A backdoor also known as: Android.Trojan.WipeLocker.A Android.Habey.A Trojan.Wipelock..1 A.H.Fra.Elite Android.Trojan.Wipelock.b Android/Wipelock.A HEUR:Trojan.AndroidOS.Soceng.f Android.Trojan.WipeLocker.A Trojan.Android.Elite.dmubjt Troj.Androidos.Habey!c Trojan-Spy:Android/SmsSpy.FW Android.Elite.1.origin ANDROID/Elite.A Android/Wipelock.A!tr Trojan/Android.Habey Android.Trojan.WipeLocker.A HEUR:Trojan.AndroidOS.Soceng.f Android-Trojan/WipeLocker.8493 Trojan.Android.Locker.c Trojan.AndroidOS.Wipelock Android.Trojan.WipeLocker.A


One of the samples we looked at SHA256:e154e62c1936f62aeaf55a41a386dbc293050acec8c4616d16f75395884c9090 contained a family of backdoor that hasn't been referenced in public documents.


A backdoor also known as: Trojan/W32.KRBanker.615936 Trojan.Sehijak.A7 Adware.Kraddare Adware.Kraddare.Win32.3892 Trojan.Zusy.D2CF65 W32/Banki.A Backdoor.Win32.Servidor.ac Trojan.Win32.RDN.eatfup Win32.Backdoor.Servidor.Pboq TrojWare.Win32.Sehijak.DA Trojan.DownLoader21.32804 BehavesLike.Win32.MultiPlug.jc W32/Banki.DFFU-6658 Backdoor.Servidor.b Trojan:Win32/Sehijak.A Backdoor.Win32.Servidor.ac Trojan/Win32.Banki.R175311 Backdoor.Servidor Win32/Adware.Kraddare.LP PUA.Kraddare! PUA.Kraddare W32/Servidor.AC!tr.bdr Win32/Backdoor.c5c


CrowdStrike has released two blog posts detailing Sakula campaigns and continues to investigate its usage.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9978 Trojan.Win32.ExtenBro.evtqgw Trojan.MSIL.ExtenBro Trojan/MSIL.fqcj TR/ExtenBro.vezgg Trojan:MSIL/ExtenBro.A Trj/GdSda.A Win32/Trojan.444


Escelar originally surfaced in January of this year, and has since had roughly 100,000 instances of attempted infections.


At the same time, the group has been improving their ability to operate the business side of a ransomware organization.


A backdoor also known as: BehavesLike.Win32.BackdoorNJRat.qm Trojan.Kazy.DEF49 Trojan/Win32.Llac.R18525


A backdoor also known as: Trojan.DLDrop.NSIS Trojan.Injector.Win32.385163 Trojan/Injector.cuom Trojan.Razy.D7CE0 W32/Injector.AKD Trojan.Win32.CUOM.ebfhyw W32/Injector.OIMQ-3591 TR/AD.Enestedel.ubzhk Ransom:Win32/Enestedel.B!rsm Trj/GdSda.A Win32/Injector.CUOM Trojan.Injector!1PtHxYGwvhY


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9829 Backdoor.Ehdoor


A backdoor also known as: Trojan-Dropper.Win32.Dorifel!O Trojan.FakeMS.ED Trojan/Dropper.Dorifel.eav Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/Trojan.GTVK-8195 W32.IRCBot.NG Trojan.MSIL.Crypt.fqbo Trojan.DownLoader6.25796 Dropper.Dorifel.Win32.1316 TrojanDropper.Dorifel.afo Trojan[Dropper]/Win32.Dorifel Win32.Troj.Dorifel.kcloud Trojan.Zusy.D115D1 Trojan.MSIL.Crypt.fqbo Trojan:MSIL/Belfusba.A TrojanDropper.Dorifel Trj/CI.A MSIL/Selenium.A Trojan.Kryptik!LBVVyRsvO34 MSIL/Selenium.A!tr


A backdoor also known as: Virus.W32.Virus!c Trojan/Spy.KeyLogger.au Trojan.Raw.KeyLog.epwywq BehavesLike.Win32.Cutwail.tc Trojan.Shelma.bbh Trojan/Win32.Shelma Trojan:Win32/Ronohu.A Trj/CI.A Python/Spy.KeyLogger.V Trojan.Python.Spy Python/KeyLogger.V!tr.spy


Usually, these are done via HTTP or other TCP/IP connections.


Infection Chain As with our earlier reports in late March , the attack chain involves diverting internet traffic to attacker-specified domains by compromising and overwriting the router ’ s DNS settings .


Recently, while reading a blog post from security vendor Akamai, we spotted a similar situation.


The forum provides members with tools to patch RDP Remote Desktop Protocol servers to support multiple user logins, as well as other hacking tools, such as proxy installers and sysinfo collectors.


] com , points to the IP address 54.69.156.31 which serves a self-signed TLS certificate with the certificate common name MyCert and fingerprint 11:41:45:2F : A7:07:23:54 : AE:9A : CE : F4 : FE:56 : AE : AC : B1 : C2:15:9F:6A : FC:1E : CC:7D : F8:61 : E3:25:26:73:6A .


A backdoor also known as: Trojan/W32.KRSign.810456 Win32.Trojan.WisdomEyes.16070401.9500.9958 Spyware.BL Trojan.ZxShellCRTD.Win32.10098 Backdoor:Win32/Zxshell.A!dha Win32/Backdoor.c4c


Petya is a form of ransomware that overwrites the master boot record MBR in order to block access to both the user's files and operating system.


A backdoor also known as: HW32.Packed.7F39 Trojan.Podjot.A Trojan.Kazy.D2D8D TROJ_PODJOT.SM1 Win32.Trojan.WisdomEyes.16070401.9500.9924 TROJ_PODJOT.SM1 MalCrypt.Indus! Trojan:Win32/Podjot.A Trojan/Win32.Zapchast.R21212 Virus.Win32.Cryptor


Figure 5 .


EventBot VirusTotal search for the malicious IP address VirusTotal search for the malicious IP address .


The threat actor behind Duqu appears to have launched attacks at the venues for some of these high level talks.


The attackers behind this campaign went to some lengths to disguise their activities, including using domains names disguised as antivirus AV company websites for their command and control C C servers.


A backdoor also known as: Trojan-Dropper.Win32.Injector!O Trojan.Zusy.D2081E W32/MalwareS.BJCG Backdoor.Vinself.B Win32/Fuwu.A BKDR_COMFOO.SME Win.Trojan.Rootkit-9875 Trojan-Dropper.Win32.Injector.jndt Trojan.Win32.DPD.dxvfcr Trojan.PWS.DPD.5 BKDR_COMFOO.SME BehavesLike.Win32.RansomWannaCry.ch Trojan.Win32.Spy W32/Risk.KUNB-3887 Trojan:Win32/Netnam.B Trojan-Dropper.Win32.Injector.jndt Trj/Zbot.M


This one-time cost provides a malicious customer with access to all the data on the server and endless other possibilities, such as using the access to launch further attacks.


Instead, they first attempt to gain access to the machine, most likely through a more targeted attack or exploit, before manually triggering and executing the malware.


A backdoor also known as: HackTool.Stimilani.FC.1099 Trojan.Zusy.D2F64E HackTool:MSIL/Stimilani.A Trj/GdSda.A


During the last hours, ESET researchers noticed that Eltima, the makers of the Elmedia Player software, have been distributing a version of their application trojanized with the OSX/Proton malware on their official website.


It appears that these threat actors have begun using Palo Alto Networks upcoming Cyber Security Summit hosted on November 3, 2016 in Jakarta, Indonesia as a lure to compromise targeted individuals.


After rendering the ad on the screen , the app tries to identify the part of the advertisement website to click .


Afterward , it will start several timers to execute different tasks .


A backdoor also known as: Trojan/W32.DoS.26816 DDOS_DEPCHARG.11 Win32.Trojan.WisdomEyes.16070401.9500.9967 W32/Trojan.ROMV-7068 DDOS_DEPCHARG.11 Win.Trojan.Chubby-2 Trojan-DDoS.Win32.DepthCharge.c Trojan.Win32.DepthCharge.dfzl Trojan.Win32.Chubby.26816 Troj.W32.Chubby.11!c Trojan.Chubby.11 Trojan.Chubby.Win32.2 BehavesLike.Win32.Fake.mc Backdoor/VB.dc TR/Chubby.11 Trojan[DDoS]/Win32.DepthCharge Trojan.Heur.VB.bmLfcmhTrPni Trojan-DDoS.Win32.DepthCharge.c TrojanDDoS.DepthCharge Win32/Chubby.11 Win32.Trojan-ddos.Depthcharge.Lpbl Trojan.DDoS.DepthCharge!wR+hD336kwM Trojan-DDoS.Win32.DepthCharge W32/Chubby.11!tr


In addition , the use of shared-hosting providers adds flexibility to the threat actor ’ s campaign and makes it harder for defending parties to track these moving targets .


A backdoor also known as: Trojan-Dropper.Win32.Small!O Trojan.Vbcrypt Spyware.Zbot Dropper.Small.Win32.2729 Trojan/Dropper.Small.dil Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Droplet.GN Win.Trojan.VB-9953 Trojan-Dropper.Win32.Small.dil Trojan.Win32.Small.wfby TrojWare.Win32.TrojanDropper.Small.dil0 Trojan.MulDrop.30852 BehavesLike.Win32.Downloader.mc Trojan-Dropper.Win32.Delf Trojan[Spy]/Win32.Zbot Trojan.Heur.E2A3DF Dropper.Small.86866 Trojan-Dropper.Win32.Small.dil Trojan/Win32.Batat.R4771 W32/Dropper.DIL!tr


Package Name SHA256 digest SHA1 certificate com.network.android ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5 44f6d1caa257799e57f0ecaf4e2e216178f4cb3d com.network.android 3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86 516f8f516cc0fd8db53785a48c0a86554f75c3ba Additional digests with links to Chrysaor As a result of our investigation we have identified these additional Chrysaor-related apps .


The commands are self-explanatory and show the features included in the malware .


The attacking IP addresses originated from very distinctive network ranges mostly associated with Chinese Internet service providers.


A backdoor also known as: Trojan.Multi Trojan.Win32.Inject.exdppy Trojan.Win32.Z.Kryptik.258107 Troj.W32.Virtumonde.mCBt Trojan.Inject.60399 Trojan.Kryptik.Win32.1344676 BehavesLike.Win32.Worm.dc Trojan:Win32/Kexject.A Spyware/Win32.Zbot.C145539 Trj/CI.A Win32.Trojan.Inject.Auto


A backdoor also known as: Backdoor/W32.Hekdor.88576 Backdoor/Hekdor.a Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Risk.EEXH-5977 Win32/Hekdor.A BKDR_HEKDOR.A Win.Trojan.HackersDoor-6351576-1 Backdoor.Win32.Hackdoor.12 Trojan.Win32.Hekdor.gtcj Backdoor.Win32.Hackdoor.88576 Backdoor.W32.Hackdoor.f!c Backdoor.Win32.Hackdoor.~dy001 BackDoor.Hackdoor.22 Backdoor.Hekdor.Win32.1 BehavesLike.Win32.Virut.mh Trojan.Win32.Hekdor Trojan[Backdoor]/Win32.Hackdoor Win32.Hack.Hekdor.a.kcloud Trojan.Graftor.Elzob.D2551 Backdoor.Win32.Hackdoor.12 Backdoor/Win32.Hackdoor.R101239 Bck/Iroffer.BG Win32.Backdoor.Hackdoor.Pegb Backdoor.Hekdor.A


They find and share readily available code and use those to make their own malware.


A backdoor also known as: Worm/Win32.AutoRun


This payload is also used by the earlier versions of the implant .


Lookout customers are also protected from this threat on both Android and iOS .


A backdoor also known as: Trojan.Win32.Clicker.cysqcu Trojan.Click2.41012 TR/Storup.D.158 Trojan:Win32/Storup.D Trojan.Graftor.DA5F2 TrojanSpy.Gaxfid!V9zv1PzO78E Trojan.Win32.Spy Trj/CI.A Win32/Trojan.b34


A backdoor also known as: Packer.W32.Katusha!c Win32.Trojan.WisdomEyes.16070401.9500.9997 TROJ_TRACUR.SMVB Packed.Win32.Katusha.ac Trojan.Win32.Tracur.csqtnd Trojan.Win32.Z.Tracur.476672 TrojWare.Win32.Kryptik.BJLP TROJ_TRACUR.SMVB TR/Tracur.ujeuv Trojan/Win32.Diple Trojan.Mikey.D823E Packed.Win32.Katusha.ac Trojan/Win32.Tracur.R87716 Trojan.Tracur Win32/Boaxxe.BB Win32.Packed.Katusha.Aljh Trojan.Win32.Boaxxe Win32/Trojan.2ed


A backdoor also known as: W32.DownloaderLTB.Trojan Trojan.Win32.Scar!O Trojan.Scar.20261 Trojan/Scar.gfdd Trojan.Graftor.Elzob.D3707 TROJ_DLOADE.SMEP Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Dropper Win32/SillyDl.HER TROJ_DLOADE.SMEP Win.Trojan.Scar-864 Virus.Win32.Lamer.vpqnl Trojan.DownLoader22.5119 TR/Taranis.2688 Trojan/Win32.Scar Trojan.Win32.A.Scar.100616 Trojan/Win32.Scar.R4127 Trojan.Scar Trojan.Win32.Sisproc


A backdoor also known as: Trojan.Cadlotcorg Trojan.DistTrack.stdr BKDR_DISTTRACK.E Win.Malware.StoneDrill-6012379-0 Trojan.Win32.Inject.wmyt Trojan.Win32.Inject.ekcbzj Trojan.Win32.Z.Inject.195072 Troj.W32.Inject!c Trojan.Stoned.5 Trojan.StoneDrill.Win32.2 BKDR_DISTTRACK.E W32/Trojan.CWLD-3265 Trojan.Inject.uoh TR/Injector.sgcfh Trojan/Win32.Inject Trojan.Razy.D1AF37 Trojan.Win32.Inject.wmyt Trojan:Win32/Cadlotcorg.A!dha Trojan/Win32.Injector.C1695778 Trojan.DiskWriter Trj/CI.A Win32/StoneDrill.A Win32.Trojan.Inject.Eddh Trojan.Inject!MGtoNAyL21Q Trojan.Win32.Cadlotcorg


HummingBad also has the ability to inject code into Google Play to tamper with its ratings and statistics .


This functionality can be seen in Figure 1 .


A backdoor also known as: BehavesLike.Win32.VirRansom.pc


A backdoor also known as: Trojan/W32.Iframer.77312 Trojan.Iframer.aa Trojan.Win32.Iframer.aa Trojan/Iframer.aa Trojan.Iframer.X W32/DLoader.OAFQ Trojan.Win32.Iframer.aa TrojWare.Win32.Iframer.aa Trojan.Win32.Iframer.aa Trojan/Iframer.b Trojan.Win32.Iframer!IK Trojan:Win32/Ifrasif.A Trojan.Win32.Iframer.aa Trojan.Win32.Iframer


Highlights Samples of the malicious code found in BrainTest have been found on Google Play , and its creator has used multiple methods to evade detection by Google including Bypassing Google Bouncer by detecting if the malware is being run from an IP or domain mapped to Google Bouncer and , if so , it will not perform its intended malicious activities .


A backdoor also known as: Trojan.Kazy.D1DA5C Win32.Trojan.WisdomEyes.16070401.9500.9993 Trojan.Win32.Steam.cwybnb TrojWare.Win32.PSW.Steathie.B2 Trojan.PWS.Steam.292 TR/PSW.Steathie.B PWS:MSIL/Pasdael.A W32/Sc!tr.pws


When analyzing the Ginp ’ s recent samples , ThreatFabric analysts found some similarities with the famous Android banking Trojan .


A backdoor also known as: Trojan.PSW.Vorbeld.B Trojan/W32.Ikmet.307200 Trojan.PSW.Vorbeld.B Troj.IM.W32.Ikmet.e!c Trojan/Ikmet.e Trojan.PSW.Vorbeld.B TROJ_VORBELD.B TROJ_VORBELD.B Trojan.PSW.Vorbeld.B Trojan-IM.Win32.Ikmet.e Trojan.PSW.Vorbeld.B Trojan.Win32.Ikmet.diag Win32.Trojan-im.Ikmet.Lfzq Trojan.PSW.Vorbeld.B TrojWare.Win32.PSW.Vorbeld.B Trojan.PSW.Vorbeld.B Trojan.PWS.Special.11 Trojan.Ikmet.Win32.2 BehavesLike.Win32.Fareit.fz W32/Risk.ZFPE-4855 Trojan/PSW.Vorbeld.b TR/PSW.Vorbeld.b Trojan[IM]/Win32.Ikmet Win32.Troj.Vorbeld.b.kcloud PWS:Win32/Vorbeld.B Trojan-IM.Win32.Ikmet.e TScope.Trojan.VB Win32/PSW.Vorbeld.B Trojan.Ikmet!CCqyhhL0iag Backdoor.VB W32/Vorbeld.E!tr Win32/Trojan.IM.00b


EventBot Obfuscated class names Obfuscated class names using letters of the alphabet .


In particular , these apps try to add an additional method called statistics ( ) into the Activity class .


A backdoor also known as: Trojan.PWS.OnlineGames.AAGG Trojan.Magania.19302 Trojan.PWS.OnlineGames.AAGG TSPY_ONLINEG.IGO Win32.Trojan.WisdomEyes.16070401.9500.9932 Infostealer.Onlinegame Win32/Frethog.CIL TSPY_ONLINEG.IGO Win.Spyware.59235-2 Trojan-GameThief.Win32.OnLineGames.txbo Trojan.PWS.OnlineGames.AAGG Trojan.Win32.OnLineGames.lhee Troj.PSW32.W.QQPass.lpXN Trojan.PWS.OnlineGames.AAGG TrojWare.Win32.Trojan.Inject.~II Trojan.PWS.OnlineGames.AAGG Trojan.MulDrop4.15206 PWS-OnlineGames.co Trojan/PSW.OnLineGames.auru Trojan[GameThief]/Win32.WOW.gic Win32.Troj.OnlineGames.sd.kcloud Trojan.PWS.OnlineGames.AAGG Trojan.Win32.PSWIGames.11924.B Trojan.PWS.OnlineGames.AAGG Trojan/Win32.OnlineGameHack.C909 TrojanPSW.OnLineGames.nr Trojan-Spy.OnLineGames


Cyphort has been monitoring how threat actors are exploiting computing resources from compromised victims to mine various crypto currencies.


A backdoor also known as: Trojan-Ransom.Win32.Toxic.a BehavesLike.Win32.BadFile.jc Trojan.Win32.Ransom.a


“ These communication channels are hard to discover and even harder to block entirely .


A backdoor also known as: TrojanRansom.Blocker Ransom_Blocker.R0C1C0DHU17 Win32.Trojan.WisdomEyes.16070401.9500.9605 Ransom_Blocker.R0C1C0DHU17 Trojan-Ransom.Win32.Blocker.kgrm Troj.Ransom.W32.Blocker!c BehavesLike.Win32.RansomCerber.gh W32/Trojan.DOGS-7123 W32.Trojan.Backdoor TR/Crypt.ZPACK.hmkaa Trojan-Ransom.Win32.Blocker.kgrm Trojan/Win32.Dapato.C1720332 Hoax.Blocker Trojan.Dropper Trj/CI.A Win32.Trojan.Blocker.Akzg Trojan.Blocker!U13z+V78Arg Win32/Trojan.Ransom.acc


Since the start of the Russo-Ukrainian conflict, Kaspersky researchers and the international community at large have identified a significant number of cyberattacks executed in a political and geopolitical context.


network.exe submitting to the server code snippet Code similarities We found some code similarities between the implant for Windows and other public accessible projects .


In the image below , we see a log TrickMo sent to the attacker upon becoming the default SMS app .


A backdoor also known as: Win.Trojan.Dadobra-446 Trojan-Downloader.Win32.Banload.bnlx Trojan.Win32.Downloader.337408.M TrojWare.Win32.TrojanDownloader.Dadobra.~JK Trojan.DownLoader5.10443 Trojan-Downloader.Win32.Banload TrojanDownloader.Banload.bhs Trojan[Downloader]/Win32.Banload Trojan-Downloader.Win32.Banload.bnlx Trojan:Win32/Banload.A Downloader/Win32.Banload.C108589 Win32/Spy.Banker.WNS Win32.Trojan-downloader.Banload.Ebhk


Dropper variants are usually barely functioning photo utility , games , or sex related apps .


SMS messages .


Let's examine a couple of interesting delivery techniques from an APT active for the past several years, the Spring Dragon APT.


] 16 lala513.gicp [ .


SunOrcal activity has been documented to at least 2013, and based on metadata surrounding some of the C2s, may have been active as early as 2010.


A backdoor also known as: TSPY_MALUMPOS.SM TSPY_MALUMPOS.SM Win.Trojan.MalumPOS-1 TR/AD.Siaacsia.ielmw Trojan:Win32/Malumpos.A Trojan/Win32.Malumpos.C1727078 Trojan-Spy.MalumPOS Win32/Trojan.Spy.958


] net app store was replaced with the malicious HenBox app ; however , some indicators point to the server running an outdated version of Apache Web Server on a Windows 32-Bit operating system .


An aside: the rootkit does appear to be named after the Pokémon of the same name.


A backdoor also known as: Application.Hacktool.EH Trojan/W32.HackTool.215552 Trojan.Mauvaise.SL1 Win.Tool.Wincred-6333920-0 Application.Hacktool.EH HackTool.Win64.WinCred.c Application.Hacktool.EH Application.Hacktool.EH Tool.WinCred.1 BehavesLike.Win64.BrowseFox.dh W64/Application.WFWG-6345 Application.Hacktool.EH HackTool.Win64.WinCred.c Application.Hacktool.EH HackTool.Win64 Trj/CI.A


Similarly , there are many crucial commands that further allow this spyware to perform additional functionality , such as executing commands sent by the C & C , clicking photos , capturing screenshots , stealing location information , and more .


A backdoor also known as: Trojan-Dropper/W32.Dapato.26112 Trojan-Dropper.Win32.Dapato!O BackdoorAPT.Hikiti.G4 Win32.Trojan.WisdomEyes.16070401.9500.9983 Backdoor.Trojan BKDR_FEXEL.MM Backdoor.Win32.Fexel.b Trojan.Win32.Dapato.ceuzkz Trojan.DownLoader10.12491 BehavesLike.Win32.Downloader.mc Trojan.Win32.Farfli W32/Backdoor.QCOF-8324 Trojan[Dropper]/Win32.Dapato Trojan.Heur.E97E22 Troj.Dropper.W32.Dapato.dawi!c Backdoor.Win32.Fexel.b Backdoor:Win32/Hikiti.G!dha Dropper/Win32.Dapato.C199271 Win32.Backdoor.Fexel.Wvkt Trj/CI.A


The legitimate version of this app is also available on Google Play .


It is assumed that actors using the malware are targeting small- to medium-sized businesses given the malware's focus on VNC applications.


In spite of these commonalities, we have not identified any firm links between the two groups.


The source process changes the registers in the target process so that PC register points directly to the shellcode .


This new wave of attacks has also used some infrastructure that has previously been used in Carbanak campaigns.


This is done using the ptrace syscall .


“ The takeaway ? Internet users should keep on securing their activities with good security solutions for both computers and mobile devices. ” Hashes : E5212D4416486AF42E7ED1F58A526AEF77BE89BE A9891222232145581FE8D0D483EDB4B18836BCFC AFF9F39A6CA5D68C599B30012D79DA29E2672C6E Insidious Android malware gives up all malicious features but one to gain stealth ESET researchers detect a new way of misusing Accessibility Service , the Achilles ’ heel of Android security 22 May 2020 - 03:00PM ESET researchers have analyzed an extremely dangerous Android app that can perform a host of nefarious actions , notably wiping out the victim ’ s bank account or cryptocurrency wallet and taking over their email or social media accounts .


A backdoor also known as: Trojan.ArchSMS!Tf0HkXJW05g Hoax.Win32.ArchSMS.hqqg Hoax.ArchSMS.hqqg SecurityRisk.PremiumSMSScam Hoax.Win32.ArchSMS Trj/CI.A


The new family appears to have been in the wild since late 2016 and to date we have only identified 10 unique samples, indicating it may be sparingly used.


BLOCKER_STOP – block display of all HTML pages .


A backdoor also known as: Backdoor.Win32.Koutodoor!IK Backdoor:Win32/Koutodoor.B Backdoor.Win32.Koutodoor.da SHeur2.AIKX


It specifically targets financial banking applications across the United States and Europe , including Italy , the UK , Spain , Switzerland , France , and Germany .


The StreamEx family has the ability to access and modify the user's file system, modify the registry, create system services, enumerate process and system information, enumerate network resources and drive types, scan for security tools such as firewall products and antivirus products, change browser security settings, and remotely execute commands.


Hide Icon Figure 3 : Code showing the hiding icon and starting service .


A backdoor also known as: Trojan.Comfold Trojan:Win32/Comfold.A


Third-party marketplaces or some other attacker-controlled domains are likely used to host the sample .


Indicators of Compromise SHA256 Package App label 332e68d865009d627343b89a5744843e3fde4ae870193f36b82980363439a425 ufD.wykyx.vlhvh SEX kr porn 403401aa71df1830d294b78de0e5e867ee3738568369c48ffafe1b15f3145588 ufD.wyjyx.vahvh 佐川急便 466dafa82a4460dcad722d2ad9b8ca332e9a896fc59f06e16ebe981ad3838a6b com.dhp.ozqh Facebook 5022495104c280286e65184e3164f3f248356d065ad76acef48ee2ce244ffdc8 ufD.wyjyx.vahvh Anshin Scan a0f3df39d20c4eaa410a61a527507dbc6b17c7f974f76e13181e98225bda0511 com.aqyh.xolo 佐川急便 cb412b9a26c1e51ece7a0e6f98f085e1c27aa0251172bf0a361eb5d1165307f7 jp.co.sagawa.SagawaOfficialApp 佐川急便 Malicious URLs : hxxp : //38 [ .


A backdoor also known as: Worm.Win32.AutoRun!O Worm.AutoRun.Win32.132231 Win32.Trojan.ServStart.a Win.Trojan.Qhost-160 Trojan.Win32.AutoRun.cvpwhj Trojan.DownLoader4.40333 BehavesLike.Win32.Ipamor.lm TR/Dldr.JKCN Trojan/Win32.Downloader.C40577 Trojan.Win32.Wc Win32/AutoRun.PT Trojan-Proxy.Win32.Ranky


The handful of malicious features densely packed in this new malware also includes the ability to drop other malware.


] net – C & C servers NG SuperShell – string from the reverse shell payload ngg – prefix in commands names of the implant for Windows Signature with specific issuer Whois records and IP relationships provide many interesting insights as well .


DOWNLOAD AND UPDATE THE TARGET CONFIGURATION FILE By analyzing and decoding the HTTP packets in EventBot Version 0.0.0.1 , we can see that EventBot downloads and updates a configuration file with almost 200 different financial application targets .


Once the malware can use accessibility services , it has the ability to operate as a keylogger and can retrieve notifications about other installed applications and content of open windows .


A backdoor also known as: W32.FamVT.ShipBHQc.Trojan Trojan.Win32.ShipUp!O TrojanPWS.Zbot.Y Trojan/Kryptik.awzk Trojan.Razy.D3C5B TROJ_KRYPTK.SML3 Win.Trojan.Redirect-6055402-0 Trojan.Win32.ShipUp.brmnrc Trojan.Redirect.140 Trojan.ShipUp.Win32.1152 TROJ_KRYPTK.SML3 BehavesLike.Win32.PWSZbot.dh Trojan.Win32.ShipUp Trojan/ShipUp.ix TR/Rogue.kdz.11287.3 Trojan/Win32.ShipUp TrojanDropper:Win32/Gepys.A Troj.W32.ShipUp.lINm Trojan/Win32.Shipup.R58491 TScope.Malware-Cryptor.SB Trojan.FakeMS.ED W32/Kryptik.AYTK!tr


A backdoor also known as: Trojan-Spy.Win32.Tibia!O Win32.Trojan.WisdomEyes.16070401.9500.9963 Trojan.Win32.Drop.cbndjf Trojan.MulDrop3.1226 BehavesLike.Win32.BadFile.rc Trojan-Dropper.Win32.Monya TR/Drop.Tibdef.B Trojan.Raldhep.1 TrojanDropper:Win32/Tibdef.B W32/Dropper.AAAI!tr


It is in use by the Molerats aka Gaza cybergang, a politically motivated group whose main objective, we believe, is intelligence gathering.


The Magnitude exploit kit has been using an XML configuration file critical to retrieving the malware payload Cerber for several months already.


Here is Forcepoint Security Labs we have seen a number of changes and improvements over the last few months.


The actors compromised the sites of a local television network, educational organizations, a religious institute, and a known political party in Taiwan; and a popular news site in Hong Kong.


One of the first changes that stands out is that the screen recording feature mentioned in the previous sample has been removed .


List of package names of apps on events from which the Trojan opens a fake Google Play window ( for the Russian version of the Trojan ) Example of Trojan screen overlapping other apps When bank card details are entered in the fake window , Riltok performs basic validation checks : card validity period , number checksum , CVC length , whether the number is in the denylist sewn into the Trojan code : Examples of phishing pages imitating mobile banks At the time of writing , the functionality of most of the Western versions of Riltok was somewhat pared down compared to the Russian one .


This disallows apps to be installed on your device from unknown sources .


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G PE_VIRUX.O W32/Trojan2.OALA W32.Virut.CF Win32/Virut.17408 PE_VIRUX.O Win32.Virus.Virut.Q Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg Virus.Win32.Virut.CE Win32.Virut.56 Virus.Virut.Win32.1938 BehavesLike.Win32.Virut.cc W32/Trojan.JXET-3602 Win32/Virut.bt Virus/Win32.Virut.ce Win32.Virut.cr.61440 W32.Virut.lM6H Virus.Win32.Virut.ce TrojanClicker:MSIL/Xobnff.A Win32/Virut.F Virus.Virut.14 W32/Sality.AO Win32/Virut.NBP Virus.Win32.Virut W32/Virut.CE Virus.Win32.Virut.M


A backdoor also known as: Backdoor.Zegost.FC.2167 Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.DownLoader22.48526 BehavesLike.Win32.Trojan.cc Trojan.MSIL.Bladabindi.1 MSIL/Injector.PJG!tr Trj/GdSda.A


This analysis dissects FakeSpy ’ s Chunghwa Post app version , which emerged in April 2020 .


Such references would be in line with FrozenCell 's phishing tactics in which they used file names to lure people associated with the political party to open malicious documents .


Sinkhole data explained below shows just how quickly this campaign is impacting victims.


A backdoor also known as: Trojan.Netstop.A Trojan.Netstop.A Backdoor.Trojan Win32/Noshare.N TROJ_NETSTOPA.A Trojan.Netstop.A Trojan.Win32.Netstop.dyylkw Win32.Trojan-spy.Gc.Hsii Trojan.Netstop.A Worm.Win32.SpyBot.GC Trojan.Netstop.A Email-Worm.Win32.GOPworm.196 TROJ_NETSTOPA.A TR/Netstop.A Trojan.Netstop.A Trojan.Netstop.A Email-Worm.Win32.GOPworm.196 Win32/SpyBot.GC Worm.SpyBot!FiFtixQJKm8 W32/Netstop.A!tr Bck/Secur.A


FireEye assesses that APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests.


android.intent.action.restart A legacy intent used to indicate a system restart .


The list of banks targeted by Red Alert 2.0 includes NatWest , Barclays , Westpac , and Citibank .


In recent years, the detention and interrogation of members of online communities has been publicized by state media for propaganda purposes.


PaloAlto Unit 42 researchers have observed a new Remote Access Tool RAT constructed by an unknown actor of Italian origin.


A backdoor also known as: Trojan.Inject.IA Trojan.Skeeyah.8818 Infostealer.Kegotip!gm TSPY_KEGOTIP.SMA Trojan.Inject.IA Trojan-PSW.Win32.Minari.a Trojan.Inject.IA Trojan.Inject.IA Trojan.Inject.IA Trojan.PWS.Stealer.2518 TSPY_KEGOTIP.SMA BehavesLike.Win32.Backdoor.ch Trojan[PSW]/Win32.Minari Trojan.Inject.IA Trojan-PSW.Win32.Minari.a Trojan/Win32.PWS.R100577 Trojan.Inject.IA


Conclusion Threats are better prevented than cured , so do not follow suspicious links in SMS , and be sure to install apps only from official sources and check what permissions you are granting during installation .


A backdoor also known as: Backdoor.Win32.Mutopy!O Trojan.Mutopy.A TROJ_MUTOPY.SMYN Win32.Trojan.WisdomEyes.16070401.9500.9995 TROJ_MUTOPY.SMYN Win.Trojan.Multi-6413508-0 Troj.Dropper.W32.Dapato.lCcB Trojan.MulDrop4.10927 BehavesLike.Win32.Downloader.hh TR/Kazy.34213.jh Trojan:Win32/Mutopy.A Trojan.Naffy.1 Trojan/Win32.HDC.C53646 TScope.Malware-Cryptor.SB Trojan.Win32.Jorik W32/Rodecap.AS!tr


Cybereason Mobile Detecting EventBotCybereason Mobile detecting EventBot .


The method is a well-known trick used by penetration testers that was automated and generalized by FinFisher The procedure starts by enumerating the KnownDlls object directory and then scanning for section objects of the cached system DLLs .


A backdoor also known as: Backdoor.W32.Androm.toYX Trojan/Injector.drgl Win32.Trojan.WisdomEyes.16070401.9500.9978 Win.Trojan.WillExec-6356235-0 Backdoor.Androm.sdz Trojan.Zusy.D3FE2C Trojan:Win32/Lethic.Q!bit Backdoor.Androm Trj/GdSda.A W32/Injector.DQID!tr


Samples uploaded to public repositories indicate that the new version of Typhon Reborn has been in the wild since December 2022.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.RHUU-4415 MSIL.Trojan.Packed.G Trojan-Dropper.Win32.Scrop.ccm Trojan.Win32.Inject.dzszva Trojan.PWS.Multi.1690 BehavesLike.Win32.Trojan.tc TrojanDropper.Sysn.arw TR/Injector.drydq Trojan/MSIL.Inject Trojan:MSIL/Plimrost.B Trojan.Kazy.DAD984 Trojan-Dropper.Win32.Scrop.ccm Trojan/Win32.Injector.C952834 Trj/CI.A Trojan.MSIL.Injector MSIL/Kryptik.DDP!tr


Zcrypt uses the Nullsoft Scriptable Install System, which works like a Zip file, decompressing and loading the content while running.


The malware used in the new attacks was a variant of the infamous Shamoon worm that targeted Saudi Aramco and Rasgas back in 2012.


This malware is simplistic in comparison to some modern-day Android malware .


Some of these might have been used on old campaigns or were already prepared for new campaigns .


Again , the concept is that new victims are more likely to install the malware if the SMS comes from someone they know .


This technical note discusses a relatively undocumented implant used by the APT10 group.


A backdoor also known as: TROJ_STARTPA.NSS W32/Backdoor2.HTGN Win32/Wysotot.GJVbdHD TROJ_STARTPA.NSS Win32.Trojan-Hijacker.Wysotot.A Trojan.Win32.AdLoad.eizvbn Adware.Mutabaha.255 Adware.MutabahaCRTD.Win32.1189 BehavesLike.Win32.ICLoader.gc Backdoor.Win32.ZAccess W32/Backdoor.SAIZ-5729 Trojan/Win32.StartPage Trojan.Adware.Zusy.D1584D PUP.Elex/Variant Downloader/Win32.Adware.R86759 Trojan.StartPage PUP.Optional.Elex Trj/CI.A Trojan.StartPage!B6aZ1c5P97Y


A backdoor also known as: Trojan.MSIL.Crypt.gauf Trojan.Starter.7472 Trojan.MSIL.ilny TR/AD.Binderon.roatv Trojan.Ursu.D13D6D Trojan.MSIL.Crypt.gauf PWS:AutoIt/Passup.A Win32/Spy.Autoit.BY Trj/GdSda.A


A backdoor also known as: HW32.Packed.1BC9 Trojan.Banavkill Trojan-Banker.Win32.Banbra.wjem Trojan.Win32.Banbra.exnyzm TR/Spy.Banker.ohxzm Trojan.Ursu.D10A45 Trojan-Banker.Win32.Banbra.wjem Trojan:Win32/Banavkill.A Trojan/Win32.Banbra.C2352559 Trojan-Banker.Banbra Trj/GdSda.A Win32.Trojan.Falsesign.Htma Win32/Trojan.f8b


We are providing a detailed analysis of the rootkit, and also making the samples available to the industry to help others block this threat.


The Flash zero-day exploit ( CVE-2015-5119 ) was added into the Angler Exploit Kit and Nuclear Exploit Pack .


A backdoor also known as: W32.OnGamesLT180912HKGHAAI.Trojan Trojan.PWS.OnlineGames.ZON Trojan.PWS.OnlineGames.ZON Win32.Trojan.WisdomEyes.16070401.9500.9999 Infostealer.Gampass TSPY_ONLINEG.FGF Win.Trojan.Onlinegames-44 Trojan.PWS.OnlineGames.ZON Trojan.PWS.OnlineGames.ZON Trojan.Win32.OnLineGames.rzwt Troj.PSW32.W.OnLineGames.aoem!c Trojan.PWS.OnlineGames.ZON Packed.Win32.MUPACK.~KW Trojan.PWS.OnlineGames.ZON Trojan.PWS.Wsgame.5652 Trojan.OnLineGames.Win32.160328 TSPY_ONLINEG.FGF BehavesLike.Win32.Sdbot.cz Trojan/PSW.OnLineGames.akkc TrojanDropper:Win32/Tilcun.E Trojan/Win32.MalPack.C60090 Trojan.PWS.OnlineGames.ZON BScope.Trojan-PSW.Gomex.22 Trj/Pupack.A


The infamous Remote Access Trojan RAT Poison Ivy hereafter referred to as PIVY has resurfaced recently, and exhibits some new behaviors.


However, we recently encountered a botnet that uses a more unusual method: an FTP server that, in effect, acts as a C C server.


A backdoor also known as: Backdoor/W32.Small.40960.BX TROJ_FAKEAV.ASI W32/Backdoor2.HASV Backdoor.Trojan.B Win32/Wonip.A TROJ_FAKEAV.ASI Trojan.PWS.Sniftp.15 W32/Backdoor.YSEB-6778 BDS/Wonip.A Backdoor:Win32/Wonip.A Trojan/Win32.Xema.C82592 W32/Backdr.FB!tr Win32/Backdoor.435


Since we published our article on Sage 2.0 last February, and the discovery of version 2.2 in March, the FortiGuard Labs team hasn't seen significant activity with this malware for over six months.


A backdoor also known as: Trojan.Qhosts Trojan.Win32.Z.Redcap.1251647 TR/RedCap.ymgda


Reverse shell payload The reverse shell module is an external ELF file compiled by the attackers to run on Android .


We identified one specific spear phishing campaign launched against targets within Palestine, and specifically against Palestinian law enforcement agencies.


At the time of writing this article , no other significant changes in Asacub ’ s network behavior had been observed : The origin of Asacub It is fairly safe to say that the Asacub family evolved from Trojan-SMS.AndroidOS.Smaps .


Once installed on a device FrozenCell is capable of : Recording calls Retrieving generic phone metadata ( e.g. , cell location , mobile country code , mobile network code ) Geolocating a device Extracting SMS messages Retrieving a victim 's accounts Exfiltrating images Downloading and installing additional applications Searching for and exfiltrating pdf , doc , docx , ppt , pptx , xls , and xlsx file types Retrieving contacts The graph below represents a split of the types of data from only one misconfigured command and control server ( out of over 37 servers ) .


A backdoor also known as: Backdoor.Yurist.Win32.37 Win32.Trojan.WisdomEyes.16070401.9500.9992 Backdoor.Win32.Yurist.cy Trojan.Win32.XFlash.bodumo Backdoor.W32.Yurist.cp!c Heur.Packed.Unknown BackDoor.XFlash BehavesLike.Win32.Backdoor.ph Backdoor/Yurist.z BDS/Yurist.K Backdoor:Win32/Yurist.K Trojan.Graftor.D45274 Backdoor.Win32.Yurist.cy Trojan/Win32.LdPinch.C27294 Win32.Backdoor.Yurist.Eads Backdoor.Yurist!9F5bediy4gg Backdoor.Win32.Yurist Trj/CI.A Win32/Backdoor.c62


If the victim opens it up, it will not only infect their system but send the same phishing document to other contacts via their Outlook inbox.


A backdoor also known as: BKDR_BAYROB.SM4 Win32.Trojan.WisdomEyes.16070401.9500.9948 BKDR_BAYROB.SM4 TrojWare.Win32.Bayrob.A Trojan.Kelios.1 Trojan:Win32/Horkremoz.A W32/Bayrob.O!tr Win32/Trojan.4af


A backdoor also known as: Backdoor.Win32.TDSS!O Backdoor.TDSS.Win32.7367 Trojan/Olmarik.akn Trojan.TDss.58 Win32.Trojan.WisdomEyes.16070401.9500.9999 TSPY_ALUREON_CD102969.RDXN Win.Trojan.Tdss-302 Backdoor.Win32.TDSS.dtx Trojan.Win32.TDSS.cdwoi Backdoor.Win32.A.Tdss.63488.B TrojWare.Win32.Olmarik.AME Trojan.DownLoader1.46896 TSPY_ALUREON_CD102969.RDXN BehavesLike.Win32.VBObfus.kh Backdoor.Win32.TDSS Backdoor/TDSS.apn Trojan[Backdoor]/Win32.TDSS Win32.Hack.TDSS.d.kcloud Backdoor.Win32.TDSS.dtx Trojan/Win32.Tdss.R1603 DNSChanger.ca Trojan.FakeAlert Win32/Olmarik.AKN Backdoor.TDSS!fzuavqQuzWg W32/DNSChanger.CA!tr


It ’ s possible the threat actors use this list to find running antivirus or banking applications .


This, combined with its focus on a specific region, makes this threat interesting from the malware researchers' perspective.


Once they obtained access to the server, the attackers infected the system with two malicious payloads.


Standard Encryption Frequently , Bread apps take advantage of standard crypto libraries in ` java.util.crypto ` .


A typical Lurk infection uses browser exploits to deliver non-persistent payloads to potential victims, probing their targets before deploying additional malware.


Backdoored Conversations C2 server analysis During the analysis of the Smali injected apps and their C2 server infrastructure we hadn ’ t found any interesting clues , but things changed when we looked at the C2 server of the linked Conversations messenger .


Some of the popular Android applications that Ewind targets include GTA Vice City, AVG cleaner, Minecraft – Pocket Edition, Avast! Ransomware Removal, VKontakte, and Opera Mobile.


For example , it could be used to display unwanted and annoying advertisements on a device , or potentially , to download and deploy a payload that steals credentials from an infected device .


FakeSpy Chunghwa Post version installation process and application UI .


A backdoor also known as: Trojan.Strictor.D1F9FA Trojan.Win32.BuhTrap.c Trojan.YakesCRTD.Win32.4839 Trojan/Win32.BuhTrap.c Backdoor:Win32/Buhtrap.A!dha Trojan.Win32.BuhTrap.c Trj/GdSda.A Backdoor.Win32.Buhtrap W32/Delf.QJL!tr Win32/Trojan.5c7


Instead of being controlled by a traditional command-and-control server , it receives instructions via tweets .


Malware code showing loading of decrypted dex file Figure 12 .


We were able to see that his recently visited web sites were Google Play pages belonging to apps containing the Ashas adware .


A backdoor also known as: W32/Etap.d Win32.Trojan.WisdomEyes.16070401.9500.9826 Trojan.GootKit!gm BehavesLike.Win32.Injector.fh Trojan.Barys.D1A48


We believe this spyware platform is developed by an Italian company called eSurv , which primarily operates in the business of video surveillance .


That's why we refer to this malware as Shakti Trojan.


A backdoor also known as: Trojan/Klone.bz W32/MUPX.A Packed.Win32.Klone.bz BackDoor.IRC.Rxbot.69 Backdoor.Win32.Rbot!IK Win32.Hack.Klone.bz.kcloud Packed/Win32.Klone Backdoor.IRCbot!312D Backdoor.Win32.Rbot


Attackers also used the name of the top-ranking official associated with Minister of Home affairs in the signature of the email, this is to make it look like the email was sent by a high-ranking Government official associated with Ministry of Home Affairs MHA.


A backdoor also known as: Trojan.Crypt.GH Trojan.Crypt.GH Trojan.Crypt.GH Win32.Trojan.WisdomEyes.16070401.9500.9999 Infostealer.Gampass TROJ_PUKISH.A Trojan.Crypt.GH Win32.Trojan-dropper.Drob.Pdmj Trojan.Crypt.GH Trojan.Crypt.GH Trojan.MulDrop7.42417 TROJ_PUKISH.A Trojan-Dropper.Win32.Drob W32/Trojan.SPVB-8287 Win32.Infect.a.124448 TrojanDropper:Win32/Pukish.A Trojan.Crypt.GH Trj/CI.A Win32/Trojan.f42


A backdoor also known as: W32.W.CodeRed.l11t Exploit:Win32/CVE-2006-3942.A Exploit.Win32.CVE-2006-3942


A backdoor also known as: Troj.W32.Havex!c Win32.Trojan.WisdomEyes.16070401.9500.9950 Trojan.Win32.Havex.tm Trojan.Proxy2.1026 BehavesLike.Win32.Dropper.gh Trojan.Havex.w TR/Havex.fbdyv Trojan.Win32.Havex.tm


A backdoor also known as: Win32.Worm.P2P.Puce.G Worm/W32.Kapucen.106496.EK I-Worm.Kapucen.b.n4 W32/Kapucen.b Trojan.Win32.Kapucen.qyzel Win32/Puce.D WORM_KAPUCEN.B Worm.Puce.E P2P-Worm.Win32.Kapucen.b Win32.Worm.P2P.Puce.G Worm.Kapucen.A Worm.Win32.P2P-Kapucen.106496.C Worm.Win32.Kapucen.B Win32.Worm.P2P.Puce.G Win32.HLLW.Puce Worm/Puce.D.90 WORM_KAPUCEN.B Worm/P2P.Kapcen.b Worm:Win32/Puce.D Win32.Worm.P2P.Puce.G Worm/Win32.Kapucen Trojan.Win32.Kapucen.B Win32/Kapucen.B P2P-Worm.Win32.Kapucen.b W32/Kapucen.fam!worm.p2p Win32/Puce.C W32/Puce.E.worm


On July 17, 2017, we detected a malicious document in VirusTotal exploiting CVE-2017-0199.


A backdoor also known as: Packed.Win32.Klone!O Backdoor.SkSocket Backdoor.Trojan Trojan.Win32.SkSocket.uwlqa Backdoor.Win32.SkSocket.109_t0 BackDoor.Sksock Virus.Win32.SkSocket.C Backdoor/SkSocket.o BDS/SkSocket.109 Win-Trojan/SkSocket.40960 Trj/CI.A Win32/SkSocket.109 Win32.Backdoor.Sksocket.Dyqp Trojan/Win32.lssj.2cc.rgrk


Initial indicators of compromise from todays WannaCry ransomware outbreak.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9971 Win.Spyware.1756-2 BehavesLike.Win32.Autorun.dc Trojan/Win32.Xema.C73573


Icons used for EventBot masqueraded as legitimate with these icons.application .


A backdoor also known as: W32.Clod62e.Trojan.18e2 Win32.Trojan.WisdomEyes.16070401.9500.9922 Trojan.Kasperbogi W32/Trojan.PRNK-2932 TR/Golroted.jumln Trojan.Strictor.D16D8E Trojan:Win32/Parsky.A!bit Trj/GdSda.A Win32/Trojan.cfd


A recent investigation by security firm CTI has identified a new wave of malware delivered to the MaaS and PPI service providers in the underground black markets, including a controversial piece of code linked to North-Korean hackers.


The phone number is fetched from a response from the C & C server and is stored in str3 variable , which further is utilized using the tel : function .


The payload, distributed disguised as antivirus, is a variant of Korplug RAT aka PlugX – a spyware with former associations with Chinese APT groups, and known from targeted attacks at important institutions of various countries.


A backdoor also known as: PUP.Optional.FilePile.A PE:PUF.FilePile!1.9E19


The site was redirecting visitors to the malware through a compromised OpenX Ad server injecting a malicious iframe into the page.


A backdoor also known as: Win32.Trojan.Ad.Pdms Trojan.InstallCube.412 Variant.Kazy.apq TR/AD.Fakruce.M.2 Trojan.Kazy.DBFFE0 Trojan.Win32.Z.Kazy.2435953 Trojan:Win32/Fakruce.B Trojan.Kazy!YZdrjH6xcT8 Trj/CI.A Win32/Trojan.824


The main purpose of this module is to exfiltrate Skype call recordings .


Shamoon W32.Disttrack first made headlines in 2012 when it was used in attacks against energy companies in Saudi Arabia.


In recent years , online activity has gradually been shifting from personal computers to mobile devices .


A backdoor also known as: Win32.Rootkit.Koutodoor.a TrojWare.Win32.Zybr.A W32.Trojan.Koutodoor.E Trojan:Win32/Koutodoor.F Trojan.Zusy.D41F3C Trojan.Win32.koutodoor.i Trojan.Rootkit RootKit.Win32.Koutodoor.I


A backdoor also known as: Backdoor.NSIS Win32.Trojan.WisdomEyes.16070401.9500.9623 TR/AD.Trochilus.illau Backdoor:Win32/Trochil.A.dll!dha Win32/Korplug.KA Win32/Trojan.d66


The imports reveal the use of a second DLL called " eCommon.dll .


While the “ core ” module resides inside the APK file , it is encrypted and disguised as a JPG file – the first two bytes are actually the magic header of JPG files , while the rest of the data is encoded with an XOR cipher .


From troubleshooting machines across countries to observing employees across rooms, RAT solutions have become widely used tools for remote maintenance and monitoring.


All information about your social networks , Bank accounts , Credit Cards .


A backdoor also known as: Trojan/W32.AntiAV.1355776.B Trojan.Win32.Vilsel!O Worm.Pykspa.C3 Worm.SkypeBot Trojan.Pykspa.1 Win32.Worm.Autorun.o W32.Pykspa.D Win32/Vilsel.CE WORM_VILSEL.SMC Win.Worm.Pykspa-1 Trojan-Ransom.Win32.Blocker.jcen Backdoor.W32.Zepfod.lohV Worm.Win32.Pykspa.a WORM_VILSEL.SMC BehavesLike.Win32.Pykse.tz Trojan/Blocker.lhz Trojan/Win32.AntiAV Trojan-Ransom.Win32.Blocker.jcen Trojan/Win32.Zepfod.R4378 Trojan.ChidikSun.28205 Trojan.Pykspa Trojan.Win32.Spy Trj/Vilsel.B Worm.Win32.Pykse.A


Mobile malware's disruptive impact on enterprises continues to see an uptick in prevalence as mobile devices become an increasingly preferred platform to flexibly access and manage data.


Morphick responded to a Kronos phishing campaign that involved a document with a malicious macro that downloaded the Kronos banking malware.


First of all the new package name is com.google.services , which can easily be confused with a legitimate Google service .


Its dropper family finished integration with Bundle Feng Shui and campaign C & C infrastructure was shifted to AWS cloud .


A backdoor also known as: Trojan.Graftor.D13264 Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Win32.DownLoad3.euzkrf Trojan.Win32.Z.Graftor.605184.A Trojan.DownLoad3.23753 BehavesLike.Win32.Trojan.hh Trojan.Win32.CoinMiner Trojan/Win32.Unknown Trojan:Win32/Herxmin.A Trojan.CoinMiner!kUww8sDe3p0 W32/CoinMiner.CE!tr


“ Using Twitter instead of command-and-control ( C & C ) servers is pretty innovative for an Android botnet. ” “ Using Twitter instead of command-and-control ( C & C ) servers is pretty innovative for an Android botnet , ” says Lukáš Štefanko , the ESET malware researcher who discovered the malicious app .


The overall motivation of this campaign is unclear at this time.


In fact, they have been using them since at least 2014 with very few variations in their modus operandi.


A backdoor also known as: W32.Info_InstallNA128.Trojan Trojan/W32.Buzus.61952.BP Trojan.Bulta Win32.Trojan.WisdomEyes.16070401.9500.9891 W32/MalwareS.FWD Win32/Tnega.AUFK Trojan.Win32.Drop.cuupf Trojan.Win32.Buzus.61952.D Trojan.Inject.63252 Trojan.Buzus.Win32.27194 BehavesLike.Win32.Backdoor.kh W32/Risk.CHGA-0655 Trojan/Buzus.svw Trojan/Win32.Buzus Backdoor:Win32/Gaertob.A Troj.W32.Buzus.tnoM Trojan/Win32.Buzus.R42500 BScope.Trojan.Palevo.012 Trojan.Buzus Trojan.Buzus!iqgr48px8nU Virus.Win32.Injector W32/Injector.fam!tr Win32/Trojan.203


A backdoor also known as: W32.FadobesLTA.Trojan Trojan.Nixofro.A3 Trojan/Downloader.VB.qjf W32/Backdoor.VMXK-0114 Win32/TrojanDownloader.VB.QJF TROJ_SPNR.35CD14 Trojan.Win32.Foreign.ctjhyf Trojan.Win32.Z.Foreign.1078272.B[h] Troj.Ransom.W32.Foreign.kcme!c Trojan:W32/Kilim.P Trojan.Guncelle.2 Trojan.Foreign.Win32.41642 TROJ_SPNR.35CD14 BehavesLike.Win32.Trojan.tm W32/Backdoor2.HUDC TR/Kazy.323825.8 W32/Foreign.KCME!tr Trojan[Ransom]/Win32.Foreign Win32.Troj.Undef.kcloud Trojan.Symmi.D97A6 Trojan:Win32/Nixofro.A Hoax.Foreign Win32.Trojan.Foreign.Htmh Trojan.Win32.Nixofro


If the text is retrieved successfully , the app uses JavaScript injection again to submit the HTML form with the captcha answer .


Figure 10 : The algorithm of the malicious update , while “ Agent Smith ” updates application If all that has failed , “ Agent Smith ” turns to Man-in-the-Disk vulnerability for ‘ SHAREit ’ or ‘ Xender ’ applications .


This was developed as an alternative to [Telnet]https://null-byte.wonderhowto.com/how-to/hack-like-pro-use-netcat-swiss-army-knife-hacking-tools-0148657/, which sends information in plaintext, which is clearly a problem, especially when [passwords]https://null-byte.wonderhowto.com/how-to/hack-like-pro-crack-passwords-part-1-principles-technologies-0156136/ are involved.


The Red Alert Payload Once installed , the malware requests Device Administrator privileges .


A backdoor also known as: Trojan.Tiny.S22205 Win32.Trojan.WisdomEyes.16070401.9500.9981 TrojanDownloader.TinyLoader.c TR/Crypt.Xpack.xhbzp Trojan:Win32/Anobato.A


root9B discovered an advanced, targeted PoS intrusion focused on harvesting payment card information for exfiltration.


A backdoor also known as: W32.HfsAutoB.FD30 Backdoor.Win32.Delf!O Backdoor.Delf.Win32.7383 Win32.Worm.Delf.cq W32.Minudazash Win.Trojan.Delf-10643 Backdoor.Win32.Delf.oqi Trojan.Win32.Delf.culgk Backdoor.Win32.Delf.308224.E Win32.HLLW.Autoruner1.11184 BehavesLike.Win32.Fake.fc Virus.Win32.Virut Backdoor/Delf.ode Trojan[Backdoor]/Win32.Delf Worm:Win32/Scafros.A Backdoor.Win32.Delf.oqi Win32/FakeMS.WOCR Backdoor.Delf W32/Banker.LWD Backdoor.Delf!0+it/723aCk W32/Delf.OQI!tr.bdr


Asset file before and after decryption Once the encrypted executable is decrypted and dropped in the storage , the malware has the definitions for all the components it declared in the manifest file .


A backdoor also known as: Trojan.Dukescamlock Trojan.TechSupportScam Ransom_DukescamLock.R002C0TK817 Win32.Trojan.WisdomEyes.16070401.9500.9553 W32.Golroted Ransom_DukescamLock.R002C0TK817 Trojan-FakeAV.MSIL.FakeSupport.d Trojan.KillProc.49845 Ransom.MSIL.DukescamLock TR/FakeSupport.gixtd Ransom:MSIL/DukescamLock.A Trojan-FakeAV.MSIL.FakeSupport.d Trj/GdSda.A MSIL/FakeSupport.AZ!tr


The malicious developer ’ s apps published on the App Store which don ’ t contain the Ashas adware Searching further for the malicious developer ’ s activities , we also discovered his Youtube channel propagating the Ashas adware and his other projects .


ESET researchers have discovered a new sneaky malware threat named Joao, targeting gamers worldwide.


CryptoWall is one ransomware variant that has shown gradual evolution over the past year with CryptoWall 2 and Cryptowall 3.


Yesterday January 19th we discovered a new wave of these attacks, where a number of electricity distribution companies in Ukraine were targeted again following the power outages in December.


We reported the apps to the Google security team and they were swiftly removed .


Case in point: the emergence of UIWIX ransomware detected by Trend Micro as RANSOM_UIWIX.A and one notable Trojan our sensors detected.


A backdoor also known as: W32.eHeur.Virus02 Trojan.Patched.JJ Trojan.Patched.JJ Trojan.Patched.JJ Win32.Trojan.WisdomEyes.16070401.9500.9925 Backdoor.Graybird Trojan.Patched.JJ Trojan.Patched.JJ Trojan.Patched.JJ BehavesLike.Win32.BadFile.gh W32.Trojan.Patched Trojan:Win32/Jaku.C!dha Trojan.Patched.JJ Trojan.Win32.Jaku


The library that uses tinyML is not yet wired to the malware ’ s functionalities , but its presence in the malware code indicates the intention to do so in future variants .


In at least one case, an app used for jailbreaking was available via this third-party app store.


FBI and CISA believe this variant, which uses its own custom-made file encryption program, evolved from earlier iterations that used Zeon as a loader.


A backdoor also known as: Trojan/W32.AntiAV.105984 Trojan.Win32.AntiAV!O Trojan.FakeMS.ED Win32.Trojan.ImPatch.a Trojan.KillAV Win32/Gosht.AY Trojan.Win32.PcClient.zvjt Trojan.Win32.AntiAV.105984.B TrojWare.Win32.Magania.~AAD BehavesLike.Win32.Backdoor.ch Trojan/AntiAV.acg Trojan/Win32.AntiAV Trojan:Win32/Scelp.A Trojan/Win32.OnlineGameHack.R1939 Trojan.AntiAV Trj/Redbind.C Backdoor.Win32.Gh0st.g Trojan.AntiAV!x/J77uxYhp4 Backdoor.Win32.FirstInj W32/Farfli.DZ!tr


Linux.MulDrop.14 changes the password on the devices it infects, unpacks and launches a miner, and then, in an infinite loop, starts searching for network nodes with an open port 22.


Based on the type of targets, on Gaza being the source of the attacks, and on the type of information the attackers are after - we estimate with medium-high certainty that the Hamas terrorist organization is behind these attacks.


A backdoor also known as: W32.HfsAdware.C713 Adware.KraddareCRTD.Win32.3559 W32/Adware.AKQI HT_KRADDARE_FB150035.UVPM Win.Trojan.Kraddare-257 not-a-virus:Downloader.Win32.Snojan.dvv Trojan.Win32.Dwn.cwejxs Trojan.DownLoader21.62200 HT_KRADDARE_FB150035.UVPM W32/Adware.VBKZ-4259 Variant.Strictor.ij TrojanDownloader:Win32/Kraddare.D Trojan.Strictor.D13BAE not-a-virus:Downloader.Win32.Snojan.dvv Win32.Application.RaonMedia.A Downloader.Snojan Adware.Kraddare!CDLXoCIKpSY Trojan-Downloader.Win32.Kraddare


This newest variant has been labeled XLoader version 6.0 ( detected as AndroidOS_XLoader.HRXD ) , following the last version discussed in a previous research on the malware family .


MITRE ATT & CK techniques Tactic ID Name Description Initial Access T1475 Deliver Malicious App via Authorized App Store The malware impersonates legitimate services on Google Play Persistence T1402 App Auto-Start at Device Boot An Android application can listen for the BOOT_COMPLETED broadcast , ensuring that the app 's functionality will be activated every time the device starts Impact T1472 Generate Fraudulent Advertising Revenue Generates revenue by automatically displaying ads The Rotexy mobile Trojan – banker and ransomware 22 NOV 2018 On the back of a surge in Trojan activity , we decided to carry out an in-depth analysis and track the evolution of some other popular malware families besides Asacub .


It can also create a simple HTTP server on the infected device to deceive victims .


FakeSpy behavior on physical device vs emulator ( anti-emulator ) .


A backdoor also known as: Backdoor.Sanhotan Trojan/IRCBot.bh Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Tnega.CTXcdP TROJ_SANHOTAN.SMCC Trojan.Win32.Dwn.cwxrbq TrojWare.MSIL.IRCBot.bh Trojan.DownLoader10.23149 TROJ_SANHOTAN.SMCC Trojan.Msil BDS/MSIL.Sanhotan.A.3 Backdoor:MSIL/Sanhotan.A Trojan.Kazy.D3D12A Trojan/Win32.Strictor.C202516 Trojan.Badur Backdoor.MSIL!V0iyslQUBdw MSIL/IRCBot.AR!tr


Around 2014, a specific user group of BlackEnergy attackers came to our attention when they began deploying SCADA-related plugins to victims in the ICS and energy sectors around the world.


A backdoor also known as: Backdoor.Win32.PcClient!O Win32.Trojan.WisdomEyes.16070401.9500.9999 Hacktool.Rootkit Win.Trojan.PcClient-22 Backdoor.Win32.PcClient.qz Troj.W32.Pakes.l3y1 Backdoor.Win32.PcClient.~AB BackDoor.PcClient BackDoor-CKB.sys Backdoor.Win32.PcClient Backdoor/PcShare.uu BDS/Pcclient.hp.1.C Backdoor.Win32.PcClient.qz Trojan/Win32.PcClient.R32879 BackDoor-CKB.sys


Bread has used a few tricks to keep strings in plaintext while preventing basic string matching .


A backdoor also known as: Trojan-PSW.Win32.Gip.112 Trojan.PWS.Gip.EJ GIP.Trojan Gip.1_12 Win32.PSW.Gip.112 TrojWare.Win32.PSW.Gip.112 Trojan.PWS.Gip.112 TR/PWStealer.Srv TROJ_GIP.112 Heuristic.BehavesLike.Win32.Downloader.A Win32/PSW.Gip.112 Trojan/PSW.Gip.112 Trojan-PWS.Win32.Gip!IK Backdoor.Win32.GIP.45568 Win-Trojan/Gip.45990 Trojan.PSW.Gip.1_12 Trojan.PWS.Gip.EJ Trojan.PSW.Gip.112 Trojan-PWS.Win32.Gip W32/GIP.112!tr Gip.1_12


A backdoor also known as: Trojan.Mezzia.CV Trojan.Mezzia TrojanDropper:Win32/Pakks.A Trojan.Mezzia.CV Worm.Mail.Win32.Zhelatin.hd Dropper.Small.29.E


TrendMicro has recently discovered a Trojan Android ad library called Xavier Detected by Trend Micro as ANDROIDOS_XAVIER.AXM that steals and leaks a user's information silently.


It downloads one more archive and dynamically loads code from it .


Recently, we observed a new version of the Clayslide delivery document used to install a new custom Trojan whose developer calls it ALMA Communicator


] top/7 * * * * * 3 ” ( Fr .


BernhardPOS is named after presumably it's author who left in the build path of C:\bernhard\Debug\bernhard.pdb and also uses the name Bernhard in creating the mutex OPSEC_BERNHARD


It is clear that on all stages there are at least two layers .


The names used for Android components are similar : Similarities with AnubisSimilarities with Anubis When analyzing these components , similarities were found in the code of both malware families : Similarities with Anubis Another major change that indicated that the actor copied code from the Anubis Trojan is the way of handling configuration values .


It looks like its main purpose is to get into the system and execute downloaded files with root rights .


A backdoor also known as: W32/Autorun.worm.f Worm.VB.Win32.714 Trojan.Heur.9nKfrjYfrwgib W32/Worm.LUOA-4933 W32.SillyFDC Trojan.Win32.Coba.czqfat Worm.Win32.VB.110592 Win32.Trojan.Fakedoc.Auto BehavesLike.Win32.Trojan.tz Worm.Win32.VB W32/Worm.APSB Worm:Win32/Fakeon.A!bit HEUR/Fakon.mwf W32/ExeFolder.E.worm Worm.VB!Ly8UmpRsepM Win32/RootKit.Rootkit.7e5


A backdoor also known as: Trojan.Heur.AutoIT.7 Win.Trojan.Autoit-271 TR/Spy.438784.57


A backdoor also known as: Ransom/W32.GandCrypt.229376.B Trojan.Gandcrypt Troj.Ransom.W32!c Ransom_GandCrypt.R002C0WB618 Win32.Trojan.WisdomEyes.16070401.9500.9998 Ransom_HPGANDCRAB.SMONT Trojan-Ransom.Win32.GandCrypt.bw Trojan.Win32.Kryptik.exorqv TrojWare.Win32.Ransom.GandCrypt.A BehavesLike.Win32.Trojan.dc Trojan/Win32.Magniber.C2395866 Trojan-Ransom.Win32.GandCrypt.bw W32/Injector.DVHR!tr


A backdoor also known as: Trojan.Multi Spyware.PasswordStealer Backdoor.Androm.Win32.48978 Uds.Dangerousobject.Multi!c Win32.Trojan.WisdomEyes.16070401.9500.9547 Backdoor.Win32.Androm.oxvy Trojan.Win32.Androm.exigvu Trojan.PWS.Banker1.24888 BehavesLike.Win32.Fareit.ft Trojan.Win32.Injector TR/Dropper.VB.hvcaz Trojan[Backdoor]/Win32.Androm Backdoor.Win32.Androm.oxvy Trojan/Win32.VBKrypt.R218732 Backdoor.Androm Trj/GdSda.A Win32.Backdoor.Androm.Wvaq W32/FareitVB.DVIL!tr Win32/Trojan.5a2


This rootkit family called Umbreon sharing the same name as the Pokémon targets Linux systems, including systems running both Intel and ARM processors, expanding the scope of this threat to include embedded devices as well.


At the time of writing Lookout has observed two updates to the Dardesh application , the first on February 26 and the second on March 28 .


A backdoor also known as: Trojan-Downloader.Win32.Delf!O Backdoor.Ginwui Win32.Trojan-Dropper.Delf.bc W32/Trojan2.JUQE PE_GINWUI.AP Win.Downloader.80081-1 Trojan-Downloader.Win32.Delf.ccc Trojan.Win32.Delf.uhoo Troj.Dropper.W32.Delf.li4k Win32.Trojan-downloader.Delf.Taex Trojan.DownLoad3.11310 Downloader.Delf.Win32.28823 PE_GINWUI.AP BehavesLike.Win32.Kespo.fc W32/Trojan.ZLPI-8330 TrojanDownloader.Delf.fdg TR/Ghimpe.dll Trojan[Downloader]/Win32.Delf Trojan.Graftor.D7EE4 Trojan.Win32.Downloader.54960 Trojan-Downloader.Win32.Delf.ccc Backdoor:Win32/Ginwui.D Trojan/Win32.Xema.R106631 Win32/TrojanDropper.Delf.OCT Trojan.DL.Delf!lmsXQwcGhNs Trojan-Dropper.Win32.Interlac TrojanDownloader.Delf


A backdoor also known as: Trojan-Downloader.Win32.Tiltee TrojanDownloader:Win32/Tiltee.A


A backdoor also known as: W32.Superboy Trojan.Vir.HLL Virus.Supeboy.Win32.1 Trojan.Heur.E3C718 TROJ_SUPEBOY.A W32/Superboy.MNPI-1152 TROJ_SUPEBOY.A Win.Trojan.Supeboy-1 Virus.Win32.HLLW.Supeboy Virus.Win32.HLLW.ghqc Trojan.Win32.Downloader.11776.D W32.HLLW.Supeboy!c Win32.HLLW.Supeboy.A W32/Supeboy.worm Trojan/SuperBoy.DelRegBackup W32/HLLW.Supeboy.A Virus/Win32.Supeboy Virus.Win32.HLLW.Supeboy W32/Supeboy.worm Trojan.Worm Win32/HLLW.Supeboy.A Win32.Virus.Hllw.Akeq Win32.HLLW.Supeboy.B Virus.Win32.HLLW Win32/Virus.BO.621


We continue to monitor its progress .


UNDER ACTIVE DEVELOPMENT An analysis of new FakeSpy samples to old ones showed code discrepancies and new features .


A backdoor also known as: W32.AppdataAdobLnrC.Trojan Net-Worm.Win32.Cynic!O Worm.Cynic Worm.Cynic.Win32.96 Win32.Trojan.WisdomEyes.16070401.9500.9997 Net-Worm.Win32.Cynic.iu Trojan.Win32.Bot.crrkzb BackDoor.IRC.Bot.1244 BehavesLike.Win32.Downloader.ct TR/Zbot.var Worm[Net]/Win32.Cynic Worm:Win32/Vexral.A Trojan.Barys.657 Worm.Win32.A.Net-Cynic.95744 Net-Worm.Win32.Cynic.iu Trojan/Win32.IRCBot.R23264 Worm.Cynic Win32/AutoRun.IRCBot.II Trojan.Injector!y7pxtOpaO3Y Net-Worm.Win32.Cynic W32/Injector.HXK!tr


Like several of the newer variants of ransomware, it does not require an internet connection to encrypt the files.


In a 5-month timespan , actor managed to create a Trojan from scratch which will presumably continue evolving offering new features such as keylogging , back-connect proxy or RAT capabilities .


A backdoor also known as: Trojan-Spy/W32.QQLogger.236036.B TrojanPWS.QQthief.BI4 Trojan/Spy.QQLogger.aby Trojan.Win32.QQLogger.bdqigk Phisher.CZ Trojan.Spy-85326 Trojan-Spy.Win32.QQLogger.ado TrojanSpy.QQLogger!0FayLe3uYlk Trojan.PWS.Qqpass.6867 TrojanSpy.QQLogger.ct Win32.Troj.QQLogger.kcloud PWS:Win32/QQThief.I Spyware/Win32.QQLogger Virus.Win32.Part.a TrojanSpy.QQLogger Trojan.PSW.Win32.QQThief.j Trojan-Spy.Win32.QQLogger W32/QQLogger.CDX!tr


A backdoor also known as: Dropped:Backdoor.BlueFire.0.5.0 Backdoor/W32.BlueFire.593408 Backdoor.Bluefire Backdoor/BlueFire.036 BKDR_BLUEFIRE.A W32/Risk.VCME-1818 Construction.Kit BKDR_BLUEFIRE.A Win.Trojan.Bluefire-5 Backdoor.Win32.BlueFire.036 Dropped:Backdoor.BlueFire.0.5.0 Trojan.Win32.BlueFire.gaiw Backdoor.W32.BlueFire.036!c Dropped:Backdoor.BlueFire.0.5.0 Backdoor.Win32.BlueFire.036 Dropped:Backdoor.BlueFire.0.5.0 BackDoor.BlueFire.36 Backdoor.BlueFire.Win32.12 Backdoor/BlueFire.036 W32.Trojan.Backdoor-BlueFire BDS/BlueFire.50.DLL Trojan[Backdoor]/Win32.BlueFire Backdoor.BlueFire.0.5.0 Backdoor.Win32.BlueFire.036 Backdoor:Win32/BlueFire.0_36 Trojan/Win32.BlueFire.R61616 Dropped:Backdoor.BlueFire.0.5.0 Backdoor.BlueFire Win32/BlueFire.036 Win32.Backdoor.Bluefire.Tayj Backdoor.BlueFire!vtgAlnbXp+8 Backdoor.Win32.Way W32/Bdoor.UZ!tr.bdr


The dark ways of the Triada Once downloaded and installed , the Triada Trojan first tries to collect some information about the system — like the device model , the OS version , the amount of the SD card space , the list of the installed applications and other things .


] website mobilestoreupdate [ .


However, the attack is different in two respects: unlike other APTs, the main focus of Blue Termite is to attack Japanese organizations; and most of their C2s are located in Japan.


But there 's little stopping it from doing much worse .


A backdoor also known as: Trojan.Crypt.ED Dropper.Binder.Win32.1016 Trojan/Dropper.Binder.qd Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/DropperX.VWP Trojan.Crypt.ED Backdoor.Win32.Rbot.abwp Trojan.Crypt.ED Trojan.Crypt.ED BackDoor.Shell BehavesLike.Win32.Backdoor.bh W32/Risk.ZNPN-3988 TrojanDropper.Binder.ht Trojan.Crypt.ED Backdoor.Win32.Rbot.abwp Backdoor:Win32/Blackhole.U Backdoor/Win32.Hupigon.R7788 Trojan.Crypt.ED Backdoor.Shell


Roaming Mantis is believed to be a Chinese threat actor group first discovered in April 2018 that has continuously evolved .


A subsequent investigation revealed that the spyware has the following capabilities : Records every phone call ( literally the conversation as a media file ) , then sends it together with the caller id to the C & C ( incall3.php and outcall3.php ) Logs every incoming SMS message ( SMS body and SMS sender ) to C & C ( script3.php ) Has capability to hide self Can send all call logs ( “ content : //call_log/calls ” , info : callname , callnum , calldate , calltype , callduration ) to C & C ( calllog.php ) Whenever the user snaps a picture , either with the front or rear camera , it gets sent to the C & C ( uppc.php , fi npic.php orreqpic.php ) Can send GPS coordinates to C & C ( gps3.php ) The C & C server to which the application seems to be sending collected data appears to be operational , as of this writing , and running since May 2018 .


A backdoor also known as: Trojan.Trojan.Crypt.52 TSPY_EMOTET.SMD3 Win32.Trojan.WisdomEyes.16070401.9500.9999 TSPY_EMOTET.SMD3 Trojan.Win32.Diple.euwotz TrojWare.Win32.Crypt.AX BehavesLike.Win32.Ramnit.dc W32.Trojan.Emotet Trojan:Win32/Diple.B!bit Trojan/Win32.Magniber.R212688 Trojan.Win32.VB Win32/Trojan.d4d


ALLMSG – send C & C all SMSs received and sent by user , as stored in phone memory .


Windows and winzip do not natively extract them which delivers some malware.


A backdoor also known as: Trojan-Dropper.Win32.Halk!O Backdoor.CIA BKDR_NERTE.780 Backdoor.Win32.NerTe.780 Backdoor.Win32.Nerte_780.Inst[h] Backdoor.Win32.NerTe.780 Trojan.MulDrop.1253 BKDR_NERTE.780 W32/Risk.YHOK-6554 BDS/Nerte78.Inst Win32.Hack.NerteZip.kcloud Backdoor:Win32/Nerte.7_80.dr Bck/Iroffer.BG Win32/NerTe.78.Client W32/NerTe.V780!tr.bdr BackDoor.Nerte Backdoor.Win32.NerTe.ajn


These campaigns have lead to a rapid rise in the rate of Bedep infections, with Arbour Networks observing just above 80K infections over a 3-day period.


A backdoor also known as: Win32.TrojanSpy.Banker.ahy.f W32/Packed_Upack.H Trojan-Banker.Win32.Banker.etk Packed.Win32.UPack Trojan.PWS.Banker.based Trojan-Banker.Win32.Banbra!IK Trojan-Banker.Win32.Banbra PSW.Banker Trj/Banker.ITS


A backdoor also known as: W32.HostsMsasc.Trojan Trojan.Win32.Inject!O Trojan.Zusy.D7CC Win32.Trojan.WisdomEyes.16070401.9500.9998 TROJ_PAM_000002012C.T3 Win.Trojan.Inject-7728 Trojan.Win32.Inject.dcduro Trojan.Win32.A.Llac.419328 Trojan.MulDrop3.3872 Trojan.Injector.Win32.50089 Trojan-Spy.MSIL TrojanDropper.Injector.kgt TR/Jorik.AC Trojan/Win32.Shakblades TrojanSpy:MSIL/VB.M Trojan/Win32.Jorik.C97808 Worm.Shakblades Worm.Ainslot!/rTzgf3sAsw


A ptrace_attach syscall is called .


On July 16, 2015, the Palo Alto Networks Unit 42 threat intelligence team discovered a watering hole attack on the website of a well-known aerospace firm.


MalumPoS was designed to be configurable.


A backdoor also known as: Virtool.8944 Server-Proxy.Win32.CCProxy!O W32/HackTool.CYA not-a-virus:Server-Proxy.Win32.CCProxy.63 Virtool.8944 Riskware.Win32.CCProxy.ybka Virtool.8944 Win32.ServerProxy.CCProxy.~BAAB Program.CCProxy W32/Tool.YSPN-2643 AdWare/CCProxy.b GrayWare[Server-Proxy]/Win32.CCProxy HackTool:Win32/CCProxy.B Virtool.D22F0 not-a-virus:Server-Proxy.Win32.CCProxy.63 Virtool.8944 Win-AppCare/Ccproxy.987136 Virtool.8944 not-a-virus:Server-Proxy.Win32.CCProxy


The source and destination addresses are both blank without an actual email address.


EventBot has the ability to update its library or potentially even download a second library when given a command from the C2 .


This file contains all HTML , CSS and PNG files necessary to create overlays .


Unit 42 also tracks the APT3 group using the name UPS, which is an intrusion set with Chinese origins that is known for having early access to zero-day vulnerabilities and delivering a backdoor called Pirpi.


Most security vendors fail to identify the malicious code 7/55 on virustotal


VBS malware, likely deployed as part of a red team


The big first buffer is used as index for multiple concurrent threads .


A backdoor also known as: W32.OnGamesMSIMOB.Trojan Worm.Win32.FakeFolder!O Trojan.Fakefolder.C4 Worm.FakeFolder.Win32.23 W32/FakeFolder.ADPV-1915 W32.SillyFDC Win32/SillyAutorun.FIA TSPY_FAKEALERT_BH010146.TOMC Win.Trojan.Fakefolder-76 Worm.Win32.FakeFolder.a Worm.Win32.A.FakeFolder.26624[UPX] TSPY_FAKEALERT_BH010146.TOMC BehavesLike.Win32.PWSBanker.tc Trojan.Win32.Fakefolder W32/FakeFolder.A Worm/FakeFolder.b Worm/Win32.FakeFolder Trojan:Win32/Fakefolder.C Worm.Win32.FakeFolder.a Trojan/Win32.FakeFolder.R143433 Worm.FakeFolder Win32.Worm.Fakefolder.Wmim Worm.FakeFolder!qDF5E1Kz9pU


Similar to previous attacks, the Disttrack malware used by Shamoon is just the destructive payload.


A backdoor also known as: TjnClicker.Qaccel.S1448 Trojan.Small.Win32.31852 Trojan/Clicker.Small.ndn Trojan.Win32.Click3.erajhs TrojWare.Win32.TrojanClicker.Small.DS Trojan.Click3.21941 TR/Dropper.tstkm GrayWare[AdWare]/Win32.TrojanClicker.Small.ndn Trojan/Win32.Dynamer.R187373 Backdoor.Bot Trojan.Win32.TrojanClicker


First , there is a small dropper , then a large second stage payload that contains multiple binaries ( where most of the surveillance functionality is implemented ) , and finally a third stage which typically uses the DirtyCOW exploit ( CVE-2016-5195 ) to obtain root .


For example : Conclusions The Skygofree Android implant is one of the most powerful spyware tools that we have ever seen for this platform .


Figure 4 shows the download prompt for this fake app ; an English translation follows .


So we recommend installing an anti-virus solution on your Android device .


A macOS malware agent, named MacDownloader, was observed in the wild as targeting the defense industrial base, and reported elsewhere to have been used against an human rights advocate.


However , successfully installing this malicious APK requires that the user has allowed the installation of such apps as controlled in the Unknown Sources settings .


A backdoor also known as: W32.Clod740.Trojan.4797 Backdoor.Bittaru!1goVteZqWDk TROJ_SPNR.15KL11 MalCrypt.Indus! BDS/Bittaru.A.4 TROJ_SPNR.15KL11 Win32.Troj.Undef.kcloud Backdoor:Win32/Bittaru.A W32/Trojan.PAFV-2148 W32/BackDoor.DPM!tr


A backdoor also known as: Trojan.MSIL.Disfa


A backdoor also known as: MemScan:Trojan.Glitch.A Trojan-Dropper.Win32.Juntador!O MemScan:Trojan.Glitch.A Trojan/Dropper.Juntador.c Trojan.Glitch.A W32/Dropper.ATCT Backdoor.IRC.Zcrew TROJ_JUNTADOR.C Win.Dropper.Juntador-12 MemScan:Trojan.Glitch.A Trojan-Dropper.Win32.Delf.hq MemScan:Trojan.Glitch.A Trojan.Win32.Juntador.diov MemScan:Trojan.Glitch.A TrojWare.Win32.TrojanDropper.Juntador.c0 MemScan:Trojan.Glitch.A BackDoor.DMoon Dropper.Juntador.Win32.230 TROJ_JUNTADOR.C BehavesLike.Win32.Dropper.hc W32/Risk.HJDZ-9373 TrojanDropper.Win32.Juntador.c TrojanDropper:Win32/Juntador.C Trojan-Dropper.Win32.Delf.hq Trojan/Win32.LdPinch.C10075 Win32/TrojanDropper.Juntador.C Win32.Trojan-dropper.Delf.Eegz Trojan-Dropper.Win32.Juntador.C Win32/Trojan.bf1


Many other banking malware families followed suit and released their own Android malware components designed to steal those OTPs and TANs .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Script.Application.CdEject.A Script.Application.Cdeject!c BehavesLike.Win32.PUPXBC.dc Joke:VBS/CDEject.D PUP.Linkury/Variant Trojan.Ejectcd.A VBS/CDEject.I Backdoor.MSIL.Bladabindi VBS/CDEject.I!tr


Symantec has identified a previously unknown group called Sowbug that has been conducting highly targeted cyber attacks against organizations in South America and Southeast Asia and appears to be heavily focused on foreign policy institutions and diplomatic targets.


This disabled the attacker's access to their victims in this campaign, provided further insight into the targets currently victimized in this operation, and enabled the notification of affected parties.


Figure 2 : “ Agent Smith ’ s jpg file structure After the extraction , the “ loader ” module adds the code to the application while using the legitimate mechanism by Android to handle large DEX files .


All the observed landing pages mimic the mobile operators ’ web pages through their domain name and web page content as well .


The app that resulted in the largest number of affected users was the click fraud version , which was installed over 170,000 times at its peak in February 2018 .


Finally, Doctor Web's security researchers investigated the Linux.Mirai Trojan found later that month.


A backdoor also known as: Virus.Win32.Sality!O Backdoor.Poison.Win32.26527 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.VBKrypt.hjcg Trojan.Win32.VB.dodqqz Troj.W32.VBKrypt.hjcg!c Trojan.MulDrop2.20812 Backdoor/Poison.eqy Trojan/Win32.VBKrypt TrojanDownloader:Win32/Tyqui.B Trojan.Win32.VBKrypt.hjcg Trj/CI.A Win32/TrojanDownloader.VB.ODM Trojan.VBKrypt!ngQI4PCHe4I Backdoor.Poison W32/Dx.TQG!tr


As of this writing , all the domains were registered recently and some are already offline .


A backdoor also known as: PERL/Shellbot.B Backdoor.Perl.Shellbot.B Perl/Shellbot.PR Perl.Backdoor.Shellbot.f Unix/ShellBot.AH IRC.Backdoor.Trojan Perl/Shellbot.NAI PERL_SHELBOT.SMO Win.Trojan.Perlbot-1 Backdoor.Perl.IRCBot.ij Backdoor.Perl.Shellbot.B Backdoor.Perl.Ircbot!c Perl.Backdoor.Ircbot.Akpo Backdoor.Perl.Shellbot.B Backdoor.Perl.Shellbot.B Perl.Ircbot.93 PERL_SHELBOT.SMO Unix/ShellBot.AH PERL/Shellbot.aa Perl/IRCBot.I!tr Backdoor.Perl.Shellbot.B Backdoor.Perl.IRCBot.ij Backdoor:Perl/Shellbot.Z Backdoor.Perl.Shellbot.B Perl.Shellbot.I Trojan.Perl.Shellbot Backdoor.Perl.Shellbot.B Win32/Trojan.BO.811


Then , the APK is installed as system application and registers listener on USER_PRESENT event .


A backdoor also known as: Backdoor.MSIL Win32.Trojan.WisdomEyes.16070401.9500.9928 W32/Trojan.GELV-4208 Backdoor.MSIL.Bladabindi.akrb Trojan.Win32.Bladabindi.extavb Backdoor.Msil.Bladabindi!c Msil.Backdoor.Bladabindi.Wmjd BackDoor.Bladabindi.13678 Backdoor.Bladabindi.Win32.8723 Trojan.MSIL.Injector Trojan:Win32/Vb.At TR/Crypt.fkm.udrkf Trojan[Backdoor]/MSIL.Bladabindi Trojan.MSIL.Bladabindi.1 Trojan.Win32.Z.Bladabindi.192000.A Backdoor.MSIL.Bladabindi.akrb Trojan:MSIL/Inmalsal.A MSIL/Kryptik.GJY!tr Trj/GdSda.A Win32/Trojan.BO.610


A backdoor also known as: Constructor.Win32.Houndhack!O Backdoor.Venik.MUE.J2 Trojan/Farfli.bwm BKDR_VENIK_EL150010.UVPM Constructor.Win32.Houndhack.a Riskware.Win32.Houndhack.erbccv Trojan.DownLoader17.62076 BKDR_VENIK_EL150010.UVPM BehavesLike.Win32.Backdoor.dc HackTool[Constructor]/Win32.Houndhack Trojan.Zusy.D35C86 Constructor.Win32.Houndhack.a Backdoor:Win32/Venik.J Backdoor/Win32.Venik.R169912 Constructor.Houndhack Constructor.Houndhack! Trojan.Constructor


A backdoor also known as: Application.BitCoinMiner.ZM Trojan.BitMiner Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.BitCoinMiner.agl Riskware.Win64.BitMiner.ewyekq BehavesLike.Win32.AdwareLinkury.vc PUA/CoinMiner.B Trojan/Win32.BitCoinMiner Trojan.Win32.BitCoinMiner.agl Trojan.Win32.BitcoinMiner


A backdoor also known as: Trojan.Win32.Small!O Trojan.Maptsc Trojan.Small.Win32.19366 Trojan.Heur.RP.EAC7EB TROJ_SMALL.NHQ Trojan.Win32.Small.cpb Trojan.Win32.Small.ebpbhy Troj.W32.Small.cpb!c Trojan.Click2.55177 TROJ_SMALL.NHQ Trojan.Win32.Small W32/Trojan.ZWIN-6050 Trojan/Small.ovd TR/Spy.6656.172 Trojan/Win32.Small Trojan:Win32/Maptsc.A Trojan.Win32.Small.cpb Trojan/Win32.Connapts.C256364 Trojan.Small.cpb Trojan.Small Win32.Trojan.Small.Edod Trojan.Click!cGVrs+boA6s Win32/Trojan.4c4


We found 280 such apps in the past three months .


The evidence above suggests that EventBot is still in the development stage , and as such , is not likely to have been used for large attack campaigns thus far .


At the time of writing , the content served at the given URL on uyghurapps [ .


READ_CONTACTS - Allows the application to read the user 's contacts data .


More information from PWC about Sofacy Bedep malware using DGA CozyDuke aka CozyBear, CozyCar or Office Monkeys is a threat actor that became increasingly active in the 2nd half of 2014 and hit a variety of targets.


Though different versions of the app vary in structure , malicious code was initialized at application launch without the user ’ s knowledge , and a number of timers were setup to gather and upload data periodically .


Moreover , eSurv was a business unit of Connexxa and was leased to eSurv S.R.L in 2014 .


It ’ s not a definite correlation , but Bouncing Golf also seems to have a connection with Domestic Kitten due to similarities we found in their code .


In the email screenshot with our added machine translation from Russian, notice the subject line and message body text reflecting a business customer upset about extra charges on his credit card social engineering theme.


A backdoor also known as: W32.GarusenV.Trojan Worm/W32.Vobfus.225280 Worm.Win32.Vobfus!O W32/Vobfus.io Trojan.Barys.950 WORM_VOBFUS.SM02 Win32.Trojan.VBObfus.f WORM_VOBFUS.SM02 Win.Trojan.Vobfus-28 Worm.Win32.Vobfus.biec Trojan.Win32.WBNA.cihuhh Worm.Win32.A.Vobfus.225280 TrojWare.Win32.Pronny.EE Trojan.VbCrypt.60 BehavesLike.Win32.VBObfus.dm Worm.Win32.Vobfus Worm/WBNA.dfdh WORM/Vobfus.dbmnua Worm.Win32.Vobfus.biec Trojan/Win32.Vobfus.R36953 BScope.Trojan.Diple Win32/Pronny.EJ W32/Vobfus.GEW.worm


However , in 2013 , autonomous mobile banking Trojans developed further .


For instance , in the case of the “ Execute ” opcode ( 0x17 ) , the 32-bit code to run is stored entirely into the variable section with the value at offset 5 specifying the number of bytes to be copied and executed .


These have been the attacks on Saudi Arabian companies where a destructive malware known as Disttrack was deployed.


In addition, we found that the infrastructure used in this case overlaps with FindPOS/PoSeidon as well as Chanitor and sits amidst a cluster of largely indiscriminate malicious activity.


A backdoor also known as: Trojan/W32.Chifrax.150357 Trojan.Chifrax.rw5 Trojan/Chifrax.a BKDR_POISON.VA W32/Poison.AX Backdoor.Odivy Win32/Poison.AAE BKDR_POISON.VA Win.Trojan.Poison-11 Trojan.Win32.Chifrax.a Trojan.Win32.Chifrax.fwpet Trojan.DownLoader9.38925 Trojan.Chifrax.Win32.1349 BehavesLike.Win32.Dropper.cc W32/Poison.HQGF-3018 Trojan/Chifrax.epp TR/Drop.PoisonIvy.C.1 W32/Chifrax.A!tr Trojan/Win32.Chifrax Troj.W32.Chifrax.a!c TrojanDropper:Win32/Poisonivy.C Win-Trojan/Poisonivy.150357 Trojan.Chifrax Win32/Poison.NGS Win32.Trojan.Chifrax.Wskn Trojan.Chifrax!Xo07JnrMN1M Trojan.Win32.Chifrax Trj/Chifrax.C Win32/Trojan.954


A backdoor also known as: AIT:Trojan.Autoit.CLU Win32.Trojan-Dropper.Autoit.l W32/Trojan.TWFF-1697 AIT:Trojan.Autoit.CLU Trojan.Win32.Beast.exaenx AIT:Trojan.Autoit.CLU BackDoor.Beast BehavesLike.Win32.PUPXAI.dh AIT:Trojan.Autoit.CLU Trojan.Autoit.F AIT:Trojan.Autoit.CLU AIT:Trojan.Autoit.CLU Trj/CI.A Win32/Trojan.0fc


Chikdos is a malware that targeted MySQL servers to make them conduct distributed denial-of-service DDoS attacks against other websites.


Exfiltrated device information and additional sensitive data sent to the C2 server .


In addition , it monitors to verify if com.android.music.helper package is removed .


A backdoor also known as: Backdoor.Tartober BKDR_TARTOBER.A Win32.Trojan.WisdomEyes.16070401.9500.9999 BScope.Trojan-Spy.Zbot BKDR_TARTOBER.A Trojan.Win32.Wisp.zraky BackDoor.Wisp.11 BehavesLike.Win32.Trojan.dc W32/Trojan.TTYH-5266 Trojan.Zusy.Elzob.D39B5 Backdoor:Win32/Tartober.A Trj/CI.A Win32/Trojan.e6d


This could indicate that actor already has plans in expanding the targets to applications from different countries and regions .


A backdoor also known as: Ransom/W32.WannaCry.5267459.F Ransom.Zenshirsh.SL8 Ransom.WannaCrypt Trojan/Exploit.CVE-2017-0147.a Win32.Worm.Rbot.a Ransom.Wannacry Ransom_WCRY.SMJ Win.Ransomware.WannaCry-6313787-0 Win32.Exploit.CVE-2017-0147.A Trojan-Ransom.Win32.Wanna.m Trojan.Win32.Wanna.epxkni Trojan.Win32.WannaCry.5267459 Troj.Ransom.W32.Wanna.toP0 Trojan.Encoder.11432 Trojan.Wanna.Win32.98 Ransom_WCRY.SMJ BehavesLike.Win32.RansomWannaCry.tt Trojan.Wanna.k TR/WannaCrypt.ahdyg Trojan[Ransom]/Win32.Wanna Trojan:Win32/Eqtonex.F!dha Trojan-Ransom.Win32.Wanna.m Trojan/Win32.WannaCryptor.R200894 Hoax.Wanna Trj/GdSda.A Win32/Exploit.CVE-2017-0147.A Exploit.CVE-2017-0147! Trojan.Win32.Exploit W32/Wanna.M!tr


A backdoor also known as: Win32.TrojanPigax Trojan-Downloader.Win32.Small.akrf Trojan-Downloader.Win32.Small.akrf TR/Dldr.Small.akrf Trojan.Dldr.Small.akrf Trojan-Downloader.Win32.Small.akrf Trojan-Downloader.Win32.Small W32/Small.AKRF!tr.dldr Trj/CI.A


Locate your device : Practice finding your device with Android Device Manager because you are far more likely to lose your device than install a PHA .


REDBALDKNIGHT, also known as BRONZE BUTLER and Tick, is a cyberespionage group known to target Japanese organizations such as government agencies including defense as well as those in biotechnology, electronics manufacturing, and industrial chemistry.


A backdoor also known as: Trojan.NaviPromo.3 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Lipler.B!packed TROJ_SKINTRI.SMC Trojan.Win32.Hrup.aah Troj.Downloader.W32.Lipler.lcwl TROJ_SKINTRI.SMC Trojan/Win32.Hrup Trojan:Win32/Skintrim.C Trojan.Win32.Hrup.aah Win32.Trojan.Hrup.Ajvd Trojan.Win32.Skintrim W32/Skintrim.CG!tr Win32/Trojan.IM.c6f


Ursnif campaigns against EU and mainly Italy spreaded by a JScript


A backdoor also known as: W32/Autorun.Worm.aaeh Win32.Trojan.WisdomEyes.16070401.9500.9867 TSPY_TEPFER.GB Trojan.Win32.VBTrojan.bvufrt TrojWare.Win32.VB.HR Trojan.DownLoader10.21377 TSPY_TEPFER.GB BehavesLike.Win32.Swisyn.cc Trojan:Win32/Beelog.C Trojan.Win32.Jorik.28672.A Trojan/Win32.Jorik.R44838 Trj/CI.A Win32/Trojan.Downloader.f2c


If a device isn ’ t rooted , it downloads from the server an exploit pack and executes it to obtain root on device .


To bypass Google Play Store security checks , the malware creators used a very interesting method : they uploaded a clean app to the store at the end of March , 2017 , and would then update it with a malicious version for short period of time .


A backdoor also known as: W32.Yaha.S W32/Yaha.aa@MM Trojan.Heur.ED1374C Win32.Trojan.WisdomEyes.16070401.9500.9777 W32.Yaha.AE@mm Win32/Yaha.Y Win.Worm.Yaha-8 Email-Worm.Win32.Lentin.s Trojan.Win32.Lentin.emzf I-Worm.Win32.Yaha.60304 Win32.Worm-email.Lentin.Wvki TrojWare.Win32.Patched.KSU Win32.HLLM.Yaha.7 W32/Yaha.aa@MM WORM/Lentin.S Worm[Email]/Win32.Lentin Worm:Win32/Yaha.AA@mm Backdoor.W32.Bifrose.l4Wh Email-Worm.Win32.Lentin.s Trojan.Win32.Rbot


A backdoor also known as: Heur.Win32.Veebee.1!O Trojan.VB.rw3 Trojan.Happili Trojan.Inject!SEi/RTfcvEo W32/Backdoor2.HUHI TROJ_SPNR.0BD714 Trojan.Win32.Inject.kxez Trojan.Win32.Inject.cwbjpa Trojan.Boaxxe.2 Trojan.Inject.Win32.72022 TR/Dropper.VB.6820 TROJ_SPNR.0BD714 Trojan/Win32.Inject Win32.Troj.Inject.kx.kcloud W32/Backdoor.PZSO-6760 TScope.Trojan.VB Trj/WLT.A Win32/Boaxxe.BL Win32.Trojan.Inject.Sxek Virus.Win32.VBInject W32/Zbot.RZIM!tr


A backdoor also known as: Trojan-PWS/W32.Hukle.157044 Trojan.Hukle.Win32.18 Trojan/PSW.Hukle.o Trojan.PWS.Hukle!uPlO8aKf2dU W32/Trojan2.GWXZ Infostealer.Hukle TROJ_HUKLE.O Win.Trojan.Hukle-16 Trojan-PSW.Win32.Hukle.o Trojan.Win32.Hukle.dhvf Troj.PSW32.W.Hukle.o!c TrojWare.Win32.PSW.Hukle.~R Trojan.PWS.Hukle.145 TROJ_HUKLE.O BehavesLike.Win32.PWSZbot.ch W32/Trojan.TBYH-4941 Trojan/Hiddukel.t W32/Hukle.O!tr.pws Trojan[PSW]/Win32.Hukle Trojan.Zusy.Elzob.D3190 Win-Trojan/Hukle.151040 PWS:Win32/Hukle.O Trojan-PWS.Win32.Hukle Trojan.Win32.InfoStealer.o


The vulnerability comes from the interaction of the mechanism that enforces JavaScript context separation the same origin policy and Firefox's PDF Viewer.


ACCESS_NETWORK_STATE - allow the app to access information about networks .


] somtum [ .


The email message and the lure document are written in Hebrew, Arabic or English – depending on the target audience.


The adversary's campaign has active and operational Command and Control C2 servers.


As the research progressed , it started to reveal unique characteristics which made us believe we were looking at an all-new malware campaign found in the wild .


] today www [ .


A one-man cybercriminal operation that uses point-of-salePoS malware has stolen more than 22,000 unique credit card numbers from terminals in Brazil,Canada, and the United States in a span of just one month.


A backdoor also known as: W32/OnlineGames.LWBP Worm.Autorun-4618 Worm.Win32.Dropper.RA Trojan:W32/DelfInject.R Trojan.PWS.Wsgame.22668 Win32/Oflwr.A!crypt Heur:Trojan/PSW.OnlineGames BScope.HackTool.Sniffer.WpePro Trj/CI.A


A backdoor also known as: W32.FakelsasLTD1.Trojan Trojan.Win32.Small!O Trojan.Upatre.S1164383 Trojan/Downloader.Small.aab Win32.Trojan.Inject.bm W32/Trojan.TBSZ-0334 Win32/Upatre.Q TROJ_BANLOAD.KAV Win.Trojan.Rubinurd-67 Trojan.Win32.Small.cpl Trojan.Win32.Small.ciwsuw TrojWare.Win32.Injector.AH Trojan.DownLoad3.28161 Trojan.Bublik.Win32.12106 TROJ_BANLOAD.KAV BehavesLike.Win32.PWSZbot.dh Backdoor.Win32.Androm W32/Trojan3.GBH Trojan/Small.oxi Trojan/Win32.Bublik Trojan.Win32.Small.cpl Trojan:Win32/Dorv.D!rfn Worm/Win32.Palevo.C199836 Trojan.Small Trojan.Email.FA Trojan.Small.AAB Win32/TrojanDownloader.Small.AAB Trojan.Bublik!BrbaRvXyIc8 W32/Bublik.AAB!tr


Custom Encryption Other variants have used custom-implemented encryption algorithms .


A backdoor also known as: Trojan.Backdoor.80


A backdoor also known as: Ransom.Exxroute.A3 Trojan.Ransom.Lukitos.1 Ransom_CERBER.SM37 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32.Ramnit!dr Ransom_CERBER.SM37 Trojan.PWS.Sphinx.2 BehavesLike.Win32.Ransomware.cc Trojan:Win32/CeeInject.MJ!bit Trojan/Win32.Fareit.R189070 Trj/GdSda.A


Currently , the Twitoor trojan has been downloading several versions of mobile banking malware .


A backdoor also known as: W32.WisdwslD.Trojan TrojanDownloader.Esaprof.A4 Trojan.Strictor.D542D Trojan.Esaprof Win32/SillyDL.YTP TROJ_ESAPROF_EK2501B4.UVPM SWF.Plicker.1 TROJ_ESAPROF_EK2501B4.UVPM BehavesLike.Win32.Dropper.wc TrojanDownloader:SWF/Esaprof.B Trojan.Win32.Downloader.3514368[UPX] Trojan.Downloader Trj/CI.A SWF/TrojanDownloader.Esaprof.A Trojan.Patched


The Windows kernel vulnerability ( CVE-2015-2387 ) existed in the open type font manager module ( ATMFD.dll ) and can be exploited to bypass the sandbox mitigation mechanism .


A spear-phishing email was sent to a diplomat of the Embassy of Uzbekistan who is likely based in Beijing, China.


In aggregate , the type of information stolen could let an attacker know where a person is , with whom they are associated ( including contacts ’ profile photos ) , the messages they are sending , the websites they visit and search history , screenshots that reveal data from other apps on the device , the conversations they have in the presence of the device , and a myriad of images including anything at which device ’ s camera is pointed .


A backdoor also known as: W32.SocksT.Trojan Worm.Win32.Socks!O Trojan.Zbot.EO4 Worm.Socks.Win32.38 W32.W.Socks.tnAV W32/Socks.ey TROJ_SPNR.14DL13 Win32.Trojan.Kryptik.el Win32/Tnega.McRJca TROJ_SPNR.14DL13 Win.Trojan.Ag-4254306-1 Worm.Win32.Socks.ey Trojan.Win32.Socks.wtnjo Worm.Win32.Socks.791340 BackDoor.FireOn.221 BehavesLike.Win32.VirRansom.tc Trojan-Spy.Zbot.BE Trojan/PSW.Almat.dwk W32.Infostealer.Zeus Worm/Win32.Socks Worm.Socks.ey.kcloud Worm.Socks Worm.Win32.Socks.ey Worm/Win32.Socks.C35688 Virus.Socks.ey Worm.Socks!MDTxLrvAMvg


Turla, which has been targeting governments, government officials and diplomats for years – see, as an example, this recent paper – is still using watering hole techniques to redirect potentially interesting victims to their C C infrastructure.


A backdoor also known as: W32.DostoxaLTB.Trojan Trojan.Mogoogwi.A3 WORM_MOGOOGWI.SMHA Win32.Trojan.WisdomEyes.16070401.9500.9996 WORM_MOGOOGWI.SMHA Trojan-Dropper.MSIL Trojan:MSIL/Mogoogwi.A Trojan.Barys.DC996 Trojan/Win32.Zusy.R154407 Trj/CI.A Win32/Trojan.65a


READ_EXTERNAL_STORAGE - Allows the application to read from external storage .


However , this wo n't close the application , it will send it to the background , instead .


A backdoor also known as: Trojan.Dynamer.A8 Trojan.Ransom.Globe Win32.Trojan.WisdomEyes.16070401.9500.9595 Ransom.Purge Ransom_PURGE.SM1 Win32.Trojan-Ransom.Globe.A Trojan-Ransom.Win32.Purga.v Win32.Trojan.Purga.Hvjx Trojan.Encoder.6182 BehavesLike.Win32.Sytro.kc W32/Trojan.DXHE-6024 Trojan.CryFile.co Trojan[Ransom]/Win32.CryFile Troj.Ransom.W32!c Trojan-Ransom.Win32.Purga.v Ransom:Win32/Contentocrypt.A Trojan/Win32.CryFile.R186838 TrojanDropper.Dapato Ransom.Globe Trojan.Filecoder!iQ4fX8DOQ4o Trj/GdSda.A Win32/Trojan.Ransom.524


Taiwan has long been subjected to persistent targeting from espionage motivated threat actors.


This attack chain exposed millions of potential victims in the US, Canada, the UK, and Australia, leveraging slight variations on a fake browser update scheme that worked on all three major Windows web browsers.


Our investigation into these attacks has unearthed more details into the method by which the threat actors delivered the Disttrack payload.


We re constantly following, detecting and monitoring the lifecycle of these RATs as they appear, disappear and often reappear under a new moniker.


Shipping companies and medical laboratories in Asia are being targeted in a likely intelligence-gathering campaign that relies exclusively on publicly available and living-off-the-land tools.


A backdoor also known as: Trojan-Spy/W32.Small.8704.J Trojan-Spy.Win32.Small!O TrojanDownloader.Dielel Troj.Spy.W32.Small.jzk!c TROJ_GOGLOAD.A Win32.Trojan.WisdomEyes.16070401.9500.9995 W32/Trojan.IOOK-0066 TROJ_GOGLOAD.A Trojan-Spy.Win32.Small.jzk DLOADER.Trojan Trojan.Win32.Spy DangerousObject.Multi.bcf W32/Small.JZK!tr Trojan[Spy]/Win32.Small Win32.Troj.small.j.kcloud Trojan.Heur.LP.EEE6A9 Trojan-Spy.Win32.Small.jzk TrojanDownloader:Win32/Dielel.A TrojanSpy.Small Win32.Trojan-spy.Small.Iit


Over time , this campaign will also infect the same device , repeatedly , with the latest malicious patches .


This technique reminds us of a combination between ages old war strategies “ Divide et impera ” and “ By way of deception ” .


A backdoor targetting Linux also known as: Trojan.Linux.MiraiDDoS.BI Downloader.Mirai.Linux.8 Troj.Downloader.Linux!c ELF_MIRAI.A HEUR:Trojan-Downloader.Linux.Mirai.b Trojan.Linux.MiraiDDoS.BI Trojan.Mlw.ektbyu Trojan.Linux.MiraiDDoS.BI Trojan.Linux.MiraiDDoS.BI Linux.DownLoader.289 ELF_MIRAI.A LINUX/Dldr.Mirai.qqlgv Trojan[Downloader]/Linux.Gafgyt.b Trojan.Linux.MiraiDDoS.BI Linux.S.Mirai.1204 HEUR:Trojan-Downloader.Linux.Mirai.b TrojanDownloader:Linux/Mirai.A Backdoor.Linux.Mirai Linux.Trojan-downloader.Gafgyt.Amlt Trojan-Downloader.Linux.Mirai Trojan.Linux.MiraiDDoS.BI


May 2018 to April 2019 : This is the actual mature stage of “ Agent Smith ” campaign .


This payload will then attempt to instantiate a remote reverse /system/bin/sh shell to the Command & Control ws.my-local-weather [ .


FrozenCell is the mobile component of a multi-platform attack we 've seen a threat actor known as " Two-tailed Scorpion/APT-C-23 , '' use to spy on victims through compromised mobile devices and desktops .


Kryptowire says the code , which it found on a BLU R1 HD devices , transmitted fine-grained location information and allowed for the remote installation of other apps .


Cybereason 's investigation shows that the threat actor behind the FakeSpy campaign is a Chinese-speaking group dubbed " Roaming Mantis '' , a group that has led similar campaigns .


Version # 2 : June - Aug. 2019 — Domain : somtum [ .


Others like transferbot , promptupdate and promptuninstall are meant to help the operator manage the malware .


A backdoor also known as: Win32.Worm.Verauto.A Win32.Worm.Verauto.A Trojan/VB.oda Win32.Worm.Verauto.A W32/VB.OO Virus.Win32.VB.b Win32.Worm.Verauto.A Virus.Win32.VB.gixe W32.VB.b!c Win32.Virus.Vb.Swum Win32.Worm.Verauto.A Virus.Win32.VB.b Win32.Worm.Verauto.A Win32.HLLW.Verauto Virus.VB.Win32.76 worm.win32.vobfus.cf W32/VB.YYAQ-1388 WORM/Verauto.A Virus/Win32.VB Worm:Win32/SillyVB.B Win32.Worm.Verauto.A Trojan.VB Win32/VB.ODA .Virus.EICAR_BOOV Worm.Win32.VB W32/VB.B!tr Win32/VB.BM


The iOS versions were available outside the app store , through phishing sites , and abused the Apple Developer Enterprise program .


A backdoor also known as: TrojanSpy.MSIL Win32.Trojan.WisdomEyes.16070401.9500.9866 Trojan.Win32.Downeks.exeslg Troj.Spy.Msil.Downeks!c Trojan.MSILPerseus.D21B6F TrojanSpy:MSIL/Tinclex.A Riskware.Confuser! Trj/GdSda.A Win32/Trojan.Spy.7a8


By comparing the sizes of the encrypted asset file tong.luo vs the decrypted JAR file mycode.jar , it is interesting to note that it is the same file ( almost the same size ) .


The malware, which has been identified by many vendors on VirusTotal, has been labeled by our researchers as Trojan.Chinad or just Chinad as an alternative short label.


The group behind the attacks is possibly associated with the Russian government and has been active since at least 2007.


A backdoor also known as: W32.HfsAutoB.BCDE Backdoor.Baceed Backdoor.Hupigon.Win32.11548 Backdoor.W32.Hupigon.torp W32/Backdoor2.EVBN Backdoor.Trojan Win.Trojan.Hupigon-27433 Backdoor.Win32.Hupigon.gklq Trojan.Win32.Hupigon.wnxa Backdoor.Win32.Hupigon.163840.I Backdoor.Win32.Hupigon.gklqo BackDoor.Pigeon1.8593 W32/Backdoor.ECNM-9194 Backdoor/Hupigon.jmk W32.Backdoor.Hupigon BDS/Baceed.hrhsh Trojan[Backdoor]/Win32.Hupigon Backdoor:Win32/Baceed.A!bit Backdoor.Win32.Hupigon.gklq Trojan/Win32.Hupigon.R42586 TScope.Malware-Cryptor.SB Win32.Backdoor.Hupigon.Pavs Backdoor.Win32.Hupigon Win32/Trojan.aab


A backdoor also known as: Trojan.Ransom.Crypt12 Ransom.Kristina Ransom_CRYPTWELVE.B Win32.Trojan.WisdomEyes.16070401.9500.9562 Ransom.CryptXXX Ransom_CRYPTWELVE.B Win.Ransomware.Kristina-6367716-1 MSIL.Trojan-Ransom.Crypt12.B Trojan.Win32.Encoder.evktgv Trojan.Win32.Z.Ransom.124928.G Trojan.Encoder.15080 Trojan.Filecoder.Win32.6738 Ransom.MSIL.Natiris W32/Trojan.ERVC-5011 TR/RedCap.khogd Ransom:MSIL/Natiris.A Trojan/Win32.Ransom.C2247299 Trj/GdSda.A Win32/Trojan.Ransom.15c


Wolf Research claimed to shut down their operations but we clearly see that their previous work continues under another guise .


First we got the Linux variant, and with information extracted from its binary, we were able to find the variant for Windows desktops, too.


However , although the “ Concipit1248 ” app requested permissions to open the device camera and read photos , the code only can upload a self-contained PNG file to a remote sever .


https : //github.com/El3ct71k/Keylogger/ It appears the developers have copied the functional part of the keylogger module from this project .


Each value represents a different type of data to steal from the device : Value Data Type 1 Accounts 2 Installed APP list 3 Running processes list 4 Battery status 5 Browser bookmarks and histories 6 Call logs 7 Clipboard 8 Contacts 9 Mobile operator information a File list on SD card b Location c Image list d Audio list e Video list f Storage and memory information g Connection information h Sensors information i SMS messages j VCard format contacts Table 1 .


A backdoor also known as: Trojan.Esacel Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Win32.Kryptik.exqpjd Trojan.Kryptik.Win32.1351348 W32/Trojan.MCPS-3536 TR/Crypt.ZPACK.ocodu Trojan.Esacel Trj/CI.A Trojan.Kryptik!MH3d/6dQFBI Trojan.Inject Malicious_Behavior.SB


Any app can ask for accessibility permissions and implement features such as screen reading , changing sizes and colors of objects , hearing enhancements , replacing touch with other forms of control and more .


At FireEye Labs, we recently detected the resurgence of a coin mining campaign with a novel and unconventional infection vector in the form of an iFRAME inline frame – an HTML document embedded inside another HTML document on a web page that allows users to get content from another separate source and display it within the main web page – embedded in a PE binary Portable Executable Binary, or .exe.


A backdoor also known as: Trojan.QHost.ACI Trojan.Win32.Qhost!O Trojan.QHost.ACI TROJ_RENOS.TU Win32.Trojan.WisdomEyes.16070401.9500.9838 W32/Trojan.YCCB-6079 Trojan.Dropper TROJ_RENOS.TU Win.Trojan.Small-4579 Trojan.Win32.Qhost.abh Trojan.QHost.ACI Trojan.Win32.Qhost.slro Trojan.QHost.ACI TrojWare.Win32.TrojanDownloader.FakeAlert.G Trojan.QHost.ACI Trojan.Fakealert.399 BehavesLike.Win32.Dropper.nc W32/Trojan2.CMAE Trojan/Qhost.tf Trojan:Win32/Wantvi.C Trojan.Win32.Qhost.abh Trojan.QHost.ACI Trojan/Win32.Qhost.R34501 Trojan.QHost.ACI OScope.Hoax.Win32.FakeAlert Trojan.Qhost Win32/TrojanDownloader.FakeAlert.G Trojan.Qhost.EP Trojan.Win32.Qhost.abh W32/Qhost.ABH!tr


A backdoor also known as: Trojan-Downloader.Mediket.CD Troj.Downloader.W32.Mediket.cd!c Trojan/Downloader.Mediket.cd Win32.Trojan.WisdomEyes.16070401.9500.9810 W32/Downloader.JJGI-8097 Win32/SillyDl.FL Trojan-Downloader.Win32.Mediket.cd Trojan.Win32.Mediket.dkal Trojan.Win32.Downloader.10240.ES Trojan.DownLoader.7470 Downloader.Mediket.Win32.64 Trojan-Downloader.Win32.Mediket.bl W32/DldrX.DHK TrojanDownloader.Mediket.fv TR/Dldr.Mediket.S.2 Trojan[Downloader]/Win32.Mediket Trojan.Heur.amGfYI3rB7li Trojan-Downloader.Win32.Mediket.cd Trojan/Win32.Small.C140121 Trojan-Downloader.Win32.Mediket.ca Trojan-Downloader.Mediket.CD Win32.Trojan-downloader.Mediket.Ajvz W32/Dloader.CD!tr.dldr


A particular focus appears to have been placed on the healthcare industry.


A backdoor also known as: Trojan/W32.Small.6656.AAX Trojan.Win32.Small!O Trojan.Tosct Trojan.Heur.RP.EF49A0 TROJ_DLOADER.FAV Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.MPRY-6149 TROJ_DLOADER.FAV Trojan.Win32.Small.coy Trojan.Win32.Small.cwxndz Trojan.Click2.56220 Trojan.Small.Win32.19363 Trojan.Win32.Tosct Trojan/Small.ovb TR/Spy.6656.106 Trojan/Win32.Small Win32.Troj.Undef.kcloud Trojan.Win32.Small.coy Trojan:Win32/Tosct.A Trojan/Win32.Connapts.C256364 Trojan.Small.coy Trojan.Small Win32.Trojan.Small.Aiik Trojan.Small!nYMaRKVOefk W32/Dloader.FAV!tr


In these websites they hosted malware that was digitally signed with a valid, likely stolen code signing certificate


A backdoor also known as: Win32.Hybris.B@mm Email-Worm.Win32.Hybris!O Worm.Hybris W32/Hybris.dll@MM W95.Hybris.PI.msOW W32/Hybris.dll@MM WORM_HYBRIS.F Win32.Trojan.WisdomEyes.16070401.9500.9989 W32/Hybris.worm.B W95.Hybris.worm WORM_HYBRIS.F Win.Trojan.Hybris-10 Win32.Hybris.B@mm Email-Worm.Win32.Hybris.plugin Win32.Hybris.B@mm Trojan.Win32.Hybris.upukw Win32.Hybris Win32.Hybris.B@mm EmailWorm.Win32.Hybris.lki Win98.Vecna.23040 Worm.Hybris.Win32.8 BehavesLike.Win32.Virut.pm W32/Hybris.worm.B Worm/Hybris.c Worm[Email]/Win32.Hybris Worm:Win32/Hybris.C@mm Email-Worm.Win32.Hybris.plugin I-Worm/Hybris.Variant Win32.Hybris.B@mm W32/Hybris.Wsock Win32.Hybris.E2C45E Win32/Hybris.dll Win32.Worm-email.Hybris.Wuqu I-Worm.Hybris Email-Worm.Win32.Hybris.Based W32/Hybris.dll@mm Win32/Worm.Email-Worm.47d


Who is behind Judy ? The malicious apps are all developed by a Korean company named Kiniwini , registered on Google Play as ENISTUDIO corp .


A backdoor also known as: HW32.Packed.8BE3 Win32.Neveg.C@mm Worm/W32.Neveg.52294.B W32/Neveg.c@MM W32/Neveg.c Win32.Neveg.C@mm Trojan.Win32.Neveg.iclu W32/Neveg.D@mm W32.Neveg.C@mm Win32/Neveg.C WORM_NEVEG.C Worm.Neveg.C.4 Email-Worm.Win32.Neveg.c I-Worm.Neveg!ysm95GgJE50 I-Worm.Win32.Neveg.52294.C[h] W32.W.Neveg.c!c Win32.Neveg.C@mm Worm.Win32.Neveg.C Win32.Neveg.C@mm Win32.HLLM.Peerage Worm.Neveg.Win32.1 WORM_NEVEG.C BehavesLike.Win32.Ramnit.qc W32/Neveg.URKR-8484 Worm[Email]/Win32.Neveg Win32.Neveg.EB4884 Worm/Win32.MyDoom Worm:Win32/Neveng.C@mm Win32.Neveg.C@mm Worm.Neveg W32/Neveg.D.worm Win32.Worm-email.Neveg.Lpbl Email-Worm.Win32.Neveg.C Win32.Neveg.C@mm I-Worm/Neveg.C Worm.Win32.Neveg.C


Below are descriptions of some of the most interesting .


Ahmed Mansoor is an internationally recognized human rights defender, based in the United Arab Emirates UAE, and recipient of the Martin Ennals Award sometimes referred to as a Nobel Prize for human rights .


All of the URLs reference the file “ mms.apk ” and all use the domain “ XXXX.ru ” , which belongs to a top five shared hosting platform in Russia ( the domain itself has been obfuscated to anonymize the provider ) .


Allows an application to send SMS messages .


A backdoor also known as: W32/Trojan.MOBS-7437 Win.Trojan.B-474 Virus.Win32.Virut.CE Trojan.Heur.LP.EE1B95 Backdoor:Win32/Liudoor.B!dha Backdoor/Win32.Liudoor.R192527 Trj/CI.A


A backdoor also known as: TrojanDropper.Dorkbot.II4 Backdoor.Bifrose.Win32.18816 Backdoor.Bifrose Trojan/Midgare.advf TROJ_DROPPER.SMS Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Dropper Win32/Bifrose.KJ TROJ_DROPPER.SMS Win.Trojan.Bifrose-9522 Trojan.Win32.Midgare.bqxuse BackDoor.Bifrost.26217 BehavesLike.Win32.Downloader.kc Backdoor/Bifrose.ovy TR/Midgare.adjf Trojan[Backdoor]/Win32.Bifrose Win32.Hack.MnlessT.lo.88519 TrojanDropper:Win32/Dooxud.A Trojan.Graftor.D46F7 Backdoor.Win32.Bifrose.77824.N Trojan/Win32.Bifrose.R3685 Backdoor.Bifrose VirTool.Injector!nUBzjCDRby4 Trojan.Win32.Midgare


Proofpoint researchers originally discovered the Panda Banker malware in February, 2016.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9961 Trojan.Win32.Bladabindi.esnxij Trojan.Win32.Z.Bladabindi.116224.CW Worm.MSIL.Autorun Trojan.MSIL.Bladabindi.1 TrojanDownloader:MSIL/Prardrukat.A Trj/GdSda.A Win32.Trojan.Atraps.Taew Win32/Trojan.62b


Beginning on October 30, 2015, Palo Alto Networks began seeing instances of this new version of CryptoWall, which some researchers have begun calling version 4.


Table 2 below lists some of these apps with their respective metadata .


A backdoor also known as: W32.FakeFolderDAS.Trojan Backdoor.Win32.BlackHole!O Worm.RussoTuristo Worm.RussoTuristo.Win32.83 Trojan.Heur.E54A1B Win32/Russo.A Worm.Win32.RussoTuristo.f Trojan.Win32.Amorale.crsxml Worm.Win32.RussoTuristo.53326 Trojan.Win32.FakeFolder.pb Win32.HLLW.Amorale BehavesLike.Win32.Adware.qh Backdoor/Blackhole.bmv Worm/Win32.RussoTuristo Worm.Win32.RussoTuristo.f Worm/Win32.RussoTuristo.R58000 Worm.TycKa.K Worm.Win32.RussoTuristo Worm.Win32.FakeFolder.CI


In the past weeks on 6 August 2016, Cyberkov Security Incident Response Team CSIRT received a numerous Android malwares operating in different areas in Libya especially in Tripoli and Benghazi.


Since January 2016, discreet campaigns involving malware called Trojan.Odinaff have targeted a number of financial organizations worldwide.


The campaign Talos analysed focused on Brazilian users and also attempted to remain stealthy by using multiple methods of re-direction in an attempt to infect the victim machine.


A backdoor also known as: Trojan.Syamcrog Trojan.Ursu.D1107 Win.Trojan.Bifrose-10939 Trojan.Win32.Tiny.etjahi TR/Downloader.wgueo Trojan:Win32/Syamcrog.A Trojan.Refroso Trj/GdSda.A


Unfortunately, the ransomware developers were not apprehended and it now appears they have been biding their time before releasing a new ransomware.


This malware variant also appears to be technically superior to many other banking Trojans being able to use its overlay attack even on Android 6 , which has technical improvements compared to the previous Android versions to prevent such attacks .