This vulnerability CVE-2017-7494 relates to all versions of Samba, starting from 3.5.0, which was released in 2010, and was patched only in the latest versions of the package 4.6.4/4.5.10/4.4.14.


The result is a large online population who have been the subject of numerous cyber-attacks in the past .


And even more curiously, SeaDuke, with its built-in support for both Windows and Linux, is the first cross-platform malware we have observed from the Duke group.


We also noticed how most of these spammed emails were sent between 9 a.m. – 11 a.m. UTC, a time when employees in European countries are starting their day at work.


A backdoor also known as: Trojan-PWS/W32.QQPass.103018 Trojan-PSW.Win32.QQShou!O TrojanPWS.QQpass Trojan/PSW.QQPass.ig Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Pws.AJSA Infostealer.Gampass Win.Spyware.WOW-37 Trojan-PSW.Win32.QQPass.ig Trojan.Win32.QQPass.lwwt Trojan.Win32.A.PSW-QQPass.102400.E TrojWare.Win32.PSW.QQShou Trojan.PWS.Tencent Trojan.QQPass.Win32.2020 BehavesLike.Win32.Downloader.cm Trojan-PWS.Win32.QQShou W32/PWS.OWXU-8397 Trojan/PSW.Chuanhua.iq Trojan[PSW]/Win32.QQPass Backdoor.W32.Hupigon.l57k Trojan/Win32.QQShou.R5746 TrojanPSW.QQPass Trj/QQshou.AA Win32/PSW.QQShou Win32.Trojan-qqpass.Qqrob.Syik Trojan.PWS.QQPass!ev/WXAy55hs W32/QQPass.IG!tr.pws Win32/Trojan.d5b


This instruction is especially important for malware that tries to avoid user interaction by running in the background as a service .


Unit 42 has been closely tracking the OilRig threat group since May 2016.


People using certain VPN service providers to protect their privacy are completely unaware that the backend uses a criminal infrastructure of infected computers worldwide.


And others have all malicious content removed , except for log comments referencing the payment process .


Rotexy then sent information about the smartphone to the C & C , including the phone model , number , name of the mobile network operator , versions of the operating system and IMEI .


This ongoing research lead us to a new Middle Eastern campaign.


The said screen is the ransom note , which contains threats and instructions to pay the ransom .


Despite broad scrutiny and reports on MuddyWater attacks, the activity continues with only incremental changes to the tools and techniques.


After conveniently granting itself additional privileges and securing its persistence on the device , Cerberus registers the infected device in the botnet and waits for commands from the C2 server while also being ready to perform overlay attacks .


Even a fake Facebook profile to pretend to be an actual company, aided in this process.


A backdoor also known as: W32.QuaresLTAAI.Trojan Worm.Fadok.IM5 Win32.Worm.FakeDoc.a WORM_FAKEDOC_FD050240.UVPM Trojan.Win32.Dwn.drcagm TrojWare.Win32.Scar.FAKD Win32.HLLW.Rendoc.3 Trojan.Scar.Win32.88546 WORM_FAKEDOC_FD050240.UVPM Trojan/Scar.bgdv Trojan/Win32.Scar.jfya Worm:Win32/Fadok.A Trojan.Razy.DA7C7 Worm/Win32.Fadok.R189010 Win32/FakeDoc.A Trojan.DownLoader! Worm.Win32.Fakedoc W32/FakeDoc.A!worm


A backdoor also known as: Backdoor/W32.KeyStart.181760 Backdoor.Win32.KeyStart!O Backdoor.KeyStart Win32.Trojan.WisdomEyes.16070401.9500.9963 Win32/Slupim.A Backdoor.Win32.KeyStart.ck Trojan.Win32.KeyStart.hfzs Trojan.Win32.Z.Keystart.181760 Backdoor.W32.Keystart!c Trojan.DownLoad.31797 Backdoor.KeyStart.Win32.47 BehavesLike.Win32.Downloader.ch Backdoor.Win32.KeyStart Backdoor/KeyStart.ak Trojan[Backdoor]/Win32.KeyStart Backdoor.Win32.KeyStart.ck Trojan:Win32/Slupim.B Bck/KeyStart.B Win32/Trojan.ec7


The Android rootnik malware uses open-sourced Android root exploit tools and the MTK root scheme from the dashi root tool to gain root access on an Android device.


A backdoor also known as: W32.FamVT.ExpiroPC.PE Trojan.DNSChanger.R Trojan.DNSChanger Trojan.DNSChanger.R Trojan.DNSChanger.R TROJ_DNSCHAN.ADD Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Flush.G TROJ_DNSCHAN.ADD Win.Downloader.Small-1720 Trojan.DNSChanger.R Trojan.Win32.DNSChanger.as Trojan.DNSChanger.R Trojan.Win32.DNSChanger.gwnl Trojan.DNSChanger.R TrojWare.Win32.DNSChanger.Y Trojan.DNSChanger.R Trojan.DnsChange Trojan.DNSChanger.Win32.6451 BehavesLike.Win32.VTFlooder.mc Trojan.Win32.DNSChanger W32.Alureon.Rootkit Trojan.Win32.DNSChanger.as Trojan/Win32.DNSChanger.R5962 DNSChanger.a MalwareScope.Trojan.DnsChange.1 Trj/DNSChanger.AQ


A backdoor also known as: Adware.NetFilter.BH Adware.NetFilter.BH Hacktool.Rootkit Adware.NetFilter.BH Adware.NetFilter.BH Adware.NetFilter.BH Adware.5Hex.Win64.8 AdWare.5hex ADWARE/5Hex.yxyby Trojan:Win64/Detrahere.E Adware.NetFilter.BH


A backdoor also known as: Trojan.Dridex Trojan.Midie.DA3BA Win32.Trojan.WisdomEyes.16070401.9500.9999 W64/Trojan.NYZW-9167 Trojan.Win32.Z.Dridex.679936.E Trojan.Kryptik.Win64.2184 Trojan.Crypt Trojan.Dridex.cy TR/Crypt.ZPACK.ohzec Trojan/Win64.Dridex.R212058 Trj/CI.A Win32/Trojan.82a


The primary targets , so far , are based in India though other Asian countries such as Pakistan and Bangladesh are also affected .


A backdoor also known as: W32.eHeur.Malware03 Worm.Drolnux.S644909 Troj.Ransom.W32.Foreign.tnvv Trojan/Ibashade.c Win32.Trojan.Kryptik.bio W32/Trojan.MTDN-3978 Trojan.Toraldrop WORM_DROLNUX_GC310160.UVPM Win.Trojan.Aavirus-2 Trojan.Win32.Kryptik.eljjir Trojan.Win32.Z.Ibashade.507562 Worm.Win32.Ibashade.D Trojan.PackedENT.44 WORM_DROLNUX_GC310160.UVPM BehavesLike.Win32.Jeefo.gh Win32/Ibashade.C Worm.Win32.Ibashade W32/Kryptik.FOAD!tr Win32/Trojan.df3


A backdoor also known as: Trojan/Dropper.Delf.nsc Trojan.DR.Delf!iMS7sjct8CE TROJ_DELF.SML TrojWare.Win32.TrojanSpy.Delf.AW TROJ_DELF.SML Trojan-Dropper.Delf!IK Backdoor:Win32/Beastdoor.DT Trojan/Win32.Pincav Trojan-Dropper.Delf Injector.NW


A backdoor also known as: Trojan.Exploit.Linux.68 TROJ_GE.F0CE4FC1 Win32.Trojan.WisdomEyes.16070401.9500.9817 TROJ_GE.F0CE4FC1 HEUR:Exploit.AndroidOS.Psneuter.a Riskware.Rooter.dshucf Tool.Rooter.6 BehavesLike.Win32.Dropper.rc HEUR:Exploit.AndroidOS.Psneuter.a Linux.Riskware.Neuter.A Android/Exploit.PSN.A Exploit.AndroidOS.Psn


XLoader abuses the MessagePack ( a data interchange format ) to package the stolen data and exfiltrate it via the WebSocket protocol for faster and more efficient transmission .


Moafee may have chosen its targets based on the rich resources of South China Sea region – the world's second business sea-lane, according to Wikipedia – including rare earth metals, crude oil, and natural gas.


If an incoming SMS contains one of the following magic strings : ” 2736428734″ or ” 7238742800″ the malware will execute multiple initial commands : Keylogger implementation Keylogging is implemented in an original manner .


The attackers behind Operation Pawn Storm have been active since at least 2007 and they continue to launch new campaigns.


After analyzing the traffic associated with these short links , we determined that each one was associated with a referral path from mail.mosa.pna.ps .


A backdoor also known as: HackTool.Fbhack Trojan.MSIL.HackTool.15 Trj/GdSda.A Win32/Trojan.Hacktool.afa


Perhaps the app ’ s false capabilities also fueled the low number of downloads .


A backdoor also known as: W32.Clod692.Trojan.ee6f Backdoor/W32.Thunk.23072 Backdoor/Thunk.a Trojan.Heur.JP.E22B62 W32/Backdoor.FUI Trojan.Bookmarker.C Hoax.Win32.Renos.dv Trojan.Win32.Thunk.ehif Win32.Trojan-psw.Lpkstart.Pftk Backdoor.Win32.Thunk.A BackDoor.Thunker Backdoor.Thunk.Win32.1 BehavesLike.Win32.PWSOnlineGames.mt W32/Backdoor.LZAN-6163 Backdoor/Thunk.c Trojan[Backdoor]/Win32.Thunk Hoax.W32.Renos.dv!c Win-Trojan/Thunk.23072 Trojan.Win32.BadJoke.dv Win32/Thunk.A Trojan.Renos!te8dhAWGe20 Backdoor.Win32.Thunk.a W32/Thunk.A!tr.bdr BackDoor.Thunk.A


Criminals are increasingly using obfuscation , the deliberate act of creating complex code to make it difficult to analyze .


A backdoor also known as: Trojan.PePatch!o2sJKTZeQwo W32/TrojanX.BKLZ W32.Spybot.Worm W32/Buzus.HBR Win32.TRBuzus.Adaa Packed.Win32.PePatch.lc Riskware.Win32.CeeInject.A!IK Constructor.Win32.Bifrose.be BackDoor.Poison.61 TR/Bifrose.EB.1 Trojan/Buzus.ejw Trojan.Win32.S.Buzus.1254544 Trojan/Win32.Xema W32/TrojanX.BKLZ BScope.Trojan.871206 Backdoor.Bifrose!rem VirTool.Win32.CeeInject.A W32/Buzus.ADBZ!tr


A backdoor also known as: Trojan-Dropper.Win32.Injector!O Backdoor.Daserf Dropper.Injector.Win32.60582 Troj.Dropper.W32.Injector.jrzp!c Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan BKDR_DASERF.ZBEI-A Trojan-Dropper.Win32.Injector.jrzp Trojan.Win32.Inject1.cmrdfo Win32.Trojan-dropper.Injector.Wnmi Trojan.Inject1.31463 BKDR_DASERF.ZBEI-A BehavesLike.Win32.Injector.mh Backdoor.Win32.Daserf W32/Trojan.YKAI-2038 W32/Injector.A!tr Trojan[Dropper]/Win32.Injector Backdoor:Win32/Daserf.A Trojan-Dropper.Win32.Injector.jrzp Trojan.Heur.FU.E0F811 Trojan.DR.Injector!lk1UiObxqaY Win32/Trojan.Dropper.cd3


It's often associated with dropping vawtrak and pony.


] today www [ .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9598 Troj.W32.Inject.l78q Trojan.DownLoader5.58525 BehavesLike.Win32.BadFile.ph Trojan[Downloader]/Win32.Unknown Win32.Troj.Undef.kcloud TrojanDownloader:Win32/Swfdown.A


Proofpoint researchers discovered a never-before-documented malware strain on February 15.


Indicators for BlackEnergy attacks in Ukraine


This scam is used more and more often to attack businesses, especially SMBs, in various countries.


This report covers a campaign of phishing and malware which we have named Operation Manul and which, based on the available evidence, we believe is likely to have been carried out on behalf of the government of Kazakhstan against journalists, dissidents living in Europe, their family members, known associates, and their lawyers.


Deceptively , the app was listed in the Education section .


A backdoor also known as: TROJ_AHENTE.RED Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Application.TQMP-8317 Trojan.Krast.C TROJ_AHENTE.RED Trojan.Win32.Gamania.ctppae Trojan.Win32.KeyLogger.93696 Trojan.PWS.Gamania.42279 Trojan.Keylogger.Win32.30981 BehavesLike.Win32.BrowseFox.ch Trojan/Win32.Unknown Win32.Troj.Undef.kcloud Backdoor:Win32/Toyecma.A!dha Trj/Vilsel.AF TrojanSpy.KeyLogger!GSKBdfHkyqU W32/KeyLogger.OFI!tr.spy


Germany is one of the first attack turfs TrickBot spread to when it first emerged in 2016 .


A backdoor also known as: HW32.Packed.16A4 Troj.W32.Monder.l3LF Win32.Trojan.WisdomEyes.16070401.9500.9996 MalCrypt.Indus! Trojan.Packed.338 BehavesLike.Win32.Downloader.mc Trojan-Downloader.Win32.Clopack Trojan.Heur.TDss.E7D957 TrojanDownloader:Win32/Conhook.AF Trojan/Win32.Xema.C130136


A backdoor also known as: W32.Pinfi.B Win32.Parite.B Virus/W32.Parite.C Virus.Win32.Parite.b!O W32.Perite.A Win32.Parite.B Ransom.Locky Virus.Parite.Win32.9 W32/Pate.B Win32.Parite.B PE_PARITE.A Win32.Virus.Parite.d W32/Locky.IGOK-1178 W32.Pinfi.B Win32/Pinfi.A PE_PARITE.A Heuristics.W32.Parite.B Virus.Win32.Parite.b Win32.Parite.B Virus.Win32.Parite.bgvo Virus.Win32.Dropper.c Win32.Parite.B Trojan.DownLoader19.38965 W32/Pate.b W32/Locky.EM Win32/Parite.b Virus/Win32.Parite.c Win32.Parite.b.5756 Win32.Parite.A Virus.Win32.Parite.b Win32.Parite.B W32/Pate.b Virus.Win32.Parite.b Trojan.Locky Win32/Parite.B Win32.Parite.B Virus.Win32.Parite W32/Kryptik.EQFZ!tr W32/Parite.B Virus.Win32.Parite.H


A backdoor also known as: Trojan.Ransom.Filecoder Ransom_MINDLOST.THBOAH Ransom_MINDLOST.THBOAH Trojan.Win32.Ransom.exdtkr TR/Ransom.uxivv Ransom:MSIL/Paggalangrypt.A!rsm


A backdoor also known as: Trojan.Skeeyah.5634 Trojan.Zusy.D38734 Win32.Trojan.WisdomEyes.16070401.9500.9944 TROJ_FASTREK.SM Trojan.DownLoader14.31853 TROJ_FASTREK.SM W32/Trojan.SYFE-6527 TR/Spy.A.5028 Trojan:Win32/Fastrek.A Win32.Trojan.Spy.Sudt Win32/Trojan.Spy.102


Officials at BLU could n't be immediately reached for comment .


With the daily growth of the different kinds of ransomware and distribution techniques, Fox-IT's Security Operations Center was investigating a new ransomware called Mole.


This implies that the authors are actively working to optimize EventBot over time .


Despite the lack of sophistication of the technical details of the malware and its mechanisms for spreading, the threat actors have demonstrated ability to compromise governmental websites successfully.


We have associated this campaign with APT19, a group that we assess is composed of freelancers, with some degree of sponsorship by the Chinese government.


App Icon Figure 1 : App icon and fake notification .


Quite possibly , this routine targets older platforms like Windows 7 and machines not taking advantage of hardware protections like UEFI and SecureBoot , available on Windows 10 .


January 2016 – May 2018 : In this stage , “ Agent Smith ” hackers started to try out 9Apps as a distribution channel for their adware .


In fact , recent variants contain code forked from an open-source machine learning module used by developers to automatically resize and crop images based on screen size , a valuable function given the variety of Android devices .


A backdoor also known as: Hacktool.Proxy Win.Trojan.Proxy-1292 Trojan.Proxy.2134 TR/Dldr.Small.ewd.1 TrojanProxy:Win32/Guilt.A Bck/GuilDNS.C


We've been tracking a series of exploit documents which, upon successful exploitation, simply drop a file and perform no other actions; these documents have dropped a variety of backdoors associated with a range of previously identified threat groups.


A backdoor also known as: Fednu.a Backdoor.Trojan Trojan.Win32.Click1.cgqbj TrojWare.Win32.Fedon.a Trojan.Click1.28242 Fednu.a Trojan:Win32/Fednu.A Trojan/Win32.Fedon.R1249 Trojan.Win32.Startpage.d W32/FAKEMS.E!tr Trojan.Win32.StartPage.BL


A backdoor also known as: W32.W.Fearso.lGmx Trojan/Boaxxe.a Trojan.Win32.Boaxxe.112128 TrojWare.Win32.Boaxxe.aak Trojan.Inject.8496 BehavesLike.Win32.Conficker.cc Trojan:Win32/Boaxxe.E Trojan.Beax.2 Trojan:Win32/Boaxxe.E Trojan/Win32.Boaxxe.R2341 Win32/Trojan.0e8


The original app looks innocent , with most of its code aimed at implementing the real features that the app claims to provide .


A backdoor also known as: W32.OnGamesFHKAGBAC.Trojan Trojan.Win32.Small!O Trojan.Keebie.S15324 Trojan/Small.akcc Trojan.Naffy.1 W32/Small.HE Win32/Keebie.A RTKT_KEEBIE.SMIA Win.Trojan.Small-14056 Trojan.Win32.A.Small.5632 TrojWare.Win32.Small.GZ Trojan.NtRootKit.17168 RTKT_KEEBIE.SMIA W32/Small.ULEB-5410 Trojan/Small.hyh TR/Small.GO.1 Trojan/Win32.Small Trojan:WinNT/Keebie.A Backdoor/Win32.Buzy.R2623 Trojan.Small Trj/Small.CN Trojan.Win32.Small.ae Trojan.Small!ebs6Gbgb5Gk Trojan.Win32.Small W32/Anno.A!tr RootKit.Win32.Koutodoor.E


Also , the software vulnerabilities pointed out in the FOTA software by Strazzere in 2015 could have been taken advantage of by cybercriminals looking to steal bank account details or execute other frauds .


A backdoor also known as: TrojanPWS.Fareit Spyware.Pony Trojan.Symmi.D11C87 Win32.Trojan.WisdomEyes.16070401.9500.9803 Trojan-PSW.Win32.Fareit.cpmi Win32.Trojan-qqpass.Qqrob.Huge BehavesLike.Win32.Fareit.dm TR/Dropper.VB.bzhbo Trojan-PSW.Win32.Fareit.cpmi Win32.Trojan.Injector.LG Trojan/Win32.Inject.R198261 BScope.Trojan.VBKrypt Trojan.VB.Crypt W32/Injector.DNRZ!tr Trj/GdSda.A


NexusLogger collects keystrokes, system information, stored passwords and will take screenshots.


A backdoor also known as: Trojan.Mauvaise.SL1 Win32.Trojan.WisdomEyes.16070401.9500.9998 TROJ_TRUEBOT.SMZIEK-A Win.Trojan.Silence-6367670-0 Trojan.DownLoader25.20128 W32/Trojan.PYHP-7871 TrojanDownloader:Win32/Truebot.A Trj/GdSda.A


EventBot Logcat from the infected device Logcat from the infected device .


The C & C address was specified in the code and was also unencrypted : In some versions , a dynamically generated low-level domain was used as an address : In its first communication , the Trojan sent the infected device ’ s IMEI to the C & C , and in return it received a set of rules for processing incoming SMSs ( phone numbers , keywords and regular expressions ) – these applied mainly to messages from banks , payment systems and mobile network operators .


The author has introduced the capability to grant the app the device admin permission .


During the final update installation process , it relies on the Janus vulnerability to bypass Android ’ s APK integrity checks .


The website was compromised to launch an apparent watering-hole attack against the company's customers.


These are then uploaded to the C & C HTTP server .


The attackers also tend to deploy what works or what s convenient, as we've also seen them attempt to infect the target host with other PoS malware such as PwnPOS TSPY_PWNPOS.SMA, and BlackPOS TSPY_POCARDL.AI.


A backdoor also known as: Trojan.Win32.Iconomon.a2.AD Trojan/Delf.cbcd Trojan.Delf!+j/t0TLqQk4 Trojan.Dropper Delf.KXWK Win32/Delf.AQT TROJ_SPNR.30FE12 Trojan.Win32.Delf.chfk Trojan.Win32.Delf.djowe TR/Offend.kdv.99866 TROJ_SPNR.30FE12 Trojan/Delf.sze Trojan:Win32/Iconomon.A Trojan.Win32.A.Delf.320512.H Trojan/Win32.Delf Trojan.Delf.aqjx Trojan.Dropper Win32/Delf.PXF Trojan.Win32.Delf Delf.VWX


The Naikon APT aligns with the actor our colleagues at FireEye recently revealed to be APT30, but we haven't discovered any exact matches.


We are especially delighted about the platform and programme of work established in the declaration of the conference , upon which we sincerely hope will be built a strong and resolute working relationship on our shared goals for the future .


Xcode is Apple's official tool for developing iOS or OS X apps and it is clear that some Chinese developers have downloaded these Trojanized packages.


A backdoor also known as: HW32.Packed.E526 Trojan/Proxy.Dlena.cb Win32.Trojan.WisdomEyes.16070401.9500.9685 W32/Proxy.AWL Trojan.Packed.9 Win32.HLLM.Bid BehavesLike.Win32.Sality.nc W32/Proxy.MUPL-7031 TrojanProxy.Dlena.bk TrojanProxy:Win32/Dlena.CB Trojan/Win32.Dlena.C245630 BScope.Trojan.Dlena Trojan.PR.Dlena!kg9jx7szz7g Win32/Trojan.ea0


The US government's Cybersecurity and Infrastructure Security Agency CISA has issued a warning about a vulnerability in its IIS server, which allows attackers to exploit a security hole in the network.


A backdoor also known as: Trojan.Spamer Trojan.Symmi.DDE55 Win32.Trojan.Kryptik.nv Trojan.Win32.Spamer.km Trojan.Win32.Kryptik.ewffdy Troj.W32.Yakes.mAv7 Trojan.DownLoader26.3007 BehavesLike.Win32.Worm.ch W32/Trojan.OMMU-8573 Trojan.Spamer.ae Trojan.Win32.Spamer.km Trojan.Spamer Trj/CI.A Win32.Trojan.Spamer.Akze Trojan.Win32.Crypt W32/Kryptic.ABGK!tr Win32/Trojan.48b


We have written about this phenomenon extensively in the past and today we can add another family of malware to the list – Backdoor.Win32.ATMii.


This lockdown screen includes two parts : A WebView containing a background picture loaded from a predefined URL .


Change archive command After this activation cycle , the malware will start the collection of information activities and dissemination .


This blog serves to discuss changes made by this group and the SamSa malware family since we last discussed them.


The “ core ” module contacts the C & C server , trying to get a fresh list of applications to search for , or if that fails , use a default app list : whatsapp lenovo.anyshare.gps mxtech.videoplayer.ad jio.jioplay.tv jio.media.jiobeats jiochat.jiochatapp jio.join good.gamecollection opera.mini.native startv.hotstar meitu.beautyplusme domobile.applock touchtype.swiftkey flipkart.android cn.xender eterno truecaller For each application on the list , the “ core ” module checks for a matching version and MD5 hash of the installed application , and also checks for the application running in the user-space .


The supposed purpose of that app is to obtain and use a required “ security code ” to log in to their online banking site .


youlabuy [ .


They exist in two types : the credentials stealers ( first 2 screenshots ) and the credit card grabbers ( last screenshot ) .


A backdoor also known as: Trojan-PWS/W32.WebGame.474112 Trojan/OnLineGames.thbb TROJ_GAMETHI.CCS Win32.Trojan.WisdomEyes.16070401.9500.9694 W32/Trojan.DBPJ-8386 Infostealer.Onlinegame Win32/Zajim.A TROJ_GAMETHI.CCS Win.Trojan.Onlinegames-15948 Trojan.Win32.OnLineGames.bqprmm Trojan.Win32.PSWIGames.474112 Troj.GameThief.W32.OnLineGames.thbb!c Backdoor.Win32.DarkstRat.~A Trojan.PWS.Lineage.4854 Trojan.OnLineGames.Win32.74056 BehavesLike.Win32.Dropper.gh Trojan-PWS.Win32.QQPass W32/Trojan2.JUUB TrojanSpy.OnLineGames.eex Trojan:Win32/Blorso.B Trojan[GameThief]/Win32.OnLineGames Win32.PSWTroj.OnLineGames.kcloud Trojan:Win32/Blorso.B Trojan/Win32.OnlineGameHack.R58928 TScope.Trojan.Delf Win32.Trojan-GameThief.Onlinegames.bovd Trojan.PWS.OnLineGames!E2qkzLkLTec W32/OnLineGames.DRT!tr.pws


We have compiled its main features in this brief analysis.


A backdoor also known as: Backdoor/W32.Bionet.593920 Backdoor.Bionet Backdoor.RAT.BioNet Backdoor.Bionet.Win32.159 Backdoor.W32.Bionet.21!c Backdoor/Bionet.21 W32/Bionet.J Backdoor.Trojan Win32/Bionet.261 Html.Trojan.BioNetPlugin-1 Backdoor.Win32.Bionet.21 Trojan.Win32.Bionet-keyhook.guhf Backdoor.Win32.Bionet_21.EditSvr BackDoor.BioNet.210 Email-Worm.Win32.GOPworm.196 Backdoor.Win32.Bionet W32/Bionet.XPHY-4314 Backdoor/Bionet.21 Trojan.Bionet BDC/Bionet.21.EdS Trojan[Backdoor]/Win32.Bionet Backdoor:Win32/Bionet.2_1 Backdoor.Win32.Bionet.21 Win-Trojan/Bionet_v21.EditSvr Email-Worm.Win32.GOPworm.196 Backdoor.Bionet Win32/Bionet.21 Win32.Backdoor.Bionet.dmkz Backdoor.Bionet!E616B62dMbM W32/Bdoor.FK!tr.bdr


A backdoor also known as: W32.AppdataWinupdtLnr.Trojan Trojan.Dusvext.A5 Trojan/Vnfraye.a Trojan.Zusy.DAD2 TROJ_DUSVEXT.SM Win32.Backdoor.Vnfraye.b W32/Dusvext.A Backdoor.Trojan Win32/Tnega.AGBV TROJ_DUSVEXT.SM Backdoor.Win32.Vernet.axt Trojan.Win32.MLW.dpvjba Backdoor.Win32.IRCBot.146944.J Backdoor.W32.Vernet.to4n Backdoor.Win32.Amtar.vna BackDoor.Gbot.2171 Trojan.Vnfraye.Win32.1 BehavesLike.Win32.ZBot.ch W32/Dusvext.JEML-8693 BDS/Vertex.A Trojan:Win32/Dusvext.A Backdoor.Win32.Vernet.axt Backdoor.Vernet Trojan.Vnfraye.A Win32/Vnfraye.A Win32.Backdoor.Vernet.Pjdv Trojan.Vnfraye!ZphwYheYjUY RAT.Vertex W32/Vnfraye.AAA!tr Win32/Trojan.d72


After the installation of the trojan , it will wait randomly between three and five minutes to activate one of the native capabilities — these are implemented on the eClient subclass called " GoogleCC .


The malware was first spotted by Tatyana Shishkova from Kaspersky by end October 2019 , but actually dates back to June 2019 .


Of the 10 million people who downloaded HummingBad-contaminated apps , an estimated 286,000 of them were located in the US .


] 160 [ .


EventBot is particularly interesting because it is in such early stages .


Stolen Data Figure 8 : Sending data to the attacker .


A backdoor also known as: Trojan.PSW.Sadam Trojan-PWS/W32.Sadam.18944 Trojan.PSW.Sadam Trojan/PSW.Sadam Trojan.Win32.Sadam.fxjw Win32/PSW.Sadam Trojan.PSW.Sadam Trojan-PSW.Win32.Sadam Trojan.PSW.Sadam Trojan.PWS.Sadam!lFmRyYmpwOU Trojan.Win32.A.PSW-Sadam.18944[h] Trojan.PSW.Sadam TrojWare.Win32.PSW.Sadam Trojan.PSW.Sadam Trojan.PWS.Pwl.4 Trojan.Sadam.Win32.1 BehavesLike.Win32.PWSOnlineGames.lm W32/Trojan.HRPL-2973 Trojan/PSW.Sadam W32/Farfli.NJ!tr Trojan[PSW]/Win32.Sadam Trojan.PSW.Sadam Troj.PSW32.W.Sadam!c Win-Trojan/PwlStealer.18944 TrojanPSW.Sadam Trojan.Win32.PSW Trojan.PSW.Sadam Win32/Trojan.PSW.418


In this day and age, it's slightly different.


Mcafee analyzed one recent email campaign with an attached .rar file.


A backdoor also known as: Trojan.Dropper.YIQ TrojanDropper.Blakamba.A5 Trojan.Dropper.YIQ Trojan.Dropper.YIQ TROJ_BLAKAMBA.SM TROJ_BLAKAMBA.SM Trojan.Dropper.YIQ Trojan.Dropper.YIQ Trojan.Win32.Blakamba.dxuyil Trojan.Dropper.YIQ TrojWare.Win32.TrojanDropper.Blakamba.A Trojan.Dropper.YIQ Adware.Yotoon.Win32.3224 BehavesLike.Win32.Multiplug.tc Virus.Win32.Obfuscator TR/Blakamba.aonaia Malware/Win32.SAPE.C1835825 Win32/Trojan.435


Stolen data will also be encrypted and sent to the C & C server via the socket connection .


Network Security appliances such as Next-Generation Firewall ( NGFW ) , Next-Generation Intrusion Prevention System ( NGIPS ) , and Meraki MX can detect malicious activity associated with this threat .


Apart from collecting the above data , the spyware monitors users ’ phone calls , records them , and saves the recorded file on the device .


A backdoor also known as: Trojan.Clicker Win32.Trojan.WisdomEyes.16070401.9500.9977 Trojan.DownLoader11.40591 Trojan.Win32.Clicker!BT Trojan.MSIL.TrojanClicker TrojanClicker:MSIL/Ezbro.B Trojan.Zusy.D1C4A9 Trojan.Win32.Clicker!BT


A backdoor also known as: W32.Winib.Worm Trojan.Rincux.AW Backdoor.Rbot Trojan/PSW.Sinowal.ag Trojan.Rincux.AW Win32.Trojan.WisdomEyes.16070401.9500.9982 Win32/Xema.A!Dropper Win.Spyware.7826-2 Trojan.Rincux.AW Backdoor.Win32.Agobot.121020 Troj.Spy.W32!c Trojan.Rincux.AW Trojan.Rincux.AW BackDoor.Monsh BehavesLike.Win32.Dropper.ch W32.Trojan.Rincux Trojan.Rincux.AW Trojan.Rincux.AW Backdoor.Agobot Worm.AutoRun W32/AgoBot.H!tr.bdr Win32/Trojan.d74


A backdoor also known as: W32.HfsAutoB.A1C4 Trojan/W32.Blocker.1092848 Trojan-Ransom.Win32.Blocker!O Trojan.Zusy.D8875 W32/Trojan.NJLB-1147 Ransom_Blocker.R002C0DLP17 Trojan-Ransom.Win32.Blocker.zdm Trojan.Win32.Blocker.crgjar Trojan.Win32.A.Blocker.1071104 Troj.Ransom.W32.Blocker!c Trojan.Inject1.15883 Trojan.Blocker.Win32.2372 Trojan/Blocker.otu TR/Injector.zuzfm Trojan[Ransom]/Win32.Blocker Trojan-Ransom.Win32.Blocker.zdm Hoax.Blocker Trojan-ransom.Win32.Blocker.kjb Trojan.Blocker!JH0Sb6Ye/p4 W32/Injector.YVK!tr Win32/Trojan.Ransom.ac8


A backdoor also known as: VB:Trojan.Valyria.645 W97M.Downloader.BDU W97M/Downloader.cct W97M.Downloader W2KM_DLOADR.YYTBR Doc.Macro.Obfuscation-6331107-0 VB:Trojan.Valyria.645 VB:Trojan.Valyria.645 W97M.S.Downloader.277504.A VB:Trojan.Valyria.645 VB:Trojan.Valyria.645 W2KM_DLOADR.YYTBR W97M/Downloader.cct W2000M/Downloader.MS.102 Trojan:O97M/Paudo.A HEUR.VBA.Trojan.e VB:Trojan.Valyria.645 W97M/Dropper.VM virus.office.qexvmc.1095


A backdoor also known as: WS.Reputation.1 Percol.A Trojan.DownLoad3.22191 TrojanDownloader.Icehart.bt Win32.Troj.Undef.kcloud TrojanDropper:Win32/Percol.B Downloader/Win32.Icehart Trojan-Downloader.Win32.Icehart Trj/CI.A


A backdoor also known as: Trojan.Nuker.BattlePong.1.0 Trojan/W32.Nuker.199168 Trojan.Battlepong FDoS-BattlePong.03 Trojan/Exploit.Nuker.BattlePong.10 Win32/Nuker.BattlePong.10 Win.Trojan.N-122 Exploit.Win32.Nuker.BattlePong.10 Trojan.Nuker.BattlePong.1.0 Exploit.Win32.BattlePong.cqpilz Exploit.W32.Nuker.BattlePong.10!c Win32.Exploit.Nuker.Lked Trojan.Nuker.BattlePong.1.0 TrojWare.Win32.Nuker.BattlePong.10 Trojan.Nuker.BattlePong.1.0 FDOS.Pong.10 Tool.BattlePong.Win32.2 FDoS-BattlePong.03 Nuker.Win32.BattlePong W32/Risk.MXKK-2153 Nuke/Win32.BattlePong.10 TR/Nuke.BattlePo.10 Trojan[Exploit]/Win32.Nuker Win32.Troj.BattlePong.kcloud Trojan.Nuker.BattlePong.1.0 Trojan.Win32.BattlePong_Nuker Exploit.Win32.Nuker.BattlePong.10 Trojan/Win32.HDC.C1336 Trojan.Nuker.BattlePong.1.0 Nuker.BattlePong Trojan.BattlePong Trojan.Nuker.BattlePong.1.0 Nuker/BattlePong.10 Win32/Trojan.Nuker.129


TimeReceiver android.intent.action.ACTION_TIME_CHANGED System notification that the time was set .


The Sandworm Team has carried out a global, sustained cyber espionage campaign since at least 2009.


Next, it was used in combination with DNS-based exfiltration aka DNS tunneling.


Check Point reached out to Google on September 10 , 2015 , and the app containing the malware was removed from Google Play on September 15 , 2015 .


Kaspersky Internet Security for Android and the Sberbank Online app securely protect users against attacks by this Trojan .


A backdoor also known as: HW32.Packed.8FE8 Win32.Trojan.WisdomEyes.16070401.9500.9998 Win.Trojan.Adylkuzz-6317076-0 BehavesLike.Win32.Ramnit.tc Trojan:Win32/Adylkuzz.B Trojan.Symmi.D1383C Unwanted/Win32.BitCoinMiner.C1986458 Trojan.Win32.Adylkuzz W32/Packed.GV!tr


A backdoor also known as: Trojan-PSW.Win32.VB!O TrojanPWS.VB.CX Trojan/PSW.VB.bia Win32.Trojan.WisdomEyes.16070401.9500.9740 W32/PWS.MPWG-1251 Win.Spyware.73829-2 Worm.Win32.VBNA.b Trojan.Win32.VB.eakjix Trojan.Win32.PSWVB.69812 Worm.W32.Vbna!c TrojWare.Win32.PSW.VB.NEC0 Trojan.MulDrop2.64396 Worm.VBNA.Win32.30118 BehavesLike.Win32.BadFile.lt Trojan-PWS.Win32.VB W32/Pws.BOIA Worm.VBNA.pcb Worm/Win32.VBNA Trojan.Heur.VP.E2F388 Worm.Win32.VBNA.b PWS:Win32/Tamenoc.A Worm/Win32.VBNA.C99913 MAS.Trojan.VB.01252 Win32/PSW.VB.NEC Win32.Worm.Vbna.Phqe Trojan.PWS.VB!uu94wtoX/Rs W32/VBNA.B!worm


Activities are key building blocks , central to an app ’ s navigation , for example .


The organization appears to be shut down , but the threat actors are still very active .


Taking this information from directory listings , like the one shown above , allowed for the decryption of all content .


These campaigns utilized fileless loading of a relatively new malware called August through the use of Word macros and PowerShell.


Stegoloader could represent an emerging trend in malware: the use of digital steganography to hide malicious code.


Additionally, TA530 customizes the email to each target by specifying the target's name, job title, phone number, and company name in the email body, subject, and attachment names.


Recently, Unit42 discovered a new version of the OceanLotus backdoor in our WildFire cloud analysis platform which may be one of the more advanced backdoors we have seen on macOS to date.


Despite having been in the wild for an extended period of time, the operation appears to still be active.


Gaza cybergang is a politically motivated Arabic cybercriminal group operating in the MENA Middle East North Africa region, mainly Egypt, United Arab Emirates and Yemen.


For this particular packet , the reason is registration of the bot .


A backdoor also known as: TrojanDropper.Injector Win32.Trojan.WisdomEyes.16070401.9500.9783 W32/Trojan.AFOE-3875 Trojan-Dropper.Win32.Injector.phoq Trojan.Win32.Dwn.eekcko Trojan.Win32.Z.Zusy.396034 W32.W.Fearso.lDrx Trojan.DownLoader14.35508 Trojan.Delf.Win32.76181 BehavesLike.Win32.Oror.fc Trojan.Win32.PSW Trojan.Zusy.D34BC4 Trojan-Dropper.Win32.Injector.phoq PWS:Win32/Cowdenry.A!bit Trojan/Win32.Buzus.R2227 TrojanDropper.Injector Trj/CI.A Win32.Trojan.Inject.Auto Win32/Trojan.5a2


The organization was closed after the CSIS presentation .


LemonDuck mining botnet, also known as the Eternal Blue downloader Trojan DTLMiner.


Also known as Disttrack, Shamoon is a highly destructive malware family that effectively wipes the victim machine.


CopyKittens is a cyberespionage group that has been operating since at least 2013.


A backdoor also known as: Trojan/W32.Small.40960.AEH Downloader.Multidl.16282 Trojan.Graftor.DFA71 Trojan.DownLoad3.32618 BehavesLike.Win32.Downloader.pc Trj/CI.A


Below is a fragment of such a log : Log with specified command Log files can be uploaded to the FTP server and sent to the attacker ’ s email inbox .


Sample 1 marks the first HenBox sample we saw embedding a legitimate app within its assets to be dropped and installed on the victim device as a decoy .


About 57 % of these devices are located in Asia and about 9 % are in Europe .


A backdoor also known as: Trojan.Kazy.D2AFE6 MSIL.Backdoor.Bladabindi.a W32/Trojan.ZFGR-8663 Trojan.Msil TR/Spy.zwtrn TrojanSpy:MSIL/Flunuceo.B!bit


With a lot of highly confidential data found in these servers and devices, a UNIX version of BIFROSE can certainly be classified as a threat.


An analysis of the malware family can be found later in this blog.


A backdoor also known as: W32.Clod7f8.Trojan.ff31 Backdoor.Win32.Vinself!O Backdoor/Vinself.a Win32.Trojan.WisdomEyes.16070401.9500.9569 W32/MalwareF.ADSSJ Backdoor.Trojan Trojan.Win32.Vinself.cpadj Backdoor.Win32.A.Vinself.57344[h] Backdoor.W32.Vinself.a!c BackDoor.Comet.435 BehavesLike.Win32.Dropper.qm W32/Risk.KOVS-4418 Backdoor:Win32/Vinself.A Backdoor.Vinself Win32.Backdoor.Backdoor.Alir Backdoor.Win32.Vinself


This backdoor shares a significant portion of its code with the Windows-based version of the XSLCmd backdoor that has been around since at least 2009.


This opens the door to , for example , fully controlling the victim ’ s bank account .


A backdoor also known as: Backdoor/W32.CSpam.122880.B Win32.Trojan.WisdomEyes.16070401.9500.9694 Backdoor.Trojan Win.Trojan.Cspam-3 Trojan.Win32.CSpam.vpryu Backdoor.Win32.A.CSpam.118784 Backdoor.W32.CSpam.c!c Trojan.MulDrop3.10935 Backdoor/CSpam.a BDS/CSpam.CA Trojan[Backdoor]/Win32.CSpam Backdoor:Win32/Samcigap.A Backdoor.CSpam Backdoor.CSpam!oR5QSbjV3Js Backdoor.Win32.CSpam Win32/Trojan.3ff


A backdoor also known as: Trojandownloader.Moljec Backdoor.W32.Hupigon.kYZB Trojan.Razy.D3D5A4 Win32.Trojan.WisdomEyes.16070401.9500.9808 BehavesLike.Win32.RAHack.nm Trojan-Downloader.Win32.Moljec TR/Dldr.Moljec.hglxv TrojanDownloader:Win32/Moljec.A


A backdoor also known as: W32.OnGamesLTLIBMSK.Trojan Backdoor/W32.Nbdd.73728.C Backdoor.Win32.Nbdd!O Backdoor.Venik.A6 Backdoor/Nbdd.myv Trojan.Kazy.D77C8E Win32.Trojan.PcClient.f Backdoor.Trojan Win.Trojan.Nbdd-12 Trojan.Win32.Nbdd.dutcj Trojan.DownLoad.64546 BehavesLike.Win32.Dropper.lh Backdoor/Nbdd.mk Trojan[Backdoor]/Win32.Nbdd Backdoor:Win32/Netbot.D Backdoor/Win32.Nbdd.R12332 Backdoor.Nbdd Backdoor.Nbdd!JW4qDWiwtBQ W32/Nbdd.MYV!tr Backdoor.Win32.NBVIP.B


The code is heavily obfuscated and made unreadable through name mangling and use of meaningless variable names : Decryption with a twist The malware uses an interesting decryption routine : the string values passed to the decryption function do not correspond to the decrypted value , they correspond to junk code to simply hinder analysis .


A backdoor also known as: Backdoor/W32.Androm.331776.K Backdoor.Androm Backdoor.W32.Androm!c Win32.Trojan.WisdomEyes.16070401.9500.9514 Backdoor.Win32.Androm.oyyc Trojan.Win32.Androm.exlhcw Trojan.Win32.Z.Androm.331776.Q Trojan.DownLoader26.14144 Trojan.Win32.Injector Backdoor.Androm.wlr Trojan[Backdoor]/Win32.Androm Trojan:Win32/Totbrick.H Backdoor.Win32.Androm.oyyc Trojan.TrickBot Trj/CI.A Trojan.Midie.DAA06 Win32.Backdoor.Androm.Wsud Win32/Backdoor.06f


An extended malware hunting process returned to us a large set of “ Agent Smith ” dropper variants which helped us further deduce a relation among multiple C & C server infrastructures .


Palo Alto Networks' Unit 42 recently blogged about a new Poison Ivy variant targeting Hong Kong activists dubbed SPIVY that uses DLL sideloading and operates quite differently from a variant recently observed by ASERT that has been active for at least the past 12 months.


In addition to adding the code , the attackers also changed the icon and package name .


A backdoor also known as: Trojan.Neurevt.A5 Win32.Trojan.WisdomEyes.16070401.9500.9799 W32/Trojan.PLNQ-7286 Trojan.Win32.GuX.ewvemj TrojWare.Win32.Neurevt.BBS Trojan.Win32.Neurevt Trojan.Heur.E04C69 Trojan/Win32.Neurevt.R156208 Trojan.Neurevt Trj/CI.A W32/Neurevt.3C40!tr Win32/Trojan.e6d


A backdoor also known as: Trojan-Downloader/W32.OneClickNetSearch.69632.C IMIServer.download Trojan/Downloader.OneClickNetSearch.b Trojan.Win32.OneClickNetSearch.dktm W32/Downloader.JOSL-6677 Adware.IEPlugin Win32/TrojanDownloader.OneClickNetS.B SPYW_IMISERV.C Trojan.Downloader.OneClickNetSearch-2 Trojan-Downloader.Win32.OneClickNetSearch.b TrojanDownloader.NetSearch!886wZrg7qCQ Virus.Win32.Heur.c TrojWare.Win32.TrojanDownloader.OneClickNetS.B Trojan.DownLoader.765 Downloader.OneClickNetSearch.Win32.9 SPYW_IMISERV.C BehavesLike.Win32.Comame.kt W32/Downldr2.AGKQ TrojanDownloader.ClkNetSch.b TR/OneClickSrch.E.2 Trojan[Downloader]/Win32.OneClickNetSearch Troj.Downloader.W32.OneClickNetSearch.b!c Win-Trojan/Oneclicknetsearch.69632.C TrojanDownloader:Win32/OneClkNetSrch.B Trj/Imiserv.B Trojan-Downloader.Win32.OneClickNetSearch Downloader.Onenet.B


A backdoor also known as: W32.Clod664.Trojan.cba8 Win32.Trojan.WisdomEyes.16070401.9500.9684 W32/Trojan.MJBK-1284 BKDR_ISMDOOR.C Trojan.Win32.Revizer.eizvti Trojan.Revizer.1141 trojan.winnt.mooqkel.a Trojan:Win32/Toorf.A!dha Trojan/Win32.Ismdoor.R194423 Trj/GdSda.A


A backdoor also known as: JS.Exploit.Pdfka.qe JS/Crypted.LT Bloodhound.Exploit.357 PDF/CVE-2010-2883.A!exploit TROJ_PIDIEF.SMZH Exploit.Win32.CVE-2010-2883.a Exploit.Script.Pdfka.bkbqa Exploit.TTF.CVE-2010-2883.a SCRIPT.Virus BehavesLike.PDF.Evasion.cn JS/Crypted.LT EXP/CVE-2010-2883.AI Trojan[Exploit]/TTF.CVE-2010-2883 Exploit.Win32.CVE-2010-2883.a JS/Exploit.Pdfka.OIB JS.Base64er.B Exploit.Win32.CVE-2010-2883 PDF:Exploit.PDF-JS.AGL virus.cve.20102883


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9982 Ransom_Zuresq.R002C0DAQ18 Win.Trojan.Zerolocker-1 Hoax.Win32.FakeRansom.df Trojan.Win32.Z.Zuresq.406528 Ransom_Zuresq.R002C0DAQ18 W32/Trojan.LNUU-1055 TR/Fraud.xacle Ransom:Win32/Zuresq.A Trojan.MSILPerseus.D1AE93 Hoax.Win32.FakeRansom.df Trojan/Win32.Ransomcrypt.C536978 Trj/GdSda.A Trojan-Ransom.FileCoder Win32/Trojan.89b


Figure 26 : “ Agent Smith ” Campaign timeline Greater “ Agent Smith ” Campaign Discovery Orchestrating a successful 9Apps centric malware campaign , the actor behind “ Agent Smith ” established solid strategies in malware proliferation and payload delivery .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9959 Trojan.Razy.D1F561 Trj/GdSda.A


A backdoor also known as: HW32.Packed.D6C8 Trojan.Farfli.Win32.7981 Win32.Trojan-GameThief.OnlineGames.h BehavesLike.Win32.Trojan.cc TR/Zegost.EB Backdoor:Win32/Morix.B Trojan.Heur.GM.D3D8682 Adware/Win32.NaviPromo.R36681 TScope.Malware-Cryptor.SB Trj/CI.A


Citizen Lab This report describes an elaborate phishing campaign against targets in Iran's diaspora, and at least one Western activist.


What we found was a kit that operated on a relatively small infrastructure footprint, but had what appeared to be one of the largest domain shadowing implementations we had ever seen.


A backdoor also known as: Trojan.Suweezy.N5 PUP.Optional.Elex Trojan.Win32.AdLoad.egraob PUP.ELEX/Variant Adware.SoEasy.1 BehavesLike.Win32.PUPXAI.ch Trojan.Adload.f PUP/Win32.Helper.R188556 Trojan.AdLoad Trj/GdSda.A Win32/Virus.e45


Various artifices indicate that the main target of this campaign is IEC – Israel Electric Company.


We will continue to monitor this ransomware family to ensure customers are protected and to share our findings and insights to the community for broad protection against these evolving mobile threats .


Based upon our visibility it has primarily targeted organizations in the energy, government, and technology sectors that are either in in or business interests in Saudi Arabia.


A new breed of cybercriminals has surfaced in China.


A backdoor also known as: PDF:Exploit.PDF-JS.VD Exploit.Js.Pdfka!c Trojan.Pidief JS/Exploit.Pdfka.QDD TROJ_PIDIEF.OPL PDF:Exploit.PDF-JS.VD Exploit.JS.Pdfka.giy Trojan.Pdf.Pdfka.blkemm PDF.S.Exploit.806918 Exploit:W32/MiniDuke.C Exploit.PDF.5708 TROJ_PIDIEF.OPL BehavesLike.PDF.Trojan.bb EXP/CVE-2013-0640.A Exploit.JS.Pdfka.giy Exploit-PDF.b Exploit.JS.Pdfka.giy Pdf.Exploit.Pdfka.Ljki Exploit.PDF.Miniduke PDF/Pdfka.GIY!exploit virus.js.unescapepmen.4


Weaponizing documents to exploit known Microsoft Word vulnerabilities is a common tactic deployed by many adversary groups, but in this example, we discovered RTF documents containing embedded OLE Word documents further containing embedded Adobe Flash .SWF files, designed to exploit Flash vulnerabilities rather than Microsoft Word.


A few days later, security teams overseas claimed that this incident was related to the BlackEnergy trojan and some malicious code samples had been acquired and analyzed.


This matches our observations of C2 servers as shown in Figure 7 .


Brazilian cybercriminals are notorious for their ability to develop banking trojans but now they have started to focus their efforts in new areas, including ransomware.


When rooting fails , a second component delivers a fake system update notification in hopes of tricking users into granting HummingBad system-level permissions .


When all the necessary card details are entered and have been checked , all the information is uploaded to the C & C .


In that case , the only help comes from an antivirus solution , for example , Kaspersky Internet Security for Android .


The developer simply has to register and receive a unique ID for his applications .


] 230 [ .


In early July 2015, Chinese APT actors used an Adobe Flash Player exploit within a specific webpage detailing a noteworthy international legal case between the Philippines and China.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Kryptik.eumbqf Trojan.Trick.45153 W32/Trojan.CBMR-6295 TR/Crypt.ZPACK.zookg Trojan.Symmi.D1340B Trojan/Win32.Mansabo.R210617 Trj/GdSda.A Win32.Trojan.Graftor.Lhdi Trojan.Win32.Crypt W32/Kryptik.FXWW!tr Win32/Trojan.dbf


Figure 12 : Boot module After the patch module is extracted , the “ boot ” module executes it , using the same method described in the “ loader ” module .


The Trojan can also leverage keylogging to broaden the attack scope .


The system verifies the signature of the legitimate file while installing the malicious file .


Other MacOS targeting activities reveal continuous refinement of AppleJeus, a MacOS backdoor developed by ITG03, complete with fake website to legitimize itself.


A backdoor also known as: W32.Dzan.A Win32.Trojan.WisdomEyes.16070401.9500.9997 Win32/SillyAutorun.ADC Trojan.MulDrop2.16084 BehavesLike.Win32.Virus.ct W32/Dzan.C Trojan:Win32/Obvesa.A Win32/Dzan.E Virus.Obvesa.24905 Virus.Win32.Dzan.ac Win32/Trojan.aca


SpyDealer uses exploits from a commercial rooting app to gain root privilege, which enables the subsequent data theft.


Analysis of this telemetry shows infected devices are completely based in Gaza , Palestine .


A backdoor also known as: Trojan.Yakes.Win32.67751 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Snojan.ccyy Trojan.Win32.Yakes.exngmv Troj.Crypt.Xpack!c Trojan.Ssebot.2 BehavesLike.Win32.Dropper.tc Trojan.Yakes.yvk Trojan/Win32.Yakes Spammer:Win32/Morphisil.A Trojan.Win32.Snojan.ccyy Trojan/Win32.Yakes.C2388388 Trojan.Win32.Krypt W32/Kryptik.EYUI!tr Trj/GdSda.A Win32/Trojan.6c1


While adware is usually considered annoying for users and relatively harmless to enterprise security, the adware campaigns we've seen since the beginning of 2016 behave more like advanced network threats.


In the run up to the French election runoff between Emmanuel Macron and Marine Le Pen, ThreatConnect reviews intelligence suggesting domains spoofing Macron's En-Marche.fr website are associated with Russian cyber activity.


We have also been tracking an actor experimenting with various loaders, providing insights into these evolving components of malware ecosystems.


Widely discussed in the media, the attacks took advantage of known BlackEnergy Trojans as well as several new modules.


The callee then invokes the getAction method to get the decrypted content .


A backdoor also known as: Ransom.Enigma.A7 Ransom_Eniqma.R002C0DA118 W32/Trojan.LKZC-7910 Ransom.Enigma!gm Ransom_Eniqma.R002C0DA118 Win32.Trojan-Ransom.Enigma.A Trojan.Win32.Encoder.ewphil Trojan.Win32.Z.Zusy.537088.HH Trojan.Encoder.4462 BehavesLike.Win32.AdwareConvertAd.hh Trojan.Crynigma.a TR/FileCoder.udtur Trojan[Ransom]/Win32.Crypmod Trojan.Zusy.D2EDC9 Ransom:Win32/Eniqma.A Trojan/Win32.Coverton.C1407984 Trojan-Ransom.FileCoder Win32/Trojan.808


Various versions may also change the index of the split ( e.g .


A backdoor also known as: Win32.Troj.Undef.kcloud Win32/Scieron.F W32/Scieron.F


A backdoor also known as: VBS.DownLoader.1051 VBS/Downldr.HM VBS/Nemucod.391C!tr.dldr Trojan-Ransom.Script.GlobeImposter


] 11/xvideo/ hxxp : //apple-icloud [ .


A backdoor also known as: TROJ_GE.5C3C51AF Win32.Trojan.WisdomEyes.16070401.9500.9933 Trojan.Win32.Kryptik.eljody Trojan.DownLoader23.49708 TR/Crypt.Xpack.341620 Trojan:Win32/Dacic.A!rfn Trj/CI.A Trojan.MSIL.Disfa Win32/Trojan.d7e


Indicators of Compromise ( IoCs ) hxxp : //mcsoft365.com/c hxxp : //pingconnect.net/c Hashes MD5 : 5c749c9fce8c41bf6bcc9bd8a691621b SHA256 : 284bd2d16092b4d13b6bc85d87950eb4c5e8cbba9af2a04d76d88da2f26c485c MD5 : b264af5d2f3390e465052ab502b0726d SHA256 : 8ab1712ce9ca2d7952ab763d8a4872aa6a278c3f60dc13e0aebe59f50e6e30f6 The TrickMo Factor The TrickBot Trojan was one of the most active banking malware strains in the cybercrime arena in 2019 .


After performing a fraudulent action , stealing the OTP/mTAN , TrickMo buys some time by activating the lock screen and preventing the user from accessing their device .


] today PHA Family Highlights : Zen and its cousins January 11 , 2019 Google Play Protect detects Potentially Harmful Applications ( PHAs ) which Google Play Protect defines as any mobile app that poses a potential security risk to users or to user data—commonly referred to as " malware .


A new type of botnet malware written in the Go programming language is active and targets web servers, according to researchers at Palo Alto Networks, who have recently discovered a sample of Go-based malware.


Javascript RAT mostly targeting Brazilian users.


A backdoor also known as: Downloader.Ponik Backdoor.Win32.Kasidet.fmc BehavesLike.Win32.Trojan.cc Trojan.MSIL.Crypt TR/Dropper.MSIL.owbdk Trojan[Backdoor]/Win32.Kasidet Trojan:Win32/Raybel.A!bit Backdoor.Win32.Kasidet.fmc Win32.Backdoor.Kasidet.Ecan Win32/Backdoor.e94


Sakula enables an adversary to run interactive commands as well as to download and execute additional components.


Background Uncovering PHAs takes a lot of detective work and unraveling the mystery of how they 're possibly connected to other apps takes even more .


The packaged application is dropped silently onto the device but has to ask the user to actually install it.


A backdoor also known as: Ransom_HPCRYPMIC.SM3 Ransom.CryptXXX!g6 Ransom_HPCRYPMIC.SM3 BehavesLike.Win32.Downloader.gc Trojan.Win32.Crypt TR/ATRAPS.buwr Ransom:Win32/Exxroute.E Trojan/Win32.CryptXXX.R184950 Trojan.Ransom.CryptXXX Trojan.MalPack Trojan.Symmi.D1070E


Dynamic overlays When victims open up a targeted app , Marcher smoothly displays an overlay , a customized WebView , looks in its application preferences ( main_prefs.xml ) and decides which specified URL is needed for the targeted app .


TO DECRYPT FILES, PLEASE, CONTACT US WRITING ON THIS EMAIL: headlessbuild@india.com


A backdoor targetting Linux also known as: Linux.Trojan.Turla.A ELF/Trojan.SKID-4 Linux.Turla Linux/Turla.B ELF_TURLA.A Linux.Trojan.Turla.A Trojan.Unix.Turla.ebdolr Backdoor.Linux.Turla!c Linux.Backdoor.Turla.Ajbi Linux.Trojan.Turla.A Backdoor:Linux/Turla.A Linux.BackDoor.Turla.2 Trojan.Turla.Linux.1 ELF_TURLA.A Backdoor.Linux.vp LINUX/Turla.wqxdp Linux.Trojan.Turla.A Backdoor:Linux/Turla.A Linux/Backdoor.801561 Linux.Trojan.Turla.A Trojan.Linux.Turla Linux.Trojan.Turla.A Linux/Turla.B


A backdoor also known as: W32.VBKrypt.2tPS.Trojan Trojan.Win32.VBKrypt!O Trojan.EyeStye PWS-Spyeye.el Troj.W32.VBKrypt.toSU Trojan/Injector.eyu Trojan.ManBat.1 HT_EYESTYE_GE05002C.UVPM Win32.Trojan.WisdomEyes.16070401.9500.9961 HT_EYESTYE_GE05002C.UVPM Win.Trojan.Vbkrypt-10134 Trojan.Win32.VBKrypt.cgnr Trojan.Win32.Stealer.eaiffn Trojan.Win32.A.VBKrypt.295936.G TrojWare.Win32.VBKrypt.cjub Trojan.PWS.Stealer.379 Trojan.VBKrypt.Win32.80508 BehavesLike.Win32.PWSSpyeye.dc Trojan.Win32.VBKrypt Trojan.VBKrypt.pmn TR/BAS.Samca.2207880 Win32.Troj.VBKrypt.kcloud Trojan.Win32.VBKrypt.cgnr Trojan/Win32.VBKrypt.C47082 SScope.Malware-Cryptor.VBCR.1841 Trojan.VBKrypt!CruzV+TB6eI W32/Injector.MQI!tr Win32/Trojan.script.56b


A backdoor also known as: Trojan-Dropper.Win32.Mudrop!O Trojan.StartPage.Win32.11288 Trojan/Dropper.Mudrop.vle Trojan-Clicker.Win32.Iedriver.a Trojan.Win32.Mudrop.demyl Trojan.MulDrop3.201 Trojan/StartPage.ize Trojan-Clicker.Win32.Iedriver.a Trojan.DR.Mudrop!xzqlDC4rTJk Trojan.Win32.StartPage


Figure 3 .


A backdoor also known as: W32/Trojan.EWSM-6788 TrojanDownloader:Win32/Tipikit.D Heur.Trojan.Hlux Trj/GdSda.A Win32.Trojan.Atraps.Swud Trojan.Win32.Rozena W32/Tiny.NNB!tr Win32/Trojan.5a2


Machine learning in Windows Defender ATP further flags suspicious behaviors observed related to the manipulation of legitimate Windows binaries .


A backdoor also known as: Trojan.Win32.StartPage.qrmpv Trojan.StartPage.47270 BehavesLike.Win32.BadFile.tc Trojan.Win32.StartPage Trojan:Win32/BootInstal.A!dll TScope.Trojan.Delf Trj/CI.A Win32.Trojan.Startpage.ddff Trojan.StartPage!We+P27yFUb0 Win32/Trojan.b7f


Recently we came across a new variant of the malware ServStart.


http : //www.himobilephone [ .


This article attempts to detail this variant.


Her looks almost certainly helped her apparent popularity.


A Chinese threat group, known as ChinaZ, is using malware to target poorly managed Linux servers and IoT systems, according to AhnLab Security Emergency Response Center ASEC in Seoul.


It can also remotely lock infected Android devices, encrypt the user's files in external storage e.g., SD card, and then ask for a U.S. $100 PayPal cash card as ransom.


A backdoor targetting Linux also known as: Tool.Shark.Linux.1 Hacktool.Linux.Shark!c HackTool.Linux.Shark.a Trojan.Unix.Shark.ewyskc Tool.Shark ELF/Trojan.QXQM-0 HackTool.Linux.z SPR/LNX.Shark.osieo HackTool.Linux.Shark.a Linux.Hacktool.Shark.Hqlw W32/HTShark.A!tr Win32/Trojan.173


Trojan.Win32.Banker.NWT is a Trojan that targets the Windows platform.


The attackers are also hijacking the device camera to take pictures .


In other words , TrickMo ’ s service will start either after the device becomes interactive or after a new SMS message is received .


It is an invaluable source of intelligence about a given campaign .. The following snippet shows the location within the Trojan where it uses SQLite database commands to store and recall command-and-control addresses : Backdoor Commands The Red Alert code also contains an embedded list of commands the botmaster can send to the bot .


Since the release of the ETERNALBLUE exploit by The Shadow Brokers' last month security researchers have been watching for a mass attack on global networks.


The person or persons behind the attempted monitoring appear to have run other surveillance operations involving various locations throughout South America, at least one apparently targeting a rabble-rousing Argentine journalist.


A backdoor also known as: Trojan.Win64.PSW TR/Hitbrovi.vjxdb Win32/Trojan.Adware.37e


] 923915 [ .


Grabbing the Screen PIN with Support for Samsung Devices Version 0.3.0.1 added an ~800 line long method called grabScreenPin , which uses accessibility features to track pin code changes in the device ’ s settings .


However, within six months the malicious actors added the capability to infect iOS devices.


A backdoor also known as: TSPY_HUNTPOS.SMB Trojan.Huntpos!g1 TSPY_HUNTPOS.SMB Trojan.Win32.Fakealert.exludw Trojan.Win32.Z.Treasurehunter.80896.B Trojan.Fakealert.origin BehavesLike.Win32.Trojan.lm TR/RedCap.rghtn TrojanDropper:Win32/Randrew.A!bit Spyware/Win32.Huntpos.C1261817 W32/Kryptik.1600!tr Trj/GdSda.A


We have covered Angler previously, such as the discussion of domain shadowing.


A backdoor also known as: W32.Virut.G BehavesLikeWin32.FileInfector!IK W32/Virut.BV Win32/Virut.bn Win32.Virut.AM Virus.Win32.Virut.X5 Harm.Win32.Autorun.c BehavesLikeWin32.FileInfector W32/Virut.CE W32/Sality.AO


The 2016 attack on Ukraine's power grid that deprived part of its capital, Kiev, of power for an hour was caused by a cyberattack.


A backdoor also known as: W32/Oledata!exploit.6402 Trojan.Dropper TROJ_MDROPPER.XC Trojan-Dropper.MSWord.1Table.bp Exploit.MSWord.CVE-2006-2492.bzzjba Exploit.Word.CVE-2006-2492 Exploit.CVE-2006-2492 TROJ_MDROPPER.XC TrojanDropper.MSWord.1Table.a MSWord/CVE20062492.fam!exploit Trojan-Dropper.MSWord.1Table.bp


BLU Products has now updated its phones to remove the spying code , which most likely would have never been detected by regular users .


With Cybereason Mobile , analysts can address mobile threats in the same platform as traditional endpoint threats , all as part of one incident .


Since most of the infrastructure used in the attack relies on cloud services, and the Trojan used is written in Python language, it is named Tengyun Snake.


The Trojan download window Asacub masquerades under the guise of an MMS app or a client of a popular free ads service .


RECEIVE_SMS - Allows the application to receive SMS messages .


A backdoor also known as: Backdoor.RemoteHack.C Backdoor/W32.RemoteHack.569344 Backdoor.RemoteHack.C W32/Risk.KPAX-3182 Backdoor.Trojan BKDR_REMHACK.13 Backdoor.RemoteHack.C Backdoor.Win32.RemoteHack.13 Backdoor.RemoteHack.C Trojan.Win32.RemoteHack.gnoa Backdoor.RemoteHack.C Backdoor.Win32.RemoteHack.13 Backdoor.RemoteHack.C BackDoor.RemHack.13 Backdoor.RemoteHack.Win32.37 BKDR_REMHACK.13 Backdoor.Win32.RemoteHack Backdoor/RemoteHack.13 Trojan[Backdoor]/Win32.RemoteHack Backdoor:Win32/RemoteHack.1_3 Backdoor.Win32.RemoteHack.13 Backdoor.RemoteHack.C TScope.Trojan.Delf Win32/VB.OLV Win32.Backdoor.Remotehack.Hoye Backdoor.RemoteHack!IKDTl0tZ3pY W32/RemoteHack.13!tr.bdr


A backdoor also known as: W32.StBotTenuA.Trojan Trojan.HorsumCS.S75593 Trojan/Horsum.c Win32.Trojan.Horsum.b TrojWare.Win32.Horsum.A Trojan:Win32/Horsum.B Trojan.Zusy.DEEE5 Win32/Horsum.C


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Steam.exmzim Trojan.PWS.Steam.1340 BehavesLike.Win32.Trojan.fc TR/Dropper.MSIL.vfmsq Trojan.Kazy.D8D397 Trojan:MSIL/BitcoinMiner.A Trojan/Win32.Kazy.C331514 Trj/GdSda.A Win32.Trojan.Kazy.Svhm Trojan.MSIL.Injector MSIL/Injector.IOF!tr


An interesting Web site infection, this time affecting a Web server belonging to the Turkish government, where the cybercriminals behind the campaign have uploaded a malware-serving fake DivX plug-in Required! Facebook-themed Web page.


It ’ s even possible to send log messages via SMS to the attacker ’ s number .


A backdoor also known as: HW32.Packed.73FF Trojan.Hookmoota Trojan.Strictor.D26544 Win32.Application.PUPStudio.A Trojan.Win32.Blamon.bbg Trojan.Win32.Blamon.exrwow BackDoor.BlackMoon.15 BehavesLike.Win32.Downloader.rc Trojan[Packed]/Win32.Vemply Trojan.Win32.Blamon.bbg Rootkit.HideProc Trj/GdSda.A Win32.Trojan.Blamon.Tcwd


A backdoor also known as: Trojan.Lukicsel Backdoor.PePatch.Win32.4586 Win32.Trojan.Delf.hh W32/Trojan.AKPR-4713 Infostealer.Gampass Win32/Delfsnif.C TROJ_BCKDR.BH Trojan-Spy.Win32.Blaxblax.mp Trojan.Win32.Blaxblax.blctg Backdoor.Lukicsel Trojan.DownLoad.44012 TROJ_BCKDR.BH W32/Trojan2.HCWA Backdoor:Win32/Lukicsel.A Trojan.Win32.A.Blaxblax.399894 Trojan-Spy.Win32.Blaxblax.mp Win32/Delf.OKY Trojan.ATRAPS


We also detected it in apps targeted toward specific Middle Eastern demographics .


A backdoor also known as: Trojan.Hacktool.Flood.A Trojan.Shell Trojan.Hacktool.Flood.A Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Hacktool.Flood.A Trojan.Hacktool.Flood.A Trojan.Script.Bbdos.cpglly Trojan.Hacktool.Flood.A Perl.Flood.3 W32/Trojan.ERNQ-5964 TR/Hacktool.jtxjg DoS:Perl/UDPFlood.A Trj/CI.A Perl/HackTool.BBSXP.NAB Perl/HackTool.NAB!tr Win32/Trojan.Flooder.363


We believe that the threat actor hijacked an existing, legitimate in-progress conversation and posed as the legitimate senders to send malicious spear phishing emails to the recipients.


Analysts suggest that both China and the United States are vying for greater influence in Myanmar, with China in particular having geopolitical interest due to sea passages, port deals, and fuel pipelines that are important to its goals.


] comkalisi [ .


Pony was originally configured to download different malware families, however, due to criminal strategy changes, it currently only downloads Dyre.


This request is only made upon installation , but there is no guarantee that it will be installed .


Information gathered from the email account provides a lot of the victims ’ personal data , including messages from IM applications .


This is also the first version where the package name changes into something that a less aware user may be tricked by , com.android.playup .


A backdoor also known as: Trojan/W32.Dialer.112255.D Trojan-GameThief.Win32.Magania!O Trojan.Aksula.A BackDoor-DVB.e Trojan/Dialer.bkm Win32.Trojan.Farfli.ai Win32/Dialer.NEW TROJ_REDOS.SM2 Trojan-GameThief.Win32.Magania.actz Trojan.Win32.Pigeon.ccmtgy Trojan.Win32.Dialer.vfq TrojWare.Win32.Trojan.Dialer.~AL BackDoor.Pigeon.12989 TROJ_REDOS.SM2 BehavesLike.Win32.Backdoor.ch Trojan/Dialer.dtm Trojan[Rootkit]/Win32.Ressdt Trojan.Win32.Dialer.112771 Trojan-GameThief.Win32.Magania.actz Win32/Gamepass.MCG Spyware.OnlineGames W32/Dropper.TMP!tr BScope.Trojan.SvcHorse.01643 Backdoor.Win32.Gh0st.BS


A backdoor also known as: PDF/Pidief.TI JS.Obfuscator.Z Trojan.Downloader.JMUB JS.Exploit.Pdfka.ij Bloodhound.PDF.21 JS_PIDIEF.SMX Trojan.Downloader.JMUB Exploit.JS.Pdfka.cop Exploit.Script.Pdfka.bzjgv JS_PIDIEF.SMX BehavesLike.PDF.Obfuscated.xb EXP/Pidief.2292 Trojan[Exploit]/JS.Pdfka.cop Exploit:JS/Pdfjsc.R Exploit.JS.Pdfka.cop Exploit.JS.Pdfka.cop Exploit.JS.Pdfka virus.pdf.za.4


A backdoor also known as: TR/DelWin.B Trojan.DOS.DelWin.b Trojan.DOS.DelWin.B Trojan.DelWin.b Trojan.QDel TROJ_DELWIN.E Trojan.DOS.DelWin.b Trojan:DOS/Delwin.B DelWin.B DelWin.b!Trojan W32/QDel176.B!tr


The operation used spyware made by the NSO Group, an Israeli company that sells intrusion tools to remotely compromise mobile phones.


Our investigation was conducted with the collaboration and assistance of R3D, SocialTic and Article 19.


Strider's attacks have tentative links with a previously uncovered group, Flamer.


Some were only 3 bytes long , containing strings such as “ ddd ” and “ 333 ” , or were otherwise corrupted .


A backdoor also known as: Trojan.BAT.Downloader.DN BAT/CoinMiner.RU TROJ_CONMINER.CFG Trojan.BAT.Downloader.DN Trojan.BAT.Downloader.DN TrojWare.Bat.CoinMiner.~ Trojan.BAT.Downloader.DN TROJ_CONMINER.CFG Trojan.IPVC-4 Trojan.BAT.Downloader.DN BAT.S.Downloader.3133 Trojan:BAT/CoinMiner.A Misc.Riskware.BitCoinMiner Trojan.BAT.Downloader.DN


Seeing as the system loader of the DEX files ( ART ) fully ignores everything that goes after the data section , the patcher writes all of its resources right there .


However , GPP does not treat new apps and updates any differently from an analysis perspective .


Operation Desert Eagle takes a look into the recent activity of the Molerats Gaza cybergang group.


The infection attempts took place in early March of 2016, shortly after the GIEI had criticized the Mexican government for interference in their investigation, and as they were preparing their final report


A backdoor also known as: Trojan.CMOS.A Cmoskill.C TROJ_KILLCMOS.B Trojan.DOS.KillCMOS.b Trojan.CMOS.A TrojWare.DOS.KillCMOS.b Trojan.CMOS.A Trojan.KillCMOS TROJ_KILLCMOS.B Trojan/KillCMOS.b Trojan/DOS.KillCMOS Trojan:Win32/KillCMOS.B Trojan.CMOS.A KillCMOS.B Trojan.DOS.KillCMOS KillCMOS.B KillCmos.B


These domains have been registered by the attackers since 2015 .


We have not been able to ascertain how the DroidVPN app on the uyghurapps [ .


Please note that these unblocking instructions are based on an analysis of the current version of Rotexy and have been tested on it .


Although the binary names have mirai mentioned it is probably not wise to treat it just as a mirai variant.


The malware architecture is modular , which means that it can execute plugins .


A backdoor also known as: Backdoor.Win32.VB!O Backdoor/VB.nb Win32.Trojan.WisdomEyes.16070401.9500.9683 W32/MemWatcher.DVPF-1178 Adware.Quadro Win32/Memwatch.F Win.Downloader.VB-61 Backdoor.Win32.VB.nb Trojan.Win32.VB.etebsn Backdoor.Win32.A.VB.233482 Backdoor.Win32.VB.NB Trojan.VbCrypt.60 Backdoor.VB.Win32.2125 BKDR_SANDBOX.A BehavesLike.Win32.VBObfus.dm Backdoor.Win32.VB W32/MemWatcher.A Backdoor/VB.ngt BDS/VB.NB Trojan[Backdoor]/Win32.VB Trojan.Heur.VP.ED107DA Backdoor.Win32.VB.nb Trojan:Win32/Sandbox.A Trojan/Win32.Xema.R122751 Backdoor.VB Win32/VB.NB Win32.Backdoor.Vb.Dzjg Backdoor.VB!sB1m+2s72zg W32/VB.NB!tr.bdr


During the trojan registration stage , the trojan exfiltrates private information such as the phone 's model , IMEI , phone number and country .


Email account A Gmail account with password is mentioned in the sample ’ s code : It contains the victim ’ s exfiltrated data and “ cmd ” directory with commands for victim devices .


Unit 42's ongoing research into the OilRig campaign shows that the threat actors involved in the original attack campaign continue to add new Trojans to their toolset and continue their persistent attacks in the Middle East.


For several years now, the Vawtrak trojan has been targeting banking and financial institutions, most recently in Canada as reported last week.


We chose the name MoonWind' based on debugging strings we saw within the samples, as well as the compiler used to generate the samples.


A backdoor also known as: W32.HfsAutoB.9C3D Trojan.Graftor.D444DD Win32.Trojan.Kryptik.aey TROJ_HPISDA.SM Win32.Trojan.Injector.HN Trojan.Win32.Dwn.eblljj Trojan.Win32.Z.Graftor.114176.Y Trojan.DownLoader20.53198 TROJ_HPISDA.SM BehavesLike.Win32.Trojan.cm W32/Trojan.QEKF-4451 Trojan[Ransom]/Win32.Locky.e Trojan:Win32/Zlader.A Trojan.Downloader Trj/CI.A Trojan.Win32.Crypt W32/Injector.CZNG!tr Win32/Trojan.af4


However, the heavy-handedness of the government has also inadvertently created a situation where Iranian users are better positioned than others to avoid some surveillance activities – increasing the burden of finding pseudonymous users.


Each APK has the ability to target different financial institutions in specific geographical locations.