Meanwhile, we have informed the Google Play security team about the RetroTetris app and are awaiting their response.


Adobe released a patch for the vulnerability on July 8, 2015.


Evolution of Rotexy 2014–2015 Since the malicious program was detected in 2014 , its main functions and propagation method have not changed : Rotexy spreads via links sent in phishing SMSs that prompt the user to install an app .


The malware payloads observed to be associated with the Uyghur themed C2 domains so far consist of PlugX, Gh0st RAT, and Saker/Xbox, although there may be others that are yet to be discovered.


The approach of separating malicious functionality out into separate stages that are later downloaded during execution and not present in the initial app published to the Google Play Store , combined with social engineering delivered via social media platforms like Facebook , requires minimal investment in comparison to premium tooling like Pegasus or FinFisher .


However , this method may not work if the threat actors react quickly to an attempt to remove the Trojan .


A backdoor also known as: BackDoor.RevetRat.2 BehavesLike.Win32.Trojan.cc


Not only that, but the Windows version was additionally equipped with a valid code signing signature.


This was followed by another great blog by McAfee on the same subject but my focus will be on a specific aspect mentioned in the RSA blog which is the exploit used. FireEye discovered a malicious docx exploiting a zero day vulnerability in Microsoft's Encapsulated Postscript EPS filter, in the summer of 2015.


The malware can execute a variety of arbitrary commands , including ( for example ) intercepting or sending text messages without the user ’ s knowledge , obtaining a copy of the victim ’ s Address Book , or call or text message logs , or sending phone network feature codes ( also known as USSD codes ) .


Most of them are almost harmless — all they did until recently was injecting tons of ads and downloading others of their kind .


Care and concern both for using a mobile device and for securing a mobile device is critical , especially for those organizations that allow bring-your-own-devices .


In some cases , TrickMo may use this feature to intercept SMS messages without the knowledge of the user by activating the lockdown screen and intercepting SMS messages in the background .


The first trace of this tool in our telemetry data dates back to late 2015.


This report is a comprehensive description of the JSocket Remote Access Tool RAT, and its significant capability to control PCs, Linux machines, Macs and Android devices.


Earlier this month, FortiGuard Labs researchers published findings about a malware campaign exploiting a PowerPoint vulnerability.


While the cyber-world was still shaking under the destructive ExPetr/Petya attack that hit on June 27, another ransomware attack targeting Ukraine at the same time went almost unnoticed.


Cybereason Mobile detects EventBot and provides the user with immediate actions .


A backdoor also known as: Trojan.Johnnie.DB3AF Trojan.Win32.Clicker!BT W32/Trojan.IUSC-1586 TrojanClicker:MSIL/Youclick.A Trojan.Win32.Clicker!BT Trojan-Clicker.MSIL.Youclick


These included the use of certificate pinning and public key encryption for C2 communications , geo-restrictions imposed by the C2 when delivering the second stage , and the comprehensive and well implemented suite of surveillance features .


Recently, while researching attacks on targets in Thailand, Unit 42 discovered a tool that initially appeared to be a variant of the well-known PlugX RAT based on similar observed behavior such as the usage of DLL side-loading and a shellcode file.


We sourced the over 561MB of exfiltrated data from this domain alone , all of which we found to be 7z compressed and password protected .


YOUR PERSONAL ID: Personal ID of your computer, for example: 4df7065b1d049d098526344faaabf3f8


Threat data from endpoints are combined with signals from email and data , identities , and apps in Microsoft 365 Defender ( previously Microsoft Threat Protection ) , which orchestrates detection , prevention , investigation , and response across domains , providing coordinated defense .


A backdoor also known as: W32.Sality.lak4 Trojan.Heur.EFE584 Win32.Trojan.WisdomEyes.16070401.9500.9961 Backdoor.Trojan Trojan-PSW.Win32.LdPinch.zie Trojan.DownLoader.origin BehavesLike.Win32.Virut.nt Trojan-PSW.Win32.LdPinch.zie


) Technical Analysis App Name : TikTok Pro Hash : 9fed52ee7312e217bd10d6a156c8b988 Package Name : com.example.dat.a8andoserverx Upon installation , the spyware portrays itself as TikTok using the name TikTok Pro .


] us .


The international investigation into the 2014 Iguala Mass Disappearance was targeted with infection attempts using spyware developed by the NSO group, an Israeli cyber warfare company


In recent attacks they set up a fake VPN Web Portal and targeted at least five Israeli IT vendors, several financial institutes, and the Israeli Post Office.


A backdoor also known as: VB:Trojan.VBA.Downloader.BU X97M.Petya.A VB:Trojan.VBA.Downloader.BU X2KM_GOLDENEYE.B Xls.Dropper.Goldeneye-3 VB:Trojan.VBA.Downloader.BU Trojan.Script.DnlrObj.ejzqyq Troj.Downloader.Script!c VB:Trojan.VBA.Downloader.BU VB:Trojan.VBA.Downloader.BU X2KM_GOLDENEYE.B X97M/Downloader.au VB:Trojan.VBA.Downloader.BU Trojan:O97M/Goldeneye.A X97M/Downloader.au Trojan-Ransom.VBA.GoldenEye Macro.Trojan-Dropper.Petya.R O97M/Dropper.ALI virus.office.obfuscated.1


The finding , in part , shows the risk that can come in opting for less expensive smartphones , whose manufacturers may not diligently fix security vulnerabilities .


A backdoor also known as: Trojan-Dropper.Win32.Haed!O Trojan/Dropper.Haed.co TROJ_DROP.SMUS1 W32/Dropper.BJGT Backdoor.Trojan TROJ_DROP.SMUS1 Win.Trojan.Haed-1 Trojan-Dropper.Win32.Haed.eno Trojan.Win32.Drop.mqlso Troj.Dropper.W32.Haed.eno!c TrojWare.Win32.Kryptik.BAN Trojan.Click1.57099 Dropper.Haed.Win32.381 virus.win32.ramnit.j W32/Risk.OLFU-0240 TR/Drop.He4Hook.B W32/Haed.A!tr.dldr Trojan[Dropper]/Win32.Haed Trojan.Heur.JP.E9E07C Dropper/Win32.Haed.N349364692 AdWare.AdPlus Win32.Trojan-Dropper.Haed.cfsr Trojan-Downloader.Win32.Frethog


In most cases , these click fraud apps were uninstalled by the users , probably due to the low quality of the apps .


Fortunately , FireEye Mobile Threat Prevention platform can recognize the malicious SMS and networking behaviors used by these RuMMS samples , and help us quickly identify the threat .


During the account sign-up process , Google may flag the account creation attempt as suspicious and prompt the app to solve a CAPTCHA .


The APC routine creates a thread in the context of the svchost.exe process that will map and execute the stage 5 malware into the winlogon.exe process .


In recent months, the malware used in the EITest campaign has been ransomware such as Spora and Mole.


Example note:Please follow the instructions Send $300 worth of Bitcoin to following address: 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX


This specific APK was modified to include the malicious remote access tool RAT called DroidJack also known as SandroRAT, which would virtually give an attacker full control over a victim's phone.


While performing some research online, Unit 42 was able to identify the following sample, which is being labeled as Trojan.Win32.Seadask' by a number of anti-virus companies.


Truth be told, these are all likely just improvements by the author to fix bugs or simply a shift in approach to make signature matching more difficult rather then a completely new variant.


A backdoor also known as: TROJ_INJECT.YYTS Win32.Trojan.WisdomEyes.16070401.9500.9953 Infostealer.Limitail TROJ_INJECT.YYTS Trojan.Win32.Inject.dkhjux Trojan/Scarsi.uz W32.Tepfer.Uqxl TR/MailPassStlr.A.87 Trojan[Dropper]/Win32.FrauDrop Trojan:MSIL/Limitless.A Trojan/Win32.DarkKomet.C641651 TrojanDropper.Injector Trj/CI.A Trojan.Injector!yje4mrhO7hs


A backdoor also known as: Exploit.SWF.CVE-2012-0754.B Exploit/W32.CVE-2012-0754 Exp.SWF.CVE-2012-0754 Exploit.CVE-2012-0754 Exploit.SWF.CVE-2012-0754.a!c Trojan.Mdropper SWF/Exploit.CVE-2012-0754.A SWF_EXPLCVE.A Exploit.SWF.CVE-2012-0754.B Exploit.SWF.CVE-2012-0754.a Exploit.SWF.CVE-2012-0754.B Exploit.S.D-Encrypted.106604 Exploit.SWF.CVE-2012-0754.B Exploit.SWF.CVE-2012-0754.B Exploit.CVE-2012-0754.1 SWF_EXPLCVE.A Exploit-MSWord.o DOC/SWFDropper.A!Camelot TrojanDownloader.SWF.t Trojan[Exploit]/SWF.CVE-2012-0754.a Exploit:Win32/CVE-2012-0754.A Exploit.SWF.CVE-2012-0754.B Exploit.SWF.CVE-2012-0754.a Exploit-MSWord.o Exploit.SWF.CVE-2012-0754.a Win32.Exploit.Cve-2012-0754.Ajli Exploit.CVE-2012-0754.A Exploit.SWF.CVE-2012-0754 W32/SWFExp.AS!tr Win32/Trojan.Exploit.6a5


A backdoor also known as: Trojan.Win32.BHO!O TrojanDownloader.Gamup Trojan/BHO.obt Trojan.Zusy.D42D95 TROJ_STARTP.SML2 Win32.Trojan.BHO.n TROJ_STARTP.SML2 Win.Trojan.OnlineGames-65 Trojan-Downloader.Win32.Gamup.qjl Trojan.Win32.Gamup.ciurh Trojan.Win32.A.Downloader.409816[UPX] Troj.Downloader.W32.Gamup!c Trojan.DownLoad2.34122 Downloader.Gamup.Win32.146 BehavesLike.Win32.Backdoor.cc Trojan.Win32.StartPage TR/BHO.efkmnb Trojan[Downloader]/Win32.Gamup Trojan-Downloader.Win32.Gamup.qjl TrojanDownloader.Gamup Win32.Trojan-downloader.Gamup.Ebhc Win32/Trojan.f4f


During the past few weeks there has been an increase in malvertising attacks, for example via a series of compromises of open source Revive ad servers which is still continuing.


In the third version spotted in the wild , the author introduced parts of the source code of the infamous Anubis Trojan ( which was leaked earlier in 2019 ) .


Utilizing AutoIT within a payload is unique because it is a legitimate management tool.


A backdoor also known as: Trojan.Batman.B Trojan/W32.Batman.24576 Trojan.Batman.B Trojan/Batman.b Trojan.Batman.B W32.BatmanTroj Win32/Batman.B TROJ_BATMAN.B Dos.Trojan.an-1 Trojan.Win32.Batman.b Trojan.Win32.Batman.dcuw Trojan.Win32.S.Batman.24576[h] Win32.Trojan.Batman.Efkt Trojan.Batman.B TrojWare.Win32.Batman.B0 Trojan.Batman.B Trojan.Batman.24576 Trojan.Batman.Win32.2 TROJ_BATMAN.B W32/Trojan.DVOK-6663 Trojan/Win32.Batman.b TR/Batman.B W32/Batman.B!tr Trojan/Win32.Batman Trojan.Batman.B Troj.W32.Batman.b!c Trojan:Win32/Batman.B Trojan/Win32.Batman.N15760 Trojan.Batman Trojan.Batman!bY5LWYbvsHM Trojan.Win32.Batman Trojan.Batman.B Trj/Batman.B Win32/Trojan.022


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 TrojWare.MSIL.Injector.AOX BackDoor.Blackshades.2 Trojan/Foreign.axc Trojan[Ransom]/Win32.Foreign Trojan:MSIL/Parpwuts.C Win32/Trojan.74b


A backdoor also known as: Trojan-Dropper.Win32.Daws!O TrojanDropper.Daws Win32.Worm.VB.sk W32.SillyFDC Trojan-Dropper.Win32.Daws.bkbb Trojan.Win32.Daws.dwunho Trojan.MulDrop4.55506 Dropper.Daws.Win32.11917 BehavesLike.Win32.VBObfus.vz Win32/Virut.bv Trojan[Dropper]/Win32.Daws TrojanDropper:Win32/Vimdop.A!bit Trojan.Razy.D1F32 Trojan-Dropper.Win32.Daws.bkbb Dropper/Win32.Daws.R88727 TScope.Trojan.VB Win32.Trojan-dropper.Daws.Wsug Trojan.DR.Daws!i7I48rjdKf8 Trojan.VB2


A backdoor also known as: Trojan-PWS/W32.WebGame.66136.T Trojan-GameThief.Win32.OnLineGames!O PWS.Zhengtu.BB3 Trojan/OnLineGames.ajcfn Trojan.Zusy.D2717 Win32.Trojan-PSW.OLGames.cm Infostealer.Onlinegame Win.Trojan.Onlinegames-14906 Trojan.Win32.OnLineGames.vtdwn Troj.GameThief.W32.OnLineGames.lulb TrojWare.Win32.GameThief.Magania.~NWABZ Trojan.PWS.Wsgame.34942 Trojan.OnLineGames.Win32.120767 BehavesLike.Win32.Vundo.kh Heur:Trojan/PSW.OnLineGames Trojan[GameThief]/Win32.OnLineGames PWS:Win32/Zhengtu.B!dll Trojan/Win32.OnlineGameHack.R23439 PWS-OnlineGames.ld TrojanPSW.OnLineGames.ai Trojan.Win32.OnlineGames.zt Trojan.PWS.OnLineGames!atUPCfHrrdw Trojan-Spy.OnLineGames W32/Onlinegames.WXA!tr Trojan.PSW.Win32.GameOnline.EN


Our Threat Intelligence and Interdiction team found the Gustuff malware being advertised in the Exploit.in forum as a botnet for rent .


A backdoor also known as: Trojan.Crypt.Delf.E Trojan.Crypt.Delf.E Trojan/Downloader.Dadobra.as Trojan.Crypt.Delf.E Trojan.DL.Dadobra!9AHkQxAvV1E W32/Bancos.APF Downloader.Trojan TSPY_BANKER.UV Trojan-Downloader.Win32.Dadobra.af Trojan.Crypt.Delf.E Trojan.Win32.Dadobra.cmicp Trojan.Win32.Downloader.375808.K[h] Trojan.Crypt.Delf.E Trojan.Crypt.Delf.E Trojan.DownLoader.2321 Downloader.Dadobra.Win32.410 TSPY_BANKER.UV TrojanDownloader.Dadobra.as Trojan[Downloader]/Win32.Dadobra TrojanDownloader:Win32/Dadobra.BM Troj.Downloader.W32.Dadobra.as!c Trojan/Win32.Dadobra Trojan.Crypt.Delf.E Trojan.Win32.Dadobra.af Trojan-Dropper.Delf W32/Delf.DOA!tr.dldr PSW.Banker.33.BG


A backdoor also known as: W32.VariantNetvat.Trojan Trojan.Netvat Backdoor.Trojan Trojan.Win32.Netvat.45056 Worm.Win32.Tenavt.A Trojan.DownLoader11.42361 BehavesLike.Win32.Downloader.pt W32/Trojan.SSPB-9075 Trojan:Win32/Netvat.E!Dll Trojan.Graftor.D29A7D Trojan/Win32.Menti.R124411 Win32.Trojan.Dropper.Heur Worm.Tenavt!JDujK3yXihg W32/Kryptik.DTAI!tr


On the other side , ByteDance has filed a lawsuit suing the Trump administration .


However it's important to say that these attackers, and the toolset used, share a number of similarities with the BlackEnergy group, which conducted attacks against the energy industry in Ukraine in December 2015 and January 2016.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9906 Trojan.Win32.PeaceDuke.gfb Trojan.Win32.Z.Peaceduke.3126830 Win32.Trojan.Peaceduke.Taow BehavesLike.Win32.Worm.vc TR/PeaceDuke.wuwtd Backdoor:Win32/Cozer.A!dha Trojan.Win32.PeaceDuke.gfb Trj/CI.A


It opens the service thread of the service process and uses the ZwQueueApcThread native API to inject an APC .


A backdoor also known as: Win32/RiskWare.PEMalform.E W32.W.Otwycal.l4av Tool.YahooCrack HackTool.YahoCrack.21 HackTool:Win32/Yacra.2_1 HackTool.Win32.Yacra


Phishing page from the French version of the Trojan Communication with C & C Riltok actively communicates with its C & C server .


The Trojan encrypts files on the compromised computer and adds the following prefix before file names: ISHTAR-


APK files will not natively open in an environment other than an Android device .


A backdoor also known as: Backdoor.Nethief.XP Backdoor/W32.Nethief.78611 Backdoor.Win32.Nethief!O Backdoor/Nethief.XP.a Win32.Trojan.WisdomEyes.16070401.9500.9612 W32/Nethief.K@bd Backdoor.Trojan Win32/Nethief.XP.A.Server BKDR_NETHIEFXP.A Backdoor.Nethief.XP Backdoor.Win32.Nethief.ek Backdoor.Nethief.XP Trojan.Win32.Nethief.dknn Backdoor.Win32.A.Nethief.78611[UPX] Win32.Backdoor.Nethief.Aiim Backdoor.Nethief.XP Backdoor.Win32.Nethief.XP.Server Backdoor.Nethief.XP BackDoor.NethiefXP Backdoor.Nethief.Win32.139 BKDR_NETHIEFXP.A BehavesLike.Win32.Virut.lc W32/Nethief.HBZO-6955 Backdoor/Nethief.XP BDS/Nethief.XP.A Trojan[Backdoor]/Win32.Nethief Win32.Hack.Nethief.XP.kcloud Backdoor.Nethief.XP Backdoor.W32.Nethief!c Backdoor.Win32.Nethief.ek Backdoor:Win32/NetThief_XP.B Trojan/Win32.HDC.C762 Backdoor.Nethief.XP Backdoor.Nethief Backdoor.Nethief!0mFzAwzISB0 Backdoor.Win32.Ceckno W32/Nethief.EK!tr.bdr Win32/Backdoor.048


FakeSpy first targeted South Korean and Japanese speakers .


The distribution of rooting malware through Google Play is not a new thing .


A backdoor also known as: Trojan.MSIL Dropper/Win32.Injector


A backdoor also known as: W32.FamVT.ExpiroPC.PE Trojan.MSIL Win32.Trojan.WisdomEyes.16070401.9500.9593 Trojan.Evrial!G1 Trojan.Win32.Stealer.exjasr Trojan.PWS.Stealer.21117 BehavesLike.Win32.Backdoor.ch TR/PSW.CoinStealer.nvgeg Trojan.Win32.Z.Razy.139264.GJ Trojan:MSIL/Evrial.B MSIL.Packed.Kryptik.JH Trj/GdSda.A Win32/Trojan.322


Using an FTP server has some advantages.


Versions 5.X.X-8.X.X were active in 2016 , and versions 9.X.X-1.X.X in 2017 .


The threat group continually updated the Nemesis malware during their ongoing access to the victim environment, deploying several different variants of the same tools and adding functionality between iterations.


A backdoor also known as: Trojan-PWS/W32.RedZone.406528 Trojan/PSW.RedZone.41 Win32/PSW.RedZone.41 TSPY_REDZONE.E Win.Spyware.62275-2 Trojan-PSW.Win32.RedZone.41 Trojan.Win32.RedZone.fqhw Trojan.Win32.A.PSW-RedZone.406528[h] Troj.PSW32.W.RedZone.41!c Win32.Trojan-qqpass.Qqrob.Dyzy TrojWare.Win32.PSW.RedZone.41 Trojan.PWS.RedZone.41 Trojan.RedZone.Win32.21 W32/Risk.MXEM-1318 Trojan/PSW.RedZone.41 TR/PSW.RedZone.41 Malware_fam.gw Trojan[PSW]/Win32.RedZone PWS:Win32/Redzone.4_1 TrojanPSW.RedZone Trojan.PWS.RedZone!tcLid0irw8w Trojan.Win32.PSW Win32/Trojan.PSW.087


A backdoor also known as: W32.Sality.PE Trojan.Dropper.UYL Virus/W32.Sality.D W32.Sality.U Trojan.Dropper.UYL Virus.Sality.Win32.25 Trojan.Dropper.UYL W32.SillyFDC Win32/Sality.AA WORM_SILLY.SMRP Trojan.Dropper.UYL Trojan.Win32.Crypted.cqxgku Trojan.Win32.Dropper.abl Trojan.Dropper.UYL Trojan.Dropper.UYL Win32.Sector.30 WORM_SILLY.SMRP BehavesLike.Win32.Sality.th Win32/HLLP.Kuku.poly2 W32/Sality.AT Worm:Win32/Enosch.A Win32.Virus.Sality.A HEUR/Fakon.mwf Virus.Win32.Sality.bakc Trojan.DataStealer.B Win32/Sality.NBA Win32.Sality.BL Trojan.Win32.Enosch W32/DataStealer.B!tr W32/Sality.AA Virus.Win32.Sality.I


A backdoor also known as: Backdoor.BLA.FC.3019 Variant.Kazy.msZ5 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.MulDrop4.60646 Trojan-PWS.MSIL PWS:MSIL/Mintluks.A


This attack is particularly effective since execution of WTP is not accompanied by a security warning and users have been conditioned to run the troubleshooter when it appears in Windows.


During ISSP Labs daily threat activity monitoring a new virus distribution campaign with a unique malware sample was discovered.


The attacks likely were initially delivered via spear-phishing e-mails, or as demonstrated by C0d0so0 in the past, legitimate websites that had been previously compromised then used as watering holes for the selected victims.


A backdoor also known as: W97M.Bendis.AU X97M.Dropper.ID W97M.Bendis.AU W97M.Downloader X2KM_DROPPER.NEZ W97M.Bendis.AU Trojan.Ole2.Vbs-heuristic.druvzi W97M.Bendis.AU W97M.Bendis.AU X2KM_DROPPER.NEZ X97M/Dropper.c HEUR.VBA.Trojan.d TrojanDropper:O97M/Credoor.A X97M/Dropper.d W97M.Bendis W97M.Bendis.AU


Indicators related to a group of attackers that have been targeting Japan for a few years and are responsible for recent breaches against Japanese targets


A backdoor also known as: Trojan.Rovnix.Win64.17 Troj.Win64.Rovnix!c Trojan.Win64.Rovnix.au Trojan.Win64.Mayachok.dsethy Trojan.Mayachok.19009 Trojan/Rovnix.f W32.Rovnix TR/Rovnix.I Trojan/Win64.Rovnix Trojan.Win64.Rovnix.au Trojan/Win64.Rovnix.R175307 Trojan.Rovnix Trj/Rovnix.B Win64.Trojan.Rovnix.Pdmr Trojan.Rovnix!6RUsEoDKtkI Trojan.Win64.Rovnix Win32/Trojan.52f


These .jar files are most often identified as Adwind.


A new Android banking trojan called Nexus has been promoted via a Malware-as-Service subscription service, but is still in its early stages, suggests security researcher Cleafy's analysis.


Next , if they indicate that they use an Android-based device , the Trojan , impersonating their bank with web injections , fools the victim into installing a fake security app .


A backdoor also known as:


The following code shows EventBot parsing instructions sent from the C2 .


We used a sample app named “ org.starsizew ” with an MD5 of d8caad151e07025fdbf5f3c26e3ceaff to analyze RuMMS ’ s code .


A backdoor also known as: Trojan.Ransom.AIG Trojan/W32.Xorist.13312.E Trojan-Ransom.Win32.Xorist!O Trojan.Ransom.FO4 Trojan.Ransom.AIG Win32.Trojan.Filecoder.g Ransom.CryptoTorLocker Ransom_XORIST.SMA Win.Trojan.CryptoTorLocker2015-1 Trojan.Ransom.AIG Trojan-Ransom.Win32.Xorist.lk Trojan.Ransom.AIG Trojan.Win32.Xorist.dxuuhl Trojan.Win32.A.Xorist.1268736 Trojan.Ransom.AIG TrojWare.Win32.Kryptik.ER Trojan.Encoder.94 Ransom_XORIST.SMA Trojan/Xorist.at TR/Ransom.Xorist.EJ Trojan[Ransom]/Win32.Xorist Trojan.Ransom.AIG Troj.Ransom.W32.Xorist.tnPf Trojan-Ransom.Win32.Xorist.lk Ransom:Win32/Sorikrypt.A Trojan/Win32.Xorist.R21676 Hoax.Xorist Ransom.FileCryptor Trj/RansomXor.A Trojan.Win32.CryptoTorLocker2015.a Trojan-Ransom.CryptoTorLocker215 Win32/Trojan.1ee


I am not sure what these are but am guessing at possibly Emotet banking Trojan


While most of the interest still lies in the public sector, more recent attacks were found targeting the following industries:Aviation Broadcasting Energy Financial Non-governmental organizations NGO Pharmaceutical Public sector Publishing Software


ESET contacted Eltima as soon as the situation was confirmed.


Connexxa was a company also from Catanzaro .


A backdoor also known as: Trojan.MalPack Trojan.Graftor.D69EE1 Win32.Trojan.Kryptik.pd Ransom_LOCKY.SMXA Trojan.Win32.Kryptik.evdsll Ransom_LOCKY.SMXA BehavesLike.Win32.Upatre.qh TrojanDownloader:Win32/Brucryp.G Trj/GdSda.A W32/Kryptik.EXPV!tr Win32/Trojan.160


A backdoor also known as: Trojan.Script.473379 Trojan/W32.Clicker.349278 Trojan.Clicker.r5 Trojan.Script.473379 Trojan.Win32.MLW.lvntl W32/MalwareF.CARP Trojan.ADH Trojan.Win32.Clicker.hd Trojan.Win32.S.Clicker.349278[h] Trojan.Script.473379 Trojan.Script.473379 Trojan.DownLoader6.110 BehavesLike.Win32.Dropper.fc W32/Risk.VMFK-0127 Trojan/Clicker.je Trojan.Script.D73923 Trojan:Win32/Gleishug.C Trojan.Script.473379 Trj/CI.A Win32.Trojan.Clicker.Hoye AdWare.FTat Trojan.Script.473379


In late 2014, ESET presented an attack campaign that had been observed over a period of time targeting Russia and other Russian speaking nations, dubbed Roaming Tiger


Its different modifications target mobile devices of Russian users from February 2015.


A backdoor also known as: W32.MasendosA.Trojan Worm.Win32.AutoRun!O Trojan.Tofsee.1 Win32.Trojan.WisdomEyes.16070401.9500.9997 Win.Worm.Autorun-6961 P2P-Worm.Win32.Palevo.idwe Trojan.Win32.Graz.vhpfw Worm.Win32.A.AutoRun.90112 TrojWare.Win32.Kryptik.JIU Win32.HLLM.Graz Worm.AutoRun.Win32.31130 BehavesLike.Win32.Downloader.kc Worm.Win32.Wergimog Worm/AutoRun.agqt TR/Offend.5523698 Worm[P2P]/Win32.Palevo Worm:Win32/Wergimog.A P2P-Worm.Win32.Palevo.idwe Worm/Win32.Cynic.R5955 Worm.AutoRun Win32/AutoRun.IRCBot.HL Win32.Worm-p2p.Palevo.Swub Worm.AutoRun!FV4PXQUzhXU Win32/Trojan.515


Over the past few months there has been a lot of research and press coverage on the Shamoon campaigns.


For versions 11.0 and 11.4 , the installation is straightforward .


Each of these behaviors is under the control of the remote C2 server .


A sophisticated hacking group with suspected ties to cybercrime gangs operating in Eastern Europe is now actively targeting and breaching prominent, brand name restaurants in the U.S.


A backdoor also known as: Exploit.Win64 Exploit.Win64.Apolmy.ewzxbo Trojan.Win64.Dianti TR/Apolmy.paocz Trojan:Win64/Apolmy.A Trj/CI.A


This EPS exploit was assigned CVE-2015-2545.


A backdoor also known as: W32.Sality.mBZF Trojan.Win32.Clicker.bcgwsn Trojan.Click2.33988 Trojan.Win32.Alyak W32/Trojan.WWZX-6000 TR/Graftor.27537.200 Trojan/Win32.Unknown Backdoor:Win32/Kanav.D BScope.Trojan.Win32.Inject.2 Trj/CI.A Trojan.Symmi.DB644 Win32/Trojan.070


The official “ Golden Cup ” Facebook page .


A backdoor also known as: Trojan.Clicker.Delf.JK Trojan-Clicker.Win32.Delf!O Trojan.Clicker.Delf.JK Win32.Trojan-Downloader.Delf.bq Win32/Bancos.QQM TROJ_CLICKER.ATG Win.Trojan.Delf-2308 Trojan-Clicker.Win32.Delf.ih Trojan.Clicker.Delf.JK Trojan.Win32.Delf.dxqhln Win32.Trojan.Delf.Eamx Trojan.Clicker.Delf.JK Trojan.Clicker.Delf.JK Trojan.Badjoke TROJ_CLICKER.ATG TrojanClicker.Delf.fq TR/Clicker.Delf.IH Trojan[Clicker]/Win32.Delf Trojan.Win32.Clicker.475648 Trojan-Clicker.Win32.Delf.ih Trojan.Clicker.Delf.JK Trojan/Win32.AdClicker.R5452 Trojan.Clicker.Delf.JK TrojanClicker.Delf Win32/TrojanDownloader.Delf.OVE Trojan.CL.Delf.BJTO Trojan-Dropper.Delf W32/Delf.YS!tr


The steps implemented include : Load a URL in a WebView Run JavaScript in WebView Toggle WiFi state Toggle mobile data state Read/modify SMS inbox Solve captchas Captchas One of the more interesting states implements the ability to solve basic captchas ( obscured letters and numbers ) .


The value used to replace GET_IMG_OBJECT comes from the JSON configuration .


A backdoor also known as: Trojan-Dropper.Win32.MultiJoiner!O Troj.Dropper.W32.Pincher.lfij Trojan.Heur.GM.11400100A0 Win32.Trojan.WisdomEyes.16070401.9500.9992 Win32/MicroJoiner.A TROJ_MULTIJOIN.A Trojan-Dropper.Win32.Microjoin.ap TrojWare.Win32.Spy.Zbot.AAT Trojan.MulDrop.613 BehavesLike.Win32.Trojan.vc Trojan-PWS.Win32.LdPinch TrojanDropper.MultiJoiner.13.b Win32.Troj.GaoPSGet.49893 TrojanDropper:Win32/MultiJoiner.A Trojan-Dropper.Win32.Microjoin.ap Dropper/Win32.Microjoin.C70525 Trj/Multijoiner.A Win32/TrojanDropper.MultiJoiner.13.B Trojan.DR.MultiJoiner.D


A backdoor also known as: Trojan-Downloader.Win32.Small!O Downloader.Small.16212 Win32.Trojan.WisdomEyes.16070401.9500.9891 Win32/Kotan.20.A Trojan-Downloader.Win32.Small.fbn Trojan.Win32.Kotan.hadu Troj.Downloader.W32.Small.fbn!c Win32.Trojan-Downloader.Small.cmak TrojWare.Win32.TrojanDownloader.Kotan Trojan.Kaotan Downloader.Small.Win32.3682 TrojanDownloader.Kotan.b W32.Malware.Downloader Win32.Troj.Kotan.kcloud TrojanDownloader:Win32/Kotan.A Trojan-Downloader.Win32.Small.fbn Trojan/Win32.HDC.C69071 TrojanDownloader.Small Win32/TrojanDownloader.Kotan Trojan.DL.Small!ILxLTxTzCnE Trojan-Downloader.Win32.Kotan


A backdoor also known as: W32.OnGamesLT180912HKGHAAI.Trojan Trojan-GameThief.Win32.OnLineGames!O Trojan/Dropper.Killav.lt Win32.Trojan.WisdomEyes.16070401.9500.9999 W32.Fiala.A Win.Trojan.Geral-941 Trojan-Dropper.Win32.Killav.lt Trojan.Win32.Killav.dqiwur Troj.Dropper.W32.Killav.lt!c Win32.Trojan-dropper.Killav.Sunr Backdoor.Win32.Popwin.~IT Trojan.KillProc.13934 Dropper.Killav.Win32.187 BehavesLike.Win32.PWSOnlineGames.mc Trojan-Downloader.Win32.Geral Trojan/PSW.Magania.amzf Trojan[Downloader]/Win32.Geral TrojanDownloader:Win32/Dogkild.S Trojan/Win32.OnlineGameHack.R38048 BScope.Trojan.SvcHorse.01643 Trj/Pupack.A Win32/AutoRun.KillAV.I Trojan.DR.Killav!1BWU2jDjRDE


A backdoor also known as: W32.FakeW7Folder.Fam.Trojan Trojan.Mauvaise.SL1 Trojan.Badur.Win32.8423 Trojan.Win32.Badur.dgkukl Win32.Trojan.Fakedoc.Auto TrojWare.Win32.Imwee.A BackDoor.Bulknet.1486 TR/Dldr.Imwee Trojan/Win32.Badur Trojan.Zusy.D39D62 Backdoor/Win32.Trojan.C753557 Win32/Trojan.IM.66a


A backdoor also known as: JS/Iframe.DGS Script.Trojan-Downloader.IFrame.AE Trojan-Downloader.JS.Iframe.deg Trojan.Script.Expack.bvtkmp PDF.DownLoader.3 BehavesLike.PDF.BadFile.db JS/BlacoleRef.CZ.29 Trojan[Downloader]/JS.Iframe.deg Trojan-Downloader.JS.Iframe.deg JS/Moat.241E54F!tr


Fileless threats and ransomware aren't new, but a malware that incorporates a combination of their characteristics can be dangerous.


A backdoor also known as: Win32.Trojan.Skillis.a W32/Trojan.PYDC-5827 W32.SillyFDC Win32/Oflwr.A!crypt Win32.Application.PUPStudio.A Trojan.Win32.Skillis.cqimdi Trojan.DownLoader21.39298 Trojan.Skillis.Win32.2785 TR/Drop.KillAV.A.69 Trojan/Win32.Unknown TrojanDropper:Win32/Killav.A Trojan/Win32.Backdoor.R142720 Trojan.Skillis Trojan.Win32.Skillis.aaa Trojan.PWS.Banbra!0kkWPO51+fM Win32.Outbreak W32/QQPass.ELG!tr.pws Win32/Trojan.7d3


A backdoor also known as: Trojan.Kazy.DAD1ED Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Trojan.ESEG-0989 Trojan.MSIL.Crypt.fpoa Trojan.Win32.Crypt.evvrmx BackDoor.Tordev.976 BehavesLike.Win32.Trojan.fc TR/Dropper.MSIL.lfcge Trojan:Win32/Rebhip.AA!bit Trojan.MSIL.Crypt.fpoa Trj/GdSda.A Msil.Trojan.Crypt.Hfp Trojan.MSIL.Injector MSIL/Injector.LHM!tr Win32/Trojan.658


A backdoor also known as: Infostealer.Jackpos BKDR_JACKPOS.SM BKDR_JACKPOS.SM BehavesLike.Win32.Dropper.ch Trojan.Win32.Jinupd W32/Trojan.RTKE-0140 Trojan:Win32/Jinupd.B Trojan/Win32.HDC.C743594 Trj/JackPos.A Win32/Trojan.2d8


First observed in July 2014, Dridex, a financial banking Trojan, is considered the successor to the GameOver ZeuS GoZ malware.


A backdoor also known as: Backdoor.Sdbot Backdoor/SdBot.zj Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Sdbot.MAM W32.Spybot.Worm Win32/Dopbot.B WORM_SDBOT.CGE Win.Trojan.SdBot-3536 Backdoor.Win32.SdBot.zj Trojan.Win32.SdBot.esce Backdoor.Win32.SdBot.28160.B Backdoor.W32.SdBot.zj!c BackDoor.IRC.Veritas Backdoor.SdBot.Win32.2281 WORM_SDBOT.CGE BehavesLike.Win32.Backdoor.mc Packed.Morphine.a WORM/IrcBot.28160.1 Trojan[Backdoor]/Win32.SdBot Backdoor.Win32.SdBot.zj BScope.Trojan-PSW.Gomex.8 W32/Gaobot.FCZ.worm IRC/SdBot.DWM Win32.Backdoor.Sdbot.Pavs Worm.SdBot!xpvJkAbKgi0


A backdoor also known as: HackTool.MultiUnwrapper Win32.Trojan.WisdomEyes.16070401.9500.9852 Infostealer.Gampass Win.Trojan.736804-1 HackTool.Win32.MultiUnwrapper Trojan[Dropper]/Win32.Dapato Trj/CI.A Riskware.HackTool!LCoXxVEhnjI Win32/Trojan.03f


APT-C-36, also known as Blind Eagle, has been actively targeting organizations in Colombia and Ecuador since at least 2019.


Unpacker thread decrypt java archive from assets directory “ start.ogg ” , and dynamically loads it and calls the method “ a.a.a.b ” from this archive .


A backdoor also known as: Adware.Rugo Trojan.Win32.BHO.fie AdWare.Win32.BHO.cdg Trojan.MulDrop.15726 TR/BHO.fie TrojanDropper:Win32/Jhee.V Trojan.Win32.BHO.fie Adware.WSearch.O Trojan.Win32.Jhee.V Trojan.BHO.fie


A backdoor also known as: TrojanDownloader.Cabby Trojan/Filecoder.MaktubLocker.c Win32.Trojan.WisdomEyes.16070401.9500.9999 RANSOM_CRYPMAKTUBLOCKER_GC3101B5.UVPM Trojan.Win32.Banpak.bbb Trojan.Win32.Cabby.emrzuq W32.Virut.lyDR Trojan.DownLoader24.13143 Downloader.Cabby.Win32.1871 RANSOM_CRYPMAKTUBLOCKER_GC3101B5.UVPM TrojanDownloader.Cabby.cpa TR/Crypt.Xpack.wgudg Trojan[Downloader]/Win32.Cabby Trojan.Razy.D255EB Trojan.Win32.Ransom.59904.R Trojan.Win32.Banpak.bbb Trojan/Win32.Locky.R197360 TrojanDownloader.Cabby Win32/Filecoder.MaktubLocker.C Trojan.Filecoder!sTyUXy4/Qig


Delimiters Another technique to obfuscate unencrypted strings uses repeated delimiters .


Such app stores are so-called because they are not officially supported by Android , nor are they provided by Google , unlike the Play Store .


Attackers create this scenario to persuade users to pay the ransom so they can gain back access to the device .


The Sofacy group, also known as APT28, Pawn Storm, Fancy Bear, and Sednit, continues to add to the variety of tools they use in attacks; in this case, targeting individuals in the aerospace industry running the OS X operating system.


A backdoor also known as: Backdoor/W32.Androm.266082.B Trojandownloader.Macdowpay Trojan.Win32.Godzilla.ephbuw Trojan.Encoder.11909 Backdoor.Androm.Win32.43313 BehavesLike.Win32.Backdoor.dc Trojan.Yakes.vjn Trojan.Backdoor.Quakbot TR/Fuery.shpvm TrojanDownloader:Win32/Macdowpay.A Trojan.Razy.D2B7A8 Trojan/Win32.Locky.R201696 Backdoor.Androm Backdoor.Andromeda Trj/CI.A


A backdoor also known as: Trojan.Horst Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/Downloader.OMUB-6519 Trojan-Proxy.Win32.Horst.av Trojan.Win32.Horst.dqlqvp Trojan.DownLoader.9121 W32/Downloader.YSQ Trojan[Proxy]/Win32.Horst Trojan-Proxy.Win32.Horst.av TrojanProxy.Horst


A backdoor also known as: Win32.Trojan-PSW.OLGames.bp W32.Rontokbro@mm Trojan.Win32.Krap.dazptt Trojan.Win32.Z.Onlinegames.25088.A Trojan.Click3.21708 BehavesLike.Win32.PWSOnlineGames.mc W32/Trojan.UITW-4840 Trojan/PSW.OnLineGames2.dg PWS:Win32/Zakahic.A Win32.Trojan.Dropper.Heur Trojan.Win32.OnlineGames.daq Trojan-GameThief.Win32.OnLineGames W32/Onlinegames.PYY!tr


We found two functions : The first function is http : //s.psserviceonline [ .


First , the app creates a JavaScript function to call a Java method , getImageBase64 , exposed to WebView using addJavascriptInterface .


This new threat actor we are naming YoroTrooper has been targeting governments across Eastern Europe since at least June 2022, and Cisco Talos has found three different activity clusters with overlapping infrastructure that are all linked to the same threat actor.


The code contains multiple comments in Italian , here is the most noteworthy example : “ Receive commands from the remote server , here you can set the key commands to command the virus ” Here are the available commands : Name Description cd Change current directory to specified quit Close the socket nggexe Execute received command via Python ’ s subprocess.Popen ( ) without outputs ngguploads Upload specified file to the specified URL nggdownloads Download content from the specified URLs and save to specified file nggfilesystem Dump file structure of the C : path , save it to the file in json format and zip it nggstart_screen nggstop_screen Enable/disable screenshot module .


A backdoor also known as: Win32/SillyPWS.CT Trojan-Spy.MSIL!IK Trojan.MulDrop1.16499 TrojanSpy.MSIL.acx PWS:MSIL/VB.B Trojan-Spy.MSIL


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9994 Trojan.Win32.Waldek.aqji Trojan.Win32.Dwn.dzdxxu BackDoor.PlugX.7 Dropper.Dapato.Win32.27346 BehavesLike.Win32.MultiPlug.fh TrojanDropper.Dapato.snz TR/AD.Plugx.M.6 Trojan[Dropper]/Win32.Dapato Trojan.Win32.Waldek.aqji Backdoor:Win32/Plugx.L!dha Trj/GdSda.A Win32.Trojan.Waldek.Wrgj Trojan.Win32.Crypt W32/Kryptik.DGGW!tr TrojanDropper.Dapato Win32/Trojan.bdb


Unfortunately, malware authors often utilize these same capabilities to compromise systems.


Interestingly , there is a domain which used to point there , “ DlmDocumentsExchange.com ” .


This notable characteristic made this attack worthy of further analysis.


Talos found 189 logos from banks to cryptocurrency exchanges inside the archive , all of which could be targeted .


] it Napoli server1rc.exodus.connexxa [ .


] biz adminloader [ .


First, this domain pattern looks just like the extremely prevalent, yet benign Akamai CDN domain.


With the increased use of Android phones in business environments , it is important to defend against these threats by ensuring devices are kept current with the latest updates .


A backdoor also known as: WORM_DORKBOT.SMA Win32.Trojan.WisdomEyes.16070401.9500.9989 Trojan.FakeAV WORM_DORKBOT.SMA Packed.Win32.Katusha.o Trojan.Win32.Katusha.exnjhu BehavesLike.Win32.PWSZbot.qc Packed.Katusha.agmk Trojan.Downloader.126 Packed.Win32.Katusha.o Win32.Worm.Autorun.E Trojan/Win32.Cosmu.C71744 W32/Crypt.AAAI!tr


A backdoor also known as: Udsdangerousobject.Multi Trojan.Waldek.Win32.5328 Uds.Dangerousobject.Multi!c BKDR_REMCOS.DRQW Trojan.Win32.Waldek.akql Trojan.Win32.Waldek.etvwxi Trojan.Win32.Z.Highconfidence.731416 BKDR_REMCOS.DRQW Trojan.Win32.Waldek W32/Trojan.CSQN-6734 W32.Waldek.Akql TR/Waldek.rludr Trojan/Win32.Waldek Trojan:Win32/Vonocksu.A Trojan.Win32.Waldek.akql Trojan/Win32.Waldek.C2216962 Trj/GdSda.A Win32.Trojan.Waldek.Htvv W32/REMCOS.DRQW!tr.bdr


Unlike other ATM malware families, Alice cannot be controlled via the numeric pad of ATMs; neither does it have information stealing features.


This behavior negatively impacts advertisement networks and their clients because advertising budget is spent without acquiring real customers , and impacts user experience by consuming their data plan resources .


A backdoor also known as: Trojan.Win32.Malware.1 W32.Mailbancos@mm Win32.Mailbancos@mm W32.Mailbancos@mm SHeur2.XWF Trj/Banbra.GGU


A backdoor also known as: HW32.Packed.A13D Backdoor.Sinowal.BC Backdoor/W32.Sinowal.335872.B Backdoor.Sinowal.Win32.471 Backdoor.Sinowal.BC Win32.Trojan.WisdomEyes.16070401.9500.9996 Trojan.Mebroot Win.Trojan.Sinowal-1209 Backdoor.Sinowal.BC Backdoor.Win32.Sinowal.eee Backdoor.Sinowal.BC Trojan.Win32.Sinowal.bfkka Backdoor.Win32.Sinowal.335872 Backdoor.W32.Sinowal!c Backdoor.Sinowal.BC Backdoor.Win32.Sinowal.~CRSB Trojan.Packed.2355 BehavesLike.Win32.Sality.fc Backdoor.Win32.Sinowal W32/Backdoor2.EHUE Backdoor/Sinowal.gje RKIT/MBR.Sinowal.W Trojan[Backdoor]/Win32.Sinowal Win32.Hack.SinowalT.bg.339968 Backdoor.Win32.Sinowal.eee Backdoor.Sinowal.BC Backdoor.Sinowal Win32.Backdoor.Sinowal.Liqd W32/SINOWAL.A!tr


However , the existence of threats like ViperRAT and Pegasus , the most sophisticated piece of mobile surveillanceware we ’ ve seen to date , are evidence that attackers are targeting mobile devices .


What makes this interesting is how the dated botnet and macro malware trick are used together.


This weekend saw multiple reports a new zero-day vulnerability that affected all versions of Microsoft Word.


A 17-year-old vulnerability in Microsoft Office Equation Editor is now confirmed to be exploited by the Cobalt Group.


In recent months, Kaspersky observed an increase in the number of malicious campaigns that use Google Advertising as a means of distributing and delivering malware.


A backdoor also known as: TROJ_BHO.SMK Win32.Trojan.WisdomEyes.16070401.9500.9922 W32/MalwareS.AXKH TROJ_BHO.SMK Trojan.DownLoader7.50629 BehavesLike.Win32.PWSZbot.dm Backdoor.WinNT.PcClient W32/Risk.AWDS-7973


Initially, only the Windows version of ROKRAT was used, but the Android version of the malware was later identified.


A backdoor also known as: HW32.Packed.F73E Backdoor/W32.Xhaker.593920 Backdoor.Xhaker.b.n7 Backdoor.Xhaker.Win32.49 Backdoor/Xhaker.b Trojan.Win32.Xhaker.cbfde W32/BackdoorX.BNHA Backdoor.Trojan Smalldoor.BKPC Backdoor.Win32.Xhaker.b Backdoor.Xhaker!qYrnZt9Kncc PE:Backdoor.Win32.VB.bnx!1075029071 BackDoor.Caverns.79 BehavesLike.Win32.Ramnit.hc W32/Backdoor.IYKC-7331 Backdoor/Xhaker.l Win32.Hack.Xhaker.b.kcloud Win32.Backdoor.Xhaker.doln W32/Xhaker.B!tr.bdr Backdoor.Win32.Xhaker.b Win32/Backdoor.bee


We recently uncovered a coordinated campaign targeting Internet infrastructure providers, a media organization, a financial services company, and an Asian government organization.


XLoader can also load multiple malicious modules to receive and execute commands from its remote command-and-control ( C & C ) server , as shown below : Here ’ s a list of the modules and their functions : sendSms — send SMS/MMS to a specified address setWifi — enable or disable Wi-Fi connection gcont — collect all the device ’ s contacts lock — currently just an input lock status in the settings ( pref ) file , but may be used as a screenlocking ransomware bc — collect all contacts from the Android device and SIM card setForward — currently not implemented , but can be used to hijack the infected device getForward — currently not implemented , but can be used to hijack the infected device hasPkg — check the device whether a specified app is installed or not setRingerMode — set the device ’ s ringer mode setRecEnable — set the device ’ s ringer mode as silent reqState — get a detailed phone connection status , which includes activated network and Wi-Fi ( with or without password ) showHome — force the device ’ s back to the home screen getnpki : get files/content from the folder named NPKI ( contains certificates related to financial transactions ) http — access a specified network using HttpURLConnection onRecordAction — simulate a number-dialed tone call — call a specified number get_apps — get all the apps installed on the device show_fs_float_window — show a full-screen window for phishing Of note is XLoader ’ s abuse of the WebSocket protocol ( supported in many browsers and web applications ) via ws ( WebSockets ) or wss ( WebSockets over SSL/TLS ) to communicate with its C & C servers .


A backdoor also known as: W32.AutorunMI.Worm Trojan-Downloader.Win32.Flux!O Worm.AutoRun Trojan/Dropper.aiv Win32.Trojan.WisdomEyes.16070401.9500.9998 Win.Trojan.Autorun-973 Worm.Win32.AutoRun.lt Trojan.Win32.AutoRun.18461 Constructor.W32.VB.lgxd Backdoor.Win32.Popwin.~IQ Trojan.Popwin Worm/Win32.AutoRun Worm.AutoRunsT.ot.18432 Worm.Win32.AutoRun.lt Worm.Winko


A backdoor also known as: W32.FamVT.SmalBHQc.Trojan Trojan.Zenshirsh.SL7 PUP.AdLoad/Variant not-a-virus:Downloader.Win32.AdLoad.syjh Trojan.Win32.Kazy.dydcdw Trojan.Vittalia.800 BehavesLike.Win32.Downloader.lc Variant.Kazy.ds PUA/IStartSurf.chew GrayWare[Adware]/Win32.istartsurf.a Trojan.Application.Bundler.Outbrowse.16 not-a-virus:Downloader.Win32.AdLoad.syjh TrojanDownloader:Win32/Subroate.A!bit Downloader.AdLoad PUA.Downloader!


In this report, we'll review how the actors attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan.


Interestingly, it utilizes a pseudorandom number generator PRNG used in Vawtrak s loader.


It was also used in limited attacks in Korea and Japan .


The iframe leads to Angler EK which downloads Bedep ad-fraud which then downloads a Gootkit loader.


PHA authors usually try to hide their tracks , so attribution is difficult .


A backdoor also known as: Trojan.Razy.D3D173 Win32.Trojan.WisdomEyes.16070401.9500.9961 Ransom_Nymaim.R002C0DAT18 Ransom_Nymaim.R002C0DAT18 Ransom:Win32/Nymaim.F Win32/Trojan.160


] nampriknum [ .


Based on our investigation, the actors behind Operation C-Major were able to keep their Android malware on Google Play for months and they advertised their apps on Facebook pages which have thousands of likes from high profile targets.


It remains available within the source code but no method of use takes place .


A backdoor also known as: Trojan/W32.MMTask.59905 Trojan/PSW.Mmtask.a Trojan.Heur.GM.040605A000 Win32.Trojan.WisdomEyes.16070401.9500.9759 W32/Trojan.ALHG-3475 Win.Trojan.Mmtask-1 Trojan-PSW.Win32.Mmtask.a Trojan.Win32.Mmtask.glty Trojan.Win32.MMTask.59905 Troj.PSW32.W.Mmtask.a!c TrojWare.Win32.PSW.MMTask.A Trojan.MMTask.1 BehavesLike.Win32.PWSZbot.qc Trojan/PSW.MMTask.a TR/PSW.MMTask.A1 Trojan[PSW]/Win32.Mmtask PWS:Win32/MMTask.A Trojan-PSW.Win32.Mmtask.a TrojanPSW.Mmtask Win32/PSW.MMTask.A Win32.Trojan-qqpass.Qqrob.Wuhe Trojan.PWS.Mmtask!shxUVb0b7bE Trojan-PWS.Win32.Mmtask W32/Bdoor.BG!tr


Usually , when users are already infected with malware like TrickBot on their desktop , they will see a web injection asking for their mobile device operating system ( OS ) type and phone number .


The collection of basic device information .


Check code for emulators As part of its defense , the malware payload first checks for emulators to prevent analysis on sandboxes .


A backdoor also known as: Heur.Corrupt.PE W32.Backdoor.Rbot Trojan:Win32/Damingvat.A.dam#2 Backdoor/Win32.Graybird.C918907


REQUEST_IGNORE_BATTERY_OPTIMIZATIONS - whitelist the app to allow it to ignore battery optimizations .


As Riltok shows , cybercriminals can apply the same methods of infection to victims in different countries with more or less the same success .


A backdoor also known as: Trojan-Spy/W32.Banker.113430.B Heur.Win32.VBKrypt.3!O Trojan.Tinba.F3 Trojan.Tinba.Win32.1756 Trojan/Injector.bzpp Win32.Trojan.WisdomEyes.16070401.9500.9974 W32.Cridex.B TROJ_TINBA.SMH Win32.Trojan.Emotet.U Trojan.Win32.VB.dmqp Trojan.Win32.Tinba.euqtlz Troj.W32.VBKrypt.tpek Trojan.PWS.Tinba.161 TROJ_TINBA.SMH BehavesLike.Win32.Emotet.cm Trojan/Banker.Tinba.amp TR/Tinba.A.843 Trojan[Banker]/Win32.Tinba Trojan.Win32.VB.dmqp Trojan/Win32.Cridex.R197444 TrojanBanker.Tinba Trojan.PWS.Tinba! Trojan-Banker.Emotet W32/Injector.BZJE!tr


It comes as no surprise then that many SMS-Trojans include bot functionality .


A backdoor also known as: W32.HfsAutoB.CD60 Downloader.Bagle.Win32.491 Trojan/Downloader.Bagle.atn Trojan.Win32.Bagle.dswqdy Troj.Downloader.W32.Bagle.atn!c Trojan.Packed.650 Trojan-Downloader.Win32.Bagle TrojanDownloader.Bagle.bfu Worm/Win32.Bagle.R767 Trojan.DL.Bagle!+mahMemQ9a4 W32/Bagle.ATN!tr.dldr Trj/CI.A Win32/Trojan.2ff


] XXXX [ .


Although this injector is new, there are some connections to its older version sharing some similarities.


Proofpoint calls the two new variants recently identified Forked and Lite IcedID.


Blackhole's author, Paunch, was arrested in October 2013 and while criminals kept using the kit for the next few months, the exploits slowly deprecated and lost value because of lack of development.


We named this family Kemoge due to its command and control CnC domain


According to its profile at Google Play ( see Figure 2 ) the app reached a mere 10+ downloads .


Rotexy may start requesting device administrator privileges again in an infinite loop ; in that case , restart the device in safe mode and remove the malicious program .


A new campaign is up and running using newly improved , significantly more powerful malware as compared to previous versions .


There has been significant media attention around a campaign likely by a nation-state actor targeting energy organizations in the U.S. including entities operating nuclear facilities.


The strings of code , for one , are similarly structured .


A backdoor also known as: W97M.Downloader.XL W97M/Downloader.buv W97M.Downloader W2KM_DLOADER.AUSUAY Trojan.Ole2.Vbs-heuristic.druvzi W97M.S.Downloader.217088 W97M.MulDrop.158 W2KM_DLOADER.AUSUAY W97M/Downloader.buv TrojanDropper:O97M/Turla.A!dha virus.office.qexvmc.1080


A backdoor also known as: Trojan.Delfinject.18174 Win32.Trojan.WisdomEyes.16070401.9500.9930 Trojan.Win32.Banker.dnoogt Trojan.DownLoader12.55999 BehavesLike.Win32.Dropper.dm W32/Trojan.XESH-6077 TrojanDownloader.Banload.bimh TR/Dldr.Banload.ybjwz TrojanDownloader:Win32/BrobanKew.A TrojanBanker.Banker Trj/CI.A Win32/TrojanDownloader.Banload.VDB Trojan-Downloader.Win32.Banload W32/Banload.VGG!tr.dldr Win32/Trojan.994


Check Point reached out to the Google Security team immediately with information on this campaign .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9840 Trojan:Win32/ShadowPad.E!dha


] 64 [ .


A backdoor also known as: Trojan.Win32.FakeAv.exgvmw Virus.W32.Virus!c TROJ_KRYPTIK_HA230029.UVPM Trojan.Win32.Crypt Trojan.Banker.GozNym.ey Trojan[Banker]/Win32.GozNym TrojanDownloader:Win32/Nymaim.K Trj/GdSda.A W32/Kryptik.GCCW!tr


Monitoring the command and control ( C & C ) servers used by Bouncing Golf , we ’ ve so far observed more than 660 Android devices infected with GolfSpy .


The current phase of the Pawn Storm attack campaign started a little over a month ago, and the overall campaign was first identified in an October 2014 report from Trend Micro PDF.


We classify this 40-month period into three main stages .


The Security Service of Ukraine SBU is continuously investigating this active threat, and has issued statements attributing the attacks to specific branches of the Russian Federal Security Service FSB.


A backdoor also known as: Adware.Msidebar TSPY_STARTPAGE_CD100271.RDXN Win32.Trojan.WisdomEyes.16070401.9500.9721 Trojan.ADH.2 TSPY_STARTPAGE_CD100271.RDXN not-a-virus:AdWare.Win32.Loadwar.wmx Riskware.Win32.Loadwar.epwdej Win32.Trojan.Multiple.drwj Trojan.DownLoader7.8701 BehavesLike.Win32.Dropper.cc TR/Msidebar.C.39 GrayWare[AdWare]/Win32.Loadwar not-a-virus:AdWare.Win32.Loadwar.wmx Trojan:Win32/Msidebar.C Trj/CI.A Trojan.Win32.Msidebar Win32/Trojan.1a4


A backdoor also known as: Backdoor.Ehdoor Trojan/Win32.Sharik.R208903 Trj/GdSda.A


A backdoor also known as: Hoax.Win32.ArchSMS!O Tool.ArchSMS.Win32.7363 Trojan/ArchSMS.otfk Trojan.Zusy.D4232C Win32.Trojan.SMSSend.a PUA.PremiumSMSScam!g14 Hoax.Win32.ArchSMS.cpmhw Riskware.Win32.galh.eaqeda Hoax.W32.Archsms!c ApplicUnwnt.Win32.Hoax.ArchSMS.TP Trojan.SMSSend.7500 BehavesLike.Win32.Dropper.vc Hoax.Win32.ArchSMS W32.Trojan.Archsms HackTool[Hoax]/Win32.ArchSMS Trojan:Win32/Tarifarch.AO Hoax.Win32.ArchSMS.cpmhw Unwanted/Win32.ArchSMS.R216870 Win32.Trojan-psw.Archsms.Htcd Trojan.ArchSMS!vRB02EvsodQ Win32/Trojan.SMS.604


The app loads a URL pointing to a Bread-controlled server .


Aside from a change in its deployment techniques , a few changes in its code set it apart from its previous versions .


Once we reached the non-secured database , we were able to directly observe the app ’ s malicious behavior .


Threat actors used different websites to host different payloads at different times .


From the beginning of 2015, a malicious spear-phishing campaign dubbed Pony, has been actively luring victims.


Adups addressed the issue in a Nov. 16 news release , writing that some products made by BLU were updated in June with a version of its FOTA that had actually been intended for other clients who had requested an ability to stop text spam .


A backdoor also known as: Trojandownloader.Script W32/Trojan.EMGI-1028 Trojan.Win32.Banload.evocsm Troj.Downloader.Script!c TR/AD.Banload.jxcsg Trj/GdSda.A Win32/Trojan.Downloader.251


] pw/6 * * * * * 5 ” ( It .


When required , the Trojan sends an SMS to the specified phone number with the information it has received from the intercepted message .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9866 Ransom.BTCware Win.Ransomware.BTCWare-6329927-0 Win32.Trojan-Ransom.BTCWare.E Trojan.Win32.Filecoder.eplmfi Trojan.Encoder.11958 BehavesLike.Win32.FDoSBEnergy.dh AdWare.ConvertAd.qjt Ransom.Filecoder/Variant Trojan/Win32.Ransom.R208332 Ransom.BTCWare Trj/GdSda.A Trojan.Win32.BTCWare.a


] net app store henbox_3 Figure 2 HenBox app installed , purporting to be DroidVPN Depending on the language setting on the device , and for this particular variant of HenBox , the installed HenBox app may have the name “ Backup ” but uses the same DroidVPN logo .


It checks whether it is being run in an emulator before it starts its malicious activity .


File encryption utilized asymmetric Elliptic Curve Cryptography ECC with Curve SECT233R1 a.k.a. NIST B-233 using the Tiny-ECDH open source library combined with a per file Salsa20 symmetric key.


A backdoor also known as: Trojan.Heur.kmGfrjraeapm2 W32/Trojan-Gypikon-based.DM2!Ma BehavesLike.Win32.Downloader.cc W32/Trojan-Gypikon-based.DM2!Ma Trojan/Banker.Banker.zmm Worm:Win32/Xtrat.B!A BScope.Trojan-Spy.Zbot Trj/GdSda.A


The malicious application da.hao.pao.bin ( Chunghwa Post ) loads a library file libmsy.so used to execute the packed mycode.jar file .


An unknown threat actor is leveraging an evasive threat campaign distributed via Discord that features the PureCrypter downloader and targets government entities.


A backdoor also known as: W32.DroxpesLTAN.Trojan Trojan.Qhost Trojan/Qhost.niv TROJ_SPNR.0BFE11 Win32.Trojan.Qhost.d W32/Trojan2.LITU Win32/Tnega.ATUN TROJ_SPNR.0BFE11 Win.Trojan.6761663-1 Trojan.BAT.Qhost.abp Trojan.Win32.KKQP3298.dkyjvz Trojan.Win32.Z.Qhost.33750 Troj.Bat.Qhost!c Trojan.Hosts.43761 BehavesLike.Win32.BadFile.nh Trojan-Dropper.Win32.StartPage W32/Trojan.KKQP-3298 TR/Qhost.mju.53 Trojan.BAT.Qhost.abp Trojan/Win32.Qhost.R77387 Trojan.BAT.Qhost Trj/CI.A BAT/Qhost.NTH Bat.Trojan.Qhost.Lnya Trojan.Comisproc!uAYBYZyFk6g Win32/Trojan.34d


What Does SimBad Do ? ‘ SimBad ’ has capabilities that can be divided into three groups – Show Ads , Phishing , and Exposure to other applications .


In some versions of Asacub , strings in the app are encrypted using the same algorithm as data sent to C & C , but with different keys .


This threat actor is remarkable for two reasons : Its access to sophisticated zero-day exploits for Microsoft and Adobe software Its use of an advanced piece of government-grade surveillance spyware FinFisher , also known as FinSpy and detected by Microsoft security products as Wingbird FinFisher is such a complex piece of malware that , like other researchers , we had to devise special methods to crack it .


A backdoor also known as: W32.VidemoY.Trojan Win32.Trojan.WisdomEyes.16070401.9500.9988 Backdoor.Trojan Win.Trojan.Bifrose-17928 Trojan.Win32.Bifrost.csybxh Troj.W32.Jorik.Arcdoor.bjr!c BackDoor.Bifrost.15005 Trojan.Inject.Win32.22484 Worm.Win32.Msil Trojan:MSIL/Harvbot.B TrojanDropper.Injector Trj/CI.A W32/Jorik_Arcdoor.BJR!tr


A backdoor also known as: Ransom.FireCrypt.A3 Ransom.BleedGreen Ransom_BleedGreen.A Win32.Trojan.WisdomEyes.16070401.9500.9560 Ransom.FireCrypt Ransom_BleedGreen.A Trojan-Ransom.Win32.Crypmodadv.xee Trojan.Win32.Z.Ransom.18432.C[h] Trojan.Encoder.10088 Trojan.Crypmodadv.Win32.90 trojanspy.msil.neos.a W32/Trojan.RPJE-7166 Trojan.Crypmodadv.en TR/Dropper.MSIL.owdes MSIL/Filecoder.DZ!tr Trojan.Ransom.HiddenTears.1 Ransom:Win32/Firecrypt.A Trojan.Ransom.FireCrypt Win32.Trojan.Crypmodadv.Pbpb Trojan.Crypmodadv! Trojan.VB.Inject Atros4.BUNV Trj/GdSda.A Win32/Trojan.Ransom.786


SUSPECTED DETECTION TESTS BY THE THREAT ACTOR In searching for EventBot , we ’ ve identified multiple submissions from the same submitter hash , 22b3c7b0 : EventBot 22b3c7b0 submitter hash The 22b3c7b0 submitter hash that submitted most of the EventBot samples to VirusTotal .


We dubbed this campaign Operation Electric Powder


) Following is the snippet of code in these older Exodus One samples showing the connection to the Command & Control : Below is the almost identical composition of the request to the Command & Control server in mike.jar ( also containing the path 7e661733-e332-429a-a7e2-23649f27690f ) : To further corroborate the connection of the Exodus spyware with eSurv , the domain attiva.exodus.esurv.it resolves to the IP 212.47.242.236 which , according to public passive DNS data , in 2017 was used to host the domain server1cs.exodus.connexxa.it .


The original leak is no longer available on github.com , but a copy can be found here .


At the time this malware was reported by several security vendors , and attributed to different malware families like Ghostpush , MonkeyTest , and Xinyinhe .


The attack comes as an email containing a malicious Google Docs link.


Even when a false flag might also be a possibility , we consider this to be unlikely .


Beginning in early 2008, Iranian security entities have engaged in operations to identify and arrest administrators of illicit websites and social media groups.


The spear phishing emails had Myanmar political-themed lures and , if the 9002 C2 server responded , the Trojan sent system specific information along with the string “ jackhex ” .


The Cybereason Nocturnus team has concluded that EventBot is designed to target over 200 different banking and finance applications , the majority of which are European bank and crypto-currency exchange applications .


to eSurv S.R.L .


Musical Chairs is a multi-year campaign which recently deployed of new variant Gh0st we've named Piano Gh0st.


Odinaff is typically deployed in the first stage of an attack, to gain a foothold onto the network, providing a persistent presence and the ability to install additional tools onto the target network.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9993 W32/Trojan.VVLV-9156 MSIL.Packed.Kryptik.JH Trojan.Win32.Razy.exgpmg BehavesLike.Win32.Trojan.gc Trojan.Razy.D2685F Trojan/Win32.Randrew.C2365157 Trojan-Dropper.MSIL.Small Trj/CI.A Win32/Trojan.24d


Due to TrickMo ’ s persistence implementation mentioned earlier , this lockdown screen persists after a restart and is re-initiated every time the device becomes interactive .


In the case of this spyware , search for app named TikTok Pro .


For the purpose of this report we analyze here the Exodus One sample with hash 8453ce501fee1ca8a321f16b09969c517f92a24b058ac5b54549eabd58bf1884 which communicated with the Command & Control server at 54.71.249.137 .


The payload will execute shell code to steal data from various applications .


Figure 5 – Keylogger component Figure 6 shows one of the most noteworthy functions of Anubis : its ransomware module .


A backdoor also known as: W97M_DLOADR.XTRQ W97M_DLOADR.XTRQ


A backdoor also known as: Trojan.Kazy.DC9EF Win32.Trojan.WisdomEyes.16070401.9500.9996 W32/Trojan.QFDJ-7788 Backdoor.Trojan Trojan.DownLoader5.32593 Trojan.Small Win32.Troj.Disfa.cv.kcloud Backdoor:MSIL/Sootbot.B Trj/CI.A Win32.Trojan.Downloader.Dyzw BackDoor.WE!tr Win32/Trojan.018


This will be the trigger for the service to start the beaconing .


A backdoor also known as: Packer.FSG.A Packer.FSG.A Downloader.WebDown.Win32.23 Troj.Downloader.W32.WebDown.10!c Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Downloader.BFIA TROJ_APHER.A Win.Trojan.Small-10534 Trojan-Downloader.Win32.WebDown.10 Packer.FSG.A Trojan.Win32.WebDown.buycqa Win32.Trojan-Downloader.Webdown.bfes Packer.FSG.A Trojan.DownLoader.2103 TROJ_APHER.A W32/Downloader.MUZI-7025 Trojan/Downloader.WebDown.10 Trojan/Win32.Unknown TrojanDownloader:Win32/Aphex.2_4 Packer.FSG.A Trojan-Downloader.Win32.WebDown.10 Packer.FSG.A Win-Trojan/Apher.1312 Win32/TrojanDownloader.Apher.070 Trojan.DL.WebDown!Zgs3lnw1FbY Trojan-Downloader.Win32.WebDown Trj/Downloader.GE


A backdoor also known as: Trojan.Multi Trojan.MalPack.VB Uds.Dangerousobject.Multi!c Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan-Spy.Win32.SpyEyes.bdxs Trojan.Win32.Z.Fareitvb.933888 BehavesLike.Win32.BadFile.dh Trojan.VB.Crypt TR/Dropper.VB.dtffd Trojan[Spy]/Win32.SpyEyes Trojan-Spy.Win32.SpyEyes.bdxs Trojan/Win32.VBKrypt.R218990 Trj/GdSda.A Win32.Trojan.Inject.Auto Win32/Trojan.Spy.8cb


Below is the list of all the commands catered by the C & C server .


A backdoor also known as: Trojan.StrictorCS.S483160 Trojan.Graftor.D21F45 Win32.Application.PUPStudio.A HEUR:Trojan.Win32.KillFiles Trojan.Win32.Drop.eaoavd Trojan.Win32.Z.Graftor.614400.AJ Trojan.MulDrop5.12779 Trojan.KillFiles.Win32.6511 W32/Trojan.XBKC-8948 TR/Graftor.905216.18 TrojanDownloader:Win32/WebToos.A HEUR:Trojan.Win32.KillFiles Trojan/Win32.Krap.R106509 TrojanDropper.Sysn Trj/CI.A Trojan.DownLoader! Win32/Trojan.0cb


A backdoor also known as: BackDoor.Dande.52 Trojan.Dande.Win32.1 Trojan.Win32.Dande BDS/Dande.xihzl Trojan.Zusy.D3503B Win32/Dande.A


A backdoor also known as: Trojandropper.Scrop TROJ_DROPPR.YYYJ Trojan-Dropper.Win32.Scrop.cxq Trojan.Win32.Autoit.euuwjs Troj.Dropper.W32.Scrop!c Trojan.DownLoader25.53180 TROJ_DROPPR.YYYJ Trojan.ECCW-6 TR/Autoit.wkswc Trojan[Exploit]/OLE.CVE-2014-6532 Trojan:O97M/Tanequalyn.A Trojan/Win32.AutoIt.C2019675 Win32.Trojan-dropper.Scrop.Pavt W32/Scrop.CO!tr


Interestingly enough, Sourcefire was the only security vendor directly referenced in the Powershell script.


This malware attempts to collect a user's online banking data and sends out information to a control server.


This is what the spear phishing e-mail looked like : In regards to the message text above , multiple activist groups have recently organized a human rights conference event in Geneva .


Since the beginning of 2017, ESET researchers have been conducting an investigation into a complex threat mainly targeting Russia and Ukraine.


A backdoor also known as: AdClicker-O.dr Trojan.Win32.Revop.nbqd W32/TrojanX.HJO Adware.Winpup TROJ_REVOP.A Trojan-Downloader.Win32.VB.ca Trojan.Win32.A.Revop.251830[h] TROJ_REVOP.A AdClicker-O.dr W32/Trojan.MQHB-1521 Win32/TrojanDownloader.VB.CA SPR/Commercials.1 Trojan/Win32.Revop Win32.Troj.Undef.kcloud TrojanDownloader:Win32/VB.CA TrojanDownloader.VB Trj/Multidropper.BJ Win32.Trojan.Revop.cxum Trojan-Downloader.Win32.VB.CA W32/REVOP.A!tr Downloader.VB.EC Trojan.Win32.VB.AhnP


Note that we later found versions that used the domain as a C2 directly instead of the IP address .


A backdoor also known as: BackDoor-EDY.b Trojan.ExeDot.Win32.325 Trojan/ExeDot.cra Win32.Trojan.WisdomEyes.16070401.9500.9965 TROJ_EXEDOT.SMA Win.Trojan.Exedot-43 Trojan.Win32.ExeDot.dsmyq TrojWare.Win32.ExeDot.L TROJ_EXEDOT.SMA BackDoor-EDY.b Trojan/ExeDot.bs Trojan:Win32/Evadiped.A Trojan/Win32.Unknown Win32.Troj.ExeDot.kcloud Trojan.Heur.E8C832 Trojan:Win32/Evadiped.A Trojan/Win32.ExeDot.R4137 Trojan.ExeDot Trojan.BHO!WIw+XSz27Q8 Trojan.Win32.ExeDot


The main goal of this malware is to steal banking credentials from the victim's device.


] 759383 [ .


So , users should beware of certain modified Android firmware .


Honkbox is an active threat with at least three variants and multiple components, some of which have not been previously documented.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9985 Infostealer.Limitail TSPY_INFILOG.SM TSPY_INFILOG.SM TrojanSpy:MSIL/Grieftylo.A


The iOS and Android apps for Netflix are enormously popular , effectively turning a mobile device into a television with which users can stream full movies and TV programs anytime , anywhere .


The actor responsible for this campaign utilized legitimate digital certificates to sign their tools and employed innovative techniques to cloak their command and control traffic.


A backdoor also known as: W32.TonersyASC.Trojan Ransom/W32.Dcryptor.2415104 Ransom.Mambretor.A5 Trojan.Dcryptor.Win32.2 Troj.Ransom.W32.Dcryptor.toNk Trojan/Filecoder.DCryptor.b Win32.Trojan.WisdomEyes.16070401.9500.9975 W32/HDD_Cryptor.A!Eldorado Ransom.HDDCryptor Win.Ransomware.HDDCryptor-2 Win32.Trojan-Ransom.Mamba.A Trojan-Ransom.Win32.Dcryptor.b Trojan.Win32.Filecoder.elaurk Trojan.Win32.Z.Dcryptor.2415104 Tool.PassView.841 Ransom_HDDCRYPTOR.SM Trojan-Ransom.Mamba W32/HDD_Cryptor.A!Eldorado Trojan.Dcryptor.a TR/FileCoder.rrsau Trojan[Ransom]/Win32.Blocker Trojan.Ransom.HDDCrypt.1 Trojan-Ransom.Win32.Dcryptor.b Ransom:Win32/Mambretor.A Trojan/Win32.Dcryptor.C1564580 Hoax.Dcryptor Ransom.HDDCryptor Trj/CI.A Win32/Filecoder.DCryptor.B Win32/Trojan.f14


The packer , besides making the static analysis more complex , will break the standard debugger .


These attackers have used additional malware families in previous activity dating to at least 2015 that include PlugX , Zupdax , 9002 , and Poison Ivy .


Disturbingly , the malware establishes a rootkit on the device , allowing it to download and execute any code a cybercriminal would want to run on a device .


A backdoor also known as: Trojan.DL.Banload!wDurcHh4EfA Spyware.Keylogger TROJ_BANLOAD.AET Win32.TRCrypt.Fkm PUA.Packed.PECompact-1 Trojan-Downloader.Win32.Banload.blpr Trojan-Spy.Win32.Bancos!IK Trojan.DownLoader3.52680 TROJ_BANLOAD.AET TrojanDownloader.Banload.awii Downloader/Win32.Banload TrojanDownloader.Banload.blmr Spyware.Keylogger!rem Trojan-Spy.Win32.Bancos W32/Banload.BLPR!tr.dldr Downloader.Banload.BKYW


A backdoor also known as: Trojan.Pugeju Trojan.Win32.Crypt.raab TrojWare.Win32.Inject.~AT BehavesLike.Win32.PUPXAC.lm Trojan-GameThief.Win32.OnLineGames Trojan/Crypt.acz Trojan/Win32.Invader Trj/CI.A Win32/Obfuscated.NBX Win32/Trojan.be7


A backdoor also known as: Trojan.Beaugrit.S16628 Trojan/Spy.Shiz.ncd Win32.Trojan-Spy.Shiz.b Backdoor.Trojan HT_SIMDA_GA310E71.UVPM Trojan.Win32.Ibank.vuhyo TrojWare.Win32.Spy.Shiz.ZV Trojan.PWS.Ibank.373 Trojan.Shiz.Win32.571 HT_SIMDA_GA310E71.UVPM BehavesLike.Win32.Backdoor.fh TR/BAS.Dorkbot.20619344 Trojan.Zusy.Elzob.D21CE PWS:Win32/Simda.K Win32/Spy.Shiz.NCD TrojanSpy.Shiz!qC77/NFCWBg Backdoor.Win32.Simda W32/Shiz.NCD!tr


The cause for this uptick appears due to widespread WordPress site compromises.


A backdoor also known as: W32.Clodfd4.Trojan.50bd Spyware.PasswordStealer TROJ_FRS.0NA000J416 TROJ_FRS.0NA000J416 Trojan.Win32.Z.Securityxploded.418304[h] BehavesLike.Win32.PWSZbot.gh W32/Trojan.ZJJQ-6216 Unwanted/Win32.Passview.C1588969 Riskware.Win32.PassDumper Trj/GdSda.A


This malware abuses the Android accessibility feature to steal user information and is able to update its code and release new features every few days .


A backdoor also known as: W32.Cloda21.Trojan.c461 DLoader.QYW Win32/SillyDl.ACS Trojan.Win32.A.Downloader.146388 Trojan.DownLoader.6702 BehavesLike.Win32.Downloader.cm TrojanDownloader:Win32/Pusrac.A Trojan.Win32.Downloader.AE


Late in the summer of 2016, CrowdStrike Intelligence analysts began investigating a curious Android Package APK named Попр-Д30.apk' which contained a number of Russian language artifacts that were military in nature.


This malware gives attackers an avenue into internal networks which compromised devices are connected to—a notable risk if the device is used to connect to company networks.


In some samples , starting from January 2016 , an algorithm has been implemented for unpacking the encrypted executable DEX file from the assets folder .


Combining timebombs , dynamic code loading , and use of reflection to complicate reverse engineering of the malware .


The Trojan may perform a man-in-the-middle MitM attack on the browser installed on the compromised computer.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9670 Backdoor.Felismus Trojan/Win32.Skeeyah.C1905486 Trj/GdSda.A Trojan.Win32.Tomyjery


A backdoor also known as: Trojan/W32.VBKrypt.208896.AN Trojan.Win32.VBKrypt!O WORM_VOBFUS.SMIA Trojan.Packed.21297 WORM_VOBFUS.SMIA Trojan.Barys.266 Trojan/Win32.VBKrypt.R2844 Worm.Win32.Vobfus


Beginning in July 2015 and possibly earlier, the attack continued into August and is currently ongoing.


This mistake in operational security allowed us to gain visibility into exfiltrated content for a number of devices .


A backdoor also known as: Trojan.Constructor.Macro.Ultras.A Constructor.Win32.Ultras.10!O WM/Uck.kit Constructor.W32.Ultras!c Trojan/Constructor.Ultras.10.a Trojan.Constructor.Macro.Ultras.A Ultras.Kit Win.Tool.Macro-8 Trojan.Constructor.Macro.Ultras.A Constructor.Win32.Ultras.10.a Trojan.Constructor.Macro.Ultras.A Riskware.Win32.Ultras-10.hpwc Trojan.Constructor.Macro.Ultras.A Constructor.Macro.Ultras.A Trojan.Constructor.Macro.Ultras.A VirusConstructor.Ultras.2 Tool.Ultras.Win32.1 WM/Uck.kit W32/Tool.QHJM-3031 Constructor.Macro.Ultras.10 TR/ConKit.UltrasUck Constructor.Win32.Ultras.10.a HackTool/Win32.Constructor.C218755 Trojan.Constructor.Macro.Ultras.A Constructor.Ultras Win32.Trojan.Ultras.Pegg Constructor.Win32.Ultras Win32/Trojan.5bd


A backdoor also known as: Win32.Worm.Stration.D Win32.Worm.Stration.D Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32.Worm.Stration.D Email-Worm.Win32.Warezov.k Win32.Worm.Stration.D Win32.Worm.Stration.D Heur.Packed.Unknown Win32.Worm.Stration.D Win32.HLLM.Limar Backdoor.Win32.IRCBot Trojan:Win32/Stration.K Win32.Worm.Stration.D Email-Worm.Win32.Warezov.k


Recently, we detected Carbanak campaigns attempting to:Target high level executives in financial companies or in financial/decision-making roles in the Middle East, U.S. and Europe ,Spear-phishing emails delivering URLs, macro documents, exploit documents,Use of Spy.Sekur Carbanak malware and commodity remote access Trojans RATs such as jRAT, Netwire, Cybergate and others used in support of operations.


A backdoor also known as: W32.QueryexXAAF.Worm Application.Hacktool.AW Worm.Win32.Zombaque!O Worm.Zombaque.A3 WORM_BIZOME.SMD W32.Spybot.Worm Win32/Zombaque.A WORM_BIZOME.SMD Win.Worm.Zombaque-12 Application.Hacktool.AW Worm.Win32.Zombaque.a Application.Hacktool.AW Trojan.Win32.Zombaque.bzuxu Worm.Win32.Zombaque.318464.A Application.Hacktool.AW Application.Hacktool.AW Win32.HLLW.RAhack Worm.Zombaque.Win32.2 BehavesLike.Win32.Sality.fc Worm.Win32.Zombaque Worm/Zombaque.l Worm/Win32.Zombaque Worm:Win32/Zombaque.A Application.Hacktool.AW Worm.Win32.Zombaque.a Worm/Win32.Zombaque.R3338 Worm.Zombaque Win32/Zombaque.A Worm.Win32.Zombaque.a Worm.Zombaque!23w9coTlBlo W32/Zombaque.A.worm


Figure 12 .


VERSIONING Bread has also leveraged an abuse tactic unique to app stores : versioning .


In a quick Google search you can find practically anything you need to know.


A backdoor also known as: Trojan.Wdfload.89 Trojan.Win64.Wdfload Trojan.Wdfload.cqq TR/Wdfload.slana Trojan/Win64.Wdfload Trojan/Win64.Wdfload.C2364123 Trj/CI.A W32/Wdfload.AA!tr Win32/Trojan.bfd


A backdoor also known as: Trojan.Downloader Win32.Trojan.WisdomEyes.16070401.9500.9691 Trojan-Downloader.Win32.Injecter.vxy BehavesLike.Win32.PWSZbot.fc W32/Trojan.SBIX-6310 Trojan.Heur.TP.E5F612 Trojan-Downloader.Win32.Injecter.vxy Trj/CI.A Win32/Trojan.03f


A backdoor also known as: Trojan.Pandex Heur.Packed.Unknown Trojan.DownLoad.3750 Heuristic.LooksLike.Win32.Morphine.I VirTool:Win32/Obfuscator.EK Voronezh.1600.A Packed.Morphine.C Trj/CI.A


The threat actor leveraged the CVE-2017-0199 Microsoft Word Office/WordPad Remote Code Execution Vulnerability with carefully crafted decoy content customized for each target recipient.


The first stage would be a malicious link within the e-mail or attachment, containing malicious code, in this case Pony.


Mobile app creators are often looking for ways to monetize their software.


The attackers deliver malware through topically titled spearphises, for example Energy_Data_Meeting_fall_2016.


The source code for Linux.Mirai bot was released a few weeks ago.


A backdoor also known as: Trojan.Graftor.D27EA8 Win32.Trojan.WisdomEyes.16070401.9500.9999 BehavesLike.Win32.Expiro.hc Trojan.Win32.Scar TrojanDropper:Win32/Binko.A W32/Cbot.NCN!tr.bdr Win32/Trojan.Dropper.007


The PureCrypter campaign uses the domain of a compromised non-profit organization as a Command and Control C2 to deliver a secondary payload.


Despite recent progress, the country is subject to ongoing conflict with ethnic rebels and an ongoing civil war.


The code snippet below shows part of the screen parsing process .


This data , when analyzed with the number of commands to send SMSs that Talos received during the investigation , lead us to conclude that the malicious operator is aggressively spreading the malware , but that does n't seem to result in the same number of new infections .


A backdoor also known as: Backdoor/W32.Bancodor.482816 Backdoor/Bancodor.b BKDR_BADCODOR.A W32/Bancodor.C@bd Backdoor.Badcodor Win32/PSWSpider.G BKDR_BADCODOR.A Win.Trojan.Bancodor-22 Backdoor.Win32.Bancodor.b Trojan.Win32.Bancodor.fzet Backdoor.Win32.A.Bancodor.455260 Backdoor.Win32.Bancodor.~B Trojan.Bancdo Backdoor.Bancodor.Win32.150 W32/Bancodor.NOXQ-3353 Backdoor/Bancodor.b BDS/Badcodor.B.6 Trojan[Backdoor]/Win32.Bancodor Win32.Hack.Bancodor.b.kcloud Backdoor:Win32/Badcodor.B Backdoor.W32.Bancodor.b!c Backdoor.Win32.Bancodor.b Backdoor/Win32.Bancodor.R145952 Backdoor.Bancodor Win32/Bancodor.B Backdoor.Badcodor.A Backdoor.Win32.Bancodor Bck/Bancodor.I


The Trojan drops a PowerPoint presentation that contains details about the 2nd Myanmar Industrial Human Resource Development Symposium.


A backdoor also known as: Trojan.Rincux.AV Trojan.Rincux.AV Win32.Trojan.WisdomEyes.16070401.9500.9998 TROJ_DLOAD.KKK Trojan.Rincux.AV Trojan.Rincux.AV BackDoor.Attack.594 TROJ_DLOAD.KKK Backdoor/Ceckno.awl W32/Downloader.L Trojan.Rincux.AV Trojan.Rincux.AV Backdoor.Ceckno!6jtmdMg8Vqs Virus.Win32.Small


Recently, TrendMicro uncovered a new cyber-espionage attack by a well-funded and organized group targeting companies close to governments and in key industries mostly in Asia.


The sample has a multicomponent structure and can download a payload or updates from its C & C server , which happens to be an FTP server belonging to the free Russian web hosting service Ucoz .


A backdoor also known as: Win32/AutoRun.Delf.RF Trojan.Win32.Autoruner2.czfwpa Win32.HLLW.Autoruner2.13746 BehavesLike.Win32.Dropper.dc Trojan.Graftor.D22611 Worm:Win32/Kerm.A Worm/Win32.AutoRun.C332941 Win32.Worm.Autorun.Wted Worm.Win32.Kerm


The Trojans designed to steal money from bank accounts pose a serious threat to Android users.


Sending the command sh to TCP port 6200 results in a full terminal being dropped : Sending the command cmd followed by a proper terminal command will execute it and print the output ( in the example we use id which displays the identity of the system user running the issued commands ) : Doing the same as above but with command sucmd will run the terminal command as root : Other commands supported by rootdaemon on TCP port 6200 are su ( which in our tests did n't properly work ) , loadsocketpolicy , loadfilepolicy , remount and removeroot .


In this case , we can see that the HTML code of the overlay is stored in the C2 infrastructure .


A backdoor also known as: Trojan.Razy.D10C13 Trojan-Downloader.Win32.Sysdrop.am Trojan.Win32.Z.Sysdrop.598528 Troj.Downloader.W32!c Trojan.DownLoader22.41648 Adware.BrowseFox.Win32.397064 W32/Trojan.VFXM-3248 TrojanDownloader.Sysdrop.h BDS/Ananlog.okrph Trojan[Downloader]/Win32.Sysdrop Backdoor:Win32/Ananlog.A Trojan-Downloader.Win32.Sysdrop.am Trj/GdSda.A Win32.Trojan-downloader.Sysdrop.Eok Trojan.DL.Sysdrop! Win32/Backdoor.773


A backdoor also known as: W32.LethicKAAB.Trojan Trojan.VB Win32.Trojan.VB.bj Trojan.KillFiles.29071 BehavesLike.Win32.VBObfus.cm Trojan.Win32.VB Trojan.Ursu.DFEE TScope.Trojan.VB Win32/VB.OCY Win32/Worm.VB.X


Similar to previous malware which infiltrated Google Play , such as FalseGuide and Skinner , Judy relies on the communication with its Command and Control server ( C & C ) for its operation .


This is done by redirecting victim traffic through a malicious proxy server.


After the the first instance of BrainTest was detected , Google removed the app from Google Play .


After collecting the changed PIN code , it is sent back to the C2 .


A backdoor also known as: W32.HfsAutoB.2B84 Worm.Esjey Win32.Trojan.WisdomEyes.16070401.9500.9938 Trojan.Win32.CFI.dcbjxv Trojan.DownLoader12.30909 BehavesLike.Win32.BadFile.wh Worm:Win32/Esjey.A Trojan.Graftor.D299B4 HEUR/Fakon.mwf Virus.Win32.VB


PackageInstaller shows the app ’ s permission access and asks for the user 's approval , which then installs the application .


When in doubt , check the APK signature and hash in sources like VirusTotal before installing it on your device .


In some cases , the decompilation process will fail , and “ Agent Smith ” will try another method for infecting the original application – A binary patch , which simply provides a binary file of the “ boot ” module of “ Agent Smith ” .


Conclusions This Trojan was distributed through the Google Play Store and uses a number of very dangerous techniques , including patching system libraries .


You may review your application list in “ Settings - > Apps ” , if you find one of this applications , please consider downloading an antivirus product such as Check Point ZoneAlarm to check if you are indeed infected .


PluginPhantom is a new class of Google Android Trojan: it is the first to use updating and to evade static detection.


The encrypted body is composed of various identifiers which are joined together : doFinal ( ) is called to encrypt the device information string : The user agent string is built from the package name and IMEI number : Finally the HTTP request is sent to the server at https : //54.71.249.137/eddd0317-2bdc-4140-86cb-0e8d7047b874 .


Recent blogs by the Zscaler research team explain how some variants of Android malware are exploiting the popularity of this game and tricking Android users into downloading a fake version .


This is a read only mode which can help end users remain protected from malicious document files.


We suspect the updated PIN is sent to the C2 , most likely to give the malware the option to perform privileged activities on the infected device related to payments , system configuration options , etc .


Although the current target list is limited to Spanish apps , it seems that the actor is taking into account that the bot should also be able to target other countries , seeing that the path used in the inject requests contains the country code of the targeted institution .


User messages created by the Trojan during installation typically contain grammatical and spelling errors , and use a mixture of Cyrillic and Latin characters .


Figure 4 : Alert prompting the victim to download an Android banking app ( English translation below ) , with stolen branding and fraudulent copy * * * Translation * * * Dear Customer , The system has detected that the Bank Austria Security App is not installed on your smartphone .


] net app store showing the current DroidVPN app Virtual Private Network ( VPN ) tools allow connections to remote private networks , increasing the security and privacy of the user ’ s communications .


A backdoor also known as: Trojan/Delf.rdv Trojan.Win32.Qhost.afmj Trojan.AVKill.28805 TR/Rogue.kdz.976325 Trojan/Win32.Qhost Trojan.Graftor.D1154C Trojan.Win32.Qhost.afmj TrojanDownloader:Win32/Qhost.A Trj/CI.A


Instead of implementing very basic gameplay , the authors pirated and repackaged the original game in their app and bundled with it their advertisement SDK .


A backdoor also known as: Trojan/Turla.a BKDR64_TURLA.YKV Win32.Trojan.WisdomEyes.16070401.9500.9968 Backdoor.Trojan BKDR64_TURLA.YKV Win64.Rootkit.Uroburos.A Backdoor.Win64.Turla.e Trojan.Win64.Turla.dflvfq Backdoor.Win64.Turla!c Trojan:W64/Turla.B BackDoor.Turla.20 Trojan.Turla.Win64.3 BDS/Turla.OE Backdoor.Win64.Turla.e Backdoor.Turla Trj/CI.A Win64/Turla.A Win32.Trojan.Url.Xqlp Win32/Trojan.URL.5b6


Detailed Malware Structure Malware Strucutre com.mile.brain ( SHA256 : 135d6acff3ca27e6e7997429e5f8051f88215d12351e4103f8344cd66611e0f3 ) : This is the main application found on Google Play .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32.Trojan-Ransom.Cryptolocker.AB Trojan.DownLoader25.64138 W32/Trojan.QFWN-8242 TR/Injector.pegqr Trojan.Graftor.D472BE TrojanDownloader:Win32/Zdowbot.B Heur.Malware-Cryptor.Filecoder Trojan.Win32.Zlader W32/Injector.DASN!tr


A backdoor also known as: Exploit.BypassUAC Win.Tool.Win7Elevate-1 Exploit.Win32.BypassUAC.bfo ApplicUnsaf.Win64.Win7Elevate Exploit.BypassUAC.Win32.550 W64/Trojan.SZNL-6335 Exploit.BypassUAC.ny SPR/Welevate.A Trojan[Exploit]/Win32.BypassUAC HackTool:Win64/Welevate.A Exploit.Win32.BypassUAC.bfo HackTool/Win32.Win7Elevate.R27568 Trj/CI.A Win32.Exploit.Bypassuac.Dyqu Trojan.Win32.Webprefix


A backdoor also known as: Win32.Randex.B@mm Backdoor.IRCBot W32/Randex.worm.B Win32.Trojan.WisdomEyes.16070401.9500.9811 W32/Randex.B W32.Randex Win32/Lioten.F Win.Worm.Randex-2 Worm.Win32.Randex.b Win32.Randex.B@mm Trojan.Win32.Randex.glyj W32.W.Randex.b!c Win32.Worm.Randex.Ajbc Win32.Randex.B@mm Worm.Win32.Randex.B Win32.Randex.B@mm Win32.HLLW.Randex.45056 Worm.Randex.Win32.3 BehavesLike.Win32.PWSZbot.lc W32/Randex.B Worm/Randex.b Worm/Win32.Randex Win32.Randex.E2C45E Worm.Win32.Randex.18432 Worm.Win32.Randex.b Worm:Win32/Randex.FN Trojan/Win32.HDC.C82152 Win32.Randex.B@mm Backdoor.IRCBot Worm.Randex Win32/Randex.B Worm.Win32.Randex!jlps7ds/blM W32/Randex.B!worm


The combination of these capabilities makes JSocket a unique and serious threat to the electronic and physical security of victims.


The EternalBlue exploit MS017-010 was initially used by WannaCry ransomware and Adylkuzz cryptocurrency miner.


SELECTED SAMPLES Package Name SHA-256 Digest com.rabbit.artcamera 18c277c7953983f45f2fe6ab4c7d872b2794c256604e43500045cb2b2084103f org.horoscope.astrology.predict 6f1a1dbeb5b28c80ddc51b77a83c7a27b045309c4f1bff48aaff7d79dfd4eb26 com.theforest.rotatemarswallpaper 4e78a26832a0d471922eb61231bc498463337fed8874db5f70b17dd06dcb9f09 com.jspany.temp 0ce78efa764ce1e7fb92c4de351ec1113f3e2ca4b2932feef46d7d62d6ae87f5 com.hua.ru.quan 780936deb27be5dceea20a5489014236796a74cc967a12e36cb56d9b8df9bc86 com.rongnea.udonood 8b2271938c524dd1064e74717b82e48b778e49e26b5ac2dae8856555b5489131 com.mbv.a.wp 01611e16f573da2c9dbc7acdd445d84bae71fecf2927753e341d8a5652b89a68 com.pho.nec.sg b4822eeb71c83e4aab5ddfecfb58459e5c5e10d382a2364da1c42621f58e119b Exobot ( Marcher ) - Android banking Trojan on the rise February 2017 Introduction The past months many different banking Trojans for the Android platform have received media attention .


A backdoor also known as: W32.FilodasD.Trojan Backdoor/W32.Small.19968.AH Backdoor.Win32.Small!O Trojan.Downloader.slowblog Backdoor/Small.klk Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.Small-13891 Backdoor.Win32.Small.klk Trojan.Win32.Small.reykq Backdoor.Win32.A.Small.19968 Backdoor.W32.Small.klk!c Trojan.DownLoad2.37573 Backdoor.Small.Win32.7582 BehavesLike.Win32.Downloader.lm Backdoor/Small.hcp W32/Cowsid.A!tr Trojan[Backdoor]/Win32.Small Win32.Hack.Small.kcloud Trojan.Heur.RP.E95DD0 Backdoor.Win32.Small.klk TrojanDownloader:Win32/Coswid.A Downloader/Win32.Small.C65823 Backdoor.Small Win32/TrojanDownloader.Coswid.A Backdoor.Small!nWa7meIxFMI Trojan-Downloader.Win32.Small


A backdoor also known as: Udsdangerousobject.Multi Win32.Trojan.WisdomEyes.16070401.9500.9998 BackDoor.Bulknet.780 W32/Trojan.JPON-8649 TrojanDropper:Win32/Insup.A Win32.Trojan.Spnr.Afhv Win32/Trojan.9d8


July 11 Two new Flash zero-day vulnerabilities , CVE-2015-5122 and CVE-2015-5123 , were found in the hacking team dump .


] 230 [ .


However , we have noted a significantly small number of downloads of the app in Pakistan , India , Afghanistan , Bangladesh , Iran , Saudi Arabia , Austria , Romania , Grenada , and Russia .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.DownLoader25.45618 Trojan:Win32/Relnicar.A!dha Trj/GdSda.A


Ahnlab is a popular antivirus software in South Korea.


A backdoor also known as: Trojan.Ransom.Cerber.1 Trojan.Ransom.Cerber.1 Trojan.Dropper Trojan.Ransom.Cerber.1 Ransom_HPCERBER.SMALY5A Win32.Trojan.Kryptik.anp Ransom_HPCERBER.SMALY5A Trojan.Ransom.Cerber.1 Trojan.Ransom.Cerber.1 Trojan.Ransom.Cerber.1 Trojan.Ransom.Cerber.1 Trojan.Ssebot.2 BehavesLike.Win32.Dropper.vc Spammer:Win32/Rowdab.A Trj/GdSda.A W32/Kryptik.EXLK!tr


But , as we have already mentioned , the criminals could easily turn their attention to users in other countries .


After the checks , the malware becomes active , but first , it goes through seven steps , each one calling a different command : uploadPhoneNumbers : Exfiltrates all phone numbers that are in the contact list .


The themes of the messages used in the attacks are related to IT Infrastructure such as a log of Server Status Report or a list of Cisco Iron Port Appliance details.


Last week on October 7, Raytheon | Websense® Security Labs™ noticed an interesting email campaign distributing what at first appeared to be Dridex botnet 220.


] comaccount-manager [ .


We decided to call the operation “ ViceLeaker ” , because of strings and variables in its code .


Decompiled APK resources .


A backdoor also known as: Adware.Toolbar.Win32.2435 Trojan.Win32.Spraxeth.elldrz RemoteAdmin.Dexn.v Worm:Win32/Spraxeth.A


Although the threat actor responsible for the development of EventBot is still unknown and the malware does not appear to be involved in major attacks , it is interesting to follow the early stages of mobile malware development .


] infomavis-dracula [ .


A backdoor also known as: HT_PATCHER_FC170076.UVPA Win32.Trojan.WisdomEyes.16070401.9500.9787 Backdoor.Graybird HT_PATCHER_FC170076.UVPA Tool.Patcher.140 BehavesLike.Win32.Dropper.pm not-a-virus:RiskTool.Win32.Patcher HackTool:Win32/Patcher.D HackTool/Win32.Patcher.C862855 Trj/CI.A


With the capability to open market applications , such as Google Play and 9Apps , with a specific keyword search or even a single application ’ s page , the actor can gain exposure for other threat actors and increase his profits .


XLoader can also start other attacker-specified packages .


A backdoor also known as: W32.W.Otwycal.l4av not-a-virus:NetTool.Win32.TCPScan.a Win-AppCare/Tcpscan.108750 HackTool.Win32.TCPScan.fge


We have notified Google of the abuse and are working with them to share additional information.


Here the list of the files potentially dropped during the installation stage : FILE NAME STAGE DESCRIPTION d3d9.dll Stage 4 Malware loader used for UAC environments with limited privileges ; also protected by VM obfuscation aepic.dll , sspisrv.dll , userenv.dll Stage 4 Malware loader used in presence of administrative privileges ; executed from ( and injected into ) a fake service ; also protected by VM obfuscation msvcr90.dll Stage 5 Malware payload injected into the explorer.exe or winlogon.exe process ; also protected by VM obfuscation .cab Config Main configuration file ; encrypted setup.cab Unknown Last section of the setup executable ; content still unknown .7z Plugin Malware plugin used to spy the victim network communications wsecedit.rar Stage 6 Main malware executable After writing some of these files , the malware decides which kind of installation to perform based on the current privilege provided by the hosting process ( for example , if a Microsoft Office process was used as exploit vector ) : Installation process under UAC When running under a limited UAC account , the installer extracts d3d9.dll and creates a persistence key under HKCU\Software\Microsoft\Windows\Run .


In cooperation with Cisco Advanced Services Incident Response, Talos identified several key aspects of the attack.


A backdoor also known as: Trojan-Dropper.Win32.StartPage!O TrojanDownloader.Small.DF3 Trojan/Dropper.StartPage.bdz TROJ_FAVADD.SMI Win32.Trojan.WisdomEyes.16070401.9500.9719 TROJ_FAVADD.SMI Win.Downloader.134775-1 Win32.Trojan.Favadd.A Trojan.Win32.Alien.bnu Trojan.Win32.Zbot.dydfgj Trojan.Win32.Z.Startpage.69632.D Troj.Downloader.W32.VB.lkln TrojWare.Win32.Pasta.SAB Trojan.MulDrop1.43517 Dropper.StartPage.Win32.220 BehavesLike.Win32.VBObfus.km TrojanDropper.StartPage.ty Trojan[Downloader]/Win32.VB Trojan.Buzy.114 Trojan.Win32.Alien.bnu Trojan:Win32/Favadd.C Trojan/Win32.StartPage.R6041 Trojan.VBRA.06132 Trojan.DL.VB!NOyJWQLVTJg Win32/Trojan.835


A backdoor also known as: TrojanDownloader.Hegel TROJ_SHIZ.SMP6 W32/Shiz.MU TROJ_SHIZ.SMP6 Trojan.Win32.A.Downloader.53760.HN Trojan.Packed.20771 BehavesLike.Win32.Cutwail.qh W32/Shiz.FQWK-1945 TrojanDownloader:Win32/Hegel.F Trojan/Win32.ADH.R23078 W32/Shiz.NCF!tr Win32/Trojan.74e


Android/Twitoor is a backdoor capable of downloading other malware onto an infected device. It has been active for around one month.


Devices running Android 4.4 and higher are protected by Verified Boot .


Using a publicly available rooting framework , the PHA attempts to root devices and gain persistence on them by reinstalling itself on the system partition of rooted device .


RIG exploit kit sends Ramnit payloads via VBScript CVE-2016-0189


Some applications rely on SMS when it comes to in-app purchases — the transaction data is transferred via a short text message .


Angler began exploiting CVE-2015-3090 about two weeks after Adobe released a patch.


It checks for different kinds of emulators , including QEMU , Genymotion , BlueStacks and Bignox .


So let's make a level-headed assessment of what is really out there.


It loads code from encrypted resources dynamically , which most detection engines can not penetrate and inspect .


Three distinctive elements of BAIJIU drew and held our attention: the unusual complexity of the attack; the appropriation of web hosting service GeoCities of 1990s fame; and the use of multiple methods of obfuscation.


We assume that these two elements were chosen to trick security products.


The stealer is disguised as a legitimate Google Drive extension and it can monitor browsing history, capture screenshots, and inject malicious scripts to steal funds from cryptocurrency exchanges.


A backdoor also known as: Trojan/W32.Mansabo.389120.B Win32.Trojan-Spy.Trickbot.F Trojan.Win32.Mansabo.aiu Trojan.Win32.Mansabo.evnqvj Trojan.Inject2.64433 Trojan.Mansabo.ni TR/AD.Inject.jyiec Trojan/Win32.Mansabo Trojan.Win32.Mansabo.aiu Trojan/Win32.Inject.C2278939 TScope.Trojan.VB Trojan.TrickBot Trj/GdSda.A Win32.Trojan.Mansabo.Ljab W32/Mansabo.AIU!tr


A backdoor also known as: Trojan-Exploit/W32.Pidief.6283.GLW JS/Pdfcm.AQ Exploit-PDF.sd Bloodhound.Exploit.196 EXPL_EXECOD.A Pdf.Exploit.CVE_2009_0927-1 Exploit.Win32.Pidief.bni PDF.Exploit.CVE-2009-0927.A Exploit.W32.Pidief!c Trojan-Dropper:JS/PdfDropper.A EXPL_EXECOD.A BehavesLike.PDF.Exploit.xn EXP/Pidief.arl Exploit.Win32.Pidief.bni Trojan.JS.Downloader.BEZ Exploit.Win32.Pidief.bni Win32.Exploit.Pidief.Hupr Trojan.Js.Exploit virus.pdf.pdfjs.1


All Firefox users are urged to update to Firefox 39.0.3. The fix has also been shipped in Firefox ESR 38.1.1.


The malware documented in this post was predominantly 64-bit, however, there are 32-bit versions of the malware in the wild.


The new Android ransomware variant overcomes these barriers by evolving further than any Android malware we ’ ve seen before .


First off , it registers the infected device in the administrative panel by sending a GET request to the relative address gate.php ( in later versions gating.php ) with the ID ( device identifier generated by the setPsuedoID function in a pseudo-random way based on the device IMEI ) and screen ( shows if the device is active , possible values are “ on ” , “ off ” , “ none ” ) parameters .


A backdoor targetting Linux also known as: TrojanXor.Linux.DDos.A Linux/DDoS-Xor.A ELF/Trojan.JWZU-2 Linux.Xorddos ELF_XORDDOS.SM Unix.Trojan.DDoS_XOR-1 HEUR:Trojan-DDoS.Linux.Xarcen.a Trojan.Unix.Xarcen.eftmox Troj.Ddos.Linux!c Linux.DDoS.Xor.4 Trojan.Xorddos.Linux.34 Linux/DDoS-Xor.A TrojanDDoS.Linux.ff LINUX/Xorddos.tmifd Trojan[DDoS]/Linux.Xarcen.a Trojan.Trojan.Linux.XorDDoS.2 Linux/Xorddos.625867 HEUR:Trojan-DDoS.Linux.Xarcen.a Trojan.Linux.XorDdos.a Trojan.Linux.DDoS ELF/DDoS.BH!tr ELF/XorDDos.A Win32/Trojan.DDoS.ee7


A backdoor also known as: Trojan.Tibrun Trojan/Kryptik.bwcw Trojan.Razy.D3CCE1 W32/Trojan2.ODQP Trojan.Bruterdep TROJ_TIBRUN.B Trojan-Spy.Win32.POSBrut.b Trojan.Win32.Crypt.ctwfbi Troj.W32.Crypt.csx!c Trojan.DownLoader9.55744 Trojan.Crypt.Win32.14169 TROJ_TIBRUN.B Trojan.Krypt-POS W32/Trojan.WWSD-0234 Trojan/Crypt.eom TR/Spy.13824.412 Trojan/Win32.Crypt.csx Trojan:Win32/Tibrun.A Trojan-Spy.Win32.POSBrut.b Trojan/Win32.Tibrun.C287165 Trojan.Crypt Trj/CI.A Win32/Kryptik.BWCW Win32.Trojan-spy.Posbrut.Sxxp Trojan.Crypt!ZT6l9g/i+CQ W32/BrutPOS.B!tr Win32/Trojan.2d6


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9846 Win32/Droplet.YK Trojan.NtRootKit.9406 TR/Horse.QWS Trj/CI.A W32/Malware_fam.NB Win32/RootKit.Rootkit.43e


The infection happens in multiple stages and the dropper is very similar to many common worm that targets embedded devices from multiple architectures.


It only has two parts , the method indicated by word “ info ” and the victim identifier .


BOT UPDATES EventBot has a long method called parseCommand that can update EventBot ’ s configuration XML files , located in the shared preferences folder on the device .


Answer from the C2 The C2 will check the country field , if it 's empty or if the country is not targeted , it will reply with a " Unauthorized '' answer .


Yesterday, our colleagues from Symantec published their analysis of Longhorn, an advanced threat actor that can be easily compared with Regin, ProjectSauron, Equation or Duqu2 in terms of its complexity.


Before patching , the Trojan will backup the original library with a name bak_ { original name } .


A backdoor also known as: Trojan/W32.Waldek.3342336 Trojan.Mauvaise.SL1 Backdoor.Trojan Trojan.Win32.Waldek.wvv Trojan.Win32.Waldek.elvbza Troj.W32.Waldek!c Trojan.Waldek.exr Trojan:Win32/Waldek.A!bit Trojan.Win32.Waldek.wvv Backdoor.Andromeda Trj/Gamarue.A Win32/Worm.5d8


A backdoor also known as: Win32.Worm.AutoRun.bo W32.SillyFDC Trojan.DownLoader8.34261 Worm:Win32/Metibh.A Rootkit.Ressdt


This malware also contains a screen recorder .


This helps the C2 define what actions it can do before being detected on the mobile device .


However the registrar NameCheap, Inc. covers a pool of 287.411.506 domains where at least 0.10% can be considered as potentially malicious.


A backdoor also known as: W32.FakeWinlogonXIA.Trojan Trojan.Win32.Swisyn!O Trojan.Swisyn.Win32.25583 Trojan/Swisyn.alai Win32.Worm.VB.qn W32.SillyFDC Win32/SillyAutorun.EYX TROJ_SWISYN.AJ Trojan.Win32.Swisyn.alai Trojan.Win32.Vb.btqbl Trojan.Win32.Swisyn.36864.C Trojan.KillFiles.12035 TROJ_SWISYN.AJ Trojan/Swisyn.vmn Worm/Win32.WBNA.mjv Worm:Win32/Roopirs.A Trojan.Win32.Swisyn.alai Trojan/Win32.Swisyn.R2752 Trojan.VBRA.04943 Trojan.PoorVirus I-Worm.VB.NUV Win32/VB.NUV Trojan.Win32.Swisyn


A backdoor also known as: MemScan:Backdoor.Turkojan.BM Trojan.PWS.VKont!NjMVuhwtYR0 BKDR_TURKOJN.SMD Win32.Backdoor.Turko PUA.Packed.Themida-2 Packed.Win32.Black.a MemScan:Backdoor.Turkojan.BM Packed.Win32..Black.~A MemScan:Backdoor.Turkojan.BM Trojan.Packed.650 BKDR_TURKOJN.SMD Heuristic.BehavesLike.Win32.Fake.O Trojan:Win32/Turkojan.B!dll MemScan:Backdoor.Turkojan.BM Packed/Win32.Black Trojan.Win32.Nodef.dqw Trj/Thed.A


As on the desktop , mobile users need to be wary of installing applications from outside of legitimate app stores and sources and be on the lookout for bogus banking sites that ask for more information than users would normally provide on legitimate sites .


This report analyzes a campaign of targeted attacks against an NGO working on environmental issues in Southeast Asia.


The developers refer to this tool by the name Kazuar, which is a Trojan written using the Microsoft .NET Framework that offers actors complete access to compromised systems targeted by its operator.


A backdoor also known as: BackDoor-AZF.dll BKDR_BITS.B W32/Backdoor.FPJ Backdoor.Trojan Win32/Bits.A BKDR_BITS.B Backdoor.Win32.Bits Trojan.Win32.Bits.dlhcqc Backdoor.Win32.Bits.A BackDoor.Bits Backdoor.Bits.Win32.9 BackDoor-AZF.dll W32/Backdoor.SUAV-1947 Backdoor/Bits.b Backdoor:Win32/Bits.B Backdoor.Win32.Bits Bck/Bits.A Backdoor.Bits!2M7xWD4MAec


Once installed , the RAT registers the infected device as shown below .


A backdoor also known as: W32.HfsAutoB.B13C Trojan.Blouiroet Trojan.Win32.Blouiroet.au Trojan.Win32.Blouiroet.evaxpp Trojan.Win32.Z.Symmi.3033600 Troj.W32.Blouiroet!c Win32.Trojan.Blouiroet.Wvkk BehavesLike.Win32.Trojan.vc Trojan.Blouiroet.s Trojan.Symmi.D1371C Trojan.Win32.Blouiroet.au Trojan:Win32/Blouiroet.A Trojan/Win32.Blouiroet.C2267836 Trojan.Blouiroet Trj/CI.A Win32/Trojan.c10


From a single instance of the encoded JavaScript discovered in one version of this malware, we pivoted on the Command and Control C2 IPv4 address discovered during static analysis and deobfuscation, using our Threat Intelligence Service AutoFocus, unearthed many more versions of the malware and found that the versions seen to date were delivering a credential-stealing Trojan as the final payload.


We found no other information stolen from the victims to be accessible .


A backdoor also known as: VirTool.VBInject Trojan.Win32.Clicker!BT Trojan.Kazy.D6D077 Win32.Trojan.Trojan-Clicker.e Trojan.Win32.VB.dwztex Trojan.Win32.Z.Kazy.28676 Win32.HLLW.VBNA.based BehavesLike.Win32.Trojan.mz Trojan.Win32.TrojanClicker TrojanClicker.VB.fwe TR/Kazy.446583.222 TrojanClicker:Win32/Wimg.A Trojan.Win32.Clicker!BT TScope.Trojan.VB Trj/GdSda.A W32/TrojanClicker.OFQ!tr Win32/Trojan.de7


The first attack vector is to compromise the out of band authentication for online banks that rely on SMS using SMS forwarding .


Many of the strings in the application are XOR 'd with the key Kjk1MmphFG : After some additional requests , the dropper made a POST request to https : //54.71.249.137/56e087c9-fc56-49bb-bbd0-4fafc4acd6e1 which returned a zip file containing the second stage binaries .


July 13 Further analysis of the hacking team dump revealed that the company used UEFI BIOS rootkit to keep their Remote Control System ( RCS ) agent installed in their targets ’ systems .


CONCLUSION We witness actors continually using open-source platforms , code and packages to create their own software .


The SpyNote RAT registers a service called AutoStartup and a broadcast receiver named BootComplete .


These attacks are targeted, but not spear-phished.


CVE-2017-0199 was originally a zero-day remote code execution vulnerability that allowed attackers to exploit a flaw that exists in the Windows Object Linking and Embedding OLE interface of Microsoft Office to deliver malware.


By performing a deep analysis of the malware , we were able to extract the unpacked JAR file mycode.jar and reveal some very interesting code .


The data targeted for theft also have similar formats .


The second stage The second stage apps contain the surveillanceware capabilities .


A backdoor also known as: Trojan.Triosir.682 Backdoor:Win32/Rupski.A Trojan.Triosir! AdWare.AddLyrics Win32/Virus.Adware.cd5


sendAll function used to spread malicious messages to the contact list .


It turns out that those smaller Trojans face serious problems trying to get root access on Android 4.4.4 and above , because a lot of vulnerabilities were patched in these versions .


A backdoor also known as: HackTool.Win32.Injecter


He also used his email account to log into various services in the video , which identifies him as the adware domain owner , beyond any doubt .


Ginp ’ s unusual target selection is not just about its focus on Spanish banks but also the wide selection of targeted apps per bank .


A backdoor also known as: Trojanpws.Ginapass Trojan.Win32.Figina.ewevus Trojan.PWS.Figina Tool.DYAMAR.Win32.193 BehavesLike.Win32.Ransom.bc PWS:Win32/GinaPass.D Downloader.Delphi Trj/CI.A


Stage 1 : Exodus One The first stage installed by downloading the malicious apps uploaded on Google Play Store only acts as a dropper .


They decrypt several archive files from the assets folder of the installation package , and launch an executable file from them with the name “ start. ” The interesting thing is that the Trojan supports even the 64-bit version of Android , which is very rare .


Bitdefender Labs has issued a technical advisory to warn the public about a new wave of opportunistic attacks using a vulnerability in Zoho ManageEngine servers, which could affect tens of thousands of businesses.


A backdoor also known as: Trojan.Win32.Clicker!BT Win32.Trojan.WisdomEyes.16070401.9500.9503 Uds.Dangerousobject.Multi!c trojanclicker.msil.fakeie.a TR/Dropper.MSIL.138467 Trojan.MSIL.Krypt.2 TrojanClicker:MSIL/FakeIE.A Trojan.Win32.Clicker!BT Downloader.MSIL.ASXS Win32/Trojan.d60


A backdoor also known as: Win32.Worm.Fujacks.AB Packed.Win32.TDSS!O W32/Fujacks.s Worm.Fujack.Win32.6 W32/Fujacks.aa.2 PE_FUJACKS.EA Win32.Worm.BMW.b W32/Fujack.R W32.Fujacks.E Win32/Emerleox.CO PE_FUJACKS.EA Win.Worm.Fujack-8 Worm.Win32.Fujack.aa Win32.Worm.Fujacks.AB Trojan.Win32.Fujack.nsvf W32.W.Fujack.kZ4V Virus.Win32.Viking.a Win32.Worm.Fujacks.AB Win32.HLLP.Whboy.80 BehavesLike.Win32.MultiPlug.th W32/Fujack.R Worm/Viking.Tail TR/Drop.Hupigon.kmx Trojan[Packed]/Win32.CPEX-based Win32.WhBoy.aa.183492 Trojan:WinNT/Kangkio.A Win32.Worm.Fujacks.AB Win32.WhBoy.AJ Worm.Win32.Fujack.aa Win32.Virus.Neshta.D Win32/Dellboy.Z Win32.Worm.Fujacks.AB Win32.HLLW.Whboy RiskWare.Tool.CK Win32.Fujacks.AD Win32/Fujacks.AD Win32.HLLP.WHBoy.AP Worm.Win32.Fujack W32/BoyhW.V Virus.Win32.Viking.LB


A backdoor also known as: Trojan.Heur.E05F81 Win32.HLLW.Autoruner2.27649 BehavesLike.Win32.Fake.dc Worm:Win32/Namepuk.A HEUR/Fakon.mwf Trojan.FKM!1pKOHJnJsdU


Open source reporting recently indicated new activity from the Iranian actor publicly known as Greenbug targeting Saudi Arabia.


Following on from our post on Angler EK we are going to expose the mechanics behind the Bedep ad-fraud malware.


The exploit files involved were identical to the Hacking Team's leaked exploit HTML, JavaScript, and ShockWave Flash 0-day files.


Since then we have identified a number of attacks over a two-year period, beginning in April 2014, which we attribute to Suckfly.


A backdoor also known as: Backdoor.Win32.Koutodoor!O Trojan.Koutodoor.E Win32.Rootkit.Koutodoor.a Trojan.Koutodoor TROJ_DLOADR.SMOM Backdoor.Win32.Koutodoor.aihc Trojan.Win32.RKDoor.evaszd Backdoor.Win32.Koutodoor.HC Trojan.DownLoader3.76 Trojan.Koutodoor.Win32.5401 TROJ_DLOADR.SMOM Trojan.Rootkit.Pakes W32.Backdoor.Koutodoor Trojan[Backdoor]/Win32.Koutodoor Win32.Troj.JunkcodeT.a.188672 Trojan.Koutodoor.12 Backdoor.Win32.Koutodoor.aihc TrojanDropper:Win32/Minmal.A Backdoor/Win32.Koutodoor.R1785 Trojan.PSW.Win32.OnlineGame.d Trojan.Win32.Koutodoor.AN


A backdoor also known as: Exploit.MSIL Exploit.Win32.CVE20130074.eupinx W32/Trojan.QBBK-0155 Exploit.MSIL.cn EXP/CVE-2013-0074.cpsmi Exploit:MSIL/CVE-2016-0034.B Trj/GdSda.A Trojan.Win32.Exploit W32/CVE_2013_0074.GW!tr Win32/Trojan.Exploit.d89


China seems to a mass victim of this kind of malware having a 92 % share .


Code snippets showing : the decoding algorithm shared by both Bouncing Golf and Domestic Kitten ( top ) , the format of data that Domestic Kitten ’ s malware targets to steal ( center ) , and how both Bouncing Golf ( bottom left ) and Domestic Kitten ( bottom right ) use " " as a separator in their command strings .