The opcode instructions generated by this custom VM are divided into different categories : Logical opcodes , which implement bit-logic operators ( OR , AND , NOT , XOR ) and mathematical operators Conditional branching opcodes , which implement a code branch based on conditions ( equals to JC , JE , JZ , other similar branching opcodes ) Load/Store opcodes , which write to or read from particular addresses of the virtual address space of the process Specialized opcodes for various purposes , like execute specialized machine instruction that are not virtualized We are publishing below the ( hopefully ) complete list of opcodes used by FinFisher VM that we found during our analysis and integrated into our de-virtualization script : INDEX MNEMONIC DESCRIPTION 0x0 EXEC Execute machine code 0x1 JG Jump if greater/Jump if not less or equal 0x2 WRITE Write a value into the dereferenced internal VM value ( treated as a pointer ) 0x3 JNO Jump if not overflow 0x4 JLE Jump if less or equal ( signed ) 0x5 MOV Move the value of a register into the VM descriptor ( same as opcode 0x1F ) 0x6 JO Jump if overflow 0x7 PUSH Push the internal VM value to the stack 0x8 ZERO Reset the internal VM value to 0 ( zero ) 0x9 JP Jump if parity even 0xA WRITE Write into an address 0xB ADD Add the value of a register to the internal VM value 0xC JNS Jump if not signed 0xD JL Jump if less ( signed ) 0xE EXEC Execute machine code and branch 0xF JBE Jump if below or equal or Jump if not above 0x10 SHL Shift left the internal value the number of times specified into the opcodes 0x11 JA Jump if above/Jump if not below or equal 0x12 MOV Move the internal VM value into a register 0x13 JZ JMP if zero 0x14 ADD Add an immediate value to the internal Vm descriptor 0x15 JB Jump if below ( unsigned ) 0x16 JS Jump if signed 0x17 EXEC Execute machine code ( same as opcode 0x0 ) 0x18 JGE Jump if greater or equal/Jump if not less 0x19 DEREF Write a register value into a dereferenced pointer 0x1A JMP Special obfuscated “ Jump if below ” opcode 0x1B * Resolve a pointer 0x1C LOAD Load a value into the internal VM descriptor 0x1D JNE Jump if not equal/Jump if not zero 0x1E CALL Call an external function or a function located in the dropper 0x1F MOV Move the value of a register into the VM descriptor 0x20 JNB Jump if not below/Jump if above or equal/Jump if not carry 0x21 JNP Jump if not parity/Jump if parity odd Each virtual instruction is stored in a special data structure that contains all the information needed to be properly read and executed by the VM .


A backdoor also known as: JS/Crypted.LS JS/Exploit.Pdfka.OYP Exploit.JS.Pdfka.ffn Exploit.Script.Heuristic-pdf.gutws Exploit.PDF.1988 HEUR_PDFEXP.B BehavesLike.PDF.Evasion.cr PDF/Obfusc.F!Camelot EXP/Pidief.aag.28 Exploit:JS/ShellCode.AF Exploit.JS.Pdfka.ffn


The threat actor used Cobalt Strike, AdFind to gather AD information, exploited the Zero Logon vulnerability CVE-2020-1472, and deployed Quantum ransomware using PSExec.


It was seen around 2015:02:18.


CLOAKING Client-side Carrier Checks In our basic command & control example above , we didn ’ t address the ( incorrectly labeled ) “ imei ” field .


A backdoor also known as: W32.W.Sircam.l8kk Heur.Corrupt.PE Worm[Email]/Win32.Sircam Worm:Win32/Sircam.D@mm.dam#2


Characterized by relatively unsophisticated technical merit and extensive use of spear phishing, the group targeted individuals and organizations in the Middle East including targets inside Iran itself, as well as across Europe and in the United States.


Once the observed Gmail account was under their control, the actors then forwarded malware to over a hundred of their contacts, ranging from an address for the United Nations Refugee Agency in Turkey to a site contact for Reza Pahlavi, the son of the deposed Shah Mohammad Reza Pahlavi.


In red , we see those values being passed into the suspicious Java method through the registered interface .


While investigating a recent security incident, Unit 42 found a webshell that we believe was used by the threat actor to remotely access the network of a targeted Middle Eastern organization.


After the profile is installed , the user will then be redirected to another Apple phishing site .


Lookout researchers have been tracking this threat for the last month .


A backdoor also known as: W32/Pate.dr Backdoor.Bot W32/Eyeveg.f I-Worm.Eyeveg!zj+VAcYzzNU W32.Lanieca.A@mm Win32/Eyeveg.I Email-Worm.Win32.Eyeveg.f Trojan.Win32.Eyeveg.haym Win32.Worm-email.Eyeveg.Wtxf Win32.HLLW.Eyeveg.2 Worm.Eyeveg.Win32.18 BehavesLike.Win32.Sality.lc I-Worm/Eyeveg.g TR/Dldr.Small.atx.1 W32/Eyeveg.F@mm Worm[Email]/Win32.Eyeveg W32.W.Eyeveg.f!c Worm/Win32.IRCBot Worm:Win32/Eyeveg.E Trojan.BHORA.05647 W32/Eyeveg.D.worm I-Worm.Eyeveg.I Worm/Eyeveg.M Worm.Win32.Eyeveg.I


If the user has launched Play Market , the Trojan intercepts the event and displays a window on top of the Google Play window , prompting the user to enter his/her bank card details in the fake window .


Recently, Cyphort Labs received multiple malware samples that were used to target a financial institution in Asia.


A backdoor also known as: W32.MosquitoQKK.Fam.Trojan Backdoor/W32.Winker.35840 W32/Risk.KYQV-3380 Backdoor.Trojan BKDR_WINKER.J Win.Trojan.Winker-3 Backdoor.Win32.Winker.j Trojan.Win32.Winker.ejnu Backdoor.W32.Winker.j!c Backdoor.Win32.Winker.J BackDoor.Winker Backdoor.Winker.Win32.3 BKDR_WINKER.J BehavesLike.Win32.Mydoom.nc TrojanDownloader.ZMailBody Trojan[Backdoor]/Win32.Winker Trojan.Heur.PT.cmGfb4TaW3pb Backdoor.Win32.Winker.j Backdoor:Win32/Winker.H Trojan/Win32.Winker.C262606 Backdoor.Winker Bck/Winker.B Win32/Winker.J Win32.Backdoor.Winker.Hqbx Backdoor.Winker!Rg36gBAv3uo


On August 10 and 11, 2016, Mansoor received SMS text messages on his iPhone promising new secrets about detainees tortured in UAE jails if he clicked on an included link.


A backdoor also known as: W32.HfsAutoB.DBB5 Backdoor.Win32.Torr!O Backdoor/Torr.lgj Backdoor.Trojan Trojan.Win32.Torr.bjcnz Backdoor.Win32.Popwin.~IQ BackDoor.Bull BehavesLike.Win32.Trojan.qc Backdoor:Win32/Yonsole.B Backdoor/Win32.Hupigon.C90957 Backdoor.Torr Trojan.MalPack.NSPack Backdoor.Win32.Hupigon Trj/CI.A Win32/Trojan.b8d


In April and July of 2017, Bankbot-infected apps were detected posing as entertainment and online banking apps on Google Play.


] top/ Oct 23 , 2017 hxxp : //online.bankaustria.at.id8817466 [ .


GlassRAT's command and control structure has exhibited brief overlap with C2 that was identified in campaigns associated with malware originally reported in 2012 that targeted government and military organizations in the Pacific Region.


In March of this year, Unit 42 investigated the SamSa actors that were attacking the healthcare industry with targeted ransomware.


A backdoor also known as: HW32.Packed.3923 Trojan.Zbot.AM4 Trojan.Extension.Exploit Trojan.Kryptik.Win32.572826 Trojan/Kryptik.cgut BKDR_SHARIK.SMA3 Win32.Trojan.Kryptik.ho W32/Zbot.CAJ BKDR_SHARIK.SMA3 Packed.Win32.Krap.ae Trojan.Win32.Krap.dcjtjs Packer.W32.Krap.ae!c trojandropper.win32.gepys.a BehavesLike.Downloader.dc W32/Zbot.REWN-4435 Packed.Krap.euzr W32/Cryptodef.PD!tr Trojan[Packed]/Win32.Krap Trojan.Kazy.D657FD Packed.Win32.Krap.ae Trojan:Win32/Ropest.B Trojan/Win32.Necurs.R116179 Win32.Packed.Krap.Ajbo Trojan.Kryptik!bJOkWg4AxxQ Crypt.Win32.Krypti7 Win32/Herz.B Win32/Trojan.19b


Last but not least , all the overlay screens ( injects ) for the banks include two steps ; first stealing the victim ’ s login credentials , then their credit card details .


Servers acting as command and control for TelsaCrypt variants.


It will also install the malicious app “ com.qualcmm.timeservices. ” These archives contain the file “ .root.sh ” which has some comments in Chinese : Main phase In this phase , the Trojan launches the “ start ” file from Game324.res or Game644.res .


By using Google Cloud Messaging botnet owners can operate without a C & C server , thus eliminating the threat of the botnet being detected and blocked by law enforcement authorities .


A backdoor also known as: VBS.Dunihi Trojan.Script.Autorun.dmmmnm Trojan-Downloader.JS.Nemucod


Record phone calls audio in 3gp format .


Map of potential targets Early samples of FrozenCell used an online service for storing geolocation information of infected devices .


A backdoor also known as: Win32.Mamianune.A Virus/W32.Mamianune Win32.Virus.Mamianune.a W32.Mamianune Win32/Ratab.A PE_GORONT.A Win32.Mamianune.A Email-Worm.Win32.Mamianune.lf Win32.Mamianune.A W32.W.Mamianune.lJsP Virus.Win32.Mamianune.A Win32.Mamianune.A PE_GORONT.A W32/Worm.RataB.6363 Worm[Email]/Win32.Mamianune.lf Win32.Mamianune.A Email-Worm.Win32.Mamianune.lf Virus.Manunya.11907 Win32.Mamianune.A Win32/Mamianune.A Virus.Win32.Mamianune_infected.if W32/Mamianune.A


If the value does not match , the app skips the “ disclosure ” page and billing process and brings the user straight to the app content .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9990 W32.Shadesrat Trojan.MSIL.Crypt.gamf Trojan.DownLoader5.3395 Trojan.Injector.Win32.74630 BehavesLike.Win32.PWSZbot.fc WORM/Ainslot.A.706 Trojan.Strictor.D12CFF Trojan.MSIL.Crypt.gamf Trojan:MSIL/MalLoader.A Trojan/Win32.Inject.C160327 Trojan.Llac Win32.Trojan.Jorik.Lkdt Trojan.Win32.Inject Win32/Trojan.401


A backdoor also known as: Trojan.Downloader.Shelcod.A Trojan-Exploit/W32.MS08-067.16384.H Exploit.Win32.MS08-067!O Trojan/Exploit.MS08-067.dw Trojan.Downloader.Shelcod.A Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Moo Win32/SMBloz.A Win.Exploit.MS08-1 Trojan.Downloader.Shelcod.A Trojan.Downloader.Shelcod.A Trojan.Win32.DownLoad1.bdwuil Trojan.Win32.EX-MS08-067.16384.L Trojan.Downloader.Shelcod.A Trojan.Downloader.Shelcod.A Trojan.DownLoad1.17537 Exploit.MS08.Win32.402 Exploit.MS08-067.jq TR/Expl.MS08-067.DW Win32.EXPLOIT.MS08-067.dw.kcloud Exploit.W32.MS08-067.dw!c Trojan.Downloader.Shelcod.A Exploit.MS08067 Win32.Exploit.Ms08-067.bltx Exploit.MS08-067!xVSxDtd39IM Exploit.Win32.MS08-067 W32/MS08_067.DW!exploit Win32/Trojan.Exploit.59a


Inside this file, we found a .lnk file, which after executing uses PowerShell to download a second stage of malware.


Android banker PaloAlto Retefe is one of the most targeted banking Trojans currently in the wild.


The RAT delivered by this campaign was not particularly interesting and had all the features you would expect in such a tool.


A backdoor also known as: Trojan.Graftor.D3CD95 BehavesLike.Win32.PUPXAO.cc TrojanDownloader:Win32/Strumapine.A Trojan-Downloader.Win32.Banload


The Ohagi malware is a short and basic piece of code, providing its operator extensive information about the target machine, possibly for optimizing future attacks and enhancing survivability of later stages of an assault on the victim's systems.


Here are some significant updates to Vawtrak: The malware now includes a DGA.


Many documents call out to tetrasecured[.]com/word/webstat/image.php?id= sinkholed by AlienVault to track when when they are opened.


It is less common, and this fact may allow it to slip unnoticed by administrators and researchers.


As outlined in our original posting, the DealersChoice exploitation platform generates malicious RTF documents which in turn use embedded OLE Word documents.


Along with creating hourly scheduled tasks, the adware also has the potential to download additional malicious code and direct the user to compromised websites.


In December 2022, Nevada ransomware was advertised in criminal forums.


A backdoor also known as: P2P-Worm.Win32!O Win32.Trojan.WisdomEyes.16070401.9500.9898 W32/Furby.A@p2p WORM_FURBY.A Win.Worm.Furby-2 P2P-Worm.Win32.Furby Trojan.Win32.Furby.empc Worm.Win32.P2P-Furby.81920 Worm.Win32.Furby.A Trojan.StartPage1.4893 WORM_FURBY.A W32/Furby.YYNU-6008 Worm/P2P.Furby Worm[P2P]/Win32.Furby Worm:Win32/Furby.A P2P-Worm.Win32.Furby HEUR/Fakon.mwf Worm.Furby Win32/Furby.A Worm.P2P.Furby W32/FURBY.A!worm.p2p W32/Byfur.A.worm


As a result , the Trojan delete button in the list of applications becomes inactive , which may cause problems for inexperienced users .


A backdoor also known as: Trojan/Tofsee.av Win32.Trojan.WisdomEyes.16070401.9500.9999 TSPY_ZBPAK.SML2 Trojan.Win32.DownLoad3.cxnnmp TrojWare.Win32.Kryptik.BAXQ Trojan.DownLoad3.21597 Trojan.Zbot.Win32.117645 TSPY_ZBPAK.SML2 BehavesLike.Win32.ICLoader.kh Trojan[Spy]/Win32.Zbot Trojan.Renos.43 TrojanDownloader:Win32/Tofsee.D BScope.Malware-Cryptor.SB.01798 Trj/Hexas.HEU Win32/Tofsee.AV Trojan.Win32.Yakes W32/Zbot.FG!tr


A backdoor also known as: Win32.Worm.TUC Trojan.Folcom Win32.Worm.TUC W32.SillyFDC Win32.Worm.TUC Win32.Worm.TUC TrojWare.Win32.Injector.XYNZ Trojan.MulDrop5.40123 Win32.Worm.TUC Trojan:Win32/Folcom.A Trojan/Win32.Folcom.R158004 Win32.Worm.TUC


The Securonix Threat Research team has identified an ongoing hyper-targeted phishing campaign TACTICAL#OCTOPUS targeting individuals in the US using seemingly valid tax forms and contracts.


A backdoor also known as: PWS-OnlineGames.cn Trojan.Win32.Vaklik.srhd W32/Trojan2.BDOH Vaklik.ATF Trojan.Spy-47164 Trojan.Win32.Vaklik.bha Trojan.Vaklik.K Trojan.Win32.Vaklik.15917 TrojWare.Win32.Magania.~AP Trojan.Vaklik.K Trojan.MulDrop.17281 PWS-OnlineGames.cn Trojan:Win32/Vaklik.A Trojan/Win32.OnlineGameHack Trojan.Vaklik.K W32/Trojan.CNYI-4128 Trojan.Win32.Vaklik W32/OnlineGames.BHA!tr Trj/Lineage.LET


A backdoor also known as: WS.Reputation.1 Trojan.DownLoader11.18813


According to our data , 0.4 % of the websites visited by users of our products were compromised sites .


FireEye analyzed a Microsoft Word document where attackers used the arbitrary code injection to download and execute a Visual Basic script that contained PowerShell commands.


Svpeng is only currently attacking clients of Russian banks .


Both the Google Play Store pages and the decoys of the malicious apps are in Italian .


A backdoor also known as: Trojan.Mdropper Win32.Mdropper Exploit.Rtf.based EXP/Rtf.E Trojan:Win32/Rtfdrop.C Trojan.Mdropper Data/CVE20103333.A!exploit


] com hxxp : //mailsa-qaf [ .


And TikTok is no exception .


A backdoor also known as: Trojan/Demtranc.aa BKDR_DEMTRANC.C Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Risk.XJQA-1744 Backdoor.Trojan BKDR_DEMTRANC.C W32/MalwareF.HOCF Trojan:Win32/Demtranc.C Trojan:Win32/Demtranc.C Trojan/Win32.Demtranc.R196 Trojan-PWS.Win32.Small W32/Demtranc.AA!tr Win32/Trojan.b7f


A backdoor also known as: Trojan.FakeFolder Win32.Trojan.WisdomEyes.16070401.9500.9943 Trojan.Win32.CFI.cqhtqx Trojan.MulDrop5.19111 Trojan/Krastic.a Worm:Win32/YahLover.K Trojan.Heur.FmGfrnQe6hhib HEUR/Fakon.mwf Trojan.Win32.Spy


Permissions The package name follows the original style name used on DenDroid .


All of this is possible because of its modular nature.


A backdoor also known as: Trojan-Spy/W32.ZBot.1251328 TROJ_HPUTOTI.SMQ Win32.Trojan.WisdomEyes.16070401.9500.9590 W32.Golroted Trojan-Spy.Win32.Zbot.yopt Trojan.Win32.Z.Zbot.1251328 Troj.Spy.W32.Zbot!c Trojan.PWS.Stealer.19347 TR/AD.Inject.pfzxb Trojan-Spy.Win32.Zbot.yopt Trj/CI.A Trojan.Inject AutoIt/Injector.DCY!tr Win32/Trojan.01c


Threatstream Labs came across an interesting FrameworkPOS sample that given it is two months old, its digitally signed and its certificate hasn't been revoked.


Threat actors delivered the same document via spear-phishing emails to both organizations.


The attack involved a spear-phishing email sent to a single French diplomat based in Taipei, Taiwan and contained an invitation to a Science and Technology support group event.


The additional commands that attackers can carry out via a socket connection ( top ) and the key used to encrypt the stolen data ( bottom ) Correlating Bouncing Golf 's Activities We monitored Bouncing Golf ’ s C & C-related activities and saw that the campaign has affected more than 660 devices as of this writing .


A backdoor also known as: W32.FulicoLTQ.Trojan Worm.RJump.A Worm/W32.RJump.3514318.B Worm.RJump.A Worm.RJump.Win32.1 W32/RJump.g Worm.RJump.A W32/RJump.D W32.Rajump Win32/RJump.D WORM_RJUMP.A Win.Worm.RJump-4 Worm.RJump.A Worm.Win32.RJump.a Worm.RJump.A Trojan.RJump.ghkp Worm.Win32.RJump.3514318 W32.W.RJump.kZfP Worm.RJump.A Worm.Win32.RJump.A0 Trojan.Iespy WORM_RJUMP.A W32/RJump.worm Worm.Win32.RJump W32/RJump.AKZT-0686 Trojan/StartPage.fo Worm:Win32/Rjump.J Worm/Win32.RJump.a Worm:Win32/RJump.J Worm.Win32.RJump.a Worm/Win32.RJump.R17519 W32/RJump.worm Bck/Ravmon.B Win32/RJump.A Win32.Worm.Rjump.Alsj Worm.RJump!KbA9JqtFC8g


Method onPostExecute parses the response from the above HTTP session and executes the commands provided by the remote attacker .


Gathered file Type Description lock Text Implant log ldata sqlite3 Location data based on network ( cell_id ) gdata sqlite3 Location data based on GPS coordinates sdata sqlite3 SMS messages f.db sqlite3 Facebook messages v.db sqlite3 Viber messages w.db sqlite3 WhatsApp messages Among the other data gathered were SMS banking messages that revealed an account with a balance of more than US $ 10,000.But as far as we know , the attacker behind this campaign is not interested in stealing the victims ’ money .


In the unpacked core we found strings suggesting that the authors named the project Shakti, which means power in Hindi or may also be a reference to the Shakti goddess.


A backdoor also known as: Trojan.Vasdek Win32.Trojan.Graftor.Lneg Backdoor.Win32.Hupigon Trojan.Graftor.D48DBE RiskWare.HangVote! Win32/Trojan.97a


A backdoor also known as: Trojan.NSIS.Sinis.A Nsis.Dropper.Cv!c Trojan.Carberp.663 TrojanDownloader:Win32/Sinis.C Trj/CI.A W32/Dx.BCQS!tr Win32/Trojan.Dropper.552


Figure 2 – Granting Permissions The following permissions are granted to the app : Figure 3 – Permissions Granted to App A closer look at the code reveals the application gathers a list of installed applications to compare the results against a list of targeted applications ( Figure 4 ) .


Asacub versions Sewn into the body of the Trojan is the version number , consisting of two or three digits separated by periods .


In this case paying the attackers will not help get any files back.


A backdoor also known as: Trojan.CHM.Downloader.5065 Exploit.CHM.Downloader HTML.Trojan-Downloader.Posh.D Exploit.Chm.Downloader!c HEUR_CHM.E Exploit:Win32/Trupto.A Exploit.Win32.Trupto Win32/Trojan.Exploit.4f5


Forcepoint Security Labs™ recently encountered a strain of attacks that appear to target Pakistani nationals.


A backdoor also known as: Trojan.Win32.Prorat-19.fwto W32/TrojanX.CKO BKDR_AVW.A Trojan.MulDrop.1246 BKDR_AVW.A W32/Trojan.BGRF-7808 WORM/Prorat.351276 BScope.Trojan.Dropper.we Trojan.Win32.Dropper.Aouw Backdoor.Win32.Prorat


Pin request overlay This overlay asks the user to provide their PIN to unlock the mobile device , which is immediately exfiltrated to the C2 .


Therefore, the Korea Financial Security Institute FSI identified the specific characteristics of domestic IT and work environment, and profiled specific threat groups that are using the attacks.


A backdoor also known as: Heur.Packed.Unknown FakeAlert.PY


Upon creation the class will start to take screenshots that will be stopped and uploaded to the C2 once the service ca n't find the targeted applications running .


It is also able to move code execution into different locations if needed .


A complete list of hashes can be found here .


We also found that recent publications on the group's activity have done nothing to change their behavior or reduce their activity.


A backdoor also known as: Udsdangerousobject.Multi BackDoor-EPJ.a Trojan/Delf.ajsi BKDR_DELF.SMR Win32.Trojan.WisdomEyes.16070401.9500.9989 Backdoor.Trojan BKDR_DELF.SMR Win.Trojan.Delf-20678 Trojan.Win32.Delf.brsrqp Trojan.Win32.Z.Delf.836986 Trojan.Delf.Win32.27370 BehavesLike.Win32.Dropper.ch Trojan/Delf.nbp Win32.Troj.DelfCode.ab.kcloud Trojan.Graftor.D6F46 Backdoor:Win32/Exsorv.A Trojan/Win32.Delf.R48296 Win32.Trojan.Delf.Eerb Trojan.Delf!+mMB+iIfbgw W32/Delf.NTBZ!tr


A backdoor also known as: Trojan.Dynamer.S18607 Trojan.Razy.D39CC3 Win32.Trojan.WisdomEyes.16070401.9500.9989 TSPY_ZBOT_GA250A16.UVPM Trojan.Win32.Panda.elkrhc Trojan.Win32.Z.Zbot.143360.ET Trojan.PWS.Panda.11620 Trojan.Zbot.Win32.198737 TSPY_ZBOT_GA250A16.UVPM BehavesLike.Win32.TrojanShifu.ch TrojanDownloader:Win32/Macapy.A!bit BScope.Trojan-Spy.Zbot Win32.Trojan.Downloader.Wtxj Win32/Trojan.Downloader.18b


Using the ThreatConnect platform we ingested the spear-phishing emails Bellingcat provided, processed out the relevant indicators, and compared them to previously known Fancy Bear activity.


A few days later they can cancel the trial and do not need to pay a penny .


When this shortcut file is opened, the host will be infected with malware called Asruex


It disguises itself as an anti-virus product, and attempts to encourage users into purchasing a non-existent protection.


A backdoor also known as: TROJ64_COINMINER.SMB Trojan.BtcMine.1165 BehavesLike.Win64.Ramnit.hh Trojan.Win64.CoinMiner TrojanDropper:Win32/Dapato.M!bit


This malware is not a ransomware and is not a bitcoin miner either as others have reported.


Proofpoint researchers have uncovered that the threat actor commonly referred to as FIN7 has added a new JScript backdoor called Bateleur and updated macros to its toolkit.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9883 W32/Pws.ALMI Win.Spyware.42247-1 BehavesLike.Win32.Ransomware.dc W32/PWS.PONN-0793 W32.Malware.Downloader


The attackers modified a few lines of code, recompiled the program, and disbursed the trojanized version on compromised web servers.


All of these methods attempt to space out the introduction of possible signals in various stages , testing for gaps in the publication process .


One of the latest ransomware variants is called TeslaCrypt and appears to be a derivative of the original Cryptolocker ransomware.


So I don ’ t know what kind of files will be executed , but they could be malicious or advertising files .


This threat group has been around for quite a while, and commonly operated tangentially to APT1 intrusions into defense contractors and aerospace companies.


A backdoor also known as: Trojandownloader.Pogolcil Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Kryptik.ewytqt Trojan.Win32.Z.Kryptik.208896.OT TR/Crypt.ZPACK.bggbz TrojanDownloader:Win32/Pogolcil.E!bit Trojan.Win32.Crypt Trj/GdSda.A Win32/Trojan.5c0


The new variant caught our attention because it ’ s an advanced malware with unmistakable malicious characteristic and behavior and yet manages to evade many available protections , registering a low detection rate against security solutions .


Technical and temporal analysis of the campaign supports these statements and indicates a direct correlation between the cyber attacks and the ongoing war, highlighting an alarming blend between cyber espionage, physical warfare, and the driving political forces behind them.


The attacks use multiple exploits in an attempt to gain root access on a device .


A backdoor also known as: W32.eHeur.Virus02 Trojan-Dropper/W32.Dapato.642320 Trojan-Dropper.Win32.Dapato!O Trojan/Dropper.Dapato.bkcv BKDR_XTRAT.LTY BKDR_XTRAT.LTY Trojan.Win32.Trojan-Dropper.ychad Dropper.Dapato.Win32.29248 W32/Trojan.AOFQ-7014 TrojanDropper.Dapato.ijj TR/Drop.Dapato.bkcv Trojan:Win32/Skymper.A TrojanDropper.Dapato Trj/CI.A Win32/Poison.NLN Win32.Trojan.Falsesign.Gbv Trojan-Dropper.Win32.Dapato W32/Dapato.BKCV!tr Win32/Trojan.0cc


Just in time for the holidays, a brand new Point Of Sale POS malware family has been discovered.


Accessing the same malicious site would redirect its user to another malicious website ( hxxp : //apple-icloud [ .


A backdoor also known as: Trojan/Arcdoor.te Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Win32.MLW.cxmnch Trojan.DownLoader4.56100 Worm.MSIL.gb Worm/MSIL.Arcdoor Trojan:MSIL/Stooten.A Worm/Win32.Arcdoor.C80706 Worm.MSIL.Arcdoor


A backdoor also known as: Trojan/W32.Cheater.32256 W32.Sharmovo.A8 Trojan/Remtasu.a Win32.Trojan.Delf.q Win32/Tnega.VIIYB TROJ_ENEG.SMUM2 Trojan.Win32.KillFiles.cqjidr W32.Lamer.lymQ TrojWare.Win32.Delf.edn Trojan.KillFiles.11968 TROJ_ENEG.SMUM2 BehavesLike.Win32.HLLP.nh Trojan/Resetter.e TR/Resetter.agah Trojan/Win32.Resetter Trojan.Heur.ED60A7 Trojan:Win32/Sharmovo.A Trojan/Win32.Resetter.R19869 Trojan.Resetter Trojan.Win32.Spy W32/Delf.BSE!tr


Check Point researchers have conducted a thorough investigation of the DiamondFox malware-as-a-service in collaboration with TerbiumLabs, a Dark Web Data Intelligence company.


A backdoor also known as: Trojanspy.Klogger Troj.Spy.W32.Klogger.tn9g Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/Trojan.PPFF-1848 Hacktool.Keylogger Win.Spyware.1752-2 Trojan-Spy.Win32.Klogger Trojan.Win32.Klog.dkjqot Trojan.Win32.A.Klogger.23552 Trojan.Klog.32786 BehavesLike.Win32.Sdbot.mm Win32.Outbreak TrojanDropper.Injector.aabu Trojan[Spy]/Win32.Klogger Trojan-Spy.Win32.Klogger Trojan/Win32.Swrort.C200048 TrojanSpy.Klogger Trj/Keylog.ES Win32/Spy.Klogger Win32.Trojan-spy.Klogger.Pbfr Win32/Trojan.54e


A backdoor also known as: Trojan.Powershell Win32.Trojan.WisdomEyes.16070401.9500.9609 Trojan.Win32.Z.Psdl.370688 Troj.W32.SchoolGirl.tnx1 Downloader.Betload.Win32.51 BehavesLike.Win32.Downloader.ft SCRIPT.PowerShell


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9995 Backdoor.Trojan BehavesLike.Win32.RansomTescrypt.jc TrojanDownloader:Win32/Macup.A Trj/CI.A Win32/Trojan.b9d


] com on port 22011 .


Distracted users mistyping the first n when accessing www.santanderempresarial.com.br are subject to banking credentials theft and a very convincing phone call from a pretended Santander's attendant.


A backdoor also known as: W32.NumberNameHB.Fam.Worm Trojan.HideExec Troj.Clicker.W32.VB.lhyE not-a-virus:RiskTool.Win32.HideExec.r Riskware.Win32.HideExec.ewkvlv Trojan.Win32.Z.Spy.171696 Program.HiddenStart TR/Spy.CoinBit.VY Win32.Troj.Miner.i.kcloud TrojanDropper:Win32/MineBicoin.A not-a-virus:RiskTool.Win32.HideExec.r Trojan.Dropper Win32/Trojan.863


] com Backend server spy [ .


The following month , we released a private report on our Threat Intelligence Portal to alert our clients about this newly discovered operation and began writing YARA rules in order to catch more samples .


A backdoor also known as: Win.Trojan.MSShellcode-7 HEUR_PDFEXP.F


Anubis can completely hijack an Android mobile device , steal data , record phone calls , and even hold the device to ransom by encrypting the victim ’ s personal files .


A backdoor also known as: W32.HfsReno.B3AA Trojan.Win32.Crypted.csnsgk Trojan.Rodricter.69 BehavesLike.Win32.PUPXAX.ch Trojan.Razy.D3CCDD Trojan:Win32/Claretore.L


We believe this activity, which dates back to at least July 2017, was intended to target travelers to hotels throughout Europe and the Middle East.


A backdoor also known as: W32.TakesoftC.Trojan Trojan/W32.Starter.49160.B Trojan.Win32.Starter!O Trojan.Kplo.S12777 Trojan/Starter.tt TSPY_STARTER_CD100003.RDXN Win32.Trojan.FakeMicro.d W32/Backdoor.HEKM-3098 W32.Ramnit.B Win32/Gamepass.PPO TSPY_STARTER_CD100003.RDXN Trojan.Win32.Starter.bwelm Trojan.Win32.Starter.65536.D Trojan.Starter.1551 Trojan.Starter.Win32.250 W32/Backdoor2.HIFX Trojan/Starter.fb TR/Starter.TT Trojan/Win32.Starter Trojan:Win32/Kplo.B Trojan/Win32.Starter.R1734 Trojan.Starter Trojan.Win32.FakeLpk.a Trojan.Starter!IXSYvr7pvbg Trojan.Win32.Starter


A backdoor also known as: VB:Trojan.Valyria.489 O97.Madeba.3874 VBA.Trojan.obfuscated.b VB:Trojan.Valyria.489 VB:Trojan.Valyria.489 Vb.Troj.Valyria!c VB:Trojan.Valyria.489 VB:Trojan.Valyria.489 VB:Trojan.Valyria.489 VB:Trojan.Valyria.489 Trojan.VB.Valyria Win32/Trojan.daf


A backdoor also known as: Trojandownloader.Nekozillot Trojan.MSILPerseus.D21311 Trojan.Win32.MSILPerseus.exesfy TrojanDownloader:MSIL/Nekozillot.A!bit Trj/GdSda.A Win32/Trojan.2a8


A backdoor also known as: W32.ForeverXA.Worm Trojan.Win32.Swisyn!O Trojan.Swisyn.Win32.22804 Trojan/Swisyn.bwfd Trojan.Razy.D162A Win32.Trojan.VB.kc W32.Gosys TROJ_SWISYN.SCX Win.Trojan.Kazy-1164 Trojan.Win32.Swisyn.bwfd Trojan.Win32.Swisyn.crsvjc Troj.W32.Swisyn.mzNn Trojan.MulDrop7.40720 BehavesLike.Win32.Swisyn.dm Trojan.Win32.VB Trojan/Swisyn.wjs Trojan.Win32.Vb Trojan.Win32.Swisyn.bwfd Trojan/Win32.Swisyn.R1452 MAS.Trojan.VB.01049 Win32.Trojan.Swisyn.Wsty W32/Swisyn.BNER!tr Win32/Trojan.d47


The third type of information will be sent when RuMMS intercepts any SMS messages , including the balance inquiry results when it contacts the SMS code of a particular financial service .


2016 We do not know exactly how many people have been infected with RuMMS malware ; however , our data suggests that there are at least 2,729 infections with RuMMS samples from January 2016 to early April 2016 .


This is a good example where two-factor authentication based on SMS would fail since the attacker can read the SMS .


A backdoor also known as: Trojan.BAT.Favadd!O Trojandropper.Favorcopy Trojan.BAT.Favadd.b Trojan.Win32.Qhost.cyikun BAT.S.Favadd.68096 Troj.BAT.Favadd.b!c Trojan.Win32.Favadd.a Worm.Win32.Autorun.dy02 Trojan.Favadd.201 W32/Trojan.UKLP-3332 Trojan/BAT.ax TrojanDropper:Win32/Favorcopy.A Trojan.BAT.Favadd.b Trojan/Win32.Favadd.R41157 Trojan.BAT.Favadd Trj/CI.A Win32/Trojan.ab8


This is an area where virus writers are actively working , resulting in a large number of technological innovations .


A backdoor also known as: Trojan-Downloader.Win32.Small!O TjnDownldr.Tibs.S12839 Trojan.Dropper/Packed Win32.Trojan.WisdomEyes.16070401.9500.9984 TROJ_DLOADER.XJ Trojan-Downloader.Win32.Small.bon Trojan.Win32.Small.bpavrf Packer.W32.Tibs.l4Hz Trojan.DownLoader.2489 TROJ_DLOADER.XJ BehavesLike.Win32.Downloader.xc TrojanDownloader.Vxgame.q TrojanDownloader:Win32/Multi.B Trojan.Win32.A.Downloader.4605[FSG] Trojan-Downloader.Win32.Small.bon Trojan/Win32.Downloader.R38972 Trojan-Downloader.Revelation.Tibs.B RiskWare.Tool.CK Trojan-Downloader.Win32.Tibs


The other iOS app “ Concipit Shop ” from the same developer appeared normal and was last updated on November 2019 .


On August 25, 2016, the Citizen Lab published a report showing that NSO's technology was used to target Ahmed Mansoor, a UAE-based human rights defender, as well as identifying targeting in Mexico.


Coming back to the execution flow , once the spyware hides itself , it starts an Android service named MainService .


Users looking forward to using the TikTok app amidst the ban might look for alternative methods to download the app .


A backdoor also known as: Adware.SMSHoax.Win32.45 Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.Win32.Inject.aiecb Trojan.Win32.Inject.evxrvf Hoax.W32.ArchSMS.mB2T Trojan.DownLoad3.49527 BehavesLike.Win32.BadFile.wm Trojan.Inject.adde Trojan:Win32/Zonsterarch.BW Adware.SMSHoax.6 Trojan.Win32.Inject.aiecb PUP/Win32.InstMonster.R215348 Adware.InstallMonster Trojan.Inject!lYnrTmkmtHE AdWare.InstMonster


It tries to steal victims' banking credentials and credit card information via phishing pages crafted to mimic Google Play's payment interface as well as the login pages of 7 different banks' apps.


A backdoor also known as: W32.DownloadRecslurpG.Trojan TrojanDownloader.Recslurp Trojan.MalPack BKDR_MATSNU.SM0 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.SEQE-1842 BKDR_MATSNU.SM0 Trojan.Win32.Recslurp.dsjyyo Trojan.Win32.Z.Recslurp.73728 Trojan.Proxy.27552 Trojan.Recslurp.Win32.1 BehavesLike.Win32.Madangel.lh W32/Trojan2.OUIQ Trojan/Recslurp.b TR/Crypt.ZPACK.kabym TrojanDownloader:Win32/Recslurp.E Trojan/Win32.Inject.R151698 Trojan.Recslurp Trj/CI.A W32/Kryptik.DZVG!tr Win32/Trojan.980


Ginning the ratings FURTHER READING 1 million Google accounts compromised by Android malware called Gooligan To implement the VM feature , the malicious APK installation dropper used by HummingWhale uses DroidPlugin , an extension originally developed by developers from China-based company Qihoo 360 , Check Point said .


A backdoor also known as: Trojan.FakeAlert Win32.Trojan.WisdomEyes.16070401.9500.9800 W32/Trojan.HIMV-8652 Troj.W32.Inject.tnKf BehavesLike.Win32.Downloader.lh Trojan.HTML.FakeAlert TrojanDownloader.Paph.ds TR/AD.Bosoda.mysge Trojan[Downloader]/Win32.Betload Trojan.Jaiko.D1041 Joke:BAT/Bosoda.A Trojan.FakeAlert Trj/CI.A HTML/FakeAlert.AF Win32.Trojan.Crypt.Wptb


On May 6 and May 11, 2015, Unit 42 observed two targeted attacks, the first against the U.S. government and the second on a European media company.


A backdoor also known as: W32.ActogarLTAI.Trojan Trojan.Zbot Trojan.IRCBot.Win32.7789 Trojan/AutoRun.IRCBot.jd Win32.Trojan.WisdomEyes.16070401.9500.9987 W32.IRCBot TROJ_HPCRYPCTB.SMR Trojan.Win32.Androm.dyglia TROJ_HPCRYPCTB.SMR BehavesLike.Win32.PWSZbot.dc W32/Trojan.JJZL-1655 Trojan.Blocker.wv TR/Crypt.ZPACK.utcuw Trojan[Downloader]/Win32.Dofoil Trojan.Zbot.191 Trojan/Win32.Miuref.R167036 Trojan.Diple Win32/AutoRun.IRCBot.JD Trojan.IRCbot!qGVCqAdzAoo Trojan.Win32.Boaxxe W32/Injector.CLNV!tr


Overall in 2012-2013 we detected approximately 10,000,000 unique malicious installation packages : Different installation packages can install programs with the same functionality that differ only in terms of the malicious app interface and , for instance , the content of the text messages it spreads .


Trend Micro presents a case study of the cyberespionage efforts by Earth Preta.


We have collected numerous samples spanning from 2016 to early 2019 .


One of the hardest things to do when you are receiving malware that have anonymized e.g. name-is-hash names or general samples that lack any indication of the infection vector is to determine the origin of the file and its intended target.


It also attempts to srpead using the EternalBlue and EternalRomance SMBv1 exploits.


A backdoor also known as: Trojan/W32.HackTool.7168.D Trojan/Hacktool.Xhack.01.b Win32/HackTool.XHack.01.B TROJ_XHACK.B HackTool.Win32.Xhack.01.b Riskware.Win32.Xhack-01.unxw HackTool.Xhack.7168[h] TrojWare.Win32.HackTool.XHack.B Tool.Xhack Tool.Xhack.Win32.2 TROJ_XHACK.B BehavesLike.Win32.TibsPacked.zc W32/Tool.WANC-2640 Hacktool.XHack.01.b SPR/xHack.01.B HackTool/Win32.Xhack HackTool.W32.Xhack.01.b!c Win-Trojan/Xhack.7168 HackTool:Win32/Xhack.B Win32.Hacktool.Xhack.Akyz HackTool.Win32.Xhack HackTool.ACAG Hacktool.Win32.Xhack.01 Win32/Trojan.Hacktool.cc1


A backdoor targetting Linux also known as: Backdoor.Linux.Mirai.B Backdoor.LuaBot.Linux.11 Backdoor.Linux.Luabot!c Linux.Iotreaper Linux/Iotreaper.A ELF_IOTREAPER.A Unix.Trojan.IoTReaper-6355327-0 HEUR:Backdoor.Linux.LuaBot.b Trojan.LuaBot.eulikp Linux.IotReaper.10 ELF_IOTREAPER.A ELF/Trojan.CQZK-6 Backdoor.Linux.aeup LINUX/Luabot.lvmpq Linux/Luabot.A!tr.bdr Trojan[Backdoor]/Linux.LuaBot.b Linux.S.Reaper.862672 HEUR:Backdoor.Linux.LuaBot.b Linux/Luabot.862672 Trojan.Linux.IotReaper Linux.Backdoor.Luabot.Taoo Trojan.Linux.Iotreaper


The attack four years ago resulted in 30,000 or more systems being damaged.


Compared to other ransomware such as Cerber, whose developers earn 40% in commissions, Encryptor RaaS has a more attractive proposition.


We believe this to be the largest known Apple account theft caused by malware.


A backdoor also known as: Win32.Worm.Socks.A Worm.Win32.Socks!O Win32.Worm.Socks.A Worm.Socks.Win32.466 W32/Socks.at Win32.Worm.Socks.A WORM_SOCKS.DZ Win32.Trojan-Downloader.Small.g W32/Worm.XEH W32.Mandaph Win32/Ruternam.DD WORM_SOCKS.DZ Win.Worm.Socks-22 SScope.Worm.Socks.afv Worm.Win32.Socks.at Trojan.Win32.Socks.bgabja Worm.Win32.A.Socks.77757 W32.W.Socks.l03A Win32.Worm.Socks.A Trojan.DownLoader8.12758 BehavesLike.Win32.VirRansom.cc W32/Worm.CUZR-8725 TrojanDownloader.Small.sui Worm/Win32.Socks Worm:Win32/Figload.A Win32.Worm.Socks.A Worm.Socks Worm.Win32.Socks.at Win32.Worm.Socks.A Worm/Win32.Socks.R51740 W32/Socks.a Win32.Worm.Socks.A Win32/TrojanDownloader.Small.OBD Worm.Socks!5J3YF194TfI W32/PackZbot.AFG!tr


A backdoor also known as: Dropped:Trojan.Dropper.TTW TrojanDropper.Crenufs.AA3 TROJ_DROPPR.SMAB Win32/Dropper.KI TROJ_DROPPR.SMAB Win.Trojan.Dropper-4236 Dropped:Trojan.Dropper.TTW Trojan.Win32.Drop.bsjju Dropped:Trojan.Dropper.TTW Backdoor.Win32.Poison.HMN Trojan.DownLoader3.58740 BehavesLike.Win32.RAHack.ch TrojanDropper.StartPage.kf TrojanDropper:Win32/Crenufs.A Trojan.Dropper.TTW Dropper.StartPage.151552 Dropped:Trojan.Dropper.TTW Dropper/Win32.StartPage.R7795 Dropped:Trojan.Dropper.TTW


A backdoor also known as: Win32.Worm.Kolab.BX Worm/W32.Kolab.196608.Z Worm.Krap Trojan/AutoRun.IRCBot.gq TROJ_INJECT.JIL Win32.Virus.Krap.a W32/Trojan2.NSDN Win32/Tnega.ALDW TROJ_INJECT.JIL Win.Trojan.Zbot-44769 Win32.Worm.Kolab.BX Virus.Win32.Krap.it Win32.Worm.Kolab.BX Trojan.Win32.SmsSend.cbobaq Worm.Win32.A.Net-Kolab.196608.H Virus.W32.Krap!c Win32.Worm.Kolab.BX ApplicUnwnt.Win32.Hoax.ArchSMS.SG Win32.Worm.Kolab.BX Trojan.PWS.Panda.547 Worm.Kolab.Win32.11974 BehavesLike.Win32.ZBot.ch W32/Trojan.VOEZ-7948 TrojanDropper.Daws.aeg W32.Infostealer.Zeus WORM/IrcBot.ED Win32.Worm.Kolab.BX Virus.Win32.Krap.it Trojan:Win32/Kanots.A Trojan/Win32.Zbot.R22644 BScope.Hoax.ArchSMS.2231 Trj/Pacrypt.D Trojan.Kolab Win32/AutoRun.IRCBot.GQ Worm.AutoRun!j45RyJLdJEk W32/Zbot.EQPB!tr Win32/Worm.ab1


I previously associated Adwind with targeted phishing attempts in limited amounts.


Add to this a ransom of 1.79 Bitcoins approximately $3,300 at the time of the campaign and the potential value of the campaign is significant.


MainService is the central controller of this spyware .


State Machines Since various carriers implement the billing process differently , Bread has developed several variants containing generalized state machines implementing all possible steps .


A backdoor also known as: Trojan.DownLoad3.15790 Trojan-Downloader.Win32.Injecter


Sending C2-specified SMS messages to phone numbers in the victim ’ s contacts .


Observe and look at the app ’ s display and text , stated functions , reviews from other users , and requested permissions before downloading .


A backdoor also known as: W97M.Downloader.BRA O97M.Dropper.XA W97M/Downloader.bbl W97M.Downloader.BRA W2KM_DRIDEX.YYSUN W97M.Downloader.BRA W97M.Downloader.BRA W97M.DownLoader.990 W2KM_DRIDEX.YYSUN W97M/Downloader.bbl HEUR.VBA.Trojan.e TrojanDropper:O97M/Vibro.A W97M.Downloader.BRA W97M.Downloader.BRA virus.office.obfuscated.4


On January 25, 2017, the criminal syndicate behind Dridex launched another small campaign targeting UK financial institutions.


A backdoor also known as: Trojan.GameHack BehavesLike.Win32.BadFile.mz Trojan.Win32.GameHack Trojan:Win32/GameHack.C


We named this campaign “ Bouncing Golf ” based on the malware ’ s code in the package named “ golf. ” The malware involved , which Trend Micro detects as AndroidOS_GolfSpy.HRX , is notable for its wide range of cyberespionage capabilities .


This RAT is marketed as an undetectable Java RAT.


A backdoor also known as: W32.eHeur.Virus02 Virus.Win32.Sality!O Win32.Trojan.WisdomEyes.16070401.9500.9970 Trojan-Ransom.Win32.HmBlocker.bdg Trojan.Win32.Winlock.bsinq TrojWare.Win32.Trojan.Ransom.~H Trojan.MulDrop.65298 BehavesLike.Win32.SoftPulse.qc Trojan/HmBlocker.wf TrojanDropper:Win32/Wlock.A Trojan-Ransom.Win32.HmBlocker.bdg Hoax.HmBlocker Trojan-Ransom.Win32.HmBlocker


A backdoor also known as: W32.DownloadSuleeLnr.Trojan Trojan/W32.Small.32768.AGT Downldr.Sulee.S235944 Win32.Trojan.WisdomEyes.16070401.9500.9947 Win32/Small.AEC Worm.Win32.Deborm.pgc Trojan.Win32.Dwn.bzwwu Trojan.Win32.Downloader.32768.PG Troj.Downloader.W32.Small.ljQA Win32.Worm.Deborm.Plkj Trojan.DownLoader9.55489 Trojan-Downloader.Win32.Small TR/Dldr.Sulee.B TrojanDownloader:Win32/Sulee.A Worm.Win32.Deborm.pgc Downloader/Win32.Small.R24462 Worm.Deborm Win32/Trojan.Downloader.9f6


An Android backdoor also known as: OSX/SabPub.A MAC.OSX.Trojan.Lamadai.B Backdoor.MacOSX.SabPab.A MAC.OSX.Trojan.Lamadai.B Backdoor.SabPub.OSX.2 OSX.Sabpab OSX_SABPAB.A Win.Trojan.SubPub-1 MAC.OSX.Trojan.Lamadai.B Backdoor.OSX.SabPub.a MAC.OSX.Trojan.Lamadai.B Trojan.Mac.Sabpub.pxvaq OSX.S.Sabpab.42556 MAC.OSX.Trojan.Lamadai.B Backdoor:OSX/Sabpab.A BackDoor.Sabpub.1 OSX_SABPAB.A OSX/FlashFake.g Backdoor/OSXSabPub.a OSX/SabPab.A MAC.OSX.Trojan.Lamadai.B Backdoor.OSX.SabPub.a!c Backdoor.OSX.SabPub.a Backdoor:MacOS_X/SabPab.A OSX32-Trojan/Sabpub.B OSX/FlashFake.g Win32.Backdoor.Sabpub.ynw Backdoor.OSX.SabPub OSX/SabPub.A!tr.bdr Win32/Backdoor.3ab


FF-RAT is a family of malware used in a number of targeted attacks over at least the last five years.


A backdoor also known as: Backdoor.DarkKomet Win32.Trojan.WisdomEyes.16070401.9500.9968 W32/Trojan.KWPG-7705 Backdoor.Win32.DarkKomet.hukx Trojan.Win32.Inject.dchfem Backdoor.W32.Darkkomet!c Win32.Backdoor.Darkkomet.Lmay Trojan.DownLoader7.8295 BehavesLike.Win32.Trojan.vc Trojan/Windef.ey Trojan[Backdoor]/Win32.DarkKomet Backdoor.Win32.DarkKomet.hukx Trojan:MSIL/Dobrun.A Trojan.MSIL.Injector MSIL/Injector.TEX!tr Trj/CI.A Win32/Trojan.fac


Proofpoint researchers recently observed a novel targeted phishing attack that combined Outlook Web Access OWA credential phishing with a malicious document download.


In this case , FrozenCell has primarily netted the actors behind it with recorded outbound calls followed closely by images and recorded incoming calls .


The malware code is complicated, busy, and fairly obfuscated–there are no Windows API calls or obvious strings.


The customer has given us approval to share some of the details about the Spyware app that Skycure discovered.


A backdoor also known as: Trojan.RingZero RingZero.Trojan Win.Trojan.Ring0-1 Trojan.RingZero Trojan-PSW.Win32.Ring0.e Trojan.RingZero Trojan.Win9x.Ring0.hvgs Troj.Psw.W32!c Win32.Trojan-qqpass.Qqrob.Lqyo Trojan.RingZero Trojan.RingZero Trojan.Eps.165 Trojan/PSW.Ring0.b TR/PSW.Ring0 Trojan.RingZero Trojan-PSW.Win32.Ring0.e PWS:Win32/Ring0.B Win-Trojan/RingZero.5704 Trojan.RingZero Trojan-Spy.Ring0 Win32/Trojan.PSW.03d


While the counterfeit games claim to provide similar functionality to the popular apps , they are simply used to display ads through a custom advertisement SDK .


This Pulse includes indicators extended from Alienvault Labs Intelligence


The malware copies itself onto removable drives to infect other machines.


A backdoor also known as: Trojan.Script Trojan.Win64.Click3.ewpadq Trojan.Click3.23647 Trojan.Atros5 W64/Trojan.CDCY-4984 Trojan.BetKrypt.c TrojanDownloader:PowerShell/Plasti.A Trj/CI.A Win32/Trojan.Downloader.036


XLoader Disguises as Android Apps , Has FakeSpy Links This new XLoader variant poses as a security app for Android devices , and uses a malicious iOS profile to affect iPhone and iPad devices .


A backdoor also known as: Backdoor.Bladabindi.G3 Win32.Trojan.WisdomEyes.16070401.9500.9999 BKDR_BLADABI.SMC MSIL.Trojan-Spy.Keylogger.I Backdoor.MSIL.Bladabindi.FQ Worm.Bladabindi.Win32.9249 BKDR_BLADABI.SMC Trojan-Dropper.Win32.Injector Backdoor:MSIL/Aataki.A Msil.Worm.Bladabindi.Pgcz Trojan.Krypt!krAm56VQrho MSIL/SpyPSW.AVQ!tr Win32/Trojan.e11


A backdoor also known as: Trojan.Heur.FU.EC2AF0 Win32.Trojan.WisdomEyes.16070401.9500.9966 Backdoor.Trojan Win.Worm.FlyStudio-20 Trojan-Clicker.Win32.Flyst.ko Trojan.Win32.FlySky.cvcco Worm.Win32.Flystudio.18944 TrojWare.Win32.FlyStudio.~UJ Trojan.FlySky.13 TrojanClicker.Flyst.dm TrojanClicker:Win32/Yumud.A Trojan-Clicker.Win32.Flyst.ko Trj/CI.A


Finally, some of the recent CloudDuke spear-phishing campaigns have born a striking resemblance to CozyDuke spear-phishing campaigns from a year ago.


A backdoor also known as: Trojan.MSIL Trojan-Ransom.Win32.Blocker.ick Trojan.Win32.Blocker.bgboef Trojan.KillProc.19469 BehavesLike.Win32.Trojan.cc TR/Zusy.23029.3 Trojan:Win32/Kurei.A Trojan/Win32.Blocker Win32.Trojan.Blocker.dkfj Trojan-Ransom.MSIL W32/Blocker.ICK!tr LockScreen.AN


The Hellsing APT group is currently active in the APAC region, hitting targets mainly in the South China Sea area, with a focus on Malaysia, the Philippines and Indonesia.


A backdoor also known as: Backdoor.Remokil Riskware.Win32.Killer.cysdud Trojan.Win32.Z.Remokil.69632 Tool.Killer BehavesLike.Win32.Dropper.km BDS/Remokil.A.2 Backdoor:Win32/Remokil.A Trj/CI.A Backdoor.Remokil!tnG0oKXIw5k W32/BackDoor.1YP!tr Win32/Backdoor.709


A backdoor also known as: Backdoor.Bdaejec.A.mue Win32.Trojan.KillAV.c Backdoor.Trojan Win32/Downloader.QRedDl_i Backdoor.Win32.Ciadoor.dgu Trojan.Win32.Ciadoor.dqnhik Trojan.StartPage.56147 BehavesLike.Win32.Dropper.dc Exploit.Win32.ShellCode Trojan[Backdoor]/Win32.Ciadoor Backdoor.Win32.Ciadoor.dgu Backdoor:Win32/Bdaejec.A Trojan/Win32.Yoddos.C209363 Backdoor.Ciadoor Backdoor.Ciadoor!PoWyk0Y7Hyg


Karagany is used by a number of groups, so the attribution here is weak.


Threat actors salivate at the thought of an increased volume of credit and debit card transactions flowing through endpoints they have compromised with card-stealing malware.


A backdoor targetting Linux also known as: HEUR:HackTool.Linux.XHide.a Trojan.XHide.exrowv Linux.Hacktool.Prochide.Wkbo Tool.Linux.ProcHide.22 ELF/Trojan.IDGF-0 HackTool.Linux.jt HackTool/Linux.XHide.a Hacktool.Linux.Xhide!c HEUR:HackTool.Linux.XHide.a


A backdoor also known as: Trojan.Hacktool.Ofstar.A W32/Tool.ZAWB-1617 HackTool.Win32.Ofstar.a Trojan.Hacktool.Ofstar.A Trojan.Win32.Ofstar.dczxtl Trojan.Hacktool.Ofstar.A Trojan.Hacktool.Ofstar.A Trojan.Click.17767 Tool.Ofstar.Win32.2 W32/VirTool.AVK HackTool/Win32.Ofstar Win32.HackTool.Ofstar.a.kcloud HackTool:Win32/Ofstar.A Trojan.Hacktool.Ofstar.A HackTool.Win32.Ofstar.a Trojan.Hacktool.Ofstar.A Trojan.Hacktool.Ofstar.A


The program can redirect incoming calls to the phone numbers of cybercriminals.


Port 6206 : Skype extraction service .


This discovery indicates the actor ’ s ambition in expanding operations into Google Play store with previous success experience from the main “ Agent Smith ” campaign .


The malware reached a global spread, infecting mostly users from south-east Asia, but also over 280,000 users in the US.


Swearing Trojan's name comes from Chinese swear words found inside the malware's code.


A backdoor also known as: W32.eHeur.Malware11 Trojan.Obfuscated.MQ Trojan.Obfuscated.MQ Downloader.RtkDL.Win32.588 Trojan.Obfuscated.MQ Win32.Rootkit.Koutodoor.a W32/Downldr2.FEHJ Trojan.Farfli RTKT_KTDOOR.SMIA Trojan.Obfuscated.MQ Trojan.Obfuscated.MQ Trojan.Win32.RtkDL.bfwayn Trojan.Win32.Downloader.29664.B Troj.Downloader.W32.RtkDL.l6Y8 Trojan.Obfuscated.MQ Trojan.Obfuscated.MQ Adware.Baidu.875 RTKT_KTDOOR.SMIA BackDoor-DTL.sys Trojan.Rootkit TrojanDownloader.RtkDL.tx Trojan[Downloader]/Win32.RtkDL Trojan:WinNT/Koutodoor.A Trojan/Win32.Xema.C26785 BackDoor-DTL.sys


A backdoor also known as: Trojan.Concon.A Trojan.Win32.Concon!O Trojan.Concon.A Trojan.Concon.A Trojan.Win32.Hesv.bznw Trojan.Concon.A Heur.Packed.Unknown Trojan.Concon.A Trojan/Win32.Concon Trojan.Concon.A Trojan.Win32.Hesv.bznw Trojan:Win32/Concon.C Trojan.Concon.A Win32.Trojan.Concon.Hwmo Trojan.Concon!EDvZbBUGNm0 Trojan.Concon W32/Dx.VVF!tr Win32/Trojan.ee5


A backdoor also known as: W32.WesboaHAH1.Worm Win32.Trojan.WisdomEyes.16070401.9500.9991 W32/Trojan.LCZO-3767 Win.Trojan.Pasmu-203 Trojan.Win32.Pasmu.sdcc Trojan.Win32.Pasmu.58368 TrojWare.Win32.PSW.Delf.~JHN Trojan.PWS.Gootkit.2 BehavesLike.Win32.VTFlooder.qh Trojan.Win32.Pasmu Trojan/Pasmu.bs Win32.PSWTroj.Undef.kcloud Trojan.Heur.FU.EDD95C Trj/CI.A Win32/Trojan.BO.9fe


The malware exfiltrates the collected account data directly to an external Command and Control C2 Server in Eastern Europe, but unusually the communications utilise raw TCP sockets rather than the HTTP protocol that has become the norm in POS malware.


AresLoader is a new loader malware-as-a-service MaaS offered by threat actors with links to Russian hacktivism that was spotted recently in the wild.


A backdoor also known as: Backdoor.Buterat Trojan.Downloader Adware.Liuliangbao.Win32.10 Trojan.Mikey.DF455 not-a-virus:AdWare.Win32.Liuliangbao.by Riskware.Win32.Liuliangbao.erwbnw Trojan.DownLoader25.5364 GrayWare[AdWare]/Win32.Liuliangbao Backdoor:Win32/Buterat.C!bit not-a-virus:AdWare.Win32.Liuliangbao.by PUP/Win32.Liuliangbao.C2086918 AdWare.Liuliangbao PUA.Liuliangbao! PUA.Liuliangbao Trj/GdSda.A Win32/Trojan.719


A backdoor also known as: W32.Welchia.Worm Net-Worm.Win32.Welchia!O W32.Nachi W32/Nachi.worm.a W32/Nachi.worm.a Win32.Worm.Rbot.a W32/Nachi.A W32.Welchia.Worm Win32/Nachi.A WORM_NACHI.H Win.Worm.Blaster-4 Net-Worm.Win32.Welchia.s Trojan.Win32.Welchia.oxhi Worm.Win32.Welchia.10240.B W32.W.Welchia.l7FB Win32.HLLW.LoveSan.2 Worm.Welchia.Win32.1 WORM_NACHI.H BehavesLike.Win32.Backdoor.mh Net-Worm.Win32.Welchia W32/Nachi.GTED-3671 WORM/Nachi.A.1 Worm[Net]/Win32.Welchia Worm:Win32/Nachi.A Net-Worm.Win32.Welchia.s Net-Worm.Welchia W32/Nachi.M.worm I-Worm.Nachi.A Win32/Nachi.A Worm.Win32.Nachi W32/Nachi.A!worm


The attachment in this campaign is a malicious zip file containing malicious obfuscated JavaScript.


This same infection chain has been utilized in the past to infect computers with the Dridex banking Trojan and Jaff's predecessor, Locky ransomware.


Unit 42 has recently discovered a new variant of PowerWare, also known as PoshCoder, imitating the popular Locky ransomware family.


In fact, our team considers them some of the best adversaries out of all the numerous nation-state, criminal and hacktivist/terrorist groups we encounter on a daily basis.


The URLs — abused as part of XLoader ’ s C & C — are hidden in three webpages , and the C & C server that XLoader connects to differ per region .


Operation Pawn Storm is a campaign known to target military, embassy, and defense contractor personnel from the United States and its allies.


Even though this is not a traditional remote access tool ( RAT ) , this campaign seems to target mainly private users .


These are related to the malware Naoinstalad


During testing we were able to generate a number of proof-of-concept PoC documents both with and without a prompt to the user.


A backdoor also known as: W32.ThasoticLTAA.Trojan Trojan/Seeav.i Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Win32.Dwn.doicqs Win32.Worm.Small.Loif Trojan.DownLoader12.19458 Worm.Seeav.Win32.1 BehavesLike.Win32.Ransomware.fc TR/Crypt.Xpack.123006 Worm/Win32.Small Trojan:Win32/Seeav.B Win32/Seeav.I Worm.Win32.Seeav Trj/CI.A


The attack has affected users browsing to many popular sites, including CNN Indonesia, the official website of Prague Airport, Detik, AASTOCKS, RTL Television Croatia, and the Bejewled Blitz game on Facebook.


A backdoor also known as: Trojan-Downloader.Win32.Bitmin.alk BehavesLike.Win32.Trojan.hh Trojan.Win32.Macultum TrojanDownloader.Bitmin.bq Trojan-Downloader.Win32.Bitmin.alk Trojan/Win32.Dropper.C237486 Win32.Trojan-downloader.Bitmin.Eflh W32/Bitmin.ALK!tr.dldr


After obtaining a sample from this attack and conducting further analysis, we found that the attackers have been using the same payload and just altering its configurations in attacks since March of this year.


At other times , Bread appears to abandon hope of making a variant successful and we see a gap of a week or longer before the next variant .


New samples of targeted malware primarily seen in the Middle East.


thought to be associated with targeted malware.


The group also continues to focus on theft of code signing certificates and internal documentation, including company files and internal communication history chats/emails.


TrendMicro has noticed a recent increase in TorrentLocker-related emails being sent to users in several countries, particularly the United Kingdom and Turkey.


We have followed the activities of this botnet for several months and during our investigations we found some versions of a Windows fork of the malware.


During the past week, US users visiting adult-themed sites were targeted by ads for a fake PornHub app that contained a version of the Koler ransomware.


A possible attack scenario involves replacing legitimate apps with repackaged or malicious versions .


Once it infects a device , Wroba behaves very aggressively .


A backdoor also known as: W32.Vetor.PE Trojan.Win32.Farfli.1!O W32.Virut.G Backdoor.Xyligan BKDR_SMALL.LDI W32.Virut.CF Win32/Virut.17408 Win.Trojan.Xyligan-19 Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg Backdoor.Win32.Bdx.e Win32.Virut.56 BehavesLike.Win32.Virut.cc Win32/Virut.bn Virus/Win32.Virut.ce Win32.Virut.cr.61440 Backdoor:Win32/Xyligan.A Virus.Win32.Virut.ce Win32/Virut.F Virus.Virut.13 Win32/Virut.NBP Backdoor.Win32.Xyligan W32/Sality.AO Virus.Win32.VirutChangeCall.J


In Russia , some major banks offer their clients a special service that allows them to transfer money from their bank card to their mobile phone account .


A backdoor also known as: TrojanDownloader.Tearsp.AA2 Downloader.Small.Win32.37323 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.A.Downloader.15980 TrojWare.Win32.TrojanDownloader.Small.F BehavesLike.Win32.Fareit.mt Trojan[Downloader]/Win32.Small Downloader/Win32.Small.R5459 Bck/Unilink.B Trojan.Win32.StartPage.c Trojan.Sisron!oYYxWSE+/gw


A backdoor also known as: Trojan.Kryptik.Win32.764268 Trojan/Kryptik.fy Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.PassView.dhxqtk Tool.PassView.638 Trojan-Dropper.Win32.Injector TrojanDropper.Injector.alvo TR/Keylogger.AY Trojan[Dropper]/Win32.Injector Win32.HeurC.KVM007.a.kcloud Trojan/Win32.Spnr.R38927 Trojan.Kryptik!I/Y93lnQFpU


A backdoor also known as: W32.QearadG.Trojan Trojan.Mauvaise.SL1 Trojan.Graftor.D451F3 Win32.Trojan.WisdomEyes.16070401.9500.9986 TROJ_SACTO.C Trojan.Win32.FakeFolder.bk Trojan.DownLoader21.61435 Trojan.FakeFolder.Win32.217 TROJ_SACTO.C Trojan.Win32.Urelas W32/Trojan.EMXX-4272 Trojan.FakeFolder.a Trojan:Win32/Sacto.B!bit Trojan.Win32.FakeFolder.bk HEUR/Fakon.mwf Trojan.FakeFolder Win32.Trojan.Fakefolder.Pcsn Trojan.Sacto!tCZ0BN8/xSI


From there , root-level apps can read or modify data and resources that would be off-limits to normal apps .


A backdoor also known as: Trojan/Dropper.FrauDrop.bkr Trojan.Fbphotofake.C W32/MalwareF.TPKK Trojan.ADH.2 TROJ_SPNR.04CG11 Trojan-Dropper.Win32.FrauDrop.cmn TROJ_SPNR.04CG11 TrojanDropper.FrauDrop.vm TrojanDownloader:Win32/Fraudload.H W32/MalwareF.TPKK Dropper/Win32.FrauDrop TrojanDropper.FrauDrop.bke Trojan.ADH Cryptic.BHN Trj/CI.A


Drive-by downloads and multiple rooting exploits The malware uses a variety of methods to infect devices .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan2.HPZR Trojan.Win32.Pakes W32/Trojan.DMTA-2040 Trojan.Zusy.D1FEBC Trojan:Win32/Rotker.A TScope.Malware-Cryptor.SB W32/Rootkit.J!tr


This gives users a chance to see details and better understand any changes made .


A backdoor also known as: Backdoor.Androm BKDR_ANDROM.THAOBFK Win32.Trojan.WisdomEyes.16070401.9500.9998 BKDR_ANDROM.THAOBFK Backdoor.Win32.Androm.oytg Trojan.Win32.Androm.exkqhv Trojan.Win32.Z.Androm.409600 Backdoor.W32.Androm!c Trojan.PWS.Stealer.17779 BehavesLike.Win32.Packed.gt Trojan.VB.Crypt Backdoor.Androm.wjy TR/Dropper.VB.quwvl Trojan[Backdoor]/Win32.Androm Backdoor.Win32.Androm.oytg Trojan/Win32.VBKrypt.R219198 TScope.Trojan.VB Trojan.PasswordStealer Trj/GdSda.A Win32.Trojan.Inject.Auto Malicious_Behavior.SB


Local and Remote Shells In order to execute commands on the infected devices , as well as to provide a reverse shell to the Command & Control operators , Exodus Two immediately attempts to execute a payload it downloads with the name null .


When root privilege is gained , a shell backdoor and malicious RCSAndroid agent APK file will be installed The second method is to use a stealthy backdoor app such as ANDROIDOS_HTBENEWS.A , which was designed to bypass Google Play .


A backdoor also known as: Trojan.Razy.D3BFAF Win32.Trojan.WisdomEyes.16070401.9500.9999 TrojWare.MSIL.Golroted.EJU BehavesLike.Win32.Trojan.jc Trojan.MSIL.Inject Win-Trojan/MSILKrypt03.Exp


The vulnerability lies in a logical bug, which enables an attacker with write-only access to a share to load a malicious samba module and execute arbitrary code.


The emails all highlighted the successful delivery of a package, which can be tracked by simply clicking on a link.


For the past two and a half months, a WordPress plugin named Display Widgets has been used to install a backdoor on WordPress sites across the Internet.


While researching the network infrastructure related to PoSeidon malware, Damballa was able to find information related to this campaign and its operators.


The report exposes the targets, tools, and attack techniques, and provides full details on the Lotus Blossom campaign, including all indicators of compromise.


A backdoor also known as: Application.Tool.3596 Packed.Win32.PePatch!O Application.Tool.DE0C Win32.Trojan-Dropper.Binder.h W32/Trojan.EPIY-8359 Spyware.Ardakey Trojan.Win32.Hesv.coag Application.Tool.3596 Trojan.Win32.PcClient.dleljw Backdoor.W32.Rbot.lBP9 Application.Tool.3596 Program.Ardamax.772 BehavesLike.Win32.Backdoor.mm W32/TrojanX.BMPY TrojanSpy.Ardamax.sj Trojan.Win32.Hesv.coag HEUR/Fakon.mwf TrojanSpy.Ardamax TrojanSpy.Ardamax!dK0E+xHhPvU Backdoor.Win32.PcClient Trj/CI.A


A backdoor also known as: W32.eHeur.Malware11 Trojan.Win32.Pincav!O Trojan.Enfal TROJ_DYER.BMC Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/MalwareF.HHES Backdoor.Trojan TROJ_DYER.BMC Win.Trojan.Enfal-50 Trojan.Win32.Pincav.ypz Trojan.Win32.Pincav.bxbuzi Trojan.Win32.Z.Pincav.57344.P Troj.W32.Pincav!c BackDoor.Tiblue.25 Trojan.Pincav.Win32.8014 W32/Risk.IONL-8174 Trojan/Pincav.eot W32/Pincav.GRW!tr Trojan/Win32.Pincav Trojan.DarkHotel.18 Trojan.Win32.Pincav.ypz Trojan:Win32/Enfal.H Trojan/Win32.Pincav.C89565 Win32.Trojan.Pincav.Alss Trojan.Pincav!xRC8VkZkT6w Win32/Trojan.c48


Although malware targeting the Android OS stopped being a novelty quite some time ago, this trojan is quite unique.


A backdoor also known as: Backdoor.Bot.130848 Backdoor/W32.IRCBot.46080.X Backdoor.Codbot Backdoor.Codbot.Win32.70 Backdoor.W32.Codbot.ah!c Backdoor/Codbot.ah W32/Sdbot.LGX W32.Toxbot Win32/Toxbot.AP WORM_CODBOT.BA Win.Trojan.Codbot-25 Backdoor.Bot.130848 Backdoor.Win32.Codbot.ah Backdoor.Bot.130848 Trojan.Win32.Codbot.frjs Backdoor.Win32.CodBot.47104.F Backdoor.Bot.130848 Backdoor.Bot.130848 Win32.Detox.based WORM_CODBOT.BA BehavesLike.Win32.Downloader.pc Backdoor/Codbot.k WORM/Spybot.46080.4 Trojan[Backdoor]/Win32.Codbot Backdoor.Bot.D1FF20 Backdoor.Win32.Codbot.ah Backdoor:Win32/Codbot.AM Worm/Win32.IRCBot.C217036 Backdoor.Codbot-O Backdoor.Codbot Bck/Sdbot.ELC Backdoor.Codbot.DM Backdoor.Win32.Codbot.AH W32/SpyBot.ZI!dam


The end payload for this campaign is Cryptowall 3.0. Talos has covered this threat repeatedly and this is another example of how the success of Ransomware has pushed it to one of the top threats we are seeing today.


A backdoor also known as: Trojan.MSILPerseus.DDB45 Win32.Trojan.WisdomEyes.16070401.9500.9979


A backdoor also known as: Backdoor.IRCBot.Win32.1711 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win.Trojan.IRCBot-2756 Backdoor.Win32.IRCBot.kzq Trojan.Win32.IRCBot.cwscme Backdoor.Win32.IRC.Bot.~RF Trojan.Mercur Backdoor/IRCBot.bmu Trojan[Backdoor]/Win32.IRCBot Win32.Hack.IRCBot.kcloud Backdoor.Win32.IRCBot.kzq Worm/Win32.IRCBot.C22556 Worm.Win32.Yoybot


Although the activity was previously linked by others to the FIN7 threat actor group, our research suggests the activity is in fact espionage related and unlikely to be FIN7 related.


Several TXT files with commands on the attacker ’ s FTP server contain a victim identifier in the names that was probably added by the criminals : CMDS10114-Sun1.txt CMDS10134-Ju_ASUS.txt CMDS10134-Tad.txt CMDS10166-Jana.txt CMDS10187-Sun2.txt CMDS10194-SlavaAl.txt CMDS10209-Nikusha.txt Some of them sound like Russian names : Jana , SlavaAl , Nikusha .


A backdoor also known as: TrojWare.Win32.Rootkit.Hodprot.~v001 Trojan.WinSpy.985 Trojan:WinNT/Parchood.A Backdoor/Win32.Hodprot Backdoor.Sheedash


The shell backdoor then installs the RCSAndroid agent .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Dwn.dbqfdz Trojan.DownLoader11.6274 TR/Changeling.A.2686 Dropper/Win32.FrauDrop.R112106 Trojan.Barys.DC712 MSIL/TrojanDownloader.Small.HC Win32.Trojan.Changeling.Wwoe Trojan-Dropper.MSIL.Small MSIL/Small.HC!tr.dldr


The potential actor and who they target Our current analysis strongly suggests Desert Scorpion is being deployed in targeted attacks against Middle Eastern individuals of interest specifically those in Palestine and has also been highlighted by other researchers .


A backdoor also known as: Joke.Kazna JOKE_TRAIN.A Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/Joke.BKPE-2551 Joke.Train Win32/Train.A!joke JOKE_TRAIN.A Win.Joke.Kazna-1 Joke.Kazna Hoax.Win32.BadJoke.Train Joke.Kazna Riskware.Win32.Train.hpzv Joke.Kazna ApplicUnsaf.Win32.Hoax.BadJoke.Train Joke.Kazna Trojan.DownLoader9.64121 Tool.BadJoke.Win32.974 BehavesLike.Win32.Trojan.xh W32/Joke.KW not-virus:Joke.Win32.Train HackTool[Hoax]/Win32.Train Joke.Kazna Hoax.W32.Badjoke!c Hoax.Win32.BadJoke.Train Unwanted/Win32.Xema.C67955 Joke.Kazna Win32/BadJoke.AZ not-a-virus:BadJoke.Win32.Train


Now , using these strings method1 can use reflection to call sendTextMessage and process the payment .


A backdoor also known as: BKDR_ESCAD.SMHA Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Destover BKDR_ESCAD.SMHA Backdoor.Win32.Escad.ax Trojan.Win32.Dllbot.40960.A BehavesLike.Win32.PWSYunsip.pm TR/NukeSped.ivjfp Trojan.Heur.LP.E1C304 Backdoor.Win32.Escad.ax Backdoor:Win32/Winsec.A!dha Trojan/Win32.Dllbot.R22672 Trj/GdSda.A W32/Destov.A!tr.bdr


A backdoor also known as: TrojanDownloader.Muskmal Trojan.Downloader Trojan.Jacard.D49FE Win32.Trojan.WisdomEyes.16070401.9500.9845 Trojan.Win32.Z.Jacard.411648 Trojan.DownLoader19.54142 BehavesLike.Win32.Virut.gh W32/Trojan.KLTK-1753 TrojanDownloader:Win32/Muskmal.A Trj/GdSda.A Win32.Trojan.Crypt.Wlzh Trojan-Downloader.Win32.Banload W32/Banload.XAK!tr Win32/Trojan.8f4


No parties in Libya before this analysis reported to use cyber attacks, malwares nor recruit hackers to spy on their rivals.


ESET did not attribute the attacks to a particular attack group, but noted that the objective of the campaign was espionage and general information stealing.


A backdoor also known as: Trojan.MSIL Trojan.MSILPerseus.D23447 Trojan.Win32.Spatet.exndob Trojan.DownLoader26.13037 Trojan.MSIL.ilbz TR/AD.Spatet.kaotz Trj/GdSda.A Trojan.MSIL.Crypt MSIL/Kryptik.MQL!tr Win32/Trojan.032


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Click.1210 W32/DL_small.BHK SScope.Trojan.Mezzia Win32/Trojan.73c


We are calling it HinataBot.


Maliciously installed bitcoin miners


A backdoor also known as: Trojan.Golroted.A3 W32/Kolab.vky Trojan.MSIL.Krypt.11 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.Stealer.ewukig Trojan.PWS.Stealer.13025 BehavesLike.Win32.Trojan.cc Trojan.MSIL6 W32/Trojan.RRXG-8151 Trojan/MSIL.elex Trojan/MSIL.Inject Trojan.MSIL.Inject Trj/CI.A Win32/AutoRun.Delf.LV Win32.Worm.Autorun.Htvy MSIL/Injector.HTG!tr Win32/Trojan.7fd


A backdoor also known as: Trojan.Ranos.A Trojan.Razy.D20CA Win32.Trojan.WisdomEyes.16070401.9500.9999 BKDR_RANOS.SM1 Trojan.Win32.Disfa.cwbhis TrojWare.MSIL.TrojanDownloader.Small.DS Trojan.DownLoader9.7732 BKDR_RANOS.SM1 Trojan.MSIL2 TR/Fsysna.adkt Trojan/Win32.Llac.R121751 Backdoor.Bladabindi MSIL/Small.GJ!tr.dldr


A backdoor also known as: Win32.Frethem.I@mm Worm/W32.Frethem.35328 W32.Frethem.F Win32.Frethem.I@mm W32/Frethem.I@MM Win32.Frethem.E8D648 WORM_FRETHEM.F Win32.Trojan.WisdomEyes.16070401.9500.9982 W32/Frethem.JFVO-6973 W32.Frethem.I@mm Win32/Frethem.I WORM_FRETHEM.F Win.Exploit.IFrame-1 Win32.Frethem.I@mm Win32.Frethem.I@mm Trojan.Win32.Frethem.emoq I-Worm.Win32.NetSky.29184 W32.W.Frethem.f!c Win32.Frethem.I@mm Win32.Frethem.I@mm Win32.HLLM.Frethem.9 Worm.Frethem.Win32.5 BehavesLike.Win32.Dropper.nc Email-Worm.Win32.Brontok W32/Frethem.F Worm/Frethem.j WORM/Frethem.009 Worm[Email]/Win32.Frethem Worm:Win32/Frethem.H@mm Win32/Frethem.worm.35328.D W32/Frem.i@MM Worm.Frethem W32/Frethem.H Win32/Frethem.I Win32.Worm-email.Frethem.Eact I-Worm.Frethem!w9RyLJa8LZM W32/Frethem.fam@mm


This technique is employed by a Trojan downloader detected by Trend Micro as TROJ_POWHOV.A and P2KM_POWHOV.A, which we've uncovered in a recent spam email campaign in the EMEA region, especially organizations in the U.K., Poland, Netherlands, and Sweden.


Both the Tibetan community and the Uyghurs, a Turkic Muslim minority residing primarily in northwest China, have been targets of multiple sophisticated attacks in the past decade.


Emotet, a malicious group known as Moby Dick has returned to spamming operations after a months-long hiatus, and has switched to distributing malicious OneNote files.


Employees at six Russian banks were sent spoofed emails delivering Trojan.Ratopak in a narrow, targeted attack.


A backdoor also known as: W32.OnGamesLT180912HKGHAAI.Trojan Trojan-GameThief.Win32.OnLineGames!O Downloader.Zlob.16943 Troj.GameThief.W32.Magania.l7ZW Win32.Trojan.WisdomEyes.16070401.9500.9907 W32/ZlobP.F TROJ_ZLOB.DQC Win.Downloader.Zlob-2167 Trojan-Downloader.Win32.Zlob.bcg Trojan.Win32.Zlob.bcayco Trojan.Popuper TROJ_ZLOB.DQC BehavesLike.Win32.PWSOnlineGames.lc W32/ZlobP.F TR/Dldr.Zlob.aaz.1 Trojan-Downloader.Win32.Zlob.bcg Win-Trojan/OnlineGameHack.B Trojan-Downloader.Win32.Revelation.Zlob


A backdoor also known as: Trojan/W32.KillAV.35840.AQ TrojanDropper.Dogkild.A4 Trojan.KillAV.Win32.1802 Troj.W32.KillAV.cpf!c Trojan/KillAV.cpf TROJ_KILLAV.ADU Trojan.KillAV TROJ_KILLAV.ADU Trojan.Win32.KillAV.vzmx Trojan.Win32.KillAV.35840.AZ TrojWare.Win32.Trojan.KillAV.~IY Trojan.AVKill.719 BehavesLike.Win32.Backdoor.nc TrojanDropper:Win32/Dogkild.C Trojan/Win32.KillAV.C646415 TScope.Malware-Cryptor.SB Win32.Trojan.Killav.Agbl Trojan.KillAV!4D1L18ztTpY Exploit.Win32.MS08067 W32/KillAV.CMO!tr


A backdoor also known as: W32.DownloadSeaduke.Trojan Backdoor.Win32.Swrort!O Backdoor/Swrort.ob Python/Rozena.E BehavesLike.Win32.MultiPlug.wc Win32.Hack.Swrort.d.kcloud


A backdoor also known as: Backdoor/W32.Wisdoor.54784 Backdoor/Wisdoor.af BKDR_AOZ.A Win32.Trojan.WisdomEyes.16070401.9500.9793 W32/Wisdoor.KOGG-7396 BKDR_AOZ.A Backdoor.Win32.Wisdoor.bh Trojan.Win32.Wisdoor.elvp Win32.Backdoor.Wisdoor.Srwy Backdoor.Win32.Wisdoor.AF BackDoor.IRC.Wisdom BehavesLike.Win32.Fujacks.qc Backdoor.Win32.Wisdoor W32/Wisdoor.AY@bd Backdoor/Wisdoor.dz Trojan[Backdoor]/Win32.Wisdoor Backdoor:Win32/Wisdoor.CK Backdoor.W32.Wisdoor.af!c Backdoor.Win32.Wisdoor.bh Trojan/Win32.Wisdoor.R93697 Backdoor.Win32.Wisdoor.a Bck/Wisdoor.I Win32/Wisdoor.AF Backdoor.Wisdoor!KUkBN9ZhT8k


They provide users and administrators with the convenience of being able to take full control of their systems without needing to be physically in front of a device.


Since early 2015, FireEye Threat Intelligence has observed the significant growth of point-of-sale POS malware families in underground cyber crime forums.


We have previously written about related activity in which a particular China-based attack group used PlugX and NetTraveler Trojans for espionage in Europe, Russia, Mongolia, Belarus, and other neighboring countries.


A backdoor also known as: TROJ_PFINET.A Win32.Trojan.WisdomEyes.16070401.9500.9996 W64/Pfinet.A Backdoor.Pfinet Win32/Pfinet.A TROJ_PFINET.A W64/Pfinet.NCKD-3924 Backdoor:WinNT/Pfinet.B!dha Malware_fam.B Win32/Trojan.640


Despite Beijing's unwillingness to participate in the international arbitration and their rejection of the PCA's jurisdiction, there appears to be a distinct effort to surreptitiously target those who are interested in this landmark international legal case via electronic means.


The compromised devices are used to steal unencrypted network traffic and offer proxying services to the botnet operator.


The Android platform continues to be particularly susceptible, with one specific malware family called DressCode steadily and stealthily spreading since April before reports about it surfaced in August.


We begin by reading news of an attack against the Taiwanese Government.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9954 Trojan.Win32.Etchfro.czmvwf Trojan.Etchfro.3 Trojan:Win32/Etchfro.C Trojan.Win32.KillAV Win32/Trojan.Adware.37e


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan BKDR_BLADABI.SMC Hacktool.Msil.Flooder!c Backdoor.MSIL.Reomot.TG BKDR_BLADABI.SMC Trojan.MSIL.Spy W32/Trojan.XXTE-4287 BDS/Remote.kdia PWS:MSIL/Mintluks.A Trj/GdSda.A Msil.Hacktool.Flooder.Htwp MSIL/SpyPSW.AVQ!tr Win32/Trojan.Flooder.211


A backdoor also known as: Worm.Win32.AutoRun!O Worm.Autorun.j Worm.Win32.AutoRun W32/AutoRun.bbud Trojan.Buzy.440 Trojan.Win32.AutoRun.bpdmo Trojan.Minit Win32/AutoRun.ADR WORM_OTORUN.SML Worm.Autorun-1854 Worm.AutoRun!QjR+q9a4/Kw Worm.Win32.Autorun.192000.C[h] Worm:W32/Autorun.OY Worm.AutoRun.Win32.81931 WORM_OTORUN.SML W32/Autorun.worm.gr Worm/AutoRun.qcf WORM/Autorun.giqh Worm/Win32.AutoRun Worm.Autorun.kcloud Worm/Win32.AutoRun W32/Autorun.worm.gr Worm.Win32.AutoRun Worm.Win32.AutoRun W32/AutoRun.BDJ!tr W32/Autorun.KOF.worm


Figure 26 : the kill switch code snippet Evidence implies that the “ Agent Smith ” actor is currently laying the groundwork , increasing its Google Play penetration rate and waiting for the right timing to kick off attacks .


A backdoor also known as: Trojan.Scar Troj.W32.StartPage.lMKH Win32.Trojan.WisdomEyes.16070401.9500.9705 W32/Trojan.MRND-5328 Win32/CDoor.AD WORM_SCAR.DRDL Win32.Trojan.Scar.C Trojan.Win32.Scar.drdl Trojan.Win32.Scar.dctpie Trojan.Win32.Z.Scar.368640.I Trojan.MulDrop7.61859 Trojan.Scar.Win32.47893 WORM_SCAR.DRDL BehavesLike.Win32.BadFile.ft Worm.Win32.Yimper W32/Trojan2.NOIP Trojan/Scar.ajmz WORM/Yimper.rqfxr Trojan.Win32.Scar.drdl Trojan.Scar W32/Ircbot.DAC.worm I-Worm.Yimper.A Win32/Yimper.A Win32.Trojan.Scar.Ecuc Trojan.Scar!sMBz7qtKkGU W32/Scar.DRDL!worm


At least five different attacks were attributed to ITG03 actors, including a significant incident at the crypto exchange, Coincheck.


A backdoor also known as: I-Worm.Golember.r6 Worm.Golember.Win32.35 Trojan/Golember.g Win32.HLLW.Rosya.D W32/Golember.G Win32/Rosya.D WORM_GOLEMBER.G IRC-Worm.Win32.Golember.g Trojan.Win32.Golember.emqh W32.W.Golember.g!c Worm.Win32.Rosya.D Win32.HLLW.Rosya.6 WORM_GOLEMBER.G BehavesLike.Win32.Dropper.pc W32/Golember.CCCT-0854 Worm/Sramota.agk W32/Golember.G Worm[IRC]/Win32.Golember Trojan.Heur.PT.cyWbbO2nkQh Trojan/Win32.OnlineGameHack Worm:Win32/Rosya.D Win32/Rosya.E IRC-Worm.Win32.Golember.g Worm/Rosya.F Worm.Win32.Golember.g


As Lookout first reported more than eight months ago , the problem with Shedun/HummingBad and similar malicious app families that silently exploit Android rooting vulnerabilities is that the infections can survive normal factory resets .


A backdoor also known as: Trojan.ICKiller.A Trojan.Win32!O Trojan.ICKiller.A Win.Trojan.ICKiller-1 Trojan.ICKiller.A Trojan.Win32.ICKiller Trojan.ICKiller.A Trojan.Win32.ICKiller.bpcqy TrojWare.Win32.ICKiller._0 Trojan.ICKiller.A Trojan.ICKiller Trojan.ICKiller.Win32.1 W32/Trojan.YCCC-3040 Trojan/Win32.ICKiller Trojan.ICKiller.A Trojan.Win32.ICKiller Trojan.ICKiller.A Trj/CI.A Win32/Trojan.322


In this case, there is no malicious code in the attachment itself.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9997 Trojan.DownLoad3.45983 HackTool:Win32/Uflooder.B!bit Backdoor/Win32.PcClient.R3680


Threat actors have delivered Bookworm as a payload in attacks on targets in Thailand.


Once thought to be defunct, the resilient Pushdo has surfaced with infections observed in more


A backdoor also known as: Trojan.KillHDD.A Trojan.KillHDD.A Trojan.KillHDD.A Trojan.KillHDD.A Trojan.Dos.KillHDD.flqn KillHDD.A Trojan.DOS-4 Trojan.DOS.KillHDD.a Dos.Trojan.Killhdd.Taew Trojan.KillHDD.A TrojWare.DOS.KillHDD.a Trojan.KillHDD.A Trojan.TestSpeed Trojan.KillHDD.DOS.5 Trojan/KillHdd.a TR/KillHDD.A W32/KillHDD.A!tr Trojan/DOS.KillHDD Trojan.KillHDD.A Troj.DOS.KillHDD.a!c Trojan.KillHDD.A Trojan.DOS.KillHDD.a


A backdoor also known as: W32.MirolanG.Trojan TjnDownldr.Stocde.S16616 Win.Trojan.15532522-1 Trojan.Injector.Win32.358137 Trojan.Zusy.D2B3AD TrojanDownloader:Win32/Stocde.A!bit


A backdoor also known as: W32/Packed_Upack.A Trojan.Crypt-41 Trojan-Spy.Win32.KeyLogger.cc Trojan.Zlob!IK Packed.Win32.MUPACK.~KW TrojanSpy.Keylogger.mn Packed.Win32.UPack PSW.Keylog.S Trj/Pupack.A


] com/ hxxp : //apple-icloud [ .


A backdoor also known as: Heur.Corrupt.PE TrojanDropper:Win32/OverJoiner.2_1.dam#2


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9911 Uds.Dangerousobject.Multi!c Trojan.MSIL.Spammer Spammer:MSIL/Misnt.A Trojan/Win32.Tepfer.R109904 Backdoor.Bot Trojan.Spammer!2GUbUR+Ce0w Trj/CI.A Win32/Trojan.Spammer.087


We've seen a plethora of threats that leverage malicious LNK files: from well-known ransomware families, backdoors typically deployed in targeted attacks, and banking Trojans to spam emails, even an exploit to a LNK vulnerability itself.


Although Ewind is fundamentally adware, monetization through displaying advertising on the victim device, it also includes other functionality such as collecting device data, and forwarding SMS messages to the attacker.


The oldest app of the second campaign was last updated in April 2016 , meaning that the malicious code hid for a long time on the Play store undetected .


From the outside , they are indistinguishable from the legitimate applications .


A backdoor also known as: Trojan:MSIL/DNSChanger.E


A backdoor also known as: W32.HfsIemusi.27F7 Trojan/W32.Depok.467814 Virus.Win32.Sality!O Trojan.Depok.Win32.59 Win32.Trojan.WisdomEyes.16070401.9500.9968 Backdoor.Graybird Trojan.Win32.Havar.cvsjm Backdoor.W32.SdBot.leu6 Trojan.MulDrop5.4716 BehavesLike.Win32.FakeAlertSecurityTool.gc Trojan/Depok.aq Trojan/Win32.Depok TrojanDropper:Win32/Frovserp.B Trojan.Win32.Z.Packer.467814 Trojan/Win32.Depok.R90764 OScope.Trojan.Diple Trojan.Depok!RTDJO7TWHwY Trojan-Dropper.Delf Win32/Trojan.01f


Kaspersky Lab ICS CERT detected a targeted attack aimed at industrial organizations which began in August 2016 and is currently ongoing.


To add more fuel to an existing fire, the sample was uploaded to VirusTotal from an IP address in Thailand a couple of minutes before the Bangkok Post newspaper reported the theft of 12 million baht from ATMs at banks in Thailand.


After a successful infection, RAA executes its main task, i.e. encrypts the user's files.


A backdoor also known as: Trojan.MSIL TROJ_PICIMGLOD.SM Trojan.Win32.Z.Taily.25600 TROJ_PICIMGLOD.SM TR/Downloader.lwzwe TrojanDownloader:MSIL/Taily.B!bit Trojan-Downloader.MSIL.Small Win32/Trojan.7c5


What ’ s more , the numbering of Asacub versions is a continuation of the Smaps system .


We found it to be installing bedep and vawtrak.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9998 BehavesLike.Win32.VirRansom.dc Trojan.Heur.E77EF0


A backdoor also known as: Backdoor/Alcodor.b Trojan.Heur.PT.EAD13BE Win32.Trojan.WisdomEyes.16070401.9500.9994 Backdoor.Win32.Alcodor.b Trojan.Win32.Alcodor.dbgk Backdoor.W32.Alcodor.b!c Win32.Backdoor.Alcodor.Hupm Backdoor.Win32.Alcodor.b BackDoor.Tsunami Backdoor.Alcodor.Win32.1 Backdoor.Win32.IRCBot Backdoor/Alcodor.a Trojan[Backdoor]/Win32.Alcodor Backdoor.Win32.Alcodor.b Backdoor.Alcodor Backdoor.Alcodor!NsO2/XMEkFE W32/Alcodor.B!tr Win32/Backdoor.db8


A backdoor also known as: Virus.Win32.Dropper Trojan.Adware.Symmi.D781 Trojan:Win32/Korad.C Adware/Win32.KorAd.R31907 Trojan.Downloader.86016 Adware.Kraddare!CwFWIAptaxs Win32/Trojan.Adware.6d7


Our findings from this new campaign include C2 infrastructure, new attack methods, four types of malware including Android malware, a system for management of stolen victim data and some detail of the actors.


A backdoor also known as: Backdoor.Simhack.EX Backdoor.Simhack.EX Backdoor.Simhack.EX Backdoor.Simhack!OrBfM+IbJYI Backdoor.Trojan Backdoor.Simhack.EX Backdoor.Simhack.EX BDS/Simhack.EX Backdoor.Simhack.EX Backdoor.Simhack.EX W32/SIMHACK.EX!tr.bdr Win32/Backdoor.IM.624


Four of the exchanges that were attacked during this timeframe by ITG03 actors were located in South Korea; while this could simply be coincidence given South Korea's large cryptocurrency market, these campaigns against South Korean entities could have the added benefit of meeting ITG03's other motivation of exhibiting force to their enemies.


A backdoor also known as: W32.SysFileB.Trojan Trojan.Win32.VB!O Trojan.VB.Win32.19780 Trojan.Kazy.D7548 Win32.Trojan.VB.hd W32/Trojan2.ERGA Win32/Pacuks.A WORM_SILLY.CC Win.Trojan.VB-7031 Trojan.Win32.VB.evlkqz Trojan.Win32.VB.61699 TrojWare.Win32.Trojan.VB.~XX Trojan.MulDrop3.18059 WORM_SILLY.CC W32/Trojan.ISFS-8468 Trojan/VB.adk TR/VB.aop Trojan/Win32.VB Win32.Troj.VB.ao.kcloud Trojan/Win32.VB.R205901 Trojan.VBO.0441 Trojan.VB!yx+XlInqS1c Trojan.Win32.VB W32/VB.AOO!tr Win32/Trojan.16b


We have observed these new tools being used to target U.S.-based chain restaurants, although FIN7 has previously targeted hospitality organizations, retailers, merchant services, suppliers and others.


Based on this JSON reply , the app looks for an HTML snippet that corresponds to the active element ( show_hide btnnext ) and , if found , the Javascript snippet tries to perform a click ( ) method on it .


A backdoor also known as: Trojan.Win32.Inject.wuxxl TROJ_SPNR.0CCG12 Trojan.Injector!ChMY8oc2Znc Trojan.Win32.S.Klibot.90112.A Trojan.Inject.64029 TR/Buzus.90112.7 TROJ_SPNR.0CCG12 Win32.Troj.Undef.kcloud Trojan:Win32/Klibot.A Virus.Win32.CeeInject W32/Injector.HXK!tr


Mcafee has recently seen some interesting tactical changes, including: Attachments with the malicious executable inside Microsoft Office documents that contain a malicious macro.


Before interpreting the opcode , the VM decrypts the opcode ’ s content ( through a simple XOR algorithm ) , which it then relocates ( if needed ) , using the relocation fields .


Specifically, it's the first malware we've seen in the wild that abuses private APIs in the iOS system to implement malicious functionalities.


A backdoor also known as: Troj.W32.Wildpositron!c Win32.Trojan.WisdomEyes.16070401.9500.9966 Backdoor.Duuzer W32/WildPositron.OTL!tr Trojan/Win32.WildPositron Backdoor:Win32/Escad.S!dha Win32/Trojan.af9


One of the export calls used is to check if the victimized system is located in Brazil.


After installation, the application runs in the background as service.


A backdoor also known as: Trojan.Ronathim.A4 TROJ_VB.DQO Trojan.VB-47165 Trojan.Win32.VB.alvj TR/Kryptik.FA TROJ_VB.DQO Trojan:Win32/Ronathim.A Trojan.Win32.A.VB.245760 Trojan/Win32.VB Trojan.VBRA.013935 Win32/VB.NYR Trojan.Ronathim!4287 W32/VB.ALVJ!tr


Ginp - A malware patchwork borrowing from Anubis November 2019 Intro ThreatFabric analysts have recently investigated an interesting new strain of banking malware .


campaigns in multiple different countries.


So how does Android.Bankosy take advantage of voice-based 2FA?


A backdoor also known as: Trojan-Downloader.Win32.Apher!O Win32.Trojan.WisdomEyes.16070401.9500.9969 Win32/SillyDl.CSE Trojan-Downloader.Win32.Apher.o TrojWare.Win32.TrojanDownloader.Apher.U0 Trojan.DownLoader6.31749 Trojan-Downloader.Win32.Apher.o Win32/SpyBot.WA.downloader


We call it the XM1RPC campaign due to the common backdoor used across all of the compromised sites.


Today, Kelihos is in a festive mood and giving away a free Amazon Gift Card especially for US customers.


The information is then stored in local app database as well as sent to the backend .


This translates into a kit that will largely evade traditional blacklisting solutions.


I would first like to credit TrendMicro with their initial research on FighterPOS.


] it Bologna server3ct.exodus.connexxa [ .


Conclusion Smishing ( SMS phishing ) offers a unique vector to infect mobile users .


] infoal-amalhumandevelopment [ .


Around July last year, more than a 100 Israeli servicemen were hit by a cunning threat actor.


Zscaler ThreatLabZ came across a new Infostealer Trojan written in .NET that utilizes popular tools like Fiddler Json.NET for its operation.


These accounts are created by abusing accessibility services .


This new organization proposed the creation of a more secure Android phone .


A backdoor also known as: W32.TikoraxaDSB.Trojan Dropped:Application.BitCoinMiner.TF BehavesLike.Win32.Trojan.fh TR/Dldr.Bitsadmin.TW TrojanDownloader:Win32/Sminager.F Trj/CI.A Trojan.DL.Alien! Dloader.X!tr


A backdoor also known as: AdWare.Downloader.Addrop


As a part of our Kaspersky APT Intelligence Reporting subscription, customers received an update in mid-February 2017 on some interesting APT activity that we called WhiteBear.


The RAT stores all the data in a database ( DB ) in order to send it to the Command & Control ( C & C ) server .


Snake, also known as Turla, Uroburos and Agent.BTZ, is a relatively complex malware framework used for targeted attacks.


The Trojan for Linux designed to carry out DDoS attacks.


After the installation, the application does not immediately show its true colours, in fact the malicious activities are postponed for a couple of minutes so users can for example first use the app to open funny videos or watch the latest news.


Figure 1 shows one such landing page using stolen branding from Bank Austria .


A targeted phishing campaign was active in early August 2017 delivering Подписать документы.doc translates to Sign Documents.doc , a MS Word document with an embedded macro responsible for dropping both the CHTHONIC banking trojan and DIMNIE spyware to an infected machine.


Example of a command that steals specific files from an infected device ’ s application ( top ) , and GolfSpy ’ s parse-and-perform command ( bottom ) Apart from the HTTP POST method , GolfSpy also creates a socket connection to the remote C & C server in order to receive and perform additional commands .


This report describes an elaborately staged malware operation with targets in the Syrian opposition.


delivered well-known backdoor variants like Gamarue.


Sophisticated campaign targeting individuals within the Mongolian government.


A backdoor also known as: Win32.Trojan.Diamin.a DIAL_DIAMIN.YG Win.Trojan.Dialer-856 Troj.W32.Diamin.l3NB TrojWare.Win32.Diamin.A Dialer.Diamin.68 DIAL_DIAMIN.YG Trojan.Win32.Dialer Trojan:Win32/Diamin.F Trojan/Win32.Dialer.R7699 W32/Dialer.SL!tr


Additionally , some copies of Exodus One use the following XOR key : Rino Gattuso is a famous retired Italian footballer , originally from Calabria .


Defense against FinFisher Exposing as much of FinFisher ’ s riddles as possible during this painstaking analysis has allowed us to ensure our customers are protected against this advanced piece of malware .


A backdoor also known as: Trojan.Crypren Ransom.FileCryptor.MSIL Troj.Ransom.W32.Crypren!c Ransom_Cryptid.R020C0DAF18 Trojan-Ransom.Win32.Crypren.aedj Trojan.Win32.Z.Ransom.36864.C Ransom_Cryptid.R020C0DAF18 BehavesLike.Win32.Trojan.nz Trojan.Crypren.kx TR/Paradise.sbeoo Trojan-Ransom.Win32.Crypren.aedj Hoax.Crypren Trj/GdSda.A Win32.Trojan.Crypren.Ecup Trojan-Ransom.FileCoder Win32/Trojan.929


With the potential to sell access to these devices to the highest bidder, Check Point researchers say similar malware campaigns may become a trend.


A backdoor also known as: W64/Trojan.EUMI-4574 Trojan.Trick.45175 BehavesLike.Win64.Dropper.cm Trojan/Win32.Trickster Trojan:Win64/Totbrick.A Trojan/Win32.Trickster.C1931466 Trojan.Win64.Trickbot


Based on the findings, Talos remains confident that the attack was destructive in nature.


In the case reported on by SensePost, this allowed for the fetching or downloading of remote payloads, using PowerShell for example.


APT28 has recently focused on using different themes.


Mobile devices are at the frontier of cyber espionage , and other criminal motives .


As rooting exploits on Android become less prevalent and lucrative , PHA authors adapt their abuse or monetization strategy to focus on tactics like click fraud .


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9986 Trojan.Win32.Pabin.bdv Trojan.Win32.Pabin.etvjly Win32.Trojan.Pabin.Pgmm Trojan.DownLoader26.9492 Trojan.Zusy.D3AED5 Trojan.Win32.Pabin.bdv Trojan:MSIL/Alohahaha.A Trojan/Win32.Pabin.R200797 Trojan.Pabin Trj/GdSda.A Win32/Trojan.Spy.155


A backdoor also known as: W32.DropperFarfli.Trojan Trojan-Dropper.Win32.Binder!O Backdoor.Farfli.O Trojan/Farfli.ej Win32.Backdoor.DarkAngle.a Backdoor.Trojan BKDR_ZEGOST.SMT Win.Spyware.Magania-20683 Backdoor.Win32.Zegost.mtcgx Trojan.Win32.Graz.pmawx Trojan.Win32.A.PSW-Magania.144384.AD Backdoor.Win32.Gh0st.au TrojWare.Win32.Farfli.LK Trojan.DownLoader7.28359 Trojan.Farfli.Win32.5816 BKDR_ZEGOST.SMT W32.Trojan.Farfli TR/Drop.Farfli.E.355 Trojan[GameThief]/Win32.Magania TrojanDropper:Win32/Farfli.E Trojan.Barys.416 Backdoor.Win32.Zegost.mtcgx Dropper/Win32.OnlineGameHack.R3269 TrojanDropper.Binder Trojan.DR.Binder!mFx5gbiyT10 Trojan-GameThief.Win32.Magania Backdoor.Win32.Gh0st.FC


In addition to the basic functionality all backdoors provide, T9000 allows the attacker to capture encrypted data, take screenshots of specific applications and specifically target Skype users.


A backdoor also known as: Trojanspy.Aolisil Win32.Trojan.WisdomEyes.16070401.9500.9590 Trojan.Win32.Aolisil.exccvy Win32.Trojan.Thief.Azkn Worm.Win32.Dropper.RA TR/Spy.Aolisil.fsmds TrojanSpy:Win32/Aolisil.A


Arid Viper testing new delivery mechanisms


A backdoor also known as: PUP.Optional.BitCoinMiner Application.Heur2.E9960A Win32.Trojan.WisdomEyes.16070401.9500.9516 Win64.Riskware.BitCoinMiner.E not-a-virus:RiskTool.Win64.BitCoinMiner.bll Riskware.Win64.BitCoinMiner.ewmbqa Program.BitCoinMiner.3 W64/Application.OFLM-1880 RiskTool.BitCoinMiner.abf W32.Bitcoinminer not-a-virus:RiskTool.Win64.BitCoinMiner.bll Trojan/Win64.BitCoinMiner.C1716351


A backdoor also known as: Trojan.Kheagol!AxrLEkZrH0Y TrojanDropper:Win32/Kheagol.C Trojan-Banker.Banker HeurEngine.MaliciousPacker Worm.Win32.Viking.pf Trj/CI.A


Otherwise , it will return a JSON encoded " OK , '' and if that is the case , the command to be executed .


A backdoor also known as: Backdoor.Trojan W32/DLoader.AHYXT WORM_FLYSTUD.SM not-a-virus:AdWare.Win32.FlyStudio.l WORM_FLYSTUD.SM Win32/Nuj.KC Virus.Win32.ScramFly!IK Trojan:Win32/Aesevin.B OScope.Trojan.EPL.Goopl Backdoor.Trojan Virus.Win32.ScramFly Trj/FlyStudio.BI


The 2013 incident was highly publicized and, in the aftermath, the threat actor went dark for almost one year.


A backdoor also known as: Trojan/W32.Small.44856 Trojan/VB.rqn Win32.Trojan.WisdomEyes.16070401.9500.9868 W32/Trojan2.IJWB Trojan.Win32.VB.cway Trojan.Win32.VB.bacjn Troj.W32.Vb!c W32/Trojan.KJRG-1539 TR/Gontu.B.dll Trojan/Win32.VB Trojan:Win32/Gontu.B!dll Trojan.Win32.VB.cway Trojan/Win32.VB.R16201 Win32.Trojan.Vb.sti Trojan.VB!RX1Ky6tbhy8 Trojan.Win32.VB


A backdoor also known as: Win32.HLLW.Deloder.A W32.Deloder W32/Deloder.worm Worm.Deloder.Win32.1 W32.W.Deloder.a!c W32/Deloder.A.worm Win32.HLLW.Deloder.A WORM_DELODER.A W32/Deloder.C W32.HLLW.Deloder Win32/Deloder.A WORM_DELODER.A Win.Worm.Deloder-1 Worm.Win32.Deloder.a Win32.HLLW.Deloder.A Riskware.Win32.PsExec.hqgg Win32.Worm.Deloder.Pbyh Win32.HLLW.Deloder.A Worm.Win32.Deloder.A Win32.HLLW.Deloder.A Win32.HLLW.Deloder W32/Deloder.worm W32/Deloder.HMKZ-0403 Worm:Win32/Deloder.A Worm/Win32.Deloder Worm.Deloder.a.kcloud Worm:Win32/Deloder.A Worm.Win32.Deloder.745984 Worm.Win32.Deloder.a Win32/Deloder.worm.745984 Win32.HLLW.Deloder.A Worm.Deloder I-Worm.Deloder.A I-Worm.Deloder.A Backdoor.Win32.Tsunami Win32.HLLW.Deloder.A W32/Deloder.A


Shellcode simply uses dlopen to open a .so file within the target process and then dlsym to find a symbol in that file and run it .


Sakula uses HTTP GET and POST communication for command and control C2.


The primary functionality of this tool is to gather information about the victim.


Not so long ago, Kaspersky clients in the United States approached Kaspersky researchers with a request to investigate a new type of malicious software that they were able to recover from their organizations' servers.


This eponymous lurking behavior would earn them notoriety until their operations were stymied and the perpetrators arrested.


The traffic transits in clear and is therefore potentially exposed to man-in-the-middle attacks : At the same time , null will also bind a local shell on 0.0.0.0:6842 .


Carbanak is a prolific crime group, well known for stealing over one billion dollars from banks in 2015 *Kaspersky estimated loss and more recently orchestrating an attack on the Oracle Micros POS support site that put over one million Point of Sale systems at risk.


In order to infect the victims, the attackers distributed spear-phishing emails containing malicious excel file which when opened dropped a malware capable of downloading additional components and spying on infected systems.


A backdoor also known as: W32.VaraminoR.Trojan P2P-Worm.Win32.Palevo!O TrojanDownloader.Small.AO6 W32/Palevo.eezd Trojan.Graftor.D479B Win.Trojan.Palevo-31897 Trojan-Downloader.Win32.Geral.boyj Trojan.Win32.Dwn.guudm Worm.Win32.A.P2P-Palevo.2115231 Troj.Downloader.W32.Geral!c Trojan.DownLoader5.26538 Dropper.StartPage.Win32.1147 Backdoor.Win32.Wuca TrojanDropper.StartPage.pr WORM/Palevo.HG.2 Win32/Palevo.NQ BScope.P2P-Worm.Palevo Win32.Trojan-downloader.Geral.Pfsq Worm.P2P.Palevo!loSA6JxZFd8 W32/Palevo.E!worm.p2p


A backdoor also known as: W32.Vetor8933 Worm.Win32.Delf!O Trojan.Pazzky.A8 TROJ_PAZZKY.SM Win.Trojan.Delf-31409 Trojan.Win32.Scar.jxhs Trojan.Win32.Delf.bobvhf Troj.W32.Scar!c Win32.Trojan.Scar.Hqbv Worm.Win32.Delf.NJO Trojan.DownLoader6.22592 TROJ_PAZZKY.SM BehavesLike.Win32.Dropper.fc Worm/Delf.zj TR/Pazzky.A.164 Worm/Win32.Delf Trojan.Jacard.D13B1A Worm.Win32.A.Delf.350976[UPX] Trojan.Win32.Scar.jxhs Trojan:Win32/Pazzky.A Trojan/Win32.Downloader.R64664 TScope.Trojan.Delf Win32/Delf.NJO W32/Scar.JXHS!tr Trj/CI.A Win32/Worm.4b2


The Trojan gets the list of bank phone numbers from its C & C server .


They have attacked more than 100 companies since January 2023.


Through analysis of malicious code, files, and infrastructure it is clear the group behind this campaign is either directly responsible for or has cooperated with the group which conducted Operation Blockbuster Sequel and, ultimately, Operation Blockbuster originally outlined by researchers from Novetta.


A backdoor also known as: W32.DaislyC.Trojan Trojan.Nagram.S83339 Trojan.Downloader Trojan/Vabushky.a Win32.Trojan.WisdomEyes.16070401.9500.9902 W64/Trojan.AXTN-9138 Trojan.Ransomcrypt.E Trojan.Encoder.289 Trojan.Vabushky.Win64.4 BehavesLike.Win64.Trojan.qc Trojan:Win64/Alureon.L Dropper/Win64.Vabushky.R81451 Trojan.Win64.Vabushky Trj/CI.A Win64/Vabushky.A Trojan.Win64.Vabushky W64/Vabushky.A!tr Win32/Trojan.4b0


It is typically distributed as a .jar Java archive attachment via spam emails see Figure 1 and relies on social engineering to convince a victim to execute the attachment.


A backdoor also known as: Trojan.Win32.Lunam!O Trojan.Lunam.A3 Trojan/Lunam.a Win32.Trojan.Otfrem.b W32/Trojan2.NMKU W32.SillyFDC.BCR Win32/SillyAutorun.EQP TROJ_LUNAM_0000000.TOMA Win.Trojan.Lunam-1 Trojan.Win32.Lunam.a Trojan.Win32.VB.mjwir Trojan.Win32.A.Lunam.476772 Trojan.Win32.FakeFolder.pb Win32.HLLW.Autoruner.48319 Trojan.Lunam.Win32.1 TROJ_LUNAM_0000000.TOMA BehavesLike.Win32.VBObfus.tm W32/Trojan.ZUUL-8834 Trojan/Lunam.b Trojan/Win32.Lunam Troj.W32.Lunam.tn6c Trojan.Win32.Lunam.a Trojan/Win32.Lunam.R2841 Trojan.VBO.012939 Win32/Otfrem.A Trojan.Win32.Lunam W32/Lunam.A!tr Worm.Win32.FakeFolder.CU


It downloads the Poison Ivy malware onto the victim's computer and then launches it.


The Lookout Threat Intelligence team identified that this same Facebook profile has also posted Google Drive links to Android malware belonging to the FrozenCell family attributed to APT-C-27 .


In addition to the clicking activity , Judy displays a large amount of advertisements , which in some cases leave users with no option but clicking on the ad itself .


A backdoor also known as: W32.eHeur.Malware10 Backdoor.Farfli.K7 Trojan.Farfli.Win32.13589 Trojan/Farfli.ek BKDR_ZEGOST.SMT Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan BKDR_ZEGOST.SMT Win.Trojan.Nitol-6335025-0 Trojan.Win32.Farfli.bqoghb TrojWare.Win32.Magania.~AAD Trojan.DownLoader8.24132 BehavesLike.Win32.Dropper.wc BDS/Farfli.kj.2 Trojan.Spyrat.1 Backdoor:Win32/Farfli.O Trojan/Win32.OnlineGameHack.R9840 backdoor.win32.gh0st.ay Trojan.Farfli!Mc/Bw6h7dtA Trojan-GameThief.Win32.Magania W32/Farfli.AIL!tr


This unique on-device , just-in-time ( JIT ) approach inspired researchers to dub this malware as “ Agent Smith ” .


Android services are components that can be made to execute independently in the background without the victim 's knowledge .


Key individuals, who are believed to be part of a China-based attack group, have been stealing years of valuable government and corporate information from defense and high technology organizations in the US since 2013 and political and government-related entities in China, Hong Kong, and the Philippines since 2010.


After months of investigation, we found that several undisclosed malware and interesting tools used for exfiltration purposes were used in this campaign.


These targets include privatized government agencies and government contractors, as well as companies in the consumer electronics, computer, healthcare, and financial industries.


A backdoor also known as: Trojan.Script.Dwn.eqrgom Trojan.KLZM-7 TrojanDownloader:JS/NeutrinoEK.Y virus.js.qexvmc.1


] com hxxp : //sagawa-reg [ .


A backdoor also known as: Win32/Trojan.673


In the early days of malware, we all remember analyzing samples of IRC botnets that were relatively simple, where the malware would connect to a random port running IRC, joining the botnet and waiting for commands from their leader.


Based on this information , Talos assesses with high confidence that the malware is the same and this is , in fact , the Gustuff malware .


This method allows Dridex to perform sneaky injections to evade AV solutions.


Wallex is a modular trojan that can download modules from a remote C&C


A backdoor also known as: JS.Locky.JI VBS/Downldr.HM VB:Trojan.Downloader.JTTI VB:Trojan.Downloader.JTTI Trojan.Script.Vbs-heuristic.druvzi VB:Trojan.Downloader.JTTI VBS.DownLoader.983 Trojan-Ransom.Script.Locky


Droppers Per Device Avg .


These names are mainly related to the propagation of the Trojan, attack activities, such as the initial use of the Driver Life Update Server for propagation, the use of the Eternal Blue vulnerability in the target system, C2 communication and PowerShell script code with the Lemon Duck string, etc.


A backdoor also known as: W32/Paroc.b Win32.Trojan.WisdomEyes.16070401.9500.9999 W32.Paroc.Worm WORM_PAROC.B Win.Worm.Paroc-1 Email-Worm.Win32.Paroc.b Trojan.Win32.Paroc.enlr I-Worm.Win32.Paroc.12288.B Win32.Prosac.12288 Worm.Paroc.Win32.2 WORM_PAROC.B BehavesLike.Win32.FDoSBEnergy.lz W32/Paroc.B I-Worm/Paroc.b WORM/Paroc.B Worm[Email]/Win32.Paroc Worm:Win32/Paroc.A@mm W32.W.Paroc.b!c Email-Worm.Win32.Paroc.b Worm/Win32.Paroc.R55629 Worm.Paroc Win32/Paroc.B I-Worm.Paroc!Wvi+tOd6Ue8 Email-Worm.Win32.Paroc W32/Paroc.B!worm


A backdoor also known as: Trojan.Rimecud.BB Win32.Trojan.WisdomEyes.151026.9950.9999 WORM_PALEVO.SMQM Trojan.Win32.ULPM.cykics Malware.FakeFolder@CV!1.6ABF Trojan.Packed.21635 WORM_PALEVO.SMQM BehavesLike.Win32.Rimecud.dt Trojan/Sasfis.unb Trojan.Razy.DB256 Trojan:Win32/Rimecud.A Worm/Win32.Palevo BScope.P2P-Worm.Palevo Virus.Win32.Virut W32/Palevo.CQQA!worm.p2p Trj/Rimecud.a


This practice can be enforced by unchecking the " Unknown Sources '' option under the " Security '' settings of your device .


A backdoor also known as: Trojan.Heur.DP.rmIfaqjr92e Backdoor:Win32/Kazakiwhale.A


Interestingly , early “ clean ” versions contain varying levels of signals that the updates will include malicious code later .


At least one observed phishing lure delivered a Cobalt Strike payload.


It is being used as a launch platform for APT actors including the now well-known Shell_Crew / Deep Panda group.


This post will also give you insights about the level of sophistication this malware has reached.


These emails are part of a wave of malware-ridden spam attacks that are currently active in Japan.


A backdoor also known as: Backdoor.Hupigon.YBO Backdoor.Win32.Hupigon.pv Backdoor.Hupigon.YBO Backdoor.Hupigon.YBO BackDoor.Pigeon.194 Trojan-Downloader.Win32.Delf.bcz!IK Backdoor/Hupigon.rsp Backdoor.Hupigon.YBO Virus.Win32.Heur.c Trojan-Downloader.Win32.Delf.aup Backdoor.Win32.Gpigeon2008.acj Trojan-Downloader.Win32.Delf.bcz


A backdoor also known as: W32.JavaNVA.Worm Trojan.Maljava Java/Trupto.A JAVA_CRAT.A Backdoor.Java.CrossRAT.b Trojan.Java.CrossRAT.exmvuo Backdoor.Java.Crossrat!c Java.CrossRat.1 JAVA_CRAT.A Backdoor.Java.gl Java/Trupto.A!tr Backdoor.Java.CrossRAT.b Trojan:Java/Trupto.A Backdoor.Java.CrossRAT Java.Backdoor.Crossrat.Ebqt Backdoor.Java.CrossRat virus.java.crossrat.1


This contained malware that we detect as Backdoor:W32/Wonknu.A.


It is unclear whether this means early samples were targeting Arabic speakers or if the developers behind it are fluent in Arabic .


A backdoor also known as: HW32.Packed.C01D Trojan-Downloader.Win32.Bredolab W32.W.Joleee.kZ0o Trojan/Pakes.nmc WORM_PKOOBF.SM Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Bredolab.JO WORM_PKOOBF.SM Trojan.Win32.Pakes.nmc Trojan.Win32.MLW.ejone Trojan.Win32.Pakes.29184.I Trojan.Packed.19706 Trojan.Pakes.Win32.79 Trojan/Pakes.gyk Trojan.Win32.Pakes.nmc TrojanDownloader:Win32/Bredolab.X TrojanDownloader.Bredolab Trojan-Downloader.Win32.Bredolab Win32/TrojanDownloader.Bredolab.AA Trojan-Downloader.Win32.Bredolab


A backdoor also known as: VB:Trojan.VBS.Downloader.ACP O97M.Downloader.AJK VB:Trojan.VBS.Downloader.ACP Doc.Downloader.Jaff-6316585-1 VB:Trojan.VBS.Downloader.ACP VB:Trojan.VBS.Downloader.ACP VB:Trojan.VBS.Downloader.ACP VB:Trojan.VBS.Downloader.ACP W97M.DownLoader.1738 HEUR_VBA.O2 W97M/Downloader.byw TrojanDownloader:JS/Swabfex.P VB:Trojan.VBS.Downloader.ACP W97M/Downloader.byw OLE.Win32.Macro.703738 WM/Moat.F1678919!tr virus.office.obfuscated.1


What's interesting to note is that some compromised sites have more value than others and this is especially true when those sites happen to be used to serve ad banners.


A backdoor also known as: Trojan.Facetake Trojan.Win32.Fbtaken.ewtnbc Trojan.MSIL.Fbtaken W32/Trojan.KQVO-5134 Trojan.MSILPerseus.D9A09 Trojan:Win32/Facetake.A Trj/GdSda.A Trojan.Fbtaken! MSIL/Fbtaken.B!tr


When considered holistically, the intelligence supports the conclusion that this exploitation campaign was purposefully carried out against the backdrop of diplomatic and legal maneuvering.


A backdoor also known as: PUP.PennyBee/Variant Trojan.Symmi.D12F46 Multi.Threats.InArchive Trojan.Win32.Patcher.zw Trojan.Win32.Kazy.dzllhn TrojWare.Win32.Addrop.SHHH Trojan.Lyrics.1951 Trojan-Dropper.Win32.Addrop TR/Taranis.1328 Trojan:Win32/Cuffahlt.C Trojan.Win32.Patcher.zw PUP/Win32.Pennybee.R164339 Trojan.Patcher PUP.Optional.PennyBee Win32/TrojanDropper.Addrop.AB Trojan.DR.Addrop!