While details would vary , all of the identified copies of this spyware shared a similar disguise .


In the observed version of the implant it doesn ’ t have an interface to work with the skype_sync2.exe module .


When we published that blog Unit 42 hadn ’ t seen any of the three registrants overlap domains used in malicious activity .


Further analysis Upon further research , we found this spyware to be developed by a framework similar to Spynote and Spymax , meaning this could be an updated version of these Trojan builders , which allow anyone , even with limited knowledge , to develop full-fledged spyware .


PluginPhantom implements each element of malicious functionality as a plugin, and utilizes a host app to control the plugins.


A backdoor also known as: Trojan-Downloader/W32.Byterage.8193 Trojan/Downloader.Byterage Trojan.Win32.Byterage.hipq W32/Downloader.HPW Byterage.C TROJ_EXCEPTION.F Trojan-Downloader.Win32.Byterage Trojan.Byterage.A Trojan.Win32.Downloader.8193 Virus.Win32.Part.k TrojWare.Win32.TrojanDownloader.Byterage Trojan.Duho TR/Byterage.Dldr TROJ_EXCEPTION.F TrojanDownloader.Win32.Byterage Trojan/Win32.Byterage Win32.Troj.DownByteage.kcloud W32/Downloader.KOEY-6366 Win-Trojan/Byterage.8193 Malware-Cryptor.InstallCore.1 Win32/TrojanDownloader.Byterage Trojan.DL.Byterage Trojan-Downloader.Win32.Small W32/Dloader.AW!tr Downloader.Byterage


In addition, thanks to a coding mistake by the attackers, this particular backdoor does not always run the right commands.


A snapshot of the code that processes each VM opcode and the associate interpreter The presence of a VM and virtualized instruction blocks can be described in simpler terms : Essentially , the creators of FinFisher interposed a layer of dynamic code translation ( the virtual machine ) that makes analysis using regular tools practically impossible .


The gopuram backdoor might be the main implant and the final payload in the attack chain.


We also observed that the threat actors were actively changing their tools, tactics, and procedures TTPs to bypass security solutions.


] ee Backend server ftp [ .


A backdoor also known as: Java.Exploit.CVE-2012-0507.K Exp.JAVA.CVE-2012-0507 Trojan.Inject.GE Exploit.CVE.JS.1533 Exploit.Java.Cve!c Java.Exploit.CVE-2012-0507.K Trojan.Maljava Java/Exploit.CVE-2012-0507.AJ JAVA_EXPLOIT.KRZ Exploit.Java.CVE-2012-0507.gd Exploit.Java.CVE20120507.cqxpdq Java.S.CVE-2012-0507.141383[h] Java.Exploit.CVE-2012-0507.K Java.Exploit.CVE-2012-0507.K Exploit.CVE2012-0507.13 JAVA_EXPLOIT.KRZ BehavesLike.Downloader.cz Exploit.CVE-2012-0507.d JAVA/Adwind.sagg.26 Java.Exploit.CVE-2012-0507.K Exploit.Java.CVE-2012-0507.eg Java.Exploit.Cve-2012-0507.Akpd Exploit.Java.CVE-2012-0507 Java.Exploit.CVE-2012-0507.K Java/Exploit.AZT


The final stage is an ARMEB version from the LuaBot Malware.


A backdoor also known as: W32.HfsAutoB.5441 Win32.Trojan.WisdomEyes.16070401.9500.9941 TROJ_INJECT.AUSPTO Trojan.Win32.Phpw.gez Trojan.Win32.Phpw.expttn TROJ_INJECT.AUSPTO BehavesLike.Win32.Trojan.cc Trojan.Win32.Themida W32/Trojan.JODZ-3607 Trojan.Win32.Phpw.gez Backdoor:MSIL/Zqorat.A Trojan/Win32.Phpw.C2403487 TScope.Malware-Cryptor.SB Trj/CI.A Win32.Trojan.Phpw.Ahym


Stage 5 : The final loader takes control The stage 5 malware is needed only to provide one more layer of obfuscation , through the VM , of the final malware payload and to set up a special Structured Exception Hander routine , which is inserted as Wow64PrepareForException in Ntdll .


The first example of this is in the onStart function , where the malware looks for the string “ Emulator ” and a x86 processor model .


In this case , the attackers hacked a Tibetan activist ’ s account and used it to attack Uyghur activists .


A backdoor also known as: Trojan.VBS.Downloader.ADR JS.Ransom.R VBS/Downldr.HM VBS.Downloader.B Vbs.Downloader.Locky-6348805-0 Trojan.VBS.Downloader.ADR Trojan.VBS.Downloader.ADR Trojan.Script.Vbs-heuristic.druvzi VBS.Downloader.11760 Troj.Downloader.Script!c Trojan.VBS.Downloader.ADR Trojan.VBS.Downloader.ADR VBS.DownLoader.957 VBS/Downloader.ea VBS/Downldr.HM Trojan.VBS.Downloader.ADR VBS/Obfus.S4 VBS/Downloader.ea Js.Trojan.Raas.Auto Trojan-Downloader.JS.Nemucod


A backdoor also known as: W32.eHeur.Malware14 Trojan/W32.Nymaim.478544 Trojan.Win32.Shiz.3!O Trojan.Kryptik.Win32.905858 Trojan.Inject2.25223 Trojan:Win32/Pennelas.A!gfc Trojan/Win32.Silcon.R186780 Trojan.Nymaim!w9Ehxpvgr9U Trj/GdSda.A


] cashnow [ .


A backdoor also known as: Application.Htool.WIP Trojan.Mauvaise.SL1 HackTool.BruteForce Trojan/Hacktool.BruteForce.ze Application.Htool.WIP Win32.Trojan.WisdomEyes.16070401.9500.9930 Win32/Tnega.dRWGBOC HV_BRUTEFORCE_CG153BD9.RDXN Win.Trojan.Bruteforce-13 Application.Htool.WIP Application.Htool.WIP Trojan.Win32.BruteForce.srzyv Application.Htool.WIP Tool.Bruteforce.185 Tool.BruteForce.Win32.254 HackTool.Win32.BruteForce HTool.BruteForce.f SPR/DUBrute.owoan HackTool/Win32.BruteForce HackTool:Win32/DUBrute.A HackTool.BruteForce Trojan/Win32.Bruteforce.R23399 HackTool.BruteForce!jw9TQR6yLS4


This is worm-like ransomware based on Petya.


A backdoor also known as: W32.FamVT.ExpiroPC.PE W32.Francette.M W32.Francette.Worm Heur.Corrupt.PE Backdoor.Win32.RedSpy Worm:Win32/Francette.M.dam#2


IOCS Hashes 139edb1bc033725539b117f50786f3d3362ed45845c57fe1f82e7ed72b044367 e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 e5f346d8f312cc1f93c2c6af611e2f50805c528934786ea173cabc6a39b14cda 1849a50a6ac9b3eec51492745eeb14765fe2e78488d476b0336d8e41c2c581d4 d328fca14c4340fcd4a15e47562a436085e6b1bb5376b5ebd83d3e7218db64e7 59b9809dba857c5969f23f460a2bf0a337a71622a79671066675ec0acf89c810 120474682ea439eb0b28274c495d9610a73d892a4b8feeff268c670570db97e2 ed234e61849dcb95223676abe2312e1378d6130c0b00851d82cda545b946ec83 27410d4019251a70d38f0635277f931fb73f67ac9f2e1f3b475ce680ebfde12a 6e6c210535b414c5aa2dd9e67f5153feeb43a8ac8126d8e249e768f501323a3e 4a32ced20df7001da7d29edc31ca76e13eef0c9b355f62c44888853435e9794f ac5abaebd9f516b8b389450f7d27649801d746fb14963b848f9d6dad0a505e66 3a45d7a16937d4108b5b48f44d72bb319be645cbe15f003dc9e77fd52f45c065 Domains cvcws [ .


A backdoor also known as: Worm.Win32.AutoRun!O Worm.Emudbot.S15201 Worm.AutoRun.Win32.57341 W32/AutoRun.diqe Win32.Trojan.WisdomEyes.16070401.9500.9953 Win.Worm.Autorun-9966 Worm.AutoRun Trojan.Win32.Emud.reytg Win32.HLLW.EmudBot.12 BehavesLike.Win32.BadFile.kh Worm/AutoRun.agrm W32.Worm.Autorun Worm.Autorun.kcloud Worm:Win32/Emudbot.A Trojan.Graftor.Elzob.D3011 Worm/Win32.AutoRun.C69047 Win32/AutoRun.Delf.MI Worm.AutoRun!NSqws7tLdQs Worm.Win32.Emudbot W32/Autorun.BGT!tr Win32/Trojan.Dropper.65e


The software generated 2FA code as it appeared on the device ’ s display ( left ) and as available in the database ( right ) Along with the malicious DEFENSOR ID app , another malicious app named Defensor Digital was discovered .


We Kaspersky have already seen some cryptor attacks where malicious programs with different functions have been used in combination.


If the original SMS app has been restored , it will send “ the app returned to its original place. ” Controlling TrickMo TrickMo ’ s operators can control the malware via two channels : Through its C & C via a plaintext HTTP protocol using JSON objects Through encrypted SMS messages There are predefined commands to change the malware ’ s configuration and make it execute certain tasks .


iSIGHT Partners has dubbed the intrusion operators who leverage the CVE-2014-4114 zero-day Sandworm Team. The name was chosen due to unique references to the classic science fiction series Dune, which are characterized by the use of multiple BlackEnergy malware variants.


A backdoor also known as: Trojan.Teper Trojan/AutoRun.Delf.lv Trojan.MSIL.Krypt.11 Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_INJECTOR_FA250012.UVPM Trojan.Win32.DarkKomet.dkhkpy TrojWare.MSIL.Teper.A Trojan.PWS.Stealer.13025 TROJ_INJECTOR_FA250012.UVPM BehavesLike.Win32.Trojan.dc Backdoor/Androm.dvy TR/Inject.xbbeiet W32/Vobfus.GEP.worm Win32/AutoRun.Delf.LV Win32.Worm.Autorun.Suxp Win32/Trojan.d74


Note that inside this single response , there is one “ install_true ” command , one “ sms_grab ” command and four “ sms_send ” commands .


The Apple Developer Enterprise program is intended to allow organizations to distribute proprietary , in-house apps to their employees without needing to use the iOS App Store .


They are using the RockLoader malware to download Bart over HTTPS.


A backdoor also known as: Win32.Worm.Autorun.MK Win32.Worm.Autorun.MK Win32.Worm.Autorun.MK Win32.Trojan.WisdomEyes.16070401.9500.9996 W32.SillyFDC Win32/Auraax.W Win.Trojan.Zbot-1219 Win32.Worm.Autorun.MK Win32.Worm.Autorun.MK Win32.Worm.Autorun.MK Win32.Worm.Autorun.MK Trojan.DownLoad.5092 Worm.AutoRun.Win32.24333 Backdoor.W32.Bifrose.kZn8 Win32/AutoRun.YM Trojan-Spy.Win32.Zbot W32/Autorun.MFA!worm Trj/CI.A


The threat posed by custom malware such as Dripion illustrates the value of multilayered security.


However, it doesn't stop there: some versions of RAA also include a Pony Trojan file, which steals confidential information from the infected computer.


Due to this feature , it is clear that the developers paid special attention to the work of the implant on Huawei devices .


The attack was initially thought to be attributed to North Korea, by way of a Chinese IP found during the attack, but no other strong evidence of North Korea's involvement has been produced since then.


After the modules are installed they are deployed to the short term memory and deleted from the device storage , which makes the Trojan a lot harder to catch .


A backdoor also known as: Trojan.PPDropper.F PPT97/PPDropper.C TROJ_PPDROPPER.L TROJ_PPDROPPER.L Exploit-PPT.d Exploit:Win32/Nappto.A Exploit-PPT.d PP97M/TrojanDropper.PPDrop.F Trojan-Dropper.PP97M.Ppdrop Exploit/PPT.A


Nevertheless , users should practice proper security hygiene to mitigate threats that may take advantage of a home or business router ’ s security gaps .


This is the same behaviour we have been seeing with the recent UPS failed to deliver nemucod ransomware versions


A backdoor also known as: Ransom.Ryzerlo.S4 Trojan.Ransom.HiddenTear Trojan.Ransom.HiddenTears.1 Win32.Trojan.WisdomEyes.16070401.9500.9717 Ransom.HiddenTear!g1 Ransom_CRYPTEAR.SMI1 Trojan.Win32.Encoder.ewzwkj Trojan.Win32.Z.Ransom.174592.P Trojan.Encoder.10598 Ransom_CRYPTEAR.SMI1 Trojan-Ransom.HiddenTear W32/Ransom.EJHW-4383 TR/Downloader.fuswg Ransom:MSIL/Flyterper.A Trj/GdSda.A Win32/Trojan.Ransom.786


“ Agent Smith ” itself , though , seems to target mainly India users .


Although this malware 's credential-harvest mechanism is not particularly sophisticated , it does have an advanced self-preservation mechanism .


Several indicators inside the samples we have analysed point to a new major version of the malware.


A backdoor also known as: W32.DroppenAS.Trojan Worm.Nohad.A9 Trojan/AutoRun.Delf.qi Win32.Worm.Delf.bw W32/Trojan.KDXB-0268 Win32/Tnega.AUMK WORM_SOHANAD.SM0 Win32.Worm.Autorun.T Trojan.Win32.Special.dtabba Trojan.Fakealert.51818 WORM_SOHANAD.SM0 W32/Trojan2.OEMC TR/Dropper.pjrqu Trojan.Zusy.D18D1A HEUR/Fakon.mwf Win32/AutoRun.Delf.QI W32/AutoRun.QIAU!tr VBS/Jenxcus.A


We identified over two hundred samples of malware generated by the group over the last two years.


A backdoor also known as: W32/AutoRun.bhyp Trojan.Heur.E5CD44 Win32.Trojan.WisdomEyes.16070401.9500.9985 W32/MalwareF.IWEH Win.Spyware.76175-2 Trojan.Win32.FrusEfas.iumlo Worm.Win32.Autorun.2101887 Trojan.MulDrop1.52015 BehavesLike.Win32.BadFile.vc W32/Risk.GYGM-4699 TrojanClicker.FrusEfas.a Trojan:Win32/Tofe.A Worm.AutoRun Trojan-GameThief.Win32.Magania


The HenBox app downloaded in May 2016 , as described in Table 1 below , masquerades as a legitimate version of the DroidVPN app by using the same app name “ DroidVPN ” and the same iconography used when displaying the app in Android ’ s launcher view , as highlighted in Figure 2 below Table 1 .


To that end, I have been working on automating ways to help ASERT better understand the context around samples so we can answer question about what may have been targeted, why it was targeted and when it was targeted.


A backdoor also known as: Backdoor.Simda.A Trojan.Beaugrit.S714409 Backdoor.Simda.A Trojan.Shiz.Win32.341 Trojan/Spy.Shiz.ncd Win32.Trojan-Spy.Shiz.b Backdoor.Trojan TROJ_BEAUGRIT_GC3101D5.UVPM Backdoor.Simda.A Backdoor.Simda.A TrojWare.Win32.Spy.Shiz.AB Backdoor.Simda.A Trojan.PWS.Ibank.300 TROJ_BEAUGRIT_GC3101D5.UVPM BehavesLike.Win32.Backdoor.jh Backdoor.Win32.Simda Backdoor.Simda.A Backdoor.Simda.A Backdoor.Simda TrojanSpy.Shiz!u9u05UapnAM W32/Shiz.NBX!tr


A backdoor also known as: W32.AutorunSevLnr.Worm Worm.AutoRun.Win32.27239 WORM_VERST.SM Win32.Worm.AutoRun.fp W32/Trojan2.OAQT WORM_VERST.SM Trojan.Win32.AutoRun.bxdzl W32.Virut.mDxm BackDoor.Pushnik.16 BehavesLike.Win32.Autorun.jc W32/Trojan.ORVC-8944 Worm/AutoRun.zqc W32.Worm.Lj Worm:Win32/Verst.A Trojan.Rimecud.2 Worm.Win32.A.P2P-Palevo.649216 HEUR/Fakon.mwf W32/Autorun.worm.bcf Worm.AutoRun Trojan.Dropper Win32/AutoRun.Delf.DK Trojan.Kryptik!Od8vCev28v4 Trojan.Win32.DNSChanger Trj/CI.A


A backdoor also known as: Trojan.Win32.FakeTool.eqvbgr Trojan.Strictor.D13D9C Riskware.HackTool!mJNDS6pSVDk HackTool.Win32.FakeHack


Stolen data is stored in external storage under the /DCIM/ directory with a hidden sub-directory named " .dat '' .


In this report, Trend Micro and ClearSky expose a vast espionage apparatus spanning the entire time the group has been active.


the first of a new wave of malspam.


It ’ s worth noting , newer versions of the DroidVPN app are available on Google Play , as well as in some other third-party app stores , which could indicate uyghurapps [ .


MacSpy is advertised as the most sophisticated Mac spyware ever with the low starting price of free.


However, they do deploy some novel tactics, detailed below, and the implications of these attacks could be significant.


A backdoor also known as: W32.RsRabND.Worm Trojan.Ransom.BUY Trojan.Ransom.BUY Ransom.BadRabbit Win32.Trojan.Ransom.b Ransom_BADRABBIT.SM Win.Ransomware.BadRabbit-6355462-2 Trojan.Ransom.BUY Trojan-Ransom.Win32.BadRabbit.e Trojan.Ransom.BUY Trojan.Win32.BadRabbit.euhxbd Trojan.Win32.Ransom.441899 Trojan.Ransom.BUY Trojan.BadRabbit.2 Ransom_BADRABBIT.SM BehavesLike.Win32.Malware.gc Trojan.Win32.Diskcoder Trojan.BadRabbit.d TR/Dropper.uobxc Trojan.Ransom.BUY Trojan-Ransom.Win32.BadRabbit.e Trojan/Win32.Diskcoder.R211512 Trojan-Ransom.BadRabbit Trj/CI.A Trojan.Badrabbit Win32/Diskcoder.D Trojan.Diskcoder! ransom.BadRabbit Win32/Trojan.RansomBadRabbit.E


We actually track samples of Winnti malware all the time, but so far we haven't been able to catch one with solid clues indicating other targeted industries.


A backdoor also known as: TR/Drop.Hirin.B PWS:MSIL/Parple.B PWS.MSIL Trj/CI.A


Google's Threat Analysis Group TAG recently discovered usage of an unpatched security bypass in Microsoft's SmartScreen security feature, which financially motivated actors are using to deliver the Magniber ransomware without any security warnings.


A backdoor also known as: Hacktool.Gamehack Trojan.Packed.Win32.57174 Win32.Packed.VMProtect.a HT_GAMEHACK_GH01014A.UVPM HT_GAMEHACK_GH01014A.UVPM Trojan.VMProtect!


Few details were given and no hashes were available, which made it interesting to find samples and conduct an initial analysis.


The InterceptCall receiver is triggered whenever there is an incoming or outgoing call .


Given its age, it might seem logical that security controls would have this threat on lockdown.


A backdoor also known as: Trojan.Win32.Clicker!BT Win32.Trojan.Wowlik.a W32/Trojan.AKEF-2737 Trojan.Win32.Graftor.espyif Win32.Trojan.Graftor.Llrb TrojWare.Win32.Wowlik.BE Trojan.DownLoader11.55853 Trojan.Graftor.D26FB7 TrojanClicker:Win32/Spackit.A Trojan.Win32.Clicker!BT Trj/CI.A Win32/Trojan.55a


By proxying all requests through a custom server , the real source of ads is opaque .


What's particularly interesting is that the malware that was used this time is not BlackEnergy, which poses further questions about the perpetrators behind the ongoing operation.


A backdoor also known as: W97m.Downloader.EMU W97M.Downloader.MF W97M/Dropper.cp Troj.Dropper.Msword!c Trojan.Mdropper W2KM_DROPPR.CSYH W97m.Downloader.EMU W97m.Downloader.EMU W97m.Downloader.EMU Trojan:W97M/Nastjencro.A W97M.MulDrop.142 W2KM_DROPPR.CSYH W97M/Dropper.cp W97m.Downloader.EMU W97m.Downloader.EMU OLE.Win32.Macro.700400 virus.office.obfuscated.5


The choice of a particular payload is determined by the implant ’ s version , and it can be downloaded from the command and control ( C & C ) server soon after the implant starts , or after a specific command .


The version number was bumped to 1.6.2a.


Seeing that the developer did not take any measures to protect his identity , it seems likely that his intentions weren ’ t dishonest at first – and this is also supported by the fact that not all his published apps contained unwanted ads .


The core malware ’ s icon is hidden .


Our research points to centralized planning and development by one or more advanced persistent threat APT actors.


SpyNote RAT was designed to function only over Wi-Fi , which is the preferable mode for Android malware to send files to C & C .


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G W32/Virut.AM Win32/Virut.17408 PE_VIRUX.R Win32.Virus.Virut.U Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg W32.Virut.lqR9 Win32.Virut.56 Virus.Virut.Win32.1938 PE_VIRUX.R BehavesLike.Win32.VBObfus.dc W32/Virut.AM Win32/Virut.bt Virus/Win32.Virut.ce Win32.Virut.dd.368640 Virus.Win32.Virut.ce Win32/Virut.F Win32/Virut.NBP W32/Virut.CE Virus.Virut.14 W32/Sality.AO Virus.Win32.VirutChangeEntry.A


A backdoor also known as: W32.LionumD.Trojan Trojan.Injector.AF Trojan-Spy.Win32.Zbot!O Trojan.CoinMiner.Win32.82 Trojan.Injector.AF Trojan.Win32.Delf.bkqgta Trojan.Injector.AF Trojan.DownLoader7.62911 Trojan/Win32.Miner TrojanDownloader:Win32/Hoptto.B Trojan.Injector.AF Trojan.Injector.AF Trojan.Injector.AF Virus.Win32.DelfInject


Research reports on the adversary are published from LAC SecureWorks and Palo Alto Networks


The malware has all the popular capabilities of modern spyware .


A backdoor also known as: HW32.Packed.50FA Trojan.Win32.Pakes.miu Trojan.Symmi.D62C5 Trojan.Win32.Bepiv TR/Drop.RKit.CM Backdoor:WinNT/Tofsee.A.dr


The Root of All ( Android ) Evil So how does TrickMo get around these security features ? It abuses accessibility services .


The description in Portuguese promises more protection for the user ’ s applications , including end-to-end encryption .


A recent research by Check Point Research shows how voice phishing can be used to infiltrate the South Korean banking sector and extract private data from the victim's mobile device, and how to prevent it.


Following is the HTTP response from the C2 server , containing the encrypted configuration : EventBot Encrypted HTTP response returned from the C2 Encrypted HTTP response returned from the C2 .


In addition , the malware can log in to the attacker ’ s email inbox , parse emails in a special folder for commands and save any payloads to a device from email attachments .


The malware goes to great lengths to identify a total of 24 potential security products that may be running on a system and customizes its installation mechanism to specifically evade those that are installed.


A backdoor also known as: Trojan.PWS.ZIY Trojan-PSW.Win32.Tepfer!O Trojan.Fareit.S467850 Trojan.Tepfer.Win32.85789 Trojan/Fareit.a Trojan.PWS.ZIY Win32.Trojan-PSW.Fareit.a Win32/PSW.Fareit.A BKDR_PONY.SM Win.Trojan.Fareit-403 Trojan.PWS.ZIY Trojan.Win32.Tepfer.dnnwuu Trojan.PWS.ZIY TrojWare.Win32.PWS.Fareit.GS Trojan.PWS.ZIY Trojan.PWS.Stealer.1932 BKDR_PONY.SM BehavesLike.Win32.ZBot.nh W32.Tepfer TR/PSW.Fareit.iloen Trojan[PSW]/Win32.Tepfer Trojan.Win32.PSW-Tepfer.92672 Trojan/Win32.Tepfer.R50650 Trojan.PWS.ZIY BScope.Malware-Cryptor.Ponik Spyware.Pony Trj/Tepfer.D Trojan.Fareit Win32.Outbreak Win32.Trojan-Stealer.Zbot.AB Win32/Trojan.PSW.5cd


These factors , in combination with the fact that the command and control infrastructure used by Frozen Cell and Desert Scorpion resides in similar IP blocks , supports the theory that the same actor is responsible for operating , if not developing , both families .


Figure 7 .


“ Agent Smith ” is possibly the first campaign seen that ingrates and weaponized all these loopholes and are described in detail below .


A backdoor also known as: TSPY_DOWNLOADER_DD300501.UVPA Win32.Trojan.WisdomEyes.16070401.9500.9967 Infostealer.Donx TSPY_DOWNLOADER_DD300501.UVPA Trojan.Win32.VB.ckqm Trojan.VB.Win32.119679 BehavesLike.Win32.Sality.dm Worm.Win32.VB Trojan/VB.cvqf Trojan/Win32.VB Worm:Win32/Vberaspul.A Trojan.Heur.RX.E04E5F Trojan.Win32.VB.ckqm Trojan/Win32.VB.R85915 Trojan.VB Win32/AutoRun.VB.BDA Trojan.VB!nw7hcYRbBc8


] comlila-tournai [ .


A backdoor also known as: TROJ_CLICKER.API W32/Trojan.HUCV-9091 TROJ_CLICKER.API Win.Trojan.Clicker-2623 Trojan.Win32.Click.ddmsji W32/Trojan2.GMLR Adware/Clicker.hjb TrojanDownloader:Win32/Valfroc.A Win32.Trojan.Clicker.Tbip W32/CLICKER.API!tr Win32/Trojan.Multi.daf


Additionally , rootdaemon attempts to remove its own power usage statistics from Huawei phones ' SystemManager : Similarly , the malicious application probably attempts to minimize traces on Samsung phones by adding to the file /data/data/com.samsung.android.securitylogagent/shared_prefs/apm_sp_status_of_apps.xml the following lines : And adding to the file /data/data/com.samsung.android.securitylogagent/shared_prefs/com.samsung.android.securitylogagent_preferences.xml these lines instead : Data Collection and Exfiltration As mentioned , mike.jar equips the spyware with extensive collection capabilities , including : Retrieve a list of installed applications .


In light of this , we believe an attack against unpatched vulnerabilities is a reasonable conjecture for how the server was compromised .


Seeing this type of activity typically indicates that a particular ransomware will see much wider distribution and thus a larger amount of victims.


A backdoor also known as: Trojan-Downloader.Win32.LibPatcher!O W32/Trojan.KFBA-3961 Trojan.KillAV Win32/KillAV.EA RTKT_BUREY.C TrojWare.Win32.AntiAV.~B Trojan.MulDrop.30985 Downloader.LibPatcher.Win32.272 RTKT_BUREY.C BehavesLike.Win32.Backdoor.mc W32/Dldr.Age.41984.C Trojan[Downloader]/Win32.LibPatcher Trojan:Win32/Perkesh.A Trojan/Win32.KillAV.R5311 Win32.Trojan-downloader.Libpatcher.Dumk Trojan-Downloader.Win32.Perkesh W32/Perkesh.A!tr Win32/Virus.81b


A backdoor also known as: W32.CKTNum.Trojan Virus.Win32.VB!O Virus.VB.Win32.90 W32.W.Mabezat.kZb9 Trojan.Heur.E2A0A7 Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Worm.EJIG-5497 Trojan.Killfiles Win32/Disackt.B TROJ_VB.BHC Trojan.Win32.VB.mrc Virus.Win32.VB.bcfhqp Win32.Trojan.Vb.Eddp TrojWare.Win32.VB.AMN TROJ_VB.BHC BehavesLike.Win32.Downloader.mz W32/Worm.AWSI Virus.VB.bc W32/Overwriter.A Worm:Win32/Disackt.A Trojan.Win32.VB.mrc TScope.Trojan.VB Win32/VB.AMN Trojan.VB!eJU5EBjve4c Virus.Win32.VB W32/VB.AMN!tr Trj/CI.A


A backdoor also known as: Trojan/W32.Small.49152.AYF Trojan.Dofoil.A Trojan/Kryptik.vgb Win32.Trojan.WisdomEyes.16070401.9500.9963 W32/Trojan.QQGJ-6488 Trojan.Win32.ULPM.eszgb Trojan.Yakes.Win32.1447 BehavesLike.Win32.Conficker.pc Trojan-Dropper.Win32.Injector W32/Kryptik.VIA!tr Trojan.Kazy.DABAF TrojanDropper:Win32/Finkmilt.C Trojan/Win32.Yakes.C144665 BScope.Trojan.Jorik.1421 Trojan.Kryptik!Y5cjjPIzRWk Bck/Qbot.AO Win32/Trojan.aeb


At the end of December 2015, the network system of Ukrainian power companies was attacked by


Stage 6 : The payload is a modular spyware framework for further analysis Our journey to deobfuscating FinFisher has allowed us to uncover the complex anti-analysis techniques used by this malware , as well as to use this intel to protect our customers , which is our top priority .


A backdoor also known as: W32/Socks.agz Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/Trojan2.BFTZ HT_PHDET_FD042CB0.UVPM Trojan.Win32.Socks.utqwi Trojan.MulDrop7.51577 HT_PHDET_FD042CB0.UVPM BehavesLike.Win32.Dropper.jc W32/Trojan.NOBV-3130 TrojanDownloader.Small.sui Worm/Win32.Socks Trojan:Win32/Phdet.E Worm.Win32.A.Socks.93017 SScope.Worm.Socks.afv Worm.Socks!GMlFK48cpa8 W32/Kryptik.BD!tr Win32/Trojan.e0b


Recently, WeipTech was analyzing suspicious Apple iOS tweaks reported by users and found over 225,000 valid Apple accounts with passwords stored on a server.


A backdoor also known as: W32.HfsAutoB.D676 Win32.Trojan.WisdomEyes.16070401.9500.9591 TR/Drop.Delfsnif.pmkbu TrojanDropper:Win32/Delfsnif.A


A backdoor also known as: Trojan-Dropper.Win32.AphexLace!O TrojanDropper.AphexLace Dropper.AphexLace.Win32.1 Troj.W32.Inject!c Trojan/Dropper.AphexLace.b Trojan.Heur.EA2D6B TROJ_APHEXLACE.D Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Dropper.IHO Trojan.Dropper TROJ_APHEXLACE.D Trojan.Win32.Inject.vgog Trojan.Win32.AphexLace.glqv Dropper.AphexLace.17920 TrojWare.Win32.TrojanDropper.AphexLace.B Trojan.MulDrop.12656 Trojan-Dropper.Win32.Delf W32/Risk.JBWO-6048 TrojanDropper.AphexLace.b TR/Drop.AphexLace.B Trojan[Dropper]/Win32.Poisoner TrojanDropper:Win32/AphexLace.B Trojan.Win32.Inject.vgog Dropper/Win32.Xema.C57521 TrojanDropper.Poisoner Win32/TrojanDropper.AphexLace.B Win32.Trojan.Inject.Dypn Trojan.DR.AphexLace!M08TVuH6+oM


The best bet for Readers who want to make sure their phone is n't infected is to scan their phones using the free version of the Lookout Security and Antivirus app .


Indicators related to the Sundown Exploit Kit


CopyCat is a fully developed malware with vast capabilities, including elevating privileges to root, establishing persistency, and to top it all - injecting code into Zygote.


A backdoor also known as: HW32.Packed.D9E5 TrojanSpy.Zbot Spyware.LokiBot Win.Packer.VbPack-0-6334882-0 Trojan-Spy.Win32.Zbot.yjsw Trojan.Win32.Zbot.etexpw Trojan.Win32.Z.Zbot.1081344 Trojan.PWS.Panda.12377 Trojan.Zbot.Win32.204854 BehavesLike.Win32.Fareit.tc Trojan.Win32.Injector TrojanSpy.Zbot.fkpq TR/AD.Zbot.cxjcv Trojan[Spy]/Win32.Zbot Trojan.Symmi.D1360F Trojan-Spy.Win32.Zbot.yjsw Trojan:Win32/Dukrid.A!bit Spyware/Win32.Zbot.R210148 TScope.Trojan.VB Trj/GdSda.A Win32.Trojan-spy.Zbot.Lqer TrojanSpy.Zbot!AasFtIJIGGs W32/Zbot.YJSW!tr Win32/Trojan.BO.553


The WordPress.org team has intervened and removed the plugin from the official WordPress Plugins repository.


It is likely these spearphishes are generated via a builder - so attribution to an exact group of attackers may be incorrect.


SimBad : A Rogue Adware Campaign On Google Play March 13 , 2019 Check Point researchers from the Mobile Threat Team have discovered a new adware campaign on the Google Play Store .


This campaign was found to be connected to the same party which previously targeted Vietnam Airlines and some other high profile targets possibly led by the Chinese 1937CN group.


A backdoor also known as: I-Worm.Stator.A Worm/W32.Stator.62976 Email-Worm.Win32.Stator!O W32.Stator.A Worm.Stator.Win32.3 W32/Stator.worm I-Worm.Stator.A W32/Stator.A W32.Stator@mm Win32/Stator.62464.A WORM_STATOR.A Win.Worm.Stator-1 I-Worm.Stator.A Email-Worm.Win32.Stator.a I-Worm.Stator.A Trojan.Win32.Stator.jahi I-Worm.Win32.Stator I-Worm.Stator.A EmailWorm.Win32.Stator.a0 I-Worm.Stator.A Win32.HLLW.Plict WORM_STATOR.A BehavesLike.Win32.Downloader.kc Email-Worm.Win32.Stator.a W32/Stator.A I-Worm/Stator.a Worm[Email]/Win32.Stator Worm:Win32/Stator.A@mm Email-Worm.Win32.Stator.a Trojan/Win32.HDC.C40377 I-Worm.Stator.A Win32.HLLW.Stator.A I-Worm.Stator.62464 Win32/Stator.62464 Win32.Stator.B W32/Stator.A


Talos assess with high confidence that this campaign is targeting Australian financial institutions based on several factors .


encrypt its APK and shell code,


It looked like a typical backdoor that could be uploaded anywhere on a compromised server, not just in this particular plugin.


Emissary is related to the Elise Trojan and the Operation Lotus Blossom attack campaign, which prompted us to start collecting additional samples of Emissary.


The authors are trying to latch onto the popularity of the Super Mario Run game to target eagerly waiting Android users .


This trojan 's design and implementation is of an uncommonly high level , making it a dangerous threat .


To quote the original article: It could be through attachments in spam messages, downloads from untrusted websites or something else.


The spyware in this analysis was portraying itself as the Netflix app .


Command Action Unistxcr Restart the app dowsizetr Send the file stored in the /sdcard/DCIM/.dat/ directory to the C & C server Caspylistx Get a list of all hidden files in the /DCIM/.dat/ directory spxcheck Check whether call details are collected by the spyware S8p8y0 Delete call details stored by the spyware screXmex Take screenshots of the device screen Batrxiops Check battery status L4oclOCMAWS Fetch the victim 's location GUIFXB Launch the fake Facebook login page IODBSSUEEZ Send a file containing stolen Facebook credentials to the C & C server FdelSRRT Delete files containing stolen Facebook credentials chkstzeaw Launch Facebook LUNAPXER Launch apps according to the package name sent by the C & C server Gapxplister Get a list of all installed applications DOTRall8xxe Zip all the stolen files and store in the /DCIM/.dat/ directory Acouxacour Get a list of accounts on the victim 's device Fimxmiisx Open the camera Scxreexcv4 Capture an image micmokmi8x Capture audio Yufsssp Get latitude and longitude GExCaalsss7 Get call logs PHOCAs7 Call phone numbers sent by the C & C server Gxextsxms Get a list of inbox SMS messages Msppossag Send SMS with message body sent by the C & C server Getconstactx Get a list of all contacts Rinxgosa Play a ringtone bithsssp64 Execute commands sent by the C & C server DOWdeletx Deletes the file specified by the C & C server Deldatall8 Delete all files stored in the /sdcard/DCIM/.dat/ directory We do n't have the space to cover all of the commands , but let 's take a look at some of the major ones .


If any of these conditions is true , the application does not continue to execute the malicious flow .


It has been the subject of many analysis reports, including those describing targeted espionage campaigns like Operation Night Dragon and the GhostNet attacks on Tibet.


A backdoor also known as: Trojan.Miner Troj.W32.Miner!c Trojan.MulDrop7.60223 TR/Muldrop.jzijj Trojan.Win32.Miner.tjvn


The threat actor's campaigns attempt to convince high-profile North American and European government officials as well as CEOs of prominent companies and celebrities into participating in recorded phone calls or video chats.


The earliest evidence obtained shows it has been in use since at least November 2016.


The hash listed in the Pastebin led us to a malicious Word document that had also been uploaded to a public sandbox.


Similarly to another Android spyware made in Italy , originally discovered by Lukas Stefanko and later named Skygofree and analyzed in depth by Kaspersky Labs , Exodus also takes advantage of " protectedapps '' , a feature in Huawei phones that allows to configure power-saving options for running applications .


At the time of writing we had no evidence of an exploit being used to obtain root privileges , though it is possible that the attackers used some unseen component to implement this feature .


] 91 2020-03-04 http : //ora.carlaarrabitoarchitetto [ .


] com ’ as an ad-related SDK .


Aside from the credential stealing , this malware also includes features like the theft of users ' contact list , collecting phone numbers associated names , and files and photos on the device .


A backdoor also known as: Ransom/W32.Locky.48128 Exploit.Cve20151701 Win32.Trojan.WisdomEyes.16070401.9500.9999 Exploit.Win32.CVE-2015-1701.bd Exploit.Win32.CVE20151701.euekja Trojan.Win32.LockCrypt.48128.A Trojan.Encoder.12135 BehavesLike.Win32.Mydoom.pm W32/Trojan.JPLA-3344 Exploit.CVE-2015-1701.ar TR/AD.RansomHeur.fbqvj Exploit.W32.Cve!c Exploit.Win32.CVE-2015-1701.bd Ransom:Win32/LockCrypt.A!bit Trojan/Win32.Scar.R211760 Exploit.CVE-2015-1701 Ransom.DXXD Trj/GdSda.A Trojan.Win32.Filecoder Win32.Trojan-Ransom.LockCrypt.A Win32/Trojan.Exploit.3d9


This is exactly what we saw in late October and early November 2016, when the espionage group Pawn Storm also known as Fancy Bear, APT28, Sofacy, and STRONTIUM ramped up its spear-phishing campaigns against various governments and embassies around the world.


A backdoor also known as: Virus.Win32!O W32.Etap W32/Etap.dr Win32.Trojan.WisdomEyes.16070401.9500.9929 W32.Simile Virus.Win32.Etap Win32.Etap.E Win32/Linux.Etap W32/Etap.dr Virus.Win32.Etap Backdoor/Hupigon.ish Virus/Win32.Etap Trojan.Kazy.D65E9 Virus.Win32.Etap Backdoor:Win32/Etap.dr Win32/Etap.E W32/Etap.D


Furthermore, each of the stages used different development platform and was obfuscated in a different way.


Rather than simply copying the features that were present within the Zeus trojan as-is Floki Bot claims to feature several new capabilities making it an attractive tool for criminals.


A backdoor also known as: Worm/W32.Silva.447488 Worm.Keco W32.W.Silva.d!c W32/Silva.d W32/Silva.D W32.Silva@mm Trojan.Win32.Silva.envq Worm.Win32.Silva.D Win32.HLLW.Silva Worm.Win32.Silva W32/Silva.QGXV-8360 I-Worm/Silva.d Worm:Win32/Silva.D@mm Worm:Win32/Silva.D@mm Email-Worm.Keco W32/Keco.G.worm Win32/Silva.D Win32.Worm-email.Keco.Peze I-Worm.Silva!97fYr5ijFvQ W32/Silva.D@mm


Below are a couple of images of the panel that the attacker would be utilizing.


A backdoor also known as: Trojan.BHO.Delf.T Trojan.Win32.Delf!O Trojan.Lnkhyd.A7 Trojan.Delf.Win32.15794 Troj.W32.Delf.lV2h Win32/Delf.AXIT TROJ_DELF.PVC Win.Trojan.Delf-11211 Trojan.BHO.Delf.T Trojan.Win32.Delf.ssh Trojan.BHO.Delf.T Trojan.Win32.Delf.cjzwb Trojan.Win32.Delf.157696.J Trojan.BHO.Delf.T TROJ_DELF.PVC Trojan.Lnkhyd Trojan/Delf.mdz Trojan:Win32/Lnkhyd.A Trojan/Win32.Delf Trojan.BHO.Delf.T Trojan.Win32.Delf.ssh Trojan:Win32/Lnkhyd.A Trojan/Win32.Fides.R3508 Trojan.BHO.Delf.T TScope.Trojan.Delf Win32.Trojan.Delf.Ednr Trojan.Win32.BHO.R


Interaction with these servers is performed in two different threads.


The samples sharing this overlap are modified versions of an open source Jabber/XMPP client called “ Conversations ” with some code additions .


They use compromised e-mail accounts to distribute their malware widely and their targeting appears opportunistic rather than specific.


A backdoor also known as: PUP.Riskware.Tool Trojan.Win32.Cindyc.wrlqe TR/DyCode.A.110 Backdoor/Cindyc.bv Win32.Troj.Undef.kcloud Trojan:Win32/DyCode.A Backdoor.Win32.A.Cindyc.141184 Backdoor/Win32.Cindyc Backdoor.Cindyc.adk Backdoor.Win32.Cindyc Trj/CI.A


] com csip6 [ .


Credit card industry giant Visa on Friday issued a security alert warning companies using point-of-sale devices made by Oracle s MICROS retail unit to double-check the machines for malicious software or unusual network activity, and to change passwords on the devices.


The dropper family, referred to internally as PNG_dropper, was observed being used as a second stage tool in different targeted attacks.


A backdoor also known as: Trojan.StartPageCRTD.Win32.8798 Win32.Trojan.WisdomEyes.16070401.9500.9990 Trojan.Win32.Clicker!BT Trojan.MSIL.EzirizNetReactor TR/Dropper.MSIL.76348 TrojanClicker:MSIL/Balamid.B Trojan.Jatif.32 Trojan/Win32.FakeMS.R113384 Trojan.Win32.Clicker!BT Win32/Trojan.Dropper.2f1


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9589 TROJ_DELF.IVW Trojan-Downloader.Win32.Delf.acc Troj.Downloader.W32.Delf!c Win32.Trojan-downloader.Delf.Edoh TrojWare.Win32.TrojanDownloader.Delf.~ABI Trojan.DownLoader.46506 Trojan-Downloader.Win32.Delf.ACC TrojanDownloader.Delf.fqq Trojan[Downloader]/Win32.Delf Win32.TrojDownloader.Delf.ac.kcloud Trojan.Downloader.bGWcaOz2KakG Trojan.Win32.A.Downloader.34816.FA Trojan-Downloader.Win32.Delf.acc Trj/Banbra.FSU Win32/Trojan.Downloader.dac


Malicious app com.qualcmm.timeservices As I mentioned before , in the “ initial phase ” , the Trojan will install the “ com.qualcmm.timeservices ” app .


It does this by leveraging the Android plugin technology.


That creates a fake ID that allows the perpetrators to generate referral revenues .


HenBox : The Chickens Come Home to Roost March 13 , 2018 at 5:00 AM Unit 42 recently discovered a new Android malware family we named “ HenBox ” masquerading as a variety of legitimate Android apps .


Trojan Ransom Xpan was created by an organized gang, which used targeted attacks via RDP that abused weak passwords and wrong implementations.


The operators have used use a range of techniques to target Windows computers and Android phones with the apparent goal of penetrating the computers of well-connected individuals in the Syrian opposition.


On the network traffic analysis end, post compromise activity results in some interesting but not unexpected activity.


Based on this evidence we believe this new malware is likely targeting South Koreans.


A series of malware attacks targeting users of cryptocurrency wallets has been identified by security firm Kaspersky, which has developed an anti-malware solution to detect and prevent such attacks in the future.


A backdoor also known as: Virus/W32.Patched.P W32.Patched.QC1 Trojan.Razy.D19982 PE_PATCHED.SMB Win32.Trojan.ImPatch.a W32/Floxif.A PE_PATCHED.SMB Trojan.Win32.Patched.qc Troj.W32.Patched.lnCt Trojan.Starter.3187 W32/Floxif.A Trojan.Win32.Patched.qc Trojan.Patched.al W32/Patched.AL Virus.Win32.Loader.abd Trojan.Win32.Patched W32/Patched.AL!tr Virus.Win32.Patched.DG


The name of the folder and the malware configuration are read from a customized configuration file stored in the resource section of the setup program .


There the user is prompted to download and install a Trojan imitating an Adobe Flash Player update .


In our research , we focus on the most recent sample , an application dubbed as " Golden Cup '' , launched just before the start of World Cup 2018 .


A backdoor also known as: W32.OnGamesGBTOFAB.Trojan Trojan-Dropper.Win32.Dapato!O Trojan/Vilsel.bftr Trojan-Dropper.Win32.Dapato.bzqh Trojan.Win32.Vilsel.dktcmg Trojan.Vilsel.Win32.24133 Trojan-PWS.Win32.QQPass TrojanDropper.Dapato.jop Trojan/Win32.Vilsel Win32.Troj.Vilsel.kcloud Trojan-Dropper.Win32.Dapato.bzqh Trojan.Vilsel


The first timer will be fired on the configured interval ( 20 seconds in this case ) , pinging the command and control ( C2 ) server .


Our intelligence shows “ Agent Smith ” droppers proliferate through third-party app store “ 9Apps ” , a UC team backed store , targeted mostly at Indian ( Hindi ) , Arabic , and Indonesian users .


For now , that is the only way how cybercriminals can profit from Triada , but don ’ t forget that it ’ s a modular Trojan , so it can be turned into literally everything on one command from the C & C server .


Most users are pushing a variety of information stealers with the service.


Rooting and Ad Network Presentation The reflection loaded methods check if the device is rooted .


This command is used to connect the victim to a Wi-Fi network controlled by the cybercriminals to perform traffic sniffing and man-in-the-middle ( MitM ) attacks .


This data shows a distinct concentration of infected devices beaconing from Gaza , Palestine .


First, users cannot easily spot any malicious behavior since PowerShell runs in the background.


We found no similarities to commercial spyware products or to other known spyware variants , which suggests BusyGasper is self-developed and used by a single threat actor .


root9B's analysis determined that the adversary is using advanced memory-resident techniques to maintain persistence and avoid detection.


The malware has a remote controlling function, and attackers sending these emails seem to attempt intruding into the targets' network using the malware.


Usually they would upload a clean version back on Google Play the very same day .


A backdoor also known as: Virus.Win32.Sality!O Ransom.Exxroute.A3 Trojan.Kryptik.Win32.1099877 Troj.Downloader.W32.Banload.l42y Ransom_CERBER.SM3B Win32.Trojan.Kryptik.bjm W32/Trojan.FUEH-0857 Backdoor.Trojan Ransom_CERBER.SM3B Trojan.Encoder.10103 BehavesLike.Win32.Cutwail.ph Trojan.Spora.mw TR/AD.Spora.svton Trojan[Ransom]/Win32.Spora Trojan.Symmi.DB88E Ransom:Win32/Spora.A Hoax.Spora Virus.Win32.VBInject


A backdoor also known as: BKDR_PIRPI.YE Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan BKDR_PIRPI.YE Trojan.Heur.LP.E69C7F Trojan:Win32/Pirpi.O Win32.Backdoor.Backdoor.Hwmn Win32/Trojan.9b5


The SMS message with a link to a banker looked as follows : “ % USERNAME % , i send you prepayment gumtree [ .


Called “ DEFENSOR ID ” , the banking trojan was available on Google Play at the time of the analysis .


A backdoor also known as: TSPY_MAJIKPOS.SMA Trojan.Majikpos TSPY_MAJIKPOS.SMA Trojan.DownLoader23.50404 W32/Trojan.QKOU-4044 Trojan.MSIL.Krypt.2 TrojanSpy:MSIL/Majikpos.A Spyware/Win32.Majikpos.C1861368 Trj/GdSda.A PUA.BrowseSmart Win32/Trojan.d60


The DragonOK group has been actively launching attacks for years.


non-Google Play ) app stores which often have fewer security and vetting procedures for the apps they host .


The infrastructure has several layers , although not being very dynamic , still has several layers each one providing some level of protection .


A backdoor also known as: W32.OnGameMITL.Trojan RDN/Downloader.a!vq Win32.Trojan.WisdomEyes.16070401.9500.9883 Trojan.FakeAV Trojan.DownLoad.41552 BehavesLike.Win32.Backdoor.ch Trojan.Win32.Redosdru Trojan/PSW.WOW.amc TrojanDownloader:Win32/Induiba.A Trojan.Heur.RP.EEBC2E Trj/CI.A


By analyzing the TaskManager class we can see the new commands that are supported at this stage : As can be seen in the code snippet above , there are quite a lot of data collection tasks that are now available : Collect device info Track location Upload contacts information Upload sent and received SMS messages Upload images Upload video files Send recursive dirlist of the external storage Upload specific files Record audio using the microphone Record calls Use the camera to capture bursts of snapshots Those tasks can either run periodically , on event ( such as incoming call ) or when getting a command from the C & C server .


A backdoor also known as: Trojan.Win32.Kargatroj!O Trojan.Kargatroj.Win32.5 BKDR_DEPPEELS.A Win32.Trojan.WisdomEyes.16070401.9500.9993 W32/Trojan.FYPB-4329 Backdoor.Kargatroj BKDR_DEPPEELS.A Win.Trojan.Kargatroj-5 Trojan.Win32.Kargatroj.a Trojan.Win32.Kargatroj.zribt Trojan.Win32.A.Kargatroj.288256 Trojan.Click2.18984 BehavesLike.Win32.Virus.dh Backdoor.Win32.IRCBot Trojan/Kargatroj.e WORM/Autorun.Agr.3 Trojan/Win32.Kargatroj Backdoor:Win32/Deppeels.A Trojan.Win32.Kargatroj.a Trojan/Win32.Kargatroj.R50492 Trojan.Kargatroj Trojan.Kargatroj!+VQ4l8zO8kI


We refer to this utility as BOOTRASH.


Security analysts are typically equipped with the tools to defeat a good number of similar tricks during malware investigations .


A backdoor also known as: W32.W.Fujack.lmEa Trojan.Dropper Win.Trojan.Packed-24 Trojan.Win32.Baidu.iidnc Trojan.Win32.A.PSW-Magania.1913020.A Trojan/Win32.Zegost Trojan.Zusy.D88F TrojanDropper:Win32/Demekaf.A Trojan.MalPack.NSPack Win32/TrojanDropper.Demekaf.A Trojan.Win32.Jorik W32/Obfuscated.AAAD!tr Win32/Trojan.4b9


The Check Point researchers have dubbed the malware family " HummingBad , '' but researchers from mobile security company Lookout say HummingBad is in fact Shedun , a family of auto-rooting malware that came to light last November and had already infected a large number of devices .


We believe that it is the largest Google account breach to date , and we are working with Google to continue the investigation .


In most so-called Western versions of the Trojan , the package names in the default configuration file are erased .


A backdoor also known as: Trojan-Dropper/W32.Hirhir.2779437 TrojanDropper.Hirhir.20 Trojan/Dropper.Hirhir.20 Trojan-Dropper.Win32.Hirhir.20 Win32/TrojanDropper.Hirhir.20 W32/Hirhir.A Trojan.Dropper W32/Smalldrp.BTL Win32.Dropper.Hirhir Trojan.Dropper-1156 Trojan-Dropper.Win32.Hirhir.20 Trojan.Dropper.Hirhir.2.0 TrojWare.Win32.TrojanDropper.Hirhir.20 Trojan.Dropper.Hirhir.2.0 Trojan.MulDrop.1734 TR/Drop.Hirhir.20.5 TROJ_HIRHIR.20 Trojan.Drop.Hirhir.20.5 Win32/DigitalM.10 W32/Hirhir.A TrojanDropper.Dmexeb.10 Trojan-Dropper.Win32.Hirhir.20!IK TrojanDropper:Win32/Hirhir.2_0 Trojan.Win32.Hirhir.2164429 Trojan.Dropper.Hirhir.2.0 Dropper/Hirhir.11776 Win32.TrojanDropper.Hirhir.20 Trojan.DR.Hirhir.H Trojan.Dmexeb.10 Trojan-Dropper.Win32.Hirhir.20 W32/Hirhir.A!tr.dr Dropper.Hirhir Trj/Hirhir.A


delivery : to deliver specified text to all victim ’ s contacts ( SMS worming ) .


Configuration file received from the C & C server As for stealth and resilience , the attacker uses a number of tricks .


Figure 6 .


A backdoor also known as: W32.FamVT.ExpiroPC.PE TROJ_ZYX_BK083A77.TOMC Heur.Corrupt.PE TROJ_ZYX_BK083A77.TOMC Trojan-Downloader.Win32.Vorloma TrojanDownloader:Win32/Vorloma.A


This very first step fails in Android 7.0 and higher , even with a root permission .


A backdoor also known as: PE:Trojan.Win32.Xcomp.a!1075128424 Heur.Packed.MultiPacked DDoS.Rincux Backdoor.Httpbot.Win32.799 BehavesLike.Win32.Trojan.cz Backdoor:Win32/Luder.H Trojan/Win32.Injector Virus.Win32.Heur.c Trj/CI.A Packed.Win32.PolyCrypt Trojan.Win32.Downloader.aC


The specific points of connection between these new samples and Operation Blockbuster include: payloads delivered by the macros discussed in Operation Blockbuster Sequel


A backdoor also known as: Trojan.ADH.2 Win.Trojan.Mediyes-1761 Trojan.Hosts.5806 Trojan.VBCRTD.Win32.7945 Trojan:Win32/Mediyes.C Trojan.Pirminay Trojan.Win32.Mediyes


A backdoor also known as: Backdoor.Aimaster.A Backdoor/W32.Aimaster.49152 Backdoor.Aimmaster Backdoor.RAT.Aimaster Backdoor.Trojan Win32/Aimaster.A BKDR_AIMASTER.A Win.Trojan.Aimaster-4 Backdoor.Win32.Aimaster Backdoor.Aimaster.A Trojan.Win32.Aimaster-Bd.fdhc Win32.Backdoor.Aimaster.Ahyt Backdoor.Aimaster.A Backdoor.Win32.Aimaster.A Backdoor.Aimaster.A BackDoor.Master.10 BackDoor-XT.svr W32/Risk.FHHV-3782 BDS/Aimaster.B W32/Aimaste.A!tr.bdr Trojan[Backdoor]/Win32.Aimaster Backdoor.Aimaster.A Backdoor.W32.Aimaster!c Backdoor.Win32.Aimaster Trojan/Win32.Aimaster.C662411 BackDoor-XT.svr Backdoor.Aimaster Backdoor.Aimaster!2o1TvHIl4Fg Backdoor.Aimaster.A Win32/Backdoor.IM.d95


The data available in the leaked Hacking Team files provides circumstantial evidence pointing to an interest in compromising individuals with ties to South Korea i.e., Korean language speakers who use software or apps popular in South Korea, or South Korean editions of Samsung phones.


A backdoor also known as: Backdoor/W32.Amitis.827392 Backdoor.Amitis!GgBFlh0m/G4 W32/Amitis.MXVV-8538 Backdoor.Amitis Win32/Amitis.13 BKDR_AMITIS.B Trojan.Amitis.13-B Backdoor.Win32.Amitis.13 Trojan.Win32.Amitis.dbhy Backdoor.Win32.S.Amitis.827392.A[h] Backdoor.W32.Amitis.13!c Backdoor.Win32.Amitis.13 BackDoor.Amitist.13 Backdoor.Amitis.Win32.17 BKDR_AMITIS.B BehavesLike.Win32.Downloader.ch W32/Amitis.N@bd Backdoor/Amitis.p W32/Amitis.C!tr Trojan[Backdoor]/Win32.Amitis Win-Trojan/Amitis.827392 Backdoor:Win32/Amitis.1_3 Win32/Amitis.13 Backdoor.Amitis Win32.Backdoor.Amitis.Akfc Backdoor.Win32.Amitis BackDoor.Amitis.G Backdoor.Win32.Amitis.13


A backdoor also known as: HackTool.Patcher Backdoor.RBot.Win32.54805 Troj.GameThief.W32.Magania.lHhM Multi.Threats.InArchive W32.Pilleuz Win.Worm.Mytob-399 Trojan.Win32.Rbot.bhwabq Heur.Packed.Unknown Win32.HLLW.MyBot.based Trojan[Backdoor]/Win32.Rbot Trojan/Win32.Malco.R7515 Trj/CI.A Win32.Viking.BJ Backdoor.Win32.Rbot


A backdoor also known as: Trojan.Win32.Mlw.ewdlbx TR/Dropper.lusig Trojan.Win32.Eightow Trj/CI.A


Though Orcus has all the typical features of RAT malware, it allows users to build custom plugins and also has a modular architecture for better management and scalability.


A backdoor also known as: Win32.Worm.SdDrop.C Worm.Sddrop W32/Sddrop.worm.c!p2p Win32.Worm.SdDrop.C Win32.Trojan.WisdomEyes.16070401.9500.9999 W32.Kwbot.Worm Unix.Tool.IRC-1 Win32.Worm.SdDrop.C P2P-Worm.Win32.SdDrop.c Win32.Worm.SdDrop.C Trojan.Win32.SdDrop.entp W32.W.SdDrop.c!c Win32.Worm.SdDrop.C Win32.Worm.SdDrop.C Win32.SdDrop.3 Worm.SdDrop.Win32.21 W32/Sddrop.worm.c!p2p Backdoor.Win32.SdBot I-Worm/P2P.SdDrop.c BDS/Sdbot.AA Worm[P2P]/Win32.SdDrop Worm:Win32/Sddrop.C P2P-Worm.Win32.SdDrop.c Trojan/Win32.HDC.C38855 Win32.Worm.SdDrop.C Backdoor.Sdbot Trj/CI.A Worm.SdDrop Win32/Sddrop.C Win32.Worm-p2p.Sddrop.Lknd Worm.P2P.SdDrop!LrfriCz8zKY W32/KWBot.E!worm


Recently, the FortiGuard Labs research team observed that a new variant of Poison Ivy was being spread through a compromised PowerPoint file.


Many victims have discussed YiSpecter infections of their jailbroken and non-jailbroken iPhones in online forums and have reported the activity to Apple.


This particular case is not an exception .


send funds via a wire transfer ) .


The campaign operated out of handful of IPs, but we ended up finding in excess of 80K malicious subdomains associated with more than 500 domains leveraging various registrant accounts.


A backdoor also known as: Udsdangerousobject.Multi TROJ_DLOADR.YLP TROJ_DLOADR.YLP Trojan.Win32.Dwn.dcbaru Trojan.Win32.Z.Tapaoux.49152 Trojan.DownLoader11.19325 W32/Trojan.FALA-2329 TR/Rogue.icdl Trojan.DownLoader! Trojan.Rogue


A backdoor also known as: Trojan.MSIL.Bladabindi.1 Win32.Trojan.WisdomEyes.16070401.9500.9922 Trojan.Win32.Bladabindi.etjjte Trojan.Win32.Z.Clicker.90624 Trojan.Win32.Clicker!BT BehavesLike.Win32.PWSZbot.mm Trojan.Win32.Clicker!BT Trj/Chgt.O Win32.Outbreak


The most popular member of the Android/AdDisplay.Ashas family on Google Play was “ Video downloader master ” with over five million downloads Ashas functionality All the apps provide the functionality they promise , besides working as adware .


If any application from that list was found , it utilizes the Janus vulnerability to inject the “ boot ” module into the repacked application .


The file size of the malware is mostly around ~50Kb, as you can see from the list of sample hashes at the end of this report.


C2 Communication The C2 communication includes two parts : sending information to the remote HTTP server and parsing the server ’ s response to execute any commands as instructed by the remote attackers .


For this purpose , the app receives from the C & C server the isGoogleIp flag , which indicates whether the IP address of the affected device falls within the range of known IP addresses for Google servers .


A backdoor also known as: W32.YahooPass.Spyware Backdoor.Win32.Bredavi!O Backdoor.Bredavi.Win32.215 Backdoor.W32.Bredavi.kYWA Backdoor/Bredavi.le Win32.Trojan-PSW.Yahoo.a Backdoor.Trojan Win32/Bredolab.PS Win.Trojan.Bredolab-1635 Trojan.Win32.Krap.ihir Backdoor.Win32.Bredavi.348960 Application.Win32.Adware.Superjuan.~JAJ Trojan.BhoSpy.97 Trojan.Win32.Glecia Backdoor/Bredavi.bf BDS/Glecia.A Trojan[Backdoor]/Win32.Bredavi Adware.Heur.E51E88 Trojan/Win32.Bredavi.C83160 Backdoor.Bredavi Trj/Sinowal.WNX Win32/PSW.YahooPass.NAD


A backdoor also known as: Email-Worm.Win32.Scano!O W32/Scano.bm WORM_SCANO.BT Win32.Worm.Scano.a W32.Areses.P@mm WORM_SCANO.BT Win.Worm.Scano-70 Email-Worm.Win32.Scano.bm Trojan.Win32.LdPinch.fmye I-Worm.Win32.A.Scano.105231 W32.W.Otwycal.l7h6 Win32.HLLM.Perf Worm.Scano.Win32.69 BehavesLike.Win32.Autorun.cm Email-Worm.Win32.Scano Worm/Scano.at W32.Worm.Areses Worm[Email]/Win32.Scano Email-Worm.Win32.Scano.bm Worm/Win32.Scano.R1851 BScope.Trojan-Dropper.Injector Win32/Scano.BM I-Worm.Scano!zrLOU/XMrws W32/Scano.AA@mm


A backdoor also known as: Trojan.Fsysna Win32.Trojan.WisdomEyes.16070401.9500.9969 Trojan.Win32.Fsysna.eqvl Trojan.Win32.Z.Strictor.607232.C Trojan.MulDrop7.49159 Trojan.Fsysna.Win32.15357 Trojan.MSIL.Spy TrojanSpy:MSIL/Logadat.A Trojan.Win32.Fsysna.eqvl Trojan.Fsysna Trj/GdSda.A Win32.Trojan.Fsysna.Lqym


The report includes extra detail to help potential targets recognize similar attacks.


ThreatStream Labs recently became aware of a campaign beginning on 30 June 2015 by the omniprescent Wekby threat actors a/k/a TG-0416, APT-18, Dynamite Panda.


All of the other IP address we discovered sharing the same TLS certificate behave in the same way .


Adding this extra layer of filtering may help the group focus on targets of interest and evade detection due to use of known malware.


A backdoor also known as: W97M.Downloader TROJ_CVE201711882.E Exploit.Xml.CVE-2017-0199.equmby Xml.Exploit.Cve!c TROJ_CVE201711882.E Malicious_Behavior.SB DOC.S.Exploit.11442 XML/Dloader.S1 Exploit.CVE-2017-0199 XML.Exploit.CVE-2017-0199.E


Our malware analysts Nikita Buchka and Mikhail Kuzin can easily name 11 families of such Trojans .


It was a standalone utility with the name HDD Rootkit for planting a bootkit on a computer.


A backdoor also known as: Win32/Goft.B Trojan.Win32.cvrsqp.eaqdwq Trojan.MyRunner BehavesLike.Win32.PWSZbot.nc Virus.Win32.AA Trojan/PSW.QQPass.fx Trojan/Win32.QQTail.R5474


It provides the same functionality you would expect from a remote access tool: keylogging, webcam access, microphone access, remote desktop, URL download, program execution, etc.


Attacks that use completely fileless malware are a rare occurrence, so we thought it important to discuss a new trojan known as JS_POWMET Detected by Trend Micro as JS_POWMET.DE, which arrives via an autostart registry procedure.


As you can see in the sample list below, this means that many school employees will have received this spam, as K-12 schools very commonly use .us domain names.


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G PE_VIRUX.R W32/Virut.AM Win32/Virut.17408 Trojan.Scar PE_VIRUX.R Win.Trojan.Virtob-1456 Win32.Virus.Virut.U Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg Virus.Win32.Virut.CE Win32.Virut.56 Virus.Virut.Win32.1938 BehavesLike.Win32.Virut.qh W32/Virut.AM Virus/Win32.Virut.ce Win32.Virut.dd.368640 W32.Virut.lqR9 Virus.Win32.Virut.ce Trojan:Win32/QHosts.BR Win32/Virut.F Virus.Virut.14 W32/Sality.AO Win32/Virut.NBP Trojan.Win32.Downloader.toh Trojan.Win32.Scar Virus.Win32.VirutChangeEntry.A


Change server request The URL 's for the new server is obfuscated , preventing easy network identification .


This organization was formerly known as the East Turkestan Islamic Party and is purported to be an Islamic extremist separatist organization founded by Uyghur jihadists .


All of these attacks leveraged CVE-2014-4114 and were delivered via malicious Microsoft PowerPoint Slideshow files *.pps.


Brambul and Joanap appear to be used to download extra payloads and carry out reconnaissance on infected computers.


] com was a C2 for Poison Ivy samples associated with attacks on Myanmar and other Asian countries discussed in a blog published by Arbor Networks in April 2016 .


Then the app finds a process id value for the process it wants to inject with code .


] com hxxp : //mailsa-qaw [ .


A backdoor also known as: Packed.Win32.Tibs!O Worm.Zhelatin Trojan.Heur.RP.fqWcaaXp5um Win32.Trojan.WisdomEyes.16070401.9500.9882 W32/Trojan.LQOD-4441 Trojan.Dropper Email-Worm.Win32.Zhelatin.rn Trojan.Win32.Z.Zhelatin.88576 MalCrypt.Indus! Trojan.Spambot.2559 Email.Worm.W32!c Email-Worm.Win32.Zhelatin.rn Worm/Win32.Zhelatin.R38109 BScope.Trojan.Zhelatin.12 Trj/CI.A Win32/Nuwar.BH Win32.Worm-email.Zhelatin.Sxxs Worm.Win32.Nuwar Win32/Worm.Email-Worm.43d


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id58717 [ .


A backdoor also known as: Backdoor.Rustock.NDU Backdoor.Win32.Rbot!O Backdoor.Rustock.NDU Backdoor.Rbot Win32.Trojan.WisdomEyes.16070401.9500.9989 W32/Trojan.TDBQ-4167 Backdoor.Rustock.B Win.Trojan.Crypt-278 Backdoor.Rustock.NDU Backdoor.Win32.Rbot.szn Backdoor.Rustock.NDU Backdoor.Win32.A.Rbot.70656.J Backdoor.Rustock.NDU Backdoor.Rustock.NDU Trojan.Fakealert.33205 BehavesLike.Win32.Downloader.kt Rootkit.KernelBot.m TR/Tiny.705 Backdoor.Rustock.NDU Backdoor.Win32.Rbot.szn Trojan:Win32/Silentbanker.B Worm/Win32.IRCBot.C36854 Backdoor.Rbot Trj/CI.A Win32.Backdoor.Rbot.Aiik Virus.Win32.Virut.n W32/RBot.SZN!tr.bdr Win32/Backdoor.0a5


During a recent United States Secret Service investigation, Trustwave encountered a new family of POS malware, that we named Punkey.


A backdoor also known as: Trojan/W32.FakeAV.29696.H Backdoor.Ziyazo Trojan.Graftor.D21706 TROJ_FAKEAV.ORH Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan.B TROJ_FAKEAV.ORH Win.Trojan.Ziyazo-1 Trojan.Win32.FakeAv.cuscpt Troj.W32.FakeAv.rxda!c Trojan.Fakealert.45728 Trojan.FakeAV.Win32.293288 BehavesLike.Win32.Backdoor.mc W32/Trojan.TSSV-1630 Trojan/Fakeav.blva Trojan/Win32.FakeAv Backdoor:Win32/Ziyazo.A Trojan/Win32.FakeAV.R94861 Trj/Dynamer.A Trojan.FakeAv!73pMuD6/3rE Trojan.Win32.FakeAV W32/FakeAv.RXDA!tr


Subsequent to the publishing of this article, through cooperation with the parties responsible for the C2 domains, Unit 42 researchers successfully gained control of multiple C2 domains.


This library is used because it uses the only ( publicly known ) way to retrieve this information on Android 6 ( using the process OOM score read from the /proc directory ) .


A backdoor also known as: Hacktool.Superscan Trojan.Win32.XFMP5368.dfvidz HackTool:Win32/SuperScan.A


Lurk was believed to have siphoned over $45 million from financial organizations, ultimately disrupting the victims' operations, reputation, and bottom line.


While Empire RIG-E disappeared at the end of December after 4 months of activity on 2017-02-17 an advert for a new exploit kit dubbed Nebula appeared underground.


A powerful threat actor known as Wild Neutron also known as Jripbot and Morpho has been active since at least 2011, infecting high profile companies for several years by using a combination of exploits, watering holes and multi-platform malware.


Extract the calls log .


Figure 4 .


A backdoor also known as: Application.Hacktool.Pipecmd.B HackTool.Pipecmd Win32.HackTool.Pipecmd.a Application.Hacktool.Pipecmd.B Application.Hacktool.Pipecmd.B Application.Hacktool.Pipecmd.B Trojan.Starter.5008 BehavesLike.Win32.PUP.lc Application.Hacktool.Pipecmd.B Trojan/Win32.Inject.C500093


Once installed , the application requests permissions so that it may control SMS messages and steal sensitive data on the device , as well as proliferate to other devices in the target device ’ s contact list .


Following a three-month hiatus, Emotet spam activities resumed in March 2023, when a botnet known as Epoch 4 began delivering malicious documents embedded in Zip files that were attached to the emails.


A backdoor also known as: Ransom.Sage.S1609000 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.TNMG-4793 Ransom.Cry Trojan.Win32.Yakes.etrgag BehavesLike.Win32.Ramnit.fc TR/AD.MalwareCrypter.zdeue Trojan.Zusy.D3FCFB Trojan/Win32.Yakes.C2201035 Trojan.Yakes Trojan.Yakes!KiOJwMzaTlA


Bots can use various methods to establish a line of communication between themselves and their command-and-control C C server.


Knowledge of the threat landscape and implementation of the right detection tools remains crucial to be able to protect yourself from fraud ; Cerberus is yet a new Trojan active in the wild ! Appendix Samples Some of the latest Cerberus samples found in the wild : App name Package name SHA 256 hash Flash Player com.uxlgtsvfdc.zipvwntdy 728a6ea44aab94a2d0ebbccbf0c1b4a93fbd9efa8813c19a88d368d6a46b4f4f Flash Player com.ognbsfhszj.hqpquokjdp fe28aba6a942b6713d7142117afdf70f5e731c56eff8956ecdb40cdc28c7c329 Flash Player com.mwmnfwt.arhkrgajn ffa5ac3460998e7b9856fc136ebcd112196c3abf24816ccab1fbae11eae4954c Flash Player com.wogdjywtwq.oiofvpzpxyo 6ac7e7ed83b4b57cc4d28f14308d69d062d29a544bbde0856d5697b0fc50cde4 Flash Player com.hvdnaiujzwo.fovzeukzywfr cfd77ddc5c1ebb8498c899a68ea75d2616c1c92a0e618113d7c9e5fcc650094b Flash Player com.gzhlubw.pmevdiexmn 3f2ed928789c200e21fd0c2095619a346f75d84f76f1e54a8b3153385850ea63 Target list The actual observed list of mobile apps targeted by Cerberus contains a total of 30 unique applications .


CVE-2015-5122 was the second Adobe Flash zero-day revealed in the leak of HackingTeam's internal data.


At the peak of procrastinators filing their taxes at the last minute, those who send in their tax forms are exactly the technically less-sophisticated users these kinds of campaigns target.


The same happens with the package squareup.otto , which is an open-source bus implementation focused on Android implementation .


A backdoor also known as: Worm/W32.Vesenlosow.1237156 Worm.Vesenlosow Worm.VB.Win32.13725 W32.W.Vesenlosow.luZW Trojan/VB.nzt WORM_VESENLO.SMA Win32.Worm.VB.m W32.Winiga WORM_VESENLO.SMA Trojan.Win32.Vesenlosow.bclidy Worm.Win32.A.Vesenlosow.909312 Trojan.MulDrop3.6950 BehavesLike.Win32.Rontokbro.tm Trojan.Win32.VB Worm/Vesenlosow.q WORM/VB.argu Trojan/Win32.VB Worm:Win32/Vesenlosow.A Trojan/Win32.VB.R46099 Trojan.Keylogger.1021 W32/Vobfus.GEP.worm Win32.Virut.NBP Win32/VB.NZT Win32.Worm.Vb.Akzk Worm.Win32.Msmm.A


A backdoor also known as: VB:Trojan.Valyria.1034 VBS/Downldr.IA W97M.Dropper TROJ_RUBREG.SM VB:Trojan.Valyria.1034 Trojan.Script.ExpKit.evbkht Troj.Downloader.Script!c VB:Trojan.Valyria.1034 VB:Trojan.Valyria.1034 VBS.DownLoader.1040 TROJ_RUBREG.SM VBS/Downloader.ea VBS/Downldr.IA TrojanDownloader:VBS/Vibrio.P VB:Trojan.Valyria.D40A VBS/Downloader.ea virus.vbs.houdini.b


A backdoor also known as: Trojan.Win32.Mydse!O TrojanDropper.Goriadu Win32.Trojan.WisdomEyes.16070401.9500.9578 TROJ_GORIADU.SMX Trojan.Win32.Mydse.az Trojan.Win32.Click.tdtvg TROJ_GORIADU.SMX BehavesLike.Win32.BadFile.fh Trojan-Clicker.ANTO TR/Clicker.9984610 Win32.Troj.AntiCloudAV.d.kcloud TrojanDropper:Win32/Goriadu.A!bit Trojan.Zusy.D38CD Trojan.Win32.Mydse.az W32/GORIADU.SMX!tr


Who is affected ? Gooligan potentially affects devices on Android 4 ( Jelly Bean , KitKat ) and 5 ( Lollipop ) , which is over 74 % of in-market devices today .


Around 2011 , the infamous Zeus Trojan started using web injects that tricked users into downloading a mobile component called “ ZitMo ” ( Zeus in the Mobile ) .


Figure 1 shows embedded URL in an Elirks sample found in early 2016.


This malware is well-known for its ability to steal credentials and quickly spread through an enterprise over network shares.


A backdoor also known as: W32.eHeur.Virus02 Adware.Heur.E101B3 Win32.Trojan.BHO.r Trojan.Win32.BHO.bropxr Adware.Softomate.603 Trojan:Win32/Jifcapi.A


A backdoor also known as: Trojan.Kromebit TROJ_KROMEBIT.SM Win32.Trojan.WisdomEyes.16070401.9500.9982 TROJ_KROMEBIT.SM Trojan.Win32.Dwn.eurwpx Trojan.Win32.Z.Kromebit.1068032 Trojan.DownLoader25.50889 BehavesLike.Win32.Dropper.tt W32/Trojan.EJDN-0785 Trojan:Win32/Kromebit.B Trj/CI.A Trojan.Win32.Kromebit W32/KROMEBIT.SM!tr


Today this malware shows unwanted ads , tomorrow it could steal sensitive information ; from private messages to banking credentials and much more .


The report closes with some security suggestions, highlighting the importance of two-factor authentication.


The record contains a personal email address : WHOIS records of C2 server exposing the attacker ’ s email address We were aware of the possibility that the attackers might be using a compromised email account , so we dug deeper to find more information related to this email address .


This week the spam party did not just include CERBER, but also decided to invite an old friend – the KOVTER family.


Tofsee, also known as Gheg, is another botnet analyzed by CERT Polska.


We assess with high confidence that this modified version is operated by the infamous Wolf Research .


It ’ s possible , as with other Android malware , that some apps may also be available on forums , file-sharing sites or even sent to victims as email attachments , and we were only able to determine the delivery mechanism for a handful of the apps we have been able to find .


A backdoor also known as: Trojan/W32.Small.15616.H Trojan.Bibei.A6 Bibei.a Win.Trojan.Rootkit-3954 Trojan.Win32.NtRootKit.rigfr TrojWare.Win32.Olmarik.AWI Trojan.NtRootKit.12543 Bibei.a TR/Offend.69286423 Trojan.Zusy.D27F7 Trojan:WinNT/Bibei.A


During the investigation , this app was able to successfully connect to the command and control server , but it received no commands .


Another trick in “ Agent Smith ’ s arsenal is to change the settings of the update timeout , making the original application wait endlessly for the update check .


The service continues by loading an ELF , created by Baidu , which is capable of tracking the device location before setting up a monitor to harvest phone numbers associated with outgoing calls for those numbers with a country code “ +86 ” prefix , which relates to the People ’ s Republic of China .


A backdoor also known as: Trojan/W32.Propas.110663 Trojan.Heur.RP.EDD84E Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/Trojan.AQD TROJ_PASSPRO.C Win.Trojan.Enfal-62 Trojan.PWS.Winlog TROJ_PASSPRO.C BehavesLike.Win32.Dropper.ch W32/Trojan.IWQS-9238 Trojan:Win32/Propas.A Trojan:Win32/Propas.A Trojan.Propas!M9i4NRQV2R8 W32/Propas.A!tr


One of the samples ( e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 ) uses the C2 server svcws [ .


A backdoor also known as: Backdoor.Syph.B Backdoor/W32.Syph.361984 Backdoor.Syph Backdoor.W32.Syph.b!c Trojan/Syph.b Backdoor.Syph.B Backdoor.Trojan BKDR_SYPH.B Win.Trojan.Syph-2 Backdoor.Syph.B Backdoor.Win32.Syph.b Backdoor.Syph.B Trojan.Win32.Syph.bfjuy Backdoor.Win32.Syph.361984 Win32.Backdoor.Syph.cyqv Backdoor.Syph.B Backdoor.Win32.Syph.B BackDoor.Syph BKDR_SYPH.B W32/Risk.GBZV-6047 Backdoor/Syph.b BDS/Syph.b.Srv Trojan[Backdoor]/Win32.Syph Backdoor:Win32/Syph.B Backdoor.Win32.Syph.b Backdoor.Syphillis Backdoor.Syph.b Bck/Syphillis.1.18 Win32/Syph.B Backdoor.Syph!hEmUZuSaZVQ Win32/Backdoor.e16


From April 19-24, 2017, a politically-motivated, targeted campaign was carried out against numerous Israeli organizations.


Although this technique has been used before by other malware campaigns, it is still not a common strategy.


It also targets devices made by Chinese manufacturer Xiaomi and those running MIUI , an operating system based on Google Android made by Xiaomi .


We gathered information from affected devices , and concurrently , attempted to acquire Chrysaor apps to better understand its impact on users .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9692 TR/Brysay.A PWS:Win32/Enesbot.A Trojan-Downloader.MSIL.Banload


Some of the icons used can be seen below .


Yet I recently uncovered evidence that suggests it was the work of a well-known Chinese threat group.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9982 Trojan.Win32.Farfli Backdoor:Win32/Dorbop.B!bit Trj/GdSda.A


A backdoor also known as: Trojan.Win32.AD.eqoszf TR/AD.PSLoader.kykon Trojan.Razy.D1F16C Win32/Powerless.F Trojan.Powerless! W32/Powerless.F!tr


We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013.


] orgacount-manager [ .


In our previous research, we detailed how an information stealer Trojan was deployed via a Word macro, in order to spy on its victims various parts of the Saudi Government.


] 175 [ .


A backdoor also known as: W32.FakeMsHelpCenter.Trojan Trojan.Graftor.D67ED Win32.Trojan.WisdomEyes.16070401.9500.9997 TROJ_ALTHUMS_EI030112.UVPM Trojan.Win32.DownLoad2.rlsdn Trojan.Win32.A.Downloader.84626 Trojan.DownLoad2.63614 Trojan.Allthumbs.Win32.1 TROJ_ALTHUMS_EI030112.UVPM BehavesLike.Win32.Worm.tz Trojan:Win32/Althums.A Trojan/Win32.Goz.R10705 Trj/CI.A Trojan.Graftor!H+8m5ivUpKY Win32/Trojan.0be


Such data includes contact and location information , phone and message activity , the ability to record from the microphone , camera , and other sensors as well as the capability to access data from many popular messaging and social media apps .


A backdoor also known as: BKDR_MATSNU.SM0 Win32.Trojan.WisdomEyes.16070401.9500.9999 BKDR_MATSNU.SM0 BehavesLike.Win32.Ransom.ch TR/Crypt.ZPACK.8577 Trojan/Win32.Trapwot.R152769 Trojan.FakeAV.01657


A full list of targeted applications is included in the IOC section at the end of this post .


This finding was listed in our Anthem blog, and we have continued to monitor it in ThreatConnect since mid February.


A backdoor also known as: W32.JapiletAA.Trojan Trojan.Dropper.Delf.BB Worm.Win32.Fesber!O Worm.Fesber Worm.Fesber.Win32.3 Trojan/Fesber.a W32/Fesber.A Win32/Fesber.A WORM_YERO.A Win.Worm.Yero-1 Worm.Win32.Fesber.g Trojan.Dropper.Delf.BB Virus.Win32.Fesber.iiof Worm.Win32.A.Fesber.13116[UPX] Virus.Win32.Fesber.k Trojan.Dropper.Delf.BB Win32.HLLW.FSB WORM_YERO.A BehavesLike.Win32.Fesber.vh W32/Fesber.QPGQ-0002 Worm/Fesber.g Worm/Win32.Fesber.g Worm.Fesber.kcloud Worm:Win32/Fesber.A Trojan.Dropper.Delf.BB Troj.PSW32.W.QQPass.lgj2 Worm.Win32.Fesber.g Trojan.Dropper.Delf.BB Worm/Win32.Fesber.R4309 Trojan.Dropper.Delf.BB Virus.Fsb.1 I-Worm.Fesber.A Win32/Fesber.A Worm.Fesber!I2XPvd5yXYs Worm.Win32.Fesber W32/Cosmu.H.worm Worm.Win32.Fesber.A


What is special about it is that it comes as a Windows link file, .LNK, that downloads and runs a malicious HTML application, .HTA, that drops and executes a malicious binary.


] 147 Red Alert 2.0 : Android Trojan targets security-seekers A malicious , counterfeit version of a VPN client for mobile devices targets security-minded victims with a RAT .


We report them to Google and take other steps to disrupt malicious campaigns we discover .


Our analysis of the Adobe Flash zero-day vulnerability used in the latest Pawn Storm campaign reveals that the previous mitigation techniques introduced by Adobe were not enough to secure the platform.


The actors behind Dridex 220 and Locky Affid=3 have introduced a new ransomware called Bart


A backdoor also known as: Application.Joke.Flipped.E Joke.Flipped Riskware.Win16.Flipped.yzsd Joke.Flipped JOKE_FLIPPED.A Joke.Flipped Application.Joke.Flipped.E Joke.Flipped Application.Joke.Flipped Joke.Flipped JOKE_FLIPPED.A Joke.Flipped Backdoor/IRC.IRC Joke:Win32/Flipped.A Trojan.Win32.A.Zbot.4128 Application.Joke.Flipped.E Joke.Flipped Joke.Flipped


Komplex shares a significant amount of functionality and traits with another tool used by Sofacy – the Carberp variant that Sofacy had used in previous attack campaigns on systems running Windows.


Figure 6 : Targeted ad network Figure 7 : Injection example After all of the required changes , “ Agent Smith ” compiles the application and builds a DEX file containing both the original code of the original application and the malicious payload .


In 2014, our colleagues at Crowdstrike wrote an exposé about a long-standing Chinese APT threat group they self-named Putter Panda, which Mandiant/FireEye refers to as APT2.


Apache Tomcat is a java based web service that is used for different applications.


Among the 153 configuration files, 54 distinct command and control C C servers were detected.


A backdoor also known as: Trojan.Win32.RedCap.ewfcku BehavesLike.Win32.VBobfus.gc Trojan.CopyKittens TR/RedCap.eevfy Trojan.Razy.D33AF6 TrojanDropper:Win32/Noratops.B!dha Trj/GdSda.A


According to a blog article by Microsoft, the malware is associated with an attacker group identified as DarkHotel Microsoft calls it as Dubnium .


A backdoor also known as: W32.Lamer.KL8 PE_LAMER_EL150191.UVPM Win32.Trojan.WisdomEyes.16070401.9500.9987 PE_LAMER_EL150191.UVPM Virus.Win32.Lamer.kl Virus.W32.Lamer!c ApplicUnsaf.Win32.ScreenMate.AA Backdoor.PePatch.Win32.75884 Virus.Win32.Lamer TR/Taranis.2787 Trojan[Ransom]/Win32.CryFile Virus.Win32.Lamer.kl Hoax.CryFile Virus.Win32.Lamer.j Win32/Virus.HideDoc.L


But that does n't mean companies and organizations are out of the woods .


Google's security team recently identified a new domain masquerading as an official EFF site as part of a targeted malware campaign.


A backdoor also known as: W32.OnGameELAIUZAC.Trojan Trojan.Zusy.D3B59 Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Win32.Clicker.cwyjjr Trojan.Click2.34240 Win32.Troj.Undef.kcloud Trojan:MSIL/Ainscomp.A Trj/CI.A Trojan.Ainscomp!KTuN3cZslCo Trojan.Msil Win32/Trojan.bfc


FinFisher is not afraid of using all kinds of tricks , ranging from junk instructions and “ spaghetti code ” to multiple layers of virtual machines and several known and lesser-known anti-debug and defensive measures .


EventBot parsing of grabbed SMS messages Parsing of grabbed SMS messages .


The second attack vector , the overlay attack , shows a customized phishing window whenever a targeted application is started on the device .


The three InPage exploit files are linked through their use of very similar shellcode, which suggests that either the same actor is behind these attacks, or the attackers have access to a shared builder.


A new type of macOS-based stealer is being sold on the dark web for $100 £70.


BLOCKER_EXTORTIONIST_START – display HTML page of the ransomware .


If the user ignores or rejects the request , the window reopens every few seconds .


The emails sent by this campaign may look spartan to the professional eye but, as ever, the human point of interaction with systems is the most vulnerable: by potentially reaching so many individuals, campaigns such as this can - and do - succeed in infecting people.


MD5 43680D1914F28E14C90436E1D42984E2 20D4B9EB9377C499917C4D69BF4CCEBE First widely distributed Android bootkit Malware infects more than 350,000 Devices January 29 , 2014 In the last quarter of 2013 , sale of a Smartphone with ANDROID operating system has increased and every second person you see is a DROID user .


Most custom backdoors used by advanced attackers have limited functionality.


EVENTBOT INFRASTRUCTURE By mapping the C2 servers , a clear , repeated pattern emerges based on the specific URL gate_cb8a5aea1ab302f0_c .


We anticipate this malware to continue to evolve with additional new features ; the only question now is when we will see the next wave .


This leads us to believe this is another actor .


A backdoor also known as: Trojan/Bifrose.nel Win.Trojan.AutoIT-6333854-0 Trojan-Dropper.Win32.Autoit.bvg Trojan.Win32.AutoIt.expdpu BehavesLike.Win32.Backdoor.tc Trojan.Win32.Z.Autoit.1633763 Dropper/Win32.Androm.C2387785 Win32/Injector.Autoit.DFJ Backdoor.MSIL W32/Injector.CYH!tr Win32/Trojan.38f


Several analysis reports were published on this malware in 2014 and , finally , the source code was leaked in 2015 .


These devices were located in the following countries : How we protect you To protect Android devices and users , Google Play provides a complete set of security services that update outside of platform releases .


MALWARE UNDER ACTIVE DEVELOPMENT EventBot “ cfg ” class EventBot “ cfg ” class .


Over the past couple of months McAfee Labs has seen an increase in the usage of macros to deliver malware.


We mostly observe attacks using Elirks occurring in East Asia.


We observed an anomaly when approximately 60 domains all [.]top TLDs registered on April 7, 2016 started serving a coin mining malware – to mine BitMonero, a form of digital currency – on their main page under the mime-type of html/text.


A backdoor also known as: W32.HfsAutoB.E147 Trojan.Banker.Win32.5895 Trojan/Banker.ju W32/Banker.AJC Win.Trojan.Bancos-852 Trojan-Banker.Win32.Banker.ju Trojan.Win32.Banker.bmncx Trojan.PWS.Banker.based Trojan-Spy.Win32.Banker W32/Banker.WTGS-4277 Trojan/Banker.Banker.ufm Trojan[Banker]/Win32.Banker Trojan-Banker.Win32.Banker.ju TrojanBanker.Banker Trojan.Banker!qguLAzH8AII W32/Banker.DUU!tr Trj/Banker.FWD Win32/Trojan.a46


At least two different stealers, Rhadamanthys and RedLine, were abusing the search engine promotion plan in order to deliver malicious payloads to victims' machines.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9925 Trojan.Win32.Graftor.bovqdb TrojWare.Win32.GameThief.Nilage.~CRSH TR/Graftor.Elzob.6117.1 Backdoor:Win32/Parcim.A Trj/CI.A Trojan.Graftor.Elzob.D17E5


It has been in the news the past few weeks as it is the bot that was used in the DDoS attack on Brian Kreb's security blog.


A backdoor also known as: Trojan.Jevafus.A Trojan.Jevafus.A Trojan.Jevafus.A Trojan.Win32.Drop.euelge Trojan.Jevafus.A Trojan.Jevafus.A BehavesLike.Win32.BadFile.vh TrojanDropper:Win32/Jevafus.A Trojan.Jevafus.A


So far, all theories regarding the spread of ExPetr/Petya point into two directions:


What ’ s more , the user can not check the balance via mobile banking or change any settings there , because after receiving the command with code 40 , the Trojan prevents the banking app from running on the phone .


The CatB ransomware family, sometimes referred to as CatB99 or Baxtoy, was first observed in late 2022, with campaigns being observed steadily since November.


A backdoor also known as: Trojan.Svectas.Win64.1 Packer.Win32.Katusha TR/Svectas.smnlb W64/Svectas.B!tr


PaloAltorecently discovered a new Android Trojan called SpyNote which facilitates remote spying.


A backdoor also known as: W32.HfsAutoB.F81D Trojan.Mikhail.Win32.4 Trojan.Ransom.Mischa.2 Ransom_MISCHA.SM Win32.Trojan.WisdomEyes.16070401.9500.9999 Ransom_MISCHA.SM Win32.Trojan-Ransom.Petya.D Trojan-Ransom.Win32.Mikhail.a Trojan.Win32.Petya.96256 Trojan.Encoder.4544 Trojan.Petr.a TR/AD.Petya.Y.rxxx Trojan[Ransom]/Win32.Mikhail Ransom:Win32/Mischa.A Trojan-Ransom.Win32.Mikhail.a Trojan/Win32.Mischa.C1478164 Hoax.Mikhail Trojan.Mikhail!


A backdoor also known as: Doc.Exploit.DDEautoexec-6346603-0 Exploit.Xml.DDEAuto.euqmxe Trojan[Exploit]/MSOffice.DDE.c Win32.Outbreak


In a much-improved Android security environment , the actors behind Agent Smith seem to have moved into the more complex world of constantly searching for new loopholes , such as Janus , Bundle and Man-in-the-Disk , to achieve a 3-stage infection chain , in order to build a botnet of controlled devices to earn profit for the perpetrator .


The end result is a new banking Trojan in the wild.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9899 HV_ROGUE_CG152C85.RDXN Heur.Packed.Unknown TR/Spy.Banker.45879 TrojanProxy:BAT/Banker.G Win32/RiskWare.PEMalform.E


A backdoor also known as: Trojan-Proxy/W32.Steredir.504832 Trojan/Proxy.Steredir.c Trojan-Proxy.Win32.Steredir.c Trojan.Win32.Steredir.fqli Troj.Proxy.W32.Steredir.c!c TrojWare.Win32.TrojanProxy.Steredir.C Trojan.Stedir.11 Trojan.Steredir.Win32.7 Trojan-Dropper.Delf W32/Risk.RESM-4501 TrojanProxy.Steredir.c TR/Proxy.Steredir.C Trojan[Proxy]/Win32.Steredir Win32.Troj.Steredir.c.kcloud Trojan.Heur.EFD23B1 Trojan.Win32.Proxy.504832 Trojan-Proxy.Win32.Steredir.c TrojanProxy:Win32/Steredir.C Win32/TrojanProxy.Steredir.C Trojan.PR.Steredir!cYzY1isGQt0 W32/Steredir.C!tr


Do not download mobile apps from unofficial or unauthorized sources .


Attitude Change The disinterest in the issues appears to have changed with The New York Times report , which lit a fire underneath Adups and BLU .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 BehavesLike.Win32.Trojan.gc Trojan.MSIL.Bladabindi.1 HackTool:MSIL/Injector.A Trojan.LVBP.ED Backdoor.Win32.DarkKomet


A backdoor also known as: Backdoor.Win32.Hupigon!O TrojanDropper.Dowque.A8 Backdoor.Hupigon.Win32.182 Backdoor/Hupigon.dkwt TROJ_DOWQUE.NY Win32.Trojan.Delf.b W32/Backdoor2.CWRX Backdoor.Graybird TROJ_DOWQUE.NY Win.Worm.Autorun-12451 Backdoor.Win32.Hupigon.56864 Backdoor.W32.Hupigon.l9fO BackDoor.Graybird.75 BehavesLike.Win32.SpywareLyndra.tc W32/Backdoor.DAWT-3367 Backdoor/Huigezi.2008.qny BDS/Farfli.kj.2 Win32.TrojDownloader.dl.kcloud TrojanDropper:Win32/Dowque.A Trojan/Win32.Hupigon.C29670 Backdoor.Bot Win32/Delf.NSN Backdoor.Win32.Hupigon.dkw Backdoor.Hupigon!hgCryiT987Y Backdoor.Win32.HacDef W32/Injector.fam!tr Trojan.Win32.Downloader.M


The file is named in such a way as to confuse WordPress administrators who are familiar with XML-RPC.


Conclusion The days when one needed in-depth coding knowledge to develop malware are long gone .


A backdoor also known as: HackTool.Win64.PSWDump.f BehavesLike.Win64.SoftPulse.lh HackTool.Mimikatz HackTool.Win64.PSWDump.f


The story was about a new vulnerability for *nix-based systems – EternalRed aka SambaCry.


sms_grab : to upload periodically the SMS messages in the inbox to C2 server .


There have been an emegerence of new domains for FighterPOS recently and I discovered a whole load of other possible domains that could be used for the command and control.


FakeSpy uses an anti-debugging technique by creating another child process of itself .


The core malware is usually disguised as Google Updater , Google Update for U or “ com.google.vending ” .


The service connects back to the attacker machine and waits for commands which will be given by the attacker.


Crooks behind MajikPOS have various tricks up their sleeves.


TA473 has continuously leveraged an unpatched Zimbra vulnerability in publicly facing webmail portals that allows them to gain access to the email mailboxes of government entities in Europe.


Unlike previously seen non-GP ( Google Play ) centric malware campaigns , “ Agent Smith ” has a significant impact upon not only developing countries but also some developed countries where GP is readily available .


Presumably from the same author of Petya, which was first seen in December 2016, and the Petya-Mischa combo, which hit users back in July 2016, Janus Cybercrime Solution's latest creation is another step in the evolution of their ransomware-as-a-service expansion.


Our research indicates that the group has sufficient financial resources to purchase the source code of a widely available malware tool, and the human resources to design improved versions of its own backdoors based on this.


A backdoor also known as: Trojan.Downloader.JRQH Trojan.Downloader.JRQH Win32.Trojan.WisdomEyes.16070401.9500.9945 Win32.Trojan-Downloader.Banload.J Trojan-Downloader.MSIL.Banload.bgr Trojan.Downloader.JRQH Trojan.Win32.Banload.dzssxt Trojan.Downloader.JRQH Trojan.Downloader.JRQH Trojan-Downloader.MSIL.Banload.bgr TrojanDownloader:MSIL/Banload.T Trojan/Win32.Banload.C829219 Trojan.Banker.ABR Trj/GdSda.A Msil.Trojan-downloader.Banload.Efkz Trojan-Downloader.MSIL.Banload


Trigona ransomware is a relatively new strain that security researchers first discovered in late October 2022.


update.exe module and Xenotix Python Keylogger code comparison ‘ addStartup ’ method from msconf.exe module ‘ addStartup ’ method from Xenotix Python Keylogger Distribution We found several landing pages that spread the Android implants .


THE CAMPAIGN The malware 's primary infection vector is SMS .


A backdoor also known as: HW32.Packed.A537 Packed.Win32.TDSS!O RiskWare.Tool.CK BehavesLike.Win32.Downloader.dc TR/Bumat.A.2896 Win32.Troj.Undef.kcloud Win-Trojan/Xema.variant PE:Malware.XPACK-HIE/Heur!1.9C48 Trojan.Crypt W32/Malware_fam.NB Win32/Trojan.648


We observed legitimate exfiltrated files of the following types of data : Contact information Compressed recorded audio in the Adaptive Multi-Rate ( amr ) file format Images captured from the device camera Images stored on both internal device and SDCard storage that are listed in the MediaStore Device geolocation information SMS content Chrome browser search history and bookmarks Call log information Cell tower information Device network metadata ; such as phone number , device software version , network country , network operator , SIM country , SIM operator , SIM serial , IMSI , voice mail number , phone type , network type , data state , data activity , call state , SIM state , whether device is roaming , and if SMS is supported .


This post describes the new campaign.


A backdoor also known as: HW32.Packed.2431 Trojan.MSIL.FKV WS.Reputation.1 Stimilik.S Trojan.Win32.Confuser.dkqarl BehavesLike.Win32.Kudj.gc Trojan/Win32.Stealer PUA.MSIL.Confuser


Attackers also used the name of the top NIC official in the signature of the email, this is to make it look like the email was sent by a high ranking Government official working at NIC National Informatics Centre.


PaloAlto observed a targeted attack in November directed at an individual working for the French Ministry of Foreign Affairs.


Red Alert Plays Dress-Up In the wild , we found Web pages designed to ( vaguely ) resemble legitimate app market pages , hosting files for download that have been disguised as a legitimate mobile application of moderately broad appeal , such as a media player or social media app .


HMRC taxes application with reference L4TI 2A0A UWSV WASP received


The infection attempts occurred in September and October of 2015 as public frustration grew at the Mexican government's seemingly contradictory statements about the Narvarte case


A backdoor also known as: Worm/W32.Mydoom.28864 W32.Mydoom.M W32/Mydoom.o@MM W32/Mydoom.m I-Worm.Mydoom!qBn5HU3v+Lw W32/Mydoom.O@mm W32.Mydoom.M@mm MyDoom.L@mm Win32/Mydoom.O Win32.Mydoom.m Worm.Mydoom-27 Email-Worm.Win32.Mydoom.m I-Worm.Win32.Mydoom.28864.A Email-Worm.Win32.Mydoom!IK Worm.Win32.Mydoom.R Win32.HLLM.MyDoom.54464 Worm/Mydoom.O.1 W32/Mydoom.o@MM Worm/Sramota.bef Worm/Win32.Mydoom Worm:Win32/Mydoom.O@mm W32/Mydoom.O@mm Win32/Mydoom.worm.49344.B Email-Worm.Win32.Mydoom.m Win32/Mydoom.R Worm.Mail.Mydoom.dh Email-Worm.Win32.Mydoom W32/Mydoom.M!dam I-Worm/Mydoom.O W32/Mydoom.N.worm


The news organization provides reporting on its website in English, Georgian, and Russian.


Lookout researchers have identified a new , highly targeted surveillanceware family known as Desert Scorpion in the Google Play Store .


Mandiant suspects UNC2970 specifically targeted security researchers in this operation.


It is also much harder for network defenders or researchers to track a campaign where the infrastructure is a moving target .


jhfrte.jar : This is a java archive file downloaded from server .


A backdoor also known as: W32.FamVT.LoringK.Trojan Backdoor.Bot.158614 Trojan-Dropper.Win32!O TrojanDropper.Loring.A11 Backdoor.Bot.158614 Backdoor.IRCBot Trojan/IRCBot.ov WORM_KWBOT.AR W32/Risk.VXNU-4867 W32.Kwbot.Worm Win32/Loring.A WORM_KWBOT.AR Win.Trojan.Obfuscated-1662 Backdoor.Bot.158614 Trojan.Win32.Reconyc.gunk Backdoor.Bot.158614 Trojan.Win32.IRCBot.dmigck Dropper.Loring.291411 Backdoor.Bot.158614 Backdoor.Bot.158614 Trojan.MulDrop5.7150 Trojan.Reconyc.Win32.6040 WORM/IrcBot.86875 Trojan[Backdoor]/Win32.IRCBot Win32.Troj.Loring.EA.kcloud Backdoor.Bot.D26B96 Troj.Dropper.W32.Loring.l8Ew Worm/Win32.IRCBot.R3593 TScope.Trojan.Delf Trojan.IRCBot.OV Win32/IRCBot.OV Trojan.DR.Loring!O3IAMVgzzx8 Trojan-Dropper.Win32.Loring


A backdoor also known as: Trojan/Injector.iuc Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Pushbot.AJZ WORM_PALEVO.SMA Win.Trojan.Ircbrute-54 Trojan.Win32.Ircbrute.eqsrw Trojan.Spambot.9818 Trojan.Injector.Win32.53831 WORM_PALEVO.SMA BehavesLike.Win32.PWSZbot.lh Backdoor.Win32.IRCBot Trojan/Win32.Unknown Trojan:Win32/Ircbrute.B Trojan.Graftor.DCFC Worm/Win32.Ckbface.R16129 Trojan.Injector!aNdlYeuOVuU


While the malware was not detectable by endpoint antivirus products, RSA Security Analytics was able to identify and alert on its network traffic, and RSA ECAT subsequently identified the malware.


A backdoor also known as: Trojan.Script.400873 Exploit/PDF-URI2.AS Exploit-PDF.f Exploit.W32.Pidief!c PDF.Exploit.Pidief.an Bloodhound.PDF.9 Trojan.Script.400873 Exploit.Win32.Pidief.asz Trojan.Script.400873 Exploit.Script.Pidief.ibwe PDF.S.Exploit.10714 Win32.Exploit.Pidief.Anfp Trojan.Script.400873 Exploit.JS.Pdfka.MJ Trojan.Script.400873 Exploit.PDF.303 HEUR_PDFEXP.B BehavesLike.PDF.Trojan.lr Exploit:Win32/Pdffir.A Trojan.Script.D61DE9 Exploit.Win32.Pidief.asz PDF/Pidief.EI Trojan.Script.400873 Exploit.Win32.Pidief.asz JS.Crypt.BSP Exploit.JS.Pdfka JS/Pdfka.BSP!exploit virus.pdf.20090837.1


A backdoor also known as: W32.DropperZbotS.Trojan Trojan-Spy.Win32.Zbot!O Trojan.AutoIt.Pik.A Backdoor/Poison.evja Trojan.Zbot Trojan.Win32.Autoit.pik Trojan.Win32.Autoit.exoora Trojan.Win32.Z.Autoit.955563 Troj.W32.Autoit!c BehavesLike.Win32.Dropper.dc Trojan.Win32.Injector Trojan.Autoit.kzp TR/AD.Zbot.cgaww Trojan.Win32.Autoit.pik Trojan:Win32/Krilog.A Trojan.Autoit.F Win32/Injector.Autoit.AOI Win32.Trojan.Autoit.Edne W32/Autoit.NWS!tr


Several hardcoded applications targeted by the MDM-grabbing command ‘ wifi ’ – this command creates a new Wi-Fi connection with specified configurations from the command and enable Wi-Fi if it is disabled .


A backdoor also known as: W32.DakusarDRW.Trojan Trojan.Blocker.Win32.34866 Trojan.DownLoader24.32105 BehavesLike.Win32.Shodi.tc Worm:Win32/Icorimg.A Trojan.Strictor.D1C7BA HEUR/Fakon.mwf Trojan.Worm!33g50yRKTx8 Trojan.FLCM!tr


First , an activity named MainActivity fires up , taking care of hiding the icon and showing the fake notification .


Upon further inspection, the RAT appeared to share many similarities with an old Chinese backdoor known as Hacker's Door first released publicly in 2004 and updated in 2005.


Due to the current absence of maintained and supported Android banking Malware-as-a-Service in the underground community , there is a certainly demand for a new service .


A backdoor also known as: BackDoor-CMQ.dldr Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_HORST.SMPE Monitor.W32.WebWatcher.lt5Y TROJ_HORST.SMPE BackDoor-CMQ.dldr Trojan.Graftor.D476C BScope.Malware-Cryptor.Win32.313 Trojan.Win32.Cosmu W32/Dloader.BOW!tr.dldr


The campaign was active between November 2016 and January 2017, targeting a limited number of people.


In this particular case , the bot abuses the accessibility service privilege to obtain the package name of the foreground application and determine whether or not to show a phishing overlay window , as shown in the following code snippet : Targets Some examples of phishing overlays are shown below .


Quasar is a .NET Framework-based open-source RAT.


A backdoor also known as: Trojan.Win32.Z.Delf.2373896 Troj.Spy.W32.Zbot.lw7D Win32.Trojan-downloader.Rakhni.Html Trojan-Downloader.Win32.Delf W32/Application.AJYX-3726 TrojanDownloader.Rakhni.ec TR/Dldr.Delf.tbxxd W32/Dloader.CDW!tr Trojan[Downloader]/Win32.Rakhni Trojan.Application.Bundler.InstallMonster.392 Trojan-Downloader.Win32.Rakhni.jqc Trj/CI.A Win32/Trojan.036


) If the application hasn ’ t received instructions about the rules for processing incoming SMSs , it simply saves all SMSs to a local database and uploads them to the C & C .


While it is not clear whether the primary goal of the attack was delivering the malicious payload or capturing the targets OWA credentials, this attack uses an OWA phish to additionally pushes a malicious document with a Veil-Framework payload capable of downloading further malware.


The second Project Spy version has similar capabilities to the first version , with the addition of the following : Stealing notification messages sent from WhatsApp , Facebook , and Telegram Abandoning the FTP mode of uploading the recorded images Aside from changing the app ’ s supposed function and look , the second and third versions ’ codes had little differences .


Installed with backdoored software, for example:- Telegram.exe - mech_korolya_artura_2017.HDRip.exe


Founded in 2013, the Android Marcher mobile malware has widely been targeting Google Play -- harvesting user credentials and credit card data.


Ransomware persists as one of the top crimeware threats thus far into 2016.


A backdoor also known as: W32.FamVT.AxVDb.Trojan Trojan.Rincux.AW Trojan.Injector.26488 Trojan.Rincux.AW Trojan.Injector Tool.StormAttack.Win32.10 Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan Win.Trojan.Rincux-6417593-0 Trojan-DDoS.Win32.StormAttack.c Trojan.Rincux.AW Trojan.Win32.Tdss.bziyas Trojan.Rincux.AW TrojWare.Win32.Magania.~AAC DDoS.Storm.156 BehavesLike.Win32.Backdoor.km TrojanDDoS.StormAttack.a Trojan[Rootkit]/Win32.TDSS DDoS:Win32/Stormser.A Trojan.Rincux.AW Trojan-DDoS.Win32.StormAttack.c BScope.Trojan.Win32.Inject.2 Trojan-Downloader.Win32.Pangu W32/ServStart.AS!tr


That version flags messages " containing certain language associated with junk texts and flags numbers associated with junk calls and not in a user 's contacts , '' the company says .


] com Given that there is some overlap in the previous two versions , it came as no surprise to us that we finally identified a sample which is an evolution based on both previous versions .


Daserf's main purpose is information stealing and the Trojan is capable of gathering information from infected computers and relaying it back to attacker-controlled servers.


Due to new EU money laundering guidelines , the new Bank Austria security app is mandatory for all customers who have a mobile phone number in our system .


A backdoor also known as: Trojan-Dropper.Win32.Flystud!O Trojan.Hookmoot.S217748 Trojan.Symmi.D7D5 Win32.Worm.FlyStudio.mc Trojan.Dropper Win32/SillyAutorun.ALB Win.Trojan.Rootkit-7763 Win32.Trojan.FlyStudio.A Trojan-GameThief.Win32.OnLineGames.boif Trojan.Win32.QQPass.esaped Troj.Dropper.W32.Flystud.lBWL Trojan.MulDrop5.5320 Dropper.Flystud.Win32.139 BehavesLike.Win32.Autorun.vc Trojan/PSW.OnLineGames.cvvq RKIT/Tiny.BK.2 Trojan:Win32/Englov.A Trojan-GameThief.Win32.OnLineGames.boif HEUR/Fakon.mwf Rootkit.Tiny Trojan.AutoRun Win32/FlyStudio.A Trojan.TenThief.QQPsw.tss Worm.Autorun!1DOkY6YfgQ8 Rootkit.Win32.Tiny W32/BDoor.DRV!tr Win32/Trojan.dd5


This attack , however , seems exclusive to Android users , as it does not have the code to attack iOS devices .


The code implementation again seems that it has been added for testing purposes only .


But we recently identified an app that demonstrated new ways of successfully evading Apple's code review.


The stolen credentials may be used for remote access into the victim network if applicable.


A backdoor also known as: Trojan.Darkshell BehavesLike.Win32.Ipamor.nm Trojan[Downloader]/Win32.Delf Trojan:WinNT/Darkshell.C Trojan/Win32.CSon.R1800 Trojan.Win32.Scar.mg


A backdoor also known as: W32.HfsAutoB.B01D Troj.Crypt.Tpm!c BehavesLike.Win32.PWSQQPass.vc Trojan:Win32/Valan.A


It can also imitate a legitimate website to lure you into revealing your sensitive information.


Dyreza originally focused on intercepting end-user bank logins, and later expanded to job hunting, file hosting, domain registration, website hosting, file hosting, tax services, and online retail categories


Brain Test has been removed from Google Play since September 24.


A backdoor also known as: W32.FamVT.DinwoodAATTC.Worm Trojan.Zenshirsh.SL7 TSPY_EYDROP.SMA Win32/Oflwr.A!crypt TSPY_EYDROP.SMA Win.Worm.Allaple-5 Trojan-Dropper.Win32.Dinwod.acqn Trojan.Win32.Dinwod.ejafor Troj.Dropper.W32.Dinwod.toVw TrojWare.Win32.TrojanDropper.Dinwod.A Trojan.Inject1.58305 BehavesLike.Win32.Dropper.wh TrojanDropper.Dinwod.ale Worm[NET]/Win32.Nimda.gic Trojan-Dropper.Win32.Dinwod.acqn Trojan/Win32.OnlineGameHack.C33730 TrojanDropper.Dinwod Trojan.Dropper Trojan.DR.Dinwod!dCCk6/8cSJk


Finally , the specific overlays are designed for Australian financial institutions , and Australia is one of the geographic regions that is accepted by the C2 .


A backdoor also known as: Trojan.Win32.Symmi!O WS.Reputation.1 OnLineGames.IRMW Win32/Oflwr.A!crypt Riskware.Win32.FakeLPK.cwuava BackDoor.BlackHole.21297 TR/Obfuscated.XZ.937 HackTool.Sniffer.WpePro PSW.OnlineGames4.BEIZ


A backdoor also known as: Trojan.Connapts Trojan/Small.ndx Trojan.Heur.LP.EDC094 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.MLW.dylhy W32/Trojan.CISW-8628 Backdoor.Bot/Variant Trojan/Win32.Xema.C93063 W32/Small.NDX!tr Win32/Backdoor.796


This spring, the author of the NukeBot banking Trojan published the source code of his creation.


A backdoor also known as: Adware.ELEXCRTD.Win32.5604 Trojan.Johnnie.D709 not-a-virus:AdWare.Win32.Elex.sgn Adware.Mutabaha.1819 RiskTool.Uncheckit.l TR/Chuckenit.dglxl Trojan:Win32/Chuckenit.A not-a-virus:AdWare.Win32.Elex.sgn


This blog post highlights the technical innovations that we found in the latest versions of Carbon we have discovered.


A backdoor also known as: Backdoor.Slingup BKDR_SLINGUP.M W32/Zbot.AAJD Backdoor.Trojan BKDR_SLINGUP.M Trojan.Win32.Yakes.pqep Trojan.Win32.Inject.ecmohu Trojan.Win32.Z.Yakes.672768 Troj.W32.Yakes.tn6w BackDoor.Tordev.8 Trojan.Win32.Injector W32/Zbot.EUMY-8878 TR/Injector.juol Trojan/Win32.Yakes Trojan:Win32/Casidel.A Trojan.Win32.Yakes.pqep Trojan.Yakes Trojan.Yakes Trj/CI.A Win32/Injector.CXUT Win32.Trojan.Yakes.Ehid Trojan.Yakes!YuLYvE8ikp0 W32/Injector.CGQK!tr Win32/Trojan.621


We do not know exactly how many people have been infected with RuMMS malware .


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G Virus.Virut.Win32.27 W32/Virut.AI W32.Virut.CF Win32/Virut.17408 PE_VIRUX.A-1 Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg Virus.Win32.Virut.tt Virus.Win32.Virut.CE Trojan.MulDrop1.57199 PE_VIRUX.A-1 BehavesLike.Win32.Virut.dc W32/Virut.AI Win32/Virut.bn Trojan[Dropper]/Win32.Injector Win32.Virut.nc.53248 Virus.Win32.Virut.ce Win32/Virut.F Virus.Virut.06 Win32.Virut.E Win32/Virut.NBP IM-Worm.Win32.Zeroll W32/Sality.AO Virus.Win32.VirutChangeEntry.A


Spreads via password guessing over networks


The malware samples were mainly distributed through a series of malicious subdomains registered under a legitimate domain belonging to a well-known shared hosting service provider in Russia .


A backdoor also known as: Trojan.Kitoles Trojan.Ransom.Scarab Win32.Trojan.WisdomEyes.16070401.9500.9547 W32/Trojan.LUOM-4097 Ransom.CryptXXX Win.Ransomware.Scarab-6336012-1 Win32.Trojan-Ransom.Amnesia.J52DUW Trojan.Win32.Encoder.ewdzie Trojan.Win32.Z.Securityshield.193058 Trojan.Encoder.23898 Trojan-Ransom.FileCoder Trojan.Purga.w Trojan.Ransom.Scarab.3 Ransom:Win32/Kitoles.A Trojan/Win32.Scarab.R213792 Trojan-Ransom.Purga Win32.Trojan.Filecoder.Phqc Win32/Trojan.Ransom.089


This specific downloader, Cmstar, is associated with the Lurid downloader also known as Enfal'.


We assume it was rushed because , unlike GlanceLove , it lacked any real obfuscation .


Recently Malwarebytes got access to several elements of the espionage toolkit that has been captured attacking Vietnamese institutions.


I am not entirely sure what it is but it has some indications of fareit Trojan.


A backdoor also known as: Trojan.Dos.Bonk.C DoS.Win32.Bonk!O Dos.Bonk Win32.Trojan.Bonk.Tcwa W32/Tool.FPXO-2436 DoS.Win32.Bonk.c Trojan.Dos.Bonk.C Trojan.Win32.Bonk.ddda TrojWare.Win32.DoS.Bonk.C Trojan.Dos.Bonk.C Trojan.Inject.654 BehavesLike.Win32.ExploitMydoom.mm Backdoor.Win32.HacDef W32/VirTool.RO TR/RedCap.kudtu DoS:Win32/Bonk.C Trojan.Dos.Bonk.C DoS.Win32.Bonk.c Trojan.Dos.Bonk.C Trojan.Asthma.23305 Trojan.Dos.Bonk.C Trojan.Dos.Bonk.C Win32/DoS.Bonk.C DoS.Bonk!CFlP7tiJI8A DoS/Bonk.A


A backdoor also known as: Trojan.Duqu Trojan.Duqu.Win32.13 TROJ_DUQU.DEC Win32.Trojan.WisdomEyes.16070401.9500.9587 Win32/Duqu.A TROJ_DUQU.DEC Win.Trojan.Duqu-14 Trojan.Win32.Duqu.evvbpp Trojan.Duqu.2 W32/Trojan.CVVB-9378 TR/Offend.6750706 W32/Duqu.A!tr Trojan:Win32/Duqu.C Worm/Win32.Stuxnet.R608 Trojan.Duqu!ZB0mf9vKpU8 Trojan.Win32.Urelas Win32/Trojan.d72


r1-r4 : This is a local privilege escalation ( root ) exploit , which includes : CVE-2013-6282 , camerageroot ( http : //www.77169.org/exploits/2013/20130414031700 ) , a rooting tool for mtk6592 and addtional exploit .