TOMA Win32.Worm.AutoRun.d W32.SillyDC Win32/SillyFDC.CD TROJ_FAM_0001c56.TOMA Worm.Win32.AutoRun.beh Trojan.Win32.AutoRun.uvsfh Worm.Win32.Autorun.204800 Trojan.Copier.8 BehavesLike.Win32.VBObfus.dm Worm.Win32.VB Worm/AutoRun.ahnn Worm:Win32/Manyasu.A Worm/Win32.AutoRun Worm:Win32/Manyasu.A Trojan.Heur.E08BA4 Worm.Win32.AutoRun.beh Worm/Win32.AutoRun.R18800 Trojan.VBO.012000 Trj/Manyasu.A Win32/AutoRun.VB.IY Trojan.Win32.VB.mct Worm.AutoRun!WxdQD2QNztM


The ongoing attacks attempt to circumvent the extra protections conferred by two-factor authentication in Gmail, and rely heavily on phone-call based phishing and real time login attempts by the attackers.


A backdoor also known as: Backdoor.Win32.Stub!O Backdoor/Stub.j Win32.Worm.Delf.a Backdoor.Trojan Win32/Bosbot.D BKDR_STUB.G Backdoor.Win32.Stub.j Trojan.Win32.Stub.bbeaok Backdoor.Win32.A.Stub.114843[UPX] BackDoor.Stfu Backdoor.Stub.Win32.24 BKDR_STUB.G BehavesLike.Win32.Backdoor.cm Virus.Win32.Imponex Backdoor/Stub.n W32/Sality.Patched Trojan/Win32.Unknown Backdoor:Win32/Stub.P W32.W.Bagle.kZt7 Backdoor.Win32.Stub.j Win32.Worm.Imponex.A Trojan/Win32.Stub.C408823 BScope.Malware-Cryptor.Hlux W32/DelpDldr.A!tr.bdr W32/Knase.C


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Java.Adwind.dkmdei Java.Adwind.2 Trojan.Java.Adwind Trojan.Java.o JAVA/RemoteAd.dld Trojan:Java/Adwind.G Trj/CI.A


A backdoor also known as: Trojan.Patched.FR Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Sheedash Win32/Sfcpatched.A TROJ_PATCH.SMLD Win.Trojan.Sfcpatch-10 Trojan.Win32.Patched.fr Trojan.Win32.Patched.cwsyqv W32.W.AutoRun.kYRk Trojan.WinSpy.921 Trojan.Patched.Win32.27797 TROJ_PATCH.SMLD Trojan.Win32.Patched Trojan/Win32.Patched Trojan.Patched.1 Trojan.Win32.Patched.fr Trojan:Win32/Parchood.A Trojan/Win32.Patched.R3621 BScope.Trojan.Crex Trojan.Win32.Patched.f Trojan.Patched!j5lr5VQfEwA Win32/Trojan.2c9


The group has been operating since 2012 and became particularly active in Q2 2015.


SpyNote is similar to OmniRat and DroidJack, which are RATs remote administration tools that allow malware owners to gain remote administrative control of an Android device.


As predicted following the leak of Hacking Team exploit codes covered here, the Zscaler security research team has recently started seeing a Chinese cyber espionage group weaponizing malware payloads using the 0-day exploits found in the leaked Hacking Team archives.


The World Anti-Doping Agency WADA has alerted their stakeholders that email phishing scams are being reported in connection with WADA and therefore asks its recipients to be careful.


Attackers create accounts on those services and post encoded IP addresses or the domain names of real C2 servers in advance of distributing the backdoor.


A backdoor also known as: P2P-Worm.Win32.Delf!O Worm.Delf.9767 W32/Delf.ao WORM_YOOHOO.D Win32.Worm.Delf.a W32/SillyP2P.BR W32.HLLW.Yoohoo WORM_YOOHOO.D Win.Trojan.Delf-1033 P2P-Worm.Win32.Delf.ao Trojan.Win32.Delf.bojqna Win32.Worm-p2p.Delf.Lnfa Win32.HLLW.Woofka Worm.Delf.Win32.191 BehavesLike.Win32.Backdoor.ch Worm/Delf.ot Worm[P2P]/Win32.Delf Worm.Win32.A.P2P-Delf.70675[UPX] P2P-Worm.Win32.Delf.ao Win32/P2PDelf.worm.45056 Worm.Delf Win32/Delf.AO Worm.P2P.Delf.AAF!AU P2P-Worm.Win32.Delf W32/Delf.AO!worm.p2p W32/Spybot.TN.worm


RECEIVE_BOOT_COMPLETED - allow the application to launch itself after system boot .


In February 2017, we observed an evolution of the Infy malware that we're calling Foudre lightning in French.


IOC's related to a new version of Citadel that hit the streets on November 2015


In July 2015, Check Point's Incident Response team was contacted by a customer after they noticed strange file system activities in one of their Linux-based DNS BIND servers.


This new version CryptoWall includes multiple updates, such as a more streamlined network communication channel, modified ransom message, and the encryption of filenames.


They can also be installed by other malware, or by exploiting software vulnerabilities.


A backdoor also known as: BackdoorAPT.Hikit.MD6 BKDR64_GOALMAY.SM BKDR64_GOALMAY.SM Win.Trojan.HiKit-41 Trojan.Hikit.Win64.4 BehavesLike.Win64.PdfCrypt.cc Trojan.Dropper Backdoor:Win64/Hikiti.N!dha Trojan/Win32.HDC.C1382826 Trj/CI.A


These attacks occurred in several different countries, but our investigation revealed that the primary targets were individuals and organizations primarily located in India.


A backdoor also known as: W32.FamVT.ExpiroPC.PE Trojan.Win32.ServStart.exsakp Trojan.Win32.Z.Servstart.15876.A Trojan.DownLoader9.26576 Trojan.Win32.Rozena TR/ServStart.dplva TrojanDownloader:Win32/Yemrok.A W32/Parite.dam W32/ServStart.DV!tr Win32/Trojan.849


A backdoor also known as: W32/VB.l Trojan.Heur.EC3E8C WORM_ZAKA.AD W32/VB.UQEY-1535 W32.HLLW.Asterz.intd WORM_ZAKA.AD Win.Worm.VB-29 P2P-Worm.Win32.VB.l Trojan.Win32.VB.hxbs Worm.Win32.P2P-VB.24576.D W32.W.VB.l!c Win32.VB.L Win32.HLLW.Kirk.24576 Worm.VB.Win32.51 BehavesLike.Win32.Virus.mz Trojan-Banker.Win32.Bancos W32/VB.KA@p2p Worm/VB.qvg Worm:Win32/Icasur.Q WORM/VB.A Worm[P2P]/Win32.VB Worm.P2PVB.a.kcloud Worm:Win32/Icasur.Q P2P-Worm.Win32.VB.l Worm.VB Win32/VB.L Win32.Virus.Vb.Lkdy Worm.P2P.Zaka.R W32/VB.L!worm.p2p


Throughout 2015, Symantec.cloud has been detecting a stream of emails that have the Xtreme remote access Trojan RAT, which we detect as W32.Extrat, as an attachment.


In November 2016, we observed the reemergence of destructive attacks associated with the 2012 Shamoon attack campaign.


This malware masquerades as typical ransomware: it encrypts the data on the computer and demands $300 bitcoins for recovery.


TREASUREHUNT enumerates running processes, extracts payment card information from memory, and then transmits this information to a command and control server.


A backdoor also known as: Backdoor.Androm Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Trojan.CFAT-3750 Trojan.MulDrop7.39399 Backdoor.Androm.tas Trojan[Backdoor]/Win32.Androm Trojan:Win32/Lamooc.A Trojan/Win32.Androm.C2185535 Backdoor.Androm Trj/GdSda.A Backdoor.Androm!dAFAsy80jho


This is a common trick played by malware developers , making the user think the app may have been removed .


This method checks if eight hours have passed from the first run of application , and if so , request containing the device ’ s data to the server .


A backdoor also known as: Trojan/Comfoo.a Backdoor.Vinself TROJ_COMFOO.AI Trojan.PWS.DPD.14 TROJ_COMFOO.AI Trojan[Dropper]/Win32.Injector Backdoor:Win32/Comfoo.C Win-Trojan/Comfoo.114688 Backdoor.Win32.Comfoo W32/PWS_y.AI!tr Win32/Trojan.3fc


In October we saw an increase in infections.


TeslaCrypt/AlphaCrypt uses AES256 encryption.


The principles of this bootkit's work, named HDRoot, have been described in the first part of our article.


A backdoor also known as: Win32.Stepaik.A Worm.Stepaik Win32.Stepaik.A W32/Trojan.ILKV-7384 Win32.Stepaik.A Email-Worm.Win32.Stepaik.c Win32.Stepaik.A Email.Worm.W32!c Win32.Stepaik.A Win32.Stepaik.A Trojan.Inject3.836 BehavesLike.Win32.Virut.mh Worm[Email]/Win32.Stepaik Email-Worm.Win32.Stepaik.c Win32.Stepaik.A Trj/CI.A Win32.Worm-email.Stepaik.Day Worm.Win32.Stepar W32/Stepaik.C@mm Win32/Trojan.7ee


We setup a system with weak and default passwords to capture any and all malware spread in this fashion.


A backdoor also known as: W32.HfsAutoB.5B9D Packer.Malware.NSAnti.A Packer.Malware.NSAnti.A Trojan.MalPack.NSPack Trojan/PornoBlocker.afxh Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Packed.NsAnti Packer.Malware.NSAnti.A Packed.Win32.NSAnti.r Packer.Malware.NSAnti.A Trojan.Win32.NSAnti.fthc Packer.Malware.NSAnti.A BackDoor.Singu Packed.NSAnti.frd Packer.Malware.NSAnti.A Packed.Win32.NSAnti.r Trojan:Win32/Vanti.B.dll Trojan/Win32.Hupigon.C134220 TScope.Malware-Cryptor.SB Rootkit.Win32.Vanti.D


The ransomware makes this connection presumably to report that your computer has been compromised.


This attack took advantage of a Java zero-day exploit and used hacked forums as watering holes.


A backdoor also known as: W32.FamVT.QPassHV.Trojan Trojan.Zenshirsh.SL7 Trojan/QQPass.owd Win32.Trojan-PSW.QQPass.af Win32/Oflwr.A!crypt Trojan.Win32.Scar.oetk Trojan.Win32.DangerousObject.dnizrq Win32.Trojan.Scar.Wsts TrojWare.Win32.PWS.QQPass.AZF Trojan.DownLoader12.31656 Trojan.QQPass.Win32.24405 BehavesLike.Win32.Trojan.nc TR/PSW.QQSteal.boeu Trojan.Win32.Z.Qqpass.100934 Trojan.Scar Win32/PSW.QQPass.OWD Win32/Worm.Scar.B


Throughout the year, Bankbot has been distributed as benign apps, some of which made their way onto popular app stores.


In June 2022, Mandiant Managed Defense detected and responded to an UNC2970 phishing campaign targeting a U.S.-based technology company.


But attackers were still constantly looking for new methods to steal TANs .


In the examined version , it was downloaded from : hxxp : //url [ .


A backdoor also known as: Trojan.NSIS.Androm.7 Ransom.Onion.A Win32.Trojan.Injector.je Packed.NSISPacker!g7 Win32/Injector.CXKV TROJ_GE.F5258674 Zum.Ransom.NSIS.Cerber.1 Trojan.NSIS.Androm.7 Trojan.Win32.CXKV.ecdllh Trojan.Kovter.118 BehavesLike.Win32.Ransom.dc Trojan.Win32.Injector Trojan/Win32.Injector.cxkv Zum.Ransom.NSIS.Cerber.1 Trojan/Win32.Cerber.R180093 Trojan.Injector!M8gUkRYeGG8 W32/Injector.CXKV!tr


It appears the same actor developed both the Komplex and XAgentOSX tools, based on similarities within the following project paths found within the tools.


The construction of the webshell was interesting by itself, as it was actually two separate webshells: an initial webshell that was responsible for saving and loading the second fully functional webshell.


A backdoor also known as: Hacktool.Flystudio.16558 Trojan.DownLoader12.49203 Trojan-Downloader.Win32.Raykmerd Trojan/Badur.jao TR/Dldr.Raykmerd.amotd TrojanDownloader:Win32/Raykmerd.A Trojan.Badur


On September 18, 2015, we saw an activity on koreatimes.com where we captured a malicious binary.


Much like we have seen in recent months , anyone can be impacted by a mobile device attack .


EventBot method responsible for the library loading The method responsible for the library loading .


Triada ’ s functionality allows it to modify those messages , so the money is sent not to some app developer , but to the malware operators .