Malpedia
Malware galaxy cluster based on Malpedia.
Authors
| Authors and/or Contributors |
|---|
| Davide Arcuri |
| Alexandre Dulaunoy |
| Steffen Enders |
| Andrea Garavaglia |
| Andras Iklody |
| Daniel Plohmann |
| Christophe Vandeplas |
FastCash
Internal MISP references
UUID e8a04177-6a91-46a6-9f63-6a9fac4dfa02 which can be used as unique global reference for FastCash in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/aix.fastcash - webarchive
- https://i.blackhat.com/USA-20/Wednesday/us-20-Perlow-FASTCash-And-INJX_Pure-How-Threat-Actors-Use-Public-Standards-For-Financial-Fraud-wp.pdf - webarchive
- https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/ - webarchive
- https://www.symantec.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware - webarchive
- https://www.youtube.com/watch?v=zGvQPtejX9w - webarchive
- https://www.us-cert.gov/ncas/alerts/TA18-275A - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://i.blackhat.com/eu-20/Wednesday/eu-20-Rivera-From-Zero-To-Sixty-The-Story-Of-North-Koreas-Rapid-Ascent-To-Becoming-A-Global-Cyber-Superpower.pdf - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware - webarchive
- https://threatrecon.nshc.net/2019/01/23/sectora01-custom-proxy-utility-tool-analysis/ - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/TA18-275A - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa20-239a - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-108A-TraderTraitor-North_Korea_APT_Targets_Blockchain_Companies.pdf - webarchive
- https://www.youtube.com/watch?v=LUxOcpIRxmg - webarchive
- https://github.com/fboldewin/FastCashMalwareDissected/ - webarchive
- https://blog.talosintelligence.com/2019/05/10-years-of-virtual-dynamite.html - webarchive
- https://i.blackhat.com/USA-20/Wednesday/us-20-Perlow-FASTCash-And-INJX_Pure-How-Threat-Actors-Use-Public-Standards-For-Financial-Fraud.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
888 RAT
Internal MISP references
UUID e98ae895-0831-4e10-aad1-593d1c678db1 which can be used as unique global reference for 888 RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Aberebot
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Aberebot.
| Known Synonyms |
|---|
Escobar |
Internal MISP references
UUID 4b9c0228-2bfd-4bc7-bd64-8357a2da12ee which can be used as unique global reference for Aberebot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.aberebot - webarchive
- https://blog.cyble.com/2021/07/30/aberebot-on-the-rise-new-banking-trojan-targeting-users-through-phishing/ - webarchive
- https://twitter.com/icebre4ker/status/1460527428544176128 - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://blog.cyble.com/2022/03/10/aberebot-returns-as-escobar/ - webarchive
- https://www.bleepingcomputer.com/news/security/android-malware-escobar-steals-your-google-authenticator-mfa-codes/ - webarchive
- https://hothardware.com/news/escobar-banking-trojan-targets-mfa-codes - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AbstractEmu
According to PCrisk, AbstractEmu is the name of rooting malware that can gain privileged access to the Android operating system. Threat actors behind AbstractEmu are using legitimate-looking apps (like password managers, app launchers, data savers) to trick users into downloading and opening/executing this malware.
Internal MISP references
UUID 57a4c8c0-140a-45e3-9166-64e3e35c5986 which can be used as unique global reference for AbstractEmu in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.abstract_emu - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://blog.lookout.com/lookout-discovers-global-rooting-malware-campaign - webarchive
- https://www.sentinelone.com/labs/the-art-and-science-of-macos-malware-hunting-with-radare2-leveraging-xrefs-yara-and-zignatures/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ActionSpy
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ActionSpy.
| Known Synonyms |
|---|
AxeSpy |
Internal MISP references
UUID 5c7a35bf-e5f1-4b07-b93a-c3608cc9142e which can be used as unique global reference for ActionSpy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.actionspy - webarchive
- https://www.trendmicro.com/en_us/research/20/f/new-android-spyware-actionspy-revealed-via-phishing-attacks-from-earth-empusa.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/new-android-spyware-actionspy-revealed-via-phishing-attacks-from-earth-empusa/ - webarchive
- https://about.fb.com/news/2021/03/taking-action-against-hackers-in-china/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AdoBot
Internal MISP references
UUID d95708e9-220a-428c-b126-a63986099892 which can be used as unique global reference for AdoBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AdultSwine
Internal MISP references
UUID 824f284b-b38b-4a57-9e4a-aee4061a5b2d which can be used as unique global reference for AdultSwine in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Agent Smith
Internal MISP references
UUID 34770e6e-e2c3-4e45-aa86-9d74b5309773 which can be used as unique global reference for Agent Smith in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AhMyth
According to PCrisk, Ahmyth is a Remote Access Trojan (RAT) targeting Android users. It is distributed via trojanized (fake) applications. Ahmyth RAT steals cryptocurrency and banking credentials, 2FA codes, lock screen passcodes, and captures screenshots.
Internal MISP references
UUID 86a5bb47-ac59-449a-8ff2-ae46e19cc6d2 which can be used as unique global reference for AhMyth in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.ahmyth - webarchive
- https://www.welivesecurity.com/2019/08/22/first-spyware-android-ahmyth-google-play/ - webarchive
- https://www.secrss.com/articles/24995 - webarchive
- https://mp.weixin.qq.com/s/J_A12SOX0k5TOYFAegBv_w - webarchive
- https://www.stratosphereips.org/blog/2020/11/10/android-mischief-rats-dataset - webarchive
- https://deform.co/hacker-group-caracal-kitten-targets-kdp-activists-with-malware/ - webarchive
- https://securelist.com/transparent-tribe-part-2/98233/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Alien
According to ThreatFabric, this is a fork of Cerberus v1 (active January 2020+). Alien is a rented banking trojan that can remotely control a phone and achieves RAT functionality by abusing TeamViewer.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Alien.
| Known Synonyms |
|---|
AlienBot |
Internal MISP references
UUID de483b10-4247-46b3-8ab5-77d089f0145c which can be used as unique global reference for Alien in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.alien - webarchive
- https://muha2xmad.github.io/malware-analysis/alien/ - webarchive
- https://www.threatfabric.com/blogs/alien_the_story_of_cerberus_demise.html - webarchive
- https://research.checkpoint.com/2021/clast82-a-new-dropper-on-google-play-dropping-the-alienbot-banker-and-mrat/ - webarchive
- https://info.phishlabs.com/blog/alien-mobile-malware-evades-detection-increases-targets - webarchive
- https://www.checkpoint.com/press/2022/march-2022s-most-wanted-malware-easter-phishing-scams-help-emotet-assert-its-dominance/ - webarchive
- https://www.prodaft.com/m/reports/BrunHilda_DaaS.pdf - webarchive
- https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html - webarchive
- https://resecurity.com/blog/article/in-the-box-mobile-malware-webinjects-marketplace - webarchive
- https://preyproject.com/blog/en/cerberus-and-alien-the-malware-that-has-put-android-in-a-tight-spot/ - webarchive
- https://www.bleepingcomputer.com/news/security/google-predator-spyware-infected-android-devices-using-zero-days/ - webarchive
- https://twitter.com/CPResearch/status/1603375823448317953 - webarchive
- https://drive.google.com/file/d/1qd7Nqjhe2vyGZ5bGm6gVw0mM1D6YDolu/view?usp=sharing - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AmpleBot
This malware was initially named BlackRock and later renamed to AmpleBot.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular AmpleBot.
| Known Synonyms |
|---|
BlackRock |
Internal MISP references
UUID 2f3f82f6-ec21-489e-8257-0967c567798a which can be used as unique global reference for AmpleBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.amplebot - webarchive
- https://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html - webarchive
- https://www.threatfabric.com/blogs/alien_the_story_of_cerberus_demise.html - webarchive
- https://www.threatfabric.com/blogs/blackrock_the_trojan_that_wanted_to_get_them_all.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Anatsa
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Anatsa.
| Known Synonyms |
|---|
ReBot |
TeaBot |
Toddler |
Internal MISP references
UUID 147081b9-7e59-4613-ad55-bbc08141fee1 which can be used as unique global reference for Anatsa in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.anatsa - webarchive
- https://thehackernews.com/2022/01/widespread-flubot-and-teabot-malware.html - webarchive
- https://www.buguroo.com/hubfs/website/pdf/reports/buguroo-malware-report-Toddler_EN.pdf - webarchive
- https://www.cleafy.com/documents/teabot - webarchive
- https://www.threatfabric.com/blogs/anatsa-hits-uk-and-dach-with-new-campaign - webarchive
- https://twitter.com/icebre4ker/status/1416409813467156482 - webarchive
- https://blog.nviso.eu/2021/05/11/android-overlay-attacks-on-belgian-financial-applications/ - webarchive
- https://www.threatfabric.com/blogs/smishing-campaign-in-nl-spreading-cabassous-and-anatsa.html - webarchive
- https://twitter.com/ThreatFabric/status/1394958795508523008 - webarchive
- https://www.telekom.com/en/blog/group/article/flubot-under-the-microscope-636368 - webarchive
- https://labs.k7computing.com/index.php/play-store-app-serves-teabot-via-github/ - webarchive
- https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html - webarchive
- https://www.cleafy.com/cleafy-labs/teabot-is-now-spreading-across-the-globe - webarchive
- https://gbhackers.com/teabot-banking-trojan/ - webarchive
- https://www.prodaft.com/m/reports/Toddler___TLPWHITE_V2.pdf - webarchive
- https://labs.bitdefender.com/2021/06/threat-actors-use-mockups-of-popular-apps-to-spread-teabot-and-flubot-malware-on-android/ - webarchive
- https://labs.k7computing.com/?p=22407 - webarchive
- https://www.bitdefender.com/blog/labs/new-flubot-and-teabot-global-malware-campaigns-discovered - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AndroRAT
Androrat is a remote administration tool developed in Java Android for the client side and in Java/Swing for the Server. The name Androrat is a mix of Android and RAT (Remote Access Tool). It has been developed in a team of 4 for a university project. The goal of the application is to give the control of the android system remotely and retrieve informations from it.
Internal MISP references
UUID 80447111-8085-40a4-a052-420926091ac6 which can be used as unique global reference for AndroRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.androrat - webarchive
- https://www.stratosphereips.org/blog/2021/3/29/dissecting-a-rat-analysis-of-the-androrat - webarchive
- https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/the-urpage-connection-to-bahamut-confucius-and-patchwork/ - webarchive
- https://www.stratosphereips.org/blog/2020/11/10/android-mischief-rats-dataset - webarchive
- https://www.stratosphereips.org/blog/2021/5/6/dissecting-a-rat-analysis-of-the-command-line-androrat - webarchive
- https://www.kaspersky.com/blog/mobile-malware-part-4/24290/ - webarchive
- https://hotforsecurity.bitdefender.com/blog/possibly-italy-born-android-rat-reported-in-china-find-bitdefender-researchers-16264.html - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/352/Bitdefender-PR-Whitepaper-BitterAPT-creat4571-en-EN-GenericUse.pdf - webarchive
- https://github.com/DesignativeDave/androrat - webarchive
- https://mp.weixin.qq.com/s/AhxP5HmROtMsFBiUxj0cFg - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Anubis (Android)
BleepingComputer found that Anubis will display fake phishing login forms when users open up apps for targeted platforms to steal credentials. This overlay screen will be shown over the real app's login screen to make victims think it's a legitimate login form when in reality, inputted credentials are sent to the attackers.
In the new version spotted by Lookout, Anubis now targets 394 apps and has the following capabilities:
Recording screen activity and sound from the microphone Implementing a SOCKS5 proxy for covert communication and package delivery Capturing screenshots Sending mass SMS messages from the device to specified recipients Retrieving contacts stored on the device Sending, reading, deleting, and blocking notifications for SMS messages received by the device Scanning the device for files of interest to exfiltrate Locking the device screen and displaying a persistent ransom note Submitting USSD code requests to query bank balances Capturing GPS data and pedometer statistics Implementing a keylogger to steal credentials Monitoring active apps to mimic and perform overlay attacks Stopping malicious functionality and removing the malware from the device
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Anubis (Android).
| Known Synonyms |
|---|
BankBot |
android.bankbot |
android.bankspy |
Internal MISP references
UUID 85975621-5126-40cb-8083-55cbfa75121b which can be used as unique global reference for Anubis (Android) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.anubis - webarchive
- https://intel-honey.medium.com/reversing-anubis-malware-93f28d154bbb - webarchive
- https://labs.bitdefender.com/2020/03/android-apps-and-malware-capitalize-on-coronavirus - webarchive
- https://www.threatfabric.com/blogs/the-rage-of-android-banking-trojans.html - webarchive
- https://0x1c3n.tech/anubis-android-malware-analysis - webarchive
- https://bushidotoken.blogspot.com/2020/05/turkey-targeted-by-cerberus-and-anubis.html - webarchive
- https://community.riskiq.com/article/85b3db8c - webarchive
- https://intel471.com/blog/china-cybercrime-undergrond-deepmix-tea-horse-road-great-firewall/ - webarchive
- https://assets.virustotal.com/reports/2021trends.pdf - webarchive
- https://muha2xmad.github.io/malware-analysis/anubis/ - webarchive
- https://www.welivesecurity.com/2017/11/21/new-campaigns-spread-banking-malware-google-play/ - webarchive
- https://www.threatfabric.com/blogs/2020_year_of_the_rat.html - webarchive
- https://info.phishlabs.com/blog/new-variant-bankbot-banking-trojan-aubis - webarchive
- https://n1ght-w0lf.github.io/malware%20analysis/anubis-banking-malware/ - webarchive
- http://blog.koodous.com/2017/05/bankbot-on-google-play.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/google-play-apps-drop-anubis-banking-malware-use-motion-based-evasion-tactics/ - webarchive
- https://securelist.com/mobile-malware-evolution-2019/96280/ - webarchive
- https://securityboulevard.com/2018/09/android-malware-intercepts-sms-2fa-we-have-the-logs/ - webarchive
- http://blog.koodous.com/2017/04/decrypting-bankbot-communications.html - webarchive
- https://securityboulevard.com/2018/09/android-malware-intercepts-sms-2fa-we-have-the-logs/
- https://pentest.blog/n-ways-to-unpack-mobile-malware/ - webarchive
- https://sysopfb.github.io/malware,/reverse-engineering/2018/08/30/Unpacking-Anubis-APK.html - webarchive
- https://www.fortinet.com/blog/threat-research/a-look-into-the-new-strain-of-bankbot.html - webarchive
- http://b0n1.blogspot.de/2017/05/tracking-android-bankbot.html - webarchive
- https://www.youtube.com/watch?v=U0UsfO-0uJM - webarchive
- https://www.fortinet.com/blog/threat-research/bankbot-the-prequel.html - webarchive
- https://eybisi.run/Mobile-Malware-Analysis-Tricks-used-in-Anubis/ - webarchive
- https://securityintelligence.com/after-big-takedown-efforts-20-more-bankbot-mobile-malware-apps-make-it-into-google-play/ - webarchive
- https://securityaffairs.co/wordpress/133115/hacking/anubis-networks-new-c2.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AnubisSpy
Internal MISP references
UUID 06ffb614-33ca-4b04-bf3b-623e68754184 which can be used as unique global reference for AnubisSpy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.anubisspy - webarchive
- https://documents.trendmicro.com/assets/tech-brief-cyberespionage-campaign-sphinx-goes-mobile-with-anubisspy.pdf - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/cyberespionage-campaign-sphinx-goes-mobile-anubisspy/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Asacub
Internal MISP references
UUID dffa06ec-e94f-4fd7-8578-2a98aace5473 which can be used as unique global reference for Asacub in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ashas
Internal MISP references
UUID aabcfbb6-6385-486d-a30b-e3a2edcf493d which can be used as unique global reference for Ashas in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ATANK
According to Lukas Stefanko, this is an open-source crypto-ransomware found on Github in 2018. IT can en/decrypt files (AES, key: 32 random chars, sent to C&C), uses email as contact point but will remove all files after 24 hours or after a reboot.
Internal MISP references
UUID 231f9f49-6752-49af-9ee0-7774578fcbe4 which can be used as unique global reference for ATANK in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AxBanker
According to EnigmaSoft, AxBanker is a banking Trojan targeting Android devices specifically. The threatening tool has been deployed as part of large attack campaigns against users in India. The threat actors use smishing (SMS phishing) techniques to smuggle the malware threat onto the victims' devices. The fake applications carrying AxBanker are designed to visually impersonate the official applications of popular Indian banking organizations. The weaponized applications use fake promises or rewards and discounts as additional lures.
Internal MISP references
UUID 4a854e8c-d6ad-4997-8931-b27e39b7f7fa which can be used as unique global reference for AxBanker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.axbanker - webarchive
- https://blog.polyswarm.io/phishing-and-android-malware-campaign-targets-indian-banks - webarchive
- https://www.trendmicro.com/en_vn/research/22/k/massive-phishing-campaigns-target-india-banks-clients.html#:~:text=We%20found%20five%20banking%20malware,card%20information%20via%20phishing%20campaigns.&text=We%20observed%20an%20uptick%20in,message%20with%20a%20phishing%20link. - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BADCALL (Android)
remote access tool (RAT) payload on Android devices
Internal MISP references
UUID 5eec00de-5d81-4907-817d-f99cb33d9b66 which can be used as unique global reference for BADCALL (Android) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BadPatch
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BadPatch.
| Known Synonyms |
|---|
WelcomeChat |
Internal MISP references
UUID 9b96e274-1602-48a4-8e0d-9f756d4e835b which can be used as unique global reference for BadPatch in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bahamut (Android)
According to PCrisk, Bahamut is the name of Android malware with spyware functionality. Threat actors use Bahamut to steal sensitive information. The newest malware version targets various messaging apps and personally identifiable information.
Internal MISP references
UUID 4038c3bc-b559-45bb-bac1-9665a54dedf9 which can be used as unique global reference for Bahamut (Android) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.bahamut - webarchive
- https://mp.weixin.qq.com/s/YAAybJBAvxqrQWYDg31BBw - webarchive
- https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf - webarchive
- https://blog.cyble.com/2022/06/29/bahamut-android-malware-returns-with-new-spying-capabilities/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/the-urpage-connection-to-bahamut-confucius-and-patchwork/ - webarchive
- https://www.welivesecurity.com/2022/11/23/bahamut-cybermercenary-group-targets-android-users-fake-vpn-apps/ - webarchive
- https://www.bellingcat.com/resources/case-studies/2017/10/27/bahamut-revisited-cyber-espionage-middle-east-south-asia/ - webarchive
- https://www.bellingcat.com/news/mena/2017/06/12/bahamut-pursuing-cyber-espionage-actor-middle-east/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Basbanke
Internal MISP references
UUID c59b65d6-d363-4b19-b082-d72508e782c0 which can be used as unique global reference for Basbanke in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.basbanke - webarchive
- https://securelist.com/basbanke-trend-setting-brazilian-banking-trojan/90365/ - webarchive
- https://seguranca-informatica.pt/hackers-are-again-attacking-portuguese-banking-organizations-via-android-trojan-banker/#.YHTDZS2tEUE - webarchive
- https://twitter.com/LukasStefanko/status/1280243673100402690 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BianLian (Android)
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BianLian (Android).
| Known Synonyms |
|---|
Hydra |
Internal MISP references
UUID 1faaa5c5-ab4e-4101-b2d9-0e12207d70fc which can be used as unique global reference for BianLian (Android) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.bianlian - webarchive
- https://cryptax.medium.com/android-bianlian-payload-61febabed00a - webarchive
- https://cryptax.medium.com/quick-look-into-a-new-sample-of-android-bianlian-bc5619efa726 - webarchive
- https://www.youtube.com/watch?v=DPFcvSy4OZk - webarchive
- https://cryptax.medium.com/bianlian-c-c-domain-name-4f226a29e221 - webarchive
- https://cryptax.medium.com/creating-a-safe-dummy-c-c-to-test-android-bots-ffa6e7a3dce5 - webarchive
- https://www.threatfabric.com/blogs/bianlian_from_rags_to_riches_the_malware_dropper_that_had_a_dream.html - webarchive
- https://cryptax.medium.com/bad-zip-and-new-packer-for-android-bianlian-5bdad4b90aeb - webarchive
- https://www.fortinet.com/blog/threat-research/new-wave-bianlian-malware.html - webarchive
- https://cryptax.medium.com/multidex-trick-to-unpack-android-bianlian-ed52eb791e56 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BrasDex
According to PCrisk, BraDex is a banking malware targeting Android operating systems. This malicious program aims to gain access to victims' bank accounts and make fraudulent transactions.
At the time of writing, BrasDex targets Brazilian banking applications exclusively. In previous BrasDex campaigns, it infiltrated devices under the guise of Android system related apps. Lately, this malware has been installed by a fake Brazilian Banco Santander banking application.
Internal MISP references
UUID dc5408e9-e9e8-44fd-ac5c-231483d0ebe3 which can be used as unique global reference for BrasDex in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BRATA
According to Cleafy, the victim's Android device is factory reset after the attackers siphon money from the victim's bank account. This distracts users from the crime, while removing traces or footprints that might be of interest to forensic analysts.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BRATA.
| Known Synonyms |
|---|
AmexTroll |
Internal MISP references
UUID d9ff080d-cde0-48da-89db-53435c99446b which can be used as unique global reference for BRATA in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.brata - webarchive
- https://www.cleafy.com/cleafy-labs/brata-is-evolving-into-an-advanced-persistent-threat - webarchive
- https://www.threatfabric.com/blogs/brata-a-tale-of-three-families.html - webarchive
- https://www.cleafy.com/cleafy-labs/how-brata-is-monitoring-your-bank-account - webarchive
- https://securelist.com/spying-android-rat-from-brazil-brata/92775/ - webarchive
- https://www.advintel.io/post/economic-growth-digital-inclusion-specialized-crime-financial-cyber-fraud-in-latam - webarchive
- https://www.cleafy.com/cleafy-labs/mobile-banking-fraud-brata-strikes-again - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Brunhilda
PRODAFT describes Brunhilda as a "Dropper as a Service" for Google Play, delivering e.g. Alien.
Internal MISP references
UUID 5d3d5f52-0a55-4c81-af87-7809ce43906b which can be used as unique global reference for Brunhilda in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.brunhilda - webarchive
- https://www.cleafy.com/cleafy-labs/the-android-malwares-journey-from-google-play-to-banking-fraud - webarchive
- https://www.prodaft.com/m/reports/BrunHilda_DaaS.pdf - webarchive
- https://www.threatfabric.com/blogs/the-attack-of-the-droppers.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BusyGasper
Internal MISP references
UUID 4bf68bf8-08e5-46f3-ade5-0bd4f124b168 which can be used as unique global reference for BusyGasper in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CapraRAT
According to PCrisk, CapraRAT is the name of an Android remote access trojan (RAT), possibly a modified version of another (open-source) RAT called AndroRAT. It is known that CapraRAT is used by an advanced persistent threat group (ATP) called APT36 (also known as Earth Karkaddan). CapraRAT allows attackers to perform certain actions on the infected Android device.
Internal MISP references
UUID 7cd1c5f3-7635-46d2-87f1-e638fb8d714c which can be used as unique global reference for CapraRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.capra_rat - webarchive
- https://www.welivesecurity.com/2023/03/07/love-scam-espionage-transparent-tribe-lures-indian-pakistani-officials/ - webarchive
- https://www.sentinelone.com/labs/capratube-transparent-tribes-caprarat-mimics-youtube-to-hijack-android-phones/ - webarchive
- https://www.trendmicro.com/en_us/research/22/a/investigating-apt36-or-earth-karkaddans-attack-chain-and-malware.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CarbonSteal
Internal MISP references
UUID 56090c0b-2b9b-4624-8eff-ef6d3632fd2b which can be used as unique global reference for CarbonSteal in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Catelites
Catelites Bot (identified by Avast and SfyLabs in December 2017) is an Android trojan, with ties to CronBot. Once the malicious app is installed, attackers use social engineering tricks and window overlays to get credit card details from the victim. The distribution vector seems to be fake apps from third-party app stores (not Google Play) or via malvertisement. After installation and activation, the app creates fake Gmail, Google Play and Chrome icons. Furthermore, the malware sends a fake system notification, telling the victim that they need to re-authenticate with Google Services and ask for their credit card details to be entered. Currently the malware has overlays for over 2,200 apps of banks and financial institutions.
Internal MISP references
UUID 2c672b27-bc65-48ba-ba3d-6318473e78b6 which can be used as unique global reference for Catelites in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cerberus
According to PCrisk, Cerberus is an Android banking Trojan which can be rented on hacker forums. It was been created in 2019 and is used to steal sensitive, confidential information. Cerberus can also be used to send commands to users' devices and perform dangerous actions.
Internal MISP references
UUID c3a2448f-bb41-4201-b524-3ddcb02ddbf4 which can be used as unique global reference for Cerberus in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.cerberus - webarchive
- https://www.threatfabric.com/blogs/cerberus-a-new-banking-trojan-from-the-underworld.html - webarchive
- https://labs.bitdefender.com/2020/09/apps-on-google-play-tainted-with-cerberus-banker-malware/ - webarchive
- https://twitter.com/AndroidCerberus - webarchive
- https://bushidotoken.blogspot.com/2020/05/turkey-targeted-by-cerberus-and-anubis.html - webarchive
- https://community.riskiq.com/article/85b3db8c - webarchive
- https://www.threatfabric.com/blogs/alien_the_story_of_cerberus_demise.html - webarchive
- https://www.forbes.com/sites/zakdoffman/2019/08/16/dangerous-new-android-trojan-hides-from-malware-researchers-and-taunts-them-on-twitter/ - webarchive
- https://resecurity.com/blog/article/in-the-box-mobile-malware-webinjects-marketplace - webarchive
- https://www.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revealing-threat-in-the-shadow-by-chi-en-shen-ashley-oleg-bondarenko - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2020-1016.pdf - webarchive
- https://securelist.com/the-state-of-stalkerware-in-2021/106193/ - webarchive
- https://blog.cyberint.com/cerberus-is-dead-long-live-cerberus - webarchive
- https://www.biznet.com.tr/wp-content/uploads/2020/08/Cerberus.pdf - webarchive
- https://nur.pub/cerberus-analysis - webarchive
- https://preyproject.com/blog/en/cerberus-and-alien-the-malware-that-has-put-android-in-a-tight-spot/ - webarchive
- https://github.com/ics-iot-bootcamp/cerberus_research - webarchive
- https://insights.oem.avira.com/in-depth-analysis-of-a-cerberus-trojan-variant/ - webarchive
- https://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/04/12075509/EN_The-State-of-Stalkerware-2021.pdf - webarchive
- https://www.threatfabric.com/blogs/2020_year_of_the_rat.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chameleon
The malware chamaleon is an Android trojan that pretends to be legitimate entities to steal data from users in Australia and Poland. It exploits the Accessibility Service to monitor and modify the device screen.
Internal MISP references
UUID 90b3a256-311d-416b-b333-e02b910ba75d which can be used as unique global reference for Chameleon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chamois
Internal MISP references
UUID 2e230ff8-3971-4168-a966-176316cbdbf2 which can be used as unique global reference for Chamois in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.chamois - webarchive
- https://android-developers.googleblog.com/2017/03/detecting-and-eliminating-chamois-fraud.html - webarchive
- https://github.com/maddiestone/ConPresentations/blob/master/KasperskySAS2019.Chamois.pdf - webarchive
- https://www.virusbulletin.com/virusbulletin/2019/01/vb2018-paper-unpacking-packed-unpacker-reversing-android-anti-analysis-native-library/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Charger
Internal MISP references
UUID 6e0545df-8df6-4990-971c-e96c4c60d561 which can be used as unique global reference for Charger in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.charger - webarchive
- http://blog.checkpoint.com/2017/01/24/charger-malware/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2019/02/ESET_Android_Banking_Malware.pdf - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-recap-january-14-29-2017 - webarchive
- http://blog.joesecurity.org/2017/01/deep-analysis-of-android-ransom-charger.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chinotto (Android)
Internal MISP references
UUID 6cc7b402-21cf-4510-be7d-d7f811a57bc1 which can be used as unique global reference for Chinotto (Android) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chrysaor
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Chrysaor.
| Known Synonyms |
|---|
JigglyPuff |
Pegasus |
Internal MISP references
UUID 52acea22-7d88-433c-99e6-8fef1657e3ad which can be used as unique global reference for Chrysaor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.chrysaor - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://cybergeeks.tech/a-technical-analysis-of-pegasus-for-android-part-1 - webarchive
- https://thewire.in/rights/sar-geelani-pegasus-spyware-phone-messages - webarchive
- https://www.theguardian.com/news/2021/jul/18/revealed-murdered-journalist-number-selected-mexico-nso-client-cecilio-pineda-birto - webarchive
- https://forbiddenstories.org/pegasus-the-new-global-weapon-for-silencing-journalists/ - webarchive
- https://forbiddenstories.org/the-pegasus-project-a-worldwide-collaboration-to-counter-a-global-crime/ - webarchive
- https://citizenlab.ca/2020/01/stopping-the-press-new-york-times-journalist-targeted-by-saudi-linked-pegasus-spyware-operator/ - webarchive
- https://citizenlab.ca/2022/04/catalangate-extensive-mercenary-spyware-operation-against-catalans-using-pegasus-candiru/ - webarchive
- https://twitter.com/alexanderjaeger/status/1417447732030189569 - webarchive
- https://nex.sx/blog/2021/08/03/the-pegasus-project.html - webarchive
- https://www.washingtonpost.com/technology/2021/07/18/reactions-pegasus-project-nso/ - webarchive
- https://unit42.paloaltonetworks.com/strategically-aged-domain-detection/ - webarchive
- https://www.theguardian.com/news/2021/jul/18/viktor-orban-using-nso-spyware-in-assault-on-media-data-suggests - webarchive
- https://www.theguardian.com/world/2021/jul/18/nso-spyware-used-to-target-family-of-jamal-khashoggi-leaked-data-shows-saudis-pegasus - webarchive
- https://github.com/AmnestyTech/investigations/tree/master/2021-07-18_nso - webarchive
- https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/ - webarchive
- https://therecord.media/mexican-army-spyware - webarchive
- https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/ - webarchive
- https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html - webarchive
- https://www.theguardian.com/world/2021/jul/18/revealed-leak-uncovers-global-abuse-of-cyber-surveillance-weapon-nso-group-pegasus - webarchive
- https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/ - webarchive
- https://arkadiyt.com/2021/07/25/scanning-your-iphone-for-nso-group-pegasus-malware/ - webarchive
- https://citizenlab.ca/2021/11/palestinian-human-rights-defenders-hacked-nso-groups-pegasus-spyware/ - webarchive
- https://www.washingtonpost.com/world/2021/07/19/india-nso-pegasus/ - webarchive
- https://thewire.in/government/project-pegasus-journalists-ministers-activists-phones-spying - webarchive
- https://www.bleepingcomputer.com/news/security/iphones-running-latest-ios-hacked-to-deploy-nso-group-spyware/ - webarchive
- https://media.ccc.de/v/33c3-7901-pegasus_internals - webarchive
- https://www.vice.com/en/article/xgx5bw/amazon-aws-shuts-down-nso-group-infrastructure - webarchive
- https://citizenlab.ca/2021/07/amnesty-peer-review/ - webarchive
- https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-android-technical-analysis.pdf - webarchive
- https://zetter.substack.com/p/pegasus-spyware-how-it-works-and - webarchive
- https://www.washingtonpost.com/investigations/interactive/2021/jamal-khashoggi-wife-fiancee-cellphone-hack/?itid=co_pegasus_5 - webarchive
- https://threatpost.com/nso-pegasus-spyware-bans-apple-accountability/167965/ - webarchive
- https://www.cyjax.com/2021/10/26/mercenary-apts-an-exploration/ - webarchive
- https://www.lemonde.fr/projet-pegasus/article/2021/07/18/au-maroc-comme-en-france-des-journalistes-mis-sous-surveillance-avec-le-logiciel-pegasus_6088654_6088648.html - webarchive
- https://irpimedia.irpi.eu/sorveglianze-cy4gate/ - webarchive
- https://security.googleblog.com/2017/04/an-investigation-of-chrysaor-malware-on.html - webarchive
- https://cybergeeks.tech/a-technical-analysis-of-pegasus-for-android-part-3/ - webarchive
- https://thewire.in/tag/pegasus-project - webarchive
- https://www.trendmicro.com/en_us/research/21/i/analyzing-pegasus-spywares-zero-click-iphone-exploit-forcedentry.html - webarchive
- https://cybergeeks.tech/a-technical-analysis-of-pegasus-for-android-part-2/ - webarchive
- https://www.cybertrends.it/pegasus-lo-spyware-per-smartphone-come-funziona-e-come-ci-si-puo-proteggere/ - webarchive
- https://www.washingtonpost.com/technology/2021/07/19/apple-iphone-nso/ - webarchive
- https://citizenlab.ca/2018/09/hide-and-seek-tracking-nso-groups-pegasus-spyware-to-operations-in-45-countries/ - webarchive
- https://objective-see.com/blog/blog_0x67.html - webarchive
- https://citizenlab.ca/2022/04/peace-through-pegasus-jordanian-human-rights-defenders-and-journalists-hacked-with-pegasus-spyware/ - webarchive
- https://forbiddenstories.org/about-the-pegasus-project/ - webarchive
- https://lifars.com/2022/01/forensics-analysis-of-the-nso-groups-pegasus-spyware/ - webarchive
- https://www.washingtonpost.com/investigations/2021/07/18/takeaways-nso-pegasus-project/ - webarchive
- https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html - webarchive
- https://www.bleepingcomputer.com/news/security/google-predator-spyware-infected-android-devices-using-zero-days/ - webarchive
- https://citizenlab.ca/2021/10/breaking-news-new-york-times-journalist-ben-hubbard-pegasus/ - webarchive
- https://www.theguardian.com/news/series/pegasus-project - webarchive
- https://thewire.in/government/indian-army-bsf-raw-pegasus-spyware-threat - webarchive
- https://www.reuters.com/technology/how-saudi-womans-iphone-revealed-hacking-around-world-2022-02-17/ - webarchive
- https://twitter.com/billmarczak/status/1416801439402262529 - webarchive
- https://blog.zecops.com/research/the-recent-ios-0-click-cve-2021-30860-sounds-familiar-an-unreleased-write-up-one-year-later/ - webarchive
- https://twitter.com/HackSysTeam/status/1418223814387765258?s=20 - webarchive
- https://android-developers.googleblog.com/2017/04/an-investigation-of-chrysaor-malware-on.html - webarchive
- https://www.washingtonpost.com/investigations/interactive/2021/nso-spyware-pegasus-cellphones/ - webarchive
- https://citizenlab.ca/2021/08/bahrain-hacks-activists-with-nso-group-zero-click-iphone-exploits/ - webarchive
- https://thewire.in/media/pegasus-project-spyware-indian-journalists - webarchive
- https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-appendix-d/ - webarchive
- https://www.amnesty.org/en/latest/news/2021/07/the-pegasus-project/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Clientor
Internal MISP references
UUID c0a48ca3-682d-45bc-805c-e62aecd4c724 which can be used as unique global reference for Clientor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Clipper
Internal MISP references
UUID ff9b47c6-a5b5-4531-abfc-2e4db3dcdc7e which can be used as unique global reference for Clipper in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.clipper - webarchive
- https://lukasstefanko.com/2019/02/android-clipper-found-on-google-play.html - webarchive
- https://news.drweb.com/show?lng=en&i=12739 - webarchive
- https://www.welivesecurity.com/2019/02/08/first-clipper-malware-google-play/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CloudAtlas
Internal MISP references
UUID ed780667-b67c-4e17-ab43-db1b7e018e66 which can be used as unique global reference for CloudAtlas in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CometBot
Internal MISP references
UUID 151bf399-aa8f-4160-b9b5-8fe222f2a6b1 which can be used as unique global reference for CometBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Connic
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Connic.
| Known Synonyms |
|---|
SpyBanker |
Internal MISP references
UUID 93b1c63a-4a34-44fd-805b-0a3470ff7e6a which can be used as unique global reference for Connic in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Coper
Coper is a descendant of ExoBotCompat, which was a rewritten version of Exobot. Malicious Coper apps have a modular architecture and a multi-stage infection mechanism. Coper has originally been spotted in Colombia but has since emerged in Europa as well.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Coper.
| Known Synonyms |
|---|
ExobotCompact |
Octo |
Internal MISP references
UUID 70973ef7-e031-468f-9420-d8aa4eb7543a which can be used as unique global reference for Coper in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.coper - webarchive
- https://news.drweb.com/show/?p=0&lng=en&i=14259&c=0 - webarchive
- https://cert-agid.gov.it/news/analisi-e-approfondimenti-tecnici-sul-malware-coper-utilizzato-per-attaccare-dispositivi-mobili/ - webarchive
- https://labs.k7computing.com/index.php/play-store-app-serves-coper-via-github/ - webarchive
- https://cert.pl/posts/2021/12/aktywacja-aplikacji-iko/ - webarchive
- https://threatfabric.com/blogs/octo-new-odf-banking-trojan.html - webarchive
- https://resecurity.com/blog/article/in-the-box-mobile-malware-webinjects-marketplace - webarchive
- https://thehackernews.com/2022/04/new-octo-banking-trojan-spreading-via.html - webarchive
- https://www.bleepingcomputer.com/news/security/new-android-banking-malware-remotely-takes-control-of-your-device/ - webarchive
- https://blog.cyble.com/2022/03/24/coper-banking-trojan/ - webarchive
- https://www.trendmicro.com/en_us/research/22/g/examining-new-dawdropper-banking-dropper-and-daas-on-the-dark-we.html - webarchive
- https://twitter.com/icebre4ker/status/1541875982684094465 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Coronavirus Android Worm
Poses as an app that can offer a "corona safety mask" but phone's address book and sends sms to contacts, spreading its own download link.
Internal MISP references
UUID f041032e-01af-4e66-9fb2-f8da88a6ea35 which can be used as unique global reference for Coronavirus Android Worm in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.corona_worm - webarchive
- https://www.zscaler.com/blogs/research/new-android-app-offers-coronavirus-safety-mask-delivers-sms-trojan - webarchive
- https://dissectingmalwa.re/jamba-superdeal-helo-sir-you-want-to-buy-mask-corona-safety-mask-sms-scam.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cpuminer (Android)
Internal MISP references
UUID 8a42a699-1746-498b-a558-e7113bb916c0 which can be used as unique global reference for Cpuminer (Android) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryCryptor
According to NHS Digital, CryCryptor is distributed via websites that spoof health organisations. At the time of publication these websites have affected the Canadian health service. CryCryptor cannot be obtained from the Google Play store, so devices restricted to only running apps from the store are not affected.
When CryCryptor is run it encrypts common file types and saves a ransom note to every directory where files have been encrypted. Encrypted files have the extension '.enc' appended to the filenames. Additional files are saved containing the salt values used in each encryption and an initialisation vector. These files have the extensions '.enc.salt' and '.enc.iv' respectively.
When files have been encrypted, a notification is displayed directing users to open the ransom note.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CryCryptor.
| Known Synonyms |
|---|
CryCrypter |
CryDroid |
Internal MISP references
UUID 21e9d7e6-6e8c-49e4-8869-6bac249cda8a which can be used as unique global reference for CryCryptor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CyberAzov
Internal MISP references
UUID bb1821f9-eace-4e63-b55d-fc7821a6e5f1 which can be used as unique global reference for CyberAzov in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.cyber_azov - webarchive
- https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag - webarchive
- https://twitter.com/sekoia_io/status/1554086468104196096 - webarchive
- https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DAAM
According to PCrisk, DAAM is an Android malware utilized to gain unauthorized access to targeted devices since 2021. With the DAAM Android botnet, threat actors can bind harmful code with a genuine application using its APK binding service.
Lookout refers to this malware as BouldSpy and assesses with medium confidence that this Android surveillance tool is used by the Law Enforcement Command of the Islamic Republic of Iran (FARAJA).
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DAAM.
| Known Synonyms |
|---|
BouldSpy |
Internal MISP references
UUID 37a3b62e-99da-47d7-81fb-78f745427b16 which can be used as unique global reference for DAAM in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dark Shades
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Dark Shades.
| Known Synonyms |
|---|
Rogue |
Internal MISP references
UUID 97fe35c9-f50c-495f-8736-0ecd95c70192 which can be used as unique global reference for Dark Shades in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DawDropper
Internal MISP references
UUID bd9756da-220d-48d6-a4f5-6646558c4b30 which can be used as unique global reference for DawDropper in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DEFENSOR ID
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DEFENSOR ID.
| Known Synonyms |
|---|
Defensor Digital |
Internal MISP references
UUID 76346e4d-d14e-467b-9409-82b28a4d6cd6 which can be used as unique global reference for DEFENSOR ID in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.defensor_id - webarchive
- https://www.welivesecurity.com/2020/05/22/insidious-android-malware-gives-up-all-malicious-features-but-one-gain-stealth/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dendroid
Internal MISP references
UUID 89989df2-e8bc-4074-a8a2-130a15d6625f which can be used as unique global reference for Dendroid in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.dendroid - webarchive
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=a29d7d7a-f150-46cf-9bb9-a1f9f4d32a80&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
dmsSpy
Internal MISP references
UUID 72a25832-4bf4-4505-a77d-8c0fc52dc85d which can be used as unique global reference for dmsSpy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.dmsspy - webarchive
- https://documents.trendmicro.com/assets/Tech-Brief-Operation-Poisoned-News-Hong-Kong-Users-Targeted-with-Mobile-Malware-via-Local-News-Links.pdf - webarchive
- https://securelist.com/ios-exploit-chain-deploys-lightspy-malware/96407/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/operation-poisoned-news-hong-kong-users-targeted-with-mobile-malware-via-local-news-links/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DoubleAgent
Internal MISP references
UUID 73fd1bda-e4aa-4777-a628-07580bc070f4 which can be used as unique global reference for DoubleAgent in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DoubleLocker
Internal MISP references
UUID 10d0115a-00b4-414e-972b-8320a2bb873c which can be used as unique global reference for DoubleLocker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dracarys
Android malware that impersonates genuine applications such as Signal, Telegram, WhatsApp, YouTube, and other chat applications and distributes through phishing sites.
Internal MISP references
UUID bf94eee6-2274-40f4-b181-2b49ce6ef9fb which can be used as unique global reference for Dracarys in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DragonEgg
Android variant of ios.LightSpy.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DragonEgg.
| Known Synonyms |
|---|
LightSpy |
Internal MISP references
UUID 4ef28f14-17f4-4f87-a292-e63b42027c8c which can be used as unique global reference for DragonEgg in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DroidJack
Internal MISP references
UUID 8990cec7-ddd8-435e-97d6-5b36778e86fe which can be used as unique global reference for DroidJack in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DroidWatcher
Internal MISP references
UUID 15f3e50b-9fa5-4eab-ac2b-928e9ce03b72 which can be used as unique global reference for DroidWatcher in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DualToy (Android)
Internal MISP references
UUID 8269e779-db23-4c94-aafb-36ee94879417 which can be used as unique global reference for DualToy (Android) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dvmap
Internal MISP references
UUID e5de818e-d25d-47a8-ab31-55fc992bf91b which can be used as unique global reference for Dvmap in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Elibomi
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Elibomi.
| Known Synonyms |
|---|
Drinik |
Internal MISP references
UUID 63cc0b01-c92e-40e7-8669-48d10a490ffb which can be used as unique global reference for Elibomi in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.elibomi - webarchive
- https://www.trendmicro.com/en_vn/research/22/k/massive-phishing-campaigns-target-india-banks-clients.html#:~:text=We%20found%20five%20banking%20malware,card%20information%20via%20phishing%20campaigns.&text=We%20observed%20an%20uptick%20in,message%20with%20a%20phishing%20link. - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/phishing-android-malware-targets-taxpayers-in-india/ - webarchive
- https://blog.cyble.com/2021/09/07/fake-income-tax-application-targets-indian-taxpayers/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ERMAC
According to Intel471, ERMAC, an Android banking trojan enables bad actors to determine when certain apps are launched and then overwrites the screen display to steal the user's credentials
Internal MISP references
UUID 602944f4-a86c-4a05-b98f-cfb525fb8896 which can be used as unique global reference for ERMAC in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.ermac - webarchive
- https://intel471.com/blog/rmac-2-0-perfecting-the-art-of-account-takeover - webarchive
- https://blog.cyble.com/2022/05/25/ermac-back-in-action/ - webarchive
- https://twitter.com/ESETresearch/status/1445618031464357888 - webarchive
- https://twitter.com/ShilpeshTrivedi/status/1709096404835356883 - webarchive
- https://www.threatfabric.com/blogs/zombinder-ermac-and-desktop-stealers.html - webarchive
- https://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html - webarchive
- https://research.nccgroup.com/2023/09/11/from-ermac-to-hook-investigating-the-technical-differences-between-two-android-malware-variants/ - webarchive
- https://resecurity.com/blog/article/in-the-box-mobile-malware-webinjects-marketplace - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Eventbot
According to ThreatFabric, the app overlays 15 financial targets from UK, Italy, and Spain, sniffs 234 apps from banks located in Europe as well as crypto wallets.
Internal MISP references
UUID 5a6fb8cd-d582-4c8c-b7e0-a5b4cf4f248f which can be used as unique global reference for Eventbot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ExoBot
Internal MISP references
UUID c9f2b058-6c22-462a-a20a-fca933a597dd which can be used as unique global reference for ExoBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.exobot - webarchive
- https://www.bleepingcomputer.com/news/security/source-code-for-exobot-android-banking-trojan-leaked-online/ - webarchive
- https://securityintelligence.com/ibm-x-force-delves-into-exobots-leaked-source-code/ - webarchive
- https://www.bleepingcomputer.com/news/security/exobot-author-calls-it-quits-and-sells-off-banking-trojan-source-code/ - webarchive
- https://threatfabric.com/blogs/octo-new-odf-banking-trojan.html - webarchive
- https://www.bleepingcomputer.com/news/security/new-android-banking-malware-remotely-takes-control-of-your-device/ - webarchive
- https://blog.cyble.com/2022/03/24/coper-banking-trojan/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-exo-android-trojan-sold-on-hacking-forums-dark-web/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Exodus
Internal MISP references
UUID 462bc006-b7bd-4e10-afdb-52baf86121e8 which can be used as unique global reference for Exodus in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.exodus - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://securitywithoutborders.org/blog/2019/03/29/exodus.html - webarchive
- https://motherboard.vice.com/en_us/article/eveeq4/prosecutors-investigation-esurv-exodus-malware-on-google-play-store - webarchive
- https://motherboard.vice.com/en_us/article/43z93g/hackers-hid-android-malware-in-google-play-store-exodus-esurv - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FaceStealer
Facebook Credential Stealer.
Internal MISP references
UUID c35ebd96-d2f8-4add-b86f-f552ed5dfa9b which can be used as unique global reference for FaceStealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.facestealer - webarchive
- https://labs.k7computing.com/index.php/facestealer-the-rise-of-facebook-credential-stealer-malware/ - webarchive
- https://www.trendmicro.com/en_us/research/22/e/fake-mobile-apps-steal-facebook-credentials--crypto-related-keys.html - webarchive
- https://threatpost.com/facestealer-trojan-google-play-facebook/179015/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FakeAdBlocker
Internal MISP references
UUID d0ae2b6b-5137-4b64-be3e-4bbc9aa007a6 which can be used as unique global reference for FakeAdBlocker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Fakecalls
According to Kaspersky, Fakecalls is a Trojan that masquerades as a banking app and imitates phone conversations with bank employees.
Internal MISP references
UUID 014aeab6-2292-4ee5-83d6-fffb0fc21423 which can be used as unique global reference for Fakecalls in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FakeSpy
Internal MISP references
UUID dd821edd-901b-4a5e-b35f-35bb811964ab which can be used as unique global reference for FakeSpy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.fakespy - webarchive
- https://www.trendmicro.com/en_us/research/18/k/a-look-into-the-connection-between-xloader-and-fakespy-and-their-possible-ties-with-the-yanbian-gang.html - webarchive
- https://www.trendmicro.com/en_us/research/18/f/fakespy-android-information-stealing-malware-targets-japanese-and-korean-speaking-users.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/a-look-into-the-connection-between-xloader-and-fakespy-and-their-possible-ties-with-the-yanbian-gang/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/fakespy-android-information-stealing-malware-targets-japanese-and-korean-speaking-users/ - webarchive
- https://medium.com/csis-techblog/the-roamingmantis-groups-expansion-to-european-apple-accounts-and-android-devices-e6381723c681 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FakeGram
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FakeGram.
| Known Synonyms |
|---|
FakeTGram |
Internal MISP references
UUID 6c0fc7e4-4629-494f-b471-f7a8cc47c0e0 which can be used as unique global reference for FakeGram in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FastFire
Internal MISP references
UUID 5613da3a-06f5-4363-b468-0b8a03ffc292 which can be used as unique global reference for FastFire in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FastSpy
Internal MISP references
UUID a5e3e217-3790-4d7c-b67a-906b9ee69034 which can be used as unique global reference for FastSpy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FileCoder
According to heimdal, A new strain of ransomware emerged on Android mobile devices. It targets those who are running the operating system Android 5.1 and higher. This Android ransomware strain has been dubbed by security researchers FileCoder (Android/Filecoder.c) and it spreads via text messages containing a malicious link.
Internal MISP references
UUID 09ff3520-b643-44bd-a0de-90c0e75ba12f which can be used as unique global reference for FileCoder in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FinFisher (Android)
Internal MISP references
UUID 0bf7acd4-6493-4126-9598-d2ed069e32eb which can be used as unique global reference for FinFisher (Android) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.finfisher - webarchive
- https://netzpolitik.org/2020/our-criminal-complaint-german-state-malware-company-finfisher-raided/ - webarchive
- https://securelist.com/new-finspy-ios-and-android-implants-revealed-itw/91685/ - webarchive
- https://securelist.com/finspy-unseen-findings/104322/ - webarchive
- https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/ - webarchive
- https://raw.githubusercontent.com/DefensiveLabAgency/FinSpy-for-Android/master/20200806_finspy_android_analysis_public_release.pdf - webarchive
- https://github.com/linuzifer/FinSpy-Dokumentation - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FlexiSpy (Android)
Internal MISP references
UUID 4305d59a-0d07-4021-a902-e7996378898b which can be used as unique global reference for FlexiSpy (Android) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FlexNet
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FlexNet.
| Known Synonyms |
|---|
gugi |
Internal MISP references
UUID 80d7d229-b3a7-4205-8304-f7b18bda129f which can be used as unique global reference for FlexNet in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FluBot
PRODAFT describes FluBot as a banking malware which originally targeted Spain. Since the first quarter of 2021 it has been targeting many other European countries as well as Japan. It uses a DGA for it's C&C and relies on both DNS and DNS-over-HTTPS for name resolution. Despite arrests of multiple people suspected of involvement with this malware in March of 2021, the campaign has only intensified since.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FluBot.
| Known Synonyms |
|---|
Cabassous |
FakeChat |
Internal MISP references
UUID ef91833f-3334-4955-9218-f106494e9fc0 which can be used as unique global reference for FluBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.flubot - webarchive
- https://www.ncsc.admin.ch/22w12-de - webarchive
- https://news.netcraft.com/archives/2021/08/04/flubot-malware-spreads-to-australia.html - webarchive
- https://www.checkpoint.com/press/2022/march-2022s-most-wanted-malware-easter-phishing-scams-help-emotet-assert-its-dominance/ - webarchive
- https://blog.fox-it.com/2022/06/29/flubot-the-evolution-of-a-notorious-android-banking-malware/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://therecord.media/despite-arrests-in-spain-flubot-operations-explode-across-europe-and-japan/ - webarchive
- https://www.nortonlifelock.com/blogs/research-group/flubot-targets-android-phone-users - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/flubot-android-malware-spreading-rapidly-through-europe-may-hit-us-soon - webarchive
- https://news.netcraft.com/archives/2021/08/17/resurgent-flubot-malware-targets-german-and-polish-banks.html - webarchive
- https://twitter.com/alberto__segura/status/1402615237296148483 - webarchive
- https://mobile.twitter.com/alberto__segura/status/1400396365759500289 - webarchive
- https://twitter.com/alberto__segura/status/1404098461440659459 - webarchive
- https://twitter.com/alberto__segura/status/1395675479194095618 - webarchive
- https://therecord.media/flubot-malware-gang-arrested-in-barcelona/ - webarchive
- https://labs.bitdefender.com/2021/06/threat-actors-use-mockups-of-popular-apps-to-spread-teabot-and-flubot-malware-on-android/ - webarchive
- https://twitter.com/alberto__segura/status/1399249798063087621?s=20 - webarchive
- https://www.bitdefender.com/blog/labs/new-flubot-and-teabot-global-malware-campaigns-discovered - webarchive
- https://www.f5.com/labs/articles/threat-intelligence/flubots-authors-employ-creative-and-sophisticated-techniques-to-achieve-their-goals-in-version-50-and-beyond - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://raw.githubusercontent.com/prodaft/malware-ioc/master/FluBot/FluBot.pdf - webarchive
- https://thehackernews.com/2022/01/widespread-flubot-and-teabot-malware.html - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://www.infinitumit.com.tr/flubot-zararlisi/ - webarchive
- https://securityintelligence.com/posts/story-of-fakechat-malware/ - webarchive
- https://cryptax.medium.com/android-flubot-preparing-for-a-new-campaign-2f7563fc6c06 - webarchive
- https://twitter.com/alberto__segura/status/1384840011892285440 - webarchive
- https://blog.cyble.com/2021/09/09/flubot-variant-masquerading-as-the-default-android-voicemail-app/ - webarchive
- https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9 - webarchive
- https://twitter.com/malwrhunterteam/status/1359939300238983172 - webarchive
- https://www.threatfabric.com/blogs/partners-in-crime-medusa-cabassous.html - webarchive
- https://securityblog.switch.ch/2021/06/19/android-flubot-enters-switzerland/ - webarchive
- https://hispasec.com/resources/FedexBanker.pdf - webarchive
- https://www.prodaft.com/m/reports/FluBot_4.pdf - webarchive
- https://www.bitsight.com/blog/flubot-malware-persists-most-prevalent-germany-and-spain - webarchive
- https://www.telekom.com/en/blog/group/article/flubot-under-the-microscope-636368 - webarchive
- https://medium.com/csis-techblog/the-brief-glory-of-cabassous-flubot-a-private-android-banking-botnet-bc2ed7917027 - webarchive
- https://www.cert.govt.nz/individuals/news-and-events/parcel-delivery-text-message-infecting-android-phones/ - webarchive
- https://blog.zimperium.com/flubot-vs-zimperium/ - webarchive
- https://blog.nviso.eu/2021/04/19/how-to-analyze-mobile-malware-a-cabassous-flubot-case-study/ - webarchive
- https://www.europol.europa.eu/media-press/newsroom/news/takedown-of-sms-based-flubot-spyware-infecting-android-phones - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FluHorse
According to Check Point, this malware features several malicious Android applications that mimic legitimate applications, most of which have more than 1,000,000 installs. These malicious apps steal the victims’ credentials and Two-Factor Authentication (2FA) codes. FluHorse targets different sectors of Eastern Asian markets and is distributed via emails. In some cases, the emails used in the first stage of the attacks belong to high-profile entities. The malware can remain undetected for months making it a persistent, dangerous, and hard-to-spot threat.
Internal MISP references
UUID aeaeb8b2-650e-471d-a901-3c4fbae42854 which can be used as unique global reference for FluHorse in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.fluhorse - webarchive
- https://www.fortinet.com/blog/threat-research/fortinet-reverses-flutter-based-android-malware-fluhorse - webarchive
- https://research.checkpoint.com/2023/eastern-asian-android-assault-fluhorse/ - webarchive
- https://cryptax.medium.com/inside-kangapack-the-kangaroo-packer-with-native-decryption-3e7e054679c4 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FlyTrap
Zimperium notes that this malware has hit more than 10,000 victims in 140+ countries using social media hijacking, 3rd party app stores and sideloading.
Internal MISP references
UUID 24af5bcc-d4bd-42dd-aed4-f994b30b4921 which can be used as unique global reference for FlyTrap in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FunkyBot
Internal MISP references
UUID bc0d37fa-113a-45ba-8a1c-b9d818e31f27 which can be used as unique global reference for FunkyBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.funkybot - webarchive
- https://securelist.com/roaming-mantis-part-v/96250/ - webarchive
- https://www.fortinet.com/blog/threat-research/funkybot-malware-targets-japan.html - webarchive
- https://medium.com/csis-techblog/the-roamingmantis-groups-expansion-to-european-apple-accounts-and-android-devices-e6381723c681 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FurBall
According to Check Point, they uncovered an operation dubbed "Domestic Kitten", which uses malicious Android applications to steal sensitive personal information from its victims: screenshots, messages, call logs, surrounding voice recordings, and more. This operation managed to remain under the radar for a long time, as the associated files were not attributed to a known malware family and were only detected by a handful of security vendors.
Internal MISP references
UUID 53282cc8-fefc-47d7-b6a5-a82a05a88f2a which can be used as unique global reference for FurBall in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.furball - webarchive
- https://ti.qianxin.com/blog/articles/surprised-by-cyrus-the-great-disclosure-against-Iran-cyrus-attack/ - webarchive
- https://www.virusbulletin.com/conference/vb2019/abstracts/domestic-kitten-iranian-surveillance-program - webarchive
- https://www.trendmicro.com/en_us/research/19/f/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east.html - webarchive
- https://research.checkpoint.com/2021/domestic-kitten-an-inside-look-at-the-iranian-surveillance-operations/ - webarchive
- https://www.bleepingcomputer.com/news/security/domestic-kitten-apt-operates-in-silence-since-2016/ - webarchive
- https://www.bleepingcomputer.com/news/security/hacking-group-updates-furball-android-spyware-to-evade-detection/ - webarchive
- https://documents.trendmicro.com/assets/appendix-mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Geost
Internal MISP references
UUID b9639878-733c-4f30-9a13-4680a7e17415 which can be used as unique global reference for Geost in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.geost - webarchive
- https://www.gosecure.net/blog/2020/12/02/deep-dive-into-an-obfuscation-as-a-service-for-android-malware/ - webarchive
- https://www.virusbulletin.com/virusbulletin/2019/10/vb2019-paper-geost-botnet-story-discovery-new-android-banking-trojan-opsec-error/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ghimob
Internal MISP references
UUID 3d1f2591-05fe-42f4-aaf8-ed1428f17605 which can be used as unique global reference for Ghimob in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GhostCtrl
Internal MISP references
UUID 3b6c1771-6d20-4177-8be0-12116e254bf5 which can be used as unique global reference for GhostCtrl in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gigabud
Gigabud is the name of an Android Remote Access Trojan (RAT) Android that can record the victim's screen and steal banking credentials by abusing the Accessibility Service. Gigabud masquerades as banking, shopping, and other applications. Threat actors have been observed using deceptive websites to distribute Gigabud RAT.
Internal MISP references
UUID 8f188382-7a31-46a5-83c6-5991dfe739ee which can be used as unique global reference for Gigabud in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ginp
Ginp is a mobile banking software targeting Android devices that was discovered by Kaspersky. The malware is able to steal both user credentials and credit cards numbers by implementing overlay attacks. For this, overlay targets are for example the default SMS application. What makes Ginp a remarkable family is how its operators managed to have it remain undetected over time even and it receiving version upgrades over many years. According to ThreatFabric, Ginp has the following features:
Overlaying: Dynamic (local overlays obtained from the C2) SMS harvesting: SMS listing SMS harvesting: SMS forwarding Contact list collection Application listing Overlaying: Targets list update SMS: Sending Calls: Call forwarding C2 Resilience: Auxiliary C2 list Self-protection: Hiding the App icon Self-protection: Preventing removal Self-protection: Emulation-detection.
Internal MISP references
UUID 77e9ace0-f6e5-4d6e-965a-a653ff626be1 which can be used as unique global reference for Ginp in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.ginp - webarchive
- https://www.threatfabric.com/blogs/ginp_a_malware_patchwork_borrowing_from_anubis.html - webarchive
- https://www.kaspersky.com/blog/ginp-trojan-coronavirus-finder/34338/ - webarchive
- https://twitter.com/ESETresearch/status/1269945115738542080 - webarchive
- https://securityintelligence.com/posts/ginp-malware-operations-rising-expansions-turkey/ - webarchive
- https://www.youtube.com/watch?v=WeL_xSryj8E - webarchive
- https://www.threatfabric.com/blogs/2020_year_of_the_rat.html - webarchive
- https://muha2xmad.github.io/malware-analysis/ginp/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GlanceLove
Internal MISP references
UUID 24a709ef-c2e4-45ca-90b6-dfa184472f49 which can be used as unique global reference for GlanceLove in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.glancelove - webarchive
- https://securelist.com/breaking-the-weakest-link-of-the-strongest-chain/77562/ - webarchive
- https://www.clearskysec.com/glancelove/ - webarchive
- https://www.idf.il/en/minisites/hamas/hamas-uses-fake-facebook-profiles-to-target-israeli-soldiers/ - webarchive
- https://www.haaretz.com/israel-news/hamas-cyber-ops-spied-on-israeli-soldiers-using-fake-world-cup-app-1.6241773 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GnatSpy
Internal MISP references
UUID a3b6a355-3afe-49ae-9f87-679c6c382943 which can be used as unique global reference for GnatSpy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GoatRAT
Internal MISP references
UUID f699d295-1072-418b-8aa2-cb36fbd4c6c7 which can be used as unique global reference for GoatRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Godfather
According to PCrisk, Godfather is the name of an Android malware targeting online banking pages and cryptocurrency exchanges in 16 countries. It opens fake login windows over legitimate applications. Threat actors use Godfather to steal account credentials. Additionally, Godfather can steal SMSs, device information, and other data.
Internal MISP references
UUID 8e95a9d5-08fb-4f11-b70a-622148bd1e62 which can be used as unique global reference for Godfather in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.godfather - webarchive
- https://brandefense.io/blog/godfather-android-banking-trojan/ - webarchive
- https://github.com/LaurieWired/StrangeLoop - webarchive
- https://blog.group-ib.com/godfather-trojan - webarchive
- https://muha2xmad.github.io/malware-analysis/godfather/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GoldenEagle
Internal MISP references
UUID b7c0c11d-8471-4b10-bbf2-f9c0f30bc27e which can be used as unique global reference for GoldenEagle in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GoldenRAT
Internal MISP references
UUID e111fff8-c73c-4069-b804-2d3732653481 which can be used as unique global reference for GoldenRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GoldDigger
Internal MISP references
UUID 8ff9cde1-627e-4967-8b12-195544f31d83 which can be used as unique global reference for GoldDigger in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
goontact
Internal MISP references
UUID 008ef3f3-579e-4065-ad0a-cf96be00becf which can be used as unique global reference for goontact in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.goontact - webarchive
- https://blog.lookout.com/lookout-discovers-new-spyware-goontact-used-by-sextortionists-for-blackmail - webarchive
- https://blog.cyble.com/2021/09/03/spyware-variant-disguised-as-korean-video-app-targets-multiple-asian-countries/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GPlayed
Cisco Talos identifies GPlayed as a malware written in .NET using the Xamarin environment for mobile applications. It is considered powerful because of its capability to adapt after its deployment. In order to achieve this adaptability, the operator has the capability to remotely load plugins, inject scripts and even compile new .NET code that can be executed.
Internal MISP references
UUID 13dc1ec7-aba7-4553-b990-8323405a1d32 which can be used as unique global reference for GPlayed in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GriftHorse
Internal MISP references
UUID fe40a0b2-be48-41c5-8814-7fa3a6a993b9 which can be used as unique global reference for GriftHorse in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Guerrilla
Internal MISP references
UUID 57de6ac2-8cf0-4022-aee2-5f76e3dbd503 which can be used as unique global reference for Guerrilla in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gustuff
Group-IB describes Gustuff as a mobile Android Trojan, which includes potential targets of customers in leading international banks, users of cryptocurrency services, popular ecommerce websites and marketplaces. Gustuff has previously never been reported. Gustuff is a new generation of malware complete with fully automated features designed to steal both fiat and crypto currency from user accounts en masse. The Trojan uses the Accessibility Service, intended to assist people with disabilities. The analysis of Gustuff sample revealed that the Trojan is equipped with web fakes designed to potentially target users of Android apps of top international banks including Bank of America, Bank of Scotland, J.P.Morgan, Wells Fargo, Capital One, TD Bank, PNC Bank, and crypto services such as Bitcoin Wallet, BitPay, Cryptopay, Coinbase etc. Group-IB specialists discovered that Gustuff could potentially target users of more than 100 banking apps, including 27 in the US, 16 in Poland, 10 in Australia, 9 in Germany, and 8 in India and users of 32 cryptocurrency apps.
Internal MISP references
UUID a5e2b65f-2087-465d-bf14-4acf891d5d0f which can be used as unique global reference for Gustuff in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.gustuff - webarchive
- https://www.group-ib.com/media/gustuff/ - webarchive
- https://www.threatfabric.com/blogs/the-rage-of-android-banking-trojans.html - webarchive
- https://blog.talosintelligence.com/2019/10/gustuffv2.html - webarchive
- https://gallery.mailchimp.com/c35aef82661dad887b8162a4f/files/e24e8206-a157-4796-a8cb-2b7262cc76e8/CSIS_Threat_Matrix_H1_2019.pdf - webarchive
- https://www.threatfabric.com/blogs/2020_year_of_the_rat.html - webarchive
- https://blog.talosintelligence.com/2019/04/gustuff-targets-australia.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HARDRAIN (Android)
Internal MISP references
UUID 0caf0292-b01a-4439-b56f-c75b71900bc0 which can be used as unique global reference for HARDRAIN (Android) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.hardrain - webarchive
- https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-F.pdf - webarchive
- https://securingtomorrow.mcafee.com/mcafee-labs/android-malware-appears-linked-to-lazarus-cybercrime-group/#sf174581990 - webarchive
- https://unit42.paloaltonetworks.com/unit42-operation-blockbuster-goes-mobile/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HawkShaw
Internal MISP references
UUID 5ae490bd-84ca-434f-ab34-b87bd38e4523 which can be used as unique global reference for HawkShaw in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HenBox
Internal MISP references
UUID 0185f9f6-018e-4eb5-a214-d810cb759a38 which can be used as unique global reference for HenBox in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.henbox - webarchive
- https://unit42.paloaltonetworks.com/unit42-henbox-chickens-come-home-roost/ - webarchive
- https://unit42.paloaltonetworks.com/pkplug_chinese_cyber_espionage_group_attacking_asia/ - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-pulling-pkplug-adversary-playbook-long-standing-espionage-activity-chinese-nation-state-adversary/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hermit
Lookout states that Hermit is an advanced spyware designed to target iOS and Android mobile devices. It is designed to collect extensive amounts of sensitive data on its victims such as their location, contacts, private messages, photos, call logs, phone conversations, ambient audio recordings, and more.
Internal MISP references
UUID b95f25a0-ba22-4320-95e3-323fbf852846 which can be used as unique global reference for Hermit in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.hermit - webarchive
- https://www.lighthousereports.nl/investigation/revealing-europes-nso - webarchive
- https://blog.google/threat-analysis-group/italian-spyware-vendor-targets-users-in-italy-and-kazakhstan/ - webarchive
- https://de.lookout.com/blog/hermit-spyware-discovery - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HeroRAT
Internal MISP references
UUID 537f17ac-74e5-440b-8659-d4fdb4af41a6 which can be used as unique global reference for HeroRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HiddenAd
HiddenAd is a malware that shows ads as overlays on the phone.
Internal MISP references
UUID 171c97ca-6b61-426d-8f72-c099528625e9 which can be used as unique global reference for HiddenAd in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.hiddenad - webarchive
- https://securelist.com/mobile-malware-evolution-2019/96280/ - webarchive
- https://labs.bitdefender.com/2020/03/infected-zoom-apps-for-android-target-work-from-home-users - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/new-hiddenads-malware-that-runs-automatically-and-hides-on-google-play-1m-users-affected/ - webarchive
- https://twitter.com/LukasStefanko/status/1136568939239137280 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HilalRAT
RAT, which can be used to extract sensitive information, e.g. contact lists, txt messages, location information.
Internal MISP references
UUID 96bea6aa-3202-4352-8e36-fa05c677c0e8 which can be used as unique global reference for HilalRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hook
According to ThreatFabric, this is a malware family based on apk.ermac. The name hook is the self-advertised named by its vendor DukeEugene. It provides WebSocket communication and has RAT capabilities.
Internal MISP references
UUID c101bc42-1011-43f6-9d30-629013c318cd which can be used as unique global reference for Hook in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.hook - webarchive
- https://www.threatfabric.com/blogs/hook-a-new-ermac-fork-with-rat-capabilities.html - webarchive
- https://cebrf.knf.gov.pl/komunikaty/artykuly-csirt-knf/362-ostrzezenia/858-hookbot-a-new-mobile-malware - webarchive
- https://research.nccgroup.com/2023/09/11/from-ermac-to-hook-investigating-the-technical-differences-between-two-android-malware-variants/ - webarchive
- https://github.com/0xperator/hookbot_source - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hydra
Avira states that Hydra is an Android BankBot variant, a type of malware designed to steal banking credentials. The way it does this is by requesting the user enables dangerous permissions such as accessibility and every time the banking app is opened, the malware is hijacking the user by overwriting the legit banking application login page with a malicious one. The goal is the same, to trick the user to enter his login credentials so that it will go straight to the malware authors.
Internal MISP references
UUID ae25953d-cf7c-4304-9ea2-2ea1498ea035 which can be used as unique global reference for Hydra in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.hydra - webarchive
- https://cryptax.medium.com/android-bianlian-payload-61febabed00a - webarchive
- https://twitter.com/muha2xmad/status/1570788983474638849 - webarchive
- https://www.avira.com/en/blog/avira-labs-research-reveals-hydra-banking-trojan-2-0 - webarchive
- https://cryptax.medium.com/quick-look-into-a-new-sample-of-android-bianlian-bc5619efa726 - webarchive
- https://pentest.blog/android-malware-analysis-dissecting-hydra-dropper/ - webarchive
- https://cryptax.medium.com/bianlian-c-c-domain-name-4f226a29e221 - webarchive
- https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html - webarchive
- https://resecurity.com/blog/article/in-the-box-mobile-malware-webinjects-marketplace - webarchive
- https://muha2xmad.github.io/malware-analysis/hydra/ - webarchive
- https://cryptax.medium.com/creating-a-safe-dummy-c-c-to-test-android-bots-ffa6e7a3dce5 - webarchive
- https://www.threatfabric.com/blogs/2020_year_of_the_rat.html - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
- https://blog.cyble.com/2022/06/13/hydra-android-malware-distributed-via-play-store/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IPStorm (Android)
Android variant of IPStorm (InterPlanetary Storm).
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular IPStorm (Android).
| Known Synonyms |
|---|
InterPlanetary Storm |
Internal MISP references
UUID dc0c8824-64ac-4ab2-a0e4-955a14ecc59c which can be used as unique global reference for IPStorm (Android) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.ipstorm - webarchive
- https://www.justice.gov/usao-pr/pr/russian-and-moldovan-national-pleads-guilty-operating-illegal-botnet-proxy-service - webarchive
- https://blog.barracuda.com/2020/10/01/threat-spotlight-new-interplanetary-storm-variant-iot/ - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/376/Bitdefender-Whitepaper-IPStorm.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IRATA
According to redpiranha, IRATA (Iranian Remote Access Trojan) Android Malware is a new malware detected in the wild. It originates from a phishing attack through SMS. The theme of the message resembles information coming from the government that will ask you to download this malicious application. IRATA can collect sensitive information from your mobile phone including bank details. Since it infects your mobile, it can also gather your SMS messages which then can be used to obtain 2FA tokens.
Internal MISP references
UUID 24fb43b4-d6a6-49c0-a862-4211a245b635 which can be used as unique global reference for IRATA in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IRRat
Internal MISP references
UUID 3e7c6e8c-46fc-4498-a28d-5b3d144c51cf which can be used as unique global reference for IRRat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JadeRAT
Internal MISP references
UUID 8804e02c-a139-4c3d-8901-03302ca1faa0 which can be used as unique global reference for JadeRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Joker
Joker is one of the most well-known malware families on Android devices. It manages to take advantage of Google’s official app store with the help of its trail signatures which includes updating the virus’s code, execution process, and payload-retrieval techniques. This malware is capable of stealing users’ personal information including contact details, device data, WAP services, and SMS messages.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Joker.
| Known Synonyms |
|---|
Bread |
Internal MISP references
UUID aa2ad8f4-3c46-4f16-994b-2a79c7481cac which can be used as unique global reference for Joker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.joker - webarchive
- https://research.checkpoint.com/2020/new-joker-variant-hits-google-play-with-an-old-trick/ - webarchive
- https://medium.com/csis-techblog/analysis-of-joker-a-spy-premium-subscription-bot-on-googleplay-9ad24f044451 - webarchive
- https://www.microsoft.com/security/blog/2022/06/30/toll-fraud-malware-how-an-android-application-can-drain-your-wallet/ - webarchive
- https://web.archive.org/web/20210714010827/https://blog.zimperium.com/joker-is-still-no-laughing-matter/ - webarchive
- https://labs.bitdefender.com/2020/03/android-apps-and-malware-capitalize-on-coronavirus - webarchive
- https://security.googleblog.com/2020/01/pha-family-highlights-bread-and-friends.html - webarchive
- https://cryptax.medium.com/tracking-android-joker-payloads-with-medusa-static-analysis-and-patience-672348b81ac2 - webarchive
- https://muha2xmad.github.io/malware-analysis/hydra/ - webarchive
- https://www.trendmicro.com/en_us/research/20/k/an-old-jokers-new-tricks--using-github-to-hide-its-payload.html - webarchive
- https://labs.k7computing.com/index.php/joker-unleashes-itself-again-on-google-play-store/ - webarchive
- https://cryptax.medium.com/live-reverse-engineering-of-a-trojanized-medical-app-android-joker-632d114073c1 - webarchive
- https://labs.k7computing.com/?p=22199 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KevDroid
Internal MISP references
UUID 1e1924b5-89cb-408b-bcee-d6aaef7b24e0 which can be used as unique global reference for KevDroid in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.kevdroid - webarchive
- https://researchcenter.paloaltonetworks.com/2018/04/unit42-reaper-groups-updated-mobile-arsenal/ - webarchive
- https://blog.talosintelligence.com/2018/04/fake-av-investigation-unearths-kevdroid.html - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KnSpy
Internal MISP references
UUID 084ebca7-91da-4d9c-8211-a18f358ac28b which can be used as unique global reference for KnSpy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.knspy - webarchive
- https://s.tencent.com/research/report/951.html - webarchive
- https://cybleinc.com/2021/04/21/donot-team-apt-group-is-back-to-using-old-malicious-patterns/ - webarchive
- https://community.riskiq.com/article/6f60db72 - webarchive
- https://blogs.360.cn/post/APT-C-35_target_at_armed_forces_in_Pakistan.html - webarchive
- https://blog.talosintelligence.com/2020/10/donot-firestarter.html - webarchive
- https://twitter.com/voodoodahl1/status/1267571622732578816 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Koler
Internal MISP references
UUID 4ff34778-de4b-4f48-9184-4975c8ccc3f3 which can be used as unique global reference for Koler in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KSREMOTE
Internal MISP references
UUID 196d51bf-cf97-455d-b997-fc3e377f2188 which can be used as unique global reference for KSREMOTE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LittleLooter
Internal MISP references
UUID 41cb4397-7ae0-4a9f-894f-47828e768aa9 which can be used as unique global reference for LittleLooter in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.little_looter - webarchive
- https://www.youtube.com/watch?v=nilzxS9rxEM - webarchive
- https://twitter.com/malwrhunterteam/status/1337684036374945792 - webarchive
- https://securityintelligence.com/posts/itg18-operational-security-errors-plague-iranian-threat-group/ - webarchive
- https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-The-Kitten-That-Charmed-Me-The-9-Lives-Of-A-Nation-State-Attacker.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Loki
Internal MISP references
UUID a6f481fe-b6db-4507-bb3c-28f10d800e2f which can be used as unique global reference for Loki in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LokiBot
Android banker Trojan with the standard banking capabilities such as overlays, SMS stealing. It also features ransomware functionality. Note, the network traffic is obfuscated the same way as in Android Bankbot.
Internal MISP references
UUID 4793a29b-1191-4750-810e-9301a6576fc4 which can be used as unique global reference for LokiBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.lokibot - webarchive
- https://github.com/vc0RExor/Malware-Threat-Reports/blob/main/Lokibot/Machete-Weapons-Lokibot/Machete%20weapons-Lokibot_EN.pdf - webarchive
- https://yoroi.company/research/aggah-how-to-run-a-botnet-without-renting-a-server-for-more-than-a-year/ - webarchive
- https://www.threatfabric.com/blogs/lokibot_the_first_hybrid_android_malware.html - webarchive
- https://news.sophos.com/en-us/2020/07/14/raticate-rats-as-service-with-commercial-crypter/?cmp=30728 - webarchive
- https://muha2xmad.github.io/mal-document/lokibotpdf/ - webarchive
- https://securelist.com/emotet-darkgate-lokibot-crimeware-report/110286/ - webarchive
- https://drive.google.com/file/d/144cOnM6fxfuBeP0V2JQshp8C0Zlk_0kH/view - webarchive
- https://isc.sans.edu/diary/27282 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LuckyCat
Internal MISP references
UUID 1785a4dd-4044-4405-91c2-efb722801867 which can be used as unique global reference for LuckyCat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mandrake
Internal MISP references
UUID 0f587654-7f70-43be-9f1f-95e3a2cc2014 which can be used as unique global reference for Mandrake in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Marcher
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Marcher.
| Known Synonyms |
|---|
ExoBot |
Internal MISP references
UUID f691663a-b360-4c0d-a4ee-e9203139c38e which can be used as unique global reference for Marcher in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.marcher - webarchive
- https://www.zscaler.de/blogs/research/android-marcher-continuously-evolving-mobile-malware - webarchive
- https://www.clientsidedetection.com/exobot_v2_update___staying_ahead_of_the_competition.html - webarchive
- https://securelist.com/mobile-malware-evolution-2019/96280/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MasterFred
According to heimdal, MasterFred malware, this is designed as an Android trojan that makes use of false login overlays to target not only Netflix, Instagram, and Twitter users, but also bank customers. The hackers’ goal is to steal credit card information.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MasterFred.
| Known Synonyms |
|---|
Brox |
Internal MISP references
UUID 87131ea3-4c5e-42ba-a8e2-edd62a0bcd8d which can be used as unique global reference for MasterFred in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MazarBot
Internal MISP references
UUID 38cbdc29-a5af-46ae-ab82-baf3f6999826 which can be used as unique global reference for MazarBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Medusa (Android)
According to ThreatFabric, this is an Android banking trojan under active development as of July 2020. It is using TCP for C&C communication and targets Turkish banks.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Medusa (Android).
| Known Synonyms |
|---|
Gorgona |
Internal MISP references
UUID f155e529-dbea-4e4d-9df3-518401191c82 which can be used as unique global reference for Medusa (Android) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.medusa - webarchive
- https://www.threatfabric.com/blogs/partners-in-crime-medusa-cabassous.html - webarchive
- https://twitter.com/ThreatFabric/status/1285144962695340032 - webarchive
- https://www.threatfabric.com/blogs/the-rage-of-android-banking-trojans.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Meterpreter (Android)
Internal MISP references
UUID e1ae3e4e-5aaf-4ffe-ba2f-7871507f6d52 which can be used as unique global reference for Meterpreter (Android) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.meterpreter - webarchive
- https://medium.com/@cryptax/locating-the-trojan-inside-an-infected-covid-19-contact-tracing-app-21e23f90fbfe - webarchive
- https://mp.weixin.qq.com/s/J_A12SOX0k5TOYFAegBv_w - webarchive
- https://www.trendmicro.com/en_us/research/20/l/sidewinder-leverages-south-asian-territorial-issues-for-spear-ph.html - webarchive
- https://medium.com/@cryptax/into-android-meterpreter-and-how-the-malware-launches-it-part-2-ef5aad2ebf12 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MobileOrder
Check Point has identified samples of this spyware being distributed since 2015. No samples were found on Google Play, meaning they were likely through other channels like social engineering.
Internal MISP references
UUID ee19588f-9752-4516-85f4-de18acfc64b3 which can be used as unique global reference for MobileOrder in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Monokle
Monokle is a sophisticated mobile surveillanceware that possesses remote access trojan (RAT) functionality, advanced data exfiltration techniques as well as the ability to install an attacker-specified certificate to the trusted certificates on an infected device that would allow for man-in-the-middle (MITM) attacks. According to Lookout researchers, It is believed to be developed by Special Technology Center (STC), which is a Russian defense contractor sanctioned by the U.S. Government in connection to alleged interference in the 2016 US presidential elections.
Internal MISP references
UUID 739d6d22-b187-4754-9098-22625ea612cc which can be used as unique global reference for Monokle in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MoqHao
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MoqHao.
| Known Synonyms |
|---|
Shaoye |
XLoader |
Internal MISP references
UUID 41a9408d-7020-4988-af2c-51baf4d20763 which can be used as unique global reference for MoqHao in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.moqhao - webarchive
- https://www.xanhacks.xyz/p/moqhao-malware-analysis - webarchive
- https://cryptax.medium.com/a-native-packer-for-android-moqhao-6362a8412fe1 - webarchive
- https://securelist.com/roaming-mantis-part-v/96250/ - webarchive
- https://team-cymru.com/blog/2021/08/11/moqhao-part-1-5-high-level-trends-of-recent-campaigns-targeting-japan/ - webarchive
- https://www.telekom.com/en/blog/group/article/moqhao-masters-new-tricks-1031484 - webarchive
- https://www.team-cymru.com/post/moqhao-part-3-recent-global-targeting-trends - webarchive
- https://www.trendmicro.com/en_us/research/18/k/a-look-into-the-connection-between-xloader-and-fakespy-and-their-possible-ties-with-the-yanbian-gang.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/a-look-into-the-connection-between-xloader-and-fakespy-and-their-possible-ties-with-the-yanbian-gang/ - webarchive
- https://team-cymru.com/blog/2022/04/07/moqhao-part-2-continued-european-expansion/ - webarchive
- https://securelist.com/roaming-mantis-dns-changer-in-malicious-mobile-app/108464/ - webarchive
- https://blog.sekoia.io/ongoing-roaming-mantis-smishing-campaign-targeting-france/ - webarchive
- https://medium.com/csis-techblog/the-roamingmantis-groups-expansion-to-european-apple-accounts-and-android-devices-e6381723c681 - webarchive
- https://hitcon.org/2019/CMT/slide-files/d2_s1_r1.pdf - webarchive
- https://www.kashifali.ca/2021/05/05/roaming-mantis-amplifies-smishing-campaign-with-os-specific-android-malware/ - webarchive
- https://team-cymru.com/blog/2021/01/20/moqhao-part-1-identifying-phishing-infrastructure/ - webarchive
- https://www.trendmicro.com/en_us/research/18/d/xloader-android-spyware-and-banking-trojan-distributed-via-dns-spoofing.html - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_4_ogawa-niseki_en.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MOrder RAT
Internal MISP references
UUID f91f27ad-edcd-4e3d-824e-23f6acd81a7b which can be used as unique global reference for MOrder RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mudwater
Internal MISP references
UUID 9a8a5dd0-c86e-40d1-bc94-51070447c907 which can be used as unique global reference for Mudwater in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MysteryBot
MysteryBot is an Android banking Trojan with overlay capabilities with support for Android 7/8 but also provides other features such as key logging and ransomware functionality.
Internal MISP references
UUID 0a53ace4-98ae-442f-be64-b8e373948bde which can be used as unique global reference for MysteryBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nexus
Internal MISP references
UUID fe0b4e6e-268e-4c63-a095-bf1ddff95055 which can be used as unique global reference for Nexus in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.nexus - webarchive
- https://liansecurity.com/#/main/news/RWt_ZocBrFZDfCElFqw_/detail
- https://www.cleafy.com/cleafy-labs/nexus-a-new-android-botnet - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OmniRAT
Internal MISP references
UUID ec936d58-6607-4e33-aa97-0e587bbbdda5 which can be used as unique global reference for OmniRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.omnirat - webarchive
- https://github.com/threatland/TL-TROJAN/tree/master/TL.RAT/RAT.Android.OmniRAT - webarchive
- https://securityintelligence.com/news/omnirat-takes-over-android-devices-through-social-engineering-tricks/ - webarchive
- https://blog.avast.com/2015/11/05/droidjack-isnt-the-only-spying-software-out-there-avast-discovers-that-omnirat-is-currently-being-used-and-spread-by-criminals-to-gain-full-remote-co - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Oscorp
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Oscorp.
| Known Synonyms |
|---|
UBEL |
Internal MISP references
UUID 8d383260-102f-46da-8cc6-7659cbbd9452 which can be used as unique global reference for Oscorp in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PackChat
Internal MISP references
UUID b0f56103-1771-4e01-9ed7-44149e39ce93 which can be used as unique global reference for PackChat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PhantomLance
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PhantomLance.
| Known Synonyms |
|---|
PWNDROID1 |
Internal MISP references
UUID a73375a5-3384-4515-8538-b598d225586d which can be used as unique global reference for PhantomLance in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.phantomlance - webarchive
- https://securelist.com/apt-phantomlance/96772/ - webarchive
- https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/mobile-malware-report.pdf - webarchive
- https://securelist.com/it-threat-evolution-q2-2020/98230 - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://threatvector.cylance.com/en_us/home/mobile-malware-and-apt-espionage-prolific-pervasive-and-cross-platform.html - webarchive
- https://drive.google.com/file/d/1m0Qg8e1Len1My6ssDy6F0oQ7JdkJUkuu/view - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PhoneSpy
According to Zimperium, PhoneSpy is a spyware aimed at South Korean residents with Android devices.
Internal MISP references
UUID ff00bbb6-6856-4cf5-adde-d1cc536dd0e2 which can be used as unique global reference for PhoneSpy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PINEFLOWER
According to Mandiant, PINEFLOWER is an Android malware family capable of a wide range of backdoor functionality, including stealing system inform information, logging and recording phone calls, initiating audio recordings, reading SMS inboxes and sending SMS messages. The malware also has features to facilitate device location tracking, deleting, downloading, and uploading files, reading connectivity state, speed, and activity, and toggling Bluetooth, Wi-Fi, and mobile data settings.
Internal MISP references
UUID a17a7c5d-0a8f-42e7-b4c9-63c258267776 which can be used as unique global reference for PINEFLOWER in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PixPirate
According to PCrisk, The PixPirate is a dangerous Android banking Trojan that has the capability to carry out ATS (Automatic Transfer System) attacks. This allows threat actors to automatically transfer funds through the Pix Instant Payment platform, which numerous Brazilian banks use.
In addition to launching ATS attacks, PixPirate can intercept and delete SMS messages, prevent the uninstallation process, and carry out malvertising attacks.
Internal MISP references
UUID cdf707bd-a8b0-4ee3-917d-a56b11f30206 which can be used as unique global reference for PixPirate in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PixStealer
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PixStealer.
| Known Synonyms |
|---|
BrazKing |
Internal MISP references
UUID 5d047596-eb67-4fed-b41d-65fa975150c5 which can be used as unique global reference for PixStealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.pixstealer - webarchive
- https://research.checkpoint.com/2021/pixstealer-a-new-wave-of-android-banking-trojans-abusing-accessibility-services/ - webarchive
- https://securityintelligence.com/posts/brazking-android-malware-upgraded-targeting-brazilian-banks/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PjobRAT
Internal MISP references
UUID 6fa6c769-2546-4a5c-a3c7-24dda4ab597d which can be used as unique global reference for PjobRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.pjobrat - webarchive
- https://mp.weixin.qq.com/s/VTHvmRTeu3dw8HFyusKLqQ - webarchive
- https://labs.k7computing.com/?p=22537 - webarchive
- https://cybleinc.com/2021/06/22/android-application-disguised-as-dating-app-targets-indian-military-personnel/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Podec
Internal MISP references
UUID 82f9c4c1-2619-4236-a701-776c6c781f45 which can be used as unique global reference for Podec in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
X-Agent (Android)
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular X-Agent (Android).
| Known Synonyms |
|---|
Popr-d30 |
Internal MISP references
UUID 0a7d9d22-a26d-4a2b-ab9b-b296176c3ecf which can be used as unique global reference for X-Agent (Android) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Fake Pornhub
Internal MISP references
UUID 3272a8d8-8323-4e98-b6ce-cb40789a3616 which can be used as unique global reference for Fake Pornhub in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Premier RAT
Internal MISP references
UUID 661471fe-2cb6-4b83-9deb-43225192a849 which can be used as unique global reference for Premier RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rafel RAT
Internal MISP references
UUID cdaa0a6d-3709-4e6f-8807-fff388baaba0 which can be used as unique global reference for Rafel RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RambleOn
Internal MISP references
UUID 41ab3c99-297c-465c-8375-3e9f7ce4b996 which can be used as unique global reference for RambleOn in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rana
Internal MISP references
UUID 65a8e406-b535-4c0a-bc6d-d1bec3c55623 which can be used as unique global reference for Rana in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RatMilad
RatMilad, a newly discovered Android spyware, has been stealing data from mobile devices in the Middle East. The malware is spread through links on social media and pretends to be applications for services like VPN and phone number spoofing. Unwary users download these trojan applications and grant access to malware.
Internal MISP references
UUID 542c3e5e-2124-4c36-af05-65893974d5ce which can be used as unique global reference for RatMilad in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Raxir
Internal MISP references
UUID f5cabe73-b5d6-4503-8350-30a6d54c32ef which can be used as unique global reference for Raxir in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RedAlert2
RedAlert 2 is an new Android malware used by an attacker to gain access to login credentials of various e-banking apps. The malware works by overlaying a login screen with a fake display that sends the credentials to a C2 server. The malware also has the ability to block incoming calls from banks, to prevent the victim of being notified. As a distribution vector RedAlert 2 uses third-party app stores and imitates real Android apps like Viber, Whatsapp or fake Adobe Flash Player updates.
Internal MISP references
UUID e9aaab46-abb1-4390-b37b-d0457d05b28f which can be used as unique global reference for RedAlert2 in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.redalert2 - webarchive
- https://www.threatfabric.com/blogs/new_android_trojan_targeting_over_60_banks_and_social_apps.html - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/red-alert-2-0-android-trojan-spreads-via-third-party-app-stores - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RemRAT
Internal MISP references
UUID 23809a2b-3c24-41c5-a310-2b8045539202 which can be used as unique global reference for RemRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Retefe (Android)
The Android app using for Retefe is a SMS stealer, used to forward mTAN codes to the threat actor. Further is a bank logo added to the specific Android app to trick users into thinking this is a legitimate app. Moreover, if the victim is not a real victim, the link to download the APK is not the malicious APK, but the real 'Signal Private Messenger' tool, hence the victim's phone doesn't get infected.
Internal MISP references
UUID 22ef1e56-7778-41d1-9b2b-737aa5bf9777 which can be used as unique global reference for Retefe (Android) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.retefe - webarchive
- http://blog.angelalonso.es/2015/10/reversing-c2c-http-emmental.html - webarchive
- http://blog.angelalonso.es/2015/11/reversing-sms-c-protocol-of-emmental.html - webarchive
- http://blog.angelalonso.es/2017/02/hunting-retefe-with-splunk-some24.html - webarchive
- http://maldr0id.blogspot.ch/2014/09/android-malware-based-on-sms-encryption.html - webarchive
- https://www.govcert.admin.ch/blog/33/the-retefe-saga - webarchive
- http://blog.dornea.nu/2014/07/07/disect-android-apks-like-a-pro-static-code-analysis/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Revive
According to PCrisk, Revive is the name of a banking Trojan targeting Android users (customers of a specific Spanish bank). It steals sensitive information. Cybercriminals use Revive to take ownership of online accounts using stolen login credentials. This malware abuses Accessibility Services to perform malicious activities.
Internal MISP references
UUID 25669934-14bf-463f-bcae-c59c590c3bf8 which can be used as unique global reference for Revive in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Riltok
Internal MISP references
UUID d7b347f8-77a5-4197-b818-f3af504da2c1 which can be used as unique global reference for Riltok in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Roaming Mantis
Internal MISP references
UUID 31d2ce1f-44bf-4738-a41d-ddb43466cd82 which can be used as unique global reference for Roaming Mantis in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.roaming_mantis - webarchive
- https://systemweakness.com/investigating-a-fake-mobile-payment-smishing-that-abuses-duck-dns-d07c72468ba8 - webarchive
- https://securelist.com/roaming-mantis-part-v/96250/ - webarchive
- https://securelist.com/roaming-mantis-uses-dns-hijacking-to-infect-android-smartphones/85178/ - webarchive
- https://systemweakness.com/a-strange-font-smishing-that-changes-behaviour-based-on-user-agent-and-abuses-duck-dns-1c1a45863ff7 - webarchive
- https://securelist.com/roaming-mantis-dabbles-in-mining-and-phishing-multilingually/85607/ - webarchive
- https://securelist.com/roaming-mantis-reaches-europe/105596/ - webarchive
- https://hitcon.org/2019/CMT/slide-files/d2_s1_r1.pdf - webarchive
- https://www.kashifali.ca/2021/05/05/roaming-mantis-amplifies-smishing-campaign-with-os-specific-android-malware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rogue
Internal MISP references
UUID 4b53480a-8006-4af7-8e4e-cc8727c62648 which can be used as unique global reference for Rogue in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rootnik
Internal MISP references
UUID db3dcfd1-79d2-4c91-898f-5f2463d7c417 which can be used as unique global reference for Rootnik in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.rootnik - webarchive
- https://blog.fortinet.com/2017/01/26/deep-analysis-of-android-rootnik-malware-using-advanced-anti-debug-and-anti-hook-part-ii-analysis-of-the-scope-of-java - webarchive
- https://blog.fortinet.com/2017/01/24/deep-analysis-of-android-rootnik-malware-using-advanced-anti-debug-and-anti-hook-part-i-debugging-in-the-scope-of-native-layer - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sauron Locker
Internal MISP references
UUID a7c058cf-d482-42cf-9ea7-d5554287ea65 which can be used as unique global reference for Sauron Locker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SharkBot
SharkBot is a piece of malicious software targeting Android Operating Systems (OSes). It is designed to obtain and misuse financial data by redirecting and stealthily initiating money transfers. SharkBot is particularly active in Europe (United Kingdom, Italy, etc.), but its activity has also been detected in the United States.
Internal MISP references
UUID 7b20fdb1-5aee-4f17-a88e-bcd72c893f0a which can be used as unique global reference for SharkBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.sharkbot - webarchive
- https://muha2xmad.github.io/malware-analysis/sharkbot/ - webarchive
- https://blog.fox-it.com/2022/03/03/sharkbot-a-new-generation-android-banking-trojan-being-distributed-on-google-play-store/ - webarchive
- https://www.cleafy.com/cleafy-labs/sharkbot-a-new-generation-of-android-trojan-is-targeting-banks-in-europe - webarchive
- https://research.checkpoint.com/2022/google-is-on-guard-sharks-shall-not-pass/ - webarchive
- https://services.google.com/fh/files/blogs/gcat_threathorizons_full_jul2023.pdf - webarchive
- https://research.nccgroup.com/2022/03/03/sharkbot-a-new-generation-android-banking-trojan-being-distributed-on-google-play-store/ - webarchive
- https://blog.fox-it.com/2022/09/02/sharkbot-is-back-in-google-play/ - webarchive
- https://www.threatfabric.com/blogs/the-attack-of-the-droppers.html - webarchive
- https://bin.re/blog/the-dgas-of-sharkbot/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SideWinder (Android)
SideWinder involved a fake VPN app for Android devices published on Google Play Store along with a custom tool that filters victims for better targeting.
Internal MISP references
UUID af929cac-e0c6-4a63-ac5a-02c4cbbab746 which can be used as unique global reference for SideWinder (Android) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SilkBean
Internal MISP references
UUID 00ab3d3b-dbbf-40de-b3d8-a3466704a1a7 which can be used as unique global reference for SilkBean in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Skygofree
Internal MISP references
UUID f5fded3c-8f45-471a-a372-d8be101e1b22 which can be used as unique global reference for Skygofree in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Slempo
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Slempo.
| Known Synonyms |
|---|
SlemBunk |
Internal MISP references
UUID d87e2574-7b9c-4ea7-98eb-88f3e139f6ff which can be used as unique global reference for Slempo in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Slocker
Internal MISP references
UUID fe187c8a-25d4-4d30-bd43-efca18d527f0 which can be used as unique global reference for Slocker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.slocker - webarchive
- https://labs.bitdefender.com/2020/05/android-slocker-variant-uses-coronavirus-scare-to-take-android-hostage/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/slocker-mobile-ransomware-starts-mimicking-wannacry/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SmsAgent
Internal MISP references
UUID ee42986c-e736-4092-a2f9-2931a02c688d which can be used as unique global reference for SmsAgent in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SMSspy
Internal MISP references
UUID 7a38c552-0e1a-4980-8d62-1aa38617efab which can be used as unique global reference for SMSspy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
S.O.V.A.
Internal MISP references
UUID 2aa95661-b63a-432e-8e5e-74ac93b42d57 which can be used as unique global reference for S.O.V.A. in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.sova - webarchive
- https://muha2xmad.github.io/malware-analysis/sova/ - webarchive
- https://www.cleafy.com/cleafy-labs/sova-malware-is-back-and-is-evolving-rapidly - webarchive
- https://liansecurity.com/#/main/news/RWt_ZocBrFZDfCElFqw_/detail
- https://www.threatfabric.com/blogs/sova-new-trojan-with-fowl-intentions.html - webarchive
- https://blog.cyble.com/2023/03/09/nexus-the-latest-android-banking-trojan-with-sova-connections - webarchive
- https://blog.cyble.com/2021/09/14/deep-dive-analysis-of-s-o-v-a-android-banking-trojan/ - webarchive
- https://cryptax.medium.com/eyes-on-android-s-o-v-a-botnet-sample-fb5ed332d08 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SpyBanker
Internal MISP references
UUID e186384b-8001-4cdd-b170-1548deb8bf04 which can be used as unique global reference for SpyBanker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SpyC23
Internal MISP references
UUID 8fb4910f-e645-4465-a202-a20835416c87 which can be used as unique global reference for SpyC23 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SpyMax
SpyMax is a popular Android surveillance tool. Its predecessor, SpyNote, was one of the most widely used spyware frameworks.
Internal MISP references
UUID e1dfb554-4c17-4d4c-ac48-604c48d8ab0b which can be used as unique global reference for SpyMax in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.spymax - webarchive
- https://www.threatfabric.com/blogs/spynote-rat-targeting-financial-institutions - webarchive
- https://www.zscaler.com/blogs/research/android-spyware-targeting-tanzania-premier-league - webarchive
- https://www.threatfabric.com/blogs/spynote-rat-targeting-financial-institutions.html - webarchive
- https://www.stratosphereips.org/blog/2020/11/10/android-mischief-rats-dataset - webarchive
- https://twitter.com/malwrhunterteam/status/1250412485808717826 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SpyNote
The malware has been released on github at https://github.com/EVLF/Cypher-Rat-Source-Code
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SpyNote.
| Known Synonyms |
|---|
CypherRat |
Internal MISP references
UUID 31592c69-d540-4617-8253-71ae0c45526c which can be used as unique global reference for SpyNote in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.spynote - webarchive
- https://ti.qianxin.com/blog/articles/Blade-hawk-The-activities-of-targeted-the-Middle-East-and-West-Asia-are-exposed/ - webarchive
- https://intel471.com/blog/china-cybercrime-undergrond-deepmix-tea-horse-road-great-firewall/ - webarchive
- https://www.cleafy.com/cleafy-labs/spynote-continues-to-attack-financial-institutions - webarchive
- https://www.threatfabric.com/blogs/spynote-rat-targeting-financial-institutions - webarchive
- https://docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc/edit#heading=h.hcd1wvpsrgfr - webarchive
- https://www.threatfabric.com/blogs/spynote-rat-targeting-financial-institutions.html - webarchive
- https://www.civilsphereproject.org/blog/2021/9/21/capturing-and-detecting-androidtester-remote-access-trojan-with-the-emergency-vpn - webarchive
- https://www.bleepingcomputer.com/news/security/spynote-android-malware-infections-surge-after-source-code-leak/ - webarchive
- https://www.volexity.com/blog/2020/03/31/storm-cloud-unleashed-tibetan-community-focus-of-highly-targeted-fake-flash-campaign/ - webarchive
- https://labs.k7computing.com/index.php/spynote-targets-irctc-users/ - webarchive
- https://mp.weixin.qq.com/s/J_A12SOX0k5TOYFAegBv_w - webarchive
- https://labs.k7computing.com/index.php/spynote-an-android-snooper/ - webarchive
- https://bulldogjob.pl/articles/1200-an-in-depth-analysis-of-spynote-remote-access-trojan - webarchive
- https://mp.weixin.qq.com/s/mstwBMkS0G3Et4GOji2mwA - webarchive
- https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
StealthAgent
Internal MISP references
UUID 0777cb30-534f-44bb-a7af-906a422bd624 which can be used as unique global reference for StealthAgent in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Stealth Mango
Internal MISP references
UUID 7d480f11-3de8-463d-8a19-54685c8b9e0f which can be used as unique global reference for Stealth Mango in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Svpeng
Internal MISP references
UUID d99c0a47-9d61-4d92-86ec-86a87b060d76 which can be used as unique global reference for Svpeng in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Switcher
Internal MISP references
UUID e3e90666-bc19-4741-aca8-1e4cbc2f4c9e which can be used as unique global reference for Switcher in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TalentRAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TalentRAT.
| Known Synonyms |
|---|
Assassin RAT |
Internal MISP references
UUID 46151a0d-aa0a-466c-9fff-c2c3474f572e which can be used as unique global reference for TalentRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TangleBot
Internal MISP references
UUID 1e37d712-df02-48aa-82fc-28fa80c92c2b which can be used as unique global reference for TangleBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TeleRAT
Internal MISP references
UUID e1600d04-d2f7-4862-8bbc-0f038ea683ea which can be used as unique global reference for TeleRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TemptingCedar Spyware
Internal MISP references
UUID 982c3554-1df2-4062-8f32-f311940ad9ff which can be used as unique global reference for TemptingCedar Spyware in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ThiefBot
Internal MISP references
UUID 5863d2eb-920d-4263-8c4b-7a16d410ff89 which can be used as unique global reference for ThiefBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TianySpy
According to Trend Micro, this malware appears to have been designed to steal credentials associated with membership websites of major Japanese telecommunication services.
Internal MISP references
UUID 8260dda5-f608-48f2-9341-28dbc5a8e895 which can be used as unique global reference for TianySpy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TinyZ
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TinyZ.
| Known Synonyms |
|---|
Catelites Android Bot |
MarsElite Android Bot |
Internal MISP references
UUID 93b27a50-f9b7-4ab6-bb9f-70a4b914eec3 which can be used as unique global reference for TinyZ in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Titan
Internal MISP references
UUID 7d418da3-d9d2-4005-8cc7-7677d1b11327 which can be used as unique global reference for Titan in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Triada
Internal MISP references
UUID fa5fdfd2-8142-43f5-9b48-d1033b5398c8 which can be used as unique global reference for Triada in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.triada - webarchive
- https://arstechnica.com/information-technology/2019/06/google-confirms-2017-supply-chain-attack-that-sneaked-backdoor-on-android-devices/ - webarchive
- https://www.nowsecure.com/blog/2016/11/21/android-malware-analysis-radare-triada-trojan/ - webarchive
- https://securelist.com/attack-on-zygote-a-new-twist-in-the-evolution-of-mobile-threats/74032/ - webarchive
- https://securelist.com/mobile-malware-evolution-2019/96280/ - webarchive
- http://contagiominidump.blogspot.de/2016/07/android-triada-modular-trojan.html - webarchive
- https://securelist.com/triada-trojan-in-whatsapp-mod/103679/ - webarchive
- https://blog.checkpoint.com/2016/06/17/in-the-wild-mobile-malware-implements-new-features/ - webarchive
- https://security.googleblog.com/2019/06/pha-family-highlights-triada.html - webarchive
- https://securelist.com/apkpure-android-app-store-infected/101845/ - webarchive
- https://securelist.com/everyone-sees-not-what-they-want-to-see/74997/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Triout
Bitdefender described Triout as a Android spyware, which appears to act as a framework for building extensive surveillance capabilities into seemingly benign applications. Found bundled with a repackaged app, the spyware’s surveillance capabilities involve hiding its presence on the device, recording phone calls, logging incoming text messages, recoding videos, taking pictures and collecting GPS coordinates, then broadcasting all of that to an attacker-controlled C&C (command and control) server.
Internal MISP references
UUID bd9ce51c-53f9-411b-b46a-aba036c433b1 which can be used as unique global reference for Triout in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
UltimaSMS
Internal MISP references
UUID 65476d5f-321f-4385-867a-383094cadb58 which can be used as unique global reference for UltimaSMS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified APK 001
Internal MISP references
UUID bbd5a32e-a080-4f16-98ea-ad8863507aa6 which can be used as unique global reference for Unidentified APK 001 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified APK 002
Internal MISP references
UUID afb6a7cc-4185-4f19-8ad4-45dcbb76e544 which can be used as unique global reference for Unidentified APK 002 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified APK 004
According to Check Point Research, this is a RAT that is disguised as a set of dating apps like "GrixyApp", "ZatuApp", "Catch&See", including dedicated websites to conceal their malicious purpose.
Internal MISP references
UUID 55626b63-4b9a-468e-92ae-4b09b303d0ed which can be used as unique global reference for Unidentified APK 004 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified APK 005
Internal MISP references
UUID 5413ca94-1385-40c0-8eb2-1fc3aff87fb1 which can be used as unique global reference for Unidentified APK 005 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified APK 006
Information stealer posing as a fake banking app, targeting Korean users.
Internal MISP references
UUID 2263198d-af38-4e38-a7a8-4435d29d88e8 which can be used as unique global reference for Unidentified APK 006 in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.unidentified_006 - webarchive
- https://medium.com/@ThreatMiner/android-trojan-targeting-korean-demographic-using-github-for-c2-8219fc39f749 - webarchive
- https://blog.cyble.com/2021/09/17/sophisticated-spyware-posing-as-a-banking-application-to-target-korean-users/ - webarchive
- https://twitter.com/ReBensk/status/1438027183490940931 - webarchive
- https://twitter.com/MsftSecIntel/status/1441524497924833282?s=20 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 007 (ARMAAN RAT)
According to Cyble, this is an Android application that pretends to be the legitimate application for the Army Mobile Aadhaar App Network (ARMAAN), intended to be used by Indian army personnel. The application was customized to include RAT functionality.
Internal MISP references
UUID 75c641c4-17df-43c4-9773-c27464c5d2ff which can be used as unique global reference for Unidentified 007 (ARMAAN RAT) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified APK 008
Android malware distributed through fake shopping websites targeting Malaysian users, targeting banking information.
Internal MISP references
UUID 2ffddca0-841c-4eb6-9983-ff38abb5d6d6 which can be used as unique global reference for Unidentified APK 008 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
VajraSpy
Internal MISP references
UUID c328b30f-e076-47dc-8c93-4d20f62c72ab which can be used as unique global reference for VajraSpy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
vamp
Related to the micropsia windows malware and also sometimes named micropsia.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular vamp.
| Known Synonyms |
|---|
android.micropsia |
Internal MISP references
UUID 1ad5b462-1b0d-4c2f-901d-ead6c9f227bc which can be used as unique global reference for vamp in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
VINETHORN
According to Mandiant, VINETHORN is an Android malware family capable of a wide range of backdoor functionality. It can steal system information, read SMS inboxes, send SMS messages, access contact lists and call histories, record audio and video, and track device location via GPS.
Internal MISP references
UUID 6da6dfb6-2c50-465c-9394-26695d72e8c7 which can be used as unique global reference for VINETHORN in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Viper RAT
Internal MISP references
UUID 3482f5fe-f129-4c77-ae98-76e25f6086b9 which can be used as unique global reference for Viper RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.viper_rat - webarchive
- https://blog.lookout.com/blog/2017/02/16/viperrat-mobile-apt/ - webarchive
- https://securelist.com/blog/incidents/77562/breaking-the-weakest-link-of-the-strongest-chain/ - webarchive
- https://about.fb.com/wp-content/uploads/2021/04/Technical-threat-report-Arid-Viper-April-2021.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vultur
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Vultur.
| Known Synonyms |
|---|
Vulture |
Internal MISP references
UUID 49b1c344-ce13-48bf-9839-909ba57649c4 which can be used as unique global reference for Vultur in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.vultur - webarchive
- https://www.cleafy.com/cleafy-labs/the-android-malwares-journey-from-google-play-to-banking-fraud - webarchive
- https://twitter.com/icebre4ker/status/1485651238175846400 - webarchive
- https://www.threatfabric.com/blogs/vultur-v-for-vnc.html - webarchive
- https://www.threatfabric.com/blogs/the-attack-of-the-droppers.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WireX
Internal MISP references
UUID 77f2254c-9886-4eed-a7c3-bbcef4a97d46 which can be used as unique global reference for WireX in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.wirex - webarchive
- https://therecord.media/turkish-national-charged-for-ddos-attacks-with-the-wirex-botnet/ - webarchive
- https://krebsonsecurity.com/2017/08/tech-firms-team-up-to-take-down-wirex-android-ddos-botnet/ - webarchive
- https://www.justice.gov/usao-ndil/pr/federal-indictment-chicago-charges-turkish-national-directing-cyber-attack - webarchive
- https://www.flashpoint-intel.com/blog/wirex-botnet-industry-collaboration/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WolfRAT
Internal MISP references
UUID 994c7bb3-ba40-41bb-89b3-f05996924b10 which can be used as unique global reference for WolfRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Wroba
According to Avira, this is a banking trojan targeting Japan.
Internal MISP references
UUID 40a5d526-ef9f-4ddf-a326-6f33dceeeebc which can be used as unique global reference for Wroba in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WyrmSpy
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular WyrmSpy.
| Known Synonyms |
|---|
AndroidControl |
Internal MISP references
UUID 77f81373-bb3a-449d-82ff-b28fe31acef6 which can be used as unique global reference for WyrmSpy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.wyrmspy - webarchive
- https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack - webarchive
- https://www.lookout.com/threat-intelligence/article/wyrmspy-dragonegg-surveillanceware-apt41 - webarchive
- https://cryptax.medium.com/organizing-malware-analysis-with-colander-example-on-android-wyrmspy-1f3ec30ae33b - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Xbot
Internal MISP references
UUID 4cfa42a3-71d9-43e2-bf23-daa79f326387 which can be used as unique global reference for Xbot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.xbot - webarchive
- https://researchcenter.paloaltonetworks.com/2016/02/new-android-trojan-xbot-phishes-credit-cards-and-bank-accounts-encrypts-devices-for-ransom/ - webarchive
- https://blog.avast.com/2015/02/17/angry-android-hacker-hides-xbot-malware-in-popular-application-icons/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Xenomorph
Xenomorph is a Android Banking RAT developed by the Hadoken.Security actor.
Internal MISP references
UUID d202e42d-2c35-4c1c-90f1-644a8cae38f1 which can be used as unique global reference for Xenomorph in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.xenomorph - webarchive
- https://www.threatfabric.com/blogs/xenomorph-a-newly-hatched-banking-trojan.html - webarchive
- https://cryptax.medium.com/unpacking-a-jsonpacker-packed-sample-4038e12119f5 - webarchive
- https://www.threatfabric.com/blogs/zombinder-ermac-and-desktop-stealers.html - webarchive
- https://www.zscaler.com/blogs/security-research/rise-banking-trojan-dropper-google-play-0 - webarchive
- https://www.threatfabric.com/blogs/bugdrop-new-dropper-bypassing-google-security-measures.html - webarchive
- https://www.threatfabric.com/blogs/xenomorph-v3-new-variant-with-ats.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
xHelper
Internal MISP references
UUID f54dec1f-bec6-4f4a-a909-690d65e0f14b which can be used as unique global reference for xHelper in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XploitSPY
Internal MISP references
UUID 57600f52-b55f-49c7-9c0c-de10b2d23370 which can be used as unique global reference for XploitSPY in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XRat
Internal MISP references
UUID a8f167a8-30b9-4953-8eb6-247f0d046d32 which can be used as unique global reference for XRat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
YellYouth
Internal MISP references
UUID a2dad59d-2355-415c-b4d6-62236d3de4c7 which can be used as unique global reference for YellYouth in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zanubis
According to cyware, Zanubis malware pretends to be a malicious PDF application. The threat actor uses it as a key to decrypt responses received from the C2 server.
Internal MISP references
UUID cebf13e5-dbfc-49d6-8715-e3b7687d386f which can be used as unique global reference for Zanubis in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zen
Internal MISP references
UUID 46d6d102-fc38-46f7-afdc-689cafe13de5 which can be used as unique global reference for Zen in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZooPark
Internal MISP references
UUID b1fc66de-fda7-4f0c-af00-751d334444b3 which can be used as unique global reference for ZooPark in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.zoopark - webarchive
- https://securelist.com/whos-who-in-the-zoo/85394 - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-juno - webarchive
- https://securelist.com/apt-trends-report-q2-2019/91897/ - webarchive
- https://securelist.com/whos-who-in-the-zoo/85394/ - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/05/03114450/ZooPark_for_public_final_edit.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ztorg
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ztorg.
| Known Synonyms |
|---|
Qysly |
Internal MISP references
UUID 9fbf97c0-d87a-47b0-a511-0147a58b5202 which can be used as unique global reference for Ztorg in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/apk.ztorg - webarchive
- http://blog.fortinet.com/2017/03/08/teardown-of-android-ztorg-part-2 - webarchive
- https://blog.fortinet.com/2017/03/15/teardown-of-a-recent-variant-of-android-ztorg-part-1 - webarchive
- https://securelist.com/ztorg-from-rooting-to-sms/78775/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nightrunner
WebShell.
Internal MISP references
UUID b0206aac-30ff-41ce-b7d4-1b94ab15e3b1 which can be used as unique global reference for Nightrunner in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Tunna
WebShell.
Internal MISP references
UUID b057f462-dc32-4f7b-95e0-98a20a48f2b2 which can be used as unique global reference for Tunna in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TwoFace
According to Unit42, TwoFace is a two-staged (loader+payload) webshell, written in C# and meant to run on webservers with ASP.NET. The author of the initial loader webshell included legitimate and expected content that will be displayed if a visitor accesses the shell in a browser, likely to remain undetected. The code in the loader webshell includes obfuscated variable names and the embedded payload is encoded and encrypted. To interact with the loader webshell, the threat actor uses HTTP POST requests to the compromised server.
The secondary webshell, which we call the payload, is embedded within the loader in encrypted form and contains additional functionality that we will discuss in further detail. When the threat actor wants to interact with the remote server, they provide data that the loader will use to modify a decryption key embedded within the loader that will be in turn used to decrypt the embedded TwoFace payload. Commands supported by the payload are execution of programs, up-, download and deletion of files and capability to manipulate MAC timestamps.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TwoFace.
| Known Synonyms |
|---|
HighShell |
HyperShell |
Minion |
SEASHARPEE |
Internal MISP references
UUID a98a04e5-1f86-44b8-91ff-dbe1534782ba which can be used as unique global reference for TwoFace in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/asp.twoface - webarchive
- https://www.zdnet.com/article/source-code-of-iranian-cyber-espionage-tools-leaked-on-telegram/ - webarchive
- https://unit42.paloaltonetworks.com/unit42-oilrig-performs-tests-twoface-webshell/ - webarchive
- https://drive.google.com/file/d/1oA4YSwXLxEF-EXJcrM76Bc4_7ZfBGYE4/view - webarchive
- https://web.archive.org/web/20200307113010/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1574947864.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-gypsy - webarchive
- https://www.cyber.gov.au/sites/default/files/2020-06/ACSC-Advisory-2020-008-Copy-Paste-Compromises.pdf - webarchive
- https://unit42.paloaltonetworks.com/unit42-twoface-webshell-persistent-access-point-lateral-movement/ - webarchive
- https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1536345486.pdf - webarchive
- https://www.youtube.com/watch?time_continue=1333&v=1CGAmjAV8nI - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2020-0312.pdf - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/incident-response-polar-ransomware-apt27/ - webarchive
- https://www.recordedfuture.com/full-spectrum-detections-five-popular-web-shells/ - webarchive
- https://cyware.com/blog/apt34-the-helix-kitten-cybercriminal-group-loves-to-meow-middle-eastern-and-international-organizations-48ae - webarchive
- https://unit42.paloaltonetworks.com/atoms/evasive-serpens/ - webarchive
- https://www.youtube.com/watch?v=GjquFKa4afU - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified ASP 001 (Webshell)
Internal MISP references
UUID d4318f40-a39a-4ce0-8d3c-246d9923d222 which can be used as unique global reference for Unidentified ASP 001 (Webshell) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Abcbot
Abcbot is a modular Go-based botnet and malware that propagates via exploits and brute force attempts. The botnet was observed launching DDoS attacks, perform internet scans, and serve web pages. It is probably linked to Xanthe-based clipjacking campaign.
Internal MISP references
UUID 8d17175b-4e9f-43a9-851d-898bb6696984 which can be used as unique global reference for Abcbot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.abcbot - webarchive
- https://www.cadosecurity.com/abcbot-an-evolution-of-xanthe/ - webarchive
- https://blog.netlab.360.com/abcbot_an_evolving_botnet_en/ - webarchive
- https://www.cadosecurity.com/the-continued-evolution-of-abcbot/ - webarchive
- https://www.lacework.com/blog/abc-botnet-attacks-on-the-rise/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Abyss Locker
Family based on HelloKitty Ransomware. Encryption algorithm changed from AES to ChaCha. Sample seems to be unpacked.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Abyss Locker.
| Known Synonyms |
|---|
elf.hellokitty |
Internal MISP references
UUID 302a96b1-73cb-4f70-a329-e68debd87bf8 which can be used as unique global reference for Abyss Locker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ACBackdoor (ELF)
A Linux backdoor that was apparently ported to Windows. This entry represents the Linux version. This version appears to have been written first and the Windows version was ported later, without full functionality. The Linux version offers persistence as well as some process manipulation techniques, though both versions apparently offer the ability to access the command line and execute programs as well as self-update.
Internal MISP references
UUID cd2d7040-edc4-4985-b708-b206b08cc1fe which can be used as unique global reference for ACBackdoor (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.acbackdoor - webarchive
- https://medium.com/@Ilandu/portdoor-malware-afc9d0796cba - webarchive
- https://www.bleepingcomputer.com/news/security/linux-windows-users-targeted-with-new-acbackdoor-malware/ - webarchive
- https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AcidRain
A MIPS ELF binary with wiper functionality used against Viasat KA-SAT modems.
Internal MISP references
UUID 6108aa3d-ea6e-47fd-9344-d333b07f5a56 which can be used as unique global reference for AcidRain in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.acidrain - webarchive
- https://www.splunk.com/en_us/blog/security/strt-ta03-cpe-destructive-software.html - webarchive
- https://www.techtimes.com/articles/273755/20220331/viasat-hit-russia-s-wiper-malware-called-acidrain-affecting-european.htm - webarchive
- https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat - webarchive
- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ - webarchive
- https://www.bleepingcomputer.com/news/security/viasat-confirms-satellite-modems-were-wiped-with-acidrain-malware/ - webarchive
- https://cybersecurity.att.com/blogs/labs-research/analysis-on-recent-wiper-attacks-examples-and-how-they-wiper-malware-works - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ - webarchive
- https://www.youtube.com/watch?v=mrTdSdMMgnk - webarchive
- https://www.splunk.com/en_us/blog/security/threat-update-acidrain-wiper.html - webarchive
- https://www.reversemode.com/2022/03/viasat-incident-from-speculation-to.html - webarchive
- https://cybersecuritynews.com/acidrain-wiper-malware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AgeLocker
Internal MISP references
UUID 5d04aac3-fdf5-4922-9976-3a5a75e96e1a which can be used as unique global reference for AgeLocker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.age_locker - webarchive
- https://therecord.media/qnap-warns-of-agelocker-ransomware-attacks-against-nas-devices/ - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://twitter.com/IntezerLabs/status/1326880812344676352 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AirDropBot
AirDropBot is used to create a DDoS botnet. It spreads as a worm, currently targeting Linksys routers. Backdoor and other bot functionality is present in this family. Development seems to be ongoing.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular AirDropBot.
| Known Synonyms |
|---|
CloudBot |
Internal MISP references
UUID e91fcb82-e788-44cb-be5d-73b9601b9533 which can be used as unique global reference for AirDropBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Aisuru
Honeypot-aware variant of Mirai.
Internal MISP references
UUID e288425b-40f0-441e-977f-5f1264ed61b6 which can be used as unique global reference for Aisuru in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Akira (ELF)
Ransomware
Internal MISP references
UUID 365081b9-f60d-4484-befa-d4fc9d0f55d7 which can be used as unique global reference for Akira (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AnchorDNS
Backdoor deployed by the TrickBot actors. It uses DNS as the command and control channel as well as for exfiltration of data.
Internal MISP references
UUID b88dc3ec-d94c-4e6e-a846-5d07130df550 which can be used as unique global reference for AnchorDNS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.anchor_dns - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/ - webarchive
- https://us-cert.cisa.gov/sites/default/files/publications/AA20-302A_Ransomware%20_Activity_Targeting_the_Healthcare_and_Public_Health_Sector.pdf - webarchive
- https://cyware.com/news/trickbots-anchordns-is-now-upgraded-to-anchormail-a21f5490/ - webarchive
- https://medium.com/stage-2-security/anchor-dns-malware-family-goes-cross-platform-d807ba13ca30 - webarchive
- https://securityintelligence.com/posts/new-malware-trickbot-anchordns-backdoor-upgrades-anchormail/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://hello.global.ntt/en-us/insights/blog/trickbot-variant-communicating-over-dns - webarchive
- https://mal-eats.net/2021/05/10/campo_new_attack_campaign_targeting_japan/ - webarchive
- https://www.netscout.com/blog/asert/dropping-anchor - webarchive
- https://www.domaintools.com/resources/blog/finding-anchordns-c2s-with-iris-investigate - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ANGRYREBEL
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ANGRYREBEL.
| Known Synonyms |
|---|
Ghost RAT |
Internal MISP references
UUID 6cb47609-b03e-43d9-a4c7-8342f1011f3b which can be used as unique global reference for ANGRYREBEL in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Avoslocker
Internal MISP references
UUID 465b6a74-87ca-4459-b4be-3f8b272f4485 which can be used as unique global reference for Avoslocker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.avoslocker - webarchive
- https://blogs.blackberry.com/en/2022/04/threat-thursday-avoslocker-prompts-advisory-from-fbi-and-fincen - webarchive
- https://blog.qualys.com/vulnerabilities-threat-research/2022/03/06/avoslocker-ransomware-behavior-examined-on-windows-linux - webarchive
- https://blog.cyble.com/2022/01/17/avoslocker-ransomware-linux-version-targets-vmware-esxi-servers/ - webarchive
- https://blog.lexfo.fr/Avoslocker.html - webarchive
- https://www.ic3.gov/Media/News/2022/220318.pdf - webarchive
- https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html - webarchive
- https://blogs.vmware.com/security/2022/02/avoslocker-modern-linux-ransomware-threats.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AVrecon
AVrecon is a Linux-based Remote Access Trojan (RAT) targeting small-office/home-office (SOHO) routers and other ARM-embedded devices. The malware is distributed via exploitation of unpatched vulnerabilities or common misconfiguration of the targeted devices. Once deployed, AVreckon will collect some information about the infected device, open a session to pre-configured C&C server, and spawn a remote shell for command execution. It might also download additional arbitrary files and run them. The malware has recently been used in campaigns aimed at ad-fraud activities, password spraying and data exfiltration.
Internal MISP references
UUID 1b218432-dd5c-4593-8f37-e202f9418fff which can be used as unique global reference for AVrecon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.avrecon - webarchive
- https://spur.us/2023/07/christmas-in-july-a-finely-wrapped-proxy-service/ - webarchive
- https://twitter.com/BlackLotusLabs/status/1684290046235484160 - webarchive
- https://krebsonsecurity.com/2023/07/who-and-what-is-behind-the-malware-proxy-service-socksescort/ - webarchive
- https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
azazel
Azazel is a Linux user-mode rootkit based off of a technique from the Jynx rootkit (LD_PRELOAD technique). Azazel is purportedly more robust than Jynx and has many more anti-analysis features
Internal MISP references
UUID 37374572-3346-4c00-abc9-9f6883c8866e which can be used as unique global reference for azazel in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
B1txor20
B1txor20 is a malware that was discovered by 360 Netlab along others exploiting Log4J. the name is derived from using the file name "b1t", the XOR encrpytion algorithm, and the RC4 algorithm key length of 20 bytes. According to 360 Netlab this Backdoor for Linux platform uses DNS Tunnel to build a C2 communication channel. They also had the assumption that the malware is still in development, because of some bugs and not fully implemented features.
Internal MISP references
UUID 05e6d9ff-93a1-429b-b856-794d9ded75df which can be used as unique global reference for B1txor20 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Babuk (ELF)
ESX and NAS modules for Babuk ransomware.
Internal MISP references
UUID 26b4d805-890b-4767-9d9f-a08adeee1c96 which can be used as unique global reference for Babuk (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.babuk - webarchive
- https://medium.com/s2wlab/blackmatter-x-babuk-using-the-same-web-server-for-sharing-leaked-files-d01c20a74751 - webarchive
- https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/ - webarchive
- https://raw.githubusercontent.com/antonioCoco/infosec-talks/main/InsomniHack_2022_Ransomware_Encryption_Internals.pdf - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/ - webarchive
- https://medium.com/s2wlab/grooves-thoughts-on-blackmatter-babuk-and-interruption-in-the-supply-of-cheese-in-the-b5328bc764f2 - webarchive
- https://www.advintel.io/post/groove-vs-babuk-groove-ransom-manifesto-ramp-underground-platform-secret-inner-workings - webarchive
- https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/how-groove-gang-is-shaking-up-the-ransomware-as-a-service-market-to-empower-affiliates/ - webarchive
- https://marcoramilli.com/2021/07/05/babuk-ransomware-the-builder/ - webarchive
- https://krebsonsecurity.com/2023/05/russian-hacker-wazawaka-indicted-for-ransomware/ - webarchive
- https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html - webarchive
- https://medium.com/s2wlab/groove-x-ramp-the-relation-between-groove-babuk-ramp-and-blackmatter-f75644f8f92d - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Backdoorit
According to Avast Decoded, Backdoorit is a multiplatform RAT written in Go programming language and supporting both Windows and Linux/Unix operating systems. In many places in the code it is also referred to as backd00rit.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Backdoorit.
| Known Synonyms |
|---|
backd00rit |
Internal MISP references
UUID 4a4bc444-9e93-47a6-a572-0e13f743d875 which can be used as unique global reference for Backdoorit in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Irc16
Internal MISP references
UUID 3008fa01-492a-42e2-ab9b-a0a9d12823b8 which can be used as unique global reference for Irc16 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BADCALL (ELF)
BADCALL is a Trojan malware variant used by the group Lazarus Group.
Internal MISP references
UUID 350817e8-4d70-455e-b1fd-000bed4a4cf4 which can be used as unique global reference for BADCALL (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bashlite
Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Bashlite.
| Known Synonyms |
|---|
Gafgyt |
gayfgt |
lizkebab |
qbot |
torlus |
Internal MISP references
UUID 81917a93-6a70-4334-afe2-56904c1fafe9 which can be used as unique global reference for Bashlite in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite - webarchive
- https://unit42.paloaltonetworks.com/new-hoaxcalls-ddos-botnet/ - webarchive
- https://unit42.paloaltonetworks.com/hoaxcalls-mirai-target-legacy-symantec-web-gateways/ - webarchive
- https://blog.netlab.360.com/wo-men-kan-dao-de-wu-ke-lan-bei-ddosgong-ji-xi-jie/ - webarchive
- https://blog.netlab.360.com/the-gafgyt-variant-vbot-and-its-31-campaigns/ - webarchive
- https://unit42.paloaltonetworks.com/cve-2022-22954-vmware-vulnerabilities/ - webarchive
- https://www.uptycs.com/blog/discovery-of-simps-botnet-leads-ties-to-keksec-group - webarchive
- https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/ - webarchive
- https://cybersecurity.att.com/blogs/labs-research/code-similarity-analysis-with-r2diaphora - webarchive
- https://cujo.com/mirai-gafgyt-with-new-ddos-modules-discovered/ - webarchive
- https://unit42.paloaltonetworks.com/unit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2015/KalnaiHorejsi-VB2015.pdf - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ - webarchive
- https://www.nozominetworks.com/blog/could-threat-actors-be-downgrading-their-malware-to-evade-detection/ - webarchive
- https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ - webarchive
- https://maxkersten.nl/binary-analysis-course/malware-analysis/corona-ddos-bot/ - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ - webarchive
- https://www.uptycs.com/blog/mirai-code-re-use-in-gafgyt - webarchive
- https://www.avira.com/en/blog/a-gafgyt-variant-that-exploits-pulse-secure-cve-2020-8218 - webarchive
- https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BCMPUPnP_Hunter
Internal MISP references
UUID d8dd47a5-85fe-4f07-89dc-00301468d209 which can be used as unique global reference for BCMPUPnP_Hunter in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BianLian (ELF)
Internal MISP references
UUID f6be433e-7ed0-4777-876b-e3e2ba7d5c7f which can be used as unique global reference for BianLian (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.bianlian - webarchive
- https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/ - webarchive
- https://rhisac.org/threat-intelligence/bianlian-ransomware-expanding-c2-infrastructure-and-operational-tempo/ - webarchive
- https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BiBi-Linux
According to Security Joes, this malware is an x64 ELF executable, lacking obfuscation or protective measures. It allows attackers to specify target folders and can potentially destroy an entire operating system if run with root permissions. During execution, it produces extensive output, which can be mitigated using the "nohup" command. It also leverages multiple threads and a queue to corrupt files concurrently, enhancing its speed and reach. Its actions include overwriting files, renaming them with a random string containing "BiBi," and excluding certain file types from corruption.
Internal MISP references
UUID efec7bb0-4ec7-4c97-a8a9-28e0fea19852 which can be used as unique global reference for BiBi-Linux in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bifrost
Linux version of the bifrose malware that originally targeted Windows platform only. The backdoor has the ability to perform file management, start or end a process, or start a remote shell. The connection is encrypted using a modified RC4 algorithm.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Bifrost.
| Known Synonyms |
|---|
elf.bifrose |
Internal MISP references
UUID 8fa6dd0e-b630-419f-bd01-5271dd8f27c6 which can be used as unique global reference for Bifrost in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.bifrost - webarchive
- https://cyberandramen.net/2022/12/30/a-quick-look-at-elf-bifrose/ - webarchive
- https://teamt5.org/tw/posts/technical-analysis-on-backdoor-bifrost-of-the-Chinese-apt-group-huapi/ - webarchive
- https://jp.security.ntt/resources/EN-BlackTech_2021.pdf - webarchive
- https://twitter.com/strinsert1Na/status/1595553530579890176 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BigViktor
A DDoS bot abusing CVE-2020-8515 to target DrayTek Vigor routers. It uses a wordlist-based DGA to generate its C&C domains.
Internal MISP references
UUID 901ab128-2d23-41d7-a9e7-6a34e281804e which can be used as unique global reference for BigViktor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BioSet
Internal MISP references
UUID 8e301f58-acef-48e7-ad8b-c27d3ed38eed which can be used as unique global reference for BioSet in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Black Basta (ELF)
ESXi encrypting ransomware, using a combination of the stream cipher ChaCha20 and RSA.
Internal MISP references
UUID 35c86fef-18fe-491c-ad3c-13f98e8f5584 which can be used as unique global reference for Black Basta (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.blackbasta - webarchive
- https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf - webarchive
- https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html - webarchive
- https://quadrantsec.com/resource/technical-analysis/black-basta-malware-overview - webarchive
- https://www.cynet.com/blog/orion-threat-alert-qakbot-ttps-arsenal-and-the-black-basta-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackCat (ELF)
ALPHV, also known as BlackCat or Noberus, is a ransomware family that is deployed as part of Ransomware as a Service (RaaS) operations. ALPHV is written in the Rust programming language and supports execution on Windows, Linux-based operating systems (Debian, Ubuntu, ReadyNAS, Synology), and VMWare ESXi. ALPHV is marketed as ALPHV on cybercrime forums, but is commonly called BlackCat by security researchers due to an icon of a black cat appearing on its leak site. ALPHV has been observed being deployed in ransomware attacks since November 18, 2021.
ALPHV can be configured to encrypt files using either the AES or ChaCha20 algorithms. In order to maximize the amount of ransomed data, ALPHV can delete volume shadow copies, stop processes and services, and stop virtual machines on ESXi servers. ALPHV can self-propagate by using PsExec to remote execute itself on other hosts on the local network.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BlackCat (ELF).
| Known Synonyms |
|---|
ALPHV |
Noberus |
Internal MISP references
UUID 860e9d03-830e-4410-ac89-75b6eb89e7e5 which can be used as unique global reference for BlackCat (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.blackcat - webarchive
- https://twitter.com/sisoma2/status/1473243875158499330 - webarchive
- https://www.forescout.com/resources/analysis-of-an-alphv-incident - webarchive
- https://www.advintel.io/post/blackcat-in-a-shifting-threat-landscape-it-helps-to-land-on-your-feet-tech-dive - webarchive
- https://thehackernews.com/2022/04/researchers-connect-blackcat-ransomware.html - webarchive
- https://x.com/vxunderground/status/1731138180672344095?t=reBMQQFFMGQ_zkV8KmL_LA&s=01 - webarchive
- https://killingthebear.jorgetesta.tech/actors/alphv - webarchive
- https://www.zdnet.com/article/blackcat-ransomware-implicated-in-attack-on-german-oil-companies/ - webarchive
- https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html - webarchive
- https://github.com/rivitna/Malware/tree/main/BlackCat/ALPHV3 - webarchive
- https://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html - webarchive
- https://www.theregister.com/2022/03/22/talos-ransomware-blackcat/ - webarchive
- https://mssplab.github.io/threat-hunting/2023/07/13/malware-analysis-blackcat.html - webarchive
- https://krebsonsecurity.com/2022/01/who-wrote-the-alphv-blackcat-ransomware-strain/ - webarchive
- https://securityintelligence.com/posts/blackcat-ransomware-levels-up-stealth-speed-exfiltration/ - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v - webarchive
- https://www.crowdstrike.com/blog/hypervisor-jackpotting-lack-of-antivirus-support-opens-the-door-to-adversaries/ - webarchive
- https://www.bleepingcomputer.com/news/security/hive-ransomware-ports-its-linux-vmware-esxi-encryptor-to-rust/ - webarchive
- https://www.intrinsec.com/alphv-ransomware-gang-analysis/ - webarchive
- https://securelist.com/a-bad-luck-blackcat/106254/ - webarchive
- https://blog.group-ib.com/blackcat - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/blackcat-ransomware-as-a-service.html - webarchive
- https://www.cisa.gov/sites/default/files/2023-11/aa23-320a_scattered_spider.pdf - webarchive
- https://securelist.com/new-ransomware-trends-in-2022/106457/ - webarchive
- https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/ - webarchive
- https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf - webarchive
- https://www.computerweekly.com/news/252525240/ALPHV-BlackCat-ransomware-family-becoming-more-dangerous - webarchive
- https://securityscorecard.com/research/the-increase-in-ransomware-attacks-on-local-governments - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://blog.emsisoft.com/en/40931/ransomware-profile-alphv/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackMatter (ELF)
Internal MISP references
UUID 1277a4bf-466c-40bc-b000-f55cbd0994a7 which can be used as unique global reference for BlackMatter (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.blackmatter - webarchive
- https://thehackernews.com/2022/04/researchers-connect-blackcat-ransomware.html - webarchive
- https://umbrella.cisco.com/blog/cybersecurity-threat-spotlight-blackmatter-lockbit-thor - webarchive
- https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/darkside-ransomware-rushes-to-cash-out-7-million-in-bitcoin/ - webarchive
- https://blog.group-ib.com/blackmatter# - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa21-291a - webarchive
- https://www.youtube.com/watch?v=NIiEcOryLpI - webarchive
- https://twitter.com/GelosSnake/status/1451465959894667275 - webarchive
- https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html - webarchive
- https://medium.com/s2wlab/blackmatter-x-babuk-using-the-same-web-server-for-sharing-leaked-files-d01c20a74751 - webarchive
- https://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html - webarchive
- https://twitter.com/VK_Intel/status/1423188690126266370 - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-2/ - webarchive
- https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/ - webarchive
- https://www.elliptic.co/blog/darkside-bitcoins-on-the-move-following-government-cyberattack-against-revil-ransomware-group - webarchive
- https://therecord.media/darkside-ransomware-gang-moves-some-of-its-bitcoin-after-revil-got-hit-by-law-enforcement/ - webarchive
- https://medium.com/s2wlab/groove-x-ramp-the-relation-between-groove-babuk-ramp-and-blackmatter-f75644f8f92d - webarchive
- https://www.bleepingcomputer.com/news/security/linux-version-of-blackmatter-ransomware-targets-vmware-esxi-servers/ - webarchive
- https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/ - webarchive
- https://blogs.blackberry.com/en/2021/09/threat-thursday-blackmatter-ransomware-as-a-service - webarchive
- https://medium.com/s2wlab/grooves-thoughts-on-blackmatter-babuk-and-interruption-in-the-supply-of-cheese-in-the-b5328bc764f2 - webarchive
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ - webarchive
- https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-moves-victims-to-lockbit-after-shutdown/ - webarchive
- https://www.mandiant.com/resources/chasing-avaddon-ransomware - webarchive
- https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/how-groove-gang-is-shaking-up-the-ransomware-as-a-service-market-to-empower-affiliates/ - webarchive
- https://blog.group-ib.com/blackmatter2 - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://www.hhs.gov/sites/default/files/demystifying-blackmatter.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Blackrota
Internal MISP references
UUID a30aedcc-562e-437a-827c-55bc00cf3506 which can be used as unique global reference for Blackrota in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.blackrota - webarchive
- https://blog.netlab.360.com/blackrota-an-obfuscated-backdoor-written-in-go-en/ - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://www.kryptoslogic.com/blog/2020/12/automated-string-de-gobfuscation/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackSuit (ELF)
According to Trend Micro, this ransomware has significant code overlap with Royal Ransomware.
Internal MISP references
UUID 5bdbeaae-0def-4547-9940-33ad94060955 which can be used as unique global reference for BlackSuit (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BOLDMOVE (ELF)
According to Mandiant, this malware family is attributed to potential chinese background and directly related to observed exploitation of Fortinet's SSL-VPN (CVE-2022-42475). There is also a Windows variant.
Internal MISP references
UUID 8f347147-c34e-4698-9439-c640233fca15 which can be used as unique global reference for BOLDMOVE (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Break out the Box
This is a pentesting tool and according to the author, "BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies.".
It has been observed being used by TeamTNT in their activities for spreading crypto-mining malware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Break out the Box.
| Known Synonyms |
|---|
BOtB |
Internal MISP references
UUID 57c9ab70-7133-441a-af66-10c0e4eb898b which can be used as unique global reference for Break out the Box in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BotenaGo
According to Alien Labs, this malware targets embedded devices including routers with more than 30 exploits. SourceCode: https://github.com/Egida/kek/blob/19991ef983f838287aa9362b78b4ed8da0929184/loader_multi.go (2021-10-16)
Internal MISP references
UUID dffcc168-cb76-4ae6-b913-c369e92c614b which can be used as unique global reference for BotenaGo in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.botenago - webarchive
- https://cybersecurity.att.com/blogs/labs-research/att-alien-labs-finds-new-golang-malwarebotenago-targeting-millions-of-routers-and-iot-devices-with-more-than-30-exploits - webarchive
- https://lifars.com/2022/01/newly-found-malware-threatens-iot-devices/ - webarchive
- https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealthy-malware-targeting-linux - webarchive
- https://www.nozominetworks.com/blog/new-botenago-variant-discovered-by-nozomi-networks-labs/ - webarchive
- https://cybersecurity.att.com/blogs/labs-research/botenago-strike-again-malware-source-code-uploaded-to-github - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BPFDoor
BPFDoor is a passive backdoor used by a China-based threat actor. This backdoor supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP allowing the threat actor a variety of mechanisms to interact with the implant.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BPFDoor.
| Known Synonyms |
|---|
JustForFun |
Internal MISP references
UUID 3c7082b6-0181-4064-8e35-ab522b49200f which can be used as unique global reference for BPFDoor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.bpfdoor - webarchive
- https://exatrack.com/public/Tricephalic_Hellkeeper.pdf - webarchive
- https://twitter.com/cyb3rops/status/1523227511551033349 - webarchive
- https://blog.qualys.com/vulnerabilities-threat-research/2022/08/01/heres-a-simple-script-to-detect-the-stealthy-nation-state-bpfdoor - webarchive
- https://www.bleepingcomputer.com/news/security/stealthier-version-of-linux-bpfdoor-malware-spotted-in-the-wild/ - webarchive
- https://unfinished.bike/fun-with-the-new-bpfdoor-2023 - webarchive
- https://www.trendmicro.com/en_us/research/23/g/detecting-bpfdoor-backdoor-variants-abusing-bpf-filters.html - webarchive
- https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/ - webarchive
- https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896 - webarchive
- https://twitter.com/CraigHRowland/status/1523266585133457408 - webarchive
- https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/ - webarchive
- https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game - webarchive
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf - webarchive
- https://nikhilh-20.github.io/blog/cbpf_bpfdoor/ - webarchive
- https://www.mandiant.com/resources/blog/chinese-espionage-tactics - webarchive
- https://elastic.github.io/security-research/intelligence/2022/05/04.bpfdoor/article/# - webarchive
- https://troopers.de/troopers22/talks/7cv8pz/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
brute_ratel
Internal MISP references
UUID 2fa4ac4e-3f89-4fd0-b4fd-2c776dcf69d8 which can be used as unique global reference for brute_ratel in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bvp47
Pangu Lab discovered this backdoor during a forensic investigation in 2013. They refer to related incidents as "Operation Telescreen".
Internal MISP references
UUID 0492f9bf-3c5d-4c17-993b-2b53d0fb06f7 which can be used as unique global reference for Bvp47 in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.bvp47 - webarchive
- https://exatrack.com/public/Tricephalic_Hellkeeper.pdf - webarchive
- https://www.pangulab.cn/en/post/the_bvp47_a_top-tier_backdoor_of_us_nsa_equation_group/ - webarchive
- https://www.bleepingcomputer.com/news/security/nsa-linked-bvp47-linux-backdoor-widely-undetected-for-10-years/ - webarchive
- https://thehackernews.com/2022/02/chinese-experts-uncover-details-of.html - webarchive
- https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en.pdf - webarchive
- https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group_ii.en.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Caja
Linux malware cross-compiled for x86, MIPS, ARM. XOR encoded strings, 13 commands supported for its C&C, including downloading, file modification and execution and ability to run shell commands.
Internal MISP references
UUID 06816c22-be7c-44db-8d0d-395ab306bb9b which can be used as unique global reference for Caja in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Caligula
According to Avast Decoded, Caligula is an IRC multiplatform bot that allows to perform DDoS attacks. It is written in Go and distributed in ELF files targeting Intel 32/64bit code, as well as ARM 32bit and PowerPC 64bit. It is based on the Hellabot open source project.
Internal MISP references
UUID c936f24c-c04a-4cab-9ac6-6384a2d4c283 which can be used as unique global reference for Caligula in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Capoae
XMRig-based mining malware written in Go.
Internal MISP references
UUID c1b0528b-c674-4c76-8e1d-5846ba8af261 which can be used as unique global reference for Capoae in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CDorked
This is in the same family as eBury, Calfbot, and is also likely related to DarkLeech
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CDorked.
| Known Synonyms |
|---|
CDorked.A |
Internal MISP references
UUID bb9eaaec-97c9-4014-94dd-129cecf31ff0 which can be used as unique global reference for CDorked in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.cdorked - webarchive
- https://www.symantec.com/security-center/writeup/2013-050214-5501-99 - webarchive
- https://www.welivesecurity.com/2013/05/02/the-stealthiness-of-linuxcdorked-a-clarification/ - webarchive
- https://blogs.cisco.com/security/linuxcdorked-faqs - webarchive
- https://blog.sucuri.net/2014/03/windigo-linux-analysis-ebury-and-cdorked.html - webarchive
- https://www.welivesecurity.com/2013/04/26/linuxcdorked-new-apache-backdoor-in-the-wild-serves-blackhole/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CDRThief
Internal MISP references
UUID 27d06ac9-42c4-433a-b1d7-660710d9e8df which can be used as unique global reference for CDRThief in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cephei
Internal MISP references
UUID baa0704b-50d8-48af-91e1-049f30f422cc which can be used as unique global reference for Cephei in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cetus
Internal MISP references
UUID 7a226df2-9599-4002-9a38-b044e16f76a9 which can be used as unique global reference for Cetus in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chaos (ELF)
Multi-functional malware written in Go, targeting both Linux and Windows, evolved from elf.kaiji.
Internal MISP references
UUID ef03e3c3-32d5-483a-bd1f-97dd531c4bca which can be used as unique global reference for Chaos (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chapro
Internal MISP references
UUID 700366d8-4036-4e48-9a5f-bd6e09fb9b6b which can be used as unique global reference for Chapro in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chisel (ELF)
Chisel is an open-source project by Jaime Pillora (jpillora) that allows tunneling TCP and UDP connections via HTTP. It is available across platforms and written in Go. While benign in itself, Chisel has been utilized by multiple threat actors. It was for example observed by SentinelOne during a PYSA ransomware campaign to achieve persistence and used as backdoor. Github: https://github.com/jpillora/chisel
Internal MISP references
UUID e5600185-39b7-49a0-bd60-a6806c7d47dd which can be used as unique global reference for Chisel (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Clop (ELF)
ELF version of clop ransomware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Clop (ELF).
| Known Synonyms |
|---|
Cl0p |
Internal MISP references
UUID 3d11ec52-9ca8-4d83-99d4-6658f306e8e4 which can be used as unique global reference for Clop (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.clop - webarchive
- https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/ - webarchive
- https://www.sentinelone.com/labs/cl0p-ransomware-targets-linux-systems-with-flawed-encryption-decryptor-available/ - webarchive
- https://www.helpnetsecurity.com/2023/02/07/cl0p-ransomware-decryptor-linux/ - webarchive
- https://www.bleepingcomputer.com/news/security/march-2023-broke-ransomware-attack-records-with-459-incidents/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cloud Snooper
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cloud Snooper.
| Known Synonyms |
|---|
Snoopy |
Internal MISP references
UUID 0b1c514d-f617-4380-a28c-a1ed305a7538 which can be used as unique global reference for Cloud Snooper in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.cloud_snooper - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-cloud-snooper-report.pdf - webarchive
- https://news.sophos.com/wp-content/uploads/2020/02/CloudSnooper_report.pdf - webarchive
- https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/ - webarchive
- https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ConnectBack
ConnectBack malware is a type of malicious software designed to establish unauthorized connections from an infected system to a remote server. Once a victim's device is compromised, ConnectBack creates a covert channel for communication, allowing the attacker to remotely control and gather sensitive information from the compromised system.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ConnectBack.
| Known Synonyms |
|---|
Getshell |
Internal MISP references
UUID 82c57d1b-c11b-44f7-9675-2f0d23fb543f which can be used as unique global reference for ConnectBack in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Conti (ELF)
Ransomware
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Conti (ELF).
| Known Synonyms |
|---|
Conti Locker |
Internal MISP references
UUID c1ab8323-ce61-409a-80f3-b945c8ffcd42 which can be used as unique global reference for Conti (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.conti - webarchive
- https://intel471.com/blog/malware-before-ransomware-trojan-information-stealer-cobalt-strike - webarchive
- https://resources.prodaft.com/wazawaka-report - webarchive
- https://www.advintel.io/post/advintel-s-state-of-emotet-aka-spmtools-displays-over-million-compromised-machines-through-2022 - webarchive
- https://www.secureworks.com/blog/gold-ulrick-continues-conti-operations-despite-public-disclosures - webarchive
- https://securelist.com/new-ransomware-trends-in-2022/106457/ - webarchive
- https://www.justice.gov/opa/pr/multiple-foreign-nationals-charged-connection-trickbot-malware-and-conti-ransomware - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf - webarchive
- https://www.esentire.com/blog/analysis-of-leaked-conti-intrusion-procedures-by-esentires-threat-response-unit-tru - webarchive
- https://damonmccoy.com/papers/Ransomware_eCrime22.pdf - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-group-targets-esxi-hypervisors-with-its-linux-variant.html - webarchive
- https://www.youtube.com/watch?v=cYx7sQRbjGA - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://www.threatstop.com/blog/first-conti-then-hive-costa-rica-gets-hit-with-ransomware-again - webarchive
- https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cpuminer (ELF)
This was observed to be pushed by IoT malware, abusing devices for LiteCoin and BitCoin mining.
Internal MISP references
UUID 8196b6f6-386e-4499-b269-4e5c65f74141 which can be used as unique global reference for Cpuminer (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cr1ptT0r
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cr1ptT0r.
| Known Synonyms |
|---|
CriptTor |
Internal MISP references
UUID 196b20ec-c3d1-4136-ab94-a2a6cc150e74 which can be used as unique global reference for Cr1ptT0r in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.cr1ptt0r - webarchive
- https://www.bleepingcomputer.com/news/security/cr1ptt0r-ransomware-infects-d-link-nas-devices-targets-embedded-systems/ - webarchive
- https://resolverblog.blogspot.com/2019/02/d-link-dns-320-nas-cr1ptt0r-ransomware.html - webarchive
- https://resolverblog.blogspot.com/2019/03/de-cr1pt0r-tool-cr1pt0r-ransomware.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CronRAT
A malware written in Bash that hides in the Linux calendar system on February 31st. Observed in relation to Magecart attacks.
Internal MISP references
UUID c49062cc-ceef-4794-9d8a-93ede434ecfd which can be used as unique global reference for CronRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CyclopsBlink
According to CISA, Cyclops Blink appears to be a replacement framework for the VPNFilter malware exposed in 2018, and which exploited network devices, primarily small office/home office (SOHO) routers and network attached storage (NAS) devices. Cyclops Blink has been deployed since at least June 2019, fourteen months after VPNFilter was disrupted. In common with VPNFilter, Cyclops Blink deployment also appears indiscriminate and widespread. The actor has so far primarily deployed Cyclops Blink to WatchGuard and ASUS devices, but it is likely that Sandworm would be capable of compiling the malware for other architectures and firmware.
Internal MISP references
UUID 76d4b754-e025-41c5-a767-7b00a39bd255 which can be used as unique global reference for CyclopsBlink in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.cyclops_blink - webarchive
- https://inquest.net/blog/2022/04/07/ukraine-cyberwar-overview - webarchive
- https://www.justice.gov/opa/video/attorney-general-merrick-b-garland-announces-enforcement-actions-disrupt-and-prosecute - webarchive
- https://attack.mitre.org/groups/G0034 - webarchive
- https://www.justice.gov/opa/press-release/file/1491281/download - webarchive
- https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-disruption-botnet-controlled-russian-federation - webarchive
- https://www.bleepingcomputer.com/news/security/us-disrupts-russian-cyclops-blink-botnet-before-being-used-in-attacks/ - webarchive
- https://www.bleepingcomputer.com/news/security/asus-warns-of-cyclops-blink-malware-attacks-targeting-routers/ - webarchive
- https://www.theregister.com/2022/03/18/cyclops_asus_routers/ - webarchive
- https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-054a - webarchive
- https://github.com/trendmicro/research/blob/main/cyclops_blink/c2-scripts/check.py - webarchive
- https://www.splunk.com/en_us/blog/security/strt-ta03-cpe-destructive-software.html - webarchive
- https://www.bleepingcomputer.com/news/security/cisa-warns-orgs-of-watchguard-bug-exploited-by-russian-state-hackers/ - webarchive
- https://www.shadowserver.org/news/shadowserver-special-reports-cyclops-blink/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/c/cyclops-blink-sets-sights-on-asus-routers/Appendix_Cyclops%20Blink%20Sets%20Sights%20on%20ASUS%20Routers.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dacls (ELF)
According to PCrisk, Dacls is the name of a remote access Trojan (RAT), a malicious program that allows cyber criminals to control infected computers remotely.
Research shows that this malware is tied to Lazarus Group (a group of cyber criminals) and targets Linux and the Windows Operating System. Typically, cyber criminals use RATs to steal sensitive, confidential information, infect systems with other malware, and so on. In any case, no RAT is harmless and should be uninstalled immediately.
Internal MISP references
UUID 2e5e2a7e-4ee5-4954-9c92-e9b21649ae1b which can be used as unique global reference for Dacls (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.dacls - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://blog.netlab.360.com/dacls-the-dual-platform-rat/ - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://vblocalhost.com/uploads/VB2021-Park.pdf - webarchive
- https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/ - webarchive
- https://www.sygnia.co/mata-framework - webarchive
- https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/ - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/ - webarchive
- https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dark
Mirai variant exploiting CVE-2021-20090 and CVE2021-35395 for spreading.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Dark.
| Known Synonyms |
|---|
Dark.IoT |
Internal MISP references
UUID d499e7ad-332f-4057-b31d-a69916408057 which can be used as unique global reference for Dark in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.dark - webarchive
- https://www.radware.com/getmedia/18d24c2d-c092-4a61-9ad6-ebb92b7a49b8/Alert_Realtek_SDK.aspx - webarchive
- https://www.radware.com/getmedia/d312a5fa-2d8d-4c1e-b31e-73046f24bf35/Alert-Dark-OMIGOD.aspx - webarchive
- https://www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/ - webarchive
- https://blogs.juniper.net/en-us/threat-research/attacks-continue-against-realtek-vulnerabilities - webarchive
- https://twitter.com/ESETresearch/status/1440052837820428298?s=20 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dark Nexus
Internal MISP references
UUID dfba0c8f-9d06-448b-817e-6fffa1b22cb9 which can be used as unique global reference for Dark Nexus in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.darknexus - webarchive
- https://www.stratosphereips.org/blog/2020/6/8/dark-nexus-the-old-the-new-and-the-ugly - webarchive
- https://www.trendmicro.com/en_us/research/21/l/the-evolution-of-iot-linux-malware-based-on-mitre-att&ck-ttps.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkSide (ELF)
Internal MISP references
UUID 61796628-c37b-4284-9aa4-9f054cc6c3c2 which can be used as unique global reference for DarkSide (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.darkside - webarchive
- https://www.maltego.com/blog/chasing-darkside-affiliates-identifying-threat-actors-connected-to-darkside-ransomware-using-maltego-intel-471-1/ - webarchive
- https://pylos.co/2021/05/13/mind-the-air-gap/ - webarchive
- https://www.bleepingcomputer.com/news/security/popular-russian-hacking-forum-xss-bans-all-ransomware-topics/ - webarchive
- https://www.bleepingcomputer.com/news/security/darkside-ransomware-rushes-to-cash-out-7-million-in-bitcoin/ - webarchive
- https://blog.group-ib.com/blackmatter# - webarchive
- https://medium.com/s2wlab/w1-jun-en-story-of-the-week-ransomware-on-the-darkweb-af491d33868b - webarchive
- https://www.guidepointsecurity.com/from-zloader-to-darkside-a-ransomware-story/ - webarchive
- https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf - webarchive
- https://therecord.media/darkside-ransomware-gang-says-it-lost-control-of-its-servers-money-a-day-after-biden-threat/ - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout - webarchive
- https://cybersecurity.att.com/blogs/labs-research/darkside-raas-in-linux-version - webarchive
- https://www.crowdstrike.com/blog/falcon-protects-from-darkside-ransomware/ - webarchive
- https://twitter.com/GelosSnake/status/1451465959894667275 - webarchive
- https://www.youtube.com/watch?v=NIiEcOryLpI - webarchive
- https://www.elliptic.co/blog/elliptic-follows-bitcoin-ransoms-paid-by-darkside-ransomware-victims - webarchive
- https://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/ - webarchive
- https://www.digitalshadows.com/blog-and-research/ransomware-as-a-service-rogue-affiliates-and-whats-next/ - webarchive
- https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/ - webarchive
- https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html - webarchive
- https://therecord.media/popular-hacking-forum-bans-ransomware-ads/ - webarchive
- https://www.bleepingcomputer.com/news/security/darkside-ransomware-servers-reportedly-seized-revil-restricts-targets/ - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/ - webarchive
- https://www.nytimes.com/2021/05/29/world/europe/ransomware-russia-darkside.html - webarchive
- https://www.justice.gov/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside - webarchive
- https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/ - webarchive
- https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/ - webarchive
- https://www.secureworks.com/blog/ransomware-groups-use-tor-based-backdoor-for-persistent-access - webarchive
- https://www.crowdstrike.com/blog/how-ransomware-adversaries-reacted-to-the-darkside-pipeline-attack/ - webarchive
- https://www.elliptic.co/blog/darkside-ransomware-has-netted-over-90-million-in-bitcoin - webarchive
- https://www.elliptic.co/blog/darkside-bitcoins-on-the-move-following-government-cyberattack-against-revil-ransomware-group - webarchive
- https://therecord.media/darkside-ransomware-gang-moves-some-of-its-bitcoin-after-revil-got-hit-by-law-enforcement/ - webarchive
- https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html - webarchive
- https://twitter.com/JAMESWT_MHT/status/1388301138437578757 - webarchive
- https://www.technologyreview.com/2021/05/24/1025195/colonial-pipeline-ransomware-bitdefender/ - webarchive
- https://www.wsj.com/articles/colonial-pipeline-ceo-tells-why-he-paid-hackers-a-4-4-million-ransom-11621435636 - webarchive
- https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/ - webarchive
- https://abcnews.go.com/Politics/biden-speak-colonial-pipeline-attack-americans-face-gasoline/story?id=77666212 - webarchive
- https://blogs.blackberry.com/en/2021/09/threat-thursday-blackmatter-ransomware-as-a-service - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/darkside-ransomware-victims-sold-short/ - webarchive
- https://www.youtube.com/watch?v=qxPXxWMI2i4 - webarchive
- https://www.crowdstrike.com/blog/how-to-defend-against-conti-darkside-revil-and-other-ransomware/ - webarchive
- https://www.bleepingcomputer.com/news/security/darkside-ransomware-made-90-million-in-just-nine-months/ - webarchive
- https://www.databreaches.net/a-former-darkside-listing-shows-up-on-revils-leak-site/ - webarchive
- https://www.ic3.gov/Media/News/2021/211101.pdf - webarchive
- https://blog.gigamon.com/2021/05/17/tracking-darkside-and-ransomware-the-network-view/ - webarchive
- https://securityscorecard.com/blog/new-evidence-supports-assessment-that-darkside-likely-responsible-for-colonial-pipeline-ransomware-attack-others-targeted - webarchive
- https://www.bleepingcomputer.com/news/security/chemical-distributor-pays-44-million-to-darkside-ransomware/ - webarchive
- https://otx.alienvault.com/pulse/60d0afbc395c24edefb33bb9 - webarchive
- https://www.intel471.com/blog/darkside-ransomware-shut-down-revil-avaddon-cybercrime - webarchive
- https://blog.group-ib.com/blackmatter2 - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkRadiation
Internal MISP references
UUID 39be337b-8a9a-4d71-949b-5efd6248fc80 which can be used as unique global reference for DarkRadiation in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DDG
First activity observed in October 2017. DDG is a botnet with P2P capability that is targeting crypto currency mining (Monero).
Internal MISP references
UUID 5c42585b-ea92-4fe2-8a79-bb47a3df67ad which can be used as unique global reference for DDG in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.ddg - webarchive
- https://blog.netlab.360.com/ddg-a-mining-botnet-aiming-at-database-servers/ - webarchive
- https://blog.netlab.360.com/ddg-botnet-round-x-is-there-an-ending/ - webarchive
- https://blog.netlab.360.com/threat-alert-ddg-3013-is-out/ - webarchive
- https://blog.netlab.360.com/ddg-mining-botnet-jin-qi-huo-dong-fen-xi/ - webarchive
- https://blog.netlab.360.com/old-botnets-never-die-and-ddg-refuse-to-fade-away/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ddoor
Internal MISP references
UUID 07f48866-647c-46b0-a0d4-29c81ad488a8 which can be used as unique global reference for ddoor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DEADBOLT
DEADBOLT is a linux ransomware written in Go, targeting QNAP NAS devices worldwide. The files are encrypted with AES128 encryption and will have the .deadbolt extension appended to file names.
Internal MISP references
UUID b37c9ba2-f1b0-4a2f-9387-7310939d2189 which can be used as unique global reference for DEADBOLT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.deadbolt - webarchive
- https://www.bleepingcomputer.com/news/security/new-deadbolt-ransomware-targets-qnap-devices-asks-50-btc-for-master-key/ - webarchive
- https://www.trendmicro.com/en_us/research/22/f/closing-the-door-deadbolt-ransomware-locks-out-vendors-with-mult.html - webarchive
- https://community.riskiq.com/article/1601124b - webarchive
- https://securelist.com/new-ransomware-trends-in-2022/106457/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Denonia
Cado discovered this malware, written in Go and targeting AWS Lambda environments.
Internal MISP references
UUID d5d9bb86-715d-4d86-a4d2-ab73085d1b0c which can be used as unique global reference for Denonia in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Derusbi (ELF)
Internal MISP references
UUID 494dcdfb-88cb-456d-a95a-252ff10c0ba9 which can be used as unique global reference for Derusbi (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dofloo
Dofloo (aka AESDDoS) is a popular malware used to create large scale botnets that can launch DDoS attacks and load cryptocurrency miners to the infected machines.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Dofloo.
| Known Synonyms |
|---|
AESDDoS |
Internal MISP references
UUID ffb5789f-d7e6-4723-a447-e5bb2fe713a0 which can be used as unique global reference for Dofloo in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Doki
Internal MISP references
UUID a5446b35-8613-4121-ada4-c0b1d6f72851 which can be used as unique global reference for Doki in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.doki - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://www.securecoding.com/blog/all-about-doki-malware/ - webarchive
- https://www.intezer.com/container-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DoubleFantasy (ELF)
Internal MISP references
UUID a41d8c89-8229-4936-96c2-4b194ebaf858 which can be used as unique global reference for DoubleFantasy (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DreamBus
Internal MISP references
UUID 22ff8eac-d92e-4c6e-829b-9b565d90eddd which can be used as unique global reference for DreamBus in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ebury
This payload has been used to compromise kernel.org back in August of 2011 and has hit cPanel Support which in turn, has infected quite a few cPanel servers. It is a credential stealing payload which steals SSH keys, passwords, and potentially other credentials.
This family is part of a wider range of tools which are described in detail in the operation windigo whitepaper by ESET.
Internal MISP references
UUID ce79265c-a467-4a17-b27d-7ec7954688d5 which can be used as unique global reference for Ebury in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.ebury - webarchive
- https://www.justice.gov/opa/pr/russian-citizen-pleads-guilty-involvement-global-botnet-conspiracy - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf - webarchive
- https://www.welivesecurity.com/2018/12/05/dark-side-of-the-forsshe/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2014/03/operation_windigo.pdf - webarchive
- https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/ - webarchive
- https://www.welivesecurity.com/2017/10/30/windigo-ebury-update-2/ - webarchive
- https://www.welivesecurity.com/2014/10/15/operation-windigo-good-job-eset-says-malware-author/ - webarchive
- https://csirt.gov.it/data/cms/posts/582/attachments/66ca2e9a-68cd-4df5-81a2-674c31a699c2/download - webarchive
- https://security.web.cern.ch/security/advisories/windigo/windigo.shtml - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Echobot
The latest in this long line of Mirai scourges is a new variant named Echobot. Coming to life in mid-May, the malware was first described by Palo Alto Networks in a report published at the start of June, and then again in a report by security researchers from Akamai, in mid-June.
When it was first spotted by Palo Alto Networks researchers in early June, Echobot was using exploits for 18 vulnerabilities. In the Akamai report, a week later, Echobot was at 26.
https://www.zdnet.com/article/new-echobot-malware-is-a-smorgasbord-of-vulnerabilities
Internal MISP references
UUID 040ac9c6-e3ab-4b51-88a9-5380101c74f8 which can be used as unique global reference for Echobot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.echobot - webarchive
- https://www.f5.com/labs/articles/threat-intelligence/echobot-malware-now-up-to-71-exploits--targeting-scada - webarchive
- https://unit42.paloaltonetworks.com/new-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices/ - webarchive
- https://blogs.akamai.com/sitr/2019/06/latest-echobot-26-infection-vectors.html - webarchive
- https://unit42.paloaltonetworks.com/mirai-variant-echobot-resurfaces-with-13-previously-unexploited-vulnerabilities/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-echobot-botnet-variant-uses-over-50-exploits-to-propagate/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EnemyBot
According to the Infosec Institute, EnemyBot is a dangerous IoT botnet that has made headlines in the last few weeks. This threat, which seems to be disseminated by the Keksec group, expanded its features by adding recent vulnerabilities discovered in 2022. It was designed to attack web servers, Android devices and content management systems (CMS) servers.
Internal MISP references
UUID 262d18be-7cab-46c2-bcb0-47fff17604aa which can be used as unique global reference for EnemyBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.enemybot - webarchive
- https://www.securonix.com/blog/detecting-the-enemybot-botnet-advisory - webarchive
- https://www.fortinet.com/blog/threat-research/enemybot-a-look-into-keksecs-latest-ddos-botnet - webarchive
- https://www.securonix.com/blog/detecting-the-enemybot-botnet-advisory/ - webarchive
- https://cybersecurity.att.com/blogs/labs-research/rapidly-evolving-iot-malware-enemybot-now-targeting-content-management-system-servers - webarchive
- https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealthy-malware-targeting-linux - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Erebus (ELF)
Internal MISP references
UUID 479353aa-c6d7-47a7-b5f0-3f97fd904864 which can be used as unique global reference for Erebus (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.erebus - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/erebus-resurfaces-as-linux-ransomware/ - webarchive
- https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ESXiArgs
Ransomware used to target ESXi servers.
Internal MISP references
UUID 7550af7f-91cc-49e7-a4c5-d4e4d993cbef which can be used as unique global reference for ESXiArgs in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.esxi_args - webarchive
- https://blog.ovhcloud.com/ransomware-targeting-vmware-esxi/ - webarchive
- https://www.youtube.com/watch?v=bBcvqxPdjoI - webarchive
- https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/ - webarchive
- https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EvilGnome
According to Infosec Institute, EvilGnome presents itself to unwitting Linux users as a legitimate GNOME extension. Legitimate extensions help to extend Linux functionality, but instead of a healthy boost in system functionality, EvilGnome begins spying on users with an array of functionalities uncommon for most Linux malware types.
Internal MISP references
UUID 149e693c-4b51-4143-9061-6a8698b0e7f5 which can be used as unique global reference for EvilGnome in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.evilgnome - webarchive
- https://www.intezer.com/blog-evilgnome-rare-malware-spying-on-linux-desktop-users/ - webarchive
- https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought - webarchive
- https://ssu.gov.ua/uploads/files/DKIB/Technical%20report%20Armagedon.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EwDoor
Internal MISP references
UUID e75eb723-7c23-4a3b-9419-cefb88e5f6b7 which can be used as unique global reference for EwDoor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Exaramel (ELF)
Internal MISP references
UUID 1e0540f3-bad3-403f-b8ed-ce40a276559e which can be used as unique global reference for Exaramel (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.exaramel - webarchive
- https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/ - webarchive
- https://www.domaintools.com/resources/blog/centreon-to-exim-and-back-on-the-trail-of-sandworm - webarchive
- https://attack.mitre.org/groups/G0034 - webarchive
- https://twitter.com/craiu/status/1361581668092493824 - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf - webarchive
- https://pylos.co/wp-content/uploads/2020/02/Threat-Intelligence-and-the-Limits-of-Malware-Analysis.pdf - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/04/ESET_Industry_Report_Government.pdf - webarchive
- https://www.wired.com/story/sandworm-centreon-russia-hack/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ext4
Internal MISP references
UUID 79b2b3c0-6119-4511-9c33-2a48532b6a60 which can be used as unique global reference for ext4 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Facefish
Internal MISP references
UUID 106487ea-a710-4546-bd62-bdbfa0b0447e which can be used as unique global reference for Facefish in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FBot
Internal MISP references
UUID 501e5434-5796-4d63-8539-d99ec48119c2 which can be used as unique global reference for FBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.fbot - webarchive
- https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html - webarchive
- https://blog.malwaremustdie.org/2020/01/mmd-0065-2020-linuxmirai-fbot.html - webarchive
- https://securitynews.sonicwall.com/xmlpost/vigilante-malware-removes-cryptominers-from-the-infected-device/ - webarchive
- https://blog.netlab.360.com/fbot-is-now-riding-the-traffic-and-transportation-smart-devices-en/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FinFisher (ELF)
Internal MISP references
UUID 44018d71-25fb-4959-b61e-d7af97c85131 which can be used as unique global reference for FinFisher (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.finfisher - webarchive
- https://netzpolitik.org/2020/our-criminal-complaint-german-state-malware-company-finfisher-raided/ - webarchive
- https://securelist.com/finspy-unseen-findings/104322/ - webarchive
- https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
floodor
Internal MISP references
UUID ac30f2be-8153-4588-b29c-5e5863792930 which can be used as unique global reference for floodor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Fodcha
Malware used to run a DDoS botnet.
Internal MISP references
UUID 4a64a1ca-e5bc-4a27-bff2-1c68cea05ba7 which can be used as unique global reference for Fodcha in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FontOnLake
This family utilizes custom modules allowing for remote access, credential harvesting (e.g. by modifying sshd) and proxy usage.
It comes with a rootkit as well.
Internal MISP references
UUID c530d62b-e49f-4ccf-9c87-d9f6c16617b7 which can be used as unique global reference for FontOnLake in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FritzFrog
Guardicore has discovered FritzFrog, a sophisticated peer-to-peer (P2P) botnet which has been actively breaching SSH servers since January 2020. It is a worm which is written in Golang, and is modular, multi-threaded and fileless, leaving no trace on the infected machine’s disk.
Internal MISP references
UUID b43b7b4a-9cf4-4f98-b4d2-617a7d84bfa7 which can be used as unique global reference for FritzFrog in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.fritzfrog - webarchive
- https://www.guardicore.com/2020/08/fritzfrog-p2p-botnet-infects-ssh-servers/ - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://blog.netlab.360.com/p2p-botnets-review-status-continuous-monitoring/ - webarchive
- https://www.securityweek.com/sophisticated-fritzfrog-p2p-botnet-returns-after-long-break - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://www.akamai.com/blog/security/fritzfrog-p2p - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gitpaste-12
Gitpaste-12 is a modular malware first observed in October 2020 targeting Linux based x86 servers, as well as Linux ARM and MIPS based IoT devices. It uses GitHub and Pastebin as dead drop C2 locations.
Internal MISP references
UUID ffd09324-b585-49c0-97e5-536d386f49a5 which can be used as unique global reference for Gitpaste-12 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Glupteba Proxy
ARM32 SOCKS proxy, written in Go, used in the Glupteba campaign.
Internal MISP references
UUID bcfec1d3-ff29-4677-a5f6-be285e98a9db which can be used as unique global reference for Glupteba Proxy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GobRAT
Internal MISP references
UUID ddba032c-ebde-4736-b7ef-8376702dac6a which can be used as unique global reference for GobRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Godlua
Internal MISP references
UUID f3cb0a78-1608-44b1-9949-c6addf6c13ce which can be used as unique global reference for Godlua in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GOSH
Internal MISP references
UUID 931f57f9-1edd-47b8-bf80-ae7190434558 which can be used as unique global reference for GOSH in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GoTitan
GoTitan is a DDoS bot under development, which support ten different methods of launching distributed denial-of-service (DDoS) attacks: UDP, UDP HEX, TCP, TLS, RAW, HTTP GET, HTTP POST, HTTP HEAD, and HTTP PUT.
Internal MISP references
UUID 92007a5e-d408-4c95-b4c2-7b4e4e29559e which can be used as unique global reference for GoTitan in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GreedyAntd
Internal MISP references
UUID 6aee7daf-9f63-4a70-bfe5-9c95cbdcb1e3 which can be used as unique global reference for GreedyAntd in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gwisin (ELF)
Internal MISP references
UUID c02d252d-95cc-45bc-adb6-bae51b16c55b which can be used as unique global reference for Gwisin (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HabitsRAT (ELF)
Internal MISP references
UUID e87e7f26-f2a1-437f-8650-312050e3cd48 which can be used as unique global reference for HabitsRAT (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Haiduc
Internal MISP references
UUID dd85732f-cbf8-4f2c-af5c-f51ef7d99b6a which can be used as unique global reference for Haiduc in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hajime
Internal MISP references
UUID ff8ee85f-4175-4f5a-99e5-0cbc378f1489 which can be used as unique global reference for Hajime in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.hajime - webarchive
- https://security.radware.com/WorkArea/DownloadAsset.aspx?id=1461 - webarchive
- http://blog.netlab.360.com/hajime-status-report-en/ - webarchive
- https://blog.netlab.360.com/quick-summary-port-8291-scan-en/ - webarchive
- https://blog.netlab.360.com/p2p-botnets-review-status-continuous-monitoring/ - webarchive
- https://www.symantec.com/connect/blogs/hajime-worm-battles-mirai-control-internet-things - webarchive
- https://par.nsf.gov/servlets/purl/10096257 - webarchive
- https://x86.re/blog/hajime-a-follow-up/ - webarchive
- https://github.com/Psychotropos/hajime_hashes - webarchive
- https://security.rapiditynetworks.com/publications/2016-10-16/hajime.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hakai
Internal MISP references
UUID 0839c28a-ea11-44d4-93d1-24b246ef6743 which can be used as unique global reference for Hakai in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HandyMannyPot
Internal MISP references
UUID 0b323b91-ad57-4127-99d1-6a2485be70df which can be used as unique global reference for HandyMannyPot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hand of Thief
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Hand of Thief.
| Known Synonyms |
|---|
Hanthie |
Internal MISP references
UUID db3e17f0-677b-4bdb-bc26-25e62a74673d which can be used as unique global reference for Hand of Thief in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.hand_of_thief - webarchive
- https://web.archive.org/web/20130815040638/https://blogs.rsa.com/thieves-reaching-for-linux-hand-of-thief-trojan-targets-linux-inth3wild/ - webarchive
- https://blog.avast.com/2013/08/27/linux-trojan-hand-of-thief-ungloved/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HelloBot (ELF)
Internal MISP references
UUID b9fec670-2b1e-4287-ac93-68360d5adcf4 which can be used as unique global reference for HelloBot (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HelloKitty (ELF)
Linux version of the HelloKitty ransomware.
Internal MISP references
UUID 785cadf7-5c99-40bc-b718-8a98d9aa90b7 which can be used as unique global reference for HelloKitty (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.hellokitty - webarchive
- https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/linux-version-of-hellokitty-ransomware-targets-vmware-esxi-servers/ - webarchive
- https://soolidsnake.github.io/2021/07/17/hellokitty_linux.html - webarchive
- https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/ - webarchive
- https://blog.sekoia.io/vice-society-a-discreet-but-steady-double-extortion-ransomware-group - webarchive
- https://www.govinfosecurity.com/vice-society-ransomware-gang-disrupted-spar-stores-a-18225 - webarchive
- https://blog.sekoia.io/vice-society-a-discreet-but-steady-double-extortion-ransomware-group/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://www.esentire.com/blog/conti-affiliate-exposed-new-domain-names-ip-addresses-and-email-addresses-uncovered-by-esentire - webarchive
- https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html - webarchive
- https://unit42.paloaltonetworks.com/emerging-ransomware-groups/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HiatusRAT
Lumen discovered this malware used in campaign targeting business-grade routers using a RAT they call HiatusRAT and a variant of tcpdump for traffic interception.
Internal MISP references
UUID 69dcee87-dc61-48d4-a6af-177396bdb850 which can be used as unique global reference for HiatusRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HiddenWasp
HiddenWasp is a Linux-based Trojan used to target systems for remote control. It comes in the form of a statically linked ELF binary with stdlibc++.
Internal MISP references
UUID ae00d48d-c515-4ca9-a29c-8c53a78f8c73 which can be used as unique global reference for HiddenWasp in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.hiddenwasp - webarchive
- https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/ - webarchive
- https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/ - webarchive
- https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hide and Seek
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Hide and Seek.
| Known Synonyms |
|---|
HNS |
Internal MISP references
UUID 41bf8f3e-bb6a-445d-bb74-d08aae61a94b which can be used as unique global reference for Hide and Seek in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.hideandseek - webarchive
- https://www.bleepingcomputer.com/news/security/new-hns-iot-botnet-has-already-amassed-14k-bots/ - webarchive
- https://unit42.paloaltonetworks.com/hide-n-seek-botnet-updates-arsenal-with-exploits-against-nexus-repository-manager-thinkphp/ - webarchive
- https://threatlabs.avast.com/botnet - webarchive
- https://blog.avast.com/hide-n-seek-botnet-continues - webarchive
- https://labs.bitdefender.com/2018/01/new-hide-n-seek-iot-botnet-using-custom-built-peer-to-peer-communication-spotted-in-the-wild/ - webarchive
- https://blog.netlab.360.com/hns-botnet-recent-activities-en/ - webarchive
- https://www.bleepingcomputer.com/news/security/hns-evolves-from-iot-to-cross-platform-botnet/ - webarchive
- https://labs.bitdefender.com/2018/05/hide-and-seek-iot-botnet-resurfaces-with-new-tricks-persistence/ - webarchive
- https://www.fortinet.com/blog/threat-research/searching-for-the-reuse-of-mirai-code--hide--n-seek-bot.html - webarchive
- https://www.bleepingcomputer.com/news/security/hide-and-seek-becomes-first-iot-botnet-capable-of-surviving-device-reboots/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HinataBot
HinataBot is a Go-based DDoS-focused botnet. It was observed in the first quarter of 2023 targeting HTTP and SSH endpoints leveraging old vulnerabilities and weak credentials. Amongst those infection vectors are exploitation of the miniigd SOAP service on Realtek SDK devices (CVE-2014-8361), Huawei HG532 routers (CVE-2017-17215), and exposed Hadoop YARN servers.
Internal MISP references
UUID b10fc382-b740-417a-98fa-e23d10223958 which can be used as unique global reference for HinataBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hipid
Internal MISP references
UUID d55eb2f1-e24d-4b50-9839-2e53b5059bae which can be used as unique global reference for Hipid in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hive (ELF)
Internal MISP references
UUID c22452c8-c818-4577-9737-0b87342c7913 which can be used as unique global reference for Hive (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.hive - webarchive
- https://therecord.media/academics-publish-method-for-recovering-data-encrypted-by-the-hive-ransomware/ - webarchive
- https://www.threatstop.com/blog/first-conti-then-hive-costa-rica-gets-hit-with-ransomware-again - webarchive
- https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html - webarchive
- https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-april-1st-2022-i-can-fight-with-a-keyboard/ - webarchive
- https://yoroi.company/research/on-the-footsteps-of-hive-ransomware/ - webarchive
- https://securityaffairs.co/wordpress/128232/security/recover-files-hive-ransomware.html - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v - webarchive
- https://arxiv.org/pdf/2202.08477.pdf - webarchive
- https://yoroi.company/wp-content/uploads/2022/07/Yoroi-On-The-Footsteps-of-Hive-Ransomware.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/hive-ransomware-ports-its-linux-vmware-esxi-encryptor-to-rust/ - webarchive
- https://therecord.media/hive-ransomware-shuts-down-california-health-care-organization/ - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf - webarchive
- https://twitter.com/ESETresearch/status/1454100591261667329 - webarchive
- https://twitter.com/malwrhunterteam/status/1455628865229950979 - webarchive
- https://krebsonsecurity.com/2023/05/russian-hacker-wazawaka-indicted-for-ransomware/ - webarchive
- https://github.com/reecdeep/HiveV5_file_decryptor - webarchive
- https://github.com/rivitna/Malware/tree/main/Hive - webarchive
- https://lifars.com/2022/02/how-to-decrypt-the-files-encrypted-by-the-hive-ransomware/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-hive - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://thehackernews.com/2022/02/master-key-for-hive-ransomware.html - webarchive
- https://blog.group-ib.com/hive - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Horse Shell
Checkpoint Research describes this as part of a custom firmware image affiliated with the Chinese state-sponsored actor “Camaro Dragon”, a custom MIPS32 ELF implant. HorseShell, the main implant inserted into the modified firmware by the attackers, provides the attacker with 3 main functionalities: * Remote shell: Execution of arbitrary shell commands on the infected router * File transfer: Upload and download files to and from the infected router. * SOCKS tunneling: Relay communication between different clients.
Internal MISP references
UUID 9d04d96a-92fd-4731-a3b5-a3fdafd3e523 which can be used as unique global reference for Horse Shell in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hubnr
Internal MISP references
UUID c55389b0-e778-4cf9-9030-3d1efc1224c9 which can be used as unique global reference for Hubnr in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HyperSSL (ELF)
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HyperSSL (ELF).
| Known Synonyms |
|---|
SysUpdate |
Internal MISP references
UUID 263aaef5-9758-49f1-aff1-9a509f545bb3 which can be used as unique global reference for HyperSSL (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
iceFire
Internal MISP references
UUID c03b2f7f-31ed-4133-b947-4b8846d90f19 which can be used as unique global reference for iceFire in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Icnanker
Internal MISP references
UUID cd9f128b-6502-4e1b-a5b3-25f3c7f01ca3 which can be used as unique global reference for Icnanker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
INC
Internal MISP references
UUID fa3f90a3-40e3-4636-90f9-3e02bf645afd which can be used as unique global reference for INC in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IoT Reaper
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular IoT Reaper.
| Known Synonyms |
|---|
IoTroop |
Reaper |
iotreaper |
Internal MISP references
UUID 37c357a1-ec09-449f-b5a9-c1ef1fba2de2 which can be used as unique global reference for IoT Reaper in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.iot_reaper - webarchive
- http://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/ - webarchive
- https://krebsonsecurity.com/2017/10/reaper-calm-before-the-iot-security-storm - webarchive
- https://research.checkpoint.com/new-iot-botnet-storm-coming/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IPStorm (ELF)
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular IPStorm (ELF).
| Known Synonyms |
|---|
InterPlanetary Storm |
Internal MISP references
UUID a24f9c4b-1fa7-4da2-9929-064345389e67 which can be used as unique global reference for IPStorm (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.ipstorm - webarchive
- https://maldbg.com/ipstorm-golang-malware-windows - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://www.justice.gov/usao-pr/pr/russian-and-moldovan-national-pleads-guilty-operating-illegal-botnet-proxy-service - webarchive
- https://www.anomali.com/blog/the-interplanetary-storm-new-malware-in-wild-using-interplanetary-file-systems-ipfs-p2p-network - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://www.intezer.com/blog/research/a-storm-is-brewing-ipstorm-now-has-linux-malware/ - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/376/Bitdefender-Whitepaper-IPStorm.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IZ1H9
ccording to Fortinet, this is a Mirai-based DDoS botnet.
Internal MISP references
UUID 6e98a149-9ce2-4750-9680-69f3ced5f33e which can be used as unique global reference for IZ1H9 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JenX
Internal MISP references
UUID 6a4365fc-8448-4270-ba93-0341788d004b which can be used as unique global reference for JenX in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kaiji
Surfaced in late April 2020, Intezer describes Kaiji as a DDoS malware written in Go that spreads through SSH brute force attacks. Recovered function names are an English representation of Chinese words, hinting about the origin. The name Kaiji was given by MalwareMustDie based on strings found in samples.
Internal MISP references
UUID 33fe7943-c1b3-48d5-b287-126390b091f0 which can be used as unique global reference for Kaiji in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.kaiji - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers/ - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/ - webarchive
- https://www.ibm.com/downloads/cas/WMDZOWK6?social_post=5483919673&linkId=131648775 - webarchive
- https://www.bitdefender.com/box/blog/iot-news/kaiji-new-strain-iot-malware-seizing-control-launching-ddos-attacks/ - webarchive
- https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kaiten
According to netenrich, Kaiten is a Trojan horse that opens a back door on the compromised computer that allows it to perform other malicious activities. The trojan does not create any copies of itself. This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Kaiten.
| Known Synonyms |
|---|
STD |
Internal MISP references
UUID 9b618703-58f6-4f0b-83a4-d4f13e2e5d12 which can be used as unique global reference for Kaiten in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.kaiten - webarchive
- https://www.trendmicro.com/en_us/research/20/i/exposed-docker-server-abused-to-drop-cryptominer-ddos-bot-.html - webarchive
- https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/kaiten-std-router-ddos-malware-threat-advisory.pdf - webarchive
- https://www.lacework.com/blog/the-kek-security-network/ - webarchive
- https://www.blackarrow.net/attackers-abuse-mobileirons-rce-to-deliver-kaiten/ - webarchive
- https://www.lacework.com/the-kek-security-network/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/apache-log4j-zero-day - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
kerberods
Internal MISP references
UUID e3787d95-2595-449e-8cf9-90845a9b7444 which can be used as unique global reference for kerberods in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.kerberods - webarchive
- https://blog.talosintelligence.com/2019/09/watchbog-patching.html - webarchive
- https://www.fortinet.com/blog/threat-research/rocke-variant-ready-to-box-mining-challengers.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/cve-2019-3396-redux-confluence-vulnerability-exploited-to-deliver-cryptocurrency-miner-with-rootkit/ - webarchive
- https://isc.sans.edu/forums/diary/Vulnerable+Apache+Jenkins+exploited+in+the+wild/24916 - webarchive
- https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KEYPLUG
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular KEYPLUG.
| Known Synonyms |
|---|
ELFSHELF |
Internal MISP references
UUID 2c4bfc14-3ea4-4ced-806a-fcac30b2a9d7 which can be used as unique global reference for KEYPLUG in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.keyplug - webarchive
- https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0330.pdf - webarchive
- https://twitter.com/CyberJack42/status/1501290277864046595 - webarchive
- https://www.sentinelone.com/labs/sandman-apt-china-based-adversaries-embrace-lua/ - webarchive
- https://experience.mandiant.com/trending-evil/p/1 - webarchive
- https://www.mandiant.com/resources/mobileiron-log4shell-exploitation - webarchive
- https://www.mandiant.com/resources/apt41-us-state-governments - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
kfos
Internal MISP references
UUID 5e353bc2-4d32-409b-aeb6-c7df32607c56 which can be used as unique global reference for kfos in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kinsing
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Kinsing.
| Known Synonyms |
|---|
h2miner |
Internal MISP references
UUID ef0e3a56-e614-4dc1-bb20-0dcf7215c1ea which can be used as unique global reference for Kinsing in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.kinsing - webarchive
- https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf - webarchive
- https://www.cadosecurity.com/analysis-of-initial-in-the-wild-attacks-exploiting-log4shell-log4j-cve-2021-44228/ - webarchive
- https://www.ibm.com/downloads/cas/WMDZOWK6?social_post=5483919673&linkId=131648775 - webarchive
- https://unit42.paloaltonetworks.com/atoms/moneylibra/ - webarchive
- https://www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/ - webarchive
- https://www.cyberark.com/resources/threat-research-blog/kinsing-the-malware-with-two-faces - webarchive
- https://www.trendmicro.com/en_us/research/22/i/a-post-exploitation-look-at-coinminers-abusing-weblogic-vulnerab.html - webarchive
- https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability - webarchive
- https://www.trendmicro.com/en_us/research/20/k/analysis-of-kinsing-malwares-use-of-rootkit.html - webarchive
- https://sysdig.com/blog/zoom-into-kinsing-kdevtmpfsi/ - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://www.zscaler.com/blogs/security-research/threatlabz-analysis-log4shell-cve-2021-44228-exploit-attempts - webarchive
- https://www.bleepingcomputer.com/news/security/log4shell-exploits-now-used-mostly-for-ddos-botnets-cryptominers/ - webarchive
- https://medium.com/s2wblog/logs-of-log4shell-cve-2021-44228-log4j-is-ubiquitous-en-809064312039 - webarchive
- https://twitter.com/IntezerLabs/status/1259818964848386048 - webarchive
- https://www.trendmicro.com/en_us/research/21/g/threat-actors-exploit-misconfigured-apache-hadoop-yarn.html - webarchive
- https://redcanary.com/blog/kinsing-malware-citrix-saltstack/ - webarchive
- https://unit42.paloaltonetworks.com/cve-2020-25213/ - webarchive
- https://blog.aquasec.com/kinsing-malware-exploits-novel-openfire-vulnerability - webarchive
- https://www.alibabacloud.com/blog/new-outbreak-of-h2miner-worms-exploiting-redis-rce-detected_595743 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KIVARS (ELF)
Internal MISP references
UUID e8b24118-4ce8-471b-8683-1077a0f5f2a9 which can be used as unique global reference for KIVARS (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kobalos
Internal MISP references
UUID 201d54ae-7fb0-4522-888c-758fa9019737 which can be used as unique global reference for Kobalos in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.kobalos - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/05/eset_threat_report_t12021.pdf - webarchive
- https://team-cymru.com/blog/2021/02/05/kobalos-malware-mapping/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf - webarchive
- https://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Krasue RAT
Internal MISP references
UUID b111325d-dd90-47cc-8777-fcb7e610a76e which can be used as unique global reference for Krasue RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lady
Internal MISP references
UUID f8b91c34-b4f0-4ef2-b9fb-15bd5ec0a66d which can be used as unique global reference for Lady in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LeetHozer
Internal MISP references
UUID e9f2857a-cb91-4715-ac8b-fdc89bc9a03e which can be used as unique global reference for LeetHozer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lightning Framework
Internal MISP references
UUID 927bc8fc-fef4-4331-877d-18bcd33bdf9c which can be used as unique global reference for Lightning Framework in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LiLock
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular LiLock.
| Known Synonyms |
|---|
Lilocked |
Lilu |
Internal MISP references
UUID 1328ed0d-9c1c-418b-9a96-1c538e4893bc which can be used as unique global reference for LiLock in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.lilock - webarchive
- https://id-ransomware.blogspot.com/2019/07/lilu-lilocked-ransomware.html - webarchive
- https://www.bleepingcomputer.com/news/security/lilocked-ransomware-actively-targeting-servers-and-web-sites/ - webarchive
- https://fossbytes.com/lilocked-ransomware-infected-linux-servers/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
lilyofthevalley
Internal MISP references
UUID f789442f-8f50-4e55-8fbc-b93d22b5314e which can be used as unique global reference for lilyofthevalley in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LiquorBot
BitDefender tracked the development of a Mirai-inspired botnet, dubbed LiquorBot, which seems to be actively in development and has recently incorporated Monero cryptocurrency mining features. Interestingly, LiquorBot is written in Go (also known as Golang), which offers some programming advantages over traditional C-style code, such as memory safety, garbage collection, structural typing, and even CSP-style concurrency.
Internal MISP references
UUID 3fe8f3db-4861-4e78-8b60-a794fe22ae3f which can be used as unique global reference for LiquorBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LockBit (ELF)
Internal MISP references
UUID afce6aba-d4c4-49fa-b9a9-1a70e92e5a0e which can be used as unique global reference for LockBit (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.lockbit - webarchive
- https://security.packt.com/understanding-lockbit/ - webarchive
- https://www.bleepingcomputer.com/news/security/lockbit-victim-estimates-cost-of-ransomware-attack-to-be-42-million/ - webarchive
- https://blog.compass-security.com/2022/03/vpn-appliance-forensics/ - webarchive
- https://www.dragos.com/blog/industry-news/dragos-ics-ot-ransomware-analysis-q4-2021/ - webarchive
- https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html - webarchive
- https://lifars.com/wp-content/uploads/2022/02/LockBitRansomware_Whitepaper.pdf - webarchive
- https://www.ic3.gov/Media/News/2022/220204.pdf - webarchive
- https://analyst1.com/ransomware-diaries-volume-1/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html - webarchive
- https://medium.com/@lcam/lighting-the-exfiltration-infrastructure-of-a-lockbit-affiliate-and-more-f57fbb7a4e79 - webarchive
- https://analyst1.com/ransomware-diaries-volume-3-lockbits-secrets/ - webarchive
- https://github.com/prodaft/malware-ioc/tree/master/PTI-257 - webarchive
- https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/ - webarchive
- https://www.crowdstrike.com/blog/better-together-global-attitude-survey-takeaways-2021/ - webarchive
- https://krebsonsecurity.com/2023/05/russian-hacker-wazawaka-indicted-for-ransomware/ - webarchive
- https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html - webarchive
- https://www.fortinet.com/blog/threat-research/ransomware-roundup-new-variants - webarchive
- https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf - webarchive
- https://securelist.com/crimeware-report-lockbit-switchsymb/110068/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://socradar.io/lockbit-3-another-upgrade-to-worlds-most-active-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Loerbas
Loader and Cleaner components used in attacks against high-performance computing centers in Europe.
Internal MISP references
UUID 6332d57c-c46f-4907-8dac-965b15ffbed6 which can be used as unique global reference for Loerbas in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Log Collector
Internal MISP references
UUID 0473214a-2daa-4b5b-84bc-1bcbab11ef80 which can be used as unique global reference for Log Collector in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lootwodniw
Internal MISP references
UUID cfcf8608-03e7-4a5b-a46c-af342db2d540 which can be used as unique global reference for Lootwodniw in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Luna
ESXi encrypting ransomware written in Rust.
Internal MISP references
UUID bc9022d6-ee65-463f-9823-bc0f96963a75 which can be used as unique global reference for Luna in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Manjusaka (ELF)
Cisco Talos compared this RAT to Cobalt Strike and Sliver. Written in Rust.
Internal MISP references
UUID cd3a3a96-af66-4470-8115-b8bf3eef005a which can be used as unique global reference for Manjusaka (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Masuta
Masuta takes advantage of the EDB 38722 D-Link exploit.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Masuta.
| Known Synonyms |
|---|
PureMasuta |
Internal MISP references
UUID b9168ff8-01df-4cd0-9f70-fe9e7a11eccd which can be used as unique global reference for Masuta in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.masuta - webarchive
- https://threatpost.com/satori-author-linked-to-new-mirai-variant-masuta/129640/ - webarchive
- https://www.virusbulletin.com/virusbulletin/2018/12/vb2018-paper-tracking-mirai-variants/#h2-appendix-sample-sha256-hashes - webarchive
- https://blog.newskysecurity.com/masuta-satori-creators-second-botnet-weaponizes-a-new-router-exploit-2ddc51cc52a7 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Matryosh
Internal MISP references
UUID 4e989704-c49f-468c-95e1-1b7c5a58b3c4 which can be used as unique global reference for Matryosh in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Melofee
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Melofee.
| Known Synonyms |
|---|
Mélofée |
Internal MISP references
UUID 1ffd85bd-389c-4e04-88fd-8186423c3691 which can be used as unique global reference for Melofee in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MESSAGETAP
MESSAGETAP is a 64-bit ELF data miner initially loaded by an installation script. It is designed to monitor and save SMS traffic from specific phone numbers, IMSI numbers and keywords for subsequent theft.
Internal MISP references
UUID a07d6748-3557-41ac-b55b-f4348dc2a3c7 which can be used as unique global reference for MESSAGETAP in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.messagetap - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf - webarchive
- https://attack.mitre.org/groups/G0096 - webarchive
- https://www.fireeye.com/blog/threat-research/2019/10/messagetap-who-is-reading-your-text-messages.html - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Midrashim
A x64 ELF file infector with non-destructive payload.
Internal MISP references
UUID fe220358-7118-4feb-b43e-cbdaf2ea09dc which can be used as unique global reference for Midrashim in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MiKey
Internal MISP references
UUID aae3b83d-a116-4ebc-aae0-f6327ef174ea which can be used as unique global reference for MiKey in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mirai (ELF)
Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mirai (ELF).
| Known Synonyms |
|---|
Katana |
Internal MISP references
UUID 17e12216-a303-4a00-8283-d3fe92d0934c which can be used as unique global reference for Mirai (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai - webarchive
- https://www.cadosecurity.com/technical-analysis-of-the-ddos-attacks-against-ukrainian-websites/ - webarchive
- https://www.crowdstrike.com/blog/linux-targeted-malware-increased-by-35-percent-in-2021/ - webarchive
- https://socradar.io/what-you-need-to-know-about-russian-cyber-escalation-in-ukraine/ - webarchive
- https://www.stratosphereips.org/blog/2019/4/12/analysis-of-a-irc-based-botnet - webarchive
- https://www.trendmicro.com/en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html - webarchive
- https://unit42.paloaltonetworks.com/hoaxcalls-mirai-target-legacy-symantec-web-gateways/ - webarchive
- https://www.cadosecurity.com/analysis-of-initial-in-the-wild-attacks-exploiting-log4shell-log4j-cve-2021-44228/ - webarchive
- https://blog.netlab.360.com/wo-men-kan-dao-de-wu-ke-lan-bei-ddosgong-ji-xi-jie/ - webarchive
- https://forensicitguy.github.io/extracting-indicators-from-packed-mirai/ - webarchive
- https://techcommunity.microsoft.com/t5/azure-sentinel/hunting-for-omi-vulnerability-exploitation-with-azure-sentinel/ba-p/2764093 - webarchive
- https://www.radware.com/getmedia/18d24c2d-c092-4a61-9ad6-ebb92b7a49b8/Alert_Realtek_SDK.aspx - webarchive
- https://unit42.paloaltonetworks.com/mirai-variant-echobot-resurfaces-with-13-previously-unexploited-vulnerabilities/ - webarchive
- https://unit42.paloaltonetworks.com/new-mirai-variant-mukashi/ - webarchive
- https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/ - webarchive
- https://researchcenter.paloaltonetworks.com/2018/07/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/ - webarchive
- https://www.fortinet.com/blog/threat-research/totolink-vulnerabilities-beastmode-mirai-campaign - webarchive
- https://www.netscout.com/blog/asert/ddos-attack-campaign-targeting-multiple-organizations-ukraine - webarchive
- https://cert.gov.ua/article/37139 - webarchive
- https://exchange.xforce.ibmcloud.com/collection/InfectedNight-Mirai-Variant-With-Massive-Attacks-On-Our-Honeypots-dbea3e9e39b8265e729545fa798e4d18 - webarchive
- https://isc.sans.edu/diary/22786 - webarchive
- https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ - webarchive
- https://blog.netlab.360.com/what-our-honeypot-sees-just-one-day-after-the-spring4shell-advisory-en/ - webarchive
- https://www.fortinet.com/blog/threat-research/multiple-malware-campaigns-target-vmware-vulnerability - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/mirai-botnet-exploit-weaponized-to-attack-iot-devices-via-cve-2020-5902/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/new-mirai-variant-expands-arsenal-exploits-cve-2020-10173/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tough-times-for-ukrainian-honeypot - webarchive
- http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ - webarchive
- https://unit42.paloaltonetworks.com/cve-2022-22954-vmware-vulnerabilities/ - webarchive
- https://www.politie.nl/nieuws/2019/oktober/2/11-servers-botnet-offline.html - webarchive
- https://www.uptycs.com/blog/discovery-of-simps-botnet-leads-ties-to-keksec-group - webarchive
- https://synthesis.to/2021/06/30/automating_string_decryption.html - webarchive
- https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/ - webarchive
- https://thehackernews.com/2022/04/hackers-exploiting-spring4shell.html - webarchive
- https://blog.reversinglabs.com/blog/mirai-botnet-continues-to-plague-iot-space - webarchive
- https://unit42.paloaltonetworks.com/mirai-compiled-for-new-processor-surfaces/ - webarchive
- https://www.tesorion.nl/en/resources/pdfstore/Report-OSINT-Russia-Ukraine-Conflict-Cyberaspect.pdf - webarchive
- https://www.uptycs.com/blog/mirai-code-re-use-in-gafgyt - webarchive
- https://www.zscaler.com/blogs/security-research/threatlabz-analysis-log4shell-cve-2021-44228-exploit-attempts - webarchive
- https://community.riskiq.com/article/d8a78daf - webarchive
- https://prod-blog.avira.com/katana-a-new-variant-of-the-mirai-botnet - webarchive
- https://www.fortinet.com/blog/threat-research/the-ghosts-of-mirai - webarchive
- https://medium.com/s2wblog/logs-of-log4shell-cve-2021-44228-log4j-is-ubiquitous-en-809064312039 - webarchive
- https://unit42.paloaltonetworks.com/cve-2020-17496/ - webarchive
- https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/ - webarchive
- https://www.crowdstrike.com/blog/linux-mirai-malware-double-on-stronger-chips/ - webarchive
- https://cujo.com/mirai-gafgyt-with-new-ddos-modules-discovered/ - webarchive
- https://unit42.paloaltonetworks.com/unit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall/ - webarchive
- https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html - webarchive
- https://unit42.paloaltonetworks.com/cve-2021-32305-websvn/ - webarchive
- https://www.bleepingcomputer.com/news/security/mirai-activity-picks-up-once-more-after-publication-of-poc-exploit-code/ - webarchive
- https://krebsonsecurity.com/2017/12/mirai-iot-botnet-co-authors-plead-guilty/ - webarchive
- https://unit42.paloaltonetworks.com/iot-vulnerabilities-mirai-payloads/ - webarchive
- https://deform.co/the-infamous-mirai-trojan-evolves-new-pandora-variant-targets-android-tvs/ - webarchive
- https://blogs.jpcert.or.jp/en/2022/03/anti_upx_unpack.html - webarchive
- https://www.cisecurity.org/insights/blog/top-10-malware-march-2022 - webarchive
- https://unit42.paloaltonetworks.com/new-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices/ - webarchive
- https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/ - webarchive
- https://www.lacework.com/blog/malware-targeting-latest-f5-vulnerability/ - webarchive
- http://osint.bambenekconsulting.com/feeds/ - webarchive
- https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://www.youtube.com/watch?v=KVJyYTie-Dc - webarchive
- https://www.lacework.com/blog/mirai-goes-stealth-tls-iot-malware/ - webarchive
- https://blog.netlab.360.com/rimasuta-spread-with-ruijie-0day-en/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/with-mirai-comes-miori-iot-botnet-delivered-via-thinkphp-remote-code-execution-exploit/ - webarchive
- https://cybersecurity.att.com/blogs/labs-research/malware-hosting-domain-cyberium-fanning-out-mirai-variants - webarchive
- https://github.com/jgamblin/Mirai-Source-Code - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mokes (ELF)
Internal MISP references
UUID 6d5a5357-4126-4950-b8c3-ee78b1172217 which can be used as unique global reference for Mokes (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Momentum
Internal MISP references
UUID aaf8ce1b-3117-47c6-b756-809538ac8ff2 which can be used as unique global reference for Momentum in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Monti
A ransomware, derived from the leaked Conti source code.
Internal MISP references
UUID 7df77b77-00dd-4eba-a697-b9a7be262acc which can be used as unique global reference for Monti in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MooBot
Internal MISP references
UUID cd8deffe-eb0b-4451-8a13-11f6d291064a which can be used as unique global reference for MooBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot - webarchive
- https://blog.netlab.360.com/ddos-botnet-moobot-en/ - webarchive
- https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ - webarchive
- https://unit42.paloaltonetworks.com/moobot-d-link-devices/ - webarchive
- https://www.fortinet.com/blog/threat-research/mirai-based-botnet-moobot-targets-hikvision-vulnerability - webarchive
- https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b - webarchive
- https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Moose
Internal MISP references
UUID 7fdb91ea-52dc-499c-81f9-3dd824e2caa0 which can be used as unique global reference for Moose in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.moose - webarchive
- http://gosecure.net/2016/11/02/exposing-the-ego-market-the-cybercrime-performed-by-the-linux-moose-botnet/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/magazine/2018/VB2018-Paquet-Clouston.pdf - webarchive
- http://www.welivesecurity.com/2015/05/26/moose-router-worm/ - webarchive
- http://www.welivesecurity.com/2016/11/02/linuxmoose-still-breathing/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mozi
Mozi is a IoT botnet, that makes use of P2P for communication and reuses source code of other well-known malware families, including Gafgyt, Mirai, and IoT Reaper.
Internal MISP references
UUID 236ba358-4c70-434c-a7ac-7a31e76c398a which can be used as unique global reference for Mozi in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.mozi - webarchive
- https://blog.centurylink.com/new-mozi-malware-family-quietly-amasses-iot-bots/ - webarchive
- https://blog.netlab.360.com/the-mostly-dead-mozi-and-its-lingering-bots/ - webarchive
- https://www.crowdstrike.com/blog/linux-targeted-malware-increased-by-35-percent-in-2021/ - webarchive
- https://cujo.com/upx-anti-unpacking-techniques-in-iot-malware/ - webarchive
- https://www.elastic.co/blog/collecting-and-operationalizing-threat-data-from-the-mozi-botnet - webarchive
- https://www.nozominetworks.com/blog/how-iot-botnets-evade-detection-and-analysis/ - webarchive
- https://blog.netlab.360.com/p2p-botnets-review-status-continuous-monitoring/ - webarchive
- https://www.microsoft.com/security/blog/2021/08/19/how-to-proactively-defend-against-mozi-iot-botnet/ - webarchive
- https://www.youtube.com/watch?v=cDFO_MRlg3M - webarchive
- https://www.nozominetworks.com/blog/overcoming-the-challenges-of-detecting-p2p-botnets-on-your-network/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-1112.pdf - webarchive
- https://blog.netlab.360.com/mozi-another-botnet-using-dht/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MrBlack
MrBlack, first identified in May 2014 by Russian security firm Dr. Web, is a botnet that targets Linux OS and is designed to conduct distributed denial-of-service (DDoS) attacks. In May 2015, Incapsula clients suffered a large-scale DDoS attack which the company attributed to network traffic generated by tens of thousands of small office/home office (SOHO) routers infected with MrBlack. This massive botnet spans over 109 countries, especially in Thailand and Brazil.
MrBlack scans for and infects routers that have not had their default login credentials changed and that allow remote access to HTTP and SSH via port 80 and port 22, respectively. One of the most impacted router brands is Ubiquiti, a U.S.-based firm that provides bulk network hub solutions for internet service providers to lease to their customers. Once a vulnerable router is compromised and MrBlack is injected into the system, a remote server is contacted and system information from the device is transmitted. This allows the host server to receive commands in order to perform different types of DDoS attacks, download and execute files, and terminate processes.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MrBlack.
| Known Synonyms |
|---|
AESDDoS |
Dofloo |
Internal MISP references
UUID fc047e32-9cf2-4a92-861a-be882efd8a50 which can be used as unique global reference for MrBlack in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.mrblack - webarchive
- https://news.drweb.com/?i=5760&c=23&lng=en - webarchive
- https://blog.syscall.party/post/aes-ddos-analysis-part-1/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2015/KalnaiHorejsi-VB2015.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/exposed-docker-apis-abused-by-ddos-cryptojacking-botnet-malware/ - webarchive
- https://www.botconf.eu/wp-content/uploads/2015/12/OK-P13-Liu-Ya-Automatically-Classify-Unknown-Bots-by-The-Register-Messages.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mumblehard
Internal MISP references
UUID 5f78127b-25d3-4f86-8a64-f9549b2db752 which can be used as unique global reference for Mumblehard in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nextcry
Ransomware used against Linux servers.
Internal MISP references
UUID 7ec8a41f-c72e-4832-a5a4-9d7380cea083 which can be used as unique global reference for Nextcry in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ngioweb (ELF)
Internal MISP references
UUID a4ad242c-6fd0-4b1d-8d97-8f48150bf242 which can be used as unique global reference for Ngioweb (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.ngioweb - webarchive
- https://twitter.com/IntezerLabs/status/1324346324683206657 - webarchive
- https://blog.netlab.360.com/an-analysis-of-linux-ngioweb-botnet-en/ - webarchive
- https://blog.netlab.360.com/linux-ngioweb-v2-going-after-iot-devices-en/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nimbo-C2 (ELF)
According to the author, Nimbo-C2 is yet another (simple and lightweight) C2 framework. The agent currently supports Windows x64 and Linux. It's written in Nim, with some usage of .NET (by dynamically loading the CLR to the process).
Internal MISP references
UUID 5dbdf2ea-a15b-4ad6-bf7a-a030998c66b4 which can be used as unique global reference for Nimbo-C2 (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NiuB
Golang-based RAT that offers execution of shell commands and download+run capability.
Internal MISP references
UUID 7c516b66-f4a4-406a-bf35-d898ac8bffec which can be used as unique global reference for NiuB in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NOTROBIN
FireEye states that NOTROBIN is a utility written in Go 1.10 and compiled to a 64-bit ELF binary for BSD systems. It periodically scans for and deletes files matching filename patterns and content characteristics. The purpose seems to be to block exploitation attempts against the CVE-2019-19781 vulnerability; however, FireEye believes that NOTROBIN provides backdoor access to the compromised system.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular NOTROBIN.
| Known Synonyms |
|---|
remove_bds |
Internal MISP references
UUID aaeb76b3-3885-4dc6-9501-4504fed9f20b which can be used as unique global reference for NOTROBIN in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.notrobin - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://www.theregister.co.uk/2020/01/17/hackers_patch_citrix_vulnerability/ - webarchive
- https://www.fireeye.com/blog/threat-research/2020/01/vigilante-deploying-mitigation-for-citrix-netscaler-vulnerability-while-maintaining-backdoor.html - webarchive
- https://blog.dcso.de/a-curious-case-of-cve-2019-19781-palware-remove_bds/ - webarchive
- https://news.sophos.com/en-us/2020/05/21/asnarok2/ - webarchive
- https://www.fireeye.com/blog/products-and-services/2020/01/rough-patch-promise-it-will-be-200-ok.html - webarchive
- https://dcso.de/2020/01/16/a-curious-case-of-cve-2019-19781-palware-remove_bds/ - webarchive
- https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OrBit
According to stormshield, Orbit is a two-stage malware that appeared in July 2022, discovered by Intezer lab. Acting as a stealer and backdoor on 64-bit Linux systems, it consists of an executable acting as a dropper and a dynamic library.
Internal MISP references
UUID ae9d84f2-60e5-4a33-98f4-a0061938ec6d which can be used as unique global reference for OrBit in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Owari
Mirai variant by actor "Anarchy" that used CVE-2017-17215 in July 2018 to compromise 18,000+ devices.
Internal MISP references
UUID ec67f206-6464-48cf-a012-3cdfc1278488 which can be used as unique global reference for Owari in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.owari - webarchive
- https://twitter.com/hrbrmstr/status/1019922651203227653 - webarchive
- https://www.bleepingcomputer.com/news/security/router-crapfest-malware-author-builds-18-000-strong-botnet-in-a-day/ - webarchive
- https://www.fortinet.com/blog/threat-research/a-wicked-family-of-bots.html - webarchive
- https://twitter.com/ankit_anubhav/status/1019647993547550720 - webarchive
- https://twitter.com/360Netlab/status/1019759516789821441 - webarchive
- https://www.scmagazine.com/malware-author-anarchy-builds-18000-strong-huawei-router-botnet/article/782395/ - webarchive
- https://blog.newskysecurity.com/understanding-the-iot-hacker-a-conversation-with-owari-sora-iot-botnet-author-117feff56863 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
p0sT5n1F3r
According to Yarix digital security, this is a malware that allows to sniff on HTTPS traffic, implemented as Apache module.
Internal MISP references
UUID cc48c6ae-d274-4ad0-b013-bd75041a20c8 which can be used as unique global reference for p0sT5n1F3r in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
P2Pinfect
P2Pinfect is a fast-growing multi platform botnet, the purpose of which is still unknown. Written in Rust, it is compatible with Windows and Linux, including a MIPS variant for Linux based routers and IoT devices. It is capable of brute forcing SSH logins and exploiting Redis servers in order to propagate itself both to random IPs on the internet and to hosts it can find references to in files present on the infected system.
Internal MISP references
UUID 31a32308-7034-4419-b1f3-56a4d64b4358 which can be used as unique global reference for P2Pinfect in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.p2pinfect - webarchive
- https://www.cadosecurity.com/p2pinfect-new-variant-targets-mips-devices/ - webarchive
- https://www.cadosecurity.com/redis-p2pinfect/ - webarchive
- https://www.cadosecurity.com/cado-security-labs-researchers-witness-a-600x-increase-in-p2pinfect-traffic/ - webarchive
- https://unit42.paloaltonetworks.com/peer-to-peer-worm-p2pinfect/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
pbot
P2P botnet derived from the Mirai source code.
Internal MISP references
UUID 7aff049d-9326-466d-bbcc-d62da673b32c which can be used as unique global reference for pbot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Penquin Turla
Internal MISP references
UUID 262e0cf2-2fed-4d37-8d7a-0fd62c712840 which can be used as unique global reference for Penquin Turla in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.penquin_turla - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf - webarchive
- https://www.youtube.com/watch?v=JXsjRUxx47E - webarchive
- https://www.leonardocompany.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf - webarchive
- https://securelist.com/big-threats-using-code-similarity-part-1/97239/ - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180251/Penquins_Moonlit_Maze_PDF_eng.pdf - webarchive
- https://securelist.com/files/2017/04/Penquins_Moonlit_Maze_PDF_eng.pdf - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://twitter.com/juanandres_gs/status/944741575837528064 - webarchive
- https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/ - webarchive
- https://securelist.com/files/2017/04/Penquins_Moonlit_Maze_AppendixB.pdf - webarchive
- https://lab52.io/blog/looking-for-penquins-in-the-wild/ - webarchive
- https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PerlBot
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PerlBot.
| Known Synonyms |
|---|
DDoS Perl IrcBot |
ShellBot |
Internal MISP references
UUID 24b77c9b-7e7e-4192-8161-b6727728170f which can be used as unique global reference for PerlBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.perlbot - webarchive
- https://jask.com/wp-content/uploads/2019/02/Shellbot-Campaign_v2.pdf - webarchive
- https://unit42.paloaltonetworks.com/los-zetas-from-eleethub-botnet/ - webarchive
- https://asec.ahnlab.com/en/49769/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-345a - webarchive
- https://sysdig.com/blog/malware-analysis-shellbot-sysdig/ - webarchive
- https://unit42.paloaltonetworks.com/cve-2020-17496/ - webarchive
- https://yoroi.company/research/outlaw-is-back-a-new-crypto-botnet-targets-european-organizations/ - webarchive
- https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ - webarchive
- https://www.trendmicro.com/en_us/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html - webarchive
- https://unit42.paloaltonetworks.com/cve-2022-22954-vmware-vulnerabilities/ - webarchive
- https://brianstadnicki.github.io/posts/malware-gitlab-perlbot/ - webarchive
- https://therecord.media/agents-raid-home-of-kansas-man-seeking-info-on-botnet-that-infected-dod-network/ - webarchive
- https://twitter.com/Nocturnus/status/1308430959512092673 - webarchive
- https://documents.trendmicro.com/assets/Perl-Based_Shellbot_Looks_to_Target_Organizations_via_C&C_appendix.pdf - webarchive
- https://asec.ahnlab.com/en/54647/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Persirai
Internal MISP references
UUID 2ee05352-3d4a-448b-825d-9d6c10792bf7 which can be used as unique global reference for Persirai in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PingPull
Internal MISP references
UUID 65a7944c-15d9-4ca5-8561-7c97b18684c8 which can be used as unique global reference for PingPull in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Pink
A botnet with P2P and centralized C&C capabilities.
Internal MISP references
UUID 67063764-a47c-4058-9cb2-1685ffa14fe8 which can be used as unique global reference for Pink in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PLEAD (ELF)
Internal MISP references
UUID de3c14aa-f9f4-4071-8e6e-a2c16a3394ad which can be used as unique global reference for PLEAD (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.plead - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://cyberandramen.net/2021/02/11/blacktech-updates-elf-plead-backdoor/ - webarchive
- https://www.macnica.net/file/mpressioncss_ta_report_2019_2_nopw.pdf - webarchive
- https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf - webarchive
- https://blogs.jpcert.or.jp/en/2020/11/elf-plead.html - webarchive
- https://www.ironnet.com/blog/china-cyber-attacks-the-current-threat-landscape - webarchive
- https://jp.security.ntt/resources/EN-BlackTech_2021.pdf - webarchive
- https://www.cyberandramen.net/home/blacktech-doesnt-miss-a-step-a-quick-analysis-of-a-busy-2020 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Poseidon (ELF)
Part of Mythic C2, written in Golang.
Internal MISP references
UUID ad796632-2595-4ae5-a563-b92197210d61 which can be used as unique global reference for Poseidon (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PRISM
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PRISM.
| Known Synonyms |
|---|
waterdrop |
Internal MISP references
UUID 9a4a866b-84a9-4778-8de8-2780a27c0597 which can be used as unique global reference for PRISM in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PrivetSanya
Black Lotus Labs identified malware for the Windows Subsystem for Linux (WSL). Mostly written in Python but compiled as Linux ELF files.
Internal MISP references
UUID 41e5aafb-5847-421e-813d-627414ee31bb which can be used as unique global reference for PrivetSanya in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Prometei (ELF)
Internal MISP references
UUID b6899bda-54e9-4953-8af5-22af39776b69 which can be used as unique global reference for Prometei (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.prometei - webarchive
- https://blog.talosintelligence.com/2020/07/prometei-botnet-and-its-quest-for-monero.html - webarchive
- https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://cujo.com/iot-malware-journals-prometei-linux/ - webarchive
- https://www.trendmicro.com/en_us/research/21/e/proxylogon-a-coinminer--a-ransomware--and-a-botnet-join-the-part.html - webarchive
- https://twitter.com/IntezerLabs/status/1338480158249013250 - webarchive
- https://www.cybereason.com/blog/prometei-botnet-exploiting-microsoft-exchange-vulnerabilities - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Pro-Ocean
Unit 42 describes this as a malware used by Rocke Group that deploys an XMRig miner.
Internal MISP references
UUID aa918c10-e5c7-4abd-b8c0-3c938a6675f5 which can be used as unique global reference for Pro-Ocean in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.pro_ocean - webarchive
- https://unit42.paloaltonetworks.com/pro-ocean-rocke-groups-new-cryptojacking-malware/ - webarchive
- https://seguranca-informatica.pt/new-cryptojacking-malware-called-pro-ocean-is-now-attacking-apache-oracle-and-redis-servers/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
pupy (ELF)
Pupy is an open-source, cross-platform RAT and post-exploitation framework mainly written in python. Pupy can be loaded from various loaders, including PE EXE, reflective DLL, Linux ELF, pure python, powershell and APK. Most of the loaders bundle an embedded python runtime, python library modules in source/compiled/native forms as well as a flexible configuration. They bootstrap a python runtime environment mostly in-memory for the later stages of pupy to run in. Pupy can communicate using various transports, migrate into processes, load remote python code, python packages and python C-extensions from memory.
Internal MISP references
UUID 92a1288f-cc4d-47ca-8399-25fe5a39cf2d which can be used as unique global reference for pupy (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Qilin
Internal MISP references
UUID d97af6c5-640f-46b4-943c-0e8940f8011e which can be used as unique global reference for Qilin in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QNAPCrypt
The QNAPCrypt ransomware works similarly to other ransomware, including encrypting all files and delivering a ransom note. However, there are several important differences:
-
The ransom note was included solely as a text file, without any message on the screen—naturally, because it is a server and not an endpoint.
-
Every victim is provided with a different, unique Bitcoin wallet—this could help the attackers avoid being traced.
-
Once a victim is compromised, the malware requests a wallet address and a public RSA key from the command and control server (C&C) before file encryption.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular QNAPCrypt.
| Known Synonyms |
|---|
eCh0raix |
Internal MISP references
UUID a0b12e5f-0257-41f1-beda-001ad944c4ca which can be used as unique global reference for QNAPCrypt in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.qnapcrypt - webarchive
- https://blog.netlab.360.com/qnap-nas-users-make-sure-you-check-your-system/ - webarchive
- https://www.intezer.com/blog-seizing-15-active-ransomware-campaigns-targeting-linux-file-storage-servers/ - webarchive
- https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf - webarchive
- https://www.intezer.com/blog-russian-cybercrime-group-fullofdeep-behind-qnapcrypt-ransomware-campaigns/ - webarchive
- https://www.anomali.com/blog/the-ech0raix-ransomware - webarchive
- https://www.qnap.com/en/security-advisory/QSA-20-02 - webarchive
- https://unit42.paloaltonetworks.com/ech0raix-ransomware-soho/ - webarchive
- https://www.ibm.com/downloads/cas/Z81AVOY7 - webarchive
- https://documents.trendmicro.com/assets/pdf/wp-backing-your-backup-defending-nas-devices-against-evolving-threats.pdf - webarchive
- https://www.intezer.com/blog/malware-analysis/when-viruses-mutate-did-suncrypt-ransomware-evolve-from-qnapcrypt - webarchive
- https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought - webarchive
- https://www.bleepingcomputer.com/news/security/qnap-warns-of-ech0raix-ransomware-attacks-roon-server-zero-day/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QSnatch
The malware infects QNAP NAS devices, is persisting via various mechanisms and resists cleaning by preventing firmware updates and interfering with QNAP MalwareRemover. The malware steals passwords and hashes
Internal MISP references
UUID 48389957-30e2-4747-b4c6-8b8a9f15250f which can be used as unique global reference for QSnatch in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.qsnatch - webarchive
- https://www.trendmicro.com/en_us/research/21/l/the-evolution-of-iot-linux-malware-based-on-mitre-att&ck-ttps.html - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-209a - webarchive
- https://documents.trendmicro.com/assets/pdf/wp-backing-your-backup-defending-nas-devices-against-evolving-threats.pdf - webarchive
- https://bin.re/blog/the-dga-of-qsnatch/ - webarchive
- https://www.ncsc.gov.uk/files/NCSC%20CISA%20Alert%20-QNAP%20NAS%20Devices.pdf - webarchive
- https://www.kyberturvallisuuskeskus.fi/en/news/qsnatch-malware-designed-qnap-nas-devices - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QUIETEXIT
Mandiant observed this backdoor being observed by UNC3524. It is based on the open-source Dropbear SSH source code.
Internal MISP references
UUID 6a5ab9ca-944c-4187-bdef-308516745d18 which can be used as unique global reference for QUIETEXIT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
r2r2
Internal MISP references
UUID 759f8590-a049-4c14-be8a-e6605e2cd43d which can be used as unique global reference for r2r2 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RagnarLocker (ELF)
Internal MISP references
UUID 5f96787e-fc9f-486b-a15f-f46c8179a4d5 which can be used as unique global reference for RagnarLocker (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.ragnarlocker - webarchive
- https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/analysis-and-protections-for-ragnarlocker-ransomware.html - webarchive
- https://twitter.com/malwrhunterteam/status/1475568201673105409 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rakos
Internal MISP references
UUID 4592384c-48a7-4e16-b492-7add50a7d2f5 which can be used as unique global reference for Rakos in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RansomEXX (ELF)
According to SentineOne, RansomEXX (aka Defray, Defray777), a multi-pronged extortion threat, has been observed in the wild since late 2020. RansomEXX is associated with attacks against the Texas Department of Transportation, Groupe Atlantic, and several other large enterprises. There are Windows and Linux variants of this malware family, and they are known for their limited and exclusive targeting.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RansomEXX (ELF).
| Known Synonyms |
|---|
Defray777 |
Internal MISP references
UUID 946814a1-957c-48ce-9068-fdef24a025bf which can be used as unique global reference for RansomEXX (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.ransomexx - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.cybereason.com/blog/cybereason-vs.-ransomexx-ransomware - webarchive
- https://securityintelligence.com/x-force/ransomexx-upgrades-rust/ - webarchive
- https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/ - webarchive
- https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/ - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://www.bleepingcomputer.com/news/security/ecuadors-state-run-cnt-telco-hit-by-ransomexx-ransomware/ - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://gustavopalazolo.medium.com/ransomexx-an%C3%A1lise-do-ransomware-utilizado-no-ataque-ao-stj-918001ec8195 - webarchive
- https://www.youtube.com/watch?v=qxPXxWMI2i4 - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.ic3.gov/Media/News/2021/211101.pdf - webarchive
- https://www.ctir.gov.br/arquivos/alertas/2020/alerta_2020_03_ataques_de_ransomware.pdf - webarchive
- https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf - webarchive
- https://www.sentinelone.com/anthology/ransomexx/ - webarchive
- https://securelist.com/ransomexx-trojan-attacks-linux-systems/99279/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RansomExx2
According to IBM Security X-Force, this is a new but functionally very similar version of RansomExx, fully rewritten in Rust and internally referred to as RansomExx2.
Internal MISP references
UUID c6d750d5-fa47-4fcb-9d24-2682036fc6e5 which can be used as unique global reference for RansomExx2 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RapperBot
A Mirai derivate bruteforcing SSH servers.
Internal MISP references
UUID 914c94eb-38e2-4cb8-a62b-21fbe9c48496 which can be used as unique global reference for RapperBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.rapper_bot - webarchive
- https://socradar.io/linux-malware-rapperbot-brute-forcing-ssh-servers/ - webarchive
- https://www.fortinet.com/blog/threat-research/rapperbot-malware-discovery - webarchive
- https://www.fortinet.com/blog/threat-research/new-rapperbot-campaign-ddos-attacks - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RaspberryPiBotnet
Internal MISP references
UUID 8dee025b-2233-4cd8-af02-fcdcd40b378f which can be used as unique global reference for RaspberryPiBotnet in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
rat_hodin
Internal MISP references
UUID 6aacf515-de49-4afc-a135-727c9beaab0b which can be used as unique global reference for rat_hodin in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
rbs_srv
Internal MISP references
UUID a08d9f8b-2cc5-48c2-8cce-ee713bcdc4b7 which can be used as unique global reference for rbs_srv in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RedXOR
Internal MISP references
UUID 421b2ec7-d4e6-4fc8-9bd3-55fe26337aae which can be used as unique global reference for RedXOR in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RedAlert Ransomware
Ransomware that targets Linux VMware ESXi servers. Encryption procedure uses the NTRUEncrypt public-key encryption algorithm.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RedAlert Ransomware.
| Known Synonyms |
|---|
N13V |
Internal MISP references
UUID 12137c8d-d3f4-44fe-b25e-2fb5f90cecce which can be used as unique global reference for RedAlert Ransomware in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.red_alert - webarchive
- https://blog.cyble.com/2022/07/12/new-ransomware-groups-on-the-rise/ - webarchive
- https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html - webarchive
- https://www.bleepingcomputer.com/news/security/new-redalert-ransomware-targets-windows-linux-vmware-esxi-servers/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rekoobe
A Trojan for Linux intended to infect machines with the SPARC architecture and Intel x86, x86-64 computers. The Trojan’s configuration data is stored in a file encrypted with XOR algorithm
Internal MISP references
UUID 48b9a9fd-4c1a-428a-acc0-40b1a3fa7590 which can be used as unique global reference for Rekoobe in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.rekoobe - webarchive
- https://documents.trendmicro.com/assets/txt/earth-berberoka-linux-iocs-2.txt - webarchive
- https://intezer.com/blog-linux-rekoobe-operating-with-new-undetected-malware-samples/ - webarchive
- https://www.sekoia.io/en/walking-on-apt31-infrastructure-footprints/ - webarchive
- https://vms.drweb.com/virus/?i=7754026&lng=en - webarchive
- https://www.intezer.com/blog/malware-analysis/elf-malware-analysis-101-part-3-advanced-analysis/ - webarchive
- https://yoroi.company/research/shadows-from-the-past-threaten-italian-enterprises/ - webarchive
- https://sansec.io/research/rekoobe-fishpig-magento - webarchive
- https://asec.ahnlab.com/en/55229/ - webarchive
- https://decoded.avast.io/davidalvarez/linux-threat-hunting-syslogk-a-kernel-rootkit-found-under-development-in-the-wild/ - webarchive
- https://twitter.com/billyleonard/status/1458531997576572929 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
reptile
Internal MISP references
UUID 934478a1-1243-4c26-8360-be3d01ae193e which can be used as unique global reference for reptile in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.reptile - webarchive
- https://documents.trendmicro.com/assets/white_papers/wp-operation-earth-berberoka.pdf - webarchive
- https://github.com/f0rb1dd3n/Reptile - webarchive
- https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-40-LunghiHorejsi.pdf - webarchive
- https://asec.ahnlab.com/en/55785/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
REvil (ELF)
ELF version of win.revil targeting VMware ESXi hypervisors.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular REvil (ELF).
| Known Synonyms |
|---|
REvix |
Internal MISP references
UUID d9d76456-01a3-4dcd-afc2-87529e00c1ba which can be used as unique global reference for REvil (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.revil - webarchive
- https://home.treasury.gov/news/press-releases/jy0471 - webarchive
- https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/moving-left-ransomware-boom - webarchive
- https://twitter.com/IntezerLabs/status/1452980772953071619 - webarchive
- http://www.fsb.ru/fsb/press/message/single.htm%21id%3D10439388%40fsbMessage.html - webarchive
- https://krebsonsecurity.com/2021/11/revil-ransom-arrest-6m-seizure-and-10m-reward/ - webarchive
- https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/ - webarchive
- https://cybersecurity.att.com/blogs/labs-research/revils-new-linux-version - webarchive
- https://www.justice.gov/opa/pr/ukrainian-arrested-and-charged-ransomware-attack-kaseya - webarchive
- https://www.bleepingcomputer.com/news/security/revil-ransomware-shuts-down-again-after-tor-sites-were-hijacked/ - webarchive
- https://documents.trendmicro.com/assets/rpt/rpt-navigating-new-frontiers-trend-micro-2021-annual-cybersecurity-report.pdf - webarchive
- https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html - webarchive
- https://twitter.com/VK_Intel/status/1409601311092490248?s=20 - webarchive
- https://threatpost.com/linux-variant-ransomware-vmwares-nas/167511/ - webarchive
- https://www.digitalshadows.com/blog-and-research/revil-analysis-of-competing-hypotheses/ - webarchive
- https://storage.courtlistener.com/recap/gov.uscourts.txnd.351760/gov.uscourts.txnd.351760.1.0_3.pdf - webarchive
- https://www.reuters.com/technology/exclusive-governments-turn-tables-ransomware-gang-revil-by-pushing-it-offline-2021-10-21/ - webarchive
- https://www.darktrace.com/en/blog/staying-ahead-of-r-evils-ransomware-as-a-service-business-model/ - webarchive
- https://therecord.media/us-arrests-and-charges-ukrainian-man-for-kaseya-ransomware-attack/ - webarchive
- https://storage.courtlistener.com/recap/gov.uscourts.txnd.352371/gov.uscourts.txnd.352371.1.0_1.pdf - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v - webarchive
- https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/ - webarchive
- https://www.secureworks.com/blog/revil-ransomware-reemerges-after-shutdown-universal-decryptor-released - webarchive
- https://www.darkowl.com/blog-content/page-not-found-revil-darknet-services-offline-after-attack-last-weekend - webarchive
- https://angle.ankura.com/post/102hcny/revix-linux-ransomware - webarchive
- https://cybleinc.com/2021/07/03/uncensored-interview-with-revil-sodinokibi-ransomware-operators/ - webarchive
- https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-revil - webarchive
- https://www.fincen.gov/sites/default/files/advisory/2021-11-08/FinCEN%20Ransomware%20Advisory_FINAL_508_.pdf - webarchive
- https://www.youtube.com/watch?v=mDUMpYAOMOo - webarchive
- https://analyst1.com/file-assets/History-of-REvil.pdf - webarchive
- https://www.fbi.gov/wanted/cyber/yevgyeniy-igoryevich-polyanin - webarchive
- https://www.advintel.io/post/storm-in-safe-haven-takeaways-from-russian-authorities-takedown-of-revil - webarchive
- https://russian.rt.com/russia/article/926347-barnaulec-rozysk-fbr-kibermoshennichestvo - webarchive
- https://twitter.com/VK_Intel/status/1409601311092490248 - webarchive
- https://otx.alienvault.com/pulse/60da2c80aa5400db8f1561d5 - webarchive
- https://twitter.com/AdamTheAnalyst/status/1409499591452639242?s=20 - webarchive
- https://www.br.de/nachrichten/deutschland-welt/mutmasslicher-ransomware-millionaer-identifiziert,Sn3iHgJ - webarchive
- https://www.domaintools.com/resources/blog/the-most-prolific-ransomware-families-a-defenders-guide - webarchive
- https://threatpost.com/ransomware-revil-sites-disappears/167745/ - webarchive
- https://www.elliptic.co/blog/revil-revealed-tracking-ransomware-negotiation-and-payment - webarchive
- https://malienist.medium.com/revix-linux-ransomware-d736956150d0 - webarchive
- https://www.flashpoint-intel.com/blog/revil-disappears-again/ - webarchive
- https://diicot.ro/mass-media/3341-comunicat-de-presa-2-08-11-2021 - webarchive
- https://us-cert.cisa.gov/ncas/current-activity/2021/07/04/cisa-fbi-guidance-msps-and-their-customers-affected-kaseya-vsa - webarchive
- https://www.flashpoint-intel.com/blog/interview-with-revil-affiliated-ransomware-contractor/ - webarchive
- https://www.trendmicro.com/en_in/research/21/k/global-operations-lead-to-arrests-of-alleged-members-of-gandcrab.html - webarchive
- https://www.bbc.com/news/technology-59297187 - webarchive
- https://github.com/f0wl/REconfig-linux - webarchive
- https://ke-la.com/will-the-revils-story-finally-be-over/ - webarchive
- https://www.youtube.com/watch?v=ptbNMlWxYnE - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rex
Internal MISP references
UUID 49639ff5-e0be-4b6a-850b-d5d8dd37e62b which can be used as unique global reference for Rex in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RHOMBUS
Internal MISP references
UUID af886910-9a0b-478e-b53d-54c8a103acb4 which can be used as unique global reference for RHOMBUS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rhysida (ELF)
Internal MISP references
UUID 1dbd7cbb-960d-4ef4-9520-1748fb7cd4c6 which can be used as unique global reference for Rhysida (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Roboto
P2P Botnet discovered by Netlab360. The botnet infects linux servers via the Webmin RCE vulnerability (CVE-2019-15107) which allows attackers to run malicious code with root privileges and take over older Webmin versions. Based on the Netlabs360 analysis, the botnet serves mainly 7 functions: reverse shell, self-uninstall, gather process' network information, gather Bot information, execute system commands, run encrypted files specified in URLs and four DDoS attack methods: ICMP Flood, HTTP Flood, TCP Flood, and UDP Flood.
Internal MISP references
UUID e18bf514-b978-4bef-b4d9-834a5100fced which can be used as unique global reference for Roboto in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RotaJakiro
RotaJakiro is a stealthy Linux backdoor which remained undetected between 2018 and 2021. The malware uses rotating encryption to encrypt the resource information within the sample, and C2 communication, using a combination of AES, XOR, ROTATE encryption and ZLIB compression.
Internal MISP references
UUID 66fb7b48-60f2-44fc-9cbe-f70e776d058b which can be used as unique global reference for RotaJakiro in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.rotajakiro - webarchive
- https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/ - webarchive
- https://www.domaintools.com/resources/blog/domaintools-and-digital-archeology-a-look-at-rotajakiro - webarchive
- https://blog.netlab.360.com/rotajakiro_linux_version_of_oceanlotus/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Royal Ransom (ELF)
According to Trendmicro, Royal ransomware was first observed in September 2022, and the threat actors behind it are believed to be seasoned cybercriminals who used to be part of Conti Team One.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Royal Ransom (ELF).
| Known Synonyms |
|---|
Royal |
Royal_unix |
Internal MISP references
UUID 4e29dae1-5a8c-4b3c-81dc-dcc0fdd3c93a which can be used as unique global reference for Royal Ransom (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.royal_ransom - webarchive
- https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/ - webarchive
- https://www.trendmicro.com/en_us/research/23/b/royal-ransomware-expands-attacks-by-targeting-linux-esxi-servers.html - webarchive
- https://unit42.paloaltonetworks.com/royal-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rshell
Internal MISP references
UUID 4947e9d3-aa13-4359-ac43-c1c436c409c9 which can be used as unique global reference for Rshell in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SALTWATER
According to Mandiant, SALTWATER is a module for the Barracuda SMTP daemon (bsmtpd) that has backdoor functionality. SALTWATER can upload or download arbitrary files, execute commands, and has proxy and tunneling capabilities. The backdoor is implemented using hooks on the send, recv, close syscalls via the 3rd party kubo/funchook hooking library, and amounts to five components, most of which are referred to as "Channels" within the binary. In addition to providing backdoor and proxying capabilities, these components exhibit classic backdoor functionality.
Internal MISP references
UUID d55ea436-b2c1-400c-99dc-6e35bc05438b which can be used as unique global reference for SALTWATER in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Satori
Satori is a variation of elf.mirai which was first detected around 2017-11-27 by 360 Netlab. It uses exploit to exhibit worm-like behaviour to spread over ports 37215 and 52869 (CVE-2014-8361).
Internal MISP references
UUID 9e5d83a8-1181-43fe-a77f-28c8c75ffbd0 which can be used as unique global reference for Satori in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.satori - webarchive
- http://blog.netlab.360.com/art-of-steal-satori-variant-is-robbing-eth-bitcoin-by-replacing-wallet-address-en/ - webarchive
- https://krebsonsecurity.com/2018/09/alleged-satori-iot-botnet-operator-sought-media-spotlight-got-indicted/ - webarchive
- https://blog.radware.com/security/botnets/2018/02/new-satori-botnet-variant-enslaves-thousands-dasan-wifi-routers/ - webarchive
- http://www.eweek.com/security/collaborative-takedown-kills-iot-worm-satori - webarchive
- https://unit42.paloaltonetworks.com/satori-mirai-botnet-variant-targeting-vantage-velocity-field-unit-rce-vulnerability/ - webarchive
- https://www.arbornetworks.com/blog/asert/the-arc-of-satori/ - webarchive
- http://blog.netlab.360.com/warning-satori-a-new-mirai-variant-is-spreading-in-worm-style-on-port-37215-and-52869-en/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SBIDIOT
Internal MISP references
UUID b4c20cf4-8e94-4523-8d48-7781aab6785d which can be used as unique global reference for SBIDIOT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.sbidiot - webarchive
- https://www.nozominetworks.com/blog/threat-intelligence-analysis-of-the-sbidiot-iot-malware/ - webarchive
- https://www.nozominetworks.com/blog/how-iot-botnets-evade-detection-and-analysis/ - webarchive
- https://brianstadnicki.github.io/posts/malware-sbidiot-dec2021/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SEASPY
According to CISA, this malware is a persistent backdoor that masquerades as a legitimate Barracuda Networks service. The malware is designed to listen to commands received from the Threat Actor’s Command-and-Control through TCP packets. When executed, the malware uses libpcap sniffer to monitor traffic for a magic packet on TCP port 25 (SMTP) and TCP port 587. It checks the network packet captured for a hard-coded string. When the right sequence of packet is captured, it establishes a TCP reverse shell to the C2 server for further exploitation. This allows the TA to execute arbitrary commands on the compromised system. The malware is based on an open-source backdoor program named "cd00r".
Internal MISP references
UUID a6699c42-69d8-4bdd-8dd9-72f4c80efefa which can be used as unique global reference for SEASPY in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.seaspy - webarchive
- https://www.cisa.gov/news-events/analysis-reports/ar23-209b - webarchive
- https://www.mandiant.com/resources/blog/chinese-espionage-tactics - webarchive
- https://www.cisa.gov/news-events/alerts/2023/07/28/cisa-releases-malware-analysis-reports-barracuda-backdoors - webarchive
- https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ShellBind
Internal MISP references
UUID b51caf06-736e-46fc-9b13-48b0b81df4b7 which can be used as unique global reference for ShellBind in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Shishiga
Internal MISP references
UUID 51da734c-70dd-4337-ab08-ab61457e0da5 which can be used as unique global reference for Shishiga in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SideWalk (ELF)
Internal MISP references
UUID ec994efc-a8a4-4e92-ada2-e37d421baf01 which can be used as unique global reference for SideWalk (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Silex
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Silex.
| Known Synonyms |
|---|
silexbot |
Internal MISP references
UUID bf059cb4-f73a-4181-bf71-d8da7bf50dd8 which can be used as unique global reference for Silex in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SimpleTea (ELF)
SimpleTea for Linux is an HTTP(S) RAT.
It was discovered in Q1 2023 as an instance of the Lazarus group's Operation DreamJob campaign for Linux. It was a payload downloaded in an execution chain which started with an HSBC-themed job offer lure. It shared the same C&C server as payloads from the 3CX incident around the same time.
It’s an object-oriented project, which does not run on Linux distributions without a graphical user interface, and decrypts its configuration from /home/%user%/.config/apdl.cf using 0x7E as the XOR key. It uses AES-GCM for encryption and decryption of its network traffic.
It supports basic commands that include operations on the victim’s filesystem, manipulation with its configuration, file exfiltration (via ZIP archives), and the download and execution of additional tools from the attacker’s arsenal. The commands are indexed by 16-bit integers, starting with the value 0x27C3.
SimpleTea for Linux seems like an updated version of BadCall for Linux, rewritten from C to C++, as there are similarities in class names and function names between the two.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SimpleTea (ELF).
| Known Synonyms |
|---|
SimplexTea |
Internal MISP references
UUID e8695701-8055-4b98-bcb6-e4bb7e0a3346 which can be used as unique global reference for SimpleTea (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.simpletea - webarchive
- https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Lazarus-campaigns-and-backdoors-in-2022-2023.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SLAPSTICK
According to FireEye, SLAPSTICK is a Solaris PAM backdoor that grants a user access to the system with a secret, hard-coded password.
Internal MISP references
UUID fb3e0a1d-3a98-4cbd-ad7f-4bbb4b9a8351 which can be used as unique global reference for SLAPSTICK in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SnappyTCP
According to PwC, SnappyTCP is a simple reverse shell for Linux/Unix systems, with variants for plaintext and TLS communication. SeaTurtle has used SnappyTCP at least between 2021 and 2023.
Internal MISP references
UUID 72e045be-eba2-4571-9c6e-7d35add3d2f8 which can be used as unique global reference for SnappyTCP in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SoWaT
This is an implant used by APT31 on home routers to utilize them as ORBs.
Internal MISP references
UUID c2866996-d622-4ee2-b548-a6598836e5ae which can be used as unique global reference for SoWaT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.sowat - webarchive
- https://blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat/ - webarchive
- https://twitter.com/billyleonard/status/1417910729005490177 - webarchive
- https://www.cert.ssi.gouv.fr/ioc/CERTFR-2021-IOC-003 - webarchive
- https://twitter.com/bkMSFT/status/1417823714922610689 - webarchive
- https://imp0rtp3.wordpress.com/2021/11/25/sowat/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Spamtorte
Internal MISP references
UUID 7b9a9ea0-04d2-42ef-b72f-9d6476b9e0d0 which can be used as unique global reference for Spamtorte in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SpeakUp
Internal MISP references
UUID 3ccd3143-c34d-4680-94b9-2cc4fa4f86fa which can be used as unique global reference for SpeakUp in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Specter
Internal MISP references
UUID b9ed5797-b591-4ca9-ba77-ce86308e333a which can be used as unique global reference for Specter in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.specter - webarchive
- https://blog.netlab.360.com/the-pitfall-of-threat-intelligence-whitelisting-specter-botnet-is-taking-over-top-legit-dns-domains-by-using-cloudns-service/ - webarchive
- https://blog.netlab.360.com/ghost-in-action-the-specter-botnet/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Speculoos
Internal MISP references
UUID df23ae3a-e10d-4c49-b379-2ea2fd1925af which can be used as unique global reference for Speculoos in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.speculoos - webarchive
- https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/ - webarchive
- https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-atlas - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SprySOCKS
Internal MISP references
UUID 3b5c485b-b6a6-4586-a7dc-9e23a3b0aa5a which can be used as unique global reference for SprySOCKS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SSHDoor
Internal MISP references
UUID 275d65b9-0894-4c9b-a255-83daddb2589c which can be used as unique global reference for SSHDoor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Stantinko
Internal MISP references
UUID e8c131df-ee3b-41d4-992d-71d3090d2d98 which can be used as unique global reference for Stantinko in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.stantinko - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://www.welivesecurity.com/2019/11/26/stantinko-botnet-adds-cryptomining-criminal-activities/ - webarchive
- https://www.welivesecurity.com/2020/08/07/stadeo-deobfuscating-stantinko-and-more/ - webarchive
- https://www.intezer.com/blog/research/stantinkos-proxy-after-your-apache-server/ - webarchive
- https://www.welivesecurity.com/2020/03/19/stantinko-new-cryptominer-unique-obfuscation-techniques/ - webarchive
- https://www.welivesecurity.com/2017/07/20/stantinko-massive-adware-campaign-operating-covertly-since-2012/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
STEELCORGI
According to FireEye, STEELCORGI is a packer for Linux ELF files that makes use of execution guardrails by sourcing decryption key material from environment variables.
Internal MISP references
UUID 21ff33b5-ef21-4263-8747-7de3d2dbdde6 which can be used as unique global reference for STEELCORGI in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.steelcorgi - webarchive
- https://yoroi.company/research/shadows-from-the-past-threaten-italian-enterprises/ - webarchive
- https://www.mandiant.com/resources/unc2891-overview - webarchive
- https://www.fireeye.com/blog/threat-research/2020/11/live-off-the-land-an-overview-of-unc1945.html - webarchive
- https://yoroi.company/research/opening-steelcorgi-a-sophisticated-apt-swiss-army-knife/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sunless
Internal MISP references
UUID d03fa69b-53a4-4f61-b800-87e4246d2656 which can be used as unique global reference for Sunless in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
sustes miner
Sustes Malware doesn’t infect victims by itself (it’s not a worm) but it is spread over exploitation and brute-force activities with special focus on IoT and Linux servers. The initial infection stage comes from a custom wget directly on the victim machine followed by a simple /bin/bash mr.sh. The script is a simple bash script which drops and executes additional software.
Internal MISP references
UUID 5c117b01-826b-4656-b6ca-8b18b6e6159f which can be used as unique global reference for sustes miner in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Suterusu
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Suterusu.
| Known Synonyms |
|---|
HCRootkit |
Internal MISP references
UUID d2748a0c-8739-4006-95c4-bdf6350d7fa9 which can be used as unique global reference for Suterusu in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sword2033
Internal MISP references
UUID 9c1a32c7-45b4-4d3a-9d15-300b353f32a7 which can be used as unique global reference for Sword2033 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Symbiote
A malware capable of capturing credentials and enabling backdoor access, implemented as a userland rootkit. It uses three methods for hiding its network activity, by hooking and hijacking 1) fopen/fopen64, 2) eBPF, 3) a set of libpcap functions.
Internal MISP references
UUID 4339d876-768c-4cdf-941f-3f55a08aafca which can be used as unique global reference for Symbiote in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.symbiote - webarchive
- https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/ - webarchive
- https://cybergeeks.tech/how-to-analyze-linux-malware-a-case-study-of-symbiote/ - webarchive
- https://www.trendmicro.com/en_us/research/23/g/detecting-bpfdoor-backdoor-variants-abusing-bpf-filters.html - webarchive
- https://blogs.blackberry.com/en/2022/06/symbiote-a-new-nearly-impossible-to-detect-linux-threat - webarchive
- https://cybergeeks.tech/how-to-analyze-linux-malware-a-case-study-of-symbiote - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SysJoker (ELF)
Internal MISP references
UUID c4b681ec-f5b5-433a-9314-07e06f739ba2 which can be used as unique global reference for SysJoker (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.sysjoker - webarchive
- https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/ - webarchive
- https://blogs.vmware.com/security/2022/03/%e2%80%afsysjoker-an-analysis-of-a-multi-os-rat.html - webarchive
- https://www.bleepingcomputer.com/news/security/new-sysjoker-backdoor-targets-windows-macos-and-linux/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sysrv-hello (ELF)
Cryptojacking botnet
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sysrv-hello (ELF).
| Known Synonyms |
|---|
Sysrv |
Internal MISP references
UUID d471083a-c8e1-4d9b-907e-685c9a75c1f9 which can be used as unique global reference for Sysrv-hello (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.sysrvhello - webarchive
- https://www.riskiq.com/blog/external-threat-management/sysrv-hello-cryptojacking-botnet/ - webarchive
- https://www.lacework.com/sysrv-hello-expands-infrastructure/ - webarchive
- https://darktrace.com/blog/worm-like-propagation-of-sysrv-hello-crypto-jacking-botnet - webarchive
- https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TeamTNT
Since Fall 2019, Team TNT is a well known threat actor which targets *nix based systems and misconfigured Docker container environments. It has constantly evolved its capabilities for its cloud-based cryptojacking operations. They have shifted their focus on compromising Kubernetes Clusters.
Internal MISP references
UUID 24695f84-d3af-477e-92dd-c05c9536ebf5 which can be used as unique global reference for TeamTNT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.teamtnt - webarchive
- https://cybersecurity.att.com/blogs/labs-research/teamtnt-delivers-malware-with-new-detection-evasion-tool - webarchive
- https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf - webarchive
- https://www.cadosecurity.com/post/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials - webarchive
- https://blog.aquasec.com/teamtnt-campaign-against-docker-kubernetes-environment - webarchive
- https://www.trendmicro.com/en_us/research/21/l/more-tools-in-the-arsenal-how-teamtnt-used-compromised-docker-hu.html - webarchive
- https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera - webarchive
- https://unit42.paloaltonetworks.com/atoms/thieflibra/ - webarchive
- https://unit42.paloaltonetworks.com/atoms/adept-libra/ - webarchive
- https://www.lacework.com/teamtnt-builds-botnet-from-chinese-cloud-servers/ - webarchive
- https://www.cyberark.com/resources/threat-research-blog/conti-group-leaked - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://www.anomali.com/blog/inside-teamtnts-impressive-arsenal-a-look-into-a-teamtnt-server - webarchive
- https://www.intezer.com/blog/malware-analysis/teamtnt-cryptomining-explosion/ - webarchive
- https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/ - webarchive
- https://www.cadosecurity.com/2020/08/17/teamtnt-the-first-crypto-mining-worm-to-steal-aws-credentials/ - webarchive
- https://www.uptycs.com/blog/team-tnt-deploys-malicious-docker-image-on-docker-hub-with-pentesting-tools - webarchive
- https://sysdig.com/blog/teamtnt-aws-credentials/ - webarchive
- https://tolisec.com/active-crypto-mining-operation-by-teamtnt/ - webarchive
- https://www.trendmicro.com/en_ae/research/21/k/teamtnt-upgrades-arsenal-refines-focus-on-kubernetes-and-gpu-env.html - webarchive
- https://www.cadosecurity.com/teamtnt-script-employed-to-grab-aws-credentials/ - webarchive
- https://www.intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf - webarchive
- https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TheMoon
Internal MISP references
UUID ed098719-797b-4cb3-a73c-65b6d08ebdfa which can be used as unique global reference for TheMoon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TNTbotinger
Internal MISP references
UUID 00319b53-e31c-4623-a3ac-9a18bc52bf36 which can be used as unique global reference for TNTbotinger in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Torii
Internal MISP references
UUID a874575e-0ad7-464d-abb6-8f4b7964aa92 which can be used as unique global reference for Torii in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Trump Bot
Internal MISP references
UUID feb6a5f6-32f9-447d-af9c-08e499457883 which can be used as unique global reference for Trump Bot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TSCookie
Internal MISP references
UUID 592f7cc6-1e07-4d83-8082-aef027e9f1e2 which can be used as unique global reference for TSCookie in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.tscookie - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf - webarchive
- https://www.macnica.net/file/mpressioncss_ta_report_2019_2_nopw.pdf - webarchive
- https://www.macnica.net/pdf/mpressioncss_ta_report_2019_4_en.pdf - webarchive
- https://www.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revealing-threat-in-the-shadow-by-chi-en-shen-ashley-oleg-bondarenko - webarchive
- https://www.ironnet.com/blog/china-cyber-attacks-the-current-threat-landscape - webarchive
- https://twitter.com/ESETresearch/status/1382054011264700416 - webarchive
- https://www.macnica.net/file/mpressioncss_ta_report_2019_4.pdf - webarchive
- https://blogs.jpcert.or.jp/en/2020/03/elf-tscookie.html - webarchive
- https://jp.security.ntt/resources/EN-BlackTech_2021.pdf - webarchive
- https://www.cyberandramen.net/home/blacktech-doesnt-miss-a-step-a-quick-analysis-of-a-busy-2020 - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_0_JPCERT_en.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
tsh
Internal MISP references
UUID 95a07de2-0e17-48a7-b935-0c1c0c0e39af which can be used as unique global reference for tsh in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Tsunami (ELF)
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Tsunami (ELF).
| Known Synonyms |
|---|
Amnesia |
Muhstik |
Radiation |
Internal MISP references
UUID 21540126-d0bb-42ce-9b93-341fedb94cac which can be used as unique global reference for Tsunami (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.tsunami - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/log4j-vulnerabilities-attacks - webarchive
- https://www.cadosecurity.com/analysis-of-initial-in-the-wild-attacks-exploiting-log4shell-log4j-cve-2021-44228/ - webarchive
- https://www.ibm.com/downloads/cas/WMDZOWK6?social_post=5483919673&linkId=131648775 - webarchive
- http://get.cyberx-labs.com/radiation-report - webarchive
- https://www.lacework.com/meet-muhstik-iot-botnet-infecting-cloud-servers/ - webarchive
- https://www.lacework.com/blog/muhstik-takes-aim-at-confluence-cve-2021-26084/ - webarchive
- https://blog.aquasec.com/fileless-malware-container-security - webarchive
- https://tolisec.com/multi-vector-minertsunami-botnet-with-ssh-lateral-movement/ - webarchive
- http://researchcenter.paloaltonetworks.com/2017/04/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/ - webarchive
- https://www.bleepingcomputer.com/news/security/log4shell-exploits-now-used-mostly-for-ddos-botnets-cryptominers/ - webarchive
- https://blog.aquasec.com/8220-gang-confluence-vulnerability-cve-2022-26134 - webarchive
- https://medium.com/s2wblog/logs-of-log4shell-cve-2021-44228-log4j-is-ubiquitous-en-809064312039 - webarchive
- https://blog.aquasec.com/new-malware-in-the-cloud-by-teamtnt - webarchive
- https://blogs.juniper.net/en-us/security/muhstik-gang-targets-redis-servers - webarchive
- https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/ - webarchive
- https://www.fortinet.com/blog/threat-research/recent-attack-uses-vulnerability-on-confluence-server - webarchive
- https://asec.ahnlab.com/en/54647/ - webarchive
- https://threatpost.com/muhstik-botnet-exploits-highly-critical-drupal-bug/131360/ - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ - webarchive
- https://sysdig.com/blog/muhstik-malware-botnet-analysis/ - webarchive
- https://www.cadosecurity.com/teamtnt-script-employed-to-grab-aws-credentials/ - webarchive
- https://www.intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Turla RAT
Internal MISP references
UUID 1b62a421-c0db-4425-bcb2-a4925d5d33e0 which can be used as unique global reference for Turla RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Umbreon
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Umbreon.
| Known Synonyms |
|---|
Espeon |
Internal MISP references
UUID 637000f7-4363-44e0-b795-9cfb7a3dc460 which can be used as unique global reference for Umbreon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.umbreon - webarchive
- http://contagiodump.blogspot.com/2018/03/rootkit-umbreon-umreon-x86-arm-samples.html - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/pokemon-themed-umbreon-linux-rootkit-hits-x86-arm-systems/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified Linux 001
According to Cybereason, these scripts have been used in an ongoing campaign exploiting a widespread vulnerability in the Exim MTA: CVE-2019-10149. This attack leverages a week-old vulnerability to gain remote command execution on the target machine, search the Internet for other machines to infect, and initiates a crypto miner.
Internal MISP references
UUID b5b59d9f-f9e2-4201-a017-f2bae0470808 which can be used as unique global reference for Unidentified Linux 001 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified ELF 004
Implant used by APT31 on compromised SOHO infrastructure, tries to camouflage as a tool ("unifi-video") related to Ubiquiti UniFi surveillance cameras.
Internal MISP references
UUID 44a57915-2ec0-476f-9f20-b11082f5b5a4 which can be used as unique global reference for Unidentified ELF 004 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 005 (Sidecopy)
Internal MISP references
UUID d49402b3-9f2a-4d9a-ae09-b1509da2e8fd which can be used as unique global reference for Unidentified 005 (Sidecopy) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified ELF 006 (Tox Backdoor)
Enables remote execution of scripts on a host, communicates via Tox.
Internal MISP references
UUID 61a36688-0a4f-4899-8b17-ca0d5ff7e800 which can be used as unique global reference for Unidentified ELF 006 (Tox Backdoor) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hive (Vault 8)
Internal MISP references
UUID 721fa6d1-da73-4dd4-9154-a60ff4607467 which can be used as unique global reference for Hive (Vault 8) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vermilion Strike (ELF)
Internal MISP references
UUID a4ded098-be7b-4852-adfd-8971ace583f1 which can be used as unique global reference for Vermilion Strike (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.vermilion_strike - webarchive
- https://notes.netbytesec.com/2021/09/discovering-linux-elf-beacon-of-cobalt_18.html - webarchive
- https://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/ - webarchive
- https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
VPNFilter
Internal MISP references
UUID 5ad30da2-2645-4893-acd9-3f8e0fbb5500 which can be used as unique global reference for VPNFilter in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.vpnfilter - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ - webarchive
- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophos-VPN-Filter-analysis-v2.pdf?la=en - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf - webarchive
- https://msrc-blog.microsoft.com/2019/08/05/corporate-iot-a-path-to-intrusion/ - webarchive
- https://blog.talosintelligence.com/2022/02/threat-advisory-cyclops-blink.html - webarchive
- https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter - webarchive
- https://blog.talosintelligence.com/2018/05/VPNFilter.html - webarchive
- https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-advanced-persistent-threat-28-botnet-infected - webarchive
- https://i.blackhat.com/USA-19/Thursday/us-19-Doerr-The-Enemy-Within-Modern-Supply-Chain-Attacks.pdf - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-054a - webarchive
- https://blog.talosintelligence.com/2018/06/vpnfilter-update.html?m=1 - webarchive
- https://www.trendmicro.com/en_us/research/21/a/vpnfilter-two-years-later-routers-still-compromised-.html - webarchive
- https://www.tesorion.nl/en/resources/pdfstore/Report-OSINT-Russia-Ukraine-Conflict-Cyberaspect.pdf - webarchive
- https://blog.talosintelligence.com/2018/09/vpnfilter-part-3.html - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-054A%20New%20Sandworm%20Malware%20Cyclops%20Blink%20Replaces%20VPN%20Filter.pdf - webarchive
- https://blog.talosintelligence.com/2022/02/current-executive-guidance-for-ongoing.html - webarchive
- https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games - webarchive
- https://cyberpeaceinstitute.org/ukraine-timeline-of-cyberattacks - webarchive
- https://blog.talosintelligence.com/2019/05/one-year-later-vpnfilter-catastrophe.html - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-110a - webarchive
- https://www.symantec.com/blogs/threat-intelligence/vpnfilter-iot-malware - webarchive
- https://www.lacework.com/blog/mirai-goes-stealth-tls-iot-malware/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/vpnfilter-affected-devices-still-riddled-with-19-vulnerabilities - webarchive
- https://securelist.com/vpnfilter-exif-to-c2-mechanism-analysed/85721/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WatchBog
According to Intezer, this is a spreader module used by WatchBog. It is a dynamically linked ELF executable, compiled with Cython. C&C adresses are fetched from Pastebin. C&C communication references unique identification keys per victim. It contains a BlueKeep scanner, reporting positively scanned hosts to the C&C server (RC4 encrypted within SSL/TLS). It contains 5 exploits targeting Jira, Exim, Solr, Jenkins and Nexus Repository Manager 3.
Internal MISP references
UUID aa00d8c9-b479-4d05-9887-cd172a11cfc9 which can be used as unique global reference for WatchBog in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WellMail
Internal MISP references
UUID 93ffafbd-a8af-4164-b3ab-9b21e6d09232 which can be used as unique global reference for WellMail in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.wellmail - webarchive
- https://blog.talosintelligence.com/2020/08/attribution-puzzle.html - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://www.ironnet.com/blog/russian-cyber-attack-campaigns-and-actors - webarchive
- https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf - webarchive
- https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development.pdf - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198c - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/wellmail.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
elf.wellmess
Internal MISP references
UUID b0046a6e-3b8b-45ad-a357-dabc46aba7de which can be used as unique global reference for elf.wellmess in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.wellmess - webarchive
- https://blog.talosintelligence.com/2020/08/attribution-puzzle.html - webarchive
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/ - webarchive
- https://community.riskiq.com/article/541a465f/description - webarchive
- https://www.ironnet.com/blog/russian-cyber-attack-campaigns-and-actors - webarchive
- https://us-cert.cisa.gov/sites/default/files/publications/AA21-116A_Russian_Foreign_Intelligence_Service_Cyber_Operations_508C.pdf - webarchive
- https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf - webarchive
- https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development.pdf - webarchive
- https://www.botconf.eu/wp-content/uploads/2018/12/2018-Y-Ishikawa-S-Nagano-Lets-go-with-a-Go-RAT-_final.pdf - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa21-116a - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-old-dogs-new-tricks.pdf - webarchive
- https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/ - webarchive
- https://services.global.ntt/en-us/insights/blog/the-layered-infrastructure-operated-by-apt29 - webarchive
- https://blogs.jpcert.or.jp/en/2018/07/malware-wellmes-9b78.html - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/wellmess-analysis-command-control.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WHIRLPOOL
Internal MISP references
UUID be3a5211-45a8-496a-974f-6ef14f44af3d which can be used as unique global reference for WHIRLPOOL in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WhiteRabbit
Internal MISP references
UUID 901b88e6-4759-4aa6-b4d1-9f7da53c2adf which can be used as unique global reference for WhiteRabbit in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.whiterabbit - webarchive
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.WHITERABBIT.YACAET - webarchive
- https://www.bleepingcomputer.com/news/security/march-2023-broke-ransomware-attack-records-with-459-incidents/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Winnti (ELF)
Internal MISP references
UUID d6c5211e-506d-415c-b886-0ced529399a1 which can be used as unique global reference for Winnti (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.winnti - webarchive
- https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a - webarchive
- https://attack.mitre.org/groups/G0096 - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-atlas - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0808.pdf - webarchive
- https://asec.ahnlab.com/en/55785/ - webarchive
- https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought - webarchive
- https://blog.exatrack.com/melofee/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Wirenet (ELF)
Internal MISP references
UUID 47a8fedb-fd60-493a-9b7d-082bdb85621e which can be used as unique global reference for Wirenet (ELF) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
X-Agent (ELF)
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular X-Agent (ELF).
| Known Synonyms |
|---|
chopstick |
fysbis |
splm |
Internal MISP references
UUID a8404a31-968a-47e8-8434-533ceaf84c1f which can be used as unique global reference for X-Agent (ELF) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.xagent - webarchive
- http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf - webarchive
- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ - webarchive
- https://contagiodump.blogspot.de/2017/02/russian-apt-apt28-collection-of-samples.html - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-twilight - webarchive
- http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/ - webarchive
- https://unit42.paloaltonetworks.com/a-look-into-fysbis-sofacys-linux-backdoor/ - webarchive
- https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/ - webarchive
- https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Xanthe
Internal MISP references
UUID 55b4d75f-adcc-47df-81cf-6c93ccb54a56 which can be used as unique global reference for Xanthe in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.xanthe - webarchive
- https://www.cadosecurity.com/abcbot-an-evolution-of-xanthe/ - webarchive
- https://blog.talosintelligence.com/2020/12/xanthe-docker-aware-miner.html - webarchive
- https://www.ibm.com/downloads/cas/WMDZOWK6?social_post=5483919673&linkId=131648775 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Xaynnalc
Internal MISP references
UUID 32b95dc7-03a6-45ab-a991-466208dd92d2 which can be used as unique global reference for Xaynnalc in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Xbash
Internal MISP references
UUID ee54fc1e-c574-4836-8cdb-992ac38cef32 which can be used as unique global reference for Xbash in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
xdr33
According to 360 netlab, this backdoor was derived from the leaked CIA Hive project. It propagates via a vulnerability in F5 and communicates using SSL with a forged Kaspersky certificate.
Internal MISP references
UUID c7b1cc91-7464-436e-ac40-3b06c98400a5 which can be used as unique global reference for xdr33 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XOR DDoS
Linux DDoS C&C Malware
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular XOR DDoS.
| Known Synonyms |
|---|
XORDDOS |
Internal MISP references
UUID 7f9df618-4bd1-44a1-ad88-e5930373aac4 which can be used as unique global reference for XOR DDoS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.xorddos - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/19/rise-in-xorddos-a-deeper-look-at-the-stealthy-ddos-malware-targeting-linux-devices/ - webarchive
- https://blog.avast.com/2015/01/06/linux-ddos-trojan-hiding-itself-with-an-embedded-rootkit/ - webarchive
- https://bartblaze.blogspot.com/2015/09/notes-on-linuxxorddos.html - webarchive
- https://www.crowdstrike.com/blog/linux-targeted-malware-increased-by-35-percent-in-2021/ - webarchive
- https://www.intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/ - webarchive
- https://en.wikipedia.org/wiki/Xor_DDoS - webarchive
- https://www.ibm.com/downloads/cas/WMDZOWK6?social_post=5483919673&linkId=131648775 - webarchive
- https://maxkersten.nl/binary-analysis-course/analysis-scripts/ghidra-script-to-decrypt-a-string-array-in-xor-ddos/ - webarchive
- https://www.lacework.com/groundhog-botnet-rapidly-infecting-cloud/ - webarchive
- http://blog.malwaremustdie.org/2014/09/mmd-0028-2014-fuzzy-reversing-new-china.html - webarchive
- https://blog.checkpoint.com/wp-content/uploads/2015/10/sb-report-threat-intelligence-groundhog.pdf - webarchive
- https://www.fireeye.com/blog/threat-research/2015/02/anatomy_of_a_brutef.html - webarchive
- https://blog.nsfocusglobal.com/threats/vulnerability-analysis/analysis-report-of-the-xorddos-malware-family/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2015/KalnaiHorejsi-VB2015.pdf - webarchive
- https://www.botconf.eu/wp-content/uploads/2015/12/OK-P13-Liu-Ya-Automatically-Classify-Unknown-Bots-by-The-Register-Messages.pdf - webarchive
- https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZeroBot
ZeroBot is a Go-based botnet that spreads primarily through IoT and web application vulnerabilities. It is offered as malware as a service (MaaS) and infrastructure overlaps with DDoS-for-hire services seized by the FBI in December 2022.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ZeroBot.
| Known Synonyms |
|---|
ZeroStresser |
Internal MISP references
UUID 458c583b-4353-4104-bee8-9e68cb77f151 which can be used as unique global reference for ZeroBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZHtrap
Internal MISP references
UUID d070ff73-ad14-4f6b-951f-1645009bdf80 which can be used as unique global reference for ZHtrap in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zollard
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Zollard.
| Known Synonyms |
|---|
darlloz |
Internal MISP references
UUID 9218630d-0425-4b18-802c-447a9322990d which can be used as unique global reference for Zollard in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZuoRAT
According to Black Lotus Labs, ZuoRAT is a MIPS file compiled for SOHO routers that can enumerate a host and internal LAN, capture packets being transmitted over the infected device and perform person-in-the-middle attacks (DNS and HTTPS hijacking based on predefined rules).
Internal MISP references
UUID c4b0a7cd-b349-44a1-94ca-3d5a4ac288b2 which can be used as unique global reference for ZuoRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AutoCAD Downloader
Small downloader composed as a Fast-AutoLoad LISP (FAS) module for AutoCAD.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular AutoCAD Downloader.
| Known Synonyms |
|---|
Acad.Bursted |
Duxfas |
Internal MISP references
UUID fb22d876-c6b5-4634-a468-5857088d605c which can be used as unique global reference for AutoCAD Downloader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DualToy (iOS)
Internal MISP references
UUID f7c1675f-b38a-4511-9ac4-6e475b3815e6 which can be used as unique global reference for DualToy (iOS) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GuiInject
Internal MISP references
UUID d9215579-eee0-4e50-9157-dba7c3214769 which can be used as unique global reference for GuiInject in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
lightSpy
Internal MISP references
UUID 8a1b524b-8fc9-4b1d-805d-c0407aff00d7 which can be used as unique global reference for lightSpy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ios.lightspy - webarchive
- https://documents.trendmicro.com/assets/Tech-Brief-Operation-Poisoned-News-Hong-Kong-Users-Targeted-with-Mobile-Malware-via-Local-News-Links.pdf - webarchive
- https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack - webarchive
- https://securelist.com/ios-exploit-chain-deploys-lightspy-malware/96407/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/operation-poisoned-news-hong-kong-users-targeted-with-mobile-malware-via-local-news-links/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Phenakite
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Phenakite.
| Known Synonyms |
|---|
Dakkatoni |
Internal MISP references
UUID 7ba7488c-b153-4949-8391-bcf6c4b057bd which can be used as unique global reference for Phenakite in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PoisonCarp
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PoisonCarp.
| Known Synonyms |
|---|
INSOMNIA |
Internal MISP references
UUID 7982cc15-f884-40ca-8a82-a452b9c340c7 which can be used as unique global reference for PoisonCarp in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ios.poisoncarp - webarchive
- https://googleprojectzero.blogspot.com/2019/08/implant-teardown.html - webarchive
- https://citizenlab.ca/2019/09/poison-carp-tibetan-groups-targeted-with-1-click-mobile-exploits/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/new-android-spyware-actionspy-revealed-via-phishing-attacks-from-earth-empusa/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Postlo
Internal MISP references
UUID 25bff9ad-20dc-4746-a174-e54fcdd8f0c1 which can be used as unique global reference for Postlo in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TriangleDB
Internal MISP references
UUID 25754894-018b-4bed-aab6-c676fac23a77 which can be used as unique global reference for TriangleDB in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ios.triangledb - webarchive
- https://securelist.com/triangledb-triangulation-implant/110050/ - webarchive
- https://media.ccc.de/v/37c3-11859-operation_triangulation_what_you_get_when_attack_iphones_of_researchers - webarchive
- https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WireLurker (iOS)
The iOS malware that is installed over USB by osx.wirelurker
Internal MISP references
UUID bb340271-023c-4283-9d22-123317824a11 which can be used as unique global reference for WireLurker (iOS) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
X-Agent (iOS)
Internal MISP references
UUID 430b9f30-5e37-49c8-b4e7-21589f120d89 which can be used as unique global reference for X-Agent (iOS) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AdWind
Part of Malware-as-service platform Used as a generic name for Java-based RAT Functionality - collect general system and user information - terminate process -log keystroke -take screenshot and access webcam - steal cache password from local or web forms - download and execute Malware - modify registry - download components - Denial of Service attacks - Acquire VPN certificates
Initial infection vector 1. Email to JAR files attached 2. Malspam URL to downlaod the malware
Persistence - Runkey - HKCU\Software\Microsoft\Windows\current version\run
Hiding Uses attrib.exe
Notes on Adwind The malware is not known to be proxy aware
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular AdWind.
| Known Synonyms |
|---|
AlienSpy |
Frutas |
JBifrost |
JSocket |
Sockrat |
UNRECOM |
Internal MISP references
UUID 8eb9d4aa-257a-45eb-8c65-95c18500171c which can be used as unique global reference for AdWind in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/jar.adwind - webarchive
- https://research.checkpoint.com/malware-against-the-c-monoculture/ - webarchive
- http://malware-traffic-analysis.net/2017/07/04/index.html - webarchive
- https://gist.github.com/herrcore/8336975475e88f9bc539d94000412885 - webarchive
- https://www.securityinbits.com/malware-analysis/interesting-tactic-by-ratty-adwind-distribution-of-jar-appended-to-signed-msi/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://marcoramilli.com/2018/08/20/interesting-hidden-threat-since-years/ - webarchive
- https://dissectingmalware.blogspot.com/2018/08/export-jratadwind-config-with-x32dbg.html - webarchive
- https://www.zscaler.com/blogs/research/compromised-wordpress-sites-used-distribute-adwind-rat - webarchive
- https://www.fortinet.com/blog/threat-research/new-jrat-adwind-variant-being-spread-with-package-delivery-scam.html - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/spam-remote-access-trojan-adwind-jrat - webarchive
- https://blogs.seqrite.com/evolution-of-jrat-java-malware/ - webarchive
- https://threatresearch.ext.hp.com/javascript-malware-dispensing-rats-into-the-wild/ - webarchive
- https://blog.talosintelligence.com/2018/09/adwind-dodgesav-dde.html - webarchive
- https://citizenlab.ca/2015/12/packrat-report/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Adzok
Internal MISP references
UUID 90cb8ee6-52e6-4d8d-8f45-f04b9aec1f6c which can be used as unique global reference for Adzok in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Banload
F-Secure observed Banload variants silently downloading malicious files from a remote server, then installing and executing the files.
Internal MISP references
UUID 30a61fa9-4bd1-427d-9382-ff7c33bd7043 which can be used as unique global reference for Banload in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/jar.banload - webarchive
- https://colin.guru/index.php?title=Advanced_Banload_Analysis - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2015/05/CPL-Malware-in-Brasil-zx02m.pdf - webarchive
- https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf - webarchive
- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3AWin32%2FBanload - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Blue Banana RAT
Internal MISP references
UUID c51bbc9b-0906-4ac5-8026-d6b8b7b23e71 which can be used as unique global reference for Blue Banana RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CrossRAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CrossRAT.
| Known Synonyms |
|---|
Trupto |
Internal MISP references
UUID bae3a6c7-9e58-47f2-8749-a194675e1c84 which can be used as unique global reference for CrossRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DynamicRAT
DynamicRAT is a malware that is spread via email attachments and compromises the security of computer systems. Once running on a device, DynamicRAT establishes a persistent presence and gives attackers complete remote control. Its features include sensitive data exfiltration, hardware control, remote action, and the ability to perform DDoS attacks. In addition, DynamicRAT uses evasion and persistence techniques to evade detection and analysis by security solutions.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DynamicRAT.
| Known Synonyms |
|---|
DYNARAT |
Internal MISP references
UUID 28539c3d-89a4-4dd6-85f5-f4c95808c0b7 which can be used as unique global reference for DynamicRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EpicSplit RAT
EpicSplit RAT is a multiplatform Java RAT that is capable of running shell commands, downloading, uploading, and executing files, manipulating the file system, establishing persistence, taking screenshots, and manipulating keyboard and mouse events. EpicSplit is typically obfuscated with the commercial Allatori Obfuscator software. One unique feature of the malware is that TCP messages sent by EpicSplit RAT to its C2 are terminated with the string "packet" as a packet delimiter.
Internal MISP references
UUID 90b304a2-452a-4c74-ae8d-80d9ace881a4 which can be used as unique global reference for EpicSplit RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FEimea RAT
Internal MISP references
UUID 3724d5d0-860d-4d1e-92a1-0a7089ca2bb3 which can be used as unique global reference for FEimea RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IceRat
According to Karsten Hahn, this malware is actually written in JPHP, but can be treated similar to .class files produced by Java. IceRat has been observed to carry out information stealing and mining.
Internal MISP references
UUID ac83a481-2ab4-42c2-a8b6-a4aec96e1c4b which can be used as unique global reference for IceRat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JavaDispCash
JavaDispCash is a piece of malware designed for ATMs. The compromise happens by using the JVM attach-API on the ATM's local application and the goal is to remotely control its operation. The malware's primary feature is the ability to dispense cash. The malware also spawns a local port (65413) listening for commands from the attacker which needs to be located in the same internal network.
Internal MISP references
UUID 71286008-9794-4dcc-a571-164195390c39 which can be used as unique global reference for JavaDispCash in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JavaLocker
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular JavaLocker.
| Known Synonyms |
|---|
JavaEncrypt Ransomware |
Internal MISP references
UUID 4bdddf41-8d5e-468d-905d-8c6667a5d47f which can be used as unique global reference for JavaLocker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
jRAT
jRAT, also known as Jacksbot, is a RAT with history, written in Java. It has support for macOS, Linux, Windows and various BSD. It also has functionality to participate in DDoS-attacks as well as to perform click fraud. Note that the Adwind family often is mistakenly labeled as jRAT, because of of a red hering reference to jrat.io.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular jRAT.
| Known Synonyms |
|---|
Jacksbot |
Internal MISP references
UUID f2a9f583-b4dd-4669-8808-49c8bbacc376 which can be used as unique global reference for jRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/jar.jrat - webarchive
- https://research.checkpoint.com/malware-against-the-c-monoculture/ - webarchive
- https://www.eff.org/files/2018/01/29/operation-manul.pdf - webarchive
- https://maskop9.wordpress.com/2019/02/06/analysis-of-jacksbot-backdoor/ - webarchive
- https://www.intego.com/mac-security-blog/new-multiplatform-backdoor-jacksbot-discovered - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/jacksbot-has-some-dirty-tricks-up-its-sleeves/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
jSpy
Internal MISP references
UUID ff24997d-1f17-4f00-b9b8-b3392146540f which can be used as unique global reference for jSpy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Octopus Scanner
Internal MISP references
UUID 8ae996fe-50bb-479b-925c-e6b1e51a9b40 which can be used as unique global reference for Octopus Scanner in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Qarallax RAT
According to SpiderLabs, in May 2015 the "company" Quaverse offered a RAT known as Quaverse RAT or QRAT. At around May 2016, this QRAT evolved into another RAT which became known as Qarallax RAT, because its C2 is at qarallax.com. Quaverse also offers a service to encrypt Java payloads (Qrypter), and thus qrypted payloads are sometimes confused with Quaverse RATs (QRAT / Qarallax RAT).
Internal MISP references
UUID e7852eb9-9de9-43d3-9f7e-3821f3b2bf41 which can be used as unique global reference for Qarallax RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Qealler
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Qealler.
| Known Synonyms |
|---|
Pyrogenic Infostealer |
Internal MISP references
UUID d16a3a1f-e244-4715-a67f-61ba30901efb which can be used as unique global reference for Qealler in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/jar.qealler - webarchive
- https://www.securityinbits.com/malware-analysis/pyrogenic-infostealer-static-analysis-part-0x1/ - webarchive
- https://www.securityinbits.com/malware-analysis/unpacking/unpacking-pyrogenic-qealler-using-java-agent-part-0x2/ - webarchive
- https://www.herbiez.com/?p=1352 - webarchive
- https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer - webarchive
- https://github.com/jeFF0Falltrades/Malware-Writeups/blob/master/Qealler/Qealler-Unloaded.pdf - webarchive
- https://www.cyberark.com/threat-research-blog/qealler-the-silent-java-credential-thief/ - webarchive
- https://www.securityinbits.com/malware-analysis/similarity-between-qealler-pyrogenic-variants-part-0x3/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QRat
QRat, also known as Quaverse RAT, was introduced in May 2015 as undetectable (because of multiple layers of obfuscation). It offers the usual functionality (password dumper, file browser, keylogger, screen shots/streaming, ...), and it comes as a SaaS. For additional historical context, please see jar.qarallax.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular QRat.
| Known Synonyms |
|---|
Quaverse RAT |
Internal MISP references
UUID ef385825-bfa1-4e8c-b368-522db78cf1bd which can be used as unique global reference for QRat in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/jar.qrat - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/updated-qnode-rat-downloader-distributed-as-trump-video-scandal/ - webarchive
- https://www.digitrustgroup.com/java-rat-qrat/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/rats-and-spam-the-nodejs-qrat/ - webarchive
- https://www.trustwave.com/Resources/SpiderLabs-Blog/Quaverse-RAT--Remote-Access-as-a-Service/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ratty
Ratty is an open source Java RAT, made available on GitHub and promoted heavily on HackForums. At some point in 2016 / 2017 the original author deleted his repository, but several clones exist.
Internal MISP references
UUID da032a95-b02a-4af2-b563-69f686653af4 which can be used as unique global reference for Ratty in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/jar.ratty - webarchive
- https://www.securityinbits.com/malware-analysis/interesting-tactic-by-ratty-adwind-distribution-of-jar-appended-to-signed-msi/ - webarchive
- https://threatresearch.ext.hp.com/javascript-malware-dispensing-rats-into-the-wild/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sorillus RAT
Sorillus is a Java-based multifunctional remote access trojan (RAT) which targets Linux, macOS and Windows operating systems. While it was first created in 2019, interest in the tool has increased considerably in 2022. Beginning on January 18, 2022, different obfuscated client versions of the tool started to be uploaded to VirusTotal. Sorillus' features are described in detail on its website (hxxps://sorillus[.]com). The tool supposedly costs 49.99€ for lifetime access but is currently available at a discounted 19.99€. Conveniently, the Sorillus can be purchased via a variety of cryptocurrencies. The tool's creator and distributor, a YouTube user known as "Tapt", asserts that the tool is able to collect the following information from its target: - HardwareID - Username - Country - Language - Webcam - Headless - Operating system - Client Version
Internal MISP references
UUID 80694785-aeb6-4e05-a3e8-cb972993d769 which can be used as unique global reference for Sorillus RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
STRRAT
STRRAT is a Java-based RAT, which makes extensive use of plugins to provide full remote access to an attacker, as well as credential stealing, key logging and additional plugins. The RAT has a focus on stealing credentials of browsers and email clients, and passwords via keylogging. It supports the following browsers and email clients: Firefox, Internet Explorer, Chrome, Foxmail, Outlook, Thunderbird.
Since Version 1.2 and above, STRRAT was infamous for its ransomware-like behavior of appending the file name extension .crimson to files. Version 1.5 is notably more obfuscated and modular than previous versions, but the backdoor functions mostly remain the same: collect browser passwords, run remote commands and PowerShell, log keystrokes, among others. Version 1.5 of STRRAT Malware includes a proper encryption routine, though currently pretty simple to revert.
Internal MISP references
UUID 6d1335d5-8351-4725-ad8a-07cabca4119e which can be used as unique global reference for STRRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/jar.strrat - webarchive
- https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries - webarchive
- https://forensicitguy.github.io/strrat-attached-to-msi/ - webarchive
- https://twitter.com/MsftSecIntel/status/1395138347601854465 - webarchive
- https://www.jaiminton.com/reverse-engineering/strrat# - webarchive
- https://umbrella.cisco.com/blog/cybersecurity-threat-spotlight-strrat-zloader-honeygain - webarchive
- https://www.jaiminton.com/reverse-engineering/strrat - webarchive
- https://any.run/cybersecurity-blog/strrat-malware-analysis-of-a-jar-archive/ - webarchive
- https://resources.securityscorecard.com/cybersecurity/analyze-java-malware-strrat#page=1 - webarchive
- https://www.fortinet.com/blog/threat-research/new-strrat-rat-phishing-campaign - webarchive
- https://www.deepinstinct.com/blog/understanding-the-windows-javascript-threat-landscape - webarchive
- https://threatresearch.ext.hp.com/wp-content/uploads/2021/10/HP-Wolf-Security-Threat-Insights-Report-Q3-2021.pdf - webarchive
- https://www.gdatasoftware.com/blog/strrat-crimson - webarchive
- https://isc.sans.edu/diary/rss/27798 - webarchive
- https://threatresearch.ext.hp.com/javascript-malware-dispensing-rats-into-the-wild/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SupremeBot
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SupremeBot.
| Known Synonyms |
|---|
BlazeBot |
Internal MISP references
UUID 651e37e0-1bf8-4024-ac1e-e7bda42470b0 which can be used as unique global reference for SupremeBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Verblecon
This malware seems to be used for attacks installing cyptocurrency miners on infected machines. Other indicators leads to the assumption that attackers may also use this malware for other purposes (e.g. stealing access tokens for Discord chat app). Symantec describes this malware as complex and powerful: The malware is loaded as a server-side polymorphic JAR file.
Internal MISP references
UUID 793565b4-666b-47a4-b15b-de9c80c75a51 which can be used as unique global reference for Verblecon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AIRBREAK
AIRBREAK, a JavaScript-based backdoor which retrieves commands from hidden strings in compromised webpages.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular AIRBREAK.
| Known Synonyms |
|---|
Orz |
Internal MISP references
UUID fd419da6-5c0d-461e-96ee-64397efac63b which can be used as unique global reference for AIRBREAK in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.airbreak - webarchive
- https://www.fireeye.com/blog/threat-research/2018/07/chinese-espionage-group-targets-cambodia-ahead-of-elections.html - webarchive
- http://www.kahusecurity.com/posts/reflow_javascript_backdoor.html - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-mohawk - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bateleur
Internal MISP references
UUID fb75a753-24ba-4b58-b7ed-2e39b0c68c65 which can be used as unique global reference for Bateleur in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.bateleur - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/ - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-niagara - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
- https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BeaverTail
Internal MISP references
UUID da0fb7ce-d730-4ee8-bcc8-3da7eba8ad79 which can be used as unique global reference for BeaverTail in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BELLHOP
• BELLHOP is a JavaScript backdoor interpreted using the native Windows Scripting Host(WSH). After performing some basic host information gathering, the BELLHOP dropper downloads a base64-encoded blob of JavaScript to disk and sets up persistence in three ways: • Creating a Run key in the Registry • Creating a RunOnce key in the Registry • Creating a persistent named scheduled task • BELLHOP communicates using HTTP and HTTPS with primarily benign sites such as Google Docs and PasteBin.
Internal MISP references
UUID 7ebeb691-b979-4a88-94e1-dade780c6a7f which can be used as unique global reference for BELLHOP in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.bellhop - webarchive
- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CACTUSTORCH
According to the GitHub repo, CACTUSTORCH is a JavaScript and VBScript shellcode launcher. It will spawn a 32 bit version of the binary specified and inject shellcode into it.
Internal MISP references
UUID efbb5a7c-8c01-4aca-ac21-8dd614b256f7 which can be used as unique global reference for CACTUSTORCH in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.cactustorch - webarchive
- https://www.macnica.net/file/mpression_automobile.pdf - webarchive
- https://forensicitguy.github.io/analyzing-cactustorch-hta-cobaltstrike/ - webarchive
- https://www.codercto.com/a/46729.html - webarchive
- https://www.seqrite.com/documents/en/white-papers/Seqrite-WhitePaper-Operation-SideCopy.pdf - webarchive
- https://github.com/mdsecactivebreach/CACTUSTORCH - webarchive
- https://www.microsoft.com/security/blog/2020/09/24/gadolinium-detecting-empires-cloud/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ChromeBack
GoSecure describes ChromeBack as a browser hijacker, redirecting traffic and serving advertisements to users.
Internal MISP references
UUID ec055670-4d25-4918-90c7-281fddf3a771 which can be used as unique global reference for ChromeBack in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ClearFake
ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver further malware using the drive-by download technique. The malware leverages social engineering to trick the user into running a fake web browser update.
Internal MISP references
UUID 8899bc6f-62e1-4732-988a-d5d64a5cf9bd which can be used as unique global reference for ClearFake in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryptoNight
WebAssembly-based crpyto miner.
Internal MISP references
UUID faa19699-a884-4cd3-a307-36492c8ee77a which can be used as unique global reference for CryptoNight in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CukieGrab
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CukieGrab.
| Known Synonyms |
|---|
Roblox Trade Assist |
Internal MISP references
UUID d47ca107-3e03-4c25-88f9-8156426b7f60 which can be used as unique global reference for CukieGrab in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkWatchman
Prevailion found this RAT written in JavaScript, which dynamically compiles an accompanying keylogger written in C# and uses a DGA für C&C.
Internal MISP references
UUID 4baf5a22-7eec-4ad8-8780-23a351d9b5f5 which can be used as unique global reference for DarkWatchman in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DNSRat
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DNSRat.
| Known Synonyms |
|---|
DNSbot |
Internal MISP references
UUID a4b40d48-e40b-47f2-8e30-72342231503e which can be used as unique global reference for DNSRat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
doenerium
Open sourced javascript info stealer, with the capabilities of stealing crypto wallets, password, cookies and modify discord clients https://github.com/doener2323/doenerium
Internal MISP references
UUID dc446dbc-6f8a-48ee-9e90-10e679a003e1 which can be used as unique global reference for doenerium in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Enrume
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Enrume.
| Known Synonyms |
|---|
Ransom32 |
Internal MISP references
UUID d6e5f6b7-cafb-476d-958c-72debdabe013 which can be used as unique global reference for Enrume in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EVILNUM (Javascript)
According proofpoint, EvilNum is a backdoor that can be used for data theft or to load additional payloads. The malware includes multiple interesting components to evade detection and modify infection paths based on identified antivirus software.
Internal MISP references
UUID b7deec7e-24f7-4f78-9d58-9b3c1e182ab3 which can be used as unique global reference for EVILNUM (Javascript) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.evilnum - webarchive
- https://blog.prevailion.com/2020/05/phantom-in-command-shell5.html - webarchive
- http://www.pwncode.io/2018/05/javascript-based-bot-using-github-c.html - webarchive
- https://www.clearskysec.com/wp-content/uploads/2019/08/ClearSky-2019-H1-Cyber-Events-Summary-Report.pdf - webarchive
- https://unit42.paloaltonetworks.com/cardinal-rat-sins-again-targets-israeli-fin-tech-firms/ - webarchive
- https://github.com/eset/malware-ioc/tree/master/evilnum - webarchive
- http://blog.nsfocus.net/agentvxapt-evilnum/ - webarchive
- https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/ - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
- https://securelist.com/deathstalker-mercenary-triumvirate/98177/ - webarchive
- https://www.zscaler.com/blogs/security-research/return-evilnum-apt-updated-ttps-and-new-targets - webarchive
- https://mp.weixin.qq.com/s/REXBtbnI2zXj4H3u6ofMMw - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FakeUpdateRU
FakeUpdateRU is a malicious JavaScript code injected into compromised websites to deliver further malware using the drive-by download technique. The malicious code displays a copy of the Google Chrome web browser download page and redirects the user to the download of a next-stage payload.
Internal MISP references
UUID 9106e280-febe-45a3-9cd1-cbffafc0c85b which can be used as unique global reference for FakeUpdateRU in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FAKEUPDATES
FAKEUPDATES is a downloader written in JavaScript that communicates via HTTP. Supported payload types include executables and JavaScript. It writes the payloads to disk prior to launching them. FAKEUPDATES has led to further compromise via additional malware families that include CHTHONIC, DRIDEX, EMPIRE, KOADIC, DOPPELPAYMER, and AZORULT.
FAKEUPDATES has been heavily used by UNC1543,a financially motivated group.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FAKEUPDATES.
| Known Synonyms |
|---|
FakeUpdate |
SocGholish |
Internal MISP references
UUID cff35ce3-8d6f-417b-ae6c-a9e6a60ee26c which can be used as unique global reference for FAKEUPDATES in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.fakeupdates - webarchive
- https://www.lac.co.jp/lacwatch/report/20220407_002923.html - webarchive
- http://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive
- https://experience.mandiant.com/trending-evil/p/1 - webarchive
- https://twitter.com/MsftSecIntel/status/1522690116979855360 - webarchive
- https://blog.sucuri.net/2022/08/socgholish-5-years-of-massive-website-infections.html - webarchive
- https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive
- https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack - webarchive
- https://resource.redcanary.com/rs/003-YRU-314/images/2022_ThreatDetectionReport_RedCanary.pdf - webarchive
- https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/ - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-socgholish-and-zloader-from-fake-updates-and-installers-to-owning-your-systems - webarchive
- https://www.trendmicro.com/en_us/research/22/d/Thwarting-Loaders-From-SocGholish-to-BLISTERs-LockBit-Payload.html - webarchive
- https://www.digitalinformationworld.com/2022/04/threatening-redirect-web-service.html - webarchive
- https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/ - webarchive
- https://killingthebear.jorgetesta.tech/actors/evil-corp - webarchive
- https://medium.com/walmartglobaltech/socgholish-campaigns-and-initial-access-kit-4c4283fea8ee - webarchive
- https://www.menlosecurity.com/blog/increase-in-attack-socgholish - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/d/thwarting-loaders-from-socgholish-to-blisters-lockbit-payload/iocs-thwarting-loaders-socgholish-blister.txt - webarchive
- https://www.mandiant.com/resources/they-come-in-the-night-ransomware-deployment-trends - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2022/06/makemoney-malvertising-campaign-adds-fake-update-template/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2018/04/fakeupdates-campaign-leverages-multiple-website-platforms/ - webarchive
- https://thehackernews.com/2022/07/microsoft-links-raspberry-robin-usb.html?_m=3n%2e009a%2e2800%2ejp0ao0cjb8%2e1shm - webarchive
- https://www.sentinelone.com/labs/socgholish-diversifies-and-expands-its-malware-staging-infrastructure-to-counter-defenders/ - webarchive
- https://decoded.avast.io/janrubin/parrot-tds-takes-over-web-servers-and-threatens-millions/ - webarchive
- https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://expel.io/blog/incident-report-spotting-socgholish-wordpress-injection/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GootLoader
According to PCrisk, they discovered GootLoader malware while examining legitimate but compromised websites (mainly websites managed using WordPress). It was found that GootLoader is used to infect computers with additional malware. Cybercriminals using GootLoader seek to trick users into unknowingly downloading and executing the malware by disguising it as a document or other file.
Internal MISP references
UUID 5b2569e5-aeb2-4708-889f-c6d598bd5e14 which can be used as unique global reference for GootLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.gootloader - webarchive
- https://dinohacks.blogspot.com/2022/06/loading-gootloader.html - webarchive
- https://redcanary.com/wp-content/uploads/2022/05/Gootloader.pdf - webarchive
- https://www.esentire.com/blog/gootloader-leads-to-cobalt-strike-and-hand-on-keyboard-activity - webarchive
- https://socradar.io/new-gootloader-variant-gootbot-changes-the-game-in-malware-tactics/ - webarchive
- https://gootloader.wordpress.com/2023/01/05/what-is-gootloader/ - webarchive
- https://www.esentire.com/web-native-pages/gootloader-unloaded - webarchive
- https://experience.mandiant.com/trending-evil/p/1 - webarchive
- https://labs.sentinelone.com/gootloader-initial-access-as-a-service-platform-expands-its-search-for-high-value-targets/ - webarchive
- https://github.com/struppigel/hedgehog-tools/tree/main/gootloader - webarchive
- https://securityintelligence.com/x-force/gootbot-gootloaders-new-approach-to-post-exploitation/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gootloader-why-your-legal-document-search-may-end-in-misery/ - webarchive
- https://blogs.blackberry.com/en/2022/07/gootloader-from-seo-poisoning-to-multi-stage-downloader - webarchive
- https://redcanary.com/blog/gootloader - webarchive
- https://community.riskiq.com/article/f5d5ed38 - webarchive
- https://gootloader.wordpress.com/2023/01/05/gootloader-command-control/ - webarchive
- https://www.kroll.com/en/insights/publications/cyber/deep-dive-gootloader-malware-infection-chain - webarchive
- https://web.archive.org/web/20230209123148/https://www.cybereason.com/hubfs/THREAT%20ALERT%20GootLoader%20-%20Large%20payload%20leading%20to%20compromise%20(BLOG).pdf - webarchive
- https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations - webarchive
- https://www.trendmicro.com/en_us/research/23/a/gootkit-loader-actively-targets-the-australian-healthcare-indust.html - webarchive
- https://www.reliaquest.com/blog/gootloader-infection-credential-access/ - webarchive
- https://blog.nviso.eu/2022/07/20/analysis-of-a-trojanized-jquery-script-gootloader-unleashed/ - webarchive
- https://threatresearch.ext.hp.com/tips-for-automating-ioc-extraction-from-gootloader-a-changing-javascript-malware/ - webarchive
- https://www.esentire.com/blog/gootloader-striking-with-a-new-infection-technique - webarchive
- https://news.sophos.com/en-us/2021/08/12/gootloaders-mothership-controls-malicious-content/ - webarchive
- https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
grelos
grelos is a skimmer used for magecart-style attacks.
Internal MISP references
UUID 79580c0b-c390-4421-976a-629a5c11af95 which can be used as unique global reference for grelos in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Griffon
GRIFFON is a lightweight JavaScript validator-style implant without any persistence mechanism. The malware is designed for receiving modules to be executed in-memory and sending the results to C2s. The first module downloaded by the GRIFFON malware to the victim’s computer is an information-gathering JavaScript, which allows the cybercriminals to understand the context of the infected workstation.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Griffon.
| Known Synonyms |
|---|
Harpy |
Internal MISP references
UUID 85c25380-69d7-4d7e-b279-6b6791fd40bd which can be used as unique global reference for Griffon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.griffon - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/ - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-2/ - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf - webarchive
- https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/would-you-exchange-your-security-for-a-gift-card/ - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-niagara - webarchive
- https://www.deepinstinct.com/blog/understanding-the-windows-javascript-threat-landscape - webarchive
- https://www.mandiant.com/resources/evolution-of-fin7 - webarchive
- https://twitter.com/ItsReallyNick/status/1059898708286939136 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
inter
Internal MISP references
UUID 36b0f1a0-29a4-4ec5-bca2-18a241881d49 which can be used as unique global reference for inter in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Jeniva
Internal MISP references
UUID b0631a44-3264-429d-b8bc-3a27e27be305 which can be used as unique global reference for Jeniva in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Jetriz
Internal MISP references
UUID 9e6a0a54-8b55-4e78-a3aa-15d1946882e1 which can be used as unique global reference for Jetriz in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
jspRAT
Internal MISP references
UUID 71903afc-7129-4821-90e5-c490e4902de3 which can be used as unique global reference for jspRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KopiLuwak
Internal MISP references
UUID 2269d37b-87e9-460d-b878-b74a2f4c3537 which can be used as unique global reference for KopiLuwak in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.kopiluwak - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://securelist.com/tomiris-called-they-want-their-turla-malware-back/109552/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/turla-apt-actor-refreshes-kopiluwak-javascript-backdoor-use-g20-themed-attack - webarchive
- https://blog.angelalonso.es/2017/10/analysis-of-malicious-doc-used-by-turla.html - webarchive
- https://securelist.com/blog/research/77429/kopiluwak-a-new-javascript-payload-from-turla/ - webarchive
- https://securelist.com/shedding-skin-turlas-fresh-faces/88069/ - webarchive
- https://www.mandiant.com/resources/blog/turla-galaxy-opportunity - webarchive
- https://pdfhost.io/v/F0@QElMu2_MacProStorage_2017FinalBitdefenderWhitepaperNetrepserA4en_ENBitdefenderWhitepaperNetrepserA4en_ENindd.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LNKR
The LNKR trojan is a malicious browser extension that will monitor the websites visited by the user, looking for pages with administrative privileges such as blog sites or web-based virtual learning environments. When the administrative user posts to the page, the infected extension will execute stored cross-site scripting attack and injects malicious JavaScript into the legitimate HTML of the page. This is used to redirect the second-party visitors of the site to both benign and malicious domains.
Internal MISP references
UUID 1a85acf3-4bda-49b4-9e50-1231f0b7340a which can be used as unique global reference for LNKR in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.lnkr - webarchive
- https://github.com/Zenexer/lnkr - webarchive
- https://krebsonsecurity.com/2020/03/the-case-for-limiting-your-browser-extensions/ - webarchive
- https://github.com/Zenexer/lnkr/blob/master/recon/extensions/fanagokoaogopceablgmpndejhedkjjb/README.md - webarchive
- https://www.riskiq.com/blog/labs/lnkr-browser-extension/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
magecart
Magecart is a malware framework intended to steal credit card information from compromised eCommerce websites. Used in criminal activities, it's a sophisticated implant built on top of relays, command and controls and anonymizers used to steal eCommerce customers' credit card information. The first stage is typically implemented in Javascript included into a compromised checkout page. It copies data from "input fields" and send them to a relay which collects credit cards coming from a subset of compromised eCommerces and forwards them to Command and Control servers.
Internal MISP references
UUID f53e404b-0dcd-4116-91dd-cad94fc41936 which can be used as unique global reference for magecart in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.magecart - webarchive
- https://blog.sucuri.net/2020/11/css-js-steganography-in-fake-flash-player-update-malware.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/us-local-government-services-targeted-by-new-magecart-credit-card-skimming-attack/ - webarchive
- https://community.riskiq.com/article/14924d61 - webarchive
- https://scotthelme.co.uk/introducing-script-watch-detect-magecart-style-attacks-fast/?utm_source=dlvr.it&utm_medium=twitter - webarchive
- https://geminiadvisory.io/magecart-google-tag-manager/ - webarchive
- https://www.perimeterx.com/blog/analyzing_magecart_malware_from_zero_to_hero/ - webarchive
- https://geminiadvisory.io/wp-content/uploads/2020/07/Appendix-C-1.pdf - webarchive
- https://www.riskiq.com/blog/labs/magecart-group-4-always-advancing/ - webarchive
- https://sansec.io/research/magecart-corona-lockdown - webarchive
- https://twitter.com/AffableKraut/status/1385030485676544001 - webarchive
- https://sansec.io/research/magento-2-persistent-parasite - webarchive
- https://blog.sucuri.net/2020/06/evasion-tactics-in-hybrid-credit-card-skimmers.html - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0719.pdf - webarchive
- https://twitter.com/MBThreatIntel/status/1416101496022724609 - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://twitter.com/AffableKraut/status/1415425132080816133?s=20 - webarchive
- https://geminiadvisory.io/keeper-magecart-group-infects-570-sites/ - webarchive
- https://www.goggleheadedhacker.com/blog/post/14 - webarchive
- https://blog.sucuri.net/2021/07/magecart-swiper-uses-unorthodox-concatenation.html - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://www.reflectiz.com/ico-fines-ticketmaster-uk-1-25-million-for-security-failures-a-lesson-to-be-learned/ - webarchive
- https://www.riskiq.com/blog/labs/magecart-ticketmaster-breach/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/fin6-compromised-e-commerce-platform-via-magecart-to-inject-credit-card-skimmers-into-thousands-of-online-shops/ - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2021/09/the-many-tentacles-of-magecart-group-8/ - webarchive
- https://blog.malwarebytes.com/cybercrime/2019/04/github-hosted-magecart-skimmer-used-against-hundreds-of-e-commerce-sites/ - webarchive
- https://gallery.mailchimp.com/c35aef82661dad887b8162a4f/files/e24e8206-a157-4796-a8cb-2b7262cc76e8/CSIS_Threat_Matrix_H1_2019.pdf - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/magecart-skimming-attack-targets-mobile-users-of-hotel-chain-booking-websites/ - webarchive
- https://www.riskiq.com/blog/labs/magecart-group-12-olympics/ - webarchive
- https://community.riskiq.com/article/fda1f967 - webarchive
- https://blog.malwarebytes.com/cybercrime/2021/06/lil-skimmer-the-magecart-impersonator/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/injecting-magecart-into-magento-global-config/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2020/06/web-skimmer-hides-within-exif-metadata-exfiltrates-credit-cards-via-image-files/ - webarchive
- https://medium.com/reflectiz/csp-the-right-solution-for-the-web-skimming-pandemic-acb7a4414218 - webarchive
- https://www.riskiq.com/blog/labs/magecart-nutribullet/ - webarchive
- https://community.riskiq.com/article/743ea75b/description - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/mirrorthief-group-uses-magecart-skimming-attack-to-hit-hundreds-of-campus-online-stores-in-us-and-canada/ - webarchive
- https://maxkersten.nl/2020/01/20/ticket-resellers-infected-with-a-credit-card-skimmer/ - webarchive
- https://www.zdnet.com/article/web-skimmers-found-on-the-websites-of-intersport-claires-and-icing/ - webarchive
- https://www.zscaler.com/blogs/security-research/black-friday-scams-4-emerging-skimming-attacks-watch-holiday-season - webarchive
- https://marcoramilli.com/2020/02/19/uncovering-new-magecart-implant-attacking-ecommerce/ - webarchive
- https://blog.malwarebytes.com/cybercrime/2021/05/newly-observed-php-based-skimmer-shows-ongoing-magecart-group-12-activity/ - webarchive
- https://community.riskiq.com/article/30f22a00 - webarchive
- https://www.riskiq.com/blog/labs/magecart-medialand/ - webarchive
- https://www.reflectiz.com/the-gocgle-web-skimming-campaign/ - webarchive
- https://maxkersten.nl/2020/02/17/following-the-tracks-of-magecart-12/ - webarchive
- https://blog.sucuri.net/2020/07/skimmers-in-images-github-repos.html - webarchive
- https://sansec.io/research/north-korea-magecart - webarchive
- https://blog.malwarebytes.com/threat-analysis/2019/06/magecart-skimmers-found-on-amazon-cloudfront-cdn/ - webarchive
- https://community.riskiq.com/article/2efc2782 - webarchive
- https://resources.malwarebytes.com/files/2020/02/2020_State-of-Malware-Report.pdf - webarchive
- https://community.riskiq.com/article/5bea32aa - webarchive
- https://community.riskiq.com/article/017cf2e6 - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2021/11/credit-card-skimmer-evades-virtual-machines/ - webarchive
- https://sansec.io/labs/2020/01/25/magecart-hackers-arrested/ - webarchive
- https://securelist.com/apt-trends-report-q2-2019/91897/ - webarchive
- https://www.riskiq.com/blog/labs/misconfigured-s3-buckets/ - webarchive
- https://www.crowdstrike.com/blog/threat-actor-magecart-coming-to-an-ecommerce-store-near-you/ - webarchive
- https://maxkersten.nl/2020/02/24/closing-in-on-magecart-12/ - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2021/10/q-logger-skimmer-keeps-magecart-attacks-going/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MiniJS
MiniJS is a very simple JavaScript-based first-stage backdoor. The backdoor is probably distributed via spearphishing email. Due to infrastructure overlap, the malware can be attributed to the actor Turla. Comparable JavaScript-based backdoor families of the actor are KopiLuwak and IcedCoffee.
Internal MISP references
UUID 5fd2f4f0-0591-45bb-a843-c194d5e294cd which can be used as unique global reference for MiniJS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
More_eggs
More_eggs is a JavaScript backdoor used by the Cobalt group. It attempts to connect to its C&C server and retrieve tasks to carry out, some of which are: - d&exec = download and execute PE file - gtfo = delete files/startup entries and terminate - more_eggs = download additional/new scripts - more_onion = run new script and terminate current script - more_power = run command shell commands
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular More_eggs.
| Known Synonyms |
|---|
SKID |
SpicyOmelette |
Internal MISP references
UUID 1c3009ff-b9a5-4ac1-859c-9b3b4a66a63f which can be used as unique global reference for More_eggs in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.more_eggs - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://twitter.com/Arkbird_SOLG/status/1301536930069278727 - webarchive
- https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/ - webarchive
- https://attack.mitre.org/software/S0284/ - webarchive
- https://www.esentire.com/blog/hackers-spearphish-corporate-hiring-managers-with-poisoned-resumes-infecting-them-with-the-more-eggs-malware - webarchive
- https://github.com/eset/malware-ioc/tree/master/evilnum - webarchive
- https://mp.weixin.qq.com/s/REXBtbnI2zXj4H3u6ofMMw - webarchive
- https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite/ - webarchive
- https://blog.morphisec.com/cobalt-gang-2.0 - webarchive
- https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish - webarchive
- https://expel.com/blog/more-eggs-and-some-linkedin-resume-spearphishing - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-kingswood - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/262/Bitdefender-WhitePaper-An-APT-Blueprint-Gaining-New-Visibility-into-Financial-Threats-interactive.pdf - webarchive
- https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html - webarchive
- https://quointelligence.eu/2020/07/golden-chickens-evolution-of-the-maas/ - webarchive
- https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://asert.arbornetworks.com/double-the-infection-double-the-fun/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/fake-jobs-campaigns-delivering-moreeggs-backdoor-fake-job-offers - webarchive
- https://reaqta.com/2018/03/spear-phishing-campaign-leveraging-msxsl/ - webarchive
- https://www.esentire.com/web-native-pages/unmasking-venom-spider - webarchive
- https://sec0wn.blogspot.com/2023/03/how-do-you-like-dem-eggs-i-like-mine.html?m=1 - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-kingswood - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses/ - webarchive
- https://securityintelligence.com/posts/itg08-aka-fin6-partners-with-trickbot-gang-uses-anchor-framework/ - webarchive
- https://www.esentire.com/security-advisories/hackers-spearphish-professionals-on-linkedin-with-fake-job-offers-infecting-them-with-malware-warns-esentire - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NanHaiShu
NanHaiShu is a remote access tool and JScript backdoor used by Leviathan. NanHaiShu has been used to target government and private-sector organizations that have relations to the South China Sea dispute.
Internal MISP references
UUID 3e46af39-52e8-442f-aff1-38eeb90336fc which can be used as unique global reference for NanHaiShu in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.nanhaishu - webarchive
- https://community.spiceworks.com/topic/1028936-stealthy-cyberespionage-campaign-attacks-with-social-engineering - webarchive
- https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets - webarchive
- https://www.f-secure.com/documents/996508/1030745/nanhaishu_whitepaper.pdf - webarchive
- https://attack.mitre.org/software/S0228/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NodeRAT
Internal MISP references
UUID e3b0ed5c-4e6a-4f50-bef2-1f7112aa31ed which can be used as unique global reference for NodeRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.node_rat - webarchive
- https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/05/vb2019-paper-apt-cases-exploiting-vulnerabilities-regionspecific-software/ - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_0_JPCERT_en.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ostap
Ostap is a commodity JScript downloader first seen in campaigns in 2016. It has been observed being delivered in ACE archives and VBA macro-enabled Microsoft Office documents. Recent versions of Ostap query WMI to check for a blacklist of running processes:
AgentSimulator.exe anti-virus.EXE BehaviorDumper BennyDB.exe ctfmon.exe fakepos_bin FrzState2k gemu-ga.exe (Possible misspelling of Qemu hypervisor’s guest agent, qemu-ga.exe) ImmunityDebugger.exe KMS Server Service.exe ProcessHacker procexp Proxifier.exe python tcpdump VBoxService VBoxTray.exe VmRemoteGuest vmtoolsd VMware2B.exe VzService.exe winace Wireshark
If a blacklisted process is found, the malware terminates.
Ostap has been observed delivering other malware families, including Nymaim, Backswap and TrickBot.
Internal MISP references
UUID a3b93781-c51c-4ccb-a856-804331470a9d which can be used as unique global reference for ostap in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.ostap - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://malfind.com/index.php/2021/11/24/from-the-archive-1-ostap-dropper-deobfuscation-and-analysis/ - webarchive
- https://labs.bitdefender.com/2020/03/5-times-more-coronavirus-themed-malware-reports-during-march/?utm_campaign=twitter&utm_medium=twitter&utm_source=twitter - webarchive
- https://www.cert.pl/en/news/single/ostap-malware-analysis-backswap-dropper/ - webarchive
- https://github.com/cryptogramfan/Malware-Analysis-Scripts/blob/master/deobfuscate_ostap.py - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/latest-trickbot-campaign-delivered-via-highly-obfuscated-js-file/ - webarchive
- https://www.intrinsec.com/deobfuscating-hunting-ostap/ - webarchive
- https://www.bromium.com/deobfuscating-ostap-trickbots-javascript-downloader/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ParaSiteSnatcher
Internal MISP references
UUID 9af9557c-04fc-4231-85c4-d1fb30c53cb6 which can be used as unique global reference for ParaSiteSnatcher in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Parrot TDS
This malicious code written in JavaScript is used as Traffic Direction System (TDS). This TDS showes similarities to the Prometheus TDS. According to DECODED Avast.io this TDS has been active since October 2021.
Internal MISP references
UUID dbefad0a-29d3-49d3-b925-116598182dee which can be used as unique global reference for Parrot TDS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PeaceNotWar
PeaceNotWar was integrated into the nodejs module node-ipc as a piece of malware/protestware with wiper characteristics. It targets machines with a public IP address located in Russia and Belarus (using geolocation) and overwrites files recursively using a heart emoji.
Internal MISP references
UUID 6c304481-024e-4f34-af06-6235edacfdcc which can be used as unique global reference for PeaceNotWar in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.peacenotwar - webarchive
- https://www.vice.com/en/article/dypeek/open-source-sabotage-node-ipc-wipe-russia-belraus-computers - webarchive
- https://www.bleepingcomputer.com/news/security/big-sabotage-famous-npm-package-deletes-files-to-protest-ukraine-war/ - webarchive
- https://gist.github.com/MidSpike/f7ae3457420af78a54b38a31cc0c809c - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PindOS
Internal MISP references
UUID 6af1eb7a-bc54-43af-9e15-7187a5f250c4 which can be used as unique global reference for PindOS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Powmet
Internal MISP references
UUID 9521ceb0-039d-412c-a38b-7bd9ddfc772e which can be used as unique global reference for Powmet in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QNodeService
According to Trend Micro, this is a Node.js based malware, that can download/upload/execute files, steal credentials from Chrome/Firefox browsers, and perform file management, among other things. It targets Windows and has components for both 32 and 64bit.
Internal MISP references
UUID 52d9260f-f090-4e79-b0b3-0c89f5db6bc6 which can be used as unique global reference for QNodeService in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QUICKCAFE
QUICKCAFE is an encrypted JavaScript downloader for QUICKRIDE.POWER that exploits the ActiveX M2Soft vulnerabilities. QUICKCAFE is obfuscated using JavaScript Obfuscator.
Internal MISP references
UUID 475766d2-1e99-4d81-89e4-0d0df4a562d0 which can be used as unique global reference for QUICKCAFE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
scanbox
Internal MISP references
UUID 0a13a546-91a2-4de0-9bbb-71c9233ce6fa which can be used as unique global reference for scanbox in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.scanbox - webarchive
- https://www.volexity.com/blog/2019/09/02/digital-crackdown-large-scale-surveillance-and-exploitation-of-uyghurs/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/chasing-currents-espionage-south-china-sea - webarchive
- http://resources.infosecinstitute.com/scanbox-framework/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-mohawk - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/attacker-tracking-users-seeking-pakistani-passport/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/ta413-leverages-new-friarfox-browser-extension-target-gmail-accounts-global - webarchive
- https://www.alienvault.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SQLRat
SQLRat campaigns typically involve a lure document that includes an image overlayed by a VB Form trigger. Once a user has double-clicked the embedded image, the form executes a VB setup script. The script writes files to the path %appdata%\Roaming\Microsoft\Templates\, then creates two task entries triggered to run daily. The scripts are responsible for deobfuscating and executing the main JavaScript file mspromo.dot. The file uses a character insertion obfuscation technique, making it appear to contain Chinese characters. After deobfuscating the file, the main JavaScript is easily recognizable. It contains a number of functions designed to drop files and execute scripts on a host system. The SQLRat script is designed to make a direct SQL connection to a Microsoft database controlled by the attackers and execute the contents of various tables.
Internal MISP references
UUID d51cb8f8-cca3-46ce-a05d-052df44aef40 which can be used as unique global reference for SQLRat in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.sqlrat - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
- https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Starfighter (Javascript)
According to the author, this is a JavaScript based Empire launcher that runs with its own embedded powershell host to not be dependent on local powershell availability.
Internal MISP references
UUID f6c80748-1cce-4f6b-92e9-f8a04ff3464a which can be used as unique global reference for Starfighter (Javascript) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Swid
Internal MISP references
UUID d4be22cf-497d-46a0-8d57-30d10d9486e3 which can be used as unique global reference for Swid in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HTML5 Encoding
Internal MISP references
UUID c7ab9e5a-0ec9-481e-95ec-ad08f06cf985 which can be used as unique global reference for HTML5 Encoding in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.turla_ff_ext - webarchive
- https://www.welivesecurity.com/2017/06/06/turlas-watering-hole-campaign-updated-firefox-extension-abusing-instagram/ - webarchive
- https://kindredsec.com/2019/08/12/an-overview-of-public-platform-c2s/ - webarchive
- https://kindredsec.wordpress.com/2019/08/12/an-overview-of-public-platform-c2s/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Maintools.js
Expects a parameter to run: needs to be started as 'maintools.js EzZETcSXyKAdF_e5I2i1'.
Internal MISP references
UUID 218f8ca8-1124-4e44-8fbd-4b05b46bde4b which can be used as unique global reference for Maintools.js in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified JS 001 (APT32 Profiler)
Internal MISP references
UUID f2b0ffdc-7d4e-4786-8935-e7036faa174d which can be used as unique global reference for Unidentified JS 001 (APT32 Profiler) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified JS 003 (Emotet Downloader)
According to Max Kersten, Emotet is dropped by a procedure spanned over multiple stages. The first stage is an office file that contains a macro. This macro then loads the second stage, which is either a PowerShell script or a piece of JavaScript, which is this family entry.
Internal MISP references
UUID 7bf28be0-3153-474d-8df7-e12fec511d7e which can be used as unique global reference for Unidentified JS 003 (Emotet Downloader) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified JS 004
A simple loader written in JavaScript found by Marco Ramilli.
Internal MISP references
UUID a15e7c49-4eb6-46f0-8f79-0b765d7d4e46 which can be used as unique global reference for Unidentified JS 004 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified JS 005 (Stealer)
Internal MISP references
UUID a797e9b9-cb3f-484a-9273-ac73e9ea1e06 which can be used as unique global reference for Unidentified JS 005 (Stealer) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified JS 006 (Winter Wyvern)
A script able to list folders and emails in the current Roundcube account, and to exfiltrate email messages to the C&C server by making HTTP requests.
Internal MISP references
UUID 547fed09-38d0-4813-b9b0-870a1d4136df which can be used as unique global reference for Unidentified JS 006 (Winter Wyvern) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified JS 002
Internal MISP references
UUID 7144063f-966b-4277-b316-00eb970ccd52 which can be used as unique global reference for Unidentified JS 002 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Valak
According to PCrisk, Valak is malicious software that downloads JScript files and executes them. What happens next depends on the actions performed by the executed JScript files. It is very likely that cyber criminals behind Valak attempt to use this malware to cause chain infections (i.e., using Valak to distribute other malware).
Research shows that Valak is distributed through spam campaigns, however, in some cases, it infiltrates systems when they are already infected with malicious program such as Ursnif (also known as Gozi).
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Valak.
| Known Synonyms |
|---|
Valek |
Internal MISP references
UUID b37b4d91-0ac7-48f5-8fd1-5237b9615cf7 which can be used as unique global reference for Valak in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/js.valak - webarchive
- https://unit42.paloaltonetworks.com/valak-evolution/ - webarchive
- https://cocomelonc.github.io/malware/2023/07/26/malware-tricks-35.html - webarchive
- https://threatresearch.ext.hp.com/detecting-ta551-domains/ - webarchive
- https://securityintelligence.com/posts/sodinokibi-ransomware-incident-response-intelligence-together/ - webarchive
- https://security-soup.net/analysis-of-valak-maldoc/ - webarchive
- https://www.cybereason.com/blog/valak-more-than-meets-the-eye - webarchive
- https://twitter.com/malware_traffic/status/1207824548021886977 - webarchive
- https://unit42.paloaltonetworks.com/atoms/monsterlibra/ - webarchive
- https://blog.talosintelligence.com/2020/07/valak-emerges.html - webarchive
- https://labs.sentinelone.com/valak-malware-and-the-connection-to-gozi-loader-confcrew/ - webarchive
- https://medium.com/@prsecurity_/casual-analysis-of-valak-c2-3497fdb79bf7 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
witchcoven
Internal MISP references
UUID dcc0fad2-29a9-4b69-9d75-d288ca458bc7 which can be used as unique global reference for witchcoven in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Godzilla Webshell
Internal MISP references
UUID 07e88ccf-6027-412b-99bf-0fa1d3cfb174 which can be used as unique global reference for Godzilla Webshell in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/jsp.godzilla_webshell - webarchive
- https://asec.ahnlab.com/en/47455/ - webarchive
- https://blog.gigamon.com/2022/09/28/investigating-web-shells/ - webarchive
- https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/ - webarchive
- https://www.elastic.co/security-labs/ref2924-howto-maintain-persistence-as-an-advanced-threat - webarchive
- https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/ - webarchive
- https://unit42.paloaltonetworks.com/tiltedtemple-manageengine-servicedesk-plus/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
3CX Backdoor (OS X)
Internal MISP references
UUID d5e10bf9-9de8-46be-96d0-aa502b14ffe8 which can be used as unique global reference for 3CX Backdoor (OS X) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AMOS
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular AMOS.
| Known Synonyms |
|---|
Atomic macOS Stealer |
Internal MISP references
UUID 2fa2be52-e44f-4998-bde7-c66cfb6f4521 which can be used as unique global reference for AMOS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.amos - webarchive
- https://denshiyurei.medium.com/silent-echoes-the-hidden-dialogue-among-malware-entities-spotlight-on-amos-infostealer-6d7cd70e3219 - webarchive
- https://blog.cyble.com/2023/04/26/threat-actor-selling-new-atomic-macos-amos-stealer-on-telegram/ - webarchive
- https://www.malwarebytes.com/blog/threat-intelligence/2023/09/atomic-macos-stealer-delivered-via-malvertising - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AppleJeus (OS X)
According to PcRisk AppleJeus is the name of backdoor malware that was distributed by the Lazarus group. They spread this malicious software through a fake app disguised as a cryptocurrency trading application called Celas Trade Pro.
Internal MISP references
UUID ca466f15-8e0a-4030-82cb-5382e3c56ee5 which can be used as unique global reference for AppleJeus (OS X) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.applejeus - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://posts.specterops.io/introducing-venator-a-macos-tool-for-proactive-detection-34055a017e56 - webarchive
- https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/ - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://blog.sekoia.io/the-dprk-delicate-sound-of-cyber/ - webarchive
- https://securelist.com/operation-applejeus-sequel/95596/ - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048a - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-north-korea-indictment - webarchive
- https://objective-see.com/blog/blog_0x5F.html - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa21-048a - webarchive
- https://www.youtube.com/watch?v=rjA0Vf75cYk - webarchive
- https://objective-see.com/blog/blog_0x49.html - webarchive
- https://vblocalhost.com/uploads/VB2021-Park.pdf - webarchive
- https://objective-see.com/blog/blog_0x54.html - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048f - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048d - webarchive
- https://www.youtube.com/watch?v=1NkzTKkEM2k - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048e - webarchive
- https://securelist.com/operation-applejeus/87553/ - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048b - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048g - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048c - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bella
Internal MISP references
UUID 3c5036ad-2afc-4bc1-a5a3-b31797f46248 which can be used as unique global reference for Bella in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bundlore
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Bundlore.
| Known Synonyms |
|---|
SurfBuyer |
Internal MISP references
UUID 5f5f5496-d9f8-4984-aa66-8702741646fe which can be used as unique global reference for Bundlore in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.bundlore - webarchive
- https://www.trendmicro.com/en_hk/research/21/f/nukesped-copies-fileless-code-from-bundlore--leaves-it-unused.html - webarchive
- https://labs.sentinelone.com/resourceful-macos-malware-hides-in-named-fork/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://twitter.com/ConfiantIntel/status/1393215825931288580?s=20 - webarchive
- https://blog.confiant.com/new-macos-bundlore-loader-analysis-ca16d19c058c - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Careto
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Careto.
| Known Synonyms |
|---|
Appetite |
Mask |
Internal MISP references
UUID dcabea75-a433-4157-bb7a-be76de3026ac which can be used as unique global reference for Careto in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Casso
Internal MISP references
UUID 387e1a19-458d-4961-a8e4-3f82463085e5 which can be used as unique global reference for Casso in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CDDS
Google TAG has observed this malware being delivered via watering hole attacks using 0-day exploits, targeting visitors to Hong Kong websites for a media outlet and a prominent pro-democracy labor and political group.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CDDS.
| Known Synonyms |
|---|
Macma |
Internal MISP references
UUID 5e4bdac7-b6c8-4c59-996f-babfc3bb3a3c which can be used as unique global reference for CDDS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.cdds - webarchive
- https://blog.google/threat-analysis-group/analyzing-watering-hole-campaign-using-macos-exploits/ - webarchive
- https://objective-see.com/blog/blog_0x69.html - webarchive
- https://www.sentinelone.com/labs/infect-if-needed-a-deeper-dive-into-targeted-backdoor-macos-macma/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Choziosi (OS X)
A loader delivering malicious Chrome and Safari extensions.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Choziosi (OS X).
| Known Synonyms |
|---|
ChromeLoader |
Chropex |
Internal MISP references
UUID 57f75f24-b77b-46b3-a06a-57d49374fb82 which can be used as unique global reference for Choziosi (OS X) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.choziosi - webarchive
- https://blogs.blackberry.com/en/2022/11/chromeloader-infects-the-browser-by-loading-malicious-extension - webarchive
- https://redcanary.com/blog/chromeloader/ - webarchive
- https://www.th3protocol.com/2022/Choziosi-Loader - webarchive
- https://www.crowdstrike.com/blog/how-crowdstrike-uncovered-a-new-macos-browser-hijacking-campaign/ - webarchive
- https://github.com/xephora/Threat-Remediation-Scripts/tree/main/Threat-Track/CS_INSTALLER - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CloudMensis
Internal MISP references
UUID 557fc183-f51a-4740-b2dd-5e81e6f6690a which can be used as unique global reference for CloudMensis in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CoinThief
CoinThief was a malware package designed to steal Bitcoins from the victim, consisting of a binary patcher, browser extensions, and a backdoor component.
It was spreading in early 2014 from several different sources: - on Github (where the trojanized compiled binary didn’t match the displayed source code), o - on popular and trusted download sites line CNET's Download.com or MacUpdate.com, and - as cracked applications via torrents camouflaged as Bitcoin Ticker TTM, BitVanity, StealthBit, Litecoin Ticker, BBEdit, Pixelmator, Angry Birds and Delicious Library.
The patcher‘s role was to locate and modify legitimate versions of the Bitcoin-Qt wallet application. The analyzed malware samples targeted versions of Bitcoin-Qt 0.8.1, 0.8.0 and 0.8.5. The earlier patch modified Bitcoin-Qt adding malicious code that would send nearly all the victim’s Bitcoins to one of the hard-coded addresses belonging to the attacker.
The browser extensions targeted Chrome and Firefox and are disguised as a “Pop-up blocker”. The extensions monitored visited websites, download malicious JavaScripts and injected them into various Bitcoin-related websites (mostly Bitcoin exchanges and online wallet sites). The injected JS scripts were able to modify transactions to redirect Bitcoin transfers to an attacker’s address or simply harvest login credentials to the targeted online service.
The backdoor enabled the attacker to take full control over the victim’s computer: - collect information about the infected computer - execute arbitrary shell scripts on the target computer - upload an arbitrary file from the victim’s hard drive to a remote server - update itself to a newer version
Internal MISP references
UUID 70e73da7-21d3-4bd6-9a0e-0c904e6457e8 which can be used as unique global reference for CoinThief in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Coldroot RAT
Internal MISP references
UUID 076a7ae0-f4b8-45c7-9de4-dc9cc7e54bcf which can be used as unique global reference for Coldroot RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Convuster
Internal MISP references
UUID 3819ded3-27ac-4e2f-9cd6-c6ef1642599b which can be used as unique global reference for Convuster in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CpuMeaner
Internal MISP references
UUID 74360d1e-8f85-44d1-8ce7-e76afb652142 which can be used as unique global reference for CpuMeaner in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CreativeUpdater
Internal MISP references
UUID 40fc6f71-75ac-43ac-abd9-c90b0e847999 which can be used as unique global reference for CreativeUpdater in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.creative_updater - webarchive
- https://digitasecurity.com/blog/2018/02/05/creativeupdater/ - webarchive
- https://objective-see.com/blog/blog_0x29.html - webarchive
- https://blog.malwarebytes.com/threat-analysis/2018/02/new-mac-cryptominer-distributed-via-a-macupdate-hack/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Crisis
Internal MISP references
UUID 2bb6c494-8057-4d83-9202-fda3284deee4 which can be used as unique global reference for Crisis in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.crisis - webarchive
- https://www.intego.com/mac-security-blog/new-apple-mac-trojan-called-osxcrisis-discovered-by-intego-virus-team/? - webarchive
- https://www.symantec.com/connect/blogs/crisis-windows-sneaks-virtual-machines - webarchive
- http://contagiodump.blogspot.com/2012/12/aug-2012-w32crisis-and-osxcrisis-jar.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Crossrider
Internal MISP references
UUID 05ddb459-5a2f-44d5-a135-ed3f1e772302 which can be used as unique global reference for Crossrider in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dacls (OS X)
According to PCrisk, Dacls is the name of a remote access Trojan (RAT), a malicious program that allows cyber criminals to control infected computers remotely.
Research shows that this malware is tied to Lazarus Group (a group of cyber criminals) and targets Linux and the Windows Operating System. Typically, cyber criminals use RATs to steal sensitive, confidential information, infect systems with other malware, and so on. In any case, no RAT is harmless and should be uninstalled immediately.
Internal MISP references
UUID 81def650-f52e-49a3-a3fe-cb53ffa75d67 which can be used as unique global reference for Dacls (OS X) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.dacls - webarchive
- https://objective-see.com/blog/blog_0x5F.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability - webarchive
- https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/ - webarchive
- https://objective-see.com/blog/blog_0x57.html - webarchive
- https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/ - webarchive
- https://www.sygnia.co/mata-framework - webarchive
- https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2020/05/new-mac-variant-of-lazarus-dacls-rat-distributed-via-trojanized-2fa-app/ - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarthMiner
Internal MISP references
UUID a8e71805-014d-4998-b21e-3125da800124 which can be used as unique global reference for DarthMiner in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DazzleSpy
Internal MISP references
UUID ba2c7d3c-7f7a-42f7-854c-a6cc0b5eb850 which can be used as unique global reference for DazzleSpy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dockster
Internal MISP references
UUID 713d8ec4-4983-4fbb-827c-2ef5bc0e6930 which can be used as unique global reference for Dockster in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dummy
Internal MISP references
UUID cbf9ff89-d35b-4954-8873-32f59f5e4d7d which can be used as unique global reference for Dummy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Eleanor
Eleanor comes as a drag-and-drop file utility called EasyDoc Converter. This application bundle wraps a shell script that uses Dropbox name as a disguise and installs three components: a hidden Tor service, a Pastebin agent and a web service with a PHP-based graphical interface.
The Tor service transforms the victim’s computer into a server that provides attackers with full anonymous access to the infected machine via Tor-generated address.
The Pastebin agent uploads the address in encrypted form to the Pastebin website where the attackers can obtain it.
The web service is the main malicious component that provides the attackers with the control over the infected machine. After successful authentication, the interface offers several control panels to the attackers, allowing them to do the following actions:
- Managing files
- Listing processes
- Connecting to various database management systems such as MySQL or SQLite
- Connecting via bind/reverse shell
- Executing shell command
- Capturing and browsing images and videos from the victim’s webcam
- Sending emails with an attachment
Internal MISP references
UUID c221e519-fe3e-416e-bc63-a2246b860958 which can be used as unique global reference for Eleanor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ElectroRAT
According to PCrisk, ElectroRAT is a Remote Access Trojan (RAT) written in the Go programming language and designed to target Windows, MacOS, and Linux users. Cyber criminals behind ElectroRAT target mainly cryptocurrency users. This RAT is distributed via the trojanized Jamm, eTrader, and DaoPoker applications.
Internal MISP references
UUID f8ccf928-7d4f-4999-91a5-9222f148152d which can be used as unique global reference for ElectroRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.electro_rat - webarchive
- https://objective-see.com/blog/blog_0x61.html - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-old-dogs-new-tricks.pdf - webarchive
- https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EvilOSX
Internal MISP references
UUID 24f3d8e1-3936-4664-b813-74c797b87d9d which can be used as unique global reference for EvilOSX in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EvilQuest
According to PcRisk, EvilQuest (also known as ThiefQuest) is like many other malicious programs of this type - it encrypts files and creates a ransom message. In most cases, this type of malware modifies the names of encrypted files by appending certain extensions, however, this ransomware leaves them unchanged.
It drops the "READ_ME_NOW.txt" in each folder that contains encrypted data and displays another ransom message in a pop-up window. Additionally, this malware is capable of detecting if certain files are stored on the computer, operates as a keylogger, and receives commands from a Command & Control server.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular EvilQuest.
| Known Synonyms |
|---|
ThiefQuest |
Internal MISP references
UUID d5b39223-a8cc-4d47-8030-1d7d6312d351 which can be used as unique global reference for EvilQuest in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.evilquest - webarchive
- https://www.bleepingcomputer.com/news/security/evilquest-wiper-uses-ransomware-cover-to-steal-files-from-macs/ - webarchive
- https://objective-see.com/blog/blog_0x5F.html - webarchive
- https://github.com/gdbinit/evilquest_deobfuscator - webarchive
- https://www.crowdstrike.com/blog/how-crowdstrike-analyzes-macos-malware-to-optimize-automated-detection-capabilities - webarchive
- https://www.sentinelone.com/blog/evilquest-a-new-macos-malware-rolls-ransomware-spyware-and-data-theft-into-one/ - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://twitter.com/dineshdina04/status/1277668001538433025 - webarchive
- https://objective-see.com/blog/blog_0x59.html - webarchive
- https://labs.sentinelone.com/breaking-evilquest-reversing-a-custom-macos-ransomware-file-encryption-routine/ - webarchive
- https://www.sentinelone.com/labs/defeating-macos-malware-anti-analysis-tricks-with-radare2/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FailyTale
Internal MISP references
UUID 5dfd704c-a69d-4e93-bd70-68f89fbbb32c which can be used as unique global reference for FailyTale in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FinFisher (OS X)
Internal MISP references
UUID 89ce536c-03b9-4f69-83ce-723f26b36494 which can be used as unique global reference for FinFisher (OS X) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.finfisher - webarchive
- https://netzpolitik.org/2020/our-criminal-complaint-german-state-malware-company-finfisher-raided/ - webarchive
- https://objective-see.com/blog/blog_0x5F.html - webarchive
- https://objective-see.com/blog/blog_0x4F.html - webarchive
- https://securelist.com/finspy-unseen-findings/104322/ - webarchive
- https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/ - webarchive
- https://reverse.put.as/2020/09/26/the-finfisher-tales-chapter-1/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FlashBack
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FlashBack.
| Known Synonyms |
|---|
FakeFlash |
Internal MISP references
UUID f92b5355-f398-4f09-8bcc-e06df6fe51a0 which can be used as unique global reference for FlashBack in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.flashback - webarchive
- https://www.crowdstrike.com/blog/how-crowdstrike-analyzes-macos-malware-to-optimize-automated-detection-capabilities - webarchive
- https://en.wikipedia.org/wiki/Flashback_(Trojan) - webarchive
- http://contagiodump.blogspot.com/2012/04/osxflashbacko-sample-some-domains.html - webarchive
- https://www.alienvault.com/blogs/labs-research/os-x-malware-samples-analyzed - webarchive
- http://contagiodump.blogspot.com/2012/04/osxflashbackk-sample-mac-os-malware.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FruitFly
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FruitFly.
| Known Synonyms |
|---|
Quimitchin |
Internal MISP references
UUID a517cdd1-6c82-4b29-bdd2-87e281227597 which can be used as unique global reference for FruitFly in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.fruitfly - webarchive
- https://objectivebythesea.com/v3/talks/OBTS_v3_tReed.pdf - webarchive
- https://arstechnica.com/security/2017/07/perverse-malware-infecting-hundreds-of-macs-remained-undetected-for-years/ - webarchive
- https://arstechnica.com/security/2017/01/newly-discovered-mac-malware-may-have-circulated-in-the-wild-for-2-years/ - webarchive
- https://www.documentcloud.org/documents/4346338-Phillip-Durachinsky-Indictment.html - webarchive
- https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/ - webarchive
- https://www.virusbulletin.com/virusbulletin/2017/11/vb2017-paper-offensive-malware-analysis-dissecting-osxfruitflyb-custom-cc-server/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FULLHOUSE
Fullhouse (AKA FULLHOUSE.DOORED) is a custom backdoor used by subsets of the North Korean Lazarus Group. Fullhouse is written in C/C++ and includes the capabilities of a tunneler and backdoor commands support such as shell command execution, file transfer, file managment, and process injection. C2 communications occur via HTTP and require configuration through the command line or a configuration file.
Internal MISP references
UUID 2ab781d8-214d-41e2-acc9-23ded4f77663 which can be used as unique global reference for FULLHOUSE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GIMMICK (OS X)
This multi-platform malware is a ObjectiveC written macOS variant dubbed GIMMICK by Volexity. This malware is a file-based C2 implant used by Storm Cloud.
Internal MISP references
UUID 0e259d0f-717a-4ced-ac58-6fe9d72e2c96 which can be used as unique global reference for GIMMICK (OS X) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gmera
According to PCrisk, GMERA (also known as Kassi trojan) is malicious software that disguises itself as Stockfolio, a legitimate trading app created for Mac users.
Research shows that there are two variants of this malware, one detected as Trojan.MacOS.GMERA.A and the other as Trojan.MacOS.GMERA.B. Cyber criminals proliferate GMERA to steal various information and upload it to a website under their control. To avoid damage caused by this malware, remove GMERA immediately.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gmera.
| Known Synonyms |
|---|
Kassi |
StockSteal |
Internal MISP references
UUID 1c65cf4e-5df4-4d56-a414-7b05f00814ba which can be used as unique global reference for Gmera in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.gmera - webarchive
- https://objective-see.com/blog/blog_0x53.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/mac-malware-that-spoofs-trading-app-steals-user-information-uploads-it-to-website/ - webarchive
- https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HiddenLotus
According to Malwarebytes, The HiddenLotus "dropper" is an application named Lê Thu Hà (HAEDC).pdf, using an old trick of disguising itself as a document - in this case, an Adobe Acrobat file.
Internal MISP references
UUID fc17e41f-e9f7-4442-a05c-7a19b9174c39 which can be used as unique global reference for HiddenLotus in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HLOADER
Internal MISP references
UUID 28304d68-689e-4488-80cb-d5b7b50a8d57 which can be used as unique global reference for HLOADER in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
iMuler
The threat was a multi-stage malware displaying a decoy that appeared to the victim as a Chinese language article on the long-running dispute over the Diaoyu Islands; an array of erotic pictures; or images of Tibetan organisations. It consisted of two stages: Revir was the dropper/downloader and Imuler was the backdoor capable of the following operations:
- capture screenshots
- exfiltrate files to a remote computer
- send various information about the infected computer
- extract ZIP archive
- download files from a remote computer and/or the Internet
- run executable files
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular iMuler.
| Known Synonyms |
|---|
Revir |
Internal MISP references
UUID 261fd543-60e4-470f-af28-7a9b17ba4759 which can be used as unique global reference for iMuler in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.imuler - webarchive
- https://nakedsecurity.sophos.com/2012/11/13/new-mac-trojan/ - webarchive
- http://contagiodump.blogspot.com/2012/11/group-photoszip-osxrevir-osximuler.html - webarchive
- https://www.welivesecurity.com/2012/03/16/osximuler-updated-still-a-threat-on-mac-os-x/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Interception (OS X)
Internal MISP references
UUID d4f7ea92-04e7-405c-9faf-7993ffd5c473 which can be used as unique global reference for Interception (OS X) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.interception - webarchive
- https://www.sentinelone.com/blog/lazarus-operation-interception-targets-macos-users-dreaming-of-jobs-in-crypto - webarchive
- https://twitter.com/ESETresearch/status/1559553324998955010 - webarchive
- https://labs.k7computing.com/index.php/lazarus-apts-operation-interception-uses-signed-binary/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Janicab (OS X)
According to Patrick Wardle, this malware persists a python script as a cron job. Steps: 1. Python installer first saves any existing cron jobs into a temporary file named '/tmp/dump'. 2. Appends its new job to this file. 3. Once the new cron job has been added 'python (~/.t/runner.pyc)' runs every minute.
Internal MISP references
UUID 01325d85-297f-40d5-b829-df9bd996af5a which can be used as unique global reference for Janicab (OS X) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.janicab - webarchive
- https://www.macmark.de/blog/osx_blog_2013-08-a.php - webarchive
- https://www.malwarology.com/2022/05/janicab-series-first-steps-in-the-infection-chain/ - webarchive
- https://blog.avast.com/2013/07/22/multisystem-trojan-janicab-attacks-windows-and-macosx-via-scripts/ - webarchive
- https://sec0wn.blogspot.com/2018/12/powersing-from-lnk-files-to-janicab.html - webarchive
- https://www.malwarology.com/posts/5-janicab-part_1/ - webarchive
- https://www.malwarology.com/2022/05/janicab-series-attibution-and-iocs/ - webarchive
- https://www.malwarology.com/2022/05/janicab-series-further-steps-in-the-infection-chain/ - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
- https://securelist.com/deathstalker-mercenary-triumvirate/98177/ - webarchive
- https://archive.f-secure.com/weblog/archives/00002576.html - webarchive
- https://www.malwarology.com/2022/05/janicab-series-the-core-artifact/ - webarchive
- https://securelist.com/deathstalker-targets-legal-entities-with-new-janicab-variant/108131/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JokerSpy
Internal MISP references
UUID 171b0695-8cea-4ca6-a3f0-c9a8455ef9de which can be used as unique global reference for JokerSpy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KANDYKORN
Internal MISP references
UUID d314856b-1c07-4f4a-ab3e-eeae38536857 which can be used as unique global reference for KANDYKORN in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KeRanger
Internal MISP references
UUID 01643bc9-bd61-42e8-b9f1-5fbf83dcd786 which can be used as unique global reference for KeRanger in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.keranger - webarchive
- https://objective-see.com/blog/blog_0x16.html - webarchive
- https://www.macworld.com/article/3234650/macs/keranger-the-first-in-the-wild-ransomware-for-macs-but-certainly-not-the-last.html - webarchive
- http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Keydnap
Internal MISP references
UUID 2173605b-bf44-4c76-b75a-09c53bb322d6 which can be used as unique global reference for Keydnap in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.keydnap - webarchive
- http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/ - webarchive
- https://objective-see.com/blog/blog_0x16.html - webarchive
- https://github.com/eset/malware-ioc/tree/master/keydnap - webarchive
- https://www.welivesecurity.com/2016/08/30/osxkeydnap-spreads-via-signed-transmission-application/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kitmos
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Kitmos.
| Known Synonyms |
|---|
KitM |
Internal MISP references
UUID 8a1b1c99-c149-4339-9058-db3b4084cdcd which can be used as unique global reference for Kitmos in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Komplex
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Komplex.
| Known Synonyms |
|---|
JHUHUGIT |
JKEYSKW |
SedUploader |
Internal MISP references
UUID d26b5518-8d7f-41a6-b539-231e4962853e which can be used as unique global reference for Komplex in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.komplex - webarchive
- http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf - webarchive
- https://contagiodump.blogspot.de/2017/02/russian-apt-apt28-collection-of-samples.html - webarchive
- https://objective-see.com/blog/blog_0x16.html - webarchive
- http://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/09/komplex-mac-backdoor-answers-old-questions/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lador
Internal MISP references
UUID 9c6b54ce-44a0-4d0c-89cb-6532c8f89d8d which can be used as unique global reference for Lador in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lambert (OS X)
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Lambert (OS X).
| Known Synonyms |
|---|
GreenLambert |
Internal MISP references
UUID 7433f3a8-f53c-4ba0-beff-e312fae9ad39 which can be used as unique global reference for Lambert (OS X) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Laoshu
Internal MISP references
UUID a13a2cb8-b0e6-483a-9916-f44969a2c42b which can be used as unique global reference for Laoshu in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Leverage
Internal MISP references
UUID 15daa766-f721-4fd5-95fb-153f5361fb87 which can be used as unique global reference for Leverage in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LockBit (OS X)
Internal MISP references
UUID 0821b5c8-db48-4d0e-a969-384dbd74a6c9 which can be used as unique global reference for LockBit (OS X) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.lockbit - webarchive
- https://medium.com/@lcam/lighting-the-exfiltration-infrastructure-of-a-lockbit-affiliate-and-more-f57fbb7a4e79 - webarchive
- https://twitter.com/malwrhunterteam/status/1647384505550876675 - webarchive
- https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/ - webarchive
- https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf - webarchive
- https://krebsonsecurity.com/2023/05/russian-hacker-wazawaka-indicted-for-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MacDownloader
Internal MISP references
UUID 910d3c78-1a9e-4600-a3ea-4aa5563f0f13 which can be used as unique global reference for MacDownloader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MacInstaller
Internal MISP references
UUID d1f8af3c-719b-4f64-961b-8d89a2defa02 which can be used as unique global reference for MacInstaller in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MacRansom
Internal MISP references
UUID 66862f1a-5823-4a9a-bd80-439aaafc1d8b which can be used as unique global reference for MacRansom in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MacSpy
Internal MISP references
UUID c9915d41-d1fb-45bc-997e-5cd9c573d8e7 which can be used as unique global reference for MacSpy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MacVX
Internal MISP references
UUID 4db9012b-d3a1-4f19-935c-4dbc7fdd93fe which can be used as unique global reference for MacVX in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MaMi
Internal MISP references
UUID 7759534c-3298-42e9-adab-896d7e507f4f which can be used as unique global reference for MaMi in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Manuscrypt
Internal MISP references
UUID f85c3ec9-81f0-4dee-87e6-b3f6b235bfe7 which can be used as unique global reference for Manuscrypt in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.manuscrypt - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://twitter.com/BitsOfBinary/status/1321488299932983296 - webarchive
- https://twitter.com/BitsOfBinary/status/1337330286787518464 - webarchive
- https://www.anquanke.com/post/id/223817 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mokes (OS X)
Internal MISP references
UUID bfbb6e5a-32dc-4842-936c-5d8497570c74 which can be used as unique global reference for Mokes (OS X) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.mokes - webarchive
- https://objective-see.com/blog/blog_0x16.html - webarchive
- https://objective-see.com/blog/blog_0x53.html - webarchive
- https://securelist.com/blog/research/75990/the-missing-piece-sophisticated-os-x-backdoor-discovered/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mughthesec
Internal MISP references
UUID aa1bf4e5-9c44-42a2-84e5-7526e4349405 which can be used as unique global reference for Mughthesec in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NetWire
Internal MISP references
UUID f0d52afd-e7c9-4bd1-be8a-9ab09b14ea24 which can be used as unique global reference for NetWire in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OceanLotus
According to PcRisk, Research shows that the OceanLotus 'backdoor' targets MacOS computers. Cyber criminals behind this backdoor have already used this malware to attack human rights and media organizations, some research institutes, and maritime construction companies.
The OceanLotus backdoor is distributed via a fake Adobe Flash Player installer and a malicious Word document (it is likely that threat authors distribute the document via malspam emails).
Internal MISP references
UUID 65b7eff4-741c-445e-b4e0-8a4e4f673a65 which can be used as unique global reference for OceanLotus in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.oceanlotus - webarchive
- https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries - webarchive
- https://github.com/AmnestyTech/investigations/tree/master/2021-02-24_vietnam - webarchive
- https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update - webarchive
- https://researchcenter.paloaltonetworks.com/2017/06/unit42-new-improved-macos-backdoor-oceanlotus/ - webarchive
- https://tradahacking.vn/%C4%91%E1%BB%A3t-r%E1%BB%93i-t%C3%B4i-c%C3%B3-%C4%91%C4%83ng-m%E1%BB%99t-status-xin-d%E1%BA%A1o-tr%C3%AAn-fb-may-qu%C3%A1-c%C5%A9ng-c%C3%B3-v%C3%A0i-b%E1%BA%A1n-nhi%E1%BB%87t-t%C3%ACnh-g%E1%BB%ADi-cho-537b19ee3468 - webarchive
- https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html - webarchive
- https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/ - webarchive
- https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html - webarchive
- https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/ - webarchive
- https://labs.sentinelone.com/apt32-multi-stage-macos-trojan-innovates-on-crimeware-scripting-technique/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Olyx
Internal MISP references
UUID cd397973-8f42-4c49-8322-414ea77ec773 which can be used as unique global reference for Olyx in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
oRAT
SentinelOne describes this as a malware written in Go, mixing own custom code with code from public repositories.
Internal MISP references
UUID 699dac0f-092c-4c8e-85e9-6e3c86129190 which can be used as unique global reference for oRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.orat - webarchive
- https://documents.trendmicro.com/assets/txt/earth-berberoka-macos-iocs-2.txt - webarchive
- https://documents.trendmicro.com/assets/white_papers/wp-operation-earth-berberoka.pdf - webarchive
- https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-40-LunghiHorejsi.pdf - webarchive
- https://www.sentinelone.com/blog/from-the-front-lines-unsigned-macos-orat-malware-gambles-for-the-win/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OSAMiner
Internal MISP references
UUID 89d0c423-c4ff-46e8-8c79-ea5e974e53e7 which can be used as unique global reference for OSAMiner in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Patcher
This crypto-ransomware for macOS was caught spreading via BitTorrent distribution sites in February 2017, masquerading as 'Patcher', an application used for pirating popular software like Adobe Premiere Pro or Microsoft Office for Mac.
The downloaded torrent contained an application bundle in the form of a single zip file. After launching the fake application, the main window of the fake cracking tool was displayed.
The file encryption process was launched after the misguided victim clicked 'Start'. Once executed, the ransomware generated a random 25-character string and set it as the key for RC4 encryption of all of the user's files. It then demanded ransom in Bitcoin, as instructed in the 'README!' .txt file copied all over the user's directories.
Despite the instructions being quite thorough, Patcher lacked the functionality to communicate with any C&C server, and therefore made it impossible for its operators to decrypt affected files. The randomly generated encryption key was also too long to be guessed via a brute-force attack, leaving the encrypted data unrecoverable in a reasonable amount of time.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Patcher.
| Known Synonyms |
|---|
FileCoder |
Findzip |
Internal MISP references
UUID bad1057c-4f92-4747-a0ec-31bcc062dab8 which can be used as unique global reference for Patcher in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PintSized
Backdoor as a fork of OpenSSH_6.0 with no logging, and “-P” and “-z” hidden command arguments. “PuffySSH_5.8p1” string.
Internal MISP references
UUID de13bec0-f443-4c5a-91fe-2223dad43be5 which can be used as unique global reference for PintSized in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Pirrit
Internal MISP references
UUID b749ff3a-df68-4b38-91f1-649864eae52c which can be used as unique global reference for Pirrit in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.pirrit - webarchive
- https://forensicitguy.github.io/analyzing-pirrit-adware-installer/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://www.cybereason.com/hubfs/Content%20PDFs/OSX.Pirrit%20Part%20III%20The%20DaVinci%20Code.pdf - webarchive
- http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf - webarchive
- http://www.zdnet.com/article/maker-of-sneaky-mac-adware-sends-security-researcher-cease-and-desist-letter/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
POOLRAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular POOLRAT.
| Known Synonyms |
|---|
SIMPLESEA |
Internal MISP references
UUID bfd9e30e-ddc7-426f-8f77-4d2e1a846541 which can be used as unique global reference for POOLRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.poolrat - webarchive
- https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack - webarchive
- https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-north-korea-indictment - webarchive
- https://www.3cx.com/blog/news/mandiant-security-update2/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Lazarus-campaigns-and-backdoors-in-2022-2023.pdf - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048e - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Poseidon (OS X)
Part of Mythic C2, written in Golang.
Internal MISP references
UUID e4ac9105-c3ad-41e2-846b-048e2bbedc6a which can be used as unique global reference for Poseidon (OS X) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Proton RAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Proton RAT.
| Known Synonyms |
|---|
Calisto |
Internal MISP references
UUID d7e31f19-8bf2-4def-8761-6c5bf7feaa44 which can be used as unique global reference for Proton RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.proton_rat - webarchive
- https://objective-see.com/blog/blog_0x1D.html - webarchive
- https://www.cybereason.com/labs-blog/labs-proton-b-what-this-mac-malware-actually-does - webarchive
- https://www.cybersixgill.com/wp-content/uploads/2017/02/02072017%20-%20Proton%20-%20A%20New%20MAC%20OS%20RAT%20-%20Sixgill%20Threat%20Report.pdf - webarchive
- https://www.hackread.com/hackers-selling-undetectable-proton-mac-malware/ - webarchive
- https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/ - webarchive
- https://securelist.com/calisto-trojan-for-macos/86543/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/mac-threat-analysis/2017/11/osx-proton-spreading-through-fake-symantec-blog/ - webarchive
- https://threatpost.com/handbrake-for-mac-compromised-with-proton-spyware/125518/ - webarchive
- https://objective-see.com/blog/blog_0x1F.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Pwnet
Cryptocurrency miner that was distributed masquerading as a Counter-Strike: Global Offensive hack.
Internal MISP references
UUID 70059ec2-9315-4af7-b65b-2ec35676a7bb which can be used as unique global reference for Pwnet in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dok
Dok a.k.a. Retefe is the macOS version of the banking trojan Retefe. It consists of a codesigned Mach-O dropper usually malspammed in an app bundle within a DMG disk image, posing as a document. The primary purpose of the dropper is to install a Tor client as well as a malicious CA certificate and proxy pac URL, in order to redirect traffic to targeted sites through their Tor node, effectively carrying out a MITM attack against selected web traffic. It also installs a custom hosts file to prevent access to Apple and VirusTotal. The macOS version shares its MO, many TTPs and infrastructure with the Windows counterpart.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Dok.
| Known Synonyms |
|---|
Retefe |
Internal MISP references
UUID 80acc956-d418-42e3-bddf-078695a01289 which can be used as unique global reference for Dok in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.retefe - webarchive
- https://blog.checkpoint.com/2017/07/13/osxdok-refuses-go-away-money/ - webarchive
- https://www.govcert.admin.ch/blog/33/the-retefe-saga - webarchive
- http://blog.checkpoint.com/2017/04/27/osx-malware-catching-wants-read-https-traffic/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/2019-return-retefe - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RustBucket (OS X)
Internal MISP references
UUID 03f356e6-296f-4195-bed0-9719a84887db which can be used as unique global reference for RustBucket (OS X) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.rustbucket - webarchive
- https://www.sentinelone.com/blog/bluenoroff-how-dprks-macos-rustbucket-seeks-to-evade-analysis-and-detection/ - webarchive
- https://sansorg.egnyte.com/dl/3P3HxFiNgL - webarchive
- https://securelist.com/bluenoroff-new-macos-malware/111290/ - webarchive
- https://www.elastic.co/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket - webarchive
- https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/ - webarchive
- https://blogs.jpcert.or.jp/ja/2023/05/dangerouspassword.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Shlayer
According to PCrisk, Shlayer is a trojan-type virus designed to proliferate various adware and other unwanted applications, and promote fake search engines. It is typically disguised as a Adobe Flash Player installer and various software cracking tools.
In most cases, users encounter this virus when visiting dubious Torrent websites that are full of intrusive advertisements and deceptive downloads.
Internal MISP references
UUID c3ee82df-a004-4c68-89bd-eb4bb2dfc803 which can be used as unique global reference for Shlayer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.shlayer - webarchive
- https://objective-see.com/blog/blog_0x64.html - webarchive
- https://threatpost.com/shlayer-mac-youtube-wikipedia/152146/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-345a - webarchive
- https://www.cisecurity.org/insights/blog/top-10-malware-march-2022 - webarchive
- https://www.crowdstrike.com/blog/how-crowdstrike-analyzes-macos-malware-to-optimize-automated-detection-capabilities - webarchive
- https://www.jamf.com/blog/shlayer-malware-abusing-gatekeeper-bypass-on-macos/ - webarchive
- https://cedowens.medium.com/macos-gatekeeper-bypass-2021-edition-5256a2955508 - webarchive
- https://www.crowdstrike.com/blog/shlayer-malvertising-campaigns-still-using-flash-update-disguise/ - webarchive
- https://resource.redcanary.com/rs/003-YRU-314/images/2021-Threat-Detection-Report.pdf - webarchive
- https://securelist.com/shlayer-for-macos/95724/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Silver Sparrow
According to Red Canary, Silver Sparrow is an activity cluster that includes a binary compiled to run on Apple’s new M1 chips but has been distributed without payload so far.
Internal MISP references
UUID f6a7aeeb-fcc5-4d26-9eab-c0b6e2819a6c which can be used as unique global reference for Silver Sparrow in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SimpleTea (OS X)
SimpleTea is a RAT for macOS that is based on the same object-oriented project as SimpleTea for Linux (SimplexTea).
It also shares similarities with POOLRAT (also known as SIMPLESEA), like the supported commands or a single-byte XOR encryption of its configuration. However, the indices of commands are different.
SimpleTea for macOS was uploaded to VirusTotal from Hong Kong and China in September 2023.
Internal MISP references
UUID ce384804-8580-4d57-97b3-bde0d903f703 which can be used as unique global reference for SimpleTea (OS X) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SUGARLOADER
Internal MISP references
UUID 171501fd-d504-4257-9c3d-fbc066d6eeba which can be used as unique global reference for SUGARLOADER in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SysJoker (OS X)
Internal MISP references
UUID 5bffe0fe-22f6-4d18-9372-f8c5d262d852 which can be used as unique global reference for SysJoker (OS X) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.sysjoker - webarchive
- https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/ - webarchive
- https://blogs.vmware.com/security/2022/03/%e2%80%afsysjoker-an-analysis-of-a-multi-os-rat.html - webarchive
- https://www.bleepingcomputer.com/news/security/new-sysjoker-backdoor-targets-windows-macos-and-linux/ - webarchive
- https://www.sentinelone.com/blog/sneaky-spies-and-backdoor-rats-sysjoker-and-dazzlespy-malware-target-macos/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
systemd
General purpose backdoor
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular systemd.
| Known Synonyms |
|---|
Demsty |
ReverseWindow |
Internal MISP references
UUID a8e7687b-9db7-4606-ba81-320d36099e3a which can be used as unique global reference for systemd in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Tsunami (OS X)
Internal MISP references
UUID 59d4a2f3-c66e-4576-80ab-e04a4b0a4317 which can be used as unique global reference for Tsunami (OS X) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified macOS 001 (UnionCryptoTrader)
Internal MISP references
UUID 1c96f6b9-6b78-4137-9d5f-aa5575f80daa which can be used as unique global reference for Unidentified macOS 001 (UnionCryptoTrader) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.unidentified_001 - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-north-korea-indictment - webarchive
- https://securelist.com/operation-applejeus-sequel/95596/ - webarchive
- https://objective-see.com/blog/blog_0x51.html - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048c - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
UpdateAgent
Internal MISP references
UUID 1f1bc885-5987-41fa-bb04-8775eeb45d88 which can be used as unique global reference for UpdateAgent in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.update_agent - webarchive
- https://twitter.com/sysopfb/status/1532442456343691273 - webarchive
- https://www.esentire.com/blog/updateagent-macos-malware - webarchive
- https://www.jamf.com/blog/updateagent-adapts-again/ - webarchive
- https://www.microsoft.com/security/blog/2022/02/02/the-evolution-of-a-mac-trojan-updateagents-progression/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Uroburos (OS X)
Internal MISP references
UUID 13173d75-45f0-4183-8e18-554a5781405c which can be used as unique global reference for Uroburos (OS X) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vigram
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Vigram.
| Known Synonyms |
|---|
WizardUpdate |
Internal MISP references
UUID 021e2fb4-1744-4fde-8d59-b247f1b34062 which can be used as unique global reference for Vigram in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.vigram - webarchive
- https://twitter.com/ConfiantIntel/status/1351559054565535745 - webarchive
- https://www.sentinelone.com/labs/the-art-and-science-of-macos-malware-hunting-with-radare2-leveraging-xrefs-yara-and-zignatures/ - webarchive
- https://twitter.com/MsftSecIntel/status/1451279679059488773 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WatchCat
Internal MISP references
UUID a73468d5-2dee-4828-8bbb-c37ea9295584 which can be used as unique global reference for WatchCat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WindTail
Internal MISP references
UUID 48751182-0b17-4326-8a72-41e4c4be35e7 which can be used as unique global reference for WindTail in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.windtail - webarchive
- https://posts.specterops.io/introducing-venator-a-macos-tool-for-proactive-detection-34055a017e56 - webarchive
- https://www.forbes.com/sites/thomasbrewster/2018/08/30/apple-mac-loophole-breached-in-middle-east-hacks/ - webarchive
- https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1554718868.pdf - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/04/vb2019-paper-cyber-espionage-middle-east-unravelling-osxwindtail/ - webarchive
- https://objective-see.com/blog/blog_0x3D.html - webarchive
- https://objective-see.com/blog/blog_0x3B.html - webarchive
- https://gsec.hitb.org/materials/sg2018/D1%20COMMSEC%20-%20In%20the%20Trails%20of%20WINDSHIFT%20APT%20-%20Taha%20Karim.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Winnti (OS X)
Internal MISP references
UUID 5aede44b-1a30-4062-bb97-ac9f4985ddb6 which can be used as unique global reference for Winnti (OS X) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WireLurker (OS X)
Internal MISP references
UUID bc32df24-8e80-44bc-80b0-6a4d55661aa5 which can be used as unique global reference for WireLurker (OS X) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Wirenet (OS X)
Internal MISP references
UUID f99ef0dc-9e96-42e0-bbfe-3616b3786629 which can be used as unique global reference for Wirenet (OS X) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
X-Agent (OS X)
Internal MISP references
UUID 858f4396-8bc9-4df8-9370-490bbb3b4535 which can be used as unique global reference for X-Agent (OS X) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.xagent - webarchive
- http://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/ - webarchive
- https://download.bitdefender.com/resources/files/News/CaseStudies/study/143/Bitdefender-Whitepaper-APT-Mac-A4-en-EN-web.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-twilight - webarchive
- https://twitter.com/PhysicalDrive0/status/845009226388918273 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XCSSET
Internal MISP references
UUID 041aee7f-cb7a-4199-9fe5-494801a18273 which can be used as unique global reference for XCSSET in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset - webarchive
- https://objective-see.com/blog/blog_0x5F.html - webarchive
- https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf - webarchive
- https://www.crowdstrike.com/blog/how-crowdstrike-analyzes-macos-malware-to-optimize-automated-detection-capabilities - webarchive
- https://www.trendmicro.com/en_us/research/21/g/updated-xcsset-malware-targets-telegram--other-apps.html - webarchive
- https://securelist.com/malware-for-the-new-apple-silicon-platform/101137/ - webarchive
- https://www.trendmicro.com/en_us/research/21/d/xcsset-quickly-adapts-to-macos-11-and-m1-based-macs.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/xcsset-mac-malware-infects-xcode-projects-performs-uxss-attack-on-safari-other-browsers-leverages-zero-day-exploits/ - webarchive
- https://www.jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Xloader
Xloader is a Rebranding of Formbook malware (mainly a stealer), available for macOS as well.
Formbook has a "magic"-value FBNG (FormBook-NG), while Xloader has a "magic"-value XLNG (XLoader-NG). This "magic"-value XLNG is platform-independent.
Not to be confused with apk.xloader or ios.xloader.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Xloader.
| Known Synonyms |
|---|
Formbook |
Internal MISP references
UUID d5f2f6ad-2ed0-42d4-9116-f95eea2ab543 which can be used as unique global reference for Xloader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.xloader - webarchive
- https://research.checkpoint.com/2022/xloader-botnet-find-me-if-you-can/ - webarchive
- https://www.vmray.com/cyber-security-blog/malware-analysis-spotlight-xbinder-xloader/ - webarchive
- https://research.checkpoint.com/2021/time-proven-tricks-in-a-new-environment-the-macos-evolution-of-formbook/ - webarchive
- https://blogs.blackberry.com/en/2021/09/threat-thursday-xloader-infostealer - webarchive
- https://twitter.com/krabsonsecurity/status/1319463908952969216 - webarchive
- https://www.lac.co.jp/lacwatch/report/20220307_002893.html - webarchive
- https://www.sentinelone.com/blog/xloaders-latest-trick-new-macos-variant-disguised-as-signed-officenote-app/ - webarchive
- https://malwarebookreports.com/cross-platform-java-dropper-snake-and-xloader-mac-version/ - webarchive
- https://cip.gov.ua/en/news/khto-stoyit-za-kiberatakami-na-ukrayinsku-kritichnu-informaciinu-infrastrukturu-statistika-15-22-bereznya - webarchive
- https://research.checkpoint.com/2021/top-prevalent-malware-with-a-thousand-campaigns-migrates-to-macos/ - webarchive
- https://www.sentinelone.com/blog/detecting-xloader-a-macos-malware-as-a-service-info-stealer-and-keylogger/ - webarchive
- https://blog.malwarebytes.com/mac/2021/07/osx-xloader-hides-little-except-its-main-purpose-what-we-learned-in-the-installation-process/ - webarchive
- https://www.zscaler.com/blogs/security-research/analysis-xloaders-c2-network-encryption - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XSLCmd
Internal MISP references
UUID 120a5890-dc3e-42e8-950e-b5ff9a849d2a which can be used as unique global reference for XSLCmd in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Yort
Internal MISP references
UUID 725cd3eb-1025-4da3-bcb1-a7b6591c632b which can be used as unique global reference for Yort in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZuRu
A malware that was observed being embedded alongside legitimate applications (such as iTerm2) offered for download on suspicious websites pushed in search engines. It uses a Python script to perform reconnaissance on the compromised system an pulls additional payload(s).
Internal MISP references
UUID bd293592-d2dd-4fdd-88e7-6098e0bbb043 which can be used as unique global reference for ZuRu in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ani-Shell
Ani-Shell is a simple PHP shell with some unique features like Mass Mailer, a simple Web-Server Fuzzer, Dosser, Back Connect, Bind Shell, Back Connect, Auto Rooter etc.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ani-Shell.
| Known Synonyms |
|---|
anishell |
Internal MISP references
UUID 7ef3c0fd-8736-47b1-8ced-ca7bf6d27471 which can be used as unique global reference for Ani-Shell in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ANTAK
Antak is a webshell written in ASP.Net which utilizes PowerShell.
Internal MISP references
UUID 88a71ca8-d99f-416a-ad29-5af12212008c which can be used as unique global reference for ANTAK in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/php.antak - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf - webarchive
- https://github.com/samratashok/nishang/blob/master/Antak-WebShell/antak.aspx - webarchive
- http://www.labofapenetrationtester.com/2014/06/introducing-antak.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ASPXSpy
Internal MISP references
UUID 4d1c01be-76ad-42dd-b094-7a8dbaf02159 which can be used as unique global reference for ASPXSpy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/php.aspxspy - webarchive
- https://asec.ahnlab.com/en/47455/ - webarchive
- https://attack.mitre.org/groups/G0096 - webarchive
- https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/ - webarchive
- https://www.recordedfuture.com/full-spectrum-detections-five-popular-web-shells - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Behinder
A webshell for multiple web languages (asp/aspx, jsp/jspx, php), openly distributed through Github.
Internal MISP references
UUID 5e5cd3a6-0348-4c6b-94b1-13ca0d845547 which can be used as unique global reference for Behinder in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/php.behinder - webarchive
- https://github.com/hktalent/MyDocs/blob/main/BehinderShell.md - webarchive
- https://www.elastic.co/security-labs/ref2924-howto-maintain-persistence-as-an-advanced-threat - webarchive
- https://cyberandramen.net/2022/02/18/a-tale-of-two-shells/ - webarchive
- https://blog.gigamon.com/2022/09/28/investigating-web-shells/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
c99shell
C99shell is a PHP backdoor that provides a lot of functionality, for example:
- run shell commands;
- download/upload files from and to the server (FTP functionality);
- full access to all files on the hard disk;
- self-delete functionality.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular c99shell.
| Known Synonyms |
|---|
c99 |
Internal MISP references
UUID cd1b8ec2-dbbd-4e73-b9a7-1bd1287a68f2 which can be used as unique global reference for c99shell in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DEWMODE
FireEye discovered the DEWMODE webshell starting mid-December 2020 after exploitation of zero-day vulnerabilities in Accellion's File Transfer Appliance. It is a PHP webshell that allows threat actors to view and download files in the victim machine. It also contains cleanup function to remove itself and clean the Apache log.
Internal MISP references
UUID a782aac8-168d-4691-a182-237d7d473e21 which can be used as unique global reference for DEWMODE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/php.dewmode - webarchive
- https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html - webarchive
- https://go.recordedfuture.com/hubfs/reports/mtp-2021-0312.pdf - webarchive
- https://www.accellion.com/sites/default/files/trust-center/accellion-fta-attack-mandiant-report-full.pdf - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-055a - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ensikology
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ensikology.
| Known Synonyms |
|---|
Ensiko |
Internal MISP references
UUID dfd8deac-ce86-4a22-b462-041c19d62506 which can be used as unique global reference for Ensikology in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
p0wnyshell
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular p0wnyshell.
| Known Synonyms |
|---|
Ponyshell |
Pownyshell |
Internal MISP references
UUID a6d13ffe-1b1a-46fe-afd9-989e8dec3773 which can be used as unique global reference for p0wnyshell in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Parrot TDS WebShell
In combination with Parrot TDS the usage of a classical web shell was observed by DECODED Avast.io.
Internal MISP references
UUID c9e7c5a6-9082-47ec-89eb-477980e73dcb which can be used as unique global reference for Parrot TDS WebShell in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PAS
Internal MISP references
UUID e6a40fa2-f79f-40e9-89d3-a56984bc51f7 which can be used as unique global reference for PAS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/php.pas - webarchive
- https://www.domaintools.com/resources/blog/centreon-to-exim-and-back-on-the-trail-of-sandworm - webarchive
- https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf - webarchive
- https://blog.erratasec.com/2016/12/some-notes-on-iocs.html - webarchive
- https://securelist.com/apt-trends-report-q1-2021/101967/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Prometheus Backdoor
Backdoor written in php
Internal MISP references
UUID b4007b02-106d-420f-af1c-76c035843fd2 which can be used as unique global reference for Prometheus Backdoor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RedHat Hacker WebShell
Internal MISP references
UUID e94a5b44-f2c2-41dc-8abb-6de69eb38241 which can be used as unique global reference for RedHat Hacker WebShell in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WSO
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular WSO.
| Known Synonyms |
|---|
Webshell by Orb |
Internal MISP references
UUID 7f3794fc-662e-4dde-b793-49bcaccc96f7 which can be used as unique global reference for WSO in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Silence DDoS
Internal MISP references
UUID b5cc7a39-305b-487e-b15a-02dcebefce90 which can be used as unique global reference for Silence DDoS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackSun
Ransomware.
Internal MISP references
UUID 1fcc4425-6e14-47e6-8434-745cf1bc9982 which can be used as unique global reference for BlackSun in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BONDUPDATER
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BONDUPDATER.
| Known Synonyms |
|---|
Glimpse |
Poison Frog |
Internal MISP references
UUID 99600ba5-30a0-4ac8-8583-6288760b77c3 which can be used as unique global reference for BONDUPDATER in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.bondupdater - webarchive
- https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/ - webarchive
- https://www.zdnet.com/article/source-code-of-iranian-cyber-espionage-tools-leaked-on-telegram/ - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://unit42.paloaltonetworks.com/behind-the-scenes-with-oilrig/ - webarchive
- https://blog.0day.rocks/hacking-back-and-influence-operations-85cd52c1e933 - webarchive
- https://marcoramilli.com/2019/05/02/apt34-glimpse-project/ - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-gypsy - webarchive
- https://ironnet.com/blog/chirp-of-the-poisonfrog/ - webarchive
- https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/ - webarchive
- https://www.netscout.com/blog/asert/tunneling-under-sands - webarchive
- https://cyware.com/blog/apt34-the-helix-kitten-cybercriminal-group-loves-to-meow-middle-eastern-and-international-organizations-48ae - webarchive
- https://nsfocusglobal.com/apt34-event-analysis-report/ - webarchive
- https://www.boozallen.com/s/insight/blog/dark-labs-discovers-apt34-malware-variants.html?cid=spo-csatb-2 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CASHY200
Internal MISP references
UUID 7373c789-2dc2-4867-9c60-fa68f8d971a2 which can be used as unique global reference for CASHY200 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FlowerPower
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FlowerPower.
| Known Synonyms |
|---|
BoBoStealer |
Internal MISP references
UUID 6f0f034a-13f1-432d-bc70-f78d7f27f46f which can be used as unique global reference for FlowerPower in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.flowerpower - webarchive
- https://www.youtube.com/watch?v=rfzmHjZX70s - webarchive
- https://i.blackhat.com/asia-21/Friday-Handouts/as-21-Kuo-We-Are-About-To-Land-How-CloudDragon-Turns-A-Nightmare-Into-Reality.pdf - webarchive
- https://vblocalhost.com/uploads/VB2020-46.pdf - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://vb2020.vblocalhost.com/uploads/VB2020-46.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FRat Loader
Loader used to deliver FRat (see family windows.frat)
Internal MISP references
UUID 385a3dca-263d-46be-b84d-5dc09ee466d9 which can be used as unique global reference for FRat Loader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FTCODE
The malware ftcode is a ransomware which encrypts files and changes their extension into .FTCODE. It later asks for a ransom in order to release the decryption key, mandatory to recover your files. It is infamous for attacking Italy pretending to be a notorious telecom provider asking for due payments.
Internal MISP references
UUID f727a05e-c1cd-4e95-b0bf-2a4bb64aa850 which can be used as unique global reference for FTCODE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.ftcode - webarchive
- https://www.certego.net/en/news/ftdecryptor-a-simple-password-based-ftcode-decryptor/ - webarchive
- https://nakedsecurity.sophos.com/2013/03/05/russian-ransomware-windows-powershell/ - webarchive
- https://www.kpn.com/security-blogs/FTCODE-taking-over-a-portion-of-the-botnet.htm - webarchive
- https://www.certego.net/en/news/malware-tales-ftcode/ - webarchive
- https://www.zscaler.com/blogs/research/ftcode-ransomware--new-version-includes-stealing-capabilities - webarchive
- https://dissectingmalwa.re/nicht-so-goot-breaking-down-gootkit-and-jasper-ftcode.html - webarchive
- https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Additional%20Analysis/Unknown/2020-06-22/Analysis.md - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GhostMiner
Internal MISP references
UUID 0db05333-2214-49c3-b469-927788932aaa which can be used as unique global reference for GhostMiner in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.ghostminer - webarchive
- https://research.checkpoint.com/malware-against-the-c-monoculture/ - webarchive
- https://blog.minerva-labs.com/ghostminer-cryptomining-malware-goes-fileless - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/fileless-cryptocurrency-miner-ghostminer-weaponizes-wmi-objects-kills-other-cryptocurrency-mining-payloads/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JasperLoader
Internal MISP references
UUID 286a14a1-7113-4bed-97ce-8db41b312a51 which can be used as unique global reference for JasperLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.jasperloader - webarchive
- https://blog.talosintelligence.com/2019/05/sorpresa-jasperloader.html - webarchive
- https://blog.threatstop.com/upgraded-jasperloader-infecting-machines - webarchive
- https://blog.talosintelligence.com/2019/04/jasperloader-targets-italy.html - webarchive
- https://dissectingmalwa.re/nicht-so-goot-breaking-down-gootkit-and-jasper-ftcode.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lazyscripter
Internal MISP references
UUID 74e5711e-b777-4f09-a4bc-db58d5e23e29 which can be used as unique global reference for Lazyscripter in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LightBot
According to Bleeping Computer and Vitali Kremez, LightBot is a compact reconnaissance tool suspected to be used to identify high-value targets for potential follow-up ransomware attacks.
Internal MISP references
UUID 319c4b4f-2901-412c-8fa5-70be75ba51cb which can be used as unique global reference for LightBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Octopus (Powershell)
The author describes Octopus as an "open source, pre-operation C2 server based on python which can control an Octopus powershell agent through HTTP/S."
It is different from the malware win.octopus written in Delphi and attributed to DustSquad by Kaspersky Labs.
Internal MISP references
UUID c3ca7a89-a885-444a-8642-31019b34b027 which can be used as unique global reference for Octopus (Powershell) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.octopus - webarchive
- https://isc.sans.edu/diary/26918 - webarchive
- https://github.com/mhaskar/Octopus - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0107.pdf - webarchive
- https://resources.malwarebytes.com/files/2021/02/LazyScripter.pdf - webarchive
- https://isc.sans.edu/diary/rss/28628 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OilRig
Internal MISP references
UUID 4a3b9669-8f91-47df-a8bf-a9876ab8edf3 which can be used as unique global reference for OilRig in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.oilrig - webarchive
- https://www.vkremez.com/2018/03/investigating-iranian-threat-group.html - webarchive
- https://twitter.com/MJDutch/status/1074820959784321026?s=19 - webarchive
- https://threatpost.com/oilrig-apt-unique-backdoor/157646/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PhonyC2
Internal MISP references
UUID c630e510-a0ad-405a-9aeb-9d8057b6a868 which can be used as unique global reference for PhonyC2 in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.phonyc2 - webarchive
- https://www.deepinstinct.com/blog/muddywater-en-able-spear-phishing-with-new-ttps - webarchive
- https://www.deepinstinct.com/blog/muddyc2go-latest-c2-framework-used-by-iranian-apt-muddywater-spotted-in-israel - webarchive
- https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
POSHSPY
Internal MISP references
UUID 4df1b257-c242-46b0-b120-591430066b6f which can be used as unique global reference for POSHSPY in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PowerBrace
Internal MISP references
UUID 7b334343-0045-4d65-b28a-ebf912c7aafc which can be used as unique global reference for PowerBrace in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PowerHarbor
PowerHarbor is a modular PowerShell-based malware that consists of various modules. The primary module maintains constant communication with the C2 server, executing and deleting additional modules received from it. Currently, the communication with the C2 server is encrypted using RSA encryption and hardcoded key data. Moreover, the main module incorporates virtual machine (VM) detection capabilities. The StealData module employs the Invoke-Stealer function as its core, enabling the theft of system information, browser-stored credentials, cryptocurrency wallet details, and credentials for various applications like Telegram, FileZilla, and WinSCP.
Internal MISP references
UUID 73b40a4c-9163-4a07-bf1b-e4a4344ac63a which can be used as unique global reference for PowerHarbor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PowerPepper
Internal MISP references
UUID 6544c75b-809f-4d31-a235-8906d4004828 which can be used as unique global reference for PowerPepper in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
POWERPIPE
Internal MISP references
UUID 60d7f668-66b6-401b-976f-918470a23c3d which can be used as unique global reference for POWERPIPE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerpipe - webarchive
- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
POWERPLANT
This powershell code is a PowerShell written backdoor used by FIN7. Regarding to Mandiant that is was revealed to be a "vast backdoor framework with a breadth of capabilities, depending on which modules are delivered from the C2 server."
Internal MISP references
UUID 697626d3-04a1-4426-aeae-d7054c6e78fb which can be used as unique global reference for POWERPLANT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
powershell_web_backdoor
Internal MISP references
UUID 4310dcab-0820-4bc1-8a0b-9691c20f5b49 which can be used as unique global reference for powershell_web_backdoor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PowerShortShell
Internal MISP references
UUID f2198153-2d8b-49ed-b8a8-0952c289b8c0 which can be used as unique global reference for PowerShortShell in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PowerShower
Internal MISP references
UUID 0959a02e-6eba-43dc-bbbf-b2c7488e9371 which can be used as unique global reference for PowerShower in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powershower - webarchive
- https://unit42.paloaltonetworks.com/atoms/clean-ursa/ - webarchive
- https://securelist.com/recent-cloud-atlas-activity/92016 - webarchive
- https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability - webarchive
- https://unit42.paloaltonetworks.com/atoms/clean-ursa - webarchive
- https://attack.mitre.org/groups/G0100 - webarchive
- https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/ - webarchive
- https://securelist.com/recent-cloud-atlas-activity/92016/ - webarchive
- https://attack.mitre.org/groups/G0100/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
POWERSOURCE
POWERSOURCE is a heavily obfuscated and modified version of the publicly available tool DNS_TXT_Pwnage. The backdoor uses DNS TXT requests for command and control and is installed in the registry or Alternate Data Streams.
Internal MISP references
UUID a4584181-f739-43d1-ade9-8a7aa21278a0 which can be used as unique global reference for POWERSOURCE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powersource - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf - webarchive
- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html - webarchive
- https://cocomelonc.github.io/malware/2023/07/26/malware-tricks-35.html - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PowerSpritz
Internal MISP references
UUID c07f6484-0669-44b7-90e6-f642e316d277 which can be used as unique global reference for PowerSpritz in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
POWERSTATS
POWERSTATS is a backdoor written in powershell. It has the ability to disable Microsoft Office Protected View, fingerprint the victim and receive commands.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular POWERSTATS.
| Known Synonyms |
|---|
Valyria |
Internal MISP references
UUID b81d91b5-23a4-4f86-aea9-3f212169fce9 which can be used as unique global reference for POWERSTATS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerstats - webarchive
- https://mp.weixin.qq.com/s/NN_iRvwA6yOHFS9Z3A0RBA - webarchive
- https://shells.systems/reviving-leaked-muddyc3-used-by-muddywater-apt/ - webarchive
- https://web.archive.org/web/20180807105755/https://www.sekoia.fr/blog/falling-on-muddywater/ - webarchive
- https://research.checkpoint.com/2019/the-muddy-waters-of-apt-attacks/ - webarchive
- http://www.secureworks.com/research/threat-profiles/cobalt-ulster - webarchive
- https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-ulster - webarchive
- https://www.group-ib.com/blog/muddywater/ - webarchive
- https://blog.prevailion.com/2020/01/summer-mirage.html - webarchive
- https://www.clearskysec.com/muddywater-targets-kurdish-groups-turkish-orgs/ - webarchive
- https://sec0wn.blogspot.com/2018/05/clearing-muddywater-analysis-of-new.html - webarchive
- https://unit42.paloaltonetworks.com/atoms/boggyserpens/ - webarchive
- https://thehackernews.com/2022/02/irans-muddywater-hacker-group-using-new.html - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-055a - webarchive
- https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater - webarchive
- https://blog.malwarebytes.com/threat-analysis/2017/09/elaborate-scripting-fu-used-in-espionage-attack-against-saudi-arabia-government_entity/ - webarchive
- https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf - webarchive
- https://www.inforisktoday.com/muddywater-targets-critical-infrastructure-in-asia-europe-a-18611 - webarchive
- https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/ - webarchive
- https://sec0wn.blogspot.com/2018/03/a-quick-dip-into-muddywaters-recent.html - webarchive
- https://sec0wn.blogspot.com/2017/10/continued-activity-targeting-middle-east.html - webarchive
- https://marcoramilli.com/2020/01/15/iranian-threat-actors-preliminary-analysis/ - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-055A_Iranian_Government-Sponsored_Actors_Conduct_Cyber_Operations.pdf - webarchive
- https://securelist.com/apt-trends-report-q2-2019/91897/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/campaign-possibly-connected-muddywater-surfaces-middle-east-central-asia/ - webarchive
- https://sec0wn.blogspot.com/2018/02/burping-on-muddywater.html - webarchive
- https://www.clearskysec.com/muddywater-operations-in-lebanon-and-oman/ - webarchive
- https://unit42.paloaltonetworks.com/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
POWERTON
Internal MISP references
UUID 08d5b8a4-e752-48f3-ac6d-944807146ce7 which can be used as unique global reference for POWERTON in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerton - webarchive
- https://blog.telsy.com/meeting-powerband-the-apt33-net-powerton-variant/ - webarchive
- https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html - webarchive
- https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/ - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-trinity - webarchive
- https://www.symantec.com/security-center/writeup/2019-062513-4935-99 - webarchive
- https://norfolkinfosec.com/apt33-powershell-malware/ - webarchive
- https://www.fireeye.com/blog/threat-research/2020/07/scandalous-external-detection-using-network-scan-data-and-automation.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
POWERTRASH
This PowerShell written malware is an in-memory dropper used by FIN7 to execute the included/embedded payload. According to Mandiant's blog article: "POWERTRASH is a uniquely obfuscated iteration of a shellcode invoker included in the PowerSploit framework available on GitHub."
Internal MISP references
UUID ff20d720-285e-4168-ac8c-86a7f9ac18d4 which can be used as unique global reference for POWERTRASH in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PowerWare
Internal MISP references
UUID 5c5beab9-614c-4c86-b369-086234ddb43c which can be used as unique global reference for PowerWare in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PowerZure
PowerZure is a PowerShell project created to assess and exploit resources within Microsoft’s cloud platform, Azure. PowerZure was created out of the need for a framework that can both perform reconnaissance and exploitation of Azure, AzureAD, and the associated resources.
Internal MISP references
UUID f5fa77e9-9851-48a6-864d-e0448de062d4 which can be used as unique global reference for PowerZure in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PowerMagic
Internal MISP references
UUID 7ee51054-1d3b-45ec-a7fd-1e212c891b99 which can be used as unique global reference for PowerMagic in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.power_magic - webarchive
- https://securelist.com/bad-magic-apt/109087/?s=31 - webarchive
- https://securelist.com/cloudwizard-apt/109722/ - webarchive
- https://securelist.com/bad-magic-apt/109087/ - webarchive
- https://www.malwarebytes.com/blog/threat-intelligence/2023/05/redstinger - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PowGoop
DLL loader that decrypts and runs a powershell-based downloader.
Internal MISP references
UUID d8429f6d-dc4b-4aae-930d-234156dbf354 which can be used as unique global reference for PowGoop in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powgoop - webarchive
- https://www.clearskysec.com/wp-content/uploads/2020/10/Operation-Quicksand.pdf - webarchive
- https://www.security.ntt/blog/analysis-of-an-iranian-apts-e400-powgoop-variant - webarchive
- https://unit42.paloaltonetworks.com/thanos-ransomware/ - webarchive
- https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/seedworm-apt-iran-middle-east - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-055A_Iranian_Government-Sponsored_Actors_Conduct_Cyber_Operations.pdf - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://thehackernews.com/2022/02/irans-muddywater-hacker-group-using-new.html - webarchive
- https://www.cyberscoop.com/muddywater-iran-symantec-middle-east/ - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-055a - webarchive
- https://www.inforisktoday.com/muddywater-targets-critical-infrastructure-in-asia-europe-a-18611 - webarchive
- https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
POWRUNER
Internal MISP references
UUID 63f6df51-4de3-495a-864f-0a7e30c3b419 which can be used as unique global reference for POWRUNER in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powruner - webarchive
- https://cyware.com/blog/apt34-the-helix-kitten-cybercriminal-group-loves-to-meow-middle-eastern-and-international-organizations-48ae - webarchive
- https://www.boozallen.com/s/insight/blog/dark-labs-discovers-apt34-malware-variants.html?cid=spo-csatb-2 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PresFox
The family is adding a fake root certificate authority, sets a proxy.pac-url for local browsers and redirects infected users to fake banking applications (currently targeting Poland). Based on information shared, it seems the PowerShell script is dropped by an exploit kit.
Internal MISP references
UUID c8c5ca3c-7cf0-453e-9fe9-d5637b1ab1f8 which can be used as unique global reference for PresFox in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QUADAGENT
Internal MISP references
UUID e27bfd65-4a58-416a-b03a-1ab1703edb24 which can be used as unique global reference for QUADAGENT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.quadagent - webarchive
- https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/ - webarchive
- https://cyware.com/blog/apt34-the-helix-kitten-cybercriminal-group-loves-to-meow-middle-eastern-and-international-organizations-48ae - webarchive
- https://www.fireeye.com/blog/threat-research/2020/07/scandalous-external-detection-using-network-scan-data-and-automation.html - webarchive
- https://youtu.be/pBDu8EGWRC4?t=2492 - webarchive
- https://docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc/edit#heading=h.ez428aw98bca - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RMOT
According to Trellix, this is a first-stage, powershell-based malware dropped via Excel/VBS. It is able to establish a foothold and exfiltrate data. Targets identified include hotels in Macao.
Internal MISP references
UUID 7e79444b-95d9-422d-92f0-aeb833a7cbcd which can be used as unique global reference for RMOT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RogueRobin
Internal MISP references
UUID 1e27a569-1899-4f6f-8c42-aa91bf0a539d which can be used as unique global reference for RogueRobin in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.roguerobin - webarchive
- https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/ - webarchive
- https://ironnet.com/blog/dns-tunneling-series-part-3-the-siren-song-of-roguerobin/ - webarchive
- https://docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc/edit#heading=h.ez428aw98bca - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Royal Ransom (Powershell)
Toolkit downloader used by Royal Ransomware group, involving GnuPG for decryption.
Internal MISP references
UUID 1c75ffff-59f9-4fdc-958d-51f822f76c35 which can be used as unique global reference for Royal Ransom (Powershell) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Schtasks
Internal MISP references
UUID 3c627182-e4ee-4db0-9263-9d657a5d7c98 which can be used as unique global reference for Schtasks in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
skyrat
Internal MISP references
UUID 8e5d7d24-9cdd-4376-a6c7-967273dfeeab which can be used as unique global reference for skyrat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
sLoad
sLoad is a PowerShell downloader that most frequently delivers Ramnit banker and includes noteworthy reconnaissance features. The malware gathers information about the infected system including a list of running processes, the presence of Outlook, and the presence of Citrix-related files. sLoad can also take screenshots and check the DNS cache for specific domains (e.g., targeted banks), as well as load external binaries.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular sLoad.
| Known Synonyms |
|---|
Starslord |
Internal MISP references
UUID e78c0259-9299-4e55-b934-17c6a3ac4bc2 which can be used as unique global reference for sLoad in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.sload - webarchive
- https://www.microsoft.com/security/blog/2020/01/21/sload-launches-version-2-0-starslord/ - webarchive
- https://cert-agid.gov.it/news/campagna-sload-v-2-9-3-veicolata-via-pec/ - webarchive
- https://blog.yoroi.company/research/the-sload-powershell-threat-is-expanding-to-italy/ - webarchive
- https://cyware.com/news/new-sload-malware-downloader-being-leveraged-by-apt-group-ta554-to-spread-ramnit-7d03f2d9 - webarchive
- https://www.proofpoint.com/us/threat-insight/post/sload-and-ramnit-pairing-sustained-campaigns-against-uk-and-italy - webarchive
- https://blog.minerva-labs.com/sload-targeting-europe-again - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf - webarchive
- https://www.cert-pa.it/notizie/campagna-sload-star-wars-edition-veicolata-via-pec/ - webarchive
- https://www.certego.net/en/news/sload-hits-italy-unveil-the-power-of-powershell-as-a-downloader/ - webarchive
- https://threatpost.com/sload-spying-payload-delivery-bits/151120/ - webarchive
- https://www.vkremez.com/2018/08/lets-learn-in-depth-into-latest-ramnit.html - webarchive
- https://isc.sans.edu/forums/diary/Malicious+Powershell+Targeting+UK+Bank+Customers/23675/ - webarchive
- https://www.cybereason.com/blog/banking-trojan-delivered-by-lolbins-ramnit-trojan - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Snugy
Internal MISP references
UUID 773a6520-d164-4727-8351-c4201b04f10b which can be used as unique global reference for Snugy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Swrort Stager
Internal MISP references
UUID 3347a1bc-6b4d-459c-98a5-746bab12d011 which can be used as unique global reference for Swrort Stager in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Tater PrivEsc
Internal MISP references
UUID 808445e6-f51c-4b5d-a812-78102bf60d24 which can be used as unique global reference for Tater PrivEsc in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ThunderShell
Internal MISP references
UUID fd9904a6-6e06-4b50-8bfd-64ffb793d4a4 which can be used as unique global reference for ThunderShell in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified PS 001
Recon and exfiltration script, dropped from a LNK file. Attributed to APT-C-12.
Internal MISP references
UUID 77231587-0dbe-4064-97b5-d7f4a2e3dc67 which can be used as unique global reference for Unidentified PS 001 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified PS 002 (RAT)
A Powershell-based RAT capable of pulling further payloads, delivered through Russia-themed phishing mails.
Internal MISP references
UUID 73578ff6-b218-4271-9bda-2a567ba3e259 which can be used as unique global reference for Unidentified PS 002 (RAT) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.unidentified_002 - webarchive
- https://www.bleepingcomputer.com/news/security/phishing-campaign-targets-russian-govt-dissidents-with-cobalt-strike/ - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2022/03/new-spear-phishing-campaign-targets-russian-dissidents/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified PS 003 (RAT)
This malware is a RAT written in PowerShell. It has the following capabilities: Downloading and Uploading files, loading and execution of a PowerShell script, execution of a specific command. It was observed by Malwarebytes LABS Threat Intelligence Team in a newly discovered campaign: this campaigns tries to lure Germans with a promise of updates on the current threat situation in Ukraine according to Malwarebyte LABS.
Internal MISP references
UUID 709ba4ad-9ec5-4e0b-b642-96db3b7f6898 which can be used as unique global reference for Unidentified PS 003 (RAT) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ViperSoftX
Internal MISP references
UUID 15b551ea-b59a-40f9-a10f-6144415d2d5c which can be used as unique global reference for ViperSoftX in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.vipersoftx - webarchive
- https://www.trendmicro.com/en_us/research/23/d/vipersoftx-updates-encryption-steals-data.html - webarchive
- https://decoded.avast.io/janrubin/vipersoftx-hiding-in-system-logs-and-spreading-venomsoftx/ - webarchive
- https://chris.partridge.tech/2022/evolution-of-vipersoftx-dga - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WannaMine
Internal MISP references
UUID beb4f2b3-85d1-491d-8ae1-f7933f00f820 which can be used as unique global reference for WannaMine in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.wannamine - webarchive
- https://www.cybereason.com/blog/wannamine-cryptominer-eternalblue-wannacry - webarchive
- https://www.crowdstrike.com/blog/cryptomining-harmless-nuisance-disruptive-threat/ - webarchive
- https://www.accenture.com/_acnmedia/PDF-46/Accenture-Threat-Analysis-Monero-Wannamine.pdf - webarchive
- https://www.crowdstrike.com/blog/weeding-out-wannamine-v4-0-analyzing-and-remediating-this-mineware-nightmare/ - webarchive
- https://news.sophos.com/fr-fr/2020/01/22/wannamine-meme-cybercriminels-veulent-avoir-mot-a-dire-sur-brexit/ - webarchive
- https://nakedsecurity.sophos.com/2018/01/31/what-are-wannamine-attacks-and-how-do-i-avoid-them/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WannaRen Downloader
Internal MISP references
UUID c9ef106e-def9-4229-8373-616a298ed645 which can be used as unique global reference for WannaRen Downloader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WMImplant
Internal MISP references
UUID d1150a1a-a2f4-4954-b22a-a85b7876408e which can be used as unique global reference for WMImplant in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AndroxGh0st
According to Laceworks, this is a SMTP cracker, which is primarily intended to scan for and parse Laravel application secrets from exposed .env files. Note: Laravel is an open source PHP framework and the Laravel .env file is often targeted for its various configuration data including AWS, SendGrid and Twilio. AndroxGh0st has multiple features to enable SMTP abuse including scanning, exploitation of exposed creds and APIs, and even deployment of webshells. For AWS specifically, the malware scans for and parses AWS keys but also has the ability to generate keys for brute force attacks. However, the brute force capability is likely a novelty and is a statistically unlikely attack vector.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular AndroxGh0st.
| Known Synonyms |
|---|
Androx |
AndroxGhost |
Internal MISP references
UUID e8f24c9c-c03c-4740-a121-d73789931c8e which can be used as unique global reference for AndroxGh0st in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Archivist
Internal MISP references
UUID 2095a09c-3fdd-4164-b82e-2e9a41affd8e which can be used as unique global reference for Archivist in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ares (Python)
Ares is a Python RAT.
Internal MISP references
UUID c4a578de-bebe-49bf-8af1-407857acca95 which can be used as unique global reference for Ares (Python) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BrickerBot
Internal MISP references
UUID f0ff8751-c182-4e9c-a275-81bb03e0cdf5 which can be used as unique global reference for BrickerBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/py.brickerbot - webarchive
- https://ics-cert.us-cert.gov/alerts/ICS-ALERT-17-102-01A - webarchive
- https://security.radware.com/ddos-threats-attacks/brickerbot-pdos-permanent-denial-of-service/ - webarchive
- http://depastedihrn3jtw.onion/show.php?md5=2c822a990ff22d56f3b9eb89ed722c3f - webarchive
- https://www.bleepingcomputer.com/news/security/brickerbot-author-retires-claiming-to-have-bricked-over-10-million-iot-devices/ - webarchive
- http://seclists.org/fulldisclosure/2017/Mar/7 - webarchive
- https://www.bleepingcomputer.com/news/security/brickerbot-author-claims-he-bricked-two-million-devices/ - webarchive
- https://www.trustwave.com/Resources/SpiderLabs-Blog/BrickerBot-mod_plaintext-Analysis/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DropboxC2C
Internal MISP references
UUID 53dd4a8b-374e-48b6-a7c8-58af0e31f435 which can be used as unique global reference for DropboxC2C in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Empyrean
Discord Stealer written in Python with Javascript-based inject files.
Internal MISP references
UUID b1aa0be3-b725-4135-b0b9-3a895d4ef047 which can be used as unique global reference for Empyrean in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Guard
According to Kaspersky Labs, Guard is a malware developed by threat actor WildPressure. It is written in Python and packaged using PyInstaller, both for Windows and macOS operating systems. Its intrinsics resemble parts of how win.milum operates.
Internal MISP references
UUID ac3382b3-3c18-4b16-8f1b-b371794916ac which can be used as unique global reference for Guard in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
InvisibleFerret
Internal MISP references
UUID 332478a1-146f-406e-9af0-b329e478efff which can be used as unique global reference for InvisibleFerret in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KeyPlexer
Internal MISP references
UUID cadf8c9d-7bb0-40ad-8c8c-043b1d4b2e93 which can be used as unique global reference for KeyPlexer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LaZagne
The author described LaZagne as an open source project used to retrieve lots of passwords stored on a local computer. It has been developed for the purpose of finding these passwords for the most commonly-used software. It is written in Python and provided as compiled standalone binaries for Linux, Mac, and Windows.
Internal MISP references
UUID c752f295-7f08-4cb0-92d5-a0c562abd08c which can be used as unique global reference for LaZagne in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/py.lazagne - webarchive
- https://www.mandiant.com/resources/blog/alphv-ransomware-backup - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://github.com/AlessandroZ/LaZagne - webarchive
- https://attack.mitre.org/groups/G0100 - webarchive
- https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/ - webarchive
- https://yoroi.company/research/shadows-from-the-past-threaten-italian-enterprises/ - webarchive
- https://www.infinitumit.com.tr/apt-35/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-ransomexx - webarchive
- https://www.trendmicro.com/en_us/research/20/k/weaponizing-open-source-software-for-targeted-attacks.html - webarchive
- https://edu.anarcho-copy.org/Against%20Security%20&%20%20Self%20Security/Group-IB%20RedCurl.pdf - webarchive
- https://attack.mitre.org/groups/G0100/ - webarchive
- https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lofy
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Lofy.
| Known Synonyms |
|---|
LofyLife |
Internal MISP references
UUID 10882613-ac61-42da-82c8-c0f4bb2673f8 which can be used as unique global reference for Lofy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Loki RAT
This RAT written in Python is an open-source fork of the Ares RAT. This malware integrates additional modules, like recording, lockscreen, and locate options. It was used in a customized form version by El Machete APT in an ongoing champaign since 2020. The original code can be found at: https://github.com/TheGeekHT/Loki.Rat/
Internal MISP references
UUID 5e7bb9d4-6633-49f8-8770-9ac1163e6531 which can be used as unique global reference for Loki RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MASEPIE
Internal MISP references
UUID 9233f6e6-9dd7-4b30-adaa-5baf5359d22a which can be used as unique global reference for MASEPIE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
N3Cr0m0rPh
An IRC bot written in (obfuscated) Python code. Distributed in attack campaign FreakOut, written by author Freak/Fl0urite and development potentially dating back as far as 2015.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular N3Cr0m0rPh.
| Known Synonyms |
|---|
FreakOut |
Necro |
Internal MISP references
UUID 2351539a-165a-4886-b5fe-f56fdf6b167a which can be used as unique global reference for N3Cr0m0rPh in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/py.n3cr0m0rph - webarchive
- https://www.lacework.com/blog/spytech-necro-keksecs-latest-python-malware/ - webarchive
- https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/ - webarchive
- https://www.bleepingcomputer.com/news/security/freakout-malware-worms-its-way-into-vulnerable-vmware-servers/ - webarchive
- https://blog.netlab.360.com/necro-upgrades-again-using-tor-dynamic-domain-dga-and-aiming-at-both-windows-linux/ - webarchive
- https://www.lacework.com/blog/the-kek-security-network/ - webarchive
- https://blogs.juniper.net/en-us/threat-research/necro-python-botnet-goes-after-vulnerable-visualtools-dvr - webarchive
- https://blog.netlab.360.com/not-really-new-pyhton-ddos-bot-n3cr0m0rph-necromorph/ - webarchive
- https://twitter.com/xuy1202/status/1392089568384454657 - webarchive
- https://blog.talosintelligence.com/2021/06/necro-python-bot-adds-new-tricks.html - webarchive
- https://twitter.com/xuy1202/status/1393384128456794116 - webarchive
- https://www.lacework.com/the-kek-security-network/ - webarchive
- https://github.com/lacework/lacework-labs/tree/master/keksec - webarchive
- https://www.lacework.com/keksec-tsunami-ryuk/ - webarchive
- https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NetWorm
Internal MISP references
UUID 6c6acd00-cdc2-460d-8edf-003b84875b5d which can be used as unique global reference for NetWorm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PIRAT
Internal MISP references
UUID bca94d33-e5a1-4bcc-981e-f35fd74a79d1 which can be used as unique global reference for PIRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Poet RAT
Cisco Talos has discovered a Python-based RAT they call Poet RAT. It is dropped from a Word document and delivered including a Python interpreter and required libraries. The name originates from references to Shakespeare. Exfiltration happens through FTP.
Internal MISP references
UUID b07819a9-a2f7-454d-a520-c6424cbf1ed4 which can be used as unique global reference for Poet RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/py.poet_rat - webarchive
- https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html - webarchive
- https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/python-malware-on-the-rise/ - webarchive
- https://ics-cert.kaspersky.com/media/KASPERSKY_H1_2020_ICS_REPORT_EN.pdf - webarchive
- https://www.ptsecurity.com/ww-en/analytics/antisandbox-techniques/ - webarchive
- https://blog.talosintelligence.com/yorotrooper-espionage-campaign-cis-turkey-europe/ - webarchive
- https://blog.talosintelligence.com/2020/10/poetrat-update.html - webarchive
- https://www.dragos.com/blog/industry-news/new-ics-threat-activity-group-stibnite/ - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
poweRAT
Internal MISP references
UUID b5cb3d2b-0205-4883-aaff-0d0b7a7f032d which can be used as unique global reference for poweRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
pupy (Python)
Internal MISP references
UUID afcc9bfc-1227-4bb0-a88a-5accdbfd58fa which can be used as unique global reference for pupy (Python) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/py.pupy - webarchive
- https://github.com/n1nj4sec/pupy - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-gypsy - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-trinity - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0107.pdf - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2020-0123.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PyAesLoader
Internal MISP references
UUID b9ba4f66-78dc-491f-8fd4-0143816ce80e which can be used as unique global reference for PyAesLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PyArk
Internal MISP references
UUID 01f15f4e-dd40-4246-9b99-c0d81306e37f which can be used as unique global reference for PyArk in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
pyback
Internal MISP references
UUID 6d96cd1e-98f4-4784-9982-397c5df19bd9 which can be used as unique global reference for pyback in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PY#RATION
According to Securonix, this malware exhibits remote access trojan (RAT) behavior, allowing for control of and persistence on the affected host. As with other RATs, PY#RATION possesses a whole host of features and capabilities, including data exfiltration and keylogging. What makes this malware particularly unique is its utilization of websockets for both command and control (C2) communication and exfiltration as well as how it evades detection from antivirus and network security measures.
Internal MISP references
UUID 1dc471d3-6303-48a1-a17a-b4f29e5ba6a9 which can be used as unique global reference for PY#RATION in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PyVil
PyVil RAT
Internal MISP references
UUID 2cf75f3c-116f-4faf-bd32-ba3a5e2327cf which can be used as unique global reference for PyVil in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Responder
Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Responder.
| Known Synonyms |
|---|
SpiderLabs Responder |
Internal MISP references
UUID 3271b5ca-c044-4ab8-bbfc-0d6e1a6601fc which can be used as unique global reference for Responder in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Saphyra
Internal MISP references
UUID 30a22cdb-9393-460b-86ae-08d97c626155 which can be used as unique global reference for Saphyra in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Serpent
According to Proofpoint, this is a backdoor written in Python, used in attacks against French entities in the construction, real estate, and government industries.
Internal MISP references
UUID 8052319b-f6da-4f53-a630-59245ff65eaf which can be used as unique global reference for Serpent in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/py.serpent - webarchive
- https://labs.k7computing.com/index.php/uncovering-the-serpent/ - webarchive
- https://www.bleepingcomputer.com/news/security/serpent-malware-campaign-abuses-chocolatey-windows-package-manager/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain - webarchive
- https://blogs.vmware.com/security/2022/04/serpent-the-backdoor-that-hides-in-plain-sight.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SpaceCow
Internal MISP references
UUID ff5c0845-6740-45d5-bd34-1cf69c635356 which can be used as unique global reference for SpaceCow in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
stealler
Internal MISP references
UUID 689247a2-4e75-4802-ab94-484fc3d6a18e which can be used as unique global reference for stealler in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Stitch
Internal MISP references
UUID 6239201b-a0bd-4f01-8bbe-79c6fc5fa861 which can be used as unique global reference for Stitch in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
unidentified_002
Internal MISP references
UUID 7e5fe6ca-3323-409a-a5bb-d34f60197b99 which can be used as unique global reference for unidentified_002 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
unidentified_003
Internal MISP references
UUID 43282411-4999-4066-9b99-2e94a17acbd4 which can be used as unique global reference for unidentified_003 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Venomous
Ransomware written in Python and delivered as compiled executable created using PyInstaller.
Internal MISP references
UUID 0bd5aed2-9c74-41a5-9fcf-9379f2cb0e2c which can be used as unique global reference for Venomous in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Venus Stealer
Venus Stealer is a python based Infostealer observed early 2023.
Internal MISP references
UUID 20f72d3c-87b7-4349-ad1b-59d7909c1df4 which can be used as unique global reference for Venus Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
W4SP Stealer
Internal MISP references
UUID c4d46e47-3af8-4117-84ad-1e5699956f2b which can be used as unique global reference for W4SP Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KV
Internal MISP references
UUID 37784130-81fd-40d7-87d4-38e5085513bd which can be used as unique global reference for KV in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FlexiSpy (symbian)
Internal MISP references
UUID 9f85f4fc-1cce-4557-b3d8-b9ef522fafb2 which can be used as unique global reference for FlexiSpy (symbian) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CageyChameleon
CageyChameleon Malware is a VBS-based backdoor which has the capability to enumerate the list of running processes and check for the presence of several antivirus products. CageyChameleon will collect user host information, system current process information, etc. The collected information is sent back to the C2 server, and continue to initiate requests to perform subsequent operations.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CageyChameleon.
| Known Synonyms |
|---|
Cabbage RAT |
Internal MISP references
UUID ea71b7c1-79eb-4e9c-a670-ea75d80132f4 which can be used as unique global reference for CageyChameleon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/vbs.cageychameleon - webarchive
- https://threatbook.cn/ppt/The%2520Nightmare%2520of%2520Global%2520Cryptocurrency%2520Companies%2520-%2520Demystifying%2520the%2520%25E2%2580%259CDangerousPassword%25E2%2580%259D%2520of%2520the%2520APT%2520Organization.pdf - webarchive
- https://atlas-cybersecurity.com/cyber-threats/cryptocore-cryptocurrency-exchanges-under-attack/ - webarchive
- https://www.clearskysec.com/cryptocore-group/ - webarchive
- https://www.clearskysec.com/wp-content/uploads/2021/05/CryptoCore-Lazarus-Clearsky.pdf - webarchive
- https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwjCk7uOzMP-AhXOYMAKHYtLCKkQFnoECBIQAQ&url=https%3A%2F%2Fi.blackhat.com%2FUSA-22%2FThursday%2FUS-22-Wikoff-Talent-Need-Not-Apply.pdf&usg=AOvVaw0deqd7ozZyRTfSBOBmlbiG - webarchive
- https://sansorg.egnyte.com/dl/3P3HxFiNgL - webarchive
- https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/ta444-apt-startup-aimed-at-your-funds - webarchive
- https://www.proofpoint.com/us/daily-ruleset-update-summary-20190314 - webarchive
- https://vb2020.vblocalhost.com/conference/presentations/unveiling-the-cryptomimic/ - webarchive
- https://mp.weixin.qq.com/s/nnLqUBPX8xZ3hCr5u-iSjQ - webarchive
- https://blogs.jpcert.or.jp/ja/2023/05/dangerouspassword.html - webarchive
- https://cyberstruggle.org/delta/LeeryTurtleThreatReport_05_20.pdf - webarchive
- https://www.clearskysec.com/wp-content/uploads/2020/06/CryptoCore_Group.pdf - webarchive
- https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/offshore%20APT%20organization/DangerousPassword/2020-04-02/Analysis.md - webarchive
- https://blogs.jpcert.or.jp/en/2019/07/spear-phishing-against-cryptocurrency-businesses.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
forbiks
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular forbiks.
| Known Synonyms |
|---|
Forbix |
Internal MISP references
UUID 2ad12163-3a8e-4ece-969e-ac616303ebe1 which can be used as unique global reference for forbiks in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GGLdr
Internal MISP references
UUID 8ca31b9b-6e78-4dcc-9d14-dfd97d44994e which can be used as unique global reference for GGLdr in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GlowSpark
Internal MISP references
UUID ab6f8b6d-f0a0-4d2c-a81b-2dcb146914ea which can be used as unique global reference for GlowSpark in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Grinju Downloader
Internal MISP references
UUID f0a64323-62a6-4c5a-bb3d-44bd3b11507f which can be used as unique global reference for Grinju Downloader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HALFBAKED
The HALFBAKED malware family consists of multiple components designed to establish and maintain a foothold in victim networks, with the ultimate goal of gaining access to sensitive financial information. HALFBAKED listens for the following commands from the C2 server:
info: Sends victim machine information (OS, Processor, BIOS and running processes) using WMI queries processList: Send list of process running screenshot: Takes screen shot of victim machine (using 58d2a83f777688.78384945.ps1) runvbs: Executes a VB script runexe: Executes EXE file runps1: Executes PowerShell script delete: Delete the specified file update: Update the specified file
Internal MISP references
UUID 095c995c-c916-488e-944d-a3f4b9842926 which can be used as unique global reference for HALFBAKED in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/vbs.halfbaked - webarchive
- https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf - webarchive
- https://attack.mitre.org/software/S0151/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Iloveyou
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Iloveyou.
| Known Synonyms |
|---|
Love Bug |
LoveLetter |
Internal MISP references
UUID bba3f3c9-f65f-45f1-a482-7209b9fa5adb which can be used as unique global reference for Iloveyou in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Janicab (VBScript)
Internal MISP references
UUID b3cb5859-2049-43d3-aed2-73db45ed0112 which can be used as unique global reference for Janicab (VBScript) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
lampion
Malware is delivered by emails, containing links to ZIP files or ZIP attachments. The ZIP contains a VBscript that, when executed, downloads additional files from AWS S3, Google Drive or other cloud hosting services. The downloaded files are encrypted .exe and .dll files. The malware targets banking clients in Portugal.
Internal MISP references
UUID 97f89048-2a57-48d5-9272-0d1061a14eca which can be used as unique global reference for lampion in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/vbs.lampion - webarchive
- https://seguranca-informatica.pt/lampion-trojan-disseminated-in-portugal-using-covid-19-template/ - webarchive
- https://unit42.paloaltonetworks.com/single-bit-trap-flag-intel-cpu/ - webarchive
- https://research.checkpoint.com/wp-content/uploads/2019/12/Threat_Intelligence_News_2019-12-30.pdf - webarchive
- https://www.layer8.pt/PDFs/New%20Lampion%20banking%20Trojan%20variant%20in%20the%20wild.pdf - webarchive
- https://cofense.com/blog/lampion-trojan-utilizes-new-delivery-through-cloud-based-sharing - webarchive
- https://seguranca-informatica.pt/new-release-of-lampion-trojan-spreads-in-portugal-with-some-improvements-on-the-vbs-downloader - webarchive
- https://seguranca-informatica.pt/trojan-lampion-is-back-after-3-months/ - webarchive
- https://seguranca-informatica.pt/targeting-portugal-a-new-trojan-lampion-has-spread-using-template-emails-from-the-portuguese-government-finance-tax/ - webarchive
- https://securityaffairs.co/wordpress/128975/malware/hidden-c2-lampion-trojan-release-212.html - webarchive
- https://seguranca-informatica.pt/the-hidden-c2-lampion-trojan-release-212-is-on-the-rise-and-using-a-c2-server-for-two-years - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LitterDrifter
Internal MISP references
UUID 31f64da5-e20b-4aa8-acf6-029bca10a7e6 which can be used as unique global reference for LitterDrifter in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
lockscreen
Internal MISP references
UUID a583a2db-616e-48e5-b12b-088a378c2307 which can be used as unique global reference for lockscreen in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MOUSEISLAND
MOUSEISLAND is a Microsoft Word macro downloader used as the first infection stage and is delivered inside a password-protected zip attached to a phishing email. Based on Fireeye intrusion data from responding to ICEDID related incidents, the secondary payload delivered by MOUSEISLAND has been PHOTOLOADER, which acts as an intermediary downloader to install ICEDID.
Internal MISP references
UUID e9afcd80-c1c6-4194-af32-133fe31e835f which can be used as unique global reference for MOUSEISLAND in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NodeJS Ransomware
Downloads NodeJS when deployed.
Internal MISP references
UUID 93c87125-7150-4bc6-a0f9-b46ff8de1839 which can be used as unique global reference for NodeJS Ransomware in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RandomQuery
According to SentinelLabs, this is a VisualBasic-based malware that gathers system and file information and exfiltrates the data using InternetExplorer.Application or Microsoft.XMLHTTP objects.
Internal MISP references
UUID 76fd3fcb-151d-4880-b97e-ea890c337aad which can be used as unique global reference for RandomQuery in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Starfighter (VBScript)
According to the author, this is a JavaScript based Empire launcher that runs with its own embedded powershell host to not be dependent on local powershell availability.
Internal MISP references
UUID e24b852c-3ede-42ac-8d04-68ab96bf53a0 which can be used as unique global reference for Starfighter (VBScript) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
STARWHALE
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular STARWHALE.
| Known Synonyms |
|---|
Canopy |
SloughRAT |
Internal MISP references
UUID 27c70673-d40e-46a2-8f47-13cc5738ff36 which can be used as unique global reference for STARWHALE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/vbs.starwhale - webarchive
- https://www.mandiant.com/resources/telegram-malware-iranian-espionage - webarchive
- https://blog.talosintelligence.com/iranian-supergroup-muddywater/ - webarchive
- https://thehackernews.com/2022/03/iranian-hackers-targeting-turkey-and.html - webarchive
- https://blog.talosintelligence.com/2022/03/iranian-supergroup-muddywater.html - webarchive
- https://www.techrepublic.com/article/muddywater-targets-middle-eastern-and-asian-countries-in-phishing-attacks/ - webarchive
- https://www.govinfosecurity.com/iranian-apt-new-methods-to-target-turkey-arabian-peninsula-a-18706 - webarchive
- https://rootdaemon.com/2022/03/10/iranian-hackers-targeting-turkey-and-arabian-peninsula-in-new-malware-campaign/ - webarchive
- https://thehackernews.com/2022/02/irans-muddywater-hacker-group-using-new.html - webarchive
- https://www.inforisktoday.com/muddywater-targets-critical-infrastructure-in-asia-europe-a-18611 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified VBS 001
Internal MISP references
UUID ba354d45-bc41-40cd-93b2-26139db296bd which can be used as unique global reference for Unidentified VBS 001 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 002 (Operation Kremlin)
Unnamed malware. Delivered as remote template that drops a VBS file, which uses LOLBINs to crawl the disk and exfiltrate data zipped up via winrar.
Internal MISP references
UUID d8e8d701-ebe4-44ab-8c5b-70a11246ddf1 which can be used as unique global reference for Unidentified 002 (Operation Kremlin) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 003 (Gamaredon Downloader)
Internal MISP references
UUID d5955c4b-f507-4b3f-8d57-080849aba831 which can be used as unique global reference for Unidentified 003 (Gamaredon Downloader) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/vbs.unidentified_003 - webarchive
- https://www.threatstop.com/blog/gamaredon-group-understanding-the-russian-apt - webarchive
- https://threatmon.io/beyond-bullets-and-bombs-an-examination-of-armageddon-groups-cyber-warfare-against-ukraine/ - webarchive
- https://aaqeel01.wordpress.com/2021/01/18/docx-files-template-injection/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified VBS 004 (RAT)
Lab52 describes this as a light first-stage RAT used by MuddyWater and observed samples between at least November 2020 and January 2022.
Internal MISP references
UUID 84c6b483-ba17-4a22-809d-dc37d9ce1822 which can be used as unique global reference for Unidentified VBS 004 (RAT) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified VBS 005 (Telegram Loader)
Internal MISP references
UUID 8eb8ebbc-c5b1-47d8-816a-4e21dee145c3 which can be used as unique global reference for Unidentified VBS 005 (Telegram Loader) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified VBS 006 (Telegram Loader)
Internal MISP references
UUID a6bd28db-c1a3-44b1-8bc3-7882e2896d67 which can be used as unique global reference for Unidentified VBS 006 (Telegram Loader) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/vbs.unidentified_006 - webarchive
- https://blogs.blackberry.com/en/2023/01/gamaredon-abuses-telegram-to-target-ukrainian-organizations - webarchive
- https://threatmon.io/beyond-bullets-and-bombs-an-examination-of-armageddon-groups-cyber-warfare-against-ukraine/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
VBREVSHELL
According to Mandiant, VBREVSHELL is a VBA macro that spawns a reverse shell relying exclusively on Windows API calls.
Internal MISP references
UUID 991179a0-efd5-450a-a1ce-78d1109bb50b which can be used as unique global reference for VBREVSHELL in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WasabiSeed
Internal MISP references
UUID 0c6568da-7017-4d9f-b077-0c486b3f9057 which can be used as unique global reference for WasabiSeed in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WhiteShadow
Internal MISP references
UUID dc857b7d-f228-4aa5-9e89-f7e17bb7ea8c which can be used as unique global reference for WhiteShadow in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
000Stealer
Internal MISP references
UUID 24e598cf-4c55-468a-ac1d-cc4f89104943 which can be used as unique global reference for 000Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
3CX Backdoor (Windows)
According to CrowdStrike, this backdoor was discovered being embedded in a legitimate, signed version of 3CXDesktopApp, and thus constitutes a supply chain attack.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular 3CX Backdoor (Windows).
| Known Synonyms |
|---|
SUDDENICON |
Internal MISP references
UUID b6a00e25-9d8d-4ebc-b9fc-7fd41797303b which can be used as unique global reference for 3CX Backdoor (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.3cx_backdoor - webarchive
- https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/ - webarchive
- https://blog.cyble.com/2023/03/31/a-comprehensive-analysis-of-the-3cx-attack - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Lazarus-campaigns-and-backdoors-in-2022-2023.pdf - webarchive
- https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack - webarchive
- https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/ - webarchive
- https://www.rapid7.com/blog/post/2023/03/30/backdoored-3cxdesktopapp-installer-used-in-active-threat-campaign/ - webarchive
- https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/ - webarchive
- https://securelist.com/it-threat-evolution-q2-2023/110355/ - webarchive
- https://www.fortinet.com/blog/threat-research/3cx-desktop-app-compromised - webarchive
- https://www.elastic.co/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack - webarchive
- https://www.cadosecurity.com/forensic-triage-of-a-windows-system-running-the-backdoored-3cx-desktop-app/ - webarchive
- https://www.trendmicro.com/en_us/research/23/c/information-on-attacks-involving-3cx-desktop-app.html - webarchive
- https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/ - webarchive
- https://blogs.vmware.com/security/2023/03/investigating-3cx-desktop-application-attacks-what-you-need-to-know.html - webarchive
- https://github.com/dodo-sec/Malware-Analysis/blob/main/SmoothOperator/SmoothOperator.md - webarchive
- https://www.group-ib.com/blog/3cx-supply-chain-attack/?utm_source=twitter&utm_campaign=3cx-blog&utm_medium=social - webarchive
- https://blogs.blackberry.com/en/2023/03/initial-implants-and-network-analysis-suggest-the-3cx-supply-chain-operation-goes-back-to-fall-2022 - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/3cx-supply-chain-attack - webarchive
- https://www.youtube.com/watch?v=fTX-vgSEfjk - webarchive
- https://www.zscaler.com/security-research/3CX-supply-chain-attack-analysis-march-2023 - webarchive
- https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats - webarchive
- https://www.splunk.com/en_us/blog/security/splunk-insights-investigating-the-3cxdesktopapp-supply-chain-compromise.html - webarchive
- https://www.reversinglabs.com/blog/red-flags-fly-over-supply-chain-compromised-3cx-update - webarchive
- https://research.openanalysis.net/3cx/northkorea/apt/triage/2023/03/30/3cx-malware.html#Functionality - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
404 Keylogger
Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victim’s sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular 404 Keylogger.
| Known Synonyms |
|---|
404KeyLogger |
Snake Keylogger |
Internal MISP references
UUID 6b87fada-86b3-449d-826d-a89858121b68 which can be used as unique global reference for 404 Keylogger in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger - webarchive
- https://threatresearch.ext.hp.com/pdf-malware-is-not-yet-dead/ - webarchive
- https://blogs.blackberry.com/en/2022/06/threat-thursday-unique-delivery-method-for-snake-keylogger - webarchive
- https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ - webarchive
- https://cert.gov.ua/article/955924 - webarchive
- https://habr.com/ru/company/group-ib/blog/477198/ - webarchive
- https://www.ciphertechsolutions.com/roboski-global-recovery-automation/ - webarchive
- https://x-junior.github.io/malware%20analysis/2022/06/24/Snakekeylogger.html - webarchive
- https://insights.infoblox.com/threat-intelligence-reports/threat-intelligence--102 - webarchive
- https://twitter.com/James_inthe_box/status/1401921257109561353 - webarchive
- https://www.fortinet.com/blog/threat-research/deep-dive-into-a-fresh-variant-of-snake-keylogger-malware - webarchive
- https://securityintelligence.com/posts/roboski-global-recovery-automation/ - webarchive
- https://malwarebookreports.com/cross-platform-java-dropper-snake-and-xloader-mac-version/ - webarchive
- https://www.malwarebytes.com/blog/threat-intelligence/2022/20221121-threat-intel-report-final.pdf - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-snake-infostealer-malware - webarchive
- https://www.youtube.com/watch?v=vzyJp2w8bPE - webarchive
- https://insights.infoblox.com/threat-intelligence-reports/threat-intelligence--89 - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://www.bleepingcomputer.com/news/security/pdf-smuggles-microsoft-word-doc-to-drop-snake-keylogger-malware/ - webarchive
- https://threatresearch.ext.hp.com/the-many-skins-of-snake-keylogger/ - webarchive
- https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ - webarchive
- https://blog.netlab.360.com/purecrypter - webarchive
- https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
4h_rat
Internal MISP references
UUID 823f4eb9-ad37-4fab-8e69-3bdae47a0028 which can be used as unique global reference for 4h_rat in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.4h_rat - webarchive
- https://cocomelonc.github.io/tutorial/2021/09/04/simple-malware-av-evasion.html - webarchive
- https://github.com/securitykitten/malware_references/blob/master/crowdstrike-intelligence-report-putter-panda.original.pdf - webarchive
- https://cocomelonc.github.io/malware/2023/09/25/malware-trick-36.html - webarchive
- https://attack.mitre.org/groups/G0024 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
5.t Downloader
Downloader used in suspected APT attack against Vietnam.
Internal MISP references
UUID 685c9c30-aa9f-43ee-a262-43c17c350049 which can be used as unique global reference for 5.t Downloader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.5t_downloader - webarchive
- https://kienmanowar.wordpress.com/2022/01/26/quicknote-analysis-of-malware-suspected-to-be-an-apt-attack-targeting-vietnam/ - webarchive
- https://research.checkpoint.com/2023/pandas-with-a-soul-chinese-espionage-attacks-against-southeast-asian-government-entities/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
7ev3n
The NJCCIC describes 7ev3n as a ransomware "that targets the Windows OS and spreads via spam emails containing malicious attachments, as well as file sharing networks. It installs multiple files in the LocalAppData folder, each of which controls different functions including disabling bootup recovery options, deleting the ransomware installation file, encrypting data, and gaining administrator privileges. This variant also adds registry keys that disables various Windows function keys such as F1, F3, F4, F10, Alt, Num Lock, Ctrl, Enter, Escape, Shift, and Tab. Files encrypted by 7ev3n are labeled with a .R5A extension. It also locks victims out of Windows recovery options making it challenging to repair the damage done by 7ev3n."
Internal MISP references
UUID ac2608e9-7851-409f-b842-e265b877a53c which can be used as unique global reference for 7ev3n in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
8Base
The 8Base ransomware group has remained relatively unknown despite the massive spike in activity in Summer of 2023. The group utilizes encryption paired with “name-and-shame” techniques to compel their victims to pay their ransoms. 8Base has an opportunistic pattern of compromise with recent victims spanning across varied industries. Despite the high amount of compromises, the information regarding identities, methodology, and underlying motivation behind these incidents still remains a mystery. Samples of their ransomware show they are using customized Phobos with SmokeLoader.
Internal MISP references
UUID 7ee60640-29cd-4127-b805-1f2b753e9e15 which can be used as unique global reference for 8Base in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.8base - webarchive
- https://socradar.io/dark-web-profile-8base-ransomware/ - webarchive
- https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/ - webarchive
- https://blog.talosintelligence.com/deep-dive-into-phobos-ransomware/ - webarchive
- https://blogs.vmware.com/security/2023/06/8base-ransomware-a-heavy-hitting-player.html - webarchive
- https://twitter.com/rivitna2/status/1674718854549831681 - webarchive
- https://www.logpoint.com/en/blog/emerging-threat/defending-against-8base/ - webarchive
- https://krebsonsecurity.com/2023/09/whos-behind-the-8base-ransomware-website/ - webarchive
- https://www.acronis.com/en-sg/cyber-protection-center/posts/8base-ransomware-stays-unseen-for-a-year/ - webarchive
- https://blog.bushidotoken.net/2023/05/unmasking-ransomware-using-stylometric.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
8.t Dropper
8T_Dropper has been used by Chinese threat actor TA428 in order to install Cotx RAT onto victim's machines during Operation LagTime IT. According to Proofpoint the attack was developed against a number of government agencies in East Asia overseeing government information technology, domestic affairs, foreign affairs, economic development, and political processes. The dropper was delivered through an RTF document exploiting CVE-2018-0798.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular 8.t Dropper.
| Known Synonyms |
|---|
8t_dropper |
RoyalRoad |
Internal MISP references
UUID df755d5f-db11-417d-8fed-b7abdc826590 which can be used as unique global reference for 8.t Dropper in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.8t_dropper - webarchive
- https://medium.com/@Ilandu/portdoor-malware-afc9d0796cba - webarchive
- https://vb2020.vblocalhost.com/uploads/VB2020-20.pdf - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0922.pdf - webarchive
- https://tradahacking.vn/l%C3%A0-1937cn-hay-oceanlotus-hay-lazarus-6ca15fe1b241 - webarchive
- https://research.checkpoint.com/2020/vicious-panda-the-covid-campaign - webarchive
- https://www.sentinelone.com/labs/targets-of-interest-russian-organizations-increasingly-under-attack-by-chinese-apts/ - webarchive
- https://research.checkpoint.com/2020/vicious-panda-the-covid-campaign/ - webarchive
- https://community.riskiq.com/article/5fe2da7f - webarchive
- https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf - webarchive
- https://nao-sec.org/2021/01/royal-road-redive.html - webarchive
- https://malgamy.github.io/malware-analysis/The-Approach-of-TA413-for-Tibetan-Targets/#third-stage - webarchive
- https://research.checkpoint.com/2019/rancor-the-year-of-the-phish/ - webarchive
- https://medium.com/@Sebdraven/malicious-document-targets-vietnamese-officials-acb3b9d8b80a - webarchive
- https://community.riskiq.com/article/56fa1b2f - webarchive
- https://research.checkpoint.com/2023/pandas-with-a-soul-chinese-espionage-attacks-against-southeast-asian-government-entities/ - webarchive
- https://tradahacking.vn/another-malicious-document-with-cve-2017-11882-839e9c0bbf2f - webarchive
- https://www.accenture.com/_acnmedia/pdf-96/accenture-security-mudcarp.pdf - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-attribution-object-using-rtf-object-dimensions-track-apt-phishing-weaponizers/ - webarchive
- https://medium.com/@Sebdraven/new-version-of-chinoxy-backdoor-using-covid19-document-lure-83fa294c0746 - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://www.proofpoint.com/us/threat-insight/post/chinese-apt-operation-lagtime-it-targets-government-information-technology - webarchive
- https://blog.malwarelab.pl/posts/on_the_royal_road/ - webarchive
- https://medium.com/@Sebdraven/malicious-document-targets-vietnamese-officials-acb3b9d8b80a? - webarchive
- https://securelist.com/cycldek-bridging-the-air-gap/97157/ - webarchive
- https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
9002 RAT
9002 RAT is a Remote Access Tool typically observed to be used by an APT to control a victim's machine. It has been spread over via zero day exploits (e.g. targeting Internet Explorer) as well as via email attachments. The infection chain starts by opening a .LNK (an OLE packager shell object) that executes a Powershell command.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular 9002 RAT.
| Known Synonyms |
|---|
HOMEUNIX |
Hydraq |
McRAT |
Internal MISP references
UUID bab647d7-c9d6-4697-8fd2-1295c7429e1f which can be used as unique global reference for 9002 RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.9002 - webarchive
- https://app.box.com/s/z1uanuv1vn3vw5iket1r6bqrmlra0gpn - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/supply-chain-attack-operation-red-signature-targets-south-korean-organizations/ - webarchive
- http://researchcenter.paloaltonetworks.com/2016/07/unit-42-attack-delivers-9002-trojan-through-google-drive/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-express - webarchive
- https://www.fireeye.com/blog/threat-research/2013/05/ready-for-summer-the-sunshop-campaign.html - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-keystone - webarchive
- https://www.crysys.hu/publications/files/tedi/ukatemicrysys_territorialdispute.pdf - webarchive
- https://www.infopoint-security.de/medien/the-elderwood-project.pdf - webarchive
- https://researchcenter.paloaltonetworks.com/2015/09/chinese-actors-use-3102-malware-in-attacks-on-us-government-and-eu-media/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/operation-rat-cook-chinese-apt-actors-use-fake-game-thrones-leaks-lures - webarchive
- https://attack.mitre.org/groups/G0001/ - webarchive
- https://www.fireeye.com/blog/threat-research/2013/11/operation-ephemeral-hydra-ie-zero-day-linked-to-deputydog-uses-diskless-method.html - webarchive
- https://www.fireeye.com/blog/threat-research/2013/02/lady-boyle-comes-to-town-with-a-new-exploit.html - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-union - webarchive
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/hidden_lynx.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-firestone - webarchive
- https://www-west.symantec.com/content/dam/symantec/docs/security-center/white-papers/elderwood-project-12-en.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/webworm-espionage-rats - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Abaddon
Uses Discord as C&C, has ransomware feature.
Internal MISP references
UUID 97be2d1a-878d-46bd-8ee7-d8798ec61ef1 which can be used as unique global reference for Abaddon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AbaddonPOS
MajorGeeks describes this malware as trying to locate credit card data by reading the memory of all processes except itself by first blacklisting its own PID using the GetCurrentProcessId API. Once that data is discovered, it sends this data back to a command and control server using a custom binary protocol instead of HTTP.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular AbaddonPOS.
| Known Synonyms |
|---|
PinkKite |
TinyPOS |
Internal MISP references
UUID a492a3e0-13cb-4b7d-93c1-027e7e69b44d which can be used as unique global reference for AbaddonPOS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.abaddon_pos - webarchive
- https://www.carbonblack.com/2020/05/21/tau-technical-report-new-attack-combines-tinypos-with-living-off-the-land-techniques-for-scraping-credit-card-data/ - webarchive
- https://medium.com/s2wlab/operation-synctrek-e5013df8d167 - webarchive
- https://www.proofpoint.com/us/threat-insight/post/AbaddonPOS-A-New-Point-Of-Sale-Threat-Linked-To-Vawtrak - webarchive
- https://threatpost.com/new-pos-malware-pinkkite-takes-flight/130428/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/abaddonpos-now-targeting-specific-pos-software - webarchive
- https://norfolkinfosec.com/tinypos-and-prolocker-an-odd-relationship/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
abantes
Internal MISP references
UUID 27b54000-26b5-405f-9296-9fbc9217a8c9 which can be used as unique global reference for abantes in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Abbath Banker
Internal MISP references
UUID e46262cd-961f-4c7d-8976-0d35a066ab83 which can be used as unique global reference for Abbath Banker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AbSent Loader
Internal MISP references
UUID 532d67fc-0c93-4345-80c4-0c1657056d5e which can be used as unique global reference for AbSent Loader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ACBackdoor (Windows)
A Linux backdoor that was apparently ported to Windows. This entry represents the Windows version. It appears the Linux version was written first and the Windows version was ported later, without full functionality. The Linux version offers persistence as well as some process manipulation techniques, though both versions apparently offer the ability to access the command line and execute programs as well as self-update.
Internal MISP references
UUID 9aa1a516-bd88-4038-a37d-cf66c607e68c which can be used as unique global reference for ACBackdoor (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ACEHASH
ACEHASH is described by FireEye as combined credential harvester that consists of two components, a loader and encrypted/compressed payload. To execute, a password is necessary (e.g. 9839D7F1A0) and the individual modules are addressed with parameters (-m, -w, -h).
Internal MISP references
UUID 51f8c94a-572f-450b-a52f-d3da96302d6b which can be used as unique global reference for ACEHASH in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.acehash - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-atlas - webarchive
- https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/ - webarchive
- https://www.fireeye.com/blog/threat-research/2019/08/game-over-detecting-and-stopping-an-apt41-operation.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AcidBox
Unit42 found AcidBox in February 2019 and describes it as a malware family used by an unknown threat actor in 2017 against Russian entities, as stated by Dr.Web. It reused and improved an exploit for VirtualBox previously used by Turla. The malware itself is a modular toolkit, featuring both usermode and kernelmode components and anti-analysis techniques such as stack-based string obfuscation or dynamic XOR-encoded API usage.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular AcidBox.
| Known Synonyms |
|---|
MagicScroll |
Internal MISP references
UUID 4ccc1ec4-6008-4788-95d9-248749f5a7fe which can be used as unique global reference for AcidBox in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.acidbox - webarchive
- https://blog.talosintelligence.com/2020/08/attribution-puzzle.html - webarchive
- https://unit42.paloaltonetworks.com/acidbox-rare-malware/ - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://www.epicturla.com/blog/acidbox-clustering - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AcridRain
AcridRain is a password stealer written in C/C++. This malware can steal credentials, cookies, credit cards from multiple browsers. It can also dump Telegram and Steam sessions, rob Filezilla recent connections, and more.
Internal MISP references
UUID ffc368a5-2cd0-44ca-869b-223fdb462c41 which can be used as unique global reference for AcridRain in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Acronym
Internal MISP references
UUID bee73d0f-8ff3-44ba-91dc-d883884c754e which can be used as unique global reference for Acronym in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Action RAT
Internal MISP references
UUID 57df4c54-3fff-49dd-9657-19265a66f5de which can be used as unique global reference for Action RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.action_rat - webarchive
- https://www.seqrite.com/blog/sidecopys-multi-platform-onslaught-leveraging-winrar-zero-day-and-linux-variant-of-ares-rat/ - webarchive
- https://threatmon.io/unraveling-the-complex-infection-chain-analysis-of-the-sidecopy-apts-attack-report/ - webarchive
- https://www.seqrite.com/blog/double-action-triple-infection-and-a-new-rat-sidecopys-persistent-targeting-of-indian-defence - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Adamantium Thief
Internal MISP references
UUID 28e01527-dbb5-4331-b5bf-5658ebf58297 which can be used as unique global reference for Adamantium Thief in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AdamLocker
Adam Locker (detected as RANSOM_ADAMLOCK.A) is a ransomware that encrypts targeted files on a victim’s system but offers them a free decryption key which can be accessed through Adf.ly, a URL shortening and advertising service.
Internal MISP references
UUID 1ed36f9a-ae00-4d16-bbf7-e97217385fb1 which can be used as unique global reference for AdamLocker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Adhubllka
Some Ransomware distributed by TA547 in Australia
Internal MISP references
UUID ebf31d45-922a-42ad-b326-8a72ba6dead7 which can be used as unique global reference for Adhubllka in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AdKoob
Internal MISP references
UUID ace3cb99-3523-44a1-92cc-9f002cf364bf which can be used as unique global reference for AdKoob in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AdvisorsBot
AdvisorsBot is a downloader named after early command and control domains that all contained the word "advisors". The malware is written in C and employs a number of anti-analysis features such as junk code, stack strings and Windows API function hashing.
Internal MISP references
UUID e3f49ec0-614e-4070-a620-5196d45df7b5 which can be used as unique global reference for AdvisorsBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Adylkuzz
Internal MISP references
UUID 3d6c3ed5-804d-4d0b-8a01-68bc54ae8c58 which can be used as unique global reference for Adylkuzz in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AESRT
Ransomware written using .NET.
Internal MISP references
UUID fb0eb7a8-ab32-4371-96b7-2d19f9064ac5 which can be used as unique global reference for AESRT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Afrodita
Internal MISP references
UUID 4c9f8ad2-ace4-42e5-ab70-efdfaad4d1bd which can be used as unique global reference for Afrodita in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.afrodita - webarchive
- https://github.com/albertzsigovits/malware-notes/blob/master/Afrodita.md - webarchive
- https://twitter.com/CPResearch/status/1201957880909484033 - webarchive
- https://dissectingmalwa.re/not-so-nice-after-all-afrodita-ransomware.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AgendaCrypt
Ransomware written in Go.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular AgendaCrypt.
| Known Synonyms |
|---|
Agenda |
Qilin |
Internal MISP references
UUID d430e861-07d3-442a-8444-0bf87e660c26 which can be used as unique global reference for AgendaCrypt in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.agendacrypt - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/h/new-golang-ransomware-agenda-customizes-attacks/IOCs-blog-New%20Golang%20Ransomware%20Agenda%20Customizes%20Attacks.txt - webarchive
- https://www.sentinelone.com/labs/crimeware-trends-ransomware-developers-turn-to-intermittent-encryption-to-evade-detection/ - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v - webarchive
- https://www.trendmicro.com/en_us/research/22/l/agenda-ransomware-uses-rust-to-target-more-vital-industries.html - webarchive
- https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Agent.BTZ
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Agent.BTZ.
| Known Synonyms |
|---|
ComRAT |
Minit |
Sun rootkit |
Internal MISP references
UUID d9cc15f7-0880-4ae4-8df4-87c58338d6b8 which can be used as unique global reference for Agent.BTZ in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_btz - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.ironnet.com/blog/russian-cyber-attack-campaigns-and-actors - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303a - webarchive
- http://blog.threatexpert.com/2008/11/agentbtz-threat-that-hit-pentagon.html - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf - webarchive
- http://www.intezer.com/new-variants-of-agent-btz-comrat-found/ - webarchive
- https://securelist.com/shedding-skin-turlas-fresh-faces/88069/ - webarchive
- http://www.intezer.com/new-variants-of-agent-btz-comrat-found-part-2/ - webarchive
- https://unit42.paloaltonetworks.com/ironnetinjector/ - webarchive
- https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf - webarchive
- https://cdn.muckrock.com/foia_files/2021/02/16/21R019_RESPONSE.pdf - webarchive
- https://docs.broadcom.com/doc/waterbug-attack-group - webarchive
- https://blog.gdata.de/2015/01/23779-weiterentwicklung-anspruchsvoller-spyware-von-agent-btz-zu-comrat - webarchive
- https://ryancor.medium.com/deobfuscating-powershell-malware-droppers-b6c34499e41d - webarchive
- https://www.gdatasoftware.com/blog/2014/11/23937-the-uroburos-case-new-sophisticated-rat-identified - webarchive
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a - webarchive
- https://artemonsecurity.com/snake_whitepaper.pdf - webarchive
- https://www.welivesecurity.com/2020/05/26/agentbtz-comratv4-ten-year-journey/ - webarchive
- https://www-west.symantec.com/content/dam/symantec/docs/security-center/white-papers/waterbug-attack-group-16-en.pdf - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-hunter - webarchive
- https://www.crysys.hu/publications/files/tedi/ukatemicrysys_territorialdispute.pdf - webarchive
- https://www.msreverseengineering.com/blog/2020/8/31/an-exhaustively-analyzed-idb-for-comrat-v4 - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://cocomelonc.github.io/tutorial/2022/05/02/malware-pers-3.html - webarchive
- https://securelist.com/blog/virus-watch/58551/agent-btz-a-source-of-inspiration/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Agent Tesla
A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Agent Tesla.
| Known Synonyms |
|---|
AgenTesla |
AgentTesla |
Negasteal |
Internal MISP references
UUID b88e29cf-79d9-42bc-b369-0383b5e04380 which can be used as unique global reference for Agent Tesla in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla - webarchive
- https://www.secureworks.com/research/darktortilla-malware-analysis - webarchive
- https://twitter.com/MsftSecIntel/status/1392219299696152578 - webarchive
- https://asec.ahnlab.com/ko/29133/ - webarchive
- https://news.sophos.com/en-us/2021/02/02/agent-tesla-amps-up-information-stealing-attacks/ - webarchive
- https://blogs.juniper.net/en-us/threat-research/new-pastebin-like-service-used-in-multiple-malware-campaigns - webarchive
- https://youtu.be/hxaeWyK8gMI - webarchive
- https://guillaumeorlando.github.io/AgentTesla - webarchive
- https://isc.sans.edu/forums/diary/AgentTesla+Delivered+via+a+Malicious+PowerPoint+AddIn/26162/ - webarchive
- https://www.telsy.com/download/4832/ - webarchive
- https://mrt4ntr4.github.io/How-Analysing-an-AgentTesla-Could-Lead-To-Attackers-Inbox-1/ - webarchive
- https://lab52.io/blog/a-twisted-malware-infection-chain/ - webarchive
- https://www.bleepingcomputer.com/news/security/russia-ukraine-war-exploited-as-lure-for-malware-distribution/ - webarchive
- https://embee-research.ghost.io/agenttesla-full-analysis-api-hashing/ - webarchive
- https://community.riskiq.com/article/40000d46 - webarchive
- https://www.logpoint.com/en/blog/agentteslas-capabilities-review-detection-strategies/ - webarchive
- https://blog.qualys.com/vulnerabilities-threat-research/2022/02/02/catching-the-rat-called-agent-tesla - webarchive
- https://news.sophos.com/en-us/2021/06/02/amsi-bypasses-remain-tricks-of-the-malware-trade/ - webarchive
- https://mp.weixin.qq.com/s/X0kAIHOSldiFDthb4IsmbQ - webarchive
- https://www.netskope.com/blog/infected-powerpoint-files-using-cloud-services-to-deliver-multiple-malware - webarchive
- https://securelist.com/agent-tesla-malicious-spam-campaign/107478/ - webarchive
- https://malwarebreakdown.com/2018/01/11/malspam-entitled-invoice-attched-for-your-reference-delivers-agent-tesla-keylogger/ - webarchive
- https://www.vmray.com/cyber-security-blog/threat-bulletin-agent-tesla/ - webarchive
- http://blog.nsfocus.net/sweed-611/ - webarchive
- https://team-cymru.com/blog/2022/07/12/an-analysis-of-infrastructure-linked-to-the-hagga-threat-actor - webarchive
- https://www.malwarebytes.com/blog/threat-intelligence/2022/20221121-threat-intel-report-final.pdf - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ - webarchive
- https://www.inde.nz/blog/inside-agenttesla - webarchive
- https://isc.sans.edu/forums/diary/PowerPoint+attachments+Agent+Tesla+and+code+reuse+in+malware/28154/ - webarchive
- https://yoroi.company/research/serverless-infostealer-delivered-in-est-european-countries/ - webarchive
- https://labs.sentinelone.com/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ipfs-a-new-data-frontier-or-a-new-cybercriminal-hideout - webarchive
- https://blogs.blackberry.com/en/2021/06/threat-thursday-agent-tesla-infostealer-malware - webarchive
- https://research.openanalysis.net/dotnet/xorstringsnet/agenttesla/2023/04/16/xorstringsnet.html - webarchive
- https://www.youtube.com/watch?v=Q9_1xNbVQPY - webarchive
- https://blog.netlab.360.com/purecrypter - webarchive
- https://threatresearch.ext.hp.com/wp-content/uploads/2021/03/HP_Bromium_Threat_Insights_Report_Q4_2020.pdf - webarchive
- https://forensicitguy.github.io/agenttesla-vba-certutil-download/ - webarchive
- https://www.seqrite.com/blog/gorgon-apt-targeting-msme-sector-in-india/ - webarchive
- https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/negasteal-uses-hastebin-for-fileless-delivery-of-crysis-ransomware - webarchive
- https://inquest.net/blog/2021/11/02/adults-only-malware-lures - webarchive
- https://cip.gov.ua/en/news/khto-stoyit-za-kiberatakami-na-ukrayinsku-kritichnu-informaciinu-infrastrukturu-statistika-15-22-bereznya - webarchive
- https://blogs.juniper.net/en-us/security/aggah-malware-campaign-expands-to-zendesk-and-github-to-host-its-malware - webarchive
- https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html - webarchive
- https://cocomelonc.github.io/tutorial/2022/04/20/malware-pers-1.html - webarchive
- https://www.proofpoint.com/us/threat-insight/post/new-whiteshadow-downloader-uses-microsoft-sql-retrieve-malware - webarchive
- https://cocomelonc.github.io/tutorial/2021/09/06/simple-malware-av-evasion-2.html - webarchive
- https://www.zscaler.com/blogs/security-research/catching-rats-over-custom-protocols - webarchive
- https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader - webarchive
- https://www.denexus.io/wp-content/uploads/2021/02/Threat-actor-targeting-gas-oil-supply-chains_public.pdf - webarchive
- http://ropgadget.com/posts/originlogger.html - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-galleon - webarchive
- https://blog.fortinet.com/2017/06/28/in-depth-analysis-of-net-malware-javaupdtr - webarchive
- https://researchcenter.paloaltonetworks.com/2017/09/unit42-analyzing-various-layers-agentteslas-packing/ - webarchive
- https://securityintelligence.com/posts/roboski-global-recovery-automation/ - webarchive
- https://unit42.paloaltonetworks.com/originlogger/ - webarchive
- https://www.gdatasoftware.com/blog/global-pandemic-remcos-tesla-netwire - webarchive
- https://youtu.be/QQuRp7Qiuzg - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord? - webarchive
- https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2022/05/nigerian-tesla-419-scammer-gone-malware-distributor-unmasked/ - webarchive
- https://blog.talosintelligence.com/ipfs-abuse/ - webarchive
- https://blog.minerva-labs.com/preventing-agenttesla - webarchive
- https://menshaway.blogspot.com/2021/04/agenttesla-malware.html - webarchive
- https://www.cisecurity.org/insights/blog/top-10-malware-march-2022 - webarchive
- https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ - webarchive
- https://forensicitguy.github.io/a-tale-of-two-dropper-scripts/ - webarchive
- https://cofense.com/strategic-analysis-agent-tesla-expands-targeting-and-networking-capabilities/ - webarchive
- https://community.riskiq.com/article/56e28880 - webarchive
- https://cert.gov.ua/article/861292 - webarchive
- https://isc.sans.edu/diary/27666 - webarchive
- https://news.sophos.com/en-us/2021/04/21/nearly-half-of-malware-now-use-tls-to-conceal-communications/ - webarchive
- https://www.fortinet.com/blog/threat-research/phishing-malware-hijacks-bitcoin-addresses-delivers-new-agent-tesla-variant - webarchive
- https://malwr-analysis.com/2020/04/05/trojan-agent-tesla-malware-analysis/ - webarchive
- https://medium.com/@mariohenkel/decrypting-agenttesla-strings-and-config-b9000b18c996?sk=fcead9538516eeb3daa7b53cb537f6f4 - webarchive
- https://mrt4ntr4.github.io/How-Analysing-an-AgentTesla-Could-Lead-To-Attackers-Inbox-2/ - webarchive
- https://www.zscaler.com/blogs/research/agent-tesla-keylogger-delivered-using-cybersquatting - webarchive
- https://www.sophos.com/en-us/medialibrary/pdfs/technical-papers/sophos-2021-threat-report.pdf - webarchive
- https://isc.sans.edu/diary/rss/27092 - webarchive
- https://www.hornetsecurity.com/en/threat-research/vba-purging-malspam-campaigns/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/dtpacker-net-packer-curious-password-1 - webarchive
- https://threatresearch.ext.hp.com/aggah-campaigns-latest-tactics-victimology-powerpoint-dropper-and-cryptocurrency-stealer/ - webarchive
- https://youtu.be/7AifHTCldZI - webarchive
- https://unit42.paloaltonetworks.com/covid-19-themed-cyber-attacks-target-government-and-medical-organizations/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/coronavirus-threat-landscape-update - webarchive
- https://www.telsy.com/wp-content/uploads/ATR_82599-1.pdf - webarchive
- https://www.bitdefender.com/blog/hotforsecurity/bitdefender-labs-sees-increased-malicious-and-scam-activity-exploiting-the-war-in-ukraine - webarchive
- https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ - webarchive
- http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ - webarchive
- https://cocomelonc.github.io/malware/2022/07/30/malware-av-evasion-8.html - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-345a - webarchive
- https://blog.malwarelab.pl/posts/basfu_aggah/ - webarchive
- https://thisissecurity.stormshield.com/2018/01/12/agent-tesla-campaign/ - webarchive
- https://unit42.paloaltonetworks.com/malicious-compiled-html-help-file-agent-tesla/ - webarchive
- https://yoroi.company/research/office-documents-may-the-xll-technique-change-the-threat-landscape-in-2022/ - webarchive
- https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ - webarchive
- https://guillaumeorlando.github.io/GorgonInfectionchain - webarchive
- https://research.loginsoft.com/threat-research/from-innocence-to-malice-the-onenote-malware-campaign-uncovered/ - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://blog.talosintelligence.com/2019/07/sweed-agent-tesla.html - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-galleon - webarchive
- https://isc.sans.edu/diary/28202 - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla - webarchive
- https://yoroi.company/research/the-wayback-campaign-a-large-scale-operation-hiding-in-plain-sight/ - webarchive
- https://www.fortinet.com/blog/threat-research/fake-purchase-order-used-to-deliver-agent-tesla - webarchive
- https://blog.malwarebytes.com/cybercrime/2020/04/new-agenttesla-variant-steals-wifi-credentials/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/commodity-net-packers-use-embedded-images-hide-payloads - webarchive
- https://www.splunk.com/en_us/blog/security/inside-the-mind-of-a-rat-agent-tesla-detection-and-analysis.html - webarchive
- https://youtu.be/BM38OshcozE - webarchive
- https://blog.apnic.net/2022/03/31/how-to-detect-and-prevent-common-data-exfiltration-attacks/ - webarchive
- https://community.riskiq.com/article/6337984e - webarchive
- https://www.lastline.com/labsblog/evolution-of-excel-4-0-macro-weaponization/ - webarchive
- https://yoroi.company/research/cyber-criminal-espionage-operation-insists-on-italian-manufacturing/ - webarchive
- https://research.checkpoint.com/2023/following-the-scent-of-trickgate-6-year-old-packer-used-to-deploy-the-most-wanted-malware/ - webarchive
- https://www.checkpoint.com/press/2022/march-2022s-most-wanted-malware-easter-phishing-scams-help-emotet-assert-its-dominance/ - webarchive
- https://malwarebookreports.com/agent-teslaggah/ - webarchive
- https://malwatch.github.io/posts/agent-tesla-malware-analysis/ - webarchive
- https://forensicitguy.github.io/agenttesla-rtf-dotnet-tradecraft/ - webarchive
- https://malgamy.github.io/malware-analysis/Deep-Analysis-Agent-Tesla/ - webarchive
- https://www.ciphertechsolutions.com/roboski-global-recovery-automation/ - webarchive
- https://www.lac.co.jp/lacwatch/report/20220307_002893.html - webarchive
- https://isc.sans.edu/diary/27088 - webarchive
- https://www.intrinsec.com/wp-content/uploads/2023/09/TLP-CLEAR-20230912-EN-GuLoader-Information-report.pdf - webarchive
- https://unit42.paloaltonetworks.com/excel-add-ins-malicious-xll-files-agent-tesla/ - webarchive
- https://isc.sans.edu/diary/Infostealer+Malware+with+Double+Extension/29354 - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/another-archive-format-smuggling-malware/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-many-roads-leading-to-agent-tesla/ - webarchive
- https://news.sophos.com/en-us/2020/05/14/raticate/ - webarchive
- https://www.secureworks.com/research/gold-galleon-how-a-nigerian-cyber-crew-plunders-the-shipping-industry - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://isc.sans.edu/diary/rss/28190 - webarchive
- https://blog.cluster25.duskrise.com/2023/10/12/cve-2023-38831-russian-attack - webarchive
- https://blog.morphisec.com/agent-tesla-a-day-in-a-life-of-ir - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AgfSpy
The agfSpy backdoor retrieves configuration and commands from its C&C server. These commands allow the backdoor to execute shell commands and send the execution results back to the server. It also enumerates directories and can list, upload, download, and execute files, among other functions. The capabilities of agfSpy are very similar to dneSpy, except each backdoor uses a different C&C server and various formats in message exchanges.
Internal MISP references
UUID 405fe149-1454-4e8c-a4a3-d56e0c5f62d7 which can be used as unique global reference for AgfSpy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ahtapot
Internal MISP references
UUID 549b23b1-6f53-494e-a302-1d00aa71043b which can be used as unique global reference for Ahtapot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Akira (Windows)
Internal MISP references
UUID 834635f7-fb0f-472c-913e-fb112ae29fdc which can be used as unique global reference for Akira (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.akira - webarchive
- https://www.trellix.com/about/newsroom/stories/research/akira-ransomware/ - webarchive
- https://news.sophos.com/en-us/2023/05/09/akira-ransomware-is-bringin-88-back/ - webarchive
- https://stairwell.com/resources/akira-pulling-on-the-chains-of-ransomware/ - webarchive
- https://cybercx.com.au/blog/akira-ransomware/ - webarchive
- https://decoded.avast.io/threatresearch/decrypted-akira-ransomware/ - webarchive
- https://arcticwolf.com/resources/blog/follow-on-extortion-campaign-targeting-victims-of-akira-and-royal-ransomware/ - webarchive
- https://www.intrinsec.com/akira_ransomware/ - webarchive
- https://twitter.com/MalGamy12/status/1651972583615602694 - webarchive
- https://arcticwolf.com/resources/blog/conti-and-akira-chained-together/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Albaniiutas
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Albaniiutas.
| Known Synonyms |
|---|
BlueTraveller |
Internal MISP references
UUID dff7e10c-41ca-481d-8003-73169803272d which can be used as unique global reference for Albaniiutas in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.albaniiutas - webarchive
- https://blog.group-ib.com/task - webarchive
- https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia - webarchive
- https://insight-jp.nttsecurity.com/post/102gkfp/pandas-new-arsenal-part-2-albaniiutas - webarchive
- https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Aldibot
According to Trend Micro Encyclopia: ALDIBOT first appeared in late August 2012 in relevant forums. Variants can steal passwords from the browser Mozilla Firefox, instant messenger client Pidgin, and the download manager jDownloader. ALDIBOT variants send the gathered information to their command-and-control (C&C) servers.
This malware family can also launch Distributed Denial of Service (DDoS) attacks using different protocols such as HTTP, TCP, UDP, and SYN. It can also perform flood attacks via Slowloris and Layer 7.
This bot can also be set up as a SOCKS proxy to abuse the infected machine as a proxy for any protocols.
This malware family can download and execute arbitrary files, and update itself. Variants can steal information, gathering the infected machine’s hardware identification (HWID), host name, local IP address, and OS version.
This backdoor executes commands from a remote malicious user, effectively compromising the affected system.
Internal MISP references
UUID 43ec8adc-0658-4765-be20-f22679097fab which can be used as unique global reference for Aldibot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Alfonso Stealer
Internal MISP references
UUID a76874b3-12d0-4dec-9813-01819e6b6d49 which can be used as unique global reference for Alfonso Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Project Alice
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Project Alice.
| Known Synonyms |
|---|
AliceATM |
PrAlice |
Internal MISP references
UUID 41bfc8ad-ce2c-4ede-aa54-b3240a5cc8ca which can be used as unique global reference for Project Alice in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.alice_atm - webarchive
- https://documents.trendmicro.com/assets/white_papers/wp-cashing-in-on-atm-malware.pdf - webarchive
- https://www.symantec.com/security-center/writeup/2016-122104-0203-99 - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/alice-lightweight-compact-no-nonsense-atm-malware/ - webarchive
- https://blog.talosintelligence.com/2019/05/10-years-of-virtual-dynamite.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Alina POS
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Alina POS.
| Known Synonyms |
|---|
alina_eagle |
alina_spark |
katrina |
Internal MISP references
UUID 27d90cd6-095a-4c28-a6f2-d1b47eae4f70 which can be used as unique global reference for Alina POS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.alina_pos - webarchive
- https://www.trustwave.com/Resources/SpiderLabs-Blog/Alina--Following-The-Shadow-Part-1/ - webarchive
- https://blog.centurylink.com/alina-point-of-sale-malware-still-lurking-in-dns/ - webarchive
- https://www.trustwave.com/Resources/SpiderLabs-Blog/Alina--Following-The-Shadow-Part-2/ - webarchive
- http://www.xylibox.com/2013/02/alina-34-pos-malware.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/operation-black-atlas-endangers-in-store-card-payments-and-smbs-worldwide-switches-between-blackpos-and-other-tools/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/two-new-pos-malware-affecting-us-smbs/ - webarchive
- https://www.trustwave.com/Resources/SpiderLabs-Blog/Alina-POS-malware--sparks--off-a-new-variant/ - webarchive
- https://www.trustwave.com/Resources/SpiderLabs-Blog/Alina--Casting-a-Shadow-on-POS/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AllaKore
AllaKore is a simple Remote Access Tool written in Delphi, first observed in 2015 but still in early stages of development. It implements the RFB protocol which uses frame buffers and thus is able to send back only the changes of screen frames to the controller, speeding up the transport and visualization control.
Internal MISP references
UUID fb1c6035-42ee-403c-a2ae-a53f7ab2de00 which can be used as unique global reference for AllaKore in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.allakore - webarchive
- https://threatmon.io/the-anatomy-of-a-sidecopy-attack-from-rar-exploits-to-allakore-rat/ - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/591/original/062521_SideCopy_%281%29.pdf - webarchive
- https://www.seqrite.com/blog/sidecopys-multi-platform-onslaught-leveraging-winrar-zero-day-and-linux-variant-of-ares-rat/ - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/591/original/062521_SideCopy_%281%29.pdf?1625657388 - webarchive
- https://sebdraven.medium.com/copy-cat-of-apt-sidewinder-1893059ca68d - webarchive
- https://www.seqrite.com/documents/en/white-papers/Seqrite-WhitePaper-Operation-SideCopy.pdf - webarchive
- https://github.com/Anderson-D/AllaKore - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/592/original/Hashes_IOCs_for_coverage.txt - webarchive
- https://blog.talosintelligence.com/2021/07/sidecopy.html - webarchive
- https://twitter.com/_re_fox/status/1212070711206064131 - webarchive
- https://www.team-cymru.com/post/allakore-d-the-sidecopy-train - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/594/original/Network_IOCs_list_for_coverage.txt?1625657479 - webarchive
- https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Allaple
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Allaple.
| Known Synonyms |
|---|
Starman |
Internal MISP references
UUID 6aabb492-e282-40fb-a840-fe4e643ec094 which can be used as unique global reference for Allaple in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AllcomeClipper
Allcome is classified as a clipper malware. Clippers are threats designed to access information saved in the clipboard (the temporary buffer space where copied data is stored) and substitute it with another. This attack is targeted at users who are active in the cryptocurrency sector mainly.
Internal MISP references
UUID 43ca1245-a5e0-4b44-9892-cf317170c7b8 which can be used as unique global reference for AllcomeClipper in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Almanahe
Internal MISP references
UUID 352f79b1-6862-4164-afa3-a1d787c40ec1 which can be used as unique global reference for Almanahe in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Alma Communicator
Internal MISP references
UUID a0881a0c-e677-495b-b475-290af09bb716 which can be used as unique global reference for Alma Communicator in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.alma_communicator - webarchive
- https://researchcenter.paloaltonetworks.com/2017/11/unit42-oilrig-deploys-alma-communicator-dns-tunneling-trojan/ - webarchive
- https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AlmaLocker
Internal MISP references
UUID b5138914-6c2b-4c8e-b182-d94973fe5a6b which can be used as unique global reference for AlmaLocker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AlmondRAT
AlmondRAT is a .NET Remote Access Trojan deployed by the Bitter APT group. It is capable of collecting system information, modifying and exfiltrating data and allows for remote command execution.
Internal MISP references
UUID c5fa22fd-5869-4a4d-b5fc-c3be18255d2e which can be used as unique global reference for AlmondRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ALPC Local PrivEsc
Internal MISP references
UUID 86517f1a-6e67-47ba-95dd-84b3125ad983 which can be used as unique global reference for ALPC Local PrivEsc in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Alphabet Ransomware
The Alphabet ransomware is a new screenlocker that is currently being developed by a criminal developer. As the malware is not ready it does not affect any user files.
The virus includes a screenlocking function which locks the user’s screen and prohibits any interaction with the computer.
Internal MISP references
UUID 5060756f-8385-465d-a7dd-7bf09a54da92 which can be used as unique global reference for Alphabet Ransomware in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AlphaLocker
A new form of ransomware named AlphaLocker that is built by cybercriminals for cybercriminals. Like all incarnations of Ransomware As A Service (RaaS), the AlphaLocker malware program can be purchased and launched by pretty much anyone who wants to get into the ransomware business. What makes AlphaLocker different from other forms of RaaS is its relatively cheap cost. The ransomware can be purchased for just $65 in bitcoin.
AlphaLocker, also known as Alpha Ransomware, is based on the EDA2 ransomware, an educational project open-sourced on GitHub last year by Turkish researcher Utku Sen. A Russian coder seems to have cloned this repository before it was taken down and used it to create his ransomware, a near-perfect clone of EDA2. The ransomware's author, is said to be paying a great deal of attention to updating the ransomware with new features, so it would always stay ahead of antivirus engines, and evade detection.
AlphaLocker's encryption process starts when the ransomware contacts its C&C server. The server generates a public and a private key via the RSA-2048 algorithm, sending the public key to the user's computer and saving the private key to its server. On the infected computer, the ransomware generates an AES-256 key for each file it encrypts, and then encrypts this key with the public RSA key, and sent to the C&C server.
To decrypt their files, users have to get ahold of the private RSA key which can decrypt the AES-encrypted files found on their computers. Users have to pay around 0.35 Bitcoin (~$450) to get this key, packaged within a nice decrypter.
Internal MISP references
UUID c1b9e8c5-9283-4dbe-af10-45956a446fb7 which can be used as unique global reference for AlphaLocker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AlphaNC
Internal MISP references
UUID 6e94186c-987e-43da-be2d-9b44f254c8b9 which can be used as unique global reference for AlphaNC in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AlphaSeed
Internal MISP references
UUID 966c5a6d-16b8-43b1-acbd-163e904d4a03 which can be used as unique global reference for AlphaSeed in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Alreay
Alreay is a remote access trojan that uses HTTP(S) or TCP for communication with its C&C server.
It uses either RC4 or DES for encryption of its configuration, which is stored in the registry.
It sends detailed information about the victim's environment, like computer name, Windows version, system locale, and network configuration.
It supports almost 25 commands that include operations on the victim’s filesystem, basic process management, file exfiltration, command line execution, and process injection of an executable downloaded from the attacker’s C&C server. As in many RATs from Lazarus arsenal, the commands are indexed by 32-bit integers, starting with values like 0x21A8B293, 0x23FAE29C or 0x91B93485.
It comes either as an EXE or as a DLL with the internal DLL name t_client_dll.dll. It may contain statically linked code from open-source libraries like Mbed TLS or zLib (version 1.0.1).
Alreay RAT was observed in 2016-2017, running on networks of banks operating SWIFT Alliance software.
Internal MISP references
UUID d258de39-e351-47e3-b619-731c87f13d9c which can be used as unique global reference for Alreay in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Alureon
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Alureon.
| Known Synonyms |
|---|
Olmarik |
Pihar |
TDL |
TDSS |
wowlik |
Internal MISP references
UUID ad4e6779-59a6-4ad6-98de-6bd871ddb271 which can be used as unique global reference for Alureon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.alureon - webarchive
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj64_wowlik.vt - webarchive
- http://contagiodump.blogspot.com/2011/02/tdss-tdl-4-alureon-32-bit-and-64-bit.html - webarchive
- https://www.virusbulletin.com/virusbulletin/2016/01/paper-notes-click-fraud-american-story/ - webarchive
- https://www.youtube.com/watch?v=FttiysUZmDw - webarchive
- http://contagiodump.blogspot.com/2010/02/list-of-aurora-hydraq-roarur-files.html - webarchive
- http://contagiodump.blogspot.com/2012/02/purple-haze-bootkit.html - webarchive
- https://archive.f-secure.com/weblog/archives/The_Case_of__TDL3.pdf - webarchive
- https://twitter.com/Sebdraven/status/1496878431719473155 - webarchive
- https://www.johannesbader.ch/2016/01/the-dga-in-alureon-dnschanger/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Amadey
Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.
Internal MISP references
UUID 77f2c81f-be07-475a-8d77-f59b4847f696 which can be used as unique global reference for Amadey in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey - webarchive
- https://blog.minerva-labs.com/underminer-exploit-kit-the-more-you-check-the-more-evasive-you-become - webarchive
- https://blogs.blackberry.com/en/2022/07/smokeloader-malware-used-to-augment-amadey-infostealer - webarchive
- https://www.cybereason.com/blog/the-hole-in-the-bucket-attackers-abuse-bitbucket-to-deliver-an-arsenal-of-malware - webarchive
- https://www.team-cymru.com/post/seychelles-seychelles-on-the-c-2-shore - webarchive
- https://asec.ahnlab.com/en/36634/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/ - webarchive
- https://cocomelonc.github.io/tutorial/2022/04/20/malware-pers-1.html - webarchive
- https://github.com/muha2xmad/Python/blob/bdc7a711d5a775f8ae47b591f20fdd2e1360b77b/Amadey/amadey_string_decryptor.py - webarchive
- https://embee-research.ghost.io/amadey-bot-infrastructure/ - webarchive
- https://research.checkpoint.com/2023/chain-reaction-rokrats-missing-link/ - webarchive
- https://asec.ahnlab.com/en/44504/ - webarchive
- https://embee-research.ghost.io/redline-stealer-basic-static-analysis-and-c2-extraction/ - webarchive
- https://cocomelonc.github.io/tutorial/2021/09/06/simple-malware-av-evasion-2.html - webarchive
- https://www.splunk.com/en_us/blog/security/amadey-threat-analysis-and-detections.html - webarchive
- https://blog.talosintelligence.com/2021/08/raccoon-and-amadey-install-servhelper.html - webarchive
- https://embee-research.ghost.io/shodan-censys-queries/ - webarchive
- https://medium.com/walmartglobaltech/amadey-stealer-plugin-adds-mikrotik-and-outlook-harvesting-518efe724ce4 - webarchive
- https://www.fsec.or.kr/common/proc/fsec/bbs/163/fileDownLoad/2297.do - webarchive
- https://thecyberexpress.com/amadey-botnet-back-via-phishing-sites/ - webarchive
- https://maxkersten.nl/binary-analysis-course/analysis-scripts/ghidra-script-to-decrypt-strings-in-amadey-1-09/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html - webarchive
- https://www.zscaler.com/blogs/security-research/latest-version-amadey-introduces-screen-capturing-and-pushes-remcos-rat - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-amadey-56c8c6ea0ad6 - webarchive
- https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/ - webarchive
- https://nao-sec.org/2019/04/Analyzing-amadey.html - webarchive
- https://twitter.com/ViriBack/status/1062405363457118210 - webarchive
- https://blog.cyble.com/2023/01/25/the-rise-of-amadey-bot-a-growing-concern-for-internet-security/ - webarchive
- https://www.telekom.com/en/blog/group/article/cybersecurity-ta505-s-box-of-chocolate-597672 - webarchive
- https://krabsonsecurity.com/2019/02/13/analyzing-amadey-a-simple-native-malware/ - webarchive
- https://twitter.com/0xffff0800/status/1062948406266642432 - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://www.anquanke.com/post/id/230116 - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://asec.ahnlab.com/en/41450/ - webarchive
- https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot - webarchive
- https://www.bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey - webarchive
- https://embee-research.ghost.io/combining-pivot-points-to-identify-malware-infrastructure-redline-smokeloader-and-cobalt-strike/ - webarchive
- https://isc.sans.edu/diary/27264 - webarchive
- https://medium.com/csis-techblog/gcleaner-garbage-provider-since-2019-2708e7c87a8a - webarchive
- https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey - webarchive
- https://github.com/muha2xmad/Python/blob/bdc7a711d5a775f8ae47b591f20fdd2e1360b77b/Amadey/amadey_config_extractor.ipynb - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AMTsol
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular AMTsol.
| Known Synonyms |
|---|
Adupihan |
Internal MISP references
UUID ce25929c-0358-477c-a85e-f0bdfcc99a54 which can be used as unique global reference for AMTsol in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.amtsol - webarchive
- http://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf - webarchive
- https://blogs.technet.microsoft.com/mmpc/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Anatova Ransomware
Anatova is a ransomware family with the goal of ciphering all the files that it can and then requesting payment from the victim. It will also check if network shares are connected and will encrypt the files on these shares too. The code is also prepared to support modular extensions.
Internal MISP references
UUID 2a28ad28-8ba5-4b8b-9652-bc0cdd37b2c4 which can be used as unique global reference for Anatova Ransomware in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.anatova_ransom - webarchive
- https://www.bleepingcomputer.com/news/security/new-anatova-ransomware-supports-modules-for-extra-functionality/ - webarchive
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/happy-new-year-2019-anatova-is-here/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Anchor
Anchor is a sophisticated backdoor served as a module to a subset of TrickBot installations. Operating since August 2018 it is not delivered to everybody, but contrary is delivered only to high-profile targets. Since its C2 communication scheme is very similar to the one implemented in the early TrickBot, multiple experts believe it could be attributed to the same authors.
Internal MISP references
UUID c38308a1-c89d-4835-b057-744f66ff7ddc which can be used as unique global reference for Anchor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.anchor - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://labs.sentinelone.com/the-deadly-planeswalker-how-the-trickbot-group-united-high-tech-crimeware-apt/ - webarchive
- https://www.netscout.com/blog/asert/dropping-anchor - webarchive
- https://us-cert.cisa.gov/sites/default/files/publications/AA20-302A_Ransomware%20_Activity_Targeting_the_Healthcare_and_Public_Health_Sector.pdf - webarchive
- https://labs.sentinelone.com/deep-dive-into-trickbot-executor-module-mexec-hidden-anchor-bot-nexus-operations/ - webarchive
- https://unit42.paloaltonetworks.com/ryuk-ransomware/ - webarchive
- https://cocomelonc.github.io/tutorial/2021/09/06/simple-malware-av-evasion-2.html - webarchive
- https://www.kryptoslogic.com/blog/2021/07/adjusting-the-anchor/ - webarchive
- https://cybersecurity.att.com/blogs/labs-research/trickbot-bazarloader-in-depth - webarchive
- https://isc.sans.edu/diary/27308 - webarchive
- https://thedfirreport.com/2021/03/08/bazar-drops-the-anchor/ - webarchive
- https://cocomelonc.github.io/tutorial/2022/05/09/malware-pers-4.html - webarchive
- https://www.bleepingcomputer.com/news/security/karakurt-revealed-as-data-extortion-arm-of-conti-cybercrime-syndicate/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://medium.com/walmartglobaltech/anchor-and-lazarus-together-again-24744e516607 - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware - webarchive
- https://technical.nttsecurity.com/post/102fsp2/trickbot-variant-anchor-dns-communicating-over-dns - webarchive
- https://securityintelligence.com/posts/itg08-aka-fin6-partners-with-trickbot-gang-uses-anchor-framework/ - webarchive
- https://hello.global.ntt/zh-cn/insights/blog/trickbot-variant-communicating-over-dns - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AnchorMail
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular AnchorMail.
| Known Synonyms |
|---|
ANCHOR.MAIL |
Delegatz |
Internal MISP references
UUID 7792096a-7623-43a1-9a67-28dce0e4b39e which can be used as unique global reference for AnchorMail in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.anchormail - webarchive
- https://securityintelligence.com/posts/trickbot-group-systematically-attacking-ukraine - webarchive
- https://securityintelligence.com/posts/new-malware-trickbot-anchordns-backdoor-upgrades-anchormail/ - webarchive
- https://blog.google/threat-analysis-group/initial-access-broker-repurposing-techniques-in-targeted-attacks-against-ukraine/ - webarchive
- https://cyware.com/news/trickbots-anchordns-is-now-upgraded-to-anchormail-a21f5490/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AnchorMTea
Recon/Loader malware attributed to Lazarus, disguised as Notepad++ shell extension.
Internal MISP references
UUID 565de3f5-7eb7-43ca-a9d9-b588dfd6a50a which can be used as unique global reference for AnchorMTea in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.anchormtea - webarchive
- https://cybergeeks.tech/a-detailed-analysis-of-lazarus-malware-disguised-as-notepad-shell-extension/ - webarchive
- https://cocomelonc.github.io/tutorial/2021/09/06/simple-malware-av-evasion-2.html - webarchive
- http://report.threatbook.cn/LS.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Andardoor
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Andardoor.
| Known Synonyms |
|---|
ROCKHATCH |
Internal MISP references
UUID 59a2437b-ae63-466a-9172-60d6610c3e19 which can be used as unique global reference for Andardoor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Andromeda
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Andromeda.
| Known Synonyms |
|---|
B106-Gamarue |
B67-SS-Gamarue |
Gamarue |
b66 |
Internal MISP references
UUID 07f46d21-a5d4-4359-8873-18e30950df1a which can be used as unique global reference for Andromeda in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.andromeda - webarchive
- https://securelist.com/tomiris-called-they-want-their-turla-malware-back/109552/ - webarchive
- https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf - webarchive
- https://redcanary.com/blog/intelligence-insights-november-2021/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf - webarchive
- https://www.virusbulletin.com/virusbulletin/2013/08/andromeda-2-7-features - webarchive
- http://resources.infosecinstitute.com/andromeda-bot-analysis-part-two/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/research/cyberattacks-targeting-ukraine-increase.html - webarchive
- https://www.europol.europa.eu/newsroom/news/andromeda-botnet-dismantled-in-international-cyber-operation - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
- http://blog.morphisec.com/andromeda-tactics-analyzed - webarchive
- http://resources.infosecinstitute.com/andromeda-bot-analysis/ - webarchive
- https://www.crowdstrike.com/blog/how-to-remediate-hidden-malware-real-time-response/ - webarchive
- https://www.virusbulletin.com/virusbulletin/2018/02/review-evolution-andromeda-over-years-we-say-goodbye/ - webarchive
- https://www.mandiant.com/resources/blog/turla-galaxy-opportunity - webarchive
- https://resource.redcanary.com/rs/003-YRU-314/images/2021-Threat-Detection-Report.pdf - webarchive
- https://byte-atlas.blogspot.ch/2015/04/kf-andromeda-bruteforcing.html - webarchive
- http://www.0xebfe.net/blog/2013/03/30/fooled-by-andromeda/ - webarchive
- https://eternal-todo.com/blog/yet-another-andromeda-gamarue-analysis - webarchive
- https://blogs.technet.microsoft.com/mmpc/2017/12/04/microsoft-teams-up-with-law-enforcement-and-other-partners-to-disrupt-gamarue-andromeda/ - webarchive
- https://eternal-todo.com/blog/andromeda-gamarue-loves-json - webarchive
- https://www.shadowserver.org/news/has-the-sun-set-on-the-necurs-botnet/ - webarchive
- https://blog.avast.com/andromeda-under-the-microscope - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AndroMut
According to Proofpoint, AndroMut is a new downloader malware written in C++ that Proofpoint researchers began observing in the wild in June 2019. The “Andro” part of the name comes from some of the pieces which bear resemblance to another downloader malware known as Andromeda [1] and “Mut” is based off a mutex that the analyzed sample creates: “mutshellmy777”.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular AndroMut.
| Known Synonyms |
|---|
Gelup |
Internal MISP references
UUID 85673cd4-fb05-4f6d-94ec-71290ae2e422 which can be used as unique global reference for AndroMut in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.andromut - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/using-qiling-framework-to-unpack-ta505-packed-samples/ - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://www.proofpoint.com/us/threat-insight/post/ta505-begins-summer-campaigns-new-pet-malware-downloader-andromut-uae-south - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://outpost24.com/blog/using-qiling-framework-to-unpack-ta505-packed-samples/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/operation-ta505-part3/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://documents.trendmicro.com/assets/Tech-Brief-Latest-Spam-Campaigns-from-TA505-Now-Using-New-Malware-Tools-Gelup-and-FlowerPippi.pdf - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Anel
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Anel.
| Known Synonyms |
|---|
UPPERCUT |
lena |
Internal MISP references
UUID a180afcc-d42d-4600-b70f-af27aaf851b7 which can be used as unique global reference for Anel in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.anel - webarchive
- https://www.macnica.net/file/mpressioncss_ta_report_2019.pdf - webarchive
- https://www.macnica.net/file/mpressioncss_2018-1h-report_mnc_rev3_nopw.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-riverside - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/chessmaster-adds-updated-tools-to-its-arsenal/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference_slides/2019/VB2019-Haruyama.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AnteFrigus
Ransomware that demands payment in Bitcoin.
Internal MISP references
UUID 04788457-5b72-4a66-8f2c-73497919ece2 which can be used as unique global reference for AnteFrigus in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Antilam
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Antilam.
| Known Synonyms |
|---|
Latinus |
Internal MISP references
UUID 02be7f3a-f3bf-447b-b8b4-c78432b82694 which can be used as unique global reference for Antilam in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Anubis (Windows)
According to Microsoft Security Intelligence, Anubis is an information stealer sold on underground forums since June 2020. The name overlaps with the Android banking malware but is unrelated. It contains code forked from Loki PWS.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Anubis (Windows).
| Known Synonyms |
|---|
Anubis Stealer |
Internal MISP references
UUID b19c9f63-a18d-47bb-a9fe-1f9cea21bac0 which can be used as unique global reference for Anubis (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.anubis - webarchive
- https://twitter.com/MsftSecIntel/status/1298752223321546754 - webarchive
- https://cybleinc.com/2021/05/02/mobile-malware-app-anubis-strikes-again-continues-to-lure-users-disguised-as-a-fake-antivirus/ - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://therecord.media/russian-hacker-pavel-sitnikov-arrested-for-sharing-malware-source-code/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Anubis Loader
A loader written in Go, tracked since at least October 2021 by ZeroFox. Originally named Kraken and rebranded to Anubis in February 2022.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Anubis Loader.
| Known Synonyms |
|---|
Kraken |
Pepega |
Internal MISP references
UUID e65ca164-f448-4f8e-a672-3ff7ec37e191 which can be used as unique global reference for Anubis Loader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.anubis_loader - webarchive
- https://www.zerofox.com/blog/meet-kraken-a-new-golang-botnet-in-development/ - webarchive
- https://windowsreport.com/kraken-botnet/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-golang-botnet-empties-windows-users-cryptocurrency-wallets/ - webarchive
- https://medium.com/walmartglobaltech/privateloader-to-anubis-loader-55d066a2653e - webarchive
- https://www.zerofox.com/blog/quick-update-kraken-completes-its-rebrand-to-anubis/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
APERETIF
Internal MISP references
UUID 573eb306-f6c7-4ba9-91a9-881473d335b8 which can be used as unique global reference for APERETIF in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Apocalipto
Internal MISP references
UUID d3e16d46-e436-4757-b962-6fd393056415 which can be used as unique global reference for Apocalipto in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Apocalypse
Internal MISP references
UUID e87d9df4-b464-4458-ae1f-31cea40d5f96 which can be used as unique global reference for Apocalypse in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Apollo
This is an implant usable with the Mythic C2 framework. Apollo is a Windows agent written in C# using the 4.0 .NET Framework designed to be used in SpecterOps training offerings.
Internal MISP references
UUID f995662c-27ad-440b-97ce-f1ecd2b59221 which can be used as unique global reference for Apollo in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Apostle
Malware used by suspected Iranian threat actor Agrius, turned from wiper into ransomware.
Internal MISP references
UUID cb2d3a6f-8ff5-4b08-af95-7377cfe3f7c3 which can be used as unique global reference for Apostle in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.apostle - webarchive
- https://assets.sentinelone.com/sentinellabs/evol-agrius - webarchive
- https://www.sentinelone.com/labs/new-version-of-apostle-ransomware-reemerges-in-targeted-attack-on-higher-education/ - webarchive
- https://www.sentinelone.com/wp-content/uploads/2021/05/SentinelLabs_From-Wiper-to-Ransomware-The-Evolution-of-Agrius.pdf - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/ - webarchive
- https://www.welivesecurity.com/2022/12/07/fantasy-new-agrius-wiper-supply-chain-attack/ - webarchive
- https://cyberpunkleigh.wordpress.com/2021/05/27/apostle-ransomware-analysis/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AppleJeus (Windows)
Internal MISP references
UUID 2b655949-8a17-46e5-9522-519c6d77c45f which can be used as unique global reference for AppleJeus (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.applejeus - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.vkremez.com/2019/10/lets-learn-dissecting-lazarus-windows.html - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa21-048a - webarchive
- https://cocomelonc.github.io/tutorial/2022/05/09/malware-pers-4.html - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048b - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048g - webarchive
- https://blog.sekoia.io/the-dprk-delicate-sound-of-cyber/ - webarchive
- https://twitter.com/VK_Intel/status/1182730637016481793 - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048d - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048f - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048c - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-north-korea-indictment - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048a - webarchive
- https://vblocalhost.com/uploads/VB2021-Park.pdf - webarchive
- https://www.telsy.com/download/5394/?uid=28b0a4577e - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048e - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Appleseed
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Appleseed.
| Known Synonyms |
|---|
JamBog |
Internal MISP references
UUID c7f8e3b8-328d-43c3-9235-9a2f704389b4 which can be used as unique global reference for Appleseed in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.appleseed - webarchive
- https://conference.hitb.org/hitbsecconf2021ams/materials/D2T1%20-%20The%20Phishermen%20-%20Dissecting%20Phishing%20Techniques%20of%20CloudDragon%20APT%20-%20Linda%20Kuo%20&Zih-Cing%20Liao%20.pdf - webarchive
- https://www.boho.or.kr/filedownload.do?attach_file_seq=2652&attach_file_id=EpF2652.pdf - webarchive
- https://vblocalhost.com/presentations/operation-newton-hi-kimsuky-did-an-appleseed-really-fall-on-newtons-head/ - webarchive
- https://i.blackhat.com/asia-21/Friday-Handouts/as-21-Kuo-We-Are-About-To-Land-How-CloudDragon-Turns-A-Nightmare-Into-Reality.pdf - webarchive
- https://asec.ahnlab.com/ko/26705/ - webarchive
- https://asec.ahnlab.com/en/36368/ - webarchive
- https://www.boho.or.kr/filedownload.do?attach_file_seq=2651&attach_file_id=EpF2652.pdf - webarchive
- https://www.youtube.com/watch?v=Dv2_DK3tRgI - webarchive
- https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/ - webarchive
- https://asec.ahnlab.com/en/41015/ - webarchive
- https://www.boho.or.kr/filedownload.do?attach_file_seq=2651&attach_file_id=EpF2651.pdf - webarchive
- https://download.ahnlab.com/global/brochure/Analysis%20Report%20of%20Kimsuky%20Group.pdf - webarchive
- https://asec.ahnlab.com/ko/54804/ - webarchive
- https://asec.ahnlab.com/en/60054/ - webarchive
- https://www.youtube.com/watch?v=rfzmHjZX70s - webarchive
- https://www.telsy.com/download/5654/?uid=4869868efd - webarchive
- https://asec.ahnlab.com/ko/36918/ - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://asec.ahnlab.com/wp-content/uploads/2021/11/Kimsuky-%EA%B7%B8%EB%A3%B9%EC%9D%98-APT-%EA%B3%B5%EA%B2%A9-%EB%B6%84%EC%84%9D-%EB%B3%B4%EA%B3%A0%EC%84%9C-AppleSeed-PebbleDash.pdf - webarchive
- https://asec.ahnlab.com/en/30532/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ArdaMax
According to f-secure, Ardamax is a commercial keylogger program that can be installed onto the system from the product's website.& When run, the program can capture a range of user activities, such as keystrokes typed, instant messenger chat logs, web browser activity and even screenshots of the active desktop.
This program can be configured to a complete stealth mode, with password protection, to avoid user detection.
The information gathered is stored in an encrypted log file, which is only viewable using the built-in Log Viewer. The log file can be sent to an external party through e-mail, via a local area network (LAN) or by upload to an FTP server (in either HTML or encrypted format).
Internal MISP references
UUID 4f5c2f8b-06ef-4fb3-b03c-afdcafa88de5 which can be used as unique global reference for ArdaMax in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Arefty
Internal MISP references
UUID bf135b0a-3120-42c4-ba58-c80f9ef689bf which can be used as unique global reference for Arefty in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ares (Windows)
A banking trojan, derived from the source code of win.kronos. In August 2022 it started to incorporate DGA code from win.qakbot.
Internal MISP references
UUID a711ad02-0120-41a1-8c03-8a857a7dc297 which can be used as unique global reference for Ares (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AresLoader
AresLoader is a new malware "downloader" that has been advertised on some Russian language Dark Web forums “RAMP and "XSS" by a threat actor called "DarkBLUP". Researchers assess this loader is likely a legitimate penetration testing tool that is now being abused by threat actors. This is because of a similar project, dubbed “Project Ares,” was previously uploaded to GitHub as a proof-of-concept (PoC) by the well-regarded user and red teamer “CerberSec.”
The loader mimics legitimate software to trick victims into executing malware with administrator rights on their machines. Additional features of the loader include:
- Written in C/C++
- Supports 64-bit payloads
- Makes it look like malware spawned by another process
- Prevents non-Microsoft signed binaries from being injected into malware
- Hides suspicious imported Windows APIs
- Leverages anti-analysis techniques to avoid reverse engineering
Furthermore, It was observed that SystemBC, Amadey, and several Raccoon Stealers were directly installing AresLoader. To date, the AresLoader downloader has been seen delivering payloads like SystemBC, Lumma Stealer, StealC, Aurora Stealer, and Laplas Clipper.
Internal MISP references
UUID 1bd6c2ab-341e-43e1-90ca-2e7509828268 which can be used as unique global reference for AresLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.aresloader - webarchive
- https://flashpoint.io/blog/private-malware-for-sale-aresloader/ - webarchive
- https://research.openanalysis.net/ares/aresloader/loader/2023/04/02/aresloader.html - webarchive
- https://www.zerofox.com/blog/the-underground-economist-volume-2-issue-24/ - webarchive
- https://twitter.com/k3dg3/status/1636873721200746496 - webarchive
- https://intel471.com/blog/new-loader-on-the-bloc-aresloader - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ArguePatch
During a campaign against a Ukrainian energy provider, a new loader of a new version of CaddyWiper called "ArguePatch" was observed by ESET researchers. ArguePatch is a modified version of Hex-Ray's Remote Debugger Server (win32_remote.exe). ArguePatch expects a decryption key and the file of the CaddyWiper shellcode as command line parameters.
Internal MISP references
UUID e9b4bec3-ad18-49cc-b6af-c0ffcc283153 which can be used as unique global reference for ArguePatch in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Aria-body
Internal MISP references
UUID 5fa1c068-8e73-4930-b6fe-8c92c6357df6 which can be used as unique global reference for Aria-body in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ariabody - webarchive
- https://cocomelonc.github.io/malware/2023/09/25/malware-trick-36.html - webarchive
- https://securelist.com/naikons-aria/96899/ - webarchive
- https://securelist.com/it-threat-evolution-q2-2020/98230 - webarchive
- https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/ - webarchive
- https://medium.com/insomniacs/aria-body-loader-is-that-you-53bdd630f8a1 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Arid Gopher
This malware is a Go written variant of Micropsia and according to DeepInstinct it is still in development.
Internal MISP references
UUID 2037d9f1-bf2a-44e1-b04f-98fe3f961381 which can be used as unique global reference for Arid Gopher in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.aridgopher - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/mantis-palestinian-attacks - webarchive
- https://www.deepinstinct.com/blog/arid-gopher-the-newest-micropsia-malware-variant - webarchive
- https://www.theregister.com/2022/03/22/arid-gopher-malware-deep-instinct/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AridHelper
Helper malware associated with AridGopher, which will provide an alternative persistence mechanism in case "360 total security" is found on a target system.
Internal MISP references
UUID 6bd3759f-5961-423d-9437-c67bddcda458 which can be used as unique global reference for AridHelper in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Arik Keylogger
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Arik Keylogger.
| Known Synonyms |
|---|
Aaron Keylogger |
Internal MISP references
UUID 3572d725-bf13-43ef-9511-bdbb7692ab06 which can be used as unique global reference for Arik Keylogger in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Arkei Stealer
Arkei is a stealer that appeared around May 2018. It collects data about browsers (saved passwords and autofill forms), cryptocurrency wallets, and steal files matching an attacker-defined pattern. It then exfiltrates everything in a zip file uploaded to the attacker's panel. Later, it was forked and used as a base to create Vidar stealer.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Arkei Stealer.
| Known Synonyms |
|---|
ArkeiStealer |
Internal MISP references
UUID 59eff508-7f26-4fd8-b526-5772a9f3d9a6 which can be used as unique global reference for Arkei Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.arkei_stealer - webarchive
- https://forensicitguy.github.io/analyzing-stealer-msi-using-msitools/ - webarchive
- https://isc.sans.edu/diary/Arkei+Variants%3A+From+Vidar+to+Mars+Stealer/28468 - webarchive
- https://blogs.blackberry.com/en/2022/02/threat-thursday-arkei-infostealer - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://drive.google.com/file/d/1wTH-BZrjxEBZwCnXJ3pQWGB7ou0IoBEr/view - webarchive
- https://isc.sans.edu/diary/rss/28468 - webarchive
- https://ke-la.com/information-stealers-a-new-landscape/ - webarchive
- https://blog.minerva-labs.com/a-long-list-of-arkei-stealers-browser-crypto-wallets - webarchive
- https://www.bleepingcomputer.com/news/security/hacker-breaches-syscoin-github-account-and-poisons-official-client/ - webarchive
- https://fumik0.com/2018/12/24/lets-dig-into-vidar-an-arkei-copycat-forked-stealer-in-depth-analysis/ - webarchive
- https://threatmon.io/arkei-stealer-analysis-threatmon/ - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ArrowRAT
It is available as a service, purchasable by anyone to use in their own campaigns. It’s features are generally fairly typical of a RAT, with its most notable aspect being the hVNC module which basically gives an attacker full remote access with minimal need for technical knowledge to use it.
Internal MISP references
UUID 3d5608dc-1e0d-40cb-8a17-3a8d7efb1c53 which can be used as unique global reference for ArrowRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ARS VBS Loader
ARS Loader, also known as ARS VBS Loader, is written in Visual Basic Script and its main purpose is to control an infected machine via different available commands, acting as a remote access trojan (RAT). Its code is based on ASPC, another Visual Basic Script malware, which at the same time seems to be based on SafeLoader.
Internal MISP references
UUID 1a4f99cc-c078-41f8-9749-e1dc524fc795 which can be used as unique global reference for ARS VBS Loader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ars_loader - webarchive
- https://twitter.com/Racco42/status/1001374490339790849 - webarchive
- https://www.blueliv.com/blog-news/research/ars-loader-evolution-zeroevil-ta545-airnaine/ - webarchive
- https://www.flashpoint-intel.com/blog/meet-ars-vbs-loader/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ARTFULPIE
Internal MISP references
UUID bc0ad216-9b56-489e-858d-68522e1fdfaf which can be used as unique global reference for ARTFULPIE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Artra Downloader
Internal MISP references
UUID 05de9c50-5958-4d02-b1a0-c4a2367c2d22 which can be used as unique global reference for Artra Downloader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.artra - webarchive
- https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/ - webarchive
- https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh/ - webarchive
- https://ti.360.net/blog/articles/analysis-of-targeted-attack-against-pakistan-by-exploiting-inpage-vulnerability-and-related-apt-groups-english - webarchive
- https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/352/Bitdefender-PR-Whitepaper-BitterAPT-creat4571-en-EN-GenericUse.pdf - webarchive
- https://securelist.com/apt-trends-report-q1-2021/101967/ - webarchive
- https://www.freebuf.com/articles/database/192726.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Asbit
Internal MISP references
UUID 488b735f-9138-4970-9d20-77132f4a82d6 which can be used as unique global reference for Asbit in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AscentLoader
Internal MISP references
UUID 4e3fa4e6-bc7d-4024-b191-ccafa5347c13 which can be used as unique global reference for AscentLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ASPC
Internal MISP references
UUID bc128d41-33e6-40ec-aaf2-9a05da9a0a27 which can be used as unique global reference for ASPC in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Asprox
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Asprox.
| Known Synonyms |
|---|
Aseljo |
BadSrc |
Internal MISP references
UUID ba557993-f64e-4538-8f13-dafaa3c0db00 which can be used as unique global reference for Asprox in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.asprox - webarchive
- http://oalabs.openanalysis.net/2014/12/04/inside-the-new-asprox-kuluoz-october-2013-january-2014/ - webarchive
- https://researchcenter.paloaltonetworks.com/2015/08/whats-next-in-malware-after-kuluoz/ - webarchive
- https://www.virusbulletin.com/virusbulletin/2012/11/tracking-2012-sasfis-campaign - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Asruex
Internal MISP references
UUID a51595aa-a399-4332-a14d-a378bae609e7 which can be used as unique global reference for Asruex in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.asruex - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/asruex-backdoor-variant-infects-word-documents-and-pdfs-through-old-ms-office-and-adobe-vulnerabilities/ - webarchive
- https://blog.bushidotoken.net/2020/06/deep-dive-darkhotel-apt.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Astaroth
First spotted in the wild in 2017, Astaroth is a highly prevalent, information-stealing Latin American banking trojan. It is written in Delphi and has some innovative execution and attack techniques. Originally, this malware variant targeted Brazilian users, but Astaroth now targets users both in North America and Europe.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Astaroth.
| Known Synonyms |
|---|
Guildma |
Internal MISP references
UUID 0cdb83dd-106b-458e-8d04-ca864281e06e which can be used as unique global reference for Astaroth in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.astaroth - webarchive
- https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html - webarchive
- https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research - webarchive
- https://securelist.com/the-tetrade-brazilian-banking-malware/97779/ - webarchive
- https://www.armor.com/resources/threat-intelligence/astaroth-banking-trojan/ - webarchive
- https://labs.f-secure.com/blog/attack-detection-fundamentals-code-execution-and-persistence-lab-1/ - webarchive
- https://www.microsoft.com/security/blog/2020/03/23/latest-astaroth-living-off-the-land-attacks-are-even-more-invisible-but-not-less-observable/ - webarchive
- https://www.welivesecurity.com/2020/03/05/guildma-devil-drives-electric/ - webarchive
- https://blog.easysol.net/meet-lucifer-international-trojan/ - webarchive
- https://isc.sans.edu/diary/27482 - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://www.microsoft.com/security/blog/2019/07/08/dismantling-a-fileless-campaign-microsoft-defender-atp-next-gen-protection-exposes-astaroth-attack/ - webarchive
- https://github.com/pan-unit42/tweets/blob/master/2022-01-17-IOCs-for-Astaroth-Guildma-infection.txt - webarchive
- https://blog.talosintelligence.com/2020/05/astaroth-analysis.html - webarchive
- https://isc.sans.edu/diary/Brazil+malspam+pushes+Astaroth+%28Guildma%29+malware/28962 - webarchive
- https://www.botconf.eu/wp-content/uploads/2019/12/B2019-Soucek-Hornak-DemystifyingBankingTrojansFromLatinAmerica.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Astasia
Astasia is a banking trojan that spreads through phishing emails that contain an executable attachment. Once the attachment is executed, Astasia downloads and installs a trojan that runs in the background. The trojan can steal personal information, such as passwords and credit card numbers, from victims.
Internal MISP references
UUID 6cc38bdd-f7ac-4775-bc41-69e72b761ab5 which can be used as unique global reference for Astasia in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AstraLocker
Internal MISP references
UUID d32a6790-57c7-4985-b6e0-5b73f025fb43 which can be used as unique global reference for AstraLocker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.astralocker - webarchive
- https://www.bleepingcomputer.com/news/security/astralocker-ransomware-shuts-down-and-releases-decryptors/ - webarchive
- https://www.emsisoft.com/ransomware-decryption-tools/astralocker - webarchive
- https://blog.malwarebytes.com/ransomware/2022/07/astralocker-2-0-ransomware-isnt-going-to-give-you-your-files-back/ - webarchive
- https://blog.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AsyncRAT
AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victim’s computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.
Internal MISP references
UUID c94c4f23-20d1-4858-8f94-01a54b213981 which can be used as unique global reference for AsyncRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat - webarchive
- https://www.secureworks.com/research/darktortilla-malware-analysis - webarchive
- https://twitter.com/MsftSecIntel/status/1392219299696152578 - webarchive
- https://blog.talosintelligence.com/2022/01/nanocore-netwire-and-asyncrat-spreading.html - webarchive
- https://blog.talosintelligence.com/2021/09/operation-layover-how-we-tracked-attack.html - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/400/Bitdefender-PR-Whitepaper-MosaicLoader-creat5540-en-EN.pdf - webarchive
- https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf - webarchive
- https://threatresearch.ext.hp.com/wp-content/uploads/2022/05/HP-Wolf-Security-Threat-Insights-Report-Q1-2022.pdf - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://medium.com/@hcksyd/asyncrat-analysing-the-three-stages-of-execution-378b343216bf - webarchive
- https://community.riskiq.com/article/3929ede0/description - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/how-cybercriminals-abuse-cloud-tunneling-services - webarchive
- https://www.fortinet.com/blog/threat-research/spear-phishing-campaign-with-new-techniques-aimed-at-aviation-companies - webarchive
- https://labs.k7computing.com/?p=21759 - webarchive
- https://mssplab.github.io/threat-hunting/2023/05/19/malware-src-asyncrat.html - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/reservations-requested-ta558-targets-hospitality-and-travel - webarchive
- https://www.huntress.com/blog/advanced-cyberchef-tips-asyncrat-loader - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://community.riskiq.com/article/ade260c6 - webarchive
- https://blog.morphisec.com/asyncrat-new-delivery-technique-new-threat-campaign - webarchive
- https://blog.morphisec.com/hubfs/Journey%20of%20a%20Crypto%20Scammer%20-%20NFT-001%20%7C%20Morphisec%20%7C%20Threat%20Report.pdf - webarchive
- https://twitter.com/vxunderground/status/1519632014361640960 - webarchive
- https://blog.netlab.360.com/purecrypter - webarchive
- https://decoded.avast.io/threatintel/outbreak-of-follina-in-australia - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-american-entities-with-commodity-rats/BlindEagleIOCList.txt - webarchive
- https://blogs.jpcert.or.jp/en/2020/12/quasar-family.html - webarchive
- https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/ - webarchive
- https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-40-LunghiHorejsi.pdf - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/targeted-attack-on-government-agencies.html - webarchive
- https://thehackernews.com/2022/01/hackers-using-new-evasive-technique-to.html - webarchive
- https://intel471.com/blog/china-cybercrime-undergrond-deepmix-tea-horse-road-great-firewall/ - webarchive
- https://threatpost.com/ta2541-apt-rats-aviation/178422/ - webarchive
- https://www.menlosecurity.com/blog/isomorph-infection-in-depth-analysis-of-a-new-html-smuggling-campaign/ - webarchive
- https://blogs.blackberry.com/en/2023/02/blind-eagle-apt-c-36-targets-colombia - webarchive
- https://community.riskiq.com/article/24759ad2 - webarchive
- https://embee-research.ghost.io/shodan-censys-queries/ - webarchive
- https://threatresearch.ext.hp.com/stealthy-opendocument-malware-targets-latin-american-hotels/# - webarchive
- https://www.zscaler.com/blogs/security-research/catching-rats-over-custom-protocols - webarchive
- https://decoded.avast.io/threatintel/outbreak-of-follina-in-australia/ - webarchive
- https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader - webarchive
- https://blog.morphisec.com/syk-crypter-discord - webarchive
- https://securityintelligence.com/posts/roboski-global-recovery-automation/ - webarchive
- https://brianstadnicki.github.io/posts/vulnerability-asyncrat-rce/ - webarchive
- https://blog.morphisec.com/tracking-hcrypt-an-active-crypter-as-a-service - webarchive
- https://eln0ty.github.io/malware%20analysis/asyncRAT/ - webarchive
- https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/ - webarchive
- https://www.ncsc.admin.ch/ncsc/en/home/aktuell/im-fokus/2022/wochenrueckblick_7.html - webarchive
- https://www.netskope.com/blog/asyncrat-using-fully-undetected-downloader - webarchive
- https://www.microsoft.com/security/blog/2021/11/11/html-smuggling-surges-highly-evasive-loader-technique-increasingly-used-in-banking-malware-targeted-attacks/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages - webarchive
- https://embee-research.ghost.io/unpacking-malware-using-process-hacker-and-memory-inspection/ - webarchive
- https://www.zscaler.com/blogs/security-research/targeted-attack-thailand-pass-customers-delivers-asyncrat - webarchive
- https://www.fortinet.com/blog/threat-research/threat-actors-prey-on-eager-travelers - webarchive
- https://www.linkedin.com/feed/update/urn
activity:7137086303329783808/ - webarchive - https://assets.virustotal.com/reports/2021trends.pdf - webarchive
- https://blog.morphisec.com/ahk-rat-loader-leveraged-in-unique-delivery-campaigns - webarchive
- https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/ - webarchive
- https://cocomelonc.github.io/malware/2023/01/04/malware-tricks-26.html - webarchive
- https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt - webarchive
- https://jstnk9.github.io/jstnk9/research/AsyncRAT-Analysis/ - webarchive
- https://blog.talosintelligence.com/2021/08/rat-campaign-targets-latin-america.html - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
- https://research.loginsoft.com/threat-research/from-innocence-to-malice-the-onenote-malware-campaign-uncovered/ - webarchive
- https://ti.qianxin.com/uploads/2020/09/17/69da886eecc7087e9dac2d3ea4c66ba8.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/follina-msdt-exploit-malware - webarchive
- https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 - webarchive
- https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf - webarchive
- https://aidenmitchell.ca/asyncrat-via-vbs/ - webarchive
- https://redskyalliance.org/xindustry/possible-identity-of-a-kuwaiti-hacker-nyanxcat - webarchive
- https://www.trendmicro.com/en_us/research/21/k/campaign-abusing-rats-uses-fake-websites.html - webarchive
- https://www.esentire.com/blog/suspected-asyncrat-delivered-via-iso-files-using-html-smuggling-technique - webarchive
- https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper - webarchive
- https://cocomelonc.github.io/book/2023/12/13/malwild-book.html - webarchive
- https://www.ciphertechsolutions.com/roboski-global-recovery-automation/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/unskilled-hacker-linked-to-years-of-attacks-on-aviation-transport-sectors/ - webarchive
- https://resecurity.com/blog/article/shortcut-based-lnk-attacks-delivering-malicious-code-on-the-rise - webarchive
- https://www.trendmicro.com/en_us/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-ameri.html - webarchive
- https://blog.talosintelligence.com/2022/04/asyncrat-3losh-update.html - webarchive
- https://www.esentire.com/blog/asyncrat-activity - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution - webarchive
- https://embee-research.ghost.io/unpacking-net-malware-with-process-hacker/ - webarchive
- https://mp.weixin.qq.com/s/J_A12SOX0k5TOYFAegBv_w - webarchive
- https://www.trendmicro.com/en_us/research/22/d/new-apt-group-earth-berberoka-targets-gambling-websites-with-old.html - webarchive
- https://blogs.vmware.com/security/2019/11/threat-analysis-unit-tau-threat-intelligence-notification-asyncrat.html - webarchive
- https://kienmanowar.wordpress.com/2023/04/08/quicknote-uncovering-suspected-malware-distributed-by-individuals-from-vietnam/ - webarchive
- https://blog.qualys.com/vulnerabilities-threat-research/2022/08/16/asyncrat-c2-framework-overview-technical-analysis-and-detection - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://github.com/jeFF0Falltrades/Tutorials/tree/master/asyncrat_config_parser - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
- https://www.splunk.com/en_us/blog/security/asyncrat-crusade-detections-and-defense.html - webarchive
- https://twitter.com/ESETresearch/status/1449132020613922828 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Atharvan
Internal MISP references
UUID b1ff6117-7dd2-4328-bde8-00d74584fc98 which can be used as unique global reference for Atharvan in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Athena
Part of the Mythic framework, payload in C# (.NET 6), support HTTP, Websockets, Slack, SMB for C2.
Internal MISP references
UUID 69bcd272-e69e-4548-bb8e-05eedcc3f13e which can be used as unique global reference for Athena in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AthenaGo RAT
Internal MISP references
UUID 587eff78-47be-4022-a1b5-7857340a9ab2 which can be used as unique global reference for AthenaGo RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ATI-Agent
Internal MISP references
UUID e248d80d-de8e-45de-b6d0-3740e5b34573 which can be used as unique global reference for ATI-Agent in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AtlasAgent
Internal MISP references
UUID 2fa8f479-63c3-4f91-954a-f30a50d2ad6e which can be used as unique global reference for AtlasAgent in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ATMii
Internal MISP references
UUID f2a7c867-6380-4cbe-b524-50727a29f0c6 which can be used as unique global reference for ATMii in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ATMitch
Internal MISP references
UUID 5f427b3a-7162-4421-b2cd-e6588d518448 which can be used as unique global reference for ATMitch in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.atmitch - webarchive
- https://documents.trendmicro.com/assets/white_papers/wp-cashing-in-on-atm-malware.pdf - webarchive
- https://securelist.com/atm-pos-malware-landscape-2017-2019/96750/ - webarchive
- https://securelist.com/blog/sas/77918/atmitch-remote-administration-of-atms/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Atmosphere
Internal MISP references
UUID 15918921-93b8-4b3a-a612-e1d1f769c420 which can be used as unique global reference for Atmosphere in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ATMSpitter
The ATMSpitter family consists of command-line tools designed to control the cash dispenser of an ATM through function calls to either CSCWCNG.dll or MFSXFS.dll. Both libraries are legitimate Windows drivers used to interact with the components of different ATM models.
Internal MISP references
UUID 5a03a6ff-e127-4cd2-aab1-75f1e3ecc187 which can be used as unique global reference for ATMSpitter in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.atmspitter - webarchive
- https://quoscient.io/reports/QuoINT_INTBRI_ATMSpitter_v2.pdf - webarchive
- https://quoscient.io/reports/QuoINT_INTBRI_New_ATMSpitter.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-kingswood - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-kingswood - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ATOMSILO
According to PCrisk, AtomSilo is a type of malware that blocks access to files by encrypting them and renames every encrypted file by appending the ".ATOMSILO" to its filename. It renames "1.jpg" to "1.jpg.ATOMSILO", "2.jpg" to "2.jpg.ATOMSILO", and so on. As its ransom note, AtomSilo creates the "README-FILE-#COMPUTER-NAME#-#CREATION-TIME#.hta" file.
Internal MISP references
UUID f47633fb-2c2b-46c3-a1e6-2204d56897b8 which can be used as unique global reference for ATOMSILO in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.atomsilo - webarchive
- https://decoded.avast.io/threatintel/decryptor-for-atomsilo-and-lockfile-ransomware/ - webarchive
- https://www.zscaler.com/blogs/security-research/atomsilo-ransomware-enters-league-double-extortion - webarchive
- https://chuongdong.com//reverse%20engineering/2021/10/13/AtomSiloRansomware/ - webarchive
- https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader - webarchive
- https://news.sophos.com/en-us/2021/10/04/atom-silo-ransomware-actors-use-confluence-exploit-dll-side-load-for-stealthy-attack/ - webarchive
- https://chuongdong.com/reverse%20engineering/2021/10/13/AtomSiloRansomware/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://twitter.com/siri_urz/status/1437664046556274694?s=20 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Attor
Attor is a cyberespionage platform used in targeted attacks against diplomatic missions and governmental institutions since at least 2013. Its most interesting features are a complex modular architecture, elaborate network communications, and a unique plugin to fingerprint GSM/GPRS devices.
Attor’s core lies in its dispatcher, which serves as a management unit for additional plugins which provide all of malware’s key capabilities. This allows the attackers to customize the platform on a per-victim basis. Plugins themselves are heavily synchronized. Network communication is based on Tor, aiming for anonymity and untraceability.
The most notable plugin can detect connected GSM/GPRS modems or mobile devices. Attor speaks to them directly using the AT command set, in order to collect sensitive information such as the IMEI, IMSI or MSISDN numbers, possibly identifying both the device and its subscriber. Other plugins provide persistence, an exfiltration channel, C&C communication and several further spying capabilities. The plugin responsible for capturing victim's screen targets social networks and blogging platforms, email services, office software, archiving utilities, file sharing and messaging services.
Internal MISP references
UUID f5f61bc0-aad2-4da3-83db-703ea516c03b which can be used as unique global reference for Attor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.attor - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf - webarchive
- https://www.unian.ua/science/10717107-mizhnarodna-it-kompaniya-poperedzhaye-pro-nizku-shpigunskih-atak-na-uryadovi-ta-diplomatichni-ustanovi-shidnoji-yevropi.html - webarchive
- https://www.zdnet.com/article/new-espionage-malware-found-targeting-russian-speaking-users-in-eastern-europe/ - webarchive
- https://cocomelonc.github.io/tutorial/2022/05/09/malware-pers-4.html - webarchive
- https://www.welivesecurity.com/2019/10/10/eset-discovers-attor-spy-platform - webarchive
- https://safe.cnews.ru/news/top/2019-10-11_za_rossijskimi_diplomatami - webarchive
- https://www.welivesecurity.com/2019/10/10/eset-discovers-attor-spy-platform/ - webarchive
- https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html - webarchive
- https://threatpost.com/sophisticated-spy-kit-russians-gsm-plugin/149095/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
August Stealer
Internal MISP references
UUID 2ee0122a-701d-487d-9ac1-7d91e4f99d78 which can be used as unique global reference for August Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AuKill
According to Sophos, the AuKill tool abuses an outdated version of the driver used by version 16.32 of the Microsoft utility, Process Explorer, to disable EDR processes before deploying either a backdoor or ransomware on the target system.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular AuKill.
| Known Synonyms |
|---|
SophosKill |
Internal MISP references
UUID 07bd266b-811a-4abe-83b3-471918d6fab4 which can be used as unique global reference for AuKill in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Auriga
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Auriga.
| Known Synonyms |
|---|
Riodrv |
Internal MISP references
UUID e3065e43-503b-4496-921b-7601dd3d6abd which can be used as unique global reference for Auriga in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Aurora
Ransomware
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Aurora.
| Known Synonyms |
|---|
OneKeyLocker |
Internal MISP references
UUID 2f899e3e-1a46-43ea-8e68-140603ce943d which can be used as unique global reference for Aurora in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.aurora - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://blog.morphisec.com/in2al5d-p3in4er - webarchive
- https://www.bleepingcomputer.com/ransomware/decryptor/how-to-decrypt-the-aurora-ransomware-with-auroradecrypter/ - webarchive
- https://www.bleepingcomputer.com/news/security/azorult-trojan-serving-aurora-ransomware-by-malactor-oktropys/ - webarchive
- https://twitter.com/malwrhunterteam/status/1001461507513880576 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Aurora Stealer
First advertised as a Malware-as-a-Service (MaaS) on Russian-speaking underground forums in April 2022, Aurora Stealer is a Golang-based information stealer with downloading and remote access capabilities. The malware targets data from multiple browsers, cryptocurrency wallets, local systems, and act as a loader. During execution, the malware runs several commands through WMIC to collect basic host information, snaps a desktop image, and exfiltrates data to the C2 server within a single base64-encoded JSON file.
Internal MISP references
UUID ac697773-7239-4f01-b4b3-7da8b2a64bdf which can be used as unique global reference for Aurora Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.aurora_stealer - webarchive
- https://blog.sekoia.io/bluefox-information-stealer-traffer-maas/ - webarchive
- https://d01a.github.io/aurora-stealer/ - webarchive
- https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar/ - webarchive
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-aurora-stealer - webarchive
- https://denshiyurei.medium.com/silent-echoes-the-hidden-dialogue-among-malware-entities-spotlight-on-amos-infostealer-6d7cd70e3219 - webarchive
- https://d01a.github.io/aurora-stealer-builder/ - webarchive
- https://research.loginsoft.com/threat-research/aurora-the-dark-dawn-and-its-menacing-effects/ - webarchive
- https://research.openanalysis.net/in2al5dp3in4er/loader/analysis/sandbox/invalid%20printer/2023/04/23/in2al5dp3in4er.html - webarchive
- https://isc.sans.edu/diary/rss/29448 - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Avaddon
Avaddon is a ransomware malware targeting Windows systems often spread via malicious spam. The first known attack where Avaddon ransomware was distributed was in February 2020. Avaddon encrypts files using the extension .avdn and uses a TOR payment site for the ransom payment.
Internal MISP references
UUID 8f648193-68ca-40c2-98b2-e5481487463e which can be used as unique global reference for Avaddon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.avaddon - webarchive
- https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/ - webarchive
- https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/ - webarchive
- https://twitter.com/dk_samper/status/1348560784285167617 - webarchive
- https://therecord.media/darkside-ransomware-gang-says-it-lost-control-of-its-servers-money-a-day-after-biden-threat/ - webarchive
- https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound - webarchive
- https://www.connectwise.com/resources/avaddon-profile - webarchive
- https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/ - webarchive
- https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html - webarchive
- https://www.cyber.gov.au/sites/default/files/2021-05/2021-003%20Ongoing%20campaign%20using%20Avaddon%20Ransomware%20-%2020210508.pdf - webarchive
- https://awakesecurity.com/blog/threat-hunting-for-avaddon-ransomware/ - webarchive
- https://labs.sentinelone.com/avaddon-raas-breaks-public-decryptor-continues-on-rampage/ - webarchive
- https://medium.com/s2wlab/quick-analysis-of-haron-ransomware-feat-avaddon-and-thanos-1ebb70f64dc4 - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/ - webarchive
- https://medium.com/s2wlab/w4-jan-en-story-of-the-week-ransomware-on-the-darkweb-7595544363b1 - webarchive
- https://www.hornetsecurity.com/en/security-information/avaddon-from-seeking-affiliates-to-in-the-wild-in-2-days/ - webarchive
- https://www.bleepingcomputer.com/news/security/another-ransomware-now-uses-ddos-attacks-to-force-victims-to-pay/ - webarchive
- https://therecord.media/avaddon-ransomware-operation-shuts-down-and-releases-decryption-keys/ - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/ - webarchive
- https://www.swascan.com/it/avaddon-ransomware/ - webarchive
- https://arxiv.org/pdf/2102.04796.pdf - webarchive
- https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/ - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/ - webarchive
- https://atos.net/en/lp/securitydive/avaddon-ransomware-analysis - webarchive
- https://www.advanced-intel.com/post/the-rise-demise-of-multi-million-ransomware-business-empire - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.welivesecurity.com/la-es/2021/05/31/ransomware-avaddon-principales-caracteristicas/ - webarchive
- https://www.mandiant.com/resources/chasing-avaddon-ransomware - webarchive
- https://twitter.com/Securityinbits/status/1271065316903120902 - webarchive
- https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/avaddon-ransomware-shuts-down-and-releases-decryption-keys/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://threatconnect.com/blog/threatconnect-research-roundup-probable-sandworm-infrastructure - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://www.tgsoft.it/files/report/download.asp?id=568531345 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AvastDisabler
Internal MISP references
UUID 96a695de-2560-4f10-bbd6-3bc2ac27b7f7 which can be used as unique global reference for AvastDisabler in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AVCrypt
Bleeping Computer notes about discovery of AVCrypt, a malware that tries to uninstall existing security software before it encrypts a computer. Furthermore, as it removes numerous services, including Windows Update, and provides no contact information, this ransomware may be a wiper.
Internal MISP references
UUID 0568fcc6-755f-416e-9c5b-22232cd7ae0e which can be used as unique global reference for AVCrypt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AvD Crypto Stealer
Cyble Research discovered this .Net written malware dubbed "AvD Crypto Stealer". The name of this malware is misleading, because this is a kind of clipper malware. Assumption of Cyble is, that this malware could target other threat actors as scenario.
Internal MISP references
UUID de92fff8-337e-4cf8-853b-f13f08ffc24d which can be used as unique global reference for AvD Crypto Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Aveo
Internal MISP references
UUID 606b160a-5180-4255-a1db-b2b9e8a52e95 which can be used as unique global reference for Aveo in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ave Maria
Information stealer which uses AutoIT for wrapping.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ave Maria.
| Known Synonyms |
|---|
AVE_MARIA |
AveMariaRAT |
Warzone RAT |
WarzoneRAT |
avemaria |
Internal MISP references
UUID 6bae792a-c2d0-42eb-b9e0-6ef1d83f9b25 which can be used as unique global reference for Ave Maria in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ave_maria - webarchive
- https://securelist.com/tomiris-called-they-want-their-turla-malware-back/109552/ - webarchive
- https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware - webarchive
- https://www.netskope.com/blog/dbatloader-abusing-discord-to-deliver-warzone-rat - webarchive
- https://blogs.blackberry.com/en/2021/12/threat-thursday-warzone-rat-breeds-a-litter-of-scriptkiddies - webarchive
- https://blog.yoroi.company/research/the-ave_maria-malware/ - webarchive
- https://blogs.quickheal.com/warzone-rat-beware-of-the-trojan-malware-stealing-data-triggering-from-various-office-documents/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 - webarchive
- https://www.youtube.com/watch?v=-G82xh9m4hc - webarchive
- https://www.trendmicro.com/en_us/research/21/i/Water-Basilisk-Uses-New-HCrypt-Variant-to-Flood-Victims-with-RAT-Payloads.html - webarchive
- https://www.youtube.com/watch?v=81fdvmGmRvM - webarchive
- https://medium.com/insomniacs/do-you-want-to-bake-a-donut-come-on-lets-go-update-go-away-maria-e8e2b33683b1 - webarchive
- https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html - webarchive
- https://www.ciphertechsolutions.com/roboski-global-recovery-automation/ - webarchive
- https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/ - webarchive
- https://www.huntress.com/blog/ave-maria-and-the-chambers-of-warzone-rat - webarchive
- https://ti.qianxin.com/blog/articles/Kasablanka-Group-Probably-Conducted-Compaigns-Targeting-Russia/ - webarchive
- https://www.trendmicro.com/en_us/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-ameri.html - webarchive
- https://www.youtube.com/watch?v=T0tdj1WDioM - webarchive
- https://resources.malwarebytes.com/files/2020/05/CTNT_Q1_2020_COVID-Report_Final.pdf - webarchive
- https://www.kaspersky.com/about/press-releases/2019_fin7-hacking-group-targets-more-than-130-companies-after-leaders-arrest - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0919.pdf - webarchive
- https://mp.weixin.qq.com/s/fsesosMnKIfAi_I9I0wKSA - webarchive
- https://exploitreversing.files.wordpress.com/2022/11/mas_6-1.pdf - webarchive
- https://blog.morphisec.com/syk-crypter-discord - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://blog.talosintelligence.com/attributing-yorotrooper/ - webarchive
- https://www.cisa.gov/sites/default/files/2023-11/aa23-320a_scattered_spider.pdf - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://securityintelligence.com/posts/roboski-global-recovery-automation/ - webarchive
- https://reaqta.com/2019/04/ave_maria-malware-part1/ - webarchive
- https://muha2xmad.github.io/malware-analysis/warzonerat/ - webarchive
- https://blog.team-cymru.com/2019/07/25/unmasking-ave_maria/ - webarchive
- https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
- https://kienmanowar.wordpress.com/2023/03/25/quicknote-decrypting-the-c2-configuration-of-warzone-rat/ - webarchive
- https://blog.talosintelligence.com/2021/09/operation-armor-piercer.html - webarchive
- https://github.com/muha2xmad/Python/blob/bdc7a711d5a775f8ae47b591f20fdd2e1360b77b/warzonerat/warzonerat_config_extraction.ipynb - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://asec.ahnlab.com/en/36629/ - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://www.uptycs.com/blog/warzone-rat-comes-with-uac-bypass-technique - webarchive
- https://www.uptycs.com/blog/warzonerat-can-now-evade-with-process-hollowing - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/ - webarchive
- https://www.securonix.com/securonix-threat-labs-security-advisory-multistorm-leverages-python-based-loader-as-onedrive-utilities-to-drop-rat-payloads/ - webarchive
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
- https://cocomelonc.github.io/tutorial/2022/05/02/malware-pers-3.html - webarchive
- http://blog.morphisec.com/threat-alert-ave-maria-infostealer-on-the-rise-with-new-stealthier-delivery - webarchive
- https://mp.weixin.qq.com/s/C09P0al1nhsyyujHRp0FAw - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-american-entities-with-commodity-rats/BlindEagleIOCList.txt - webarchive
- https://blog.talosintelligence.com/2020/09/salfram-robbing-place-without-removing.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AvosLocker
AvosLocker is a ransomware-as-a-service (RaaS) gang that first appeared in mid-2021. It has since become notorious for its attacks targeting critical infrastructure in the United States, including the sectors of financial services, critical manufacturing, and government facilities.
In March 2022, the FBI and US Treasury Department issued a warning about the attacks.
Internal MISP references
UUID 8cee7a73-df5f-4ca3-ac52-b8a29a9b7414 which can be used as unique global reference for AvosLocker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.avos_locker - webarchive
- https://blogs.blackberry.com/en/2022/04/threat-thursday-avoslocker-prompts-advisory-from-fbi-and-fincen - webarchive
- https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape - webarchive
- https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html - webarchive
- https://blog.malwarebytes.com/threat-analysis/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners/ - webarchive
- https://blog.cyble.com/2022/01/17/avoslocker-ransomware-linux-version-targets-vmware-esxi-servers/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-avoslocker - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker - webarchive
- https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group - webarchive
- https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf - webarchive
- https://blog.talosintelligence.com/2022/06/avoslocker-new-arsenal.html - webarchive
- https://www.ic3.gov/Media/News/2022/220318.pdf - webarchive
- https://cdn.pathfactory.com/assets/10555/contents/400686/13f4424c-05b4-46db-bb9c-6bf9b5436ec4.pdf - webarchive
- https://news.sophos.com/en-us/2021/12/22/avos-locker-remotely-accesses-boxes-even-running-in-safe-mode/ - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://unit42.paloaltonetworks.com/emerging-ransomware-groups/ - webarchive
- https://blog.qualys.com/vulnerabilities-threat-research/2022/03/06/avoslocker-ransomware-behavior-examined-on-windows-linux - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 061 (Windows)
Was previously wrongly tagged as PoweliksDropper, now looking for additional context.
Internal MISP references
UUID 969d1054-b917-4fb8-b3f8-1e33926fdb65 which can be used as unique global reference for Unidentified 061 (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Avzhan
Internal MISP references
UUID b12d9354-f67b-47dd-944c-82cfdff7b9a3 which can be used as unique global reference for Avzhan in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
AXLocker
Internal MISP references
UUID 017ea8db-6eb4-4df1-bac0-da908d2aea9f which can be used as unique global reference for AXLocker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ayegent
Internal MISP references
UUID c84a6b0b-28a5-4293-b8fc-6a6eeb7b5f70 which can be used as unique global reference for Ayegent in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Aytoke
Keylogger.
Internal MISP references
UUID 91524400-097c-4584-9168-05b317d57b63 which can be used as unique global reference for Aytoke in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Azorult
AZORult is a credential and payment card information stealer. Among other things, version 2 added support for .bit-domains. It has been observed in conjunction with Chthonic as well as being dropped by Ramnit.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Azorult.
| Known Synonyms |
|---|
PuffStealer |
Rultazo |
Internal MISP references
UUID 0dfbe48e-a3da-4265-975e-1eb37ad9c51c which can be used as unique global reference for Azorult in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.azorult - webarchive
- https://twitter.com/DrStache_/status/1227662001247268864 - webarchive
- https://securelist.com/azorult-analysis-history/89922/ - webarchive
- https://threatvector.cylance.com/en_us/home/threat-spotlight-analyzing-azorult-infostealer-malware.html - webarchive
- https://www.domaintools.com/resources/blog/identifying-network-infrastructure-related-to-a-who-spoofing-campaign - webarchive
- https://www.trendmicro.com/en_us/research/21/k/campaign-abusing-rats-uses-fake-websites.html - webarchive
- https://blog.talosintelligence.com/2020/06/tor2mine-is-up-to-their-old-tricks-and_11.html - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf - webarchive
- https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/ - webarchive
- https://mariohenkel.medium.com/decrypting-azorult-traffic-for-fun-and-profit-9f28d8638b05 - webarchive
- https://research.checkpoint.com/2023/following-the-scent-of-trickgate-6-year-old-packer-used-to-deploy-the-most-wanted-malware/ - webarchive
- https://isc.sans.edu/forums/diary/Analysis+of+a+tripleencrypted+AZORult+downloader/25768/ - webarchive
- https://www.cybereason.com/blog/the-hole-in-the-bucket-attackers-abuse-bitbucket-to-deliver-an-arsenal-of-malware - webarchive
- https://blog.talosintelligence.com/2021/12/magnat-campaigns-use-malvertising-to.html - webarchive
- https://malwarebreakdown.com/2017/11/12/seamless-campaign-delivers-ramnit-via-rig-ek-at-188-225-82-158-follow-up-malware-is-azorult-stealer/ - webarchive
- https://www.blueliv.com/blog-news/research/azorult-crydbrox-stops-sells-malware-credential-stealer/ - webarchive
- https://www.splunk.com/en_us/blog/security/-applocker-rules-as-defense-evasion-complete-analysis.html - webarchive
- https://asec.ahnlab.com/en/26517/ - webarchive
- https://www.youtube.com/watch?v=EyDiIAt__dI - webarchive
- https://www.virusbulletin.com/uploads/pdf/magazine/2021/202104-design-vulnerabilities-azorult-cc-panels.pdf - webarchive
- https://yoroi.company/research/aggah-how-to-run-a-botnet-without-renting-a-server-for-more-than-a-year/ - webarchive
- https://www.ciphertechsolutions.com/roboski-global-recovery-automation/ - webarchive
- https://research.checkpoint.com/the-emergence-of-the-new-azorult-3-3/ - webarchive
- https://ke-la.com/information-stealers-a-new-landscape/ - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/using-qiling-framework-to-unpack-ta505-packed-samples/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/new-whiteshadow-downloader-uses-microsoft-sql-retrieve-malware - webarchive
- https://maxkersten.nl/binary-analysis-course/malware-analysis/azorult-loader-stages/ - webarchive
- https://outpost24.com/blog/using-qiling-framework-to-unpack-ta505-packed-samples/ - webarchive
- https://malwarebreakdown.com/2017/07/24/the-seamless-campaign-drops-ramnit-follow-up-malware-azorult-stealer-smoke-loader-etc/ - webarchive
- https://resources.malwarebytes.com/files/2020/05/CTNT_Q1_2020_COVID-Report_Final.pdf - webarchive
- https://blog.checkpoint.com/2022/05/10/a-german-car-attack-on-german-vehicle-businesses/ - webarchive
- https://umbrella.cisco.com/blog/navigating-cybersecurity-during-a-pandemic-latest-malware-and-threat-actors - webarchive
- https://research.checkpoint.com/2019/select-code_execution-from-using-sqlite/ - webarchive
- https://blog.minerva-labs.com/puffstealer-evasion-in-a-cloak-of-multiple-layers - webarchive
- https://www.proofpoint.com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongside - webarchive
- https://www.proofpoint.com/us/threat-insight/post/threat-actors-using-legitimate-paypal-accounts-to-distribute-chthonic-banking-trojan - webarchive
- https://www.vmray.com/cyber-security-blog/azorult-delivered-by-guloader-malware-analysis-spotlight/ - webarchive
- https://community.riskiq.com/article/2a36a7d2/description - webarchive
- http://www.vkremez.com/2017/07/lets-learn-reversing-credential-and.html - webarchive
- https://blog.prevailion.com/2020/02/the-triune-threat-mastermana-returns.html - webarchive
- https://securityintelligence.com/posts/roboski-global-recovery-automation/ - webarchive
- https://unit42.paloaltonetworks.com/cybersquatting/ - webarchive
- https://blog.yoroi.company/research/aggah-how-to-run-a-botnet-without-renting-a-server-for-more-than-a-year/ - webarchive
- https://blog.team-cymru.com/2020/02/19/azorult-what-we-see-using-our-own-tools/ - webarchive
- https://www.telekom.com/en/blog/group/article/cybersecurity-ta505-s-box-of-chocolate-597672 - webarchive
- https://cocomelonc.github.io/tutorial/2021/09/04/simple-malware-av-evasion.html - webarchive
- https://blog.nviso.eu/2020/09/01/epic-manchego-atypical-maldoc-delivery-brings-flurry-of-infostealers/ - webarchive
- https://blogs.blackberry.com/en/2020/04/threat-spotlight-gootkit-banking-trojan - webarchive
- https://ke-la.com/exploring-the-genesis-supply-chain-for-fun-and-profit/ - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://www.zscaler.com/blogs/security-research/targeted-attacks-oil-and-gas-supply-chain-industries-middle-east - webarchive
- https://www.zscaler.com/blogs/research/multistage-freedom-loader-used-spread-azorult-and-nanocore-rat - webarchive
- https://fr3d.hk/blog/gazorp-thieving-from-thieves - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://blog.minerva-labs.com/azorult-now-as-a-signed-google-update - webarchive
- https://isc.sans.edu/diary/25120 - webarchive
- https://blog.talosintelligence.com/2020/04/azorult-brings-friends-to-party.html - webarchive
- https://medium.com/s2wlab/operation-synctrek-e5013df8d167 - webarchive
- https://medium.com/s2wlab/w1-feb-en-story-of-the-week-stealers-on-the-darkweb-49945a31601d - webarchive
- https://community.riskiq.com/article/56e28880 - webarchive
- https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ - webarchive
- https://ke-la.com/whats-dead-may-never-die-azorult-infostealer-decommissioned-again/ - webarchive
- https://www.bleepingcomputer.com/news/security/azorult-trojan-serving-aurora-ransomware-by-malactor-oktropys/ - webarchive
- https://yoroi.company/research/apt-or-not-apt-whats-behind-the-aggah-campaign/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Azov Wiper
According to Checkpoint, this malware is a wiper instead of ransomware as self-announced. It is manually written in FASM, unrecoverably overwriting data in blocks of 666 bytes, using multi-threading.
Internal MISP references
UUID db8dee2a-938e-46af-b2e3-ef5d6e626da7 which can be used as unique global reference for Azov Wiper in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.azov_wiper - webarchive
- https://www.fortinet.com/blog/threat-research/the-year-of-the-wiper - webarchive
- https://research.checkpoint.com/2022/pulling-the-curtains-on-azov-ransomware-not-a-skidsware-but-polymorphic-wiper/ - webarchive
- https://twitter.com/CPResearch/status/1587837524604465153 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Babadeda
According to PCrisk, Babadeda is a new sample in the crypters family, allowing threat actors to encrypt and obfuscate the malicious samples. The obfuscation allows malware to bypass the majority of antivirus protections without triggering any alerts. According to the researchers’ analysis, Babadeda leverages a sophisticated and complex obfuscation that shows a very low detection rate by anti-virus engines.
Internal MISP references
UUID fcb369e1-0783-4188-8841-936c6976035f which can be used as unique global reference for Babadeda in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Babar
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Babar.
| Known Synonyms |
|---|
SNOWBALL |
Internal MISP references
UUID 947dffa1-0184-48d4-998e-1899ad97e93e which can be used as unique global reference for Babar in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.babar - webarchive
- https://drive.google.com/a/cyphort.com/file/d/0B9Mrr-en8FX4dzJqLWhDblhseTA/ - webarchive
- https://web.archive.org/web/20150218192803/http://www.cyphort.com/babar-suspected-nation-state-spyware-spotlight/ - webarchive
- https://researchcenter.paloaltonetworks.com/2017/09/unit42-analysing-10-year-old-snowball/ - webarchive
- https://www.gdatasoftware.com/blog/2015/02/24270-babar-espionage-software-finally-found-and-put-under-the-microscope - webarchive
- http://www.spiegel.de/media/media-35683.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Babuk (Windows)
Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Babuk (Windows).
| Known Synonyms |
|---|
Babyk |
Vasa Locker |
Internal MISP references
UUID 3e243686-a0a0-4aff-b149-786cc3f99a84 which can be used as unique global reference for Babuk (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk - webarchive
- https://resources.prodaft.com/wazawaka-report - webarchive
- https://medium.com/s2wlab/w1-jun-en-story-of-the-week-ransomware-on-the-darkweb-af491d33868b - webarchive
- https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/ - webarchive
- https://www.bleepingcomputer.com/news/security/leaked-babuk-locker-ransomware-builder-used-in-new-attacks/ - webarchive
- https://securelist.com/ransomware-world-in-2021/102169/ - webarchive
- https://www.bleepingcomputer.com/news/security/data-leak-marketplaces-aim-to-take-over-the-extortion-economy/ - webarchive
- https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf - webarchive
- https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html - webarchive
- https://www.zerofox.com/blog/babuk-ransomware-variant-delta-plus/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/are-virtual-machines-the-new-gold-for-cyber-criminals/ - webarchive
- https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/ - webarchive
- https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html - webarchive
- https://www.trendmicro.com/en_us/research/21/b/new-in-ransomware.html - webarchive
- https://cocomelonc.github.io/book/2023/12/13/malwild-book.html - webarchive
- https://medium.com/s2wlab/blackmatter-x-babuk-using-the-same-web-server-for-sharing-leaked-files-d01c20a74751 - webarchive
- https://www.bleepingcomputer.com/news/security/babyk-ransomware-wont-hit-charities-unless-they-support-lgbt-blm/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-evil-corp-ransomware-mimics-payloadbin-gang-to-evade-us-sanctions/ - webarchive
- https://ke-la.com/new-russian-speaking-forum-a-new-place-for-raas/ - webarchive
- https://raw.githubusercontent.com/vc0RExor/Malware-Threat-Reports/main/Ransomware/Babuk/Babuk_Ransomware_EN_2021_05.pdf - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.advintel.io/post/groove-vs-babuk-groove-ransom-manifesto-ramp-underground-platform-secret-inner-workings - webarchive
- https://medium.com/s2wlab/w4-jan-en-story-of-the-week-ransomware-on-the-darkweb-7595544363b1 - webarchive
- http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ - webarchive
- https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-moving-to-vm-nix-systems.pdf - webarchive
- https://medium.com/s2wlab/groove-x-ramp-the-relation-between-groove-babuk-ramp-and-blackmatter-f75644f8f92d - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus/IOCs-blog-Ransomware%20Actor%20Abuses%20Genshin%20Impact%20Anti-Cheat%20Driver%20to%20Kill%20Antivirus.txt - webarchive
- https://killingthebear.jorgetesta.tech/actors/evil-corp - webarchive
- https://therecord.media/builder-for-babuk-locker-ransomware-leaked-online/ - webarchive
- https://blog.morphisec.com/babuk-ransomware-variant-major-attack - webarchive
- https://www.bleepingcomputer.com/news/security/babuk-ransomware-is-back-uses-new-version-on-corporate-networks/ - webarchive
- https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/ - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://raw.githubusercontent.com/antonioCoco/infosec-talks/main/InsomniHack_2022_Ransomware_Encryption_Internals.pdf - webarchive
- https://medium.com/s2wlab/grooves-thoughts-on-blackmatter-babuk-and-interruption-in-the-supply-of-cheese-in-the-b5328bc764f2 - webarchive
- https://medium.com/s2wlab/w4-may-en-story-of-the-week-ransomware-on-the-darkweb-5f5b8d4c3b6f - webarchive
- https://github.com/EmissarySpider/ransomware-descendants - webarchive
- https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/ - webarchive
- https://sebdraven.medium.com/babuk-is-distributed-packed-78e2f5dd2e62 - webarchive
- https://krebsonsecurity.com/2023/05/russian-hacker-wazawaka-indicted-for-ransomware/ - webarchive
- https://www.databreaches.net/babuk-re-organizes-as-payload-bin-offers-its-first-leak/ - webarchive
- https://www.fr.sogeti.com/globalassets/france/avis-dexperts--livres-blancs/cybersecchronicles_-_babuk.pdf - webarchive
- https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/is-there-really-such-a-thing-as-a-low-paid-ransomware-operator/ - webarchive
- https://mssplab.github.io/threat-hunting/2023/06/15/malware-analysis-babuk.html - webarchive
- https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf - webarchive
- https://twitter.com/GossiTheDog/status/1409117153182224386 - webarchive
- https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html - webarchive
- https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/ - webarchive
- https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ - webarchive
- https://krebsonsecurity.com/2022/02/wazawaka-goes-waka-waka/ - webarchive
- https://lab52.io/blog/quick-review-of-babuk-ransomware-builder/ - webarchive
- https://twitter.com/Sebdraven/status/1346377590525845504 - webarchive
- https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/how-groove-gang-is-shaking-up-the-ransomware-as-a-service-market-to-empower-affiliates/ - webarchive
- https://marcoramilli.com/2021/07/05/babuk-ransomware-the-builder/ - webarchive
- https://sekurak.pl/udalo-nam-sie-zrealizowac-wywiad-z-grupa-ransomware-babuk-ktora-zaszyfrowala-policje-metropolitarna-w-waszyngtonie/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BabyLon RAT
Internal MISP references
UUID 1a196c09-f7cd-4a6e-bc3c-2489121b5381 which can be used as unique global reference for BabyLon RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BABYMETAL
BABYMETAL is a command line network tunnel utility based on the TinyMet Meterpreter tool, primarily used to execute Meterpreter reverse shell payloads.
Internal MISP references
UUID 30c2e5c6-851d-4f3a-8b6e-2e7b69a26467 which can be used as unique global reference for BABYMETAL in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.babymetal - webarchive
- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf - webarchive
- https://www.infosecurityeurope.com/__novadocuments/367989?v=636338290033030000 - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
- https://www.mandiant.com/resources/evolution-of-fin7 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BabyShark
BabyShark is Microsoft Visual Basic (VB) script-based malware family first seen in November 2018. The malware is launched by executing the first stage HTA from a remote location, thus it can be delivered via different file types including PE files as well as malicious documents. It exfiltrates system information to C2 server, maintains persistence on the system, and waits for further instruction from the operator
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BabyShark.
| Known Synonyms |
|---|
LATEOP |
Internal MISP references
UUID 8abdd40c-d79a-4353-80e3-29f8a4229a37 which can be used as unique global reference for BabyShark in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.babyshark - webarchive
- https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries - webarchive
- https://conference.hitb.org/hitbsecconf2021ams/materials/D2T1%20-%20The%20Phishermen%20-%20Dissecting%20Phishing%20Techniques%20of%20CloudDragon%20APT%20-%20Linda%20Kuo%20&Zih-Cing%20Liao%20.pdf - webarchive
- https://www.youtube.com/watch?v=rfzmHjZX70s - webarchive
- https://www.sentinelone.com/labs/kimsuky-evolves-reconnaissance-capabilities-in-new-global-campaign/ - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/research/tracking-kimsuky-north-korea-based-cyber-espionage-group-part-1.htmlhttps://www.pwc.co.uk/issues/cyber-security-data-privacy/research/tracking-kimsuky-north-korea-based-cyber-espionage-group-part-2.html - webarchive
- https://twitter.com/i/web/status/1099147896950185985 - webarchive
- https://blog.alyac.co.kr/3352 - webarchive
- https://www.youtube.com/watch?v=Dv2_DK3tRgI - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-301a - webarchive
- https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite - webarchive
- https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/ - webarchive
- https://i.blackhat.com/asia-21/Friday-Handouts/as-21-Kuo-We-Are-About-To-Land-How-CloudDragon-Turns-A-Nightmare-Into-Reality.pdf - webarchive
- https://blog.google/threat-analysis-group/how-were-protecting-users-from-government-backed-attacks-from-north-korea/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.bloomberglaw.com/document/public/subdoc/X67FPNDOUBV9VOPS35A4864BFIU?imagename=1 - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/research/tracking-kimsuky-north-korea-based-cyber-espionage-group-part-1.html - webarchive
- https://www.pwc.co.uk/issues/cyber-security-data-privacy/research/tracking-kimsuky-north-korea-based-cyber-espionage-group-part-2.html - webarchive
- https://www.huntress.com/blog/targeted-apt-activity-babyshark-is-out-for-blood - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bachosens
Internal MISP references
UUID c5b3d358-62f8-46fe-85dc-44b565052f94 which can be used as unique global reference for Bachosens in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BACKBEND
FireEye describes BACKBEND as a secondary downloader used as a backup mechanism in the case the primary backdoor is removed. When executed, BACKBEND checks for the presence of the mutexes MicrosoftZj or MicrosoftZjBak (both associated with BACKSPACE variants). If either of the mutexes exist, the malware exits.
Internal MISP references
UUID 934da8b2-f66e-4056-911e-1da09216e8b8 which can be used as unique global reference for BACKBEND in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BackConfig
Internal MISP references
UUID b3c517cf-6704-43b0-a6da-fed94c9b537a which can be used as unique global reference for BackConfig in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BackNet
Internal MISP references
UUID e2840cc1-c43d-4542-9818-a3c15a0f9f7a which can be used as unique global reference for BackNet in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Backoff POS
Internal MISP references
UUID 70f68c8c-4dc5-4bb0-9f4d-a7484561574b which can be used as unique global reference for Backoff POS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
backspace
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular backspace.
| Known Synonyms |
|---|
Lecna |
ZRLnk |
Internal MISP references
UUID 23398248-a52a-4a7c-af10-262822d33a4e which can be used as unique global reference for backspace in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.backspace - webarchive
- https://www.mandiant.com/sites/default/files/2021-09/rpt-apt30.pdf - webarchive
- https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/eagle-eye-is-back-apt30/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-geneva - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BackSwap
Internal MISP references
UUID 4ec40af9-0295-4b9a-81ad-b7017a21609d which can be used as unique global reference for BackSwap in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.backswap - webarchive
- https://www.cyberbit.com/backswap-banker-malware-hides-inside-replicas-of-legitimate-programs/ - webarchive
- https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree - webarchive
- https://www.f5.com/labs/articles/threat-intelligence/backswap-defrauds-online-banking-customers-using-hidden-input-fi - webarchive
- https://research.checkpoint.com/the-evolution-of-backswap/ - webarchive
- https://www.cert.pl/en/news/single/backswap-malware-analysis/ - webarchive
- https://explore.group-ib.com/htct/hi-tech_crime_2018 - webarchive
- https://www.fintechsecurity.com.hk/slides/01.Dmitry-Annual-Group-IB-report-High-Tech-Crime-Trends.pdf - webarchive
- https://securityintelligence.com/backswap-malware-now-targets-six-banks-in-spain/ - webarchive
- https://www.cyberbit.com/blog/endpoint-security/backswap-banker-malware-hides-inside-replicas-of-legitimate-programs/ - webarchive
- https://www.welivesecurity.com/2018/05/25/backswap-malware-empty-bank-accounts/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BADCALL (Windows)
Internal MISP references
UUID 9ddf546b-487f-44e4-b0dd-07e9997c86c6 which can be used as unique global reference for BADCALL (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.badcall - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://cocomelonc.github.io/tutorial/2021/09/04/simple-malware-av-evasion.html - webarchive
- https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF - webarchive
- https://www.us-cert.gov/ncas/analysis-reports/ar19-252a - webarchive
- https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BadEncript
Internal MISP references
UUID af1c99be-e55a-473e-abed-726191e1da05 which can be used as unique global reference for BadEncript in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
badflick
BADFLICK, a backdoor that is capable of modifying the file system, generating a reverse shell, and modifying its command-and-control configuration.
Internal MISP references
UUID 1eceb5c0-3a01-43c2-b204-9957b15cf763 which can be used as unique global reference for badflick in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BADHATCH
Internal MISP references
UUID 8e8880bf-d016-4759-a138-2fdb4e54f9ab which can be used as unique global reference for BADHATCH in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.badhatch - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling/ - webarchive
- https://team-cymru.com/blog/2021/03/15/fin8-badhatch-threat-indicator-enrichment/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BadNews
Internal MISP references
UUID f28fa5ca-9466-410c-aa32-4bd102f3f0e1 which can be used as unique global reference for BadNews in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.badnews - webarchive
- http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-1 - webarchive
- https://lab52.io/blog/new-patchwork-campaign-against-pakistan/ - webarchive
- https://ti.qianxin.com/blog/articles/apt-c-09-reappeared-as-conflict-intensified-between-india-and-pakistan/ - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2022/01/patchwork-apt-caught-in-its-own-web/ - webarchive
- https://www.forcepoint.com/blog/x-labs/monsoon-analysis-apt-campaign - webarchive
- https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/ - webarchive
- https://cocomelonc.github.io/tutorial/2021/09/04/simple-malware-av-evasion.html - webarchive
- https://securelist.com/apt-trends-report-q1-2021/101967/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference_slides/2019/VB2019-LunghiHorejsi.pdf - webarchive
- https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2 - webarchive
- https://ti.qianxin.com/blog/articles/analysis-of-the-attack-activities-of-patchwork-using-the-documents-of-relevant-government-agencies-in-pakistan-as-bait - webarchive
- https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bagle
Internal MISP references
UUID f09af1cc-cf9d-499a-9026-e783a3897508 which can be used as unique global reference for Bagle in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bahamut (Windows)
Internal MISP references
UUID b420eb9f-d526-473c-95ab-5ab380bbec72 which can be used as unique global reference for Bahamut (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bahamut - webarchive
- https://www.bellingcat.com/resources/case-studies/2017/10/27/bahamut-revisited-cyber-espionage-middle-east-south-asia/ - webarchive
- https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf - webarchive
- https://www.bellingcat.com/news/mena/2017/06/12/bahamut-pursuing-cyber-espionage-actor-middle-east/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Baldr
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Baldr.
| Known Synonyms |
|---|
Baldir |
Internal MISP references
UUID 7024893a-96fe-4de4-bb04-c1d4794a4c95 which can be used as unique global reference for Baldr in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.baldr - webarchive
- https://www.youtube.com/watch?v=E2V4kB_gtcQ - webarchive
- https://krabsonsecurity.com/2019/06/04/taking-a-look-at-baldr-stealer/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2019/04/say-hello-baldr-new-stealer-market/ - webarchive
- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/baldr-vs-the-world.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BalkanDoor
According to ESET, BalkanDoor is a simple backdoor with a small number of commands (download and execute a file, create a remote shell, take a screenshot). It can be used to automate tasks on the compromised computer or to automatically control several affected computers at once. We have seen six versions of the backdoor, with a range of supported commands, evolve since 2016.
Internal MISP references
UUID 22d61347-4d89-41e7-89dc-95b1f370522d which can be used as unique global reference for BalkanDoor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BalkanRAT
The goal of BalkanRAT which is a more complex part of the malicious Balkan-toolset (cf. BalkanDoor) is to deploy and leverage legitimate commercial software for remote administration. The malware has several additional components to help load, install and conceal the existence of the remote desktop software. A single long-term campaign involving BalkanRAT has been active at least from January 2016 and targeted accouting departments of organizations in Croatia, Serbia, Montenegro, and Bosnia and Herzegovina (considered that the contents of the emails, included links and decoy PDFs all were involving taxes). It was legitimaly signed and installed by an exploit of the WinRAR ACE vulnerability (CVE-2018-20250).
Internal MISP references
UUID d7b40333-a2ce-423d-9052-51b09bf18bb3 which can be used as unique global reference for BalkanRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bamital
Internal MISP references
UUID f355f41b-a6b2-48b7-9c5c-da99a41cb1ad which can be used as unique global reference for Bamital in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bamital - webarchive
- https://blogs.microsoft.com/blog/2013/02/22/bamital-botnet-takedown-is-successful-cleanup-underway/ - webarchive
- https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/trojan-bamital-13-en.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Banatrix
Internal MISP references
UUID 721fe429-f240-4fd6-a5c9-187195624b51 which can be used as unique global reference for Banatrix in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
bancos
Internal MISP references
UUID a2ee2f24-ead8-4415-b777-7190478a620c which can be used as unique global reference for bancos in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bandit Stealer
Internal MISP references
UUID 53ef2273-0e62-4ad3-bcbc-d2cd72fc6108 which can be used as unique global reference for Bandit Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bandit - webarchive
- https://www.trendmicro.com/en_in/research/23/e/new-info-stealer-bandit-stealer-targets-browsers-wallets.html - webarchive
- https://research.openanalysis.net/bandit/stealer/garble/go/obfuscation/2023/07/31/bandit-garble.html - webarchive
- https://research.openanalysis.net/garble/go/obfuscation/strings/2023/08/03/garble.html - webarchive
- https://www.cloudsek.com/blog/breaking-into-the-bandit-stealer-malware-infrastructure - webarchive
- https://www.zscaler.com/blogs/security-research/technical-analysis-bandit-stealer - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bandook
Bandook malware is a remote access trojan (RAT) first seen in 2007 and has been active for several years. Written in both Delphi and C++, it was first seen as a commercial RAT developed by a Lebanese creator named PrinceAli. Over the years, several variants of Bandook were leaked online, and the malware became available for public download.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Bandook.
| Known Synonyms |
|---|
Bandok |
Internal MISP references
UUID 3144e23d-6e3e-47e6-8f0e-a47be25d1041 which can be used as unique global reference for Bandook in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bandook - webarchive
- https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf - webarchive
- https://research.checkpoint.com/2020/bandook-signed-delivered/ - webarchive
- https://www.eff.org/files/2018/01/29/operation-manul.pdf - webarchive
- https://www.eff.org/deeplinks/2020/12/dark-caracal-you-missed-spot - webarchive
- https://www.eff.org/deeplinks/2023/02/uncle-sow-dark-caracal-latin-america - webarchive
- https://twitter.com/malwrhunterteam/status/796425285197561856 - webarchive
- https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving - webarchive
- https://www.welivesecurity.com/2021/07/07/bandidos-at-large-spying-campaign-latin-america/ - webarchive
- https://research.checkpoint.com/2020/bandook-signed-delivered - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/new-threat-actor-uses-spanish-language-lures-distribute-seldom-observed-bandook - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
bangat
Internal MISP references
UUID 5c3c53ff-c81f-4daa-9b60-672650046ed7 which can be used as unique global reference for bangat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Banjori
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Banjori.
| Known Synonyms |
|---|
BackPatcher |
BankPatch |
MultiBanker 2 |
Internal MISP references
UUID 137cde28-5c53-489b-ad0b-d0fa2e342324 which can be used as unique global reference for Banjori in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bankshot
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Bankshot.
| Known Synonyms |
|---|
COPPERHEDGE |
FoggyBrass |
Internal MISP references
UUID bc67677c-c0e7-4fb1-8619-7f43fa3ff886 which can be used as unique global reference for Bankshot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bankshot - webarchive
- https://blog.reversinglabs.com/blog/hidden-cobra - webarchive
- https://malverse.it/analisi-bankshot-copperhedge - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-108a - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a - webarchive
- https://www.us-cert.gov/ncas/analysis-reports/ar20-133a - webarchive
- https://www.virusbulletin.com/uploads/pdf/magazine/2018/VB2018-Kalnai-Poslusny.pdf - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/nickel-gladstone - webarchive
- https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF - webarchive
- https://securelist.com/the-lazarus-group-deathnote-campaign/109490/ - webarchive
- https://securelist.com/it-threat-evolution-q2-2023/110355/ - webarchive
- https://vblocalhost.com/uploads/VB2021-Park.pdf - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-108A-TraderTraitor-North_Korea_APT_Targets_Blockchain_Companies.pdf - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa22-108a - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BanPolMex RAT
BanPolMex is a remote access trojan that uses TCP for communication.
It uses an RC4-like stream cipher called Spritz for encryption of its configuration and network traffic.
It sends detailed information about the victim's environment, like computer name, Windows version, free space of memory and all drives, processor identifier and architecture, system locale, system metrics, manufacturer, and network configuration.
It supports almost 30 commands that include operations on the victim’s filesystem, basic process management, file exfiltration, and the download and execution of additional tools from the attacker’s C&C server. As in many RATs from Lazarus arsenal, the commands are indexed by 32-bit integers. However, in this case the indicis are convertible into a meaningful ASCII representation, that even suggests the functionality: SLEP, HIBN, DRIV, DIR, DIRP, CHDR, RUN, RUNX, DEL, WIPE, MOVE, FTIM, NEWF, DOWN, ZDWN, UPLD, PVEW, PKIL, CMDL, DIE, GCFG, SCFG, TCON, PEEX, PEIN.
It has aclui.dll as the internal DLL name. It contains statically linked code from open-source libraries like libcurl (version 7.47.1) or zLib (version 0.15).
BanPolMex RAT was delivered for victims of a watering hole campaign targeting employees of Polish and Mexican banks, that was discovered in February 2017. It is usually loaded by HOTWAX.
Internal MISP references
UUID 95d699dc-d19e-47a7-9d38-fef5008ce891 which can be used as unique global reference for BanPolMex RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Barb(ie) Downloader
Internal MISP references
UUID dbf9d453-cf02-4861-ab90-f65bb77d5971 which can be used as unique global reference for Barb(ie) Downloader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BarbWire
Internal MISP references
UUID 7e68e486-08a8-4d09-997f-2b844cf86fc2 which can be used as unique global reference for BarbWire in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
barkiofork
Internal MISP references
UUID d2cdaceb-7810-4c80-9a69-0a6f27832725 which can be used as unique global reference for barkiofork in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bart
Internal MISP references
UUID 1dfd3ba6-7f82-407f-958d-c4a2ac055123 which can be used as unique global reference for Bart in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bart - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BatchWiper
Internal MISP references
UUID b74747e0-59ac-4adf-baac-78213a234ff5 which can be used as unique global reference for BatchWiper in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Batel
Internal MISP references
UUID 3900aa45-a7ff-48cc-9ac0-58c7c372991e which can be used as unique global reference for Batel in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BATLOADER
According to PCrisk, BATLOADER is part of the infection chain where it is used to perform the initial compromise. This malware is used to execute payloads like Ursnif. Our team has discovered BATLOADER after executing installers for legitimate software (such as Zoom, TeamViewer Visual Studio) bundled with this malware. We have found those installers on compromised websites.
Internal MISP references
UUID ce6fe6c6-a74a-4cf7-adf8-41b5433bcbb6 which can be used as unique global reference for BATLOADER in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bat_loader - webarchive
- https://www.esentire.com/blog/batloader-continues-signed-msix-app-package-abuse - webarchive
- https://www.seqrite.com/blog/decoding-batloader-2-x-unmasking-the-threat-of-stealthy-malware-tactics/ - webarchive
- https://www.esentire.com/blog/batloader-continues-to-abuse-google-search-ads-to-deliver-vidar-stealer-and-ursnif - webarchive
- https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html - webarchive
- https://www.kroll.com/en/insights/publications/cyber/hive-ransomware-technical-analysis-initial-access-discovery - webarchive
- https://www.trendmicro.com/en_us/research/23/h/batloader-campaigns-use-pyarmor-pro-for-evasion.html - webarchive
- https://www.trendmicro.com/en_us/research/23/a/batloader-malware-abuses-legitimate-tools-uses-obfuscated-javasc.html - webarchive
- https://intel471.com/blog/malvertising-surges-to-distribute-malware - webarchive
- https://insight-jp.nttsecurity.com/post/102i7af/steelclovergoogle - webarchive
- https://medium.com/walmartglobaltech/signed-dll-campaigns-as-a-service-7760ac676489 - webarchive
- https://medium.com/walmartglobaltech/revisiting-batloader-c2-structure-52f46ff9893a - webarchive
- https://www.mandiant.com/resources/seo-poisoning-batloader-atera - webarchive
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-batloader - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BazarBackdoor
BazarBackdoor is a small backdoor, probably by a TrickBot "spin-off" like anchor. Its called team9 backdoor (and the corresponding loader: team9 restart loader).
For now, it exclusively uses Emercoin domains (.bazar), thus the naming. FireEye uses KEGTAP as name for BazarLoader and BEERBOT for BazarBackdoor.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BazarBackdoor.
| Known Synonyms |
|---|
BEERBOT |
KEGTAP |
Team9Backdoor |
bazaloader |
bazarloader |
Internal MISP references
UUID 3b1a6ba7-9617-4413-a4ad-66f5d9870bb7 which can be used as unique global reference for BazarBackdoor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bazarbackdoor - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.cyberscoop.com/trickbot-shutdown-conti-emotet/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf - webarchive
- https://twitter.com/anthomsec/status/1321865315513520128 - webarchive
- https://johannesbader.ch/blog/the-buggy-dga-of-bazarbackdoor/ - webarchive
- https://documents.trendmicro.com/assets/rpt/rpt-navigating-new-frontiers-trend-micro-2021-annual-cybersecurity-report.pdf - webarchive
- https://www.cybereason.com/blog/cybereason-vs.-ryuk-ransomware - webarchive
- https://www.advanced-intel.com/post/anatomy-of-attack-inside-bazarbackdoor-to-ryuk-ransomware-one-group-via-cobalt-strike - webarchive
- https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/ - webarchive
- https://blog.prevailion.com/wizard-spider-continues-to-confound-4298370f6903 - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.zscaler.com/blogs/security-research/new-trickbot-and-bazarloader-campaigns-use-multiple-delivery-vectors - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-ransomware-attacks-continue - webarchive
- https://www.hhs.gov/sites/default/files/bazarloader.pdf - webarchive
- https://cocomelonc.github.io/tutorial/2022/06/12/malware-pers-7.html - webarchive
- https://isc.sans.edu/diary/27308 - webarchive
- https://mal-eats.net/2021/05/10/campo_new_attack_campaign_targeting_japan/ - webarchive
- https://thedfirreport.com/2021/03/08/bazar-drops-the-anchor/ - webarchive
- https://blogs.vmware.com/networkvirtualization/2020/11/trick-or-threat-ryuk-ransomware-targets-the-health-care-industry.html/ - webarchive
- https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group - webarchive
- https://research.nccgroup.com/2022/04/29/adventures-in-the-land-of-bumblebee-a-new-malicious-loader/ - webarchive
- https://www.youtube.com/watch?v=pIXl79IPkLI - webarchive
- https://elis531989.medium.com/highway-to-conti-analysis-of-bazarloader-26368765689d - webarchive
- https://unit42.paloaltonetworks.com/api-hammering-malware-families/ - webarchive
- https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/ - webarchive
- https://storage.pardot.com/652283/16118467480sqebwq7/MSP_Security_SummitJohnHammond_Huntress_Analyzing_Ryuk.pdf - webarchive
- https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html - webarchive
- https://www.hornetsecurity.com/en/threat-research/bazarloader-campaign-with-fake-termination-emails/ - webarchive
- https://www.cybereason.com/blog/cybereason-vs.-conti-ransomware - webarchive
- https://www.microsoft.com/security/blog/2021/07/29/bazacall-phony-call-centers-lead-to-exfiltration-and-ransomware/ - webarchive
- https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ - webarchive
- https://unit42.paloaltonetworks.com/bumblebee-malware-projector-libra/ - webarchive
- https://blog.minerva-labs.com/slamming-the-backdoor-on-bazarloader - webarchive
- https://www.trendmicro.com/en_us/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict.html - webarchive
- https://malwarebookreports.com/a-look-back-at-bazarloaders-dga/ - webarchive
- https://www.area1security.com/blog/trickbot-spear-phishing-drops-bazar-buer-malware/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ - webarchive
- https://www.bleepingcomputer.com/news/security/corporate-website-contact-forms-used-to-spread-bazarbackdoor-malware/ - webarchive
- https://news.sophos.com/en-us/2021/04/15/bazarloader-deploys-a-pair-of-novel-spam-vectors - webarchive
- https://www.0ffset.net/reverse-engineering/analysing-the-main-bazarloader/ - webarchive
- https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/ - webarchive
- https://pcsxcetrasupport3.wordpress.com/2021/11/16/excel-4-macro-code-obfuscation/ - webarchive
- https://www.fortinet.com/blog/threat-research/new-bazar-trojan-variant-is-being-spread-in-recent-phishing-campaign-part-I - webarchive
- https://www.crowdstrike.com/blog/four-popular-defensive-evasion-techniques-in-2021/ - webarchive
- https://www.gosecure.net/blog/2021/02/01/bazarloader-mocks-researchers-in-december-2020-malspam-campaign/ - webarchive
- https://public.intel471.com/blog/trickbot-update-november-2020-bazar-loader-microsoft/ - webarchive
- https://johannesbader.ch/blog/the-dga-of-bazarbackdoor/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://thehackernews.com/2022/02/trickbot-gang-likely-shifting.html - webarchive
- https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/group-behind-trickbot-spreads-fileless-bazarbackdoor - webarchive
- https://securityintelligence.com/posts/trickbot-gang-template-based-metaprogramming-bazar-malware/ - webarchive
- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://malwarebookreports.com/bazarloader-back-from-holiday-break/ - webarchive
- https://www.esentire.com/blog/conti-affiliate-exposed-new-domain-names-ip-addresses-and-email-addresses-uncovered-by-esentire - webarchive
- https://medium.com/walmartglobaltech/decrypting-bazarloader-strings-with-a-unicorn-15d2585272a9 - webarchive
- https://kienmanowar.wordpress.com/2022/02/24/quicknote-techniques-for-decrypting-bazarloader-strings/ - webarchive
- https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles - webarchive
- https://www.hornetsecurity.com/en/threat-research/bazarloaders-elaborate-flower-shop-lure/ - webarchive
- https://thehackernews.com/2022/02/notorious-trickbot-malware-gang-shuts.html - webarchive
- https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html - webarchive
- https://unit42.paloaltonetworks.com/bazarloader-network-reconnaissance/ - webarchive
- https://www.youtube.com/watch?v=uAkeXCYcl4Y - webarchive
- https://unit42.paloaltonetworks.com/bazarloader-anti-analysis-techniques/ - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/bazarbackdoor-sneaks-in-through-nested-rar-and-zip-archives/ - webarchive
- https://unit42.paloaltonetworks.com/luna-moth-callback-phishing/ - webarchive
- https://www.crowdstrike.com/blog/wizard-spider-adversary-update/ - webarchive
- https://unit42.paloaltonetworks.com/ryuk-ransomware/ - webarchive
- https://resource.redcanary.com/rs/003-YRU-314/images/2022_ThreatDetectionReport_RedCanary.pdf - webarchive
- https://twitter.com/Unit42_Intel/status/1458113934024757256 - webarchive
- https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html - webarchive
- https://forensicitguy.github.io/bazariso-analysis-advpack/ - webarchive
- https://johannesbader.ch/blog/next-version-of-the-bazarloader-dga/ - webarchive
- https://thedfirreport.com/2021/01/31/bazar-no-ryuk/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/baza-valentines-day - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/research/evolution-of-bazarcall-social-engineering-tactics.html - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0118.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/bazarbackdoor-trickbot-gang-s-new-stealthy-network-hacking-malware/ - webarchive
- https://unit42.paloaltonetworks.com/bazarloader-malware/ - webarchive
- https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/ - webarchive
- https://github.com/ThreatConnect-Inc/research-team/blob/master/IOCs/WizardSpider-UNC1878-Ryuk.csv - webarchive
- https://www.bleepingcomputer.com/news/security/karakurt-revealed-as-data-extortion-arm-of-conti-cybercrime-syndicate/ - webarchive
- https://www.bleepingcomputer.com/news/security/cisa-updates-conti-ransomware-alert-with-nearly-100-domain-names/ - webarchive
- https://intel471.com/blog/conti-leaks-ransomware-development - webarchive
- https://www.intel471.com/blog/Cobalt-strike-cybercriminals-trickbot-qbot-hancitor - webarchive
- https://www.trendmicro.com/en_us/research/21/d/a-spike-in-bazarcall-and-icedid-activity.html - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://abnormalsecurity.com/blog/bazarloader-contact-form - webarchive
- https://www.0ffset.net/reverse-engineering/bazarloader-iso-file-infection/ - webarchive
- https://www.microsoft.com/en-us/security/blog/2021/07/29/bazacall-phony-call-centers-lead-to-exfiltration-and-ransomware/ - webarchive
- https://cofense.com/blog/bazarbackdoor-stealthy-infiltration - webarchive
- https://thedfirreport.com/2021/09/13/bazarloader-to-conti-ransomware-in-32-hours/ - webarchive
- https://thedfirreport.com/2021/12/13/diavol-ransomware/ - webarchive
- https://www.advanced-intel.com/post/front-door-into-bazarbackdoor-stealthy-cybercrime-weapon - webarchive
- https://cofense.com/the-ryuk-threat-why-bazarbackdoor-matters-most/ - webarchive
- https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/ - webarchive
- https://attackiq.com/2022/06/15/attack-graph-emulating-the-conti-ransomware-teams-behaviors/ - webarchive
- https://www.cybereason.com/hubfs/A%20Bazar%20of%20Tricks%20Following%20Team9%E2%80%99s%20Development%20Cycles%20IOCs.pdf - webarchive
- https://experience.mandiant.com/trending-evil/p/1 - webarchive
- https://www.mandiant.com/resources/fin12-ransomware-intrusion-actor-pursuing-healthcare-targets - webarchive
- https://thedfirreport.com/2020/10/08/ryuks-return/ - webarchive
- https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti - webarchive
- https://fr3d.hk/blog/campo-loader-simple-but-effective - webarchive
- https://us-cert.cisa.gov/sites/default/files/publications/AA20-302A_Ransomware%20_Activity_Targeting_the_Healthcare_and_Public_Health_Sector.pdf - webarchive
- https://www.zscaler.com/blogs/research/spear-phishing-campaign-delivers-buer-and-bazar-malware - webarchive
- https://securityintelligence.com/posts/trickbot-gang-doubles-down-enterprise-infection/ - webarchive
- https://www.scythe.io/library/threatthursday-ryuk - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://blog.fox-it.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/ - webarchive
- https://johannesbader.ch/blog/yet-another-bazarloader-dga/ - webarchive
- https://intel471.com/blog/ettersilent-maldoc-builder-macro-trickbot-qbot/ - webarchive
- https://johannesbader.ch/blog/a-bazarloader-dga-that-breaks-during-summer-months/ - webarchive
- https://www.domaintools.com/resources/blog/tracking-a-trickbot-related-ransomware-incident - webarchive
- https://cybersecurity.att.com/blogs/labs-research/trickbot-bazarloader-in-depth - webarchive
- https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/ - webarchive
- https://blog.bushidotoken.net/2022/04/lessons-from-conti-leaks.html - webarchive
- https://www.bleepingcomputer.com/news/security/malicious-csv-text-files-used-to-install-bazarbackdoor-malware/ - webarchive
- https://medium.com/walmartglobaltech/nimar-loader-4f61c090c49e - webarchive
- https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/ - webarchive
- https://cocomelonc.github.io/tutorial/2021/09/04/simple-malware-av-evasion.html - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware - webarchive
- https://www.trendmicro.com/en_us/research/21/k/bazarloader-adds-compromised-installers-iso-to-arrival-delivery-vectors.html - webarchive
- https://twitter.com/Unit42_Intel/status/1421117403644186629?s=20 - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/rise-of-lnk-shortcut-files-malware/ - webarchive
- https://www.fortinet.com/blog/threat-research/new-bazar-trojan-variant-is-being-spread-in-recent-phishing-campaign-part-II - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BazarNimrod
A rewrite of Bazarloader in the Nim programming language.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BazarNimrod.
| Known Synonyms |
|---|
NimzaLoader |
Internal MISP references
UUID 1735a331-9ca9-49b6-a5aa-0ddac9db8de6 which can be used as unique global reference for BazarNimrod in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bazarnimrod - webarchive
- https://umbrella.cisco.com/blog/cybersecurity-threat-spotlight-backdoors-rats-loaders-evasion-techniques - webarchive
- https://medium.com/walmartglobaltech/nimar-loader-4f61c090c49e - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/nimzaloader-ta800s-new-initial-access-malware - webarchive
- https://medium.com/walmartglobaltech/investigation-into-the-state-of-nim-malware-14cc543af811 - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-old-dogs-new-tricks.pdf - webarchive
- https://www.healthcareinfosecurity.com/spear-phishing-campaign-distributes-nim-based-malware-a-16176 - webarchive
- https://twitter.com/James_inthe_box/status/1357009652857196546 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BBSRAT
Internal MISP references
UUID cad1d6db-3a6c-4d67-8f6e-627d8a168d6a which can be used as unique global reference for BBSRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bbsrat - webarchive
- https://www.sstic.org/media/SSTIC2020/SSTIC-actes/pivoter_tel_bernard_ou_comment_monitorer_des_attaq/SSTIC2020-Slides-pivoter_tel_bernard_ou_comment_monitorer_des_attaquants_ngligents-lunghi.pdf - webarchive
- https://www.youtube.com/watch?v=uakw2HMGZ-I - webarchive
- https://cocomelonc.github.io/tutorial/2022/05/09/malware-pers-4.html - webarchive
- https://medium.com/insomniacs/shadows-with-a-chance-of-blacknix-badc0f2f41cb - webarchive
- https://researchcenter.paloaltonetworks.com/2016/03/digital-quartermaster-scenario-demonstrated-in-attacks-against-the-mongolian-government/ - webarchive
- https://medium.com/insomniacs/shadows-in-the-rain-a16efaf21aae - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BBtok
360 Security Center describes BBtok as a banking trojan targeting Mexico.
Internal MISP references
UUID 0b114f49-8c4d-425d-8426-a0c4ab145f36 which can be used as unique global reference for BBtok in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bbtok - webarchive
- https://research.checkpoint.com/2023/behind-the-scenes-of-bbtok-analyzing-a-bankers-server-side-components/ - webarchive
- https://blog.360totalsecurity.com/en/360-file-less-attack-protection-intercepts-the-banker-trojan-bbtok-active-in-mexico/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Beapy
According to Symantec, Beapy is a cryptojacking campaign impacting enterprises that uses the EternalBlue exploit and stolen and hardcoded credentials to spread rapidly across networks.
Internal MISP references
UUID 404e8121-bced-4320-a984-2b490fad90f8 which can be used as unique global reference for Beapy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BEATDROP
According to Mandiant, BEATDROP is a downloader written in C that uses Atlassian's project management service Trello for C&C. BEATDROP uses Trello to store victim information and retrieve AES-encrypted shellcode payloads to be executed. BEATDROP then injects and executes downloaded payloads into a suspended process. Upon execution, BEATDROP maps a copy of ntdll.dll into memory to execute shellcode in its own process. The sample then creates a suspended thread with RtlCreateUserThread the thread points to NtCreateFile. The sample changes execution to shellcode and resumes the thread. The shellcode payload is retrieved from Trello and is targeted per victim. Once the payload has been retrieved, it is deleted from Trello.
Internal MISP references
UUID d2fd10ba-5904-4679-8758-509b72b1aa2c which can be used as unique global reference for BEATDROP in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.beatdrop - webarchive
- https://r136a1.info/2022/07/19/a-look-into-apt29s-new-early-stage-google-drive-downloader/ - webarchive
- https://www.mandiant.com/resources/blog/tracking-apt29-phishing-campaigns - webarchive
- https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA%3D%3D&mid=2247494783&idx=1&sn=612cf3cea1ef62e04bfb6bd0ce3b6b65&chksm=f9ed80c0ce9a09d6f5edc1424df5260cb9a9cf55fe92bd922407eef960650e91ec8cc46933ab&scene=178&cur_album_id=1375769135073951745 - webarchive
- https://www.incibe-cert.es/sites/default/files/contenidos/estudios/doc/incibe-cert_estudio_analisis_nobelium_2022_v1.pdf - webarchive
- https://mrtiepolo.medium.com/sophisticated-apt29-campaign-abuses-notion-api-to-target-the-european-commission-200188059f58 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bedep
Bedep has been mostly observed in ad-fraud campaigns, although it can also generally load modules for different tasks. It was dropped by the Angler Exploit Kit.
Internal MISP references
UUID af338ac2-8103-4419-8393-fb4f3b43af4b which can be used as unique global reference for Bedep in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bedep - webarchive
- https://sentrant.com/2015/05/20/bedep-ad-fraud-botnet-analysis-exposing-the-mechanics-behind-153-6m-defrauded-ad-impressions-a-day/index.html - webarchive
- http://malware-traffic-analysis.net/2016/05/09/index.html - webarchive
- https://blog.talosintelligence.com/bedep-actor/ - webarchive
- https://malware.dontneedcoffee.com/2016/04/bedepantiVM.html - webarchive
- https://web.archive.org/web/20150524032716/http://asert.arbornetworks.com/bedeps-dga-trading-foreign-exchange-for-malware-domains/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bee
Malware family observed in conjunction with PlugX infrastructure in 2013.
Internal MISP references
UUID 2d4aacb7-392a-46fd-b93d-33fcdaeb348f which can be used as unique global reference for Bee in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
beendoor
BEENDOOR is a XMPP based trojan. It is capable of taking screenshots of the victim's desktop.
Internal MISP references
UUID e2dca2b5-7ca0-4654-ae3d-91dab60dfd90 which can be used as unique global reference for beendoor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BeepService
Internal MISP references
UUID 1732faab-2cf9-4d79-a085-6331da008047 which can be used as unique global reference for BeepService in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Belonard
Once set up in the system, Trojan.Belonard replaces the list of available game servers in the game client and creates proxies on the infected computer to spread the Trojan. As a rule, proxy servers show a lower ping, so other players will see them at the top of the list. By selecting one of them, a player gets redirected to a malicious server where their computer become infected with Trojan.Belonard.
Internal MISP references
UUID 40c48c99-7d33-4f35-92f1-937c3686afa7 which can be used as unique global reference for Belonard in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Berbomthum
Internal MISP references
UUID 6944cbe7-db95-422d-8751-98c9fc4f0b12 which can be used as unique global reference for Berbomthum in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BernhardPOS
Internal MISP references
UUID e59d1d3a-6c23-4684-8be1-2f182f63ab41 which can be used as unique global reference for BernhardPOS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BestKorea
Internal MISP references
UUID 33308a2c-b1ef-4cbb-9240-25cb6dce55a9 which can be used as unique global reference for BestKorea in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BetaBot
Cybereason concludes that Betabot is a sophisticated infostealer malware that’s evolved significantly since it first appeared in late 2012. The malware began as a banking Trojan and is now packed with features that allow its operators to practically take over a victim’s machine and steal sensitive information.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BetaBot.
| Known Synonyms |
|---|
Neurevt |
Internal MISP references
UUID 837c5618-69dc-4817-8672-b3d7ae644f5c which can be used as unique global reference for BetaBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.betabot - webarchive
- http://resources.infosecinstitute.com/beta-bot-analysis-part-1/#gref - webarchive
- https://news.sophos.com/en-us/2020/05/14/raticate/ - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/BetaBot.pdf?la=en - webarchive
- https://news.sophos.com/en-us/2020/07/14/raticate-rats-as-service-with-commercial-crypter/?cmp=30728 - webarchive
- https://krabsonsecurity.com/2022/03/28/betabot-in-the-rearview-mirror/ - webarchive
- https://securelist.com/financial-cyberthreats-in-2020/101638/ - webarchive
- https://www.cybereason.com/blog/betabot-banking-trojan-neurevt - webarchive
- https://medium.com/@woj_ciech/betabot-still-alive-with-multi-stage-packing-fbe8ef211d39 - webarchive
- https://www.ccn-cert.cni.es/seguridad-al-dia/comunicados-ccn-cert/6087-betabot-y-fleercivet-dos-nuevos-informes-de-codigo-danino-del-ccn-cert.html - webarchive
- http://www.malwaredigger.com/2013/09/how-to-extract-betabot-config-info.html - webarchive
- http://www.xylibox.com/2015/04/betabot-retrospective.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bezigate
Bezigate is a Trojan horse that opens a back door on the compromised computer. It may also download potentially malicious files.
The Trojan may perform the following actions: List, move, and delete drives List, move, and delete files List processes and running Windows titles List services List registry values Kill processes Maximize, minimize, and close windows Upload and download files Execute shell commands Uninstall itself
Internal MISP references
UUID 29f45180-cb57-4655-8812-eb814c2a0b0e which can be used as unique global reference for Bezigate in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BfBot
Internal MISP references
UUID 95b454f6-8ffb-4ef7-8a91-14d48601a899 which can be used as unique global reference for BfBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BHunt
BHunt collects the crypto wallets of its victims. The malware consists of several functions/modules, e.g. a reporting module that reports the presence of crypto wallets on the target computers to the C2 server. It searches for many different cryptocurrencies (e.g. Atomic, Bitcoin, Electrum, Ethereum, Exodus, Jaxx and Litecoin). The Blackjack module is used to steal wallets, Sweet_Bonanza steals victims' browser passwords. There are also modules like the Golden7 or the Chaos_crew module.
Internal MISP references
UUID ae3fe9fa-0717-413e-94fe-6e7b607e45c6 which can be used as unique global reference for BHunt in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bhunt - webarchive
- https://blogs.blackberry.com/en/2022/02/threat-thursday-bhunt-scavenger - webarchive
- https://www.bleepingcomputer.com/news/security/new-bhunt-malware-targets-your-crypto-wallets-and-passwords/ - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/411/Bitdefender-PR-Whitepaper-CyberWallet-creat5874-en-EN.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BianLian (Windows)
BianLian is a GoLang-based ransomware that continues to breach several industries and demand large ransom amounts. The threat actors also use the double extortion method by stealing an affected organization’s files and leaking them online if the ransom is not paid on time. BianLian gains access to victim systems through valid Remote Desktop Protocol (RDP) credentials, uses open-source tools and command-line scripting for discovery and credential harvesting, and exfiltrates victim data via File Transfer Protocol (FTP), Rclone, or Mega. BianLian originally employed a double-extortion model in which they encrypted victims’ systems after exfiltrating the data; however, around January 2023, they shifted to primarily exfiltration-based extortion. The BianLian ransomware uses goroutines and encrypts files in chunks to quickly hijack an infected system. The ransomware adds its own extension to each encrypted file.
Internal MISP references
UUID fcc016ad-41a0-4bda-ad88-9542b5f560d9 which can be used as unique global reference for BianLian (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bianlian - webarchive
- https://twitter.com/malwrhunterteam/status/1558548947584548865 - webarchive
- https://blogs.blackberry.com/en/2022/10/bianlian-ransomware-encrypts-files-in-the-blink-of-an-eye - webarchive
- https://embee-research.ghost.io/practical-queries-for-malware-infrastructure-part-3/ - webarchive
- https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/ - webarchive
- https://embee-research.ghost.io/building-advanced-censys-queries-utilising-regex-bianlian/ - webarchive
- https://blog.cyble.com/2022/08/18/bianlian-new-ransomware-variant-on-the-rise/ - webarchive
- https://www.bleepingcomputer.com/news/security/march-2023-broke-ransomware-attack-records-with-459-incidents/ - webarchive
- https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BI_D Ransomware
Small and relatively simple ransomware for Windows. Gives files the .BI_D extension after encrypting them with a combination of RSA/AES. Persistence achieved via the Windows Registry. Kills all processes on the victim machine besides itself and a small whitelist of mostly Windows sytem processes and kills shadow copies.
Internal MISP references
UUID 9f80bebb-dc5d-4cc1-b2dc-16bca1bbfaad which can be used as unique global reference for BI_D Ransomware in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
bifrose
Internal MISP references
UUID 47e654af-8b94-4b97-a2ea-6a28c1bc8099 which can be used as unique global reference for bifrose in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bifrose - webarchive
- https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/bifrose-now-more-evasive-through-tor-used-for-targeted-attack/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BillGates
BillGates is a modularized malware, of supposedly Chinese origin. Its main functionality is to perform DDoS attacks, with support for DNS amplification. Often, BillGates is delivered with one or many backdoor modules.
BillGates is available for *nix-based systems as well as for Windows.
On Windows, the (Bill)Gates installer typically contains the various modules as linked resources.
Internal MISP references
UUID 42ed9fc4-08ba-4c1c-bf15-d789ee4e3ca6 which can be used as unique global reference for BillGates in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.billgates - webarchive
- https://www.bleepingcomputer.com/news/security/log4shell-exploits-now-used-mostly-for-ddos-botnets-cryptominers/ - webarchive
- https://habrahabr.ru/post/213973/ - webarchive
- https://bartblaze.blogspot.com/2017/12/notes-on-linuxbillgates.html - webarchive
- https://thisissecurity.stormshield.com/2015/09/30/when-elf-billgates-met-windows/ - webarchive
- https://www.akamai.com/kr/ko/multimedia/documents/state-of-the-internet/bill-gates-botnet-threat-advisory.pdf - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2015/KalnaiHorejsi-VB2015.pdf - webarchive
- https://securelist.com/versatile-ddos-trojan-for-linux/64361/ - webarchive
- https://www.fortinet.com/blog/threat-research/recent-attack-uses-vulnerability-on-confluence-server - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Binanen
Binanen is a dropper that drops and executes a section of itself into a hidden dummy process. According to F-Secure, it executes command line tools such as (for example) asipconfig, which is useful to retrieve the network configuration. The malware aims to steal information about the machine, the username, installed software and, more generally speaking, it potentially can carry out actions on the compromised machine.
Internal MISP references
UUID a76a35e4-6ef7-45ad-9656-98584835d910 which can be used as unique global reference for Binanen in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BioData
Internal MISP references
UUID 96bcaa83-998b-4fb2-a4e7-a2d33c6427d7 which can be used as unique global reference for BioData in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.biodata - webarchive
- https://unit42.paloaltonetworks.com/unit42-recent-inpage-exploits-lead-multiple-malware-families/ - webarchive
- https://securelist.com/inpage-zero-day-exploit-used-to-attack-financial-institutions-in-asia/76717/ - webarchive
- https://ti.qianxin.com/blog/articles/analysis-of-targeted-attack-against-pakistan-by-exploiting-inpage-vulnerability-and-related-apt-groups-english/ - webarchive
- https://ti.360.net/blog/articles/analysis-of-targeted-attack-against-pakistan-by-exploiting-inpage-vulnerability-and-related-apt-groups-english/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
bioload
Internal MISP references
UUID 04803315-fc17-44d0-839e-534b9da4c7fc which can be used as unique global reference for bioload in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BIOPASS
BIOPASS RAT is a malware family which targets online gambling companies in China by leveraging a watering hole attack. This Remote Access Trojan (RAT) is unique in that it leverages the Open Broadcaster Software (OBS) framework to monitor the user's screen.
Internal MISP references
UUID f3cdfef4-7976-42f9-8b5e-a67d4a62b5c1 which can be used as unique global reference for BIOPASS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.biopass - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf - webarchive
- https://www.trendmicro.com/en_us/research/21/g/biopass-rat-new-malware-sniffs-victims-via-live-streaming.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Biscuit
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Biscuit.
| Known Synonyms |
|---|
zxdosml |
Internal MISP references
UUID f98b4092-5f32-407c-9015-2da787d70c64 which can be used as unique global reference for Biscuit in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BISTROMATH
Internal MISP references
UUID fa8b2a91-ec55-41cc-b5f6-3d233cc3cc65 which can be used as unique global reference for BISTROMATH in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bistromath - webarchive
- https://ti.qianxin.com/blog/articles/Analysis-of-attacks-by-Lazarus-using-Daewoo-shipyard-as-bait/ - webarchive
- https://labs.sentinelone.com/dprk-hidden-cobra-update-north-korean-malicious-cyber-activity/ - webarchive
- https://www.us-cert.gov/ncas/analysis-reports/ar20-045a - webarchive
- https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/ - webarchive
- https://blog.malwarebytes.com/malwarebytes-news/2021/04/lazarus-apt-conceals-malicious-code-within-bmp-file-to-drop-its-rat/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BitPyLock
Bitpylock is a ransomware that encrypts files by using asymmetric keys and puts '.bitpy' as suffix once the encryption phase ended. The ransom note appears on the affected user's Desktop with the following name: "# # HELP_TO_DECRYPT_YOUR_FILES # .html". At the time of writing the ransom request is 0.8 BTC and the communication email is: helpbitpy@cock.li.
Internal MISP references
UUID da5adcc1-9adc-4e86-9034-08aafecc14c1 which can be used as unique global reference for BitPyLock in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bitpylock - webarchive
- https://www.bleepingcomputer.com/news/security/bitpylock-ransomware-now-threatens-to-publish-stolen-data/ - webarchive
- https://yomi.yoroi.company/report/5e1d77b371ef016089703d1a/5e1d79d7d1cc4993da62f24f/overview - webarchive
- https://twitter.com/malwrhunterteam/status/1215252402988822529 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bitsran
SHADYCAT is a dropper and spreader component for the HERMES 2.1 RANSOMWARE radical edition.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Bitsran.
| Known Synonyms |
|---|
SHADYCAT |
Internal MISP references
UUID 3e072464-6fa6-4977-9b64-08f86d1062fc which can be used as unique global reference for Bitsran in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bitsran - webarchive
- http://baesystemsai.blogspot.de/2017/10/taiwan-heist-lazarus-tools.html - webarchive
- https://content.fireeye.com/apt/rpt-apt38 - webarchive
- https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug-180129.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bitter RAT
Internal MISP references
UUID 265f96d1-fdd4-4dec-b7ca-51ae6f726634 which can be used as unique global reference for Bitter RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bitter_rat - webarchive
- https://www.forcepoint.com/blog/security-labs/bitter-targeted-attack-against-pakistan - webarchive
- https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh/ - webarchive
- https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html - webarchive
- https://ti.qianxin.com/blog/articles/analysis-of-targeted-attack-against-pakistan-by-exploiting-inpage-vulnerability-and-related-apt-groups-english/ - webarchive
- https://ti.360.net/blog/articles/analysis-of-targeted-attack-against-pakistan-by-exploiting-inpage-vulnerability-and-related-apt-groups-english/ - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/352/Bitdefender-PR-Whitepaper-BitterAPT-creat4571-en-EN-GenericUse.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BitRAT
According to Bitdefender, BitRAT is a notorious remote access trojan (RAT) marketed on underground cybercriminal web markets and forums. Its price tag of $20 for lifetime access makes it irresistible to cybercriminals and helps the malicious payload spread.
Furthermore, each buyer’s modus operandi makes BitRAT even harder to stop, considering it can be employed in various operations, such as trojanized software, phishing and watering hole attacks.
BitRAT’s popularity arises from its versatility. The malicious tool can perform a wide range of operations, including data exfiltration, UAC bypass, DDoS attacks, clipboard monitoring, gaining unauthorized webcam access, credential theft, audio recording, XMRig coin mining and generic keylogging.
Internal MISP references
UUID 8c4363f4-4f38-4a5a-bc87-16f0721bd03b which can be used as unique global reference for BitRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bit_rat - webarchive
- https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware - webarchive
- https://threatresearch.ext.hp.com/wp-content/uploads/2021/03/HP_Bromium_Threat_Insights_Report_Q4_2020.pdf - webarchive
- https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure - webarchive
- https://krabsonsecurity.com/2020/08/22/bitrat-the-latest-in-copy-pasted-malware-by-incompetent-developers/ - webarchive
- https://www.fortinet.com/blog/threat-research/nft-lure-used-to-distribute-bitrat - webarchive
- https://github.com/Finch4/Malware-Analysis-Reports/blob/main/13e0f258cfbe3aece8a7e6d29ceb5697/README.md - webarchive
- https://www.trendmicro.com/en_us/research/21/i/Water-Basilisk-Uses-New-HCrypt-Variant-to-Flood-Victims-with-RAT-Payloads.html - webarchive
- https://asec.ahnlab.com/en/32781/ - webarchive
- https://www.ciphertechsolutions.com/roboski-global-recovery-automation/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities - webarchive
- https://www.trendmicro.com/en_us/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-ameri.html - webarchive
- https://blog.checkpoint.com/2022/05/10/a-german-car-attack-on-german-vehicle-businesses/ - webarchive
- https://unit42.paloaltonetworks.com/nodestealer-2-targets-facebook-business/ - webarchive
- https://forensicitguy.github.io/hcrypt-injecting-bitrat-analysis/ - webarchive
- https://securityintelligence.com/posts/roboski-global-recovery-automation/ - webarchive
- https://krabsonsecurity.com/2020/09/04/bitrat-pt-2-hidden-browser-socks5-proxy-and-unknownproducts-unmasked/ - webarchive
- https://research.checkpoint.com/2021/apomacrosploit-apocalyptical-fud-race/ - webarchive
- https://www.bitdefender.com/blog/hotforsecurity/bitrat-malware-seen-spreading-through-unofficial-microsoft-windows-activators/ - webarchive
- https://www.bleepingcomputer.com/news/security/bitrat-malware-now-spreading-as-a-windows-10-license-activator/ - webarchive
- https://www.youtube.com/watch?v=CYm3g4zkQdw - webarchive
- https://community.riskiq.com/article/ade260c6 - webarchive
- https://isc.sans.edu/forums/diary/A+Zip+Bomb+to+Bypass+Security+Controls+Sandboxes/28670/ - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://blog.morphisec.com/hubfs/Journey%20of%20a%20Crypto%20Scammer%20-%20NFT-001%20%7C%20Morphisec%20%7C%20Threat%20Report.pdf - webarchive
- https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-american-entities-with-commodity-rats/BlindEagleIOCList.txt - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bizzaro
Kaspersky Labs characterizes Bizarro as yet another banking Trojan family originating from Brazil that is now found in other regions of the world. They have seen users being targeted in Spain, Portugal, France and Italy. Attempts have now been made to steal credentials from customers of 70 banks from different European and South American countries.
Internal MISP references
UUID 00fb2087-7e08-4649-ac93-9547deda7aca which can be used as unique global reference for Bizzaro in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BKA Trojaner
BKA Trojaner is a screenlocker ransomware that was active in 2011, displaying a police-themed message in German language.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BKA Trojaner.
| Known Synonyms |
|---|
bwin3_bka |
Internal MISP references
UUID ea06f87c-148c-49e5-afec-7012cb2b4f0a which can be used as unique global reference for BKA Trojaner in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Black Basta (Windows)
"Black Basta" is a new ransomware strain discovered during April 2022 - looks in dev since at least early February 2022 - and due to their ability to quickly amass new victims and the style of their negotiations, this is likely not a new operation but rather a rebrand of a previous top-tier ransomware gang that brought along their affiliates.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Black Basta (Windows).
| Known Synonyms |
|---|
no_name_software |
Internal MISP references
UUID ada47367-7e69-4122-b5c1-4e5aeb54f922 which can be used as unique global reference for Black Basta (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbasta - webarchive
- https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape - webarchive
- https://therecord.media/german-wind-farm-operator-confirms-cybersecurity-incident-after-ransomware-group/ - webarchive
- https://www.trendmicro.com/de_de/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html - webarchive
- https://www.bleepingcomputer.com/news/security/march-2023-broke-ransomware-attack-records-with-459-incidents/ - webarchive
- https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v - webarchive
- https://securityscorecard.pathfactory.com/all/a-deep-dive-into-bla - webarchive
- https://www.trendmicro.com/en_us/research/22/f/black-basta-ransomware-operators-expand-their-attack-arsenal-wit.html - webarchive
- https://securityintelligence.com/posts/black-basta-ransomware-group-besting-network/ - webarchive
- https://securityscorecard.com/research/a-deep-dive-into-black-basta-ransomware - webarchive
- https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/ - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/ - webarchive
- https://www.cybereason.com/blog/threat-alert-aggressive-qakbot-campaign-and-the-black-basta-ransomware-group-targeting-u.s.-companies - webarchive
- https://www.youtube.com/watch?v=iD_KZAqNDZ0 - webarchive
- https://securityintelligence.com/posts/trickbot-conti-crypters-where-are-they-now/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-black-basta-ransomware-springs-into-action-with-a-dozen-breaches/ - webarchive
- https://www.reliaquest.com/blog/qbot-black-basta-ransomware/ - webarchive
- https://www.bleepingcomputer.com/news/security/american-dental-association-hit-by-new-black-basta-ransomware/ - webarchive
- https://gbhackers.com/black-basta-ransomware/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbasta - webarchive
- https://www.zscaler.com/blogs/security-research/back-black-basta - webarchive
- https://assets.sentinelone.com/sentinellabs22/sentinellabs-blackbasta - webarchive
- https://www.kroll.com/en/insights/publications/cyber/black-basta-technical-analysis - webarchive
- https://securelist.com/luna-black-basta-ransomware/106950 - webarchive
- https://www.sentinelone.com/labs/crimeware-trends-ransomware-developers-turn-to-intermittent-encryption-to-evade-detection/ - webarchive
- https://quadrantsec.com/resource/technical-analysis/black-basta-malware-overview - webarchive
- https://www.avertium.com/resources/threat-reports/in-depth-look-at-black-basta-ransomware - webarchive
- https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf - webarchive
- https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/ - webarchive
- https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackByte
Ransomware. Uses dropper written in JavaScript to deploy a .NET payload.
Internal MISP references
UUID c7732221-fbb3-4469-a1c6-260a825b290a which can be used as unique global reference for BlackByte in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbyte - webarchive
- https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape - webarchive
- https://www.trendmicro.com/vinfo/my/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/trellix-global-defenders-analysis-and-protections-for-blackbyte-ransomware.html - webarchive
- https://www.deepinstinct.com/blog/understanding-the-windows-javascript-threat-landscape - webarchive
- https://news.sophos.com/en-us/2022/10/04/blackbyte-ransomware-returns/ - webarchive
- https://www.bleepingcomputer.com/news/security/fbi-blackbyte-ransomware-breached-us-critical-infrastructure/ - webarchive
- https://de.darktrace.com/blog/detecting-the-unknown-revealing-uncategorised-ransomware-using-darktrace - webarchive
- https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure - webarchive
- https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group - webarchive
- https://securelist.com/modern-ransomware-groups-ttps/106824/ - webarchive
- https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/ - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf - webarchive
- https://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt - webarchive
- https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/ - webarchive
- https://twitter.com/splinter_code/status/1628057204954652674 - webarchive
- https://redcanary.com/blog/blackbyte-ransomware/ - webarchive
- https://blog.talosintelligence.com/2022/05/the-blackbyte-ransomware-group-is.html - webarchive
- https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/ - webarchive
- https://www.advintel.io/post/hydra-with-three-heads-blackbyte-the-future-of-ransomware-subsidiary-groups - webarchive
- https://www.zscaler.com/blogs/security-research/analysis-blackbyte-ransomwares-go-based-variants - webarchive
- https://www.ic3.gov/Media/News/2022/220211.pdf - webarchive
- https://therecord.media/san-francisco-49ers-confirm-ransomware-attack/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackCat (Windows)
ALPHV, also known as BlackCat or Noberus, is a ransomware family that is deployed as part of Ransomware as a Service (RaaS) operations. ALPHV is written in the Rust programming language and supports execution on Windows, Linux-based operating systems (Debian, Ubuntu, ReadyNAS, Synology), and VMWare ESXi. ALPHV is marketed as ALPHV on cybercrime forums, but is commonly called BlackCat by security researchers due to an icon of a black cat appearing on its leak site. ALPHV has been observed being deployed in ransomware attacks since November 18, 2021.
ALPHV can be configured to encrypt files using either the AES or ChaCha20 algorithms. In order to maximize the amount of ransomed data, ALPHV can delete volume shadow copies, stop processes and services, and stop virtual machines on ESXi servers. ALPHV can self-propagate by using PsExec to remote execute itself on other hosts on the local network.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BlackCat (Windows).
| Known Synonyms |
|---|
ALPHV |
Noberus |
Internal MISP references
UUID 44109c47-f4ab-41c0-8d18-b93e7dcd8e42 which can be used as unique global reference for BlackCat (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blackcat - webarchive
- https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/noberus-blackcat-alphv-rust-ransomware - webarchive
- https://thehackernews.com/2022/04/researchers-connect-blackcat-ransomware.html - webarchive
- https://www.advintel.io/post/blackcat-in-a-shifting-threat-landscape-it-helps-to-land-on-your-feet-tech-dive - webarchive
- https://www.microsoft.com/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/ - webarchive
- https://id-ransomware.blogspot.com/2021/12/blackcat-ransomware.html - webarchive
- https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware - webarchive
- https://therecord.media/german-wind-farm-operator-confirms-cybersecurity-incident-after-ransomware-group/ - webarchive
- https://medium.com/s2wblog/blackcat-new-rust-based-ransomware-borrowing-blackmatters-configuration-31c8d330a809 - webarchive
- https://x.com/vxunderground/status/1731138180672344095?t=reBMQQFFMGQ_zkV8KmL_LA&s=01 - webarchive
- https://killingthebear.jorgetesta.tech/actors/alphv - webarchive
- https://www.theregister.com/2023/11/16/blackcat_ransomware_luring_corporate_targets/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ - webarchive
- https://www.zdnet.com/article/blackcat-ransomware-implicated-in-attack-on-german-oil-companies/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-by-the-numbers/lockbit-conti-and-blackcat-lead-pack-amid-rise-in-active-raas-and-extortion-groups-ransomware-in-q1-2022 - webarchive
- https://www.bleepingcomputer.com/news/security/march-2023-broke-ransomware-attack-records-with-459-incidents/ - webarchive
- https://cocomelonc.github.io/book/2023/12/13/malwild-book.html - webarchive
- https://github.com/rivitna/Malware/tree/main/BlackCat/ALPHV3 - webarchive
- https://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html - webarchive
- https://www.crowdstrike.com/blog/falcon-overwatch-contributes-to-blackcat-protection/ - webarchive
- https://mssplab.github.io/threat-hunting/2023/07/13/malware-analysis-blackcat.html - webarchive
- https://www.ic3.gov/Media/News/2022/220420.pdf - webarchive
- https://krebsonsecurity.com/2022/01/who-wrote-the-alphv-blackcat-ransomware-strain/ - webarchive
- https://community.riskiq.com/article/47766fbd - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor - webarchive
- https://securityintelligence.com/posts/blackcat-ransomware-levels-up-stealth-speed-exfiltration/ - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v - webarchive
- https://unit42.paloaltonetworks.com/blackcat-ransomware/ - webarchive
- https://www.intrinsec.com/alphv-ransomware-gang-analysis - webarchive
- https://documents.trendmicro.com/assets/pdf/datasheet-ransomware-in-Q1-2022.pdf - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
- https://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/ - webarchive
- https://www.intrinsec.com/alphv-ransomware-gang-analysis/ - webarchive
- https://securelist.com/a-bad-luck-blackcat/106254/ - webarchive
- https://blog.group-ib.com/blackcat - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/blackcat-ransomware-as-a-service.html - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://securityscorecard.com/blog/ttps-associated-with-new-version-of-blackcat-ransomware - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-007.pdf - webarchive
- https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group - webarchive
- https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf - webarchive
- https://securelist.com/modern-ransomware-groups-ttps/106824/ - webarchive
- https://www.varonis.com/blog/alphv-blackcat-ransomware - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/noberus-blackcat-ransomware-ttps - webarchive
- https://www.trendmicro.com/en_us/research/22/d/an-investigation-of-the-blackcat-ransomware.html - webarchive
- https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware - webarchive
- https://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/ - webarchive
- https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/ - webarchive
- https://www.mandiant.com/resources/blog/alphv-ransomware-backup - webarchive
- https://github.com/f0wl/blackCatConf - webarchive
- https://www.trellix.com/about/newsroom/stories/research/scattered-spider-the-modus-operandi/ - webarchive
- https://www.sentinelone.com/labs/crimeware-trends-ransomware-developers-turn-to-intermittent-encryption-to-evade-detection/ - webarchive
- https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf - webarchive
- https://www.computerweekly.com/news/252525240/ALPHV-BlackCat-ransomware-family-becoming-more-dangerous - webarchive
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a - webarchive
- https://www.netskope.com/blog/blackcat-ransomware-tactics-and-techniques-from-a-targeted-attack - webarchive
- https://securityscorecard.com/research/the-increase-in-ransomware-attacks-on-local-governments - webarchive
- https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html - webarchive
- https://go.kaspersky.com/rs/802-IJN-240/images/TR_BlackCat_Report.pdf - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BLACKCOFFEE
a backdoor that obfuscates its communications as normal traffic to legitimate websites such as Github and Microsoft's Technet portal.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BLACKCOFFEE.
| Known Synonyms |
|---|
PNGRAT |
ZoxPNG |
gresim |
Internal MISP references
UUID ff660bf2-a9e4-4973-be0c-9f6618e40899 which can be used as unique global reference for BLACKCOFFEE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blackcoffee - webarchive
- http://malware-log.hatenablog.com/entry/2015/05/18/000000_1 - webarchive
- http://www.novetta.com/wp-content/uploads/2014/11/ZoxPNG.pdf - webarchive
- https://www.youtube.com/watch?v=NFJqD-LcpIg - webarchive
- https://attack.mitre.org/groups/G0096 - webarchive
- https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-keystone - webarchive
- https://attack.mitre.org/software/S0069/ - webarchive
- https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html - webarchive
- https://intrusiontruth.wordpress.com/2019/07/24/apt17-is-run-by-the-jinan-bureau-of-the-chinese-ministry-of-state-security/ - webarchive
- https://nao-sec.org/2020/01/an-overhead-view-of-the-royal-road.html - webarchive
- https://attack.mitre.org/groups/G0001/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-mohawk - webarchive
- https://attack.mitre.org/groups/G0025/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackEnergy
BlackEnergy, its first version shortened as BE1, started as a crimeware being sold in the Russian cyber underground as early as 2007. Initially, it was designed as a toolkit for creating botnets for conducting DDoS attacks. It supported a variety of flooding commands including protocols like ICMP, TCP SYN, UDP, HTTP and DNS. Among the high profile targets of cyber attacks utilising BE1 were a Norwegian bank and government websites in Georgia three weeks before Russo-Georgian War.
Version 2 of BlackEnergy, BE2, came in 2008 with a complete code rewrite that introduced a protective layer, a kernel-mode rootkit and a modular architecture. Plugins included mostly DDoS attacks, a spam plugin and two banking authentication plugins to steal from Russian nad Ukrainian banks. The banking plugin was paired with a module designed to destroy the filesystem. Moreover, BE2 was able to - download and execute a remote file; - execute a local file on the infected computer; - update the bot and its plugins;
The Industrial Control Systems Cyber Emergency Response Team issued an alert warning that BE2 was leveraging the human-machine interfaces of industrial control systems like GE CIMPLICITY, Advantech/Broadwin WebAccess, and Siemens WinCC to gain access to critical infrastructure networks.
In 2014, the BlackEnergy toolkit, BE3, switched to a lighter footprint with no kernel-mode driver component. Its plugins included: - operations with victim's filesystem - spreading with a parasitic infector - spying features like keylogging, screenshoots or a robust password stealer - Team viewer and a simple pseudo “remote desktop” - listing Windows accounts and scanning network - destroying the system
Typical for distribution of BE3 was heavy use of spear-phishing emails containing Microsoft Word or Excel documents with a malicious VBA macro, Rich Text Format (RTF) documents embedding exploits or a PowerPoint presentation with zero-day exploit CVE-2014-4114.
On 23 December 2015, attackers behind the BlackEnergy malware successfully caused power outages for several hours in different regions of Ukraine. This cyber sabotage against three energy companies has been confirmed by the Ukrainian government. The power grid compromise has become known as the first-of-its-kind cyber warfare attack affecting civilians.
Internal MISP references
UUID 82c644ab-550a-4a83-9b35-d545f4719069 which can be used as unique global reference for BlackEnergy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blackenergy - webarchive
- https://www.ironnet.com/blog/russian-cyber-attack-campaigns-and-actors - webarchive
- https://attack.mitre.org/groups/G0034 - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf - webarchive
- https://marcusedmondson.com/2019/01/18/black-energy-analysis/ - webarchive
- https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/ - webarchive
- https://securelist.com/black-ddos/36309/ - webarchive
- https://www.secureworks.com/research/blackenergy2 - webarchive
- https://www.picussecurity.com/blog/picus-10-critical-mitre-attck-techniques-t1055-process-injection - webarchive
- https://cocomelonc.github.io/tutorial/2022/04/20/malware-pers-1.html - webarchive
- https://threatconnect.com/blog/casting-a-light-on-blackenergy/ - webarchive
- https://www.welivesecurity.com/2014/10/14/cve-2014-4114-details-august-blackenergy-powerpoint-campaigns/ - webarchive
- http://atlas-public.ec2.arbor.net/docs/BlackEnergy+DDoS+Bot+Analysis.pdf - webarchive
- https://www.riskint.blog/post/revisited-fancy-bear-s-new-faces-and-sandworms-too - webarchive
- https://securelist.com/be2-extraordinary-plugins-siemens-targeting-dev-fails/68838/ - webarchive
- https://www.tesorion.nl/en/resources/pdfstore/Report-OSINT-Russia-Ukraine-Conflict-Cyberaspect.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-viking - webarchive
- https://cocomelonc.github.io/tutorial/2022/05/09/malware-pers-4.html - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0909.pdf - webarchive
- https://web.archive.org/web/20140428201836/http://www.fireeye.com/blog/technical/malware-research/2010/03/black-energy-crypto.html - webarchive
- https://www.virusbulletin.com/uploads/pdf/magazine/2016/VB2016-Cherepanov-Lipovsky.pdf - webarchive
- https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games - webarchive
- https://enterprise.verizon.com/resources/reports/2019-data-breach-investigations-report.pdf - webarchive
- http://pds15.egloos.com/pds/201001/01/66/BlackEnergy_DDoS_Bot_Analysis.pdf - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-110a - webarchive
- https://symantec.broadcom.com/hubfs/Attacks-Against-Critical_Infrastructrure.pdf - webarchive
- https://securelist.com/blackenergy-apt-attacks-in-ukraine-employ-spearphishing-with-word-documents/73440/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackGuard
According to Zscaler, BlackGuard has the capability to steal all types of information related to Crypto wallets, VPN, Messengers, FTP credentials, saved browser credentials, and email clients.
Internal MISP references
UUID 86048398-cfc2-4d6c-a49f-9114e2966b61 which can be used as unique global reference for BlackGuard in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blackguard - webarchive
- https://blogs.blackberry.com/en/2022/04/threat-thursday-blackguard-infostealer - webarchive
- https://medium.com/s2wblog/the-history-of-blackguard-stealer-86207e72ffb4 - webarchive
- https://blog.cyble.com/2022/04/01/dissecting-blackguard-info-stealer/ - webarchive
- https://ke-la.com/information-stealers-a-new-landscape/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-blackguard-password-stealing-malware-sold-on-hacker-forums/ - webarchive
- https://thehackernews.com/2022/04/experts-shed-light-on-blackguard.html - webarchive
- https://medium.com/s2wblog/rising-stealer-in-q1-2022-blackguard-stealer-f516d9f85ee5 - webarchive
- https://cyberint.com/blog/research/blackguard-stealer/ - webarchive
- https://www.techtimes.com/articles/273752/20220331/new-password-stealing-malware-hacking-forum-hack-password-stealing-google-chrome-binance-outlook-telegram.htm - webarchive
- https://www.zdnet.com/article/meet-blackguard-a-new-infostealer-peddled-on-russian-hacker-forums/ - webarchive
- https://www.youtube.com/watch?v=Fd8WjxzY2_g - webarchive
- https://www.bleepingcomputer.com/news/security/new-meta-information-stealer-distributed-in-malspam-campaign/ - webarchive
- https://www.f5.com/labs/articles/threat-intelligence/blackguard-infostealer-malware-dissecting-the-state-of-exfiltrated-data - webarchive
- https://www.zscaler.com/blogs/security-research/analysis-blackguard-new-info-stealer-malware-being-sold-russian-hacking - webarchive
- https://team-cymru.com/blog/2022/05/25/bablosoft-lowering-the-barrier-of-entry-for-malicious-actors/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackKingdom Ransomware
Internal MISP references
UUID 246b6563-edd8-49c7-9d3c-97dc1aec6b81 which can be used as unique global reference for BlackKingdom Ransomware in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blackkingdom_ransomware - webarchive
- https://news.sophos.com/en-us/2021/03/23/black-kingdom/ - webarchive
- https://securelist.com/black-kingdom-ransomware/102873/ - webarchive
- https://www.advanced-intel.com/post/adversarial-perspective-advintel-breach-avoidance-through-monitoring-initial-vulnerabilities - webarchive
- https://www.trendmicro.com/en_us/research/21/e/proxylogon-a-coinminer--a-ransomware--and-a-botnet-join-the-part.html - webarchive
- https://blog.redteam.pl/2020/06/black-kingdom-ransomware.html - webarchive
- https://id-ransomware.blogspot.com/2020/02/blackkingdom-ransomware.html - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackLotus
Internal MISP references
UUID 6d542c85-cf94-466f-97a2-eac3c50fbea2 which can be used as unique global reference for BlackLotus in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blacklotus - webarchive
- https://cocomelonc.github.io/book/2023/12/13/malwild-book.html - webarchive
- https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/ - webarchive
- https://blog.bushidotoken.net/2023/08/tracking-adversaries-scattered-spider.html - webarchive
- https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ - webarchive
- https://mssplab.github.io/threat-hunting/2023/07/15/malware-src-blacklotus.html - webarchive
- https://www.binarly.io/posts/The_Untold_Story_of_the_BlackLotus_UEFI_Bootkit/index.html - webarchive
- https://kn0s-organization.gitbook.io/blacklotus-analysis-stage2-bootkit-rootkit-stage/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackMagic
Ransomware
Internal MISP references
UUID 80735865-325c-4829-a6df-22e5d84735e6 which can be used as unique global reference for BlackMagic in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackMatter (Windows)
According to PCrisk, BlackMatter is a piece of malicious software categorized as ransomware. It operates by encrypting data for the purpose of making ransom demands for the decryption tools. In other words, files affected by BlackMatter are rendered inaccessible, and victims are asked to pay - to recover access to their data.
During the encryption process, files are appended with an extension consisting of a random character string. For example, a file initially named "1.jpg" would appear as something similar to "1.jpg.k5RO9fVOl". After this process is complete, the ransomware changes the desktop wallpaper and created a ransom note - "[random_string].README.txt" (e.g., k5RO9fVOl.README.txt).
Internal MISP references
UUID f838f3bb-a36b-49df-8f8c-1bb8cf66b736 which can be used as unique global reference for BlackMatter (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blackmatter - webarchive
- https://www.microsoft.com/security/blog/2022/04/13/dismantling-zloader-how-malicious-ads-led-to-disabled-security-tools-and-ransomware/ - webarchive
- https://thehackernews.com/2022/04/researchers-connect-blackcat-ransomware.html - webarchive
- https://www.bleepingcomputer.com/news/security/darkside-ransomware-rushes-to-cash-out-7-million-in-bitcoin/ - webarchive
- https://blog.group-ib.com/blackmatter# - webarchive
- https://www.netskope.com/blog/netskope-threat-coverage-blackmatter - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa21-291a - webarchive
- https://medium.com/s2wblog/blackcat-new-rust-based-ransomware-borrowing-blackmatters-configuration-31c8d330a809 - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf - webarchive
- https://www.tesorion.nl/en/posts/analysis-of-the-blackmatter-ransomware/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ - webarchive
- https://www.youtube.com/watch?v=NIiEcOryLpI - webarchive
- https://twitter.com/GelosSnake/status/1451465959894667275 - webarchive
- https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html - webarchive
- https://ke-la.com/the-ideal-ransomware-victim-what-attackers-are-looking-for/ - webarchive
- https://medium.com/s2wlab/blackmatter-x-babuk-using-the-same-web-server-for-sharing-leaked-files-d01c20a74751 - webarchive
- https://services.google.com/fh/files/misc/gcat_threathorizons_full_nov2021.pdf - webarchive
- https://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackmatter-data-exfiltration - webarchive
- https://assets.virustotal.com/reports/2021trends.pdf - webarchive
- https://www.theregister.com/2022/03/22/talos-ransomware-blackcat/ - webarchive
- https://blog.minerva-labs.com/blackmatter - webarchive
- https://chuongdong.com/reverse%20engineering/2021/09/05/BlackMatterRansomware/ - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-2/ - webarchive
- https://www.trendmicro.com/en_us/research/22/g/lockbit-ransomware-group-augments-its-latest-variant--lockbit-3-.html - webarchive
- https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/ - webarchive
- https://www.mandiant.com/resources/cryptography-blackmatter-ransomware - webarchive
- https://www.varonis.com/blog/blackmatter-ransomware/ - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
- https://www.elliptic.co/blog/darkside-bitcoins-on-the-move-following-government-cyberattack-against-revil-ransomware-group - webarchive
- https://www.nozominetworks.com/blog/blackmatter-ransomware-technical-analysis-and-tools-from-nozomi-networks-labs/ - webarchive
- https://therecord.media/darkside-ransomware-gang-moves-some-of-its-bitcoin-after-revil-got-hit-by-law-enforcement/ - webarchive
- https://medium.com/s2wlab/groove-x-ramp-the-relation-between-groove-babuk-ramp-and-blackmatter-f75644f8f92d - webarchive
- https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus - webarchive
- https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/ - webarchive
- https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf - webarchive
- https://raw.githubusercontent.com/antonioCoco/infosec-talks/main/InsomniHack_2022_Ransomware_Encryption_Internals.pdf - webarchive
- https://blogs.blackberry.com/en/2021/09/threat-thursday-blackmatter-ransomware-as-a-service - webarchive
- https://medium.com/s2wlab/grooves-thoughts-on-blackmatter-babuk-and-interruption-in-the-supply-of-cheese-in-the-b5328bc764f2 - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/noberus-blackcat-ransomware-ttps - webarchive
- https://therecord.media/blackmatter-ransomware-says-its-shutting-down-due-to-pressure-from-local-authorities/ - webarchive
- https://www.mcafee.com/blogs/enterprise/blackmatter-ransomware-analysis-the-dark-side-returns/ - webarchive
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ - webarchive
- https://www.glimps.fr/lockbit3-0/ - webarchive
- https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-moves-victims-to-lockbit-after-shutdown/ - webarchive
- https://www.mandiant.com/resources/chasing-avaddon-ransomware - webarchive
- https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf - webarchive
- https://www.ciphertechsolutions.com/rapidly-evolving-blackmatter-ransomware-tactics/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/MTP-2021-0804.pdf - webarchive
- https://blog.digital-investigations.info/2021-08-05-understanding-blackmatters-api-hashing.html - webarchive
- https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/how-groove-gang-is-shaking-up-the-ransomware-as-a-service-market-to-empower-affiliates/ - webarchive
- https://blog.group-ib.com/blackmatter2 - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://www.hhs.gov/sites/default/files/demystifying-blackmatter.pdf - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackNET RAT
Advanced and modern Windows botnet with PHP panel developed using VB.NET. It has a lot of functionalities including: stealing/grabbing files and passwords, keylogging, cryptojacking, loading files, executing commands, etc. It is open source and emerged at the end of 2019.
Internal MISP references
UUID 656c4009-cd79-4501-9fc9-7ad2d97b634c which can be used as unique global reference for BlackNET RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blacknet_rat - webarchive
- https://blog.minerva-labs.com/become-a-vip-victim-with-new-discord-distributed-malware - webarchive
- http://www.pwncode.io/2019/12/blacknet-rat-when-you-leave-panel.html - webarchive
- https://github.com/mave12/BlackNET-3.7.0.1 - webarchive
- https://github.com/BlackHacker511/BlackNET/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2020/03/fake-corona-antivirus-distributes-blacknet-remote-administration-tool/ - webarchive
- https://github.com/FarisCode511/BlackNET/ - webarchive
- https://labs.k7computing.com/?p=21365 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackNix RAT
Internal MISP references
UUID 845ce966-fb40-4f12-b9c1-8b97263a589e which can be used as unique global reference for BlackNix RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackPOS
BlackPOS infects computers running on Windows that have credit card readers connected to them and are part of a POS system. POS system computers can be easily infected if they do not have the most up to date operating systems and antivirus programs to prevent security breaches or if the computer database systems have weak administration login credentials.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BlackPOS.
| Known Synonyms |
|---|
Kaptoxa |
MMon |
POSWDS |
Reedum |
Internal MISP references
UUID 1e62fc1f-daa7-416f-9159-099798bb862c which can be used as unique global reference for BlackPOS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blackpos - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/operation-black-atlas-endangers-in-store-card-payments-and-smbs-worldwide-switches-between-blackpos-and-other-tools/ - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/new-blackpos-malware-emerges-in-the-wild-targets-retail-accounts/ - webarchive
- https://usa.visa.com/dam/VCOM/global/support-legal/documents/new-pos-malware-samples.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackRemote
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BlackRemote.
| Known Synonyms |
|---|
BlackRAT |
Internal MISP references
UUID b1302517-d5c9-44bb-833d-4396365915db which can be used as unique global reference for BlackRemote in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blackremote - webarchive
- https://news.sophos.com/en-us/2020/05/14/raticate/ - webarchive
- https://asec.ahnlab.com/en/56405/ - webarchive
- https://unit42.paloaltonetworks.jp/blackremote-money-money-money-a-swedish-actor-peddles-an-expensive-new-rat/ - webarchive
- https://unit42.paloaltonetworks.com/blackremote-money-money-money-a-swedish-actor-peddles-an-expensive-new-rat/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackRevolution
Internal MISP references
UUID 6a5bd819-5fbc-437b-92c4-ce0dfb5c67f8 which can be used as unique global reference for BlackRevolution in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackRouter
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BlackRouter.
| Known Synonyms |
|---|
BLACKHEART |
Internal MISP references
UUID 0b235fbf-c191-47c0-ae83-9386a64b1c79 which can be used as unique global reference for BlackRouter in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blackrouter - webarchive
- https://www.bleepingcomputer.com/news/security/blackrouter-ransomware-promoted-as-a-raas-by-iranian-developer/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/legitimate-application-anydesk-bundled-with-new-ransomware-variant/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Blackruby
Ransomware.
Internal MISP references
UUID 617d53dd-1143-4146-bbc0-39e975a26fe5 which can be used as unique global reference for Blackruby in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blackruby - webarchive
- https://www.bleepingcomputer.com/news/security/black-ruby-ransomware-skips-victims-in-iran-and-adds-a-miner-for-good-measure/ - webarchive
- https://www.acronis.com/en-us/blog/posts/black-ruby-combining-ransomware-and-coin-miner-malware - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackShades
Internal MISP references
UUID 0fb57d46-1c4f-49a3-80c2-05bcaa34ec1b which can be used as unique global reference for BlackShades in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blackshades - webarchive
- https://blog.malwarebytes.com/threat-analysis/2014/05/taking-off-the-blackshades/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-2-blackshades-net/ - webarchive
- http://contagiodump.blogspot.com/2012/06/rat-samples-from-syrian-targeted.html - webarchive
- https://blog.malwarebytes.com/threat-analysis/2012/06/blackshades-in-syria/ - webarchive
- https://www.secureworks.com/research/threat-profiles/aluminum-saratoga - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackSnake
Internal MISP references
UUID 366fe903-5ab4-47d3-a0e0-8ff45b2b4a8c which can be used as unique global reference for BlackSnake in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackSoul
Internal MISP references
UUID 58701e4d-87aa-45a5-adfd-9b20f50fea91 which can be used as unique global reference for BlackSoul in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlackSuit (Windows)
According to Trend Micro, this ransomware has significant code overlap with Royal Ransomware.
Internal MISP references
UUID b73202ea-e636-4e70-91b1-f29c1db4cbb1 which can be used as unique global reference for BlackSuit (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Blackworm RAT
Internal MISP references
UUID 02d2bb6d-9641-406e-9767-58aff2fad6c7 which can be used as unique global reference for Blackworm RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blackworm_rat - webarchive
- https://www.fireeye.com/blog/threat-research/2014/08/connecting-the-dots-syrian-malware-team-uses-blackworm-for-attacks.html - webarchive
- https://www.fidelissecurity.com/threatgeek/archive/down-h-w0rm-hole-houdinis-rat/ - webarchive
- https://github.com/BlackHacker511/BlackWorm - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BleachGap
Internal MISP references
UUID cfcdbf20-304e-4ea4-bec1-d84bb78e723f which can be used as unique global reference for BleachGap in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BLINDINGCAN
BLINDINGCAN is a remote access trojan that communicates with its C&C server via HTTP(S). It uses a (custom) RC4 or AES for encryption and decryption of its configuration and network traffic. It sends information about the victim's environment, like computer name, IP, Windows product name and processor name. It supports around 30 commands that include operations on the victim’s filesystem, basic process management, command line execution, file exfiltration, configuration update, and the download and execution of additional payloads from the attackers' C&C. The commands are indexed by 16-bit integers, starting with the index 0x2009 and going incrementally up to 0x2057, with some indicis being skipped. It uses various parameter names in its HTTP POST requests, mostly associated with web servers running bulletin board systems, like bbs, article, boardid, s_board, page, idx_num, etc. It contains specific RTTI symbols like ".?AVCHTTP_Protocol@@", ".?AVCFileRW@@" or ".?AVCSinSocket@@". BLINDINGCAN RAT is a flagship payload deployed in many Lazarus attacks, especially in the Operation DreamJob campaigns happening in 2020-2022.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BLINDINGCAN.
| Known Synonyms |
|---|
AIRDRY |
ZetaNile |
Internal MISP references
UUID 44d22b4e-5ad4-4f05-a421-95607706378d which can be used as unique global reference for BLINDINGCAN in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blindingcan - webarchive
- https://www.hvs-consulting.de/lazarus-report/ - webarchive
- https://www.sentinelone.com/blog/the-blindingcan-rat-and-malicious-north-korean-activity/ - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a - webarchive
- https://www.cisa.gov/news-events/analysis-reports/ar20-232a - webarchive
- https://www.welivesecurity.com/2022/09/30/amazon-themed-campaigns-lazarus-netherlands-belgium/ - webarchive
- https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf - webarchive
- https://blogs.jpcert.or.jp/en/2020/09/BLINDINGCAN.html - webarchive
- https://securelist.com/the-lazarus-group-deathnote-campaign/109490/ - webarchive
- https://securelist.com/it-threat-evolution-q2-2023/110355/ - webarchive
- https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Lazarus-campaigns-and-backdoors-in-2022-2023.pdf - webarchive
- https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BLINDTOAD
BLINDTOAD is 64-bit Service DLL that loads an encrypted file from disk and executes it in memory.
Internal MISP references
UUID b34fd401-9d37-4bc6-908f-448c1697f749 which can be used as unique global reference for BLINDTOAD in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blindtoad - webarchive
- https://content.fireeye.com/apt/rpt-apt38 - webarchive
- https://baesystemsai.blogspot.com/2017/10/taiwan-heist-lazarus-tools.html - webarchive
- https://adeo.com.tr/wp-content/uploads/2020/05/ADEO-Lazarus-APT38.pdf - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-continues-heists-mounts-attacks-on-financial-organizations-in-latin-america/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Blister
Elastic observed this loader coming with valid code signatures, being used to deploy secondary payloads in-memory.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Blister.
| Known Synonyms |
|---|
COLORFAKE |
Internal MISP references
UUID 8ffc1f23-c0a6-4186-b06e-11a72c153722 which can be used as unique global reference for Blister in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blister - webarchive
- https://security-labs.elastic.co/security-labs/revisiting-blister-new-developments-of-the-blister-loader - webarchive
- https://killingthebear.jorgetesta.tech/actors/evil-corp - webarchive
- https://redcanary.com/blog/intelligence-insights-january-2022/ - webarchive
- https://medium.com/walmartglobaltech/socgholish-campaigns-and-initial-access-kit-4c4283fea8ee - webarchive
- https://blog.fox-it.com/2023/11/01/popping-blisters-for-research-an-overview-of-past-payloads-and-exploring-recent-developments/ - webarchive
- https://elastic.github.io/security-research/malware/2022/05/02.blister/article/ - webarchive
- https://www.trendmicro.com/en_no/research/22/d/Thwarting-Loaders-From-SocGholish-to-BLISTERs-LockBit-Payload.html - webarchive
- https://cloudsek.com/technical-analysis-of-code-signed-blister-malware-campaign-part-1/ - webarchive
- https://www.elastic.co/blog/elastic-security-uncovers-blister-malware-campaign - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ - webarchive
- https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/d/thwarting-loaders-from-socgholish-to-blisters-lockbit-payload/iocs-thwarting-loaders-socgholish-blister.txt - webarchive
- https://www.trendmicro.com/en_us/research/22/d/Thwarting-Loaders-From-SocGholish-to-BLISTERs-LockBit-Payload.html - webarchive
- https://www.elastic.co/security-labs/revisiting-blister-new-developments-of-the-blister-loader - webarchive
- https://cloudsek.com/technical-analysis-of-code-signed-blister-malware-campaign-part-2/ - webarchive
- https://twitter.com/MsftSecIntel/status/1522690116979855360 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
win.trojan.bloodalchemy
Internal MISP references
UUID ca547f0c-6cd1-4381-bcf1-143dd0798690 which can be used as unique global reference for win.trojan.bloodalchemy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BloodyStealer
Internal MISP references
UUID ecdc0a43-8845-4dc4-a3f0-de2f0142aa4d which can be used as unique global reference for BloodyStealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlueFox
BlueFox is a .NET infostealer sold on forums as a Maware-as-a-Service. Its capabilities are those of a classic information stealer, with a focus on cryptocurrency wallets, and file grabber and loader capabilities.
Internal MISP references
UUID f9f5d767-3460-49f3-94c2-5dd91b341505 which can be used as unique global reference for BlueFox in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BLUEHAZE
Mandiant associates this with UNC4191, this malware is a launcher for NCAT to establish a reverse tunnel.
Internal MISP references
UUID 3dcfef7b-d657-4ac5-b738-ef793237274b which can be used as unique global reference for BLUEHAZE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BLUELIGHT
Malware family used to deliver follow up payloads, variants using Microsoft Graph API and Google Web Apps have been observed.
Internal MISP references
UUID 9c5ec440-2bb8-4485-9811-f2fb52cf76e5 which can be used as unique global reference for BLUELIGHT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlueNoroff
This family contains the BlueNoroff toolkit used for SWIFT manipulation, as used by the Lazarus activity cluster also referred to as BlueNoroff.
Internal MISP references
UUID 862e9c13-dde6-473e-a816-a7d7043bf73c which can be used as unique global reference for BlueNoroff in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlueShell
According to AhnLab, BlueShell is a backdoor malware developed in Go language, published on Github, and it supports Windows, Linux, and Mac operating systems. Currently, the original Github repository is presumed to have been deleted, but the BlueShell source code can still be obtained from other repositories. It features an explanatory ReadMe file in Chinese, indicating the possibility that the creator is a Chinese user.
Internal MISP references
UUID 91d441a6-4244-43a2-9b96-354a2df63a4e which can be used as unique global reference for BlueShell in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BlueSky
Ransomware.
Internal MISP references
UUID 5c19d979-4c22-452f-b4f0-9325a46b7083 which can be used as unique global reference for BlueSky in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bluesky - webarchive
- https://www.sentinelone.com/blog/bluesky-ransomware-ad-lateral-movement-evasion-and-fast-encryption-puts-threat-on-the-radar/ - webarchive
- https://unit42.paloaltonetworks.com/bluesky-ransomware/ - webarchive
- https://thedfirreport.com/2023/12/04/sql-brute-force-leads-to-bluesky-ransomware/ - webarchive
- https://yoroi.company/research/dissecting-bluesky-ransomware-payload/ - webarchive
- https://cloudsek.com/technical-analysis-of-bluesky-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BLUETHER
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BLUETHER.
| Known Synonyms |
|---|
CAPGELD |
Internal MISP references
UUID cf542e2d-531c-4d34-98c8-7e3cb26a32af which can be used as unique global reference for BLUETHER in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bluether - webarchive
- https://web.archive.org/web/20200229012206/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1574947724.pdf - webarchive
- https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1574947724.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BluStealer
Avast describe this malware as a recombination of other malware including SpyEx, ThunderFox, ChromeRecovery, StormKitty, and firepwd.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BluStealer.
| Known Synonyms |
|---|
a310logger |
Internal MISP references
UUID cb4bfed3-3042-4a29-a72d-c8b5c510faea which can be used as unique global reference for BluStealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.blustealer - webarchive
- https://blogs.blackberry.com/en/2021/10/threat-thursday-blustealer-infostealer - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://blog.minerva-labs.com/a-new-blustealer-loader-uses-direct-syscalls-to-evade-edrs - webarchive
- https://twitter.com/GoSecure_Inc/status/1437435265350397957 - webarchive
- https://decoded.avast.io/anhho/blustealer/ - webarchive
- https://www.gosecure.net/blog/2021/09/22/gosecure-titan-labs-technical-report-blustealer-malware-threat/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BOATLAUNCH
FIN7 uses this malware as helper module during intrusion operations. BOATLAUNCH is continuously looking for PowerShell processes on infected systems and patches them to bypuss Windows AntiMalware Scan Interface (AMSI).
Internal MISP references
UUID 13e62fe0-af0e-4a44-8437-ed86101f12d4 which can be used as unique global reference for BOATLAUNCH in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Boaxxe
Internal MISP references
UUID 2f11eb73-4faa-48c5-b217-11e139962c6f which can be used as unique global reference for Boaxxe in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bobik
This malware offers remote access capabilities but also has a DDoS module that was used against supporters of Ukraine.
Internal MISP references
UUID 71a2182f-1010-496d-8c20-7a60639adff1 which can be used as unique global reference for Bobik in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bohmini
Internal MISP references
UUID 444ca9d1-7128-40fa-9665-654194dfbe0b which can be used as unique global reference for Bohmini in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BOLDMOVE (Windows)
According to Mandiant, this malware family is attributed to potential chinese background and its Linux variant is related to exploitation of Fortinet's SSL-VPN (CVE-2022-42475).
Internal MISP references
UUID 4212b386-b6de-4b06-86f1-ba20b5c01447 which can be used as unique global reference for BOLDMOVE (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bolek
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Bolek.
| Known Synonyms |
|---|
KBOT |
Internal MISP references
UUID d3af810f-e657-409c-b821-4b1cf727ad18 which can be used as unique global reference for Bolek in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BookCodes RAT
BookCodesRAT is a remote access trojan that uses HTTP(S) for communication. It supports around 25 commands that include operations on the victim’s filesystem, basic process management and the download and execution of additional tools from the attacker’s arsenal. They are indexed by 32-bit integers, starting with the value 0x97853646.
BookCodesRAT uses mostly compromised South Korean web servers for the C&C traffic and is usually deployed against South Korean targets.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BookCodes RAT.
| Known Synonyms |
|---|
BookCodesTea |
Internal MISP references
UUID 433b9a1c-dd2a-4d2b-b469-47b40fc6c196 which can be used as unique global reference for BookCodes RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bookcodesrat - webarchive
- https://www.welivesecurity.com/2020/11/16/lazarus-supply-chain-attack-south-korea/ - webarchive
- https://www.boho.or.kr/filedownload.do?attach_file_seq=2612&attach_file_id=EpF2612.pdf - webarchive
- https://securelist.com/lazarus-covets-covid-19-related-intelligence/99906/ - webarchive
- https://www.boho.or.kr/filedownload.do?attach_file_seq=2452&attach_file_id=EpF2452.pdf - webarchive
- https://vblocalhost.com/uploads/VB2021-Lee-etal.pdf - webarchive
- https://vblocalhost.com/uploads/VB2021-Park.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Book of Eli
This in .Net written malware is a classic information stealer. It can collect various information and can be depoyed in different configurations: "The full-featured version of the malware can log keystrokes, collect profile files of Mozilla Firefox and Google Chrome browsers, record sound from the microphone, grab desktop screenshots, capture photo from the webcam, and collect information about the version of the operation system and installed anti-virus software." (ESET) This malware has been active since at least 2012.
Internal MISP references
UUID 2029a6f7-f98e-4582-bc5b-7ff0188f1af2 which can be used as unique global reference for Book of Eli in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bookworm
Internal MISP references
UUID 1b8cfb29-7a63-459a-bc90-c9ea3634b21c which can be used as unique global reference for Bookworm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BOOMBOX
Internal MISP references
UUID e8112e1a-4fda-4857-8df8-0ba7fb5ea1ba which can be used as unique global reference for BOOMBOX in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.boombox - webarchive
- https://www.incibe-cert.es/sites/default/files/contenidos/estudios/doc/incibe-cert_estudio_analisis_nobelium_2022_v1.pdf - webarchive
- https://r136a1.info/2022/07/19/a-look-into-apt29s-new-early-stage-google-drive-downloader/ - webarchive
- https://cert.pl/posts/2023/04/kampania-szpiegowska-apt29/ - webarchive
- https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BOOSTWRITE
FireEye describes BOOSTWRITE as a loader crafted to be launched via abuse of the DLL search order of applications which load the legitimate ‘Dwrite.dll’ provided by the Microsoft DirectX Typography Services. The application loads the ‘gdi’ library, which loads the ‘gdiplus’ library, which ultimately loads ‘Dwrite’. Mandiant identified instances where BOOSTWRITE was placed on the file system alongside the RDFClient binary to force the application to import DWriteCreateFactory from it rather than the legitimate DWrite.dll.
Internal MISP references
UUID a24eb119-d526-4aa4-ab5f-171ccddd4fbc which can be used as unique global reference for BOOSTWRITE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.boostwrite - webarchive
- https://www.fireeye.com/blog/threat-research/2019/10/mahalo-fin7-responding-to-new-tools-and-techniques.html - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BOOTWRECK
BOOTWRECK is a master boot record wiper malware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BOOTWRECK.
| Known Synonyms |
|---|
MBRkiller |
Internal MISP references
UUID 174b9314-765e-44d0-a761-10d352f4466c which can be used as unique global reference for BOOTWRECK in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Borat RAT
The Borat RAT comes bundled with its components (e.g. binary builder, supporting modules, server certificates). According to Cyble this malware is an unique combination of RAT, Spyware, and ransomware. The supporting modules are included; a few of the capabilities: Keylogger, Ransomware, Audio/Webcam Recording, Process Hollowing, Browser Credential/Discord Token Stealing, etc.
Internal MISP references
UUID 7ff0b462-c5be-40fa-82da-7efe93722f92 which can be used as unique global reference for Borat RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.boratrat - webarchive
- https://blogs.blackberry.com/en/2022/04/threat-thursday-boratrat - webarchive
- https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-borat-remote-access-malware-is-no-laughing-matter/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Borr
Internal MISP references
UUID e016e652-8d02-45c4-a268-fe4c588ebd3d which can be used as unique global reference for Borr in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BottomLoader
Internal MISP references
UUID 450133c9-b40c-4526-a669-5d5cc55276d5 which can be used as unique global reference for BottomLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bouncer
Internal MISP references
UUID 80487bca-7629-4cb2-bf5b-993d5568b699 which can be used as unique global reference for Bouncer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BoxCaon
According to Checkpoint Research, this malware family has the ability to download and upload files, run commands and send the attackers the results. It has been observed being used by threat actor IndigoZebra.
Internal MISP references
UUID 5ccb9d4c-bb9b-48ee-9ea3-a64a81eb210f which can be used as unique global reference for BoxCaon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bozok
Internal MISP references
UUID f9d0e934-879c-4668-b959-6bf7bdc96f5d which can be used as unique global reference for Bozok in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bozok - webarchive
- https://www.fireeye.com/blog/threat-research/2013/10/know-your-enemy-tracking-a-rapidly-evolving-apt-actor.html - webarchive
- https://securelist.com/apt-trends-report-q1-2021/101967/ - webarchive
- https://unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BRAIN
Internal MISP references
UUID 1619ee64-fc54-47c0-8ee1-8b786fefc0fd which can be used as unique global reference for BRAIN in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Brambul
Brambul is a worm that spreads by using a list of hard-coded login credentials to launch a brute-force password attack against an SMB protocol for access to a victim’s networks.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Brambul.
| Known Synonyms |
|---|
SORRYBRUTE |
Internal MISP references
UUID d97ae60e-612a-4feb-908a-8c4d32e9d763 which can be used as unique global reference for Brambul in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.brambul - webarchive
- https://metaswan.github.io/posts/Malware-Lazarus-group's-Brambul-worm-of-the-former-Wannacry-1 - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://metaswan.github.io/posts/Malware-Lazarus-group's-Brambul-worm-of-the-former-Wannacry-2 - webarchive
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=5b9850b9-0fdd-48a9-b595-9234207ae7df&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://swanleesec.github.io/posts/Malware-Lazarus-group's-Brambul-worm-of-the-former-Wannacry-2 - webarchive
- https://www.acalvio.com/lateral-movement-technique-employed-by-hidden-cobra/ - webarchive
- https://www.us-cert.gov/ncas/analysis-reports/AR18-149A - webarchive
- https://swanleesec.github.io/posts/Malware-Lazarus-group's-Brambul-worm-of-the-former-Wannacry-1 - webarchive
- https://www.secureworks.com/research/threat-profiles/nickel-academy - webarchive
- https://www.us-cert.gov/ncas/alerts/TA18-149A - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BravoNC
Internal MISP references
UUID fbed27da-551d-4793-ba7e-128256326909 which can be used as unique global reference for BravoNC in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BrbBot
Internal MISP references
UUID b9a4455a-ad55-4858-9017-bb73a8640045 which can be used as unique global reference for BrbBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BreachRAT
This is a backdoor which FireEye call the Breach Remote Administration Tool (BreachRAT), written in C++. The malware name is derived from the hardcoded PDB path found in the RAT: C:\Work\Breach Remote Administration Tool\Release\Client.pdb
Internal MISP references
UUID 52cf2986-89e8-463d-90b6-e4356c9777e7 which can be used as unique global reference for BreachRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Breakthrough
There is no reference available for this family and all known samples have version 1.0.0.
Pdb-strings in the samples suggest that this is an "exclusive" loader, known as "breakthrough" (maybe), e.g. C:\Users\Exclusiv\Desktop\хп-пробив\Release\build.pdb
The communication url parameters are pretty unique in this combination:
gate.php?hwid=
Internal MISP references
UUID a05b8e4b-a686-439f-8094-037fbcda52bd which can be used as unique global reference for Breakthrough in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bredolab
Internal MISP references
UUID 55d343a1-7e80-4254-92eb-dfb433b91a90 which can be used as unique global reference for Bredolab in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bredolab - webarchive
- https://securelist.com/end-of-the-line-for-the-bredolab-botnet/36335/ - webarchive
- https://web.archive.org/web/20160616170611/https://media.blackhat.com/bh-eu-10/presentations/Carrera_Silberman/BlackHat-EU-2010-Carrera-Silberman-State-of-Malware-slides.pdf - webarchive
- https://www.fireeye.com/blog/threat-research/2010/10/bredolab-its-not-the-size-of-the-dog-in-fight.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BrittleBush
Internal MISP references
UUID fd4665b8-59b6-427f-a22d-bb3b50e9e176 which can be used as unique global reference for BrittleBush in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BROKEYOLK
According to Mandiant, BROKEYOLK is a .NET downloader that downloads and executes a file from a hard-coded command and control (C2) server. The malware communicates via SOAP (Simple Object Access Protocol) requests using HTTP.
Internal MISP references
UUID dd19501d-c23e-4a52-8cef-726a8483d6c2 which can be used as unique global reference for BROKEYOLK in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BROLER
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BROLER.
| Known Synonyms |
|---|
down_new |
Internal MISP references
UUID 9a544700-13e3-490f-ae4e-45b3fd159546 which can be used as unique global reference for BROLER in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bruh Wiper
Internal MISP references
UUID 33b76b3f-7056-4892-a134-6e984f500c3c which can be used as unique global reference for Bruh Wiper in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BrushaLoader
Internal MISP references
UUID 75a03c4f-8a97-4fc0-a69e-b2e73e4564fc which can be used as unique global reference for BrushaLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.brushaloader - webarchive
- https://www.cert.pl/en/news/single/brushaloader-gaining-new-layers-like-a-pro/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/brushaloader-still-sweeping-victims-one-year-later - webarchive
- https://blog.talosintelligence.com/2019/02/combing-through-brushaloader.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Brute Ratel C4
Brute Ratel is a a Customized Command and Control Center for Red Team and Adversary Simulation
SMB and TCP payloads provide functionality to write custom external C2 channels over legitimate websites such as Slack, Discord, Microsoft Teams and more. Built-in debugger to detect EDR userland hooks. Ability to keep memory artifacts hidden from EDRs and AV. Direct Windows SYS calls on the fly.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Brute Ratel C4.
| Known Synonyms |
|---|
BruteRatel |
Internal MISP references
UUID 19e4df44-d469-4903-8999-22d650a21dd7 which can be used as unique global reference for Brute Ratel C4 in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.brute_ratel_c4 - webarchive
- https://cybergeeks.tech/a-deep-dive-into-brute-ratel-c4-payloads-part-2/ - webarchive
- https://cybergeeks.tech/a-deep-dive-into-brute-ratel-c4-payloads/ - webarchive
- https://www.trendmicro.com/de_de/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html - webarchive
- https://www.splunk.com/en_us/blog/security/deliver-a-strike-by-reversing-a-badger-brute-ratel-detection-and-analysis.html - webarchive
- https://socradar.io/brute-ratel-utilized-by-threat-actors-in-new-ransomware-operations/ - webarchive
- https://protectedmo.de/brute.html - webarchive
- https://bruteratel.com/research/feature-update/2021/06/01/PE-Reflection-Long-Live-The-King/ - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v - webarchive
- https://blog.spookysec.net/analyzing-brc4-badgers/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0808.pdf - webarchive
- https://0xdarkvortex.dev/hiding-in-plainsight/ - webarchive
- https://andreafortuna.org/2023/02/23/how-to-detect-brute-ratel-activities - webarchive
- https://twitter.com/MichalKoczwara/status/1652067563545800705 - webarchive
- https://michaelkoczwara.medium.com/hunting-c2-with-shodan-223ca250d06f - webarchive
- https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/ - webarchive
- https://www.youtube.com/watch?v=a7W6rhkpVSM - webarchive
- https://twitter.com/embee_research/status/1580030303950995456?s=20&t=0vfXnrCXaVSX-P-hiSrFwA - webarchive
- https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/ - webarchive
- https://web.archive.org/web/20230216110153/https://yoroi.company/research/hunting-cyber-evil-ratels-from-the-targeted-attacks-to-the-widespread-usage-of-brute-ratel/ - webarchive
- https://medium.com/walmartglobaltech/brute-ratel-config-decoding-update-7820455022cb - webarchive
- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ - webarchive
- https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BrutPOS
Internal MISP references
UUID e413c33a-badd-49a1-8d44-c9a0983b5151 which can be used as unique global reference for BrutPOS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BS2005
Internal MISP references
UUID 35e00ff0-704e-4e61-b9bb-9ed20a4a008f which can be used as unique global reference for BS2005 in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bs2005 - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-palace - webarchive
- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/ - webarchive
- https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/ - webarchive
- https://github.com/nccgroup/Royal_APT - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BTCWare
Internal MISP references
UUID d29786c6-2cc0-4e2f-97b0-242a1d9e9bf8 which can be used as unique global reference for BTCWare in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BUBBLEWRAP
BUBBLEWRAP is a full-featured backdoor that is set to run when the system boots, and can communicate using HTTP, HTTPS, or a SOCKS proxy. This backdoor collects system information, including the operating system version and hostname, and includes functionality to check, upload, and register plugins that can further enhance its capabilities.
Internal MISP references
UUID d114ee6c-cf7d-408a-8077-d59e736f5a66 which can be used as unique global reference for BUBBLEWRAP in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Buer
Buer is a downloader sold on underground forums and used by threat actors to deliver payload malware onto target machines. It has been observed in email campaigns and has been sold as a service since August 2019.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Buer.
| Known Synonyms |
|---|
Buerloader |
RustyBuer |
Internal MISP references
UUID b908173c-c89e-400e-b69d-da411120dae2 which can be used as unique global reference for Buer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.buer - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://news.sophos.com/en-us/2020/10/28/hacks-for-sale-inside-the-buer-loader-malware-as-a-service/ - webarchive
- https://www.area1security.com/blog/trickbot-spear-phishing-drops-bazar-buer-malware/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf - webarchive
- https://labs.vipre.com/buer-loader-found-in-an-unusual-email-attachment/ - webarchive
- https://research.checkpoint.com/2023/following-the-scent-of-trickgate-6-year-old-packer-used-to-deploy-the-most-wanted-malware/ - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.fortinet.com/blog/threat-research/signed-sealed-and-delivered-signed-xll-file-delivers-buer-loader - webarchive
- https://therecord.media/meet-prometheus-the-secret-tds-behind-some-of-todays-malware-campaigns/ - webarchive
- https://documents.trendmicro.com/assets/rpt/rpt-navigating-new-frontiers-trend-micro-2021-annual-cybersecurity-report.pdf - webarchive
- https://tehtris.com/en/blog/buer-loader-analysis-a-rusted-malware-program - webarchive
- https://securelist.com/mokes-and-buerak-distributed-under-the-guise-of-security-certificates/96324/ - webarchive
- https://medium.com/walmartglobaltech/buerloader-updates-3e34c1949b96 - webarchive
- https://krabsonsecurity.com/2019/12/05/buer-loader-new-russian-loader-on-the-market-with-interesting-persistence/ - webarchive
- https://www.zscaler.com/blogs/research/spear-phishing-campaign-delivers-buer-and-bazar-malware - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://twitter.com/StopMalvertisin/status/1182505434231398401 - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/new-variant-buer-loader-written-rust - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/a-review-and-analysis-of-2021-buer-loader-campaigns/TechnicalBrief-An-Analysis-of-Buer-Loader.pdf - webarchive
- https://twitter.com/SophosLabs/status/1321844306970251265 - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-blackburn - webarchive
- https://www.trendmicro.com/en_us/research/21/k/a-review-and-analysis-of-2021-buer-loader-campaigns.html - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://blog.minerva-labs.com/stopping-buerloader - webarchive
- https://blog.group-ib.com/prometheus-tds - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/buer-new-loader-emerges-underground-marketplace - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-symphony - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-old-dogs-new-tricks.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BUFFETLINE
Internal MISP references
UUID eca37457-cdd4-44c7-ad07-7a4a863e8765 which can be used as unique global reference for BUFFETLINE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BUGHATCH
According to Elastic, BUGHATCH is an in-memory implant loaded by an obfuscated PowerShell script that decodes and executes an embedded shellcode blob in its allocated memory space using common Windows APIs (VirtualAlloc, CreateThread, WaitForSingleObject).
Internal MISP references
UUID d05f8cfe-ae3f-4468-9c48-90124b59ccda which can be used as unique global reference for BUGHATCH in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Buhtrap
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Buhtrap.
| Known Synonyms |
|---|
Ratopak |
Internal MISP references
UUID fa278536-8293-4717-86b5-8a03aa11063f which can be used as unique global reference for Buhtrap in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.buhtrap - webarchive
- https://www.scythe.io/library/threatthursday-buhtrap - webarchive
- https://dcso.de/2019/03/14/pegasus-buhtrap-analysis-of-the-malware-stage-based-on-the-leaked-source-code - webarchive
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=8e498912-44f8-4ea0-ac50-4544f0fedd6c&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments - webarchive
- https://www.welivesecurity.com/2019/04/30/buhtrap-backdoor-ransomware-advertising-platform/ - webarchive
- https://malware-research.org/carbanak-source-code-leaked/ - webarchive
- https://dcso.de/2019/03/14/pegasus-buhtrap-analysis-of-the-malware-stage-based-on-the-leaked-source-code/ - webarchive
- https://www.welivesecurity.com/2015/04/09/operation-buhtrap/ - webarchive
- https://www.welivesecurity.com/2019/07/11/buhtrap-zero-day-espionage-campaigns/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/operation-ta505-part3/ - webarchive
- https://blog.dcso.de/pegasus-buhtrap-analysis-of-the-malware-stage-based-on-the-leaked-source-code/ - webarchive
- https://www.group-ib.com/brochures/gib-buhtrap-report.pdf - webarchive
- https://www.symantec.com/connect/blogs/russian-bank-employees-received-fake-job-offers-targeted-email-attack - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BumbleBee
This malware is delivered by an ISO file, with an DLL inside with a custom loader. Because of the unique user-agent "bumblebee" this malware was dubbed BUMBLEBEE. At the time of Analysis by Google's Threat Analysis Group (TAG) BumbleBee was observed to fetch Cobalt Strike Payloads.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular BumbleBee.
| Known Synonyms |
|---|
COLDTRAIN |
SHELLSTING |
Shindig |
Internal MISP references
UUID fa47d59d-7251-468f-9d84-6e1ba21887db which can be used as unique global reference for BumbleBee in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bumblebee - webarchive
- https://intel471.com/blog/malware-before-ransomware-trojan-information-stealer-cobalt-strike - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime - webarchive
- https://www.infinitumit.com.tr/bumblebee-loader-malware-analysis/ - webarchive
- https://research.openanalysis.net/bumblebee/malware/loader/unpacking/2022/05/12/bumblebee_loader.html - webarchive
- https://www.fortinet.com/blog/threat-research/notable-droppers-emerge-in-recent-threat-campaigns - webarchive
- https://www.youtube.com/watch?v=JoKJNfLAc0Y - webarchive
- http://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive
- https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/ - webarchive
- https://www.intrinsec.com/emotet-returns-and-deploys-loaders/ - webarchive
- https://www.first.org/resources/papers/conf2023/FIRSTCON23-TLPCLEAR-Staubmann-Busy-Bees.pptx - webarchive
- https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti - webarchive
- https://team-cymru.com/blog/2022/05/25/bablosoft-lowering-the-barrier-of-entry-for-malicious-actors/ - webarchive
- https://twitter.com/Artilllerie/status/1701250284238823493 - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/comprehensive-look-emotets-fall-2022-return - webarchive
- https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive
- https://cloudsek.com/technical-analysis-of-bumblebee-malware-loader/ - webarchive
- https://blog.talosintelligence.com/following-the-lnk-metadata-trail - webarchive
- https://isc.sans.edu/diary/28636 - webarchive
- https://www.trendmicro.com/en_us/research/21/i/remote-code-execution-zero-day--cve-2021-40444--hits-windows--tr.html - webarchive
- https://resecurity.com/blog/article/shortcut-based-lnk-attacks-delivering-malicious-code-on-the-rise - webarchive
- https://www.deepinstinct.com/blog/pindos-new-javascript-dropper-delivering-bumblebee-and-icedid - webarchive
- https://www.cynet.com/orion-threat-alert-flight-of-the-bumblebee/ - webarchive
- https://0xtoxin.github.io/malware%20analysis/Bumblebee-DocuSign-Campaign/ - webarchive
- https://isc.sans.edu/diary/rss/28664 - webarchive
- https://isc.sans.edu/diary/Bumblebee+Malware+from+TransferXL+URLs/28664 - webarchive
- https://blog.sekoia.io/bumblebee-a-new-trendy-loader-for-initial-access-brokers/ - webarchive
- https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056 - webarchive
- https://blog.cerbero.io/?p=2617 - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://research.checkpoint.com/2022/bumblebee-increasing-its-capacity-and-evolving-its-ttps/ - webarchive
- https://twitter.com/Intrinsec/status/1699779830294970856 - webarchive
- https://thedfirreport.com/2022/09/26/bumblebee-round-two/ - webarchive
- https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks - webarchive
- https://isc.sans.edu/diary/rss/28636 - webarchive
- https://community.riskiq.com/article/0b211905/description - webarchive
- https://bin.re/blog/the-dga-of-bumblebee/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://research.nccgroup.com/2022/04/29/adventures-in-the-land-of-bumblebee-a-new-malicious-loader/ - webarchive
- https://www.secureworks.com/blog/bumblebee-malware-distributed-via-trojanized-installer-downloads - webarchive
- https://www.youtube.com/watch?v=pIXl79IPkLI - webarchive
- https://twitter.com/ESETresearch/status/1577963080096555008 - webarchive
- https://www.deepinstinct.com/blog/the-dark-side-of-bumblebee-malware-loader - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming - webarchive
- https://blog.cyble.com/2022/06/07/bumblebee-loader-on-the-rise/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
- https://blog.gigamon.com/2021/09/10/rendering-threats-a-network-perspective/ - webarchive
- https://blog.cyble.com/2022/09/07/bumblebee-returns-with-new-infection-technique/ - webarchive
- https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/bumblebee-docusign-campaign - webarchive
- https://blog.krakz.fr/articles/bumblebee/ - webarchive
- https://www.botconf.eu/wp-content/uploads/formidable/2/2023_4889_DESOUZA.pdf - webarchive
- https://mp.weixin.qq.com/s/cGS8FocPnUdBconLbbaG-g - webarchive
- https://securityintelligence.com/posts/from-ramnit-to-bumblebee-via-neverquest - webarchive
- https://www.logpoint.com/wp-content/uploads/2022/05/buzz-of-the-bumblebee-a-new-malicious-loader-threat-report-no-3.pdf - webarchive
- https://twitter.com/threatinsight/status/1648330456364883968 - webarchive
- https://unit42.paloaltonetworks.com/bumblebee-malware-projector-libra/ - webarchive
- https://securityintelligence.com/posts/trickbot-group-systematically-attacking-ukraine - webarchive
- https://twitter.com/Intrinsec/status/1709609529070010447 - webarchive
- https://www.aspirets.com/blog/bumblebee-malware-loader-threat-analysis/ - webarchive
- https://sec-consult.com/blog/detail/bumblebee-hunting-with-a-velociraptor/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-bumblebee-malware-replaces-contis-bazarloader-in-cyberattacks/ - webarchive
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - webarchive
- https://www.intezer.com/blog/malware-analysis/how-threat-actors-abuse-lnk-files/ - webarchive
- https://threathunt.blog/bzz-bzz-bumblebee-loader - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bundestrojaner
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Bundestrojaner.
| Known Synonyms |
|---|
0zapftis |
R2D2 |
Internal MISP references
UUID 04aeda9f-7923-45d1-ab74-9dddd8612d47 which can be used as unique global reference for Bundestrojaner in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BundleBot
Bundlebot is an info stealer that abuses the single-file dotnet bundle which operates as a self-contained executable that does not require any preinstalled dotnet runtime version. Bundlebot functionality targets a wide variety of data including the victim's system information, browser data, telegram data, discord token, Facebook account information, and screenshots.
Internal MISP references
UUID d63eb20b-6a3f-4d96-a52d-8395f1868389 which can be used as unique global reference for BundleBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Bunitu
Bunitu is a trojan that exposes infected computers to be used as a proxy for remote clients. It registers itself at startup by providing its address and open ports. Access to Bunitu proxies is available by using criminal VPN services (e.g.VIP72).
Internal MISP references
UUID 4350b52a-8100-49b5-848d-d4a4029e949d which can be used as unique global reference for Bunitu in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.bunitu - webarchive
- https://broadanalysis.com/2019/04/12/rig-exploit-kit-delivers-bunitu-malware/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/ - webarchive
- https://zerophagemalware.com/2017/06/07/rig-ek-via-fake-eve-online-website-drops-bunitu/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2015/08/whos-behind-your-proxy-uncovering-bunitus-secrets/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2015/07/revisiting-the-bunitu-trojan/ - webarchive
- http://malware-traffic-analysis.net/2017/05/09/index.html - webarchive
- https://malwarebreakdown.com/2018/03/21/fobos-malvertising-campaign-delivers-bunitu-proxy-trojan-via-rig-ek/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Buterat
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Buterat.
| Known Synonyms |
|---|
spyvoltar |
Internal MISP references
UUID cd4ee7f0-394e-4129-a1dc-d5fb423f2311 which can be used as unique global reference for Buterat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Buzus
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Buzus.
| Known Synonyms |
|---|
Yimfoca |
Internal MISP references
UUID 69a3e0ed-1727-4a9c-ae21-1e32322ede93 which can be used as unique global reference for Buzus in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
BYEBY
Internal MISP references
UUID 12886243-55b6-4864-bf7a-7e2439e3a4c1 which can be used as unique global reference for BYEBY in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.byeby - webarchive
- https://www.welivesecurity.com/2020/05/14/mikroceen-spying-backdoor-high-profile-networks-central-asia/ - webarchive
- https://research.checkpoint.com/2020/vicious-panda-the-covid-campaign/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/calypso-apt-2019/ - webarchive
- https://researchcenter.paloaltonetworks.com/2017/09/unit42-threat-actors-target-government-belarus-using-cmstar-trojan - webarchive
- https://decoded.avast.io/luigicamastra/apt-group-planted-backdoors-targeting-high-profile-networks-in-central-asia/ - webarchive
- https://decoded.avast.io/luigicamastra/apt-group-planted-backdoors-targeting-high-profile-networks-in-central-asia - webarchive
- https://unit42.paloaltonetworks.com/unit42-threat-actors-target-government-belarus-using-cmstar-trojan - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
c0d0so0
Internal MISP references
UUID b6b187d0-e19f-489a-91c0-7c94519555f6 which can be used as unique global reference for c0d0so0 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CabArt
Internal MISP references
UUID fe1d51d8-f0e8-4f71-bf5c-724f7d4a824c which can be used as unique global reference for CabArt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CaddyWiper
CaddyWiper is another destructive malware believed to be deployed to target Ukraine.
CaddyWiper wipes all files under C:\Users and all also all files under available drives from D: to Z: by overwriting the data with NULL value. If the target file is greater than 0xA00000 bytes in size (10MB), it will only wipe the first 0xA00000 bytes.
It also wipes disk partitions from \.\PHYSICALDRIVE9 to \.\PHYSICALDRIVE0 by overwriting the first 0x780 bytes with NULL.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CaddyWiper.
| Known Synonyms |
|---|
KillDisk.NCX |
Internal MISP references
UUID c6053700-5f3b-48cc-8176-191393522fc3 which can be used as unique global reference for CaddyWiper in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.caddywiper - webarchive
- https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat - webarchive
- https://cip.gov.ua/en/news/khto-stoyit-za-kiberatakami-na-ukrayinsku-kritichnu-informaciinu-infrastrukturu-statistika-15-22-bereznya - webarchive
- https://thehackernews.com/2022/03/caddywiper-yet-another-data-wiping.html - webarchive
- https://services.google.com/fh/files/blogs/google_fog_of_war_research_report.pdf - webarchive
- https://cybersecuritynews.com/destructive-data-wiper-malware/ - webarchive
- https://securityintelligence.com/posts/caddywiper-malware-targeting-ukrainian-organizations/ - webarchive
- https://www.nioguard.com/2022/03/analysis-of-caddywiper.html - webarchive
- https://blog.talosintelligence.com/2022/03/threat-advisory-caddywiper.html - webarchive
- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - webarchive
- https://maxkersten.nl/binary-analysis-course/analysis-scripts/ghidra-script-to-handle-stack-strings/ - webarchive
- https://blog.morphisec.com/caddywiper-analysis-new-malware-attacking-ukraine - webarchive
- https://www.mandiant.com/resources/blog/gru-rise-telegram-minions - webarchive
- https://twitter.com/HackPatch/status/1503538555611607042 - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ - webarchive
- https://cert.gov.ua/article/39518 - webarchive
- https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/ - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://n0p.me/2022/03/2022-03-26-caddywiper/ - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4Vwwd - webarchive
- https://twitter.com/silascutler/status/1513870210398363651 - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/ - webarchive
- https://www.truesec.com/hub/blog/analysis-of-caddywiper-wiper-targeting-ukraine - webarchive
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-caddywiper - webarchive
- https://twitter.com/ESETresearch/status/1503436420886712321 - webarchive
- https://www.mandiant.com/resources/blog/gru-disruptive-playbook - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war - webarchive
- https://blog.eset.ie/2022/04/12/industroyer2-industroyer-reloaded/ - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2022/03/double-header-isaacwiper-and-caddywiper/ - webarchive
- https://cert.gov.ua/article/3718487 - webarchive
- https://www.nextgov.com/cybersecurity/2022/03/ukrainian-cyber-lead-least-4-types-malware-are-targeting-ukrainian-institutions/363558/ - webarchive
- https://cybernews.com/cyber-war/new-destructive-wiper-malware-deployed-in-ukraine/ - webarchive
- https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/ - webarchive
- https://www.fortinet.com/blog/threat-research/the-year-of-the-wiper - webarchive
- https://www.microsoft.com/en-us/security/business/security-insider/wp-content/uploads/2023/03/A-year-of-Russian-hybrid-warfare-in-Ukraine_MS-Threat-Intelligence-1.pdf - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/ - webarchive
- https://blogs.microsoft.com/on-the-issues/2022/12/03/preparing-russian-cyber-offensive-ukraine/ - webarchive
- https://www.splunk.com/en_us/blog/security/threat-update-caddywiper.html - webarchive
- https://cybersecurity.att.com/blogs/labs-research/analysis-on-recent-wiper-attacks-examples-and-how-they-wiper-malware-works - webarchive
- https://www.youtube.com/watch?v=mrTdSdMMgnk - webarchive
- https://securityaffairs.co/wordpress/129069/cyber-warfare-2/caddywiper-wiper-hits-ukraine.html - webarchive
- https://www.bleepingcomputer.com/news/security/new-caddywiper-data-wiping-malware-hits-ukrainian-networks/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CadelSpy
CadelSpy is a spyware supposedly used by Iranian threat actors. It has several functions such as logging keystrokes, record audio, capture screenshots and webcam photos, and steal any documents that are sent to a printer.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CadelSpy.
| Known Synonyms |
|---|
Cadelle |
Internal MISP references
UUID cad83c5e-2081-4ab4-81c7-32cfc16eae66 which can be used as unique global reference for CadelSpy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cadelspy - webarchive
- https://web.archive.org/web/20191221064439/https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets - webarchive
- http://www.symantec.com/content/en/us/enterprise/media/security_response/docs/CadelSpy-Remexi-IOC.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CALMTHORN
Internal MISP references
UUID 52c0b49b-d57e-400d-8808-a00d4171ac05 which can be used as unique global reference for CALMTHORN in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cameleon
PWC describes this malware as a backdoor, capable of file management, upload and download of files, and execution of commands.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cameleon.
| Known Synonyms |
|---|
StormKitty |
Internal MISP references
UUID d3fb548f-64cb-4997-8262-1dca695fbae2 which can be used as unique global reference for Cameleon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
campoloader
Internal MISP references
UUID 2bf8ef91-a220-49aa-a7b9-0437d2ee0b15 which can be used as unique global reference for campoloader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.campoloader - webarchive
- https://unit42.paloaltonetworks.com/bazarloader-malware/ - webarchive
- https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/ - webarchive
- https://blog.group-ib.com/prometheus-tds - webarchive
- https://therecord.media/meet-prometheus-the-secret-tds-behind-some-of-todays-malware-campaigns/ - webarchive
- https://orangecyberdefense.com/global/blog/cybersoc/in-the-eye-of-our-cybersoc-campo-loader-analysis-and-detection-perspectives/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CamuBot
There is no lot of IOCs in this article so we take one sample and try to extract some interesting IOCs, our findings below :
CamuBot sample : 37ca2e37e1dc26d6b66ba041ed653dc8ee43e1db71a705df4546449dd7591479
Dropped Files on disk :
C:\Users\user~1\AppData\Local\Temp\protecao.exe : 0af612461174eedec813ce670ba35e74a9433361eacb3ceab6d79232a6fe13c1
C:\Users\user~1\AppData\Local\Temp\Renci.SshNet.dll : 3E3CD9E8D94FC45F811720F5E911B892A17EE00F971E498EAA8B5CAE44A6A8D8
C:\ProgramData\m.msi : AD90D4ADFED0BDCB2E56871B13CC7E857F64C906E2CF3283D30D6CFD24CD2190
Protecao.exe try to download hxxp://www.usb-over-network.com/usb-over-network-64bit.msi
A new driver is installed : C:\Windows\system32\drivers\ftusbload2.sys : 9255E8B64FB278BC5FFE5B8F70D68AF8
ftusbload2.sys set 28 IRP handlers.
Internal MISP references
UUID ecac83ab-cd64-4def-979a-40aeeca0400b which can be used as unique global reference for CamuBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cannibal Rat
Cannibal Rat is a python written remote access trojan with 4 versions as of March 2018. The RAT is reported to impact users of a Brazilian public sector management school. The RAT is distributed in a py2exe format, with the python27.dll and the python bytecode stored as a PE resource and the additional libraries zipped in the overlay of the executable.
Internal MISP references
UUID 1e722d81-085e-4beb-8901-aa27fe502dba which can be used as unique global reference for Cannibal Rat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cannon
Internal MISP references
UUID 3fada5b6-0b3d-4b83-97c9-2157c959704c which can be used as unique global reference for Cannon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cannon - webarchive
- https://unit42.paloaltonetworks.com/atoms/fighting-ursa/ - webarchive
- https://www.vkremez.com/2018/11/lets-learn-in-depth-on-sofacy-canon.html - webarchive
- https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Carbanak
MyCERT states that Carbanak is a remote backdoor designed for espionage, data exfiltration, and to remote control.
The attacker deploy malware via spear phishing email to lure the user to open and run the malicious attachment that will infect the machine. The main objective of this campaign is primarily to remotely control the infected machine and gain control of the internal destinations of money processing services such as Automated Teller Machines(ATM) and financial accounts. The following information are the malware capabilities:
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Carbanak.
| Known Synonyms |
|---|
Anunak |
Sekur RAT |
Internal MISP references
UUID 8c246ec4-eaa5-42c0-b137-29f28cbb6832 which can be used as unique global reference for Carbanak in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.carbanak - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://threatintel.blog/OPBlueRaven-Part1/ - webarchive
- https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-two-continuing-source-code-analysis.html - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout - webarchive
- https://www.brighttalk.com/webcast/15591/382191/fin7-apt-how-billion-dollar-crime-ring-remains-active-after-leaders-arrest - webarchive
- https://cocomelonc.github.io/book/2023/12/13/malwild-book.html - webarchive
- https://blog.truesec.com/2020/12/22/collaboration-between-fin7-and-the-ryuk-group-a-truesec-investigation/ - webarchive
- https://cocomelonc.github.io/tutorial/2021/09/06/simple-malware-av-evasion-2.html - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-niagara - webarchive
- https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-three-behind-the-backdoor.html - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
- https://www.mandiant.com/resources/evolution-of-fin7 - webarchive
- https://app.box.com/s/p7qzcury97tuwk26694uutujwqmwqyhe - webarchive
- https://cocomelonc.github.io/malware/2022/07/30/malware-av-evasion-8.html - webarchive
- https://cocomelonc.github.io/tutorial/2022/05/09/malware-pers-4.html - webarchive
- https://therecord.media/two-carbanak-hackers-sentenced-to-eight-years-in-prison-in-kazakhstan/ - webarchive
- https://www.prodaft.com/m/reports/FIN7_TLPCLEAR.pdf - webarchive
- https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-one-a-rare-occurrence.html - webarchive
- https://www.mandiant.com/resources/blog/evolution-of-fin7 - webarchive
- https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-four-desktop-video-player.html - webarchive
- https://unit42.paloaltonetworks.com/atoms/mulelibra/ - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/ - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf - webarchive
- https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html - webarchive
- https://threatintel.blog/OPBlueRaven-Part2/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Carberp
Internal MISP references
UUID 8f0d4866-7c67-4376-a6f2-958224d3c9d0 which can be used as unique global reference for Carberp in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.carberp - webarchive
- https://web.archive.org/web/20150713145858/http://www.rsaconference.com/writable/presentations/file_upload/ht-t06-dissecting-banking-trojan-carberp_copy1.pdf - webarchive
- https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree - webarchive
- https://cdn1.esetstatic.com/eset/US/resources/docs/white-papers/white-papers-win-32-carberp.pdf - webarchive
- https://cocomelonc.github.io/malware/2022/07/30/malware-av-evasion-8.html - webarchive
- https://blog.avast.com/2013/04/08/carberp_epitaph/ - webarchive
- https://cocomelonc.github.io/tutorial/2021/09/06/simple-malware-av-evasion-2.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cardinal RAT
Cardinal RAT is a remote access Trojan capable of stealing username and credentials, cleaning out cookies from browsers, keylogging and capturing screenshots on targeted systems. It is delivered via a downloader dubbed “Carp” which uses malicious macros in Microsoft Excel documents to compile embedded source code into an executable, which then deploys the Cardinal RAT malware family.
Internal MISP references
UUID 3d3da4c0-004c-400c-9da6-f83fd35d907e which can be used as unique global reference for Cardinal RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cardinal_rat - webarchive
- https://www.picussecurity.com/blog/picus-10-critical-mitre-attck-techniques-t1055-process-injection - webarchive
- https://cocomelonc.github.io/malware/2022/07/30/malware-av-evasion-8.html - webarchive
- https://cocomelonc.github.io/tutorial/2021/09/06/simple-malware-av-evasion-2.html - webarchive
- https://www.clearskysec.com/wp-content/uploads/2019/08/ClearSky-2019-H1-Cyber-Events-Summary-Report.pdf - webarchive
- https://cocomelonc.github.io/tutorial/2021/09/04/simple-malware-av-evasion.html - webarchive
- https://unit42.paloaltonetworks.com/cardinal-rat-sins-again-targets-israeli-fin-tech-firms/ - webarchive
- http://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/?adbsc=social71702736&adbid=855028404965433346&adbpl=tw&adbpr=4487645412 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CargoBay
CargoBay is a newer malware family which was first observed in 2022 and is notable for being written in the Rust language. CargoBay is likely based on source code taken from 'Black Hat Rust' GitHub project (https://github.com/skerkour/black-hat-rust). CargoBay is usually distributed via phishing emails, and the malware binaries may be disguised as legitimate applications. Upon execution, the malware starts by performing environmental checks such as checking its execution path and the configured system language. If the tests pass, then the malware proceeds to gather basic system information and register with its C2 via HTTP from which it receives JSON-formatted jobs to carry out. CargoBay can execute commands via the command line and downloading additional malware binaries.
Internal MISP references
UUID cfdc931d-d3da-4b2a-9fef-42592c0f5c5f which can be used as unique global reference for CargoBay in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CARROTBALL
CARROTBALL is a simple FTP downloader built to deploy SYSCON, a Remote Access Trojan used by the same threat actor. Discovered by Unit 42 in late 2019, the downloader was adopted for use in spear phishing attacks against US government agencies.
Internal MISP references
UUID cca82b51-fef9-4f33-a2f5-418b80d0966d which can be used as unique global reference for CARROTBALL in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CarrotBat
Internal MISP references
UUID 4ad06a5f-12e6-44ae-9547-98ee62114357 which can be used as unique global reference for CarrotBat in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.carrotbat - webarchive
- https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/ - webarchive
- https://unit42.paloaltonetworks.com/unit42-the-fractured-block-campaign-carrotbat-malware-used-to-deliver-malware-targeting-southeast-asia/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Casper
ESET describes Casper as a well-developed reconnaissance tool, making extensive efforts to remain unseen on targeted machines. Of particular note are the specific strategies adopted against anti-malware software. Casper was used against Syrian targets in April 2014, which makes it the most recent malware from this group publicly known at this time.
Internal MISP references
UUID 3198501e-0ff0-43b7-96f0-321b463ab656 which can be used as unique global reference for Casper in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CatB
Internal MISP references
UUID a96445d6-4bbb-4b9a-a761-83759108a403 which can be used as unique global reference for CatB in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.catb - webarchive
- https://minerva-labs.com/blog/new-catb-ransomware-employs-2-year-old-dll-hijacking-technique-to-evade-detection/ - webarchive
- https://www.sentinelone.com/blog/decrypting-catb-ransomware-analyzing-their-latest-attack-methods/ - webarchive
- http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Catchamas
Internal MISP references
UUID 8060dbdc-cf31-40bc-9900-eb8119423c50 which can be used as unique global reference for Catchamas in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CCleaner Backdoor
According to CrowdStrike, this backdoor was discovered embedded in the legitimate, signed version of CCleaner 5.33, and thus constitutes a supply chain attack.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CCleaner Backdoor.
| Known Synonyms |
|---|
DIRTCLEANER |
Internal MISP references
UUID c51ee09b-fc2d-41fd-a43b-426a4f337139 which can be used as unique global reference for CCleaner Backdoor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ccleaner_backdoor - webarchive
- https://blog.avast.com/new-investigations-in-ccleaner-incident-point-to-a-possible-third-stage-that-had-keylogger-capacities - webarchive
- http://blog.talosintelligence.com/2017/09/avast-distributes-malware.html - webarchive
- https://stmxcsr.com/persistence/print-processor.html - webarchive
- https://blog.avast.com/avast-threat-labs-analysis-of-ccleaner-incident - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-atlas - webarchive
- http://www.intezer.com/evidence-aurora-operation-still-active-part-2-more-ties-uncovered-between-ccleaner-hack-chinese-hackers/ - webarchive
- https://blog.avast.com/additional-information-regarding-the-recent-ccleaner-apt-security-incident - webarchive
- https://www.crowdstrike.com/blog/in-depth-analysis-of-the-ccleaner-backdoor-stage-2-dropper-and-its-payload/ - webarchive
- https://risky.biz/whatiswinnti/ - webarchive
- https://blog.avast.com/update-ccleaner-attackers-entered-via-teamviewer - webarchive
- https://www.mandiant.com/resources/pe-file-infecting-malware-ot - webarchive
- https://securelist.com/big-threats-using-code-similarity-part-1/97239/ - webarchive
- https://www.ptsecurity.com/upload/corporate/ww-en/pt-esc/winnti-2020-eng.pdf - webarchive
- https://twitter.com/craiu/status/910148928796061696 - webarchive
- http://blog.morphisec.com/morphisec-discovers-ccleaner-backdoor - webarchive
- https://www.wired.com/story/ccleaner-malware-targeted-tech-firms - webarchive
- https://www.crowdstrike.com/blog/protecting-software-supply-chain-deep-insights-ccleaner-backdoor/ - webarchive
- http://www.intezer.com/evidence-aurora-operation-still-active-supply-chain-attack-through-ccleaner/ - webarchive
- http://blog.talosintelligence.com/2017/09/ccleaner-c2-concern.html - webarchive
- https://www.ptsecurity.com/upload/corporate/ru-ru/pt-esc/winnti-2020-rus.pdf - webarchive
- https://blog.avast.com/progress-on-ccleaner-investigation - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CEELOADER
Mandiant characterizes this malware as a downloader and shellcode stager.
Internal MISP references
UUID 0333d13e-e01f-46cd-a030-448bbf043c10 which can be used as unique global reference for CEELOADER in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CenterPOS
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CenterPOS.
| Known Synonyms |
|---|
cerebrus |
Internal MISP references
UUID fca8c5e0-4fef-408c-bcd7-9826271e8e5d which can be used as unique global reference for CenterPOS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cerber
A prolific ransomware which originally added ".cerber" as a file extension to encrypted files. Has undergone multiple iterations in which the extension has changed. Uses a very readily identifiable set of of UDP activity to checkin and report infections. Primarily uses TOR for payment information.
Internal MISP references
UUID 79a7203a-6ea5-4c39-abd4-faa20cf8821a which can be used as unique global reference for Cerber in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cerber - webarchive
- https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-345a - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/cerber-starts-evading-machine-learning/ - webarchive
- https://www.virusbulletin.com/virusbulletin/2017/12/vb2017-paper-nine-circles-cerber/ - webarchive
- https://www.youtube.com/watch?v=y8Z9KnL8s8s - webarchive
- https://storage.googleapis.com/pub-tools-public-publication-data/pdf/ce44cbda9fdc061050c1d2a5dec0270874a9dc85.pdf - webarchive
- https://news.sophos.com/en-us/2022/06/16/confluence-exploits-used-to-drop-ransomware-on-vulnerable-servers/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://research.checkpoint.com/2023/following-the-scent-of-trickgate-6-year-old-packer-used-to-deploy-the-most-wanted-malware/ - webarchive
- https://rinseandrepeatanalysis.blogspot.com/2018/08/reversing-cerber-raas.html - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://i.blackhat.com/asia-21/Thursday-Handouts/as21-Taniguchi-How-Did-The-Adversaries-Abusing-The-Bitcoin-Blockchain-Evade-Our-Takeover.pdf - webarchive
- https://www.justice.gov/usao-dc/press-release/file/1021186/download - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-as-a-service-enabler-of-widespread-attacks - webarchive
- https://www.youtube.com/watch?v=LUxOcpIRxmg - webarchive
- https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/03/cerber-ransomware-new-but-mature/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cerbu
This malware family delivers its artifacts packed with free and generic packers. It writes files to windows temporary folders, downloads additional malware (generally cryptominers) and deletes itself.
Internal MISP references
UUID ba7706c1-7d2a-4031-9acc-cb862860da1a which can be used as unique global reference for Cerbu in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CetaRAT
Internal MISP references
UUID 12d2d503-def6-4161-bd42-2093ccad49bd which can be used as unique global reference for CetaRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ceta_rat - webarchive
- https://blogs.quickheal.com/cetarat-apt-group-targeting-the-government-agencies/ - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/591/original/062521_SideCopy_%281%29.pdf?1625657388 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ChaChi
Internal MISP references
UUID 6a3e6f07-1aaa-4af5-8bd3-96898aca3510 which can be used as unique global reference for ChaChi in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chaes
Internal MISP references
UUID 0d4ab3af-189f-49af-b47a-9b25f59f9a12 which can be used as unique global reference for Chaes in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chainshot
Internal MISP references
UUID 36f9a5e0-9a78-4b9a-9072-1596c91b59b6 which can be used as unique global reference for Chainshot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.chainshot - webarchive
- https://researchcenter.paloaltonetworks.com/2018/09/unit42-slicing-dicing-cve-2018-5002-payloads-new-chainshot-malware/ - webarchive
- https://www.icebrg.io/blog/adobe-flash-zero-day-targeted-attack - webarchive
- https://www.vice.com/en_us/article/3kx5y3/uzbekistan-hacking-operations-uncovered-due-to-spectacularly-bad-opsec - webarchive
- https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/ - webarchive
- https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CHAIRSMACK
Internal MISP references
UUID f049e626-7de2-4648-81db-53dfd34f2fab which can be used as unique global reference for CHAIRSMACK in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chaos (Windows)
In-development ransomware family which was released in June 2021 by an unknown threat actor. The builder initially claimed to be a "Ryuk .Net Ransomware Builder" even though it was completely unrelated to the Ryuk malware family. Presently it appears to contain trojan-like features, but lacks features commonly found in ransomware such as data exfiltration.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Chaos (Windows).
| Known Synonyms |
|---|
FakeRyuk |
RyukJoke |
Yashma |
Internal MISP references
UUID fb760029-9331-4ba0-b644-d47a8e6d3ad2 which can be used as unique global reference for Chaos (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.chaos - webarchive
- https://blog.talosintelligence.com/new-threat-actor-using-yashma-ransomware/ - webarchive
- https://marcoramilli.com/2021/06/14/the-allegedly-ryuk-ransomware-builder-ryukjoke/ - webarchive
- https://research.openanalysis.net/quasar/chaos/rat/ransomware/2023/04/13/quasar-chaos.html - webarchive
- https://www.bleepingcomputer.com/news/security/roblox-game-pass-store-used-to-sell-ransomware-decryptor/ - webarchive
- https://www.fortinet.com/blog/threat-research/chaos-ransomware-variant-sides-with-russia - webarchive
- https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree - webarchive
- https://www.fortinet.com/blog/threat-research/chaos-ransomware-variant-in-fake-minecraft-alt-list-brings-destruction - webarchive
- https://threatmon.io/chaos-unleashed-a-technical-analysis-of-a-novel-ransomware/ - webarchive
- https://twitter.com/vinopaljiri/status/1519645742440329216 - webarchive
- https://www.trendmicro.com/en_us/research/21/h/chaos-ransomware-a-dangerous-proof-of-concept.html - webarchive
- https://brianstadnicki.github.io/posts/malware-chaos-ransomware-v4/ - webarchive
- https://blog.qualys.com/vulnerabilities-threat-research/2022/01/17/the-chaos-ransomware-can-be-ravaging - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chaperone
According to Kaspersky GReAT and AMR, TajMahal is a previously unknown and technically sophisticated APT framework discovered by Kaspersky Lab in the autumn of 2018. This full-blown spying framework consists of two packages named Tokyo and Yokohama. It includes backdoors, loaders, orchestrators, C2 communicators, audio recorders, keyloggers, screen and webcam grabbers, documents and cryptography key stealers, and even its own file indexer for the victim’s machine. We discovered up to 80 malicious modules stored in its encrypted Virtual File System, one of the highest numbers of plugins they have ever seen for an APT toolset.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Chaperone.
| Known Synonyms |
|---|
Taj Mahal |
Internal MISP references
UUID e4027aaa-de86-48ea-8567-c215cdb88ec1 which can be used as unique global reference for Chaperone in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ChargeWeapon
Internal MISP references
UUID 4eccbebb-9f7d-411f-a8fe-da01c99c8e3b which can be used as unique global reference for ChargeWeapon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CHCH
CHCH is a Ransomware spotted in the wild in December 2019. It encrypts victim files and adds the extension .chch to them while it drops a ransomware note named: READ_ME.TXT
Internal MISP references
UUID 22b03600-505c-41d4-ba1c-45d70cc2e123 which can be used as unique global reference for CHCH in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ChChes
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ChChes.
| Known Synonyms |
|---|
HAYMAKER |
Ham Backdoor |
Internal MISP references
UUID 6eee9bf9-ffce-4c88-a5ad-9d80f6fc727c which can be used as unique global reference for ChChes in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.chches - webarchive
- https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html - webarchive
- http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/ - webarchive
- https://www.jpcert.or.jp/magazine/acreport-ChChes.html - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-riverside - webarchive
- https://www.jpcert.or.jp/magazine/acreport-ChChes_ps1.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CHEESETRAY
CHEESETRAY is a sophisticated proxy-aware backdoor that can operate in both active and passive mode depending on the passed command-line parameters. The backdoor is capable of enumerating files and processes, enumerating drivers, enumerating remote desktop sessions, uploading and downloading files, creating and terminating processes, deleting files, creating a reverse shell, acting as a proxy server, and hijacking processes among its other functionality. The backdoor communicates with its C&C server using a custom binary protocol over TCP with port specified as a command-line parameter.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CHEESETRAY.
| Known Synonyms |
|---|
CROWDEDFLOUNDER |
Internal MISP references
UUID 7a6c1063-32b9-4007-8283-ccd4a2163caa which can be used as unique global reference for CHEESETRAY in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cheesetray - webarchive
- https://www.us-cert.gov/ncas/analysis-reports/ar20-045c - webarchive
- https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/apt/rpt-apt38-2018.pdf - webarchive
- https://labs.sentinelone.com/dprk-hidden-cobra-update-north-korean-malicious-cyber-activity/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chernolocker
Chernolocker is a ransomware that encrypts a victim's files by using AES-256 and it asks for BTC ransom. Different versions are classified by the attacker's email address which changes over time.
Internal MISP references
UUID e21dc86d-c8a5-44f7-b9d6-5e60373e838b which can be used as unique global reference for Chernolocker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CherryPicker POS
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CherryPicker POS.
| Known Synonyms |
|---|
cherry_picker |
cherrypicker |
cherrypickerpos |
Internal MISP references
UUID e6ab90d3-8011-4927-a0cd-eab57e7971aa which can be used as unique global reference for CherryPicker POS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cherry_picker - webarchive
- https://www.trustwave.com/Resources/SpiderLabs-Blog/Shining-the-Spotlight-on-Cherry-Picker-PoS-Malware/ - webarchive
- https://www.trustwave.com/Resources/SpiderLabs-Blog/New-Memory-Scraping-Technique-in-Cherry-Picker-PoS-Malware/ - webarchive
- https://cocomelonc.github.io/tutorial/2022/05/16/malware-pers-5.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ChewBacca
Internal MISP references
UUID 2137a0ce-8d06-4538-ad0b-6ab6ec865493 which can be used as unique global reference for ChewBacca in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chimera
According to PCrisk, Chimera is a ransomware virus that encrypts files stored on infected systems. It is distributed using various false job applications, business offers, and infected email attachments. After encrypting the files, Chimera adds a . crypt extension to each file.
Internal MISP references
UUID 830b0526-8e3b-4369-9677-9f8a31ca5ded which can be used as unique global reference for Chimera in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CHINACHOPPER
a simple code injection webshell that executes Microsoft .NET code within HTTP POST commands. This allows the shell to upload and download files, execute applications with web server account permissions, list directory contents, access Active Directory, access databases, and any other action allowed by the .NET runtime.
Internal MISP references
UUID 0d8f0bb7-e14f-4b85-baa1-6ec951aa6c53 which can be used as unique global reference for CHINACHOPPER in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.chinachopper - webarchive
- https://www.crowdstrike.com/blog/an-end-to-smash-and-grab-more-targeted-approaches/ - webarchive
- https://www.picussecurity.com/resource/blog/ttps-hafnium-microsoft-exchange-servers - webarchive
- https://www.youtube.com/watch?v=rn-6t7OygGk - webarchive
- https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos - webarchive
- https://attack.mitre.org/groups/G0096 - webarchive
- https://web.archive.org/web/20200307113010/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1574947864.pdf - webarchive
- https://www.domaintools.com/resources/blog/examining-exchange-exploitation-and-its-lessons-for-defenders - webarchive
- https://www.imperva.com/blog/imperva-observes-hive-of-activity-following-hafnium-microsoft-exchange-disclosures/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/multi-factor-authentication-new-attacks - webarchive
- https://unit42.paloaltonetworks.com/remediation-steps-for-the-Microsoft-Exchange-Server-vulnerabilities/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-president - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/microsoft-exchange-server-protection - webarchive
- https://blog.talosintelligence.com/2019/08/china-chopper-still-active-9-years-later.html - webarchive
- https://www.secureworks.com/blog/ongoing-campaign-leveraging-exchange-vulnerability-potentially-linked-to-iran - webarchive
- https://twitter.com/CyberRaiju/status/1373582619707867136 - webarchive
- https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_9_yanagishita-tamada-nakatsuru-ishimaru_en.pdf - webarchive
- https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/hafnium-china-chopper-and-aspnet-runtime/ - webarchive
- https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/incident-response-polar-ransomware-apt27/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-mohawk - webarchive
- https://twitter.com/ESETresearch/status/1366862946488451088 - webarchive
- https://www.praetorian.com/blog/reproducing-proxylogon-exploit/ - webarchive
- https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html - webarchive
- https://unit42.paloaltonetworks.com/exchange-server-credential-harvesting/ - webarchive
- https://blog.talosintelligence.com/2021/05/lemon-duck-spreads-wings.html - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/witchetty-steganography-espionage - webarchive
- https://www.microsoft.com/security/blog/2021/03/25/analyzing-attacks-taking-advantage-of-the-exchange-server-vulnerabilities/ - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-259a - webarchive
- https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-atlas - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-express - webarchive
- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers - webarchive
- https://techcommunity.microsoft.com/t5/azure-sentinel/web-shell-threat-hunting-with-azure-sentinel/ba-p/2234968 - webarchive
- https://unit42.paloaltonetworks.com/microsoft-exchange-server-attack-timeline/ - webarchive
- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/ - webarchive
- https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html - webarchive
- https://attack.mitre.org/groups/G0125/ - webarchive
- https://redcanary.com/blog/microsoft-exchange-attacks - webarchive
- https://secjoes-reports.s3.eu-central-1.amazonaws.com/Backdoor%2Bvia%2BXFF%2BMysterious%2BThreat%2BActor%2BUnder%2BRadar.pdf - webarchive
- https://www.huntress.com/blog/rapid-response-mass-exploitation-of-on-prem-exchange-servers - webarchive
- https://www.cyborgsecurity.com/blog/you-dont-know-the-hafnium-of-it/ - webarchive
- https://informationonsecurity.blogspot.com/2012/11/china-chopper-webshell.html - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf - webarchive
- https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/ - webarchive
- https://blog.joshlemon.com.au/hafnium-exchange-attacks/ - webarchive
- https://www.fireeye.com/blog/threat-research/2019/08/game-over-detecting-and-stopping-an-apt41-operation.html - webarchive
- https://www.wired.com/story/china-microsoft-exchange-server-hack-victims/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-275a - webarchive
- https://www.trendmicro.com/en_us/research/21/d/could-the-microsoft-exchange-breach-be-stopped.html - webarchive
- https://www.trendmicro.com/en_us/research/21/d/hello-ransomware-uses-updated-china-chopper-web-shell-sharepoint-vulnerability.html - webarchive
- https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/Vorfaelle/Exchange-Schwachstellen-2021/MSExchange_Schwachstelle_Detektion_Reaktion.pdf - webarchive
- https://www.trendmicro.com/en_us/research/21/e/proxylogon-a-coinminer--a-ransomware--and-a-botnet-join-the-part.html - webarchive
- https://www.paloaltonetworks.com/blog/security-operations/through-the-cortex-xdr-lens-uncovering-a-new-activity-group-targeting-governments-in-the-middle-east-and-africa/ - webarchive
- https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers - webarchive
- https://unit42.paloaltonetworks.com/atoms/iron-taurus/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-union - webarchive
- https://news.sophos.com/en-us/2021/05/07/new-lemon-duck-variants-exploiting-microsoft-exchange-server/?cmp=30728 - webarchive
- https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html - webarchive
- https://www.reddit.com/r/msp/comments/lwmo5c/mass_exploitation_of_onprem_exchange_servers - webarchive
- https://www.huntress.com/hubfs/Mass%20Exploitation%20of%20Microsoft%20Exchange%20(2).pdf - webarchive
- https://www.trendmicro.com/en_us/research/21/a/targeted-attack-using-chopper-aspx-web-shell-exposed-via-managed.html - webarchive
- https://asec.ahnlab.com/en/47455/ - webarchive
- https://www.crowdstrike.com/blog/falcon-complete-stops-microsoft-exchange-server-zero-day-exploits - webarchive
- https://www.domaintools.com/content/conceptualizing-a-continuum-of-cyber-threat-attribution.pdf - webarchive
- https://blog.truesec.com/2021/03/07/exchange-zero-day-proxylogon-and-hafnium/ - webarchive
- https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html - webarchive
- https://www.justice.gov/opa/pr/two-chinese-hackers-working-ministry-state-security-charged-global-computer-intrusion - webarchive
- https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-259a - webarchive
- https://unit42.paloaltonetworks.com/china-chopper-webshell/ - webarchive
- https://www.fireeye.com/blog/threat-research/2021/09/proxyshell-exploiting-microsoft-exchange-servers.html - webarchive
- https://attack.mitre.org/software/S0020/ - webarchive
- https://www.huntress.com/hubfs/Videos/Webinars/Overlay-Mass_Exploitation_of_Exchange.mp4 - webarchive
- https://www.devo.com/blog/detect-and-investigate-hafnium-using-devo/ - webarchive
- https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chinad
Adware that shows advertisements using plugin techniques for popular browsers
Internal MISP references
UUID 098cfb93-8921-48f0-a694-a83f350e8a61 which can be used as unique global reference for Chinad in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ChinaJm
Ransomware.
Internal MISP references
UUID ef216f1d-9ee5-4676-ae34-f954a8611290 which can be used as unique global reference for ChinaJm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chinotto (Windows)
Internal MISP references
UUID fda4561c-56a9-479b-8db5-7f6774be9a3d which can be used as unique global reference for Chinotto (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.chinotto - webarchive
- https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37 - webarchive
- https://www.boho.or.kr/data/reportView.do?bulletin_writing_sequence=67064 - webarchive
- https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/ - webarchive
- https://blog.sekoia.io/peeking-at-reaper-surveillance-operations-against-north-korea-defectors/ - webarchive
- https://thorcert.notion.site/TTPs-9-f04ce99784874947978bd2947738ac92 - webarchive
- https://threatmon.io/chinotto-backdoor-technical-analysis-of-the-apt-reapers-powerful/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chinoxy
Internal MISP references
UUID f8f5f33b-c719-4b6d-bf98-07979ac0cd97 which can be used as unique global reference for Chinoxy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.chinoxy - webarchive
- https://community.riskiq.com/article/56fa1b2f - webarchive
- https://documents.trendmicro.com/assets/white_papers/wp-finding-APTX-attributing-attacks-via-MITRE-TTPs.pdf - webarchive
- https://medium.com/@Sebdraven/how-to-unpack-chinoxy-backdoor-and-decipher-the-configuration-of-the-backdoor-4ffd98ca2a02 - webarchive
- https://www.fortinet.com/blog/threat-research/pivnoxy-and-chinoxy-puppeteer-analysis - webarchive
- https://community.riskiq.com/article/5fe2da7f - webarchive
- https://nao-sec.org/2021/01/royal-road-redive.html - webarchive
- https://medium.com/@Sebdraven/new-version-of-chinoxy-backdoor-using-covid19-document-lure-83fa294c0746 - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/above-fold-and-your-inbox-tracing-state-aligned-activity-targeting-journalists - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-1208.pdf - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chir
Internal MISP references
UUID 59b5697a-5154-4c08-87f8-c71b0e8425fc which can be used as unique global reference for Chir in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chisel (Windows)
Chisel is an open-source project by Jaime Pillora (jpillora) that allows tunneling TCP and UDP connections via HTTP. It is available across platforms and written in Go. While benign in itself, Chisel has been utilized by multiple threat actors. It was for example observed by SentinelOne during a PYSA ransomware campaign to achieve persistence and used as backdoor. Github: https://github.com/jpillora/chisel
Internal MISP references
UUID fbfbbcbc-6730-4c4d-9ece-9b72802d42e9 which can be used as unique global reference for Chisel (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ChiserClient
Internal MISP references
UUID 637714e1-c46d-4c10-bbc5-604c6e47fbbb which can be used as unique global reference for ChiserClient in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Choziosi (Windows)
Choziosi is a browser hijacker for Chrome. It was first seen in January 2022. It commonly infects users via pirated media downloads like games, software, wallpapers or movies. The initial infectors are available for several platforms such as Mac and Windows.
Its main component is the Chrome browser extension written in JavaScript with the purpose of serving advertisments and hijacking search requests to Google, Yahoo and Bing.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Choziosi (Windows).
| Known Synonyms |
|---|
ChromeLoader |
Internal MISP references
UUID 7cfa3158-ccfc-4c23-8e7a-5d4e9cc1c43f which can be used as unique global reference for Choziosi (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.choziosi - webarchive
- https://blogs.blackberry.com/en/2022/11/chromeloader-infects-the-browser-by-loading-malicious-extension - webarchive
- https://www.gdatasoftware.com/blog/2022/01/37236-qr-codes-on-twitter-deliver-malicious-chrome-extension - webarchive
- https://blogs.vmware.com/security/2022/09/the-evolution-of-the-chromeloader-malware.html - webarchive
- https://cybergeeks.tech/chromeloader-browser-hijacker - webarchive
- https://www.connectwise.com/blog/threat-report/smash-jacker - webarchive
- https://redcanary.com/blog/chromeloader/ - webarchive
- https://github.com/xephora/Threat-Remediation-Scripts/tree/main/Threat-Track/CS_INSTALLER - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Chthonic
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Chthonic.
| Known Synonyms |
|---|
AndroKINS |
Internal MISP references
UUID 9441a589-e23d-402d-9603-5e55e3e33971 which can be used as unique global reference for Chthonic in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.chthonic - webarchive
- https://securelist.com/chthonic-a-new-modification-of-zeus/68176/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://www.proofpoint.com/us/threat-insight/post/threat-actors-using-legitimate-paypal-accounts-to-distribute-chthonic-banking-trojan - webarchive
- https://bartblaze.blogspot.com/2017/08/crystal-finance-millennium-used-to.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
cifty
Internal MISP references
UUID 8a1af36b-b8e1-4e05-ac42-c2866ffba031 which can be used as unique global reference for cifty in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cinobi
Internal MISP references
UUID d0f0f754-fe9b-45bd-a9d2-c6110c807af4 which can be used as unique global reference for Cinobi in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cinobi - webarchive
- https://documents.trendmicro.com/assets/pdf/Tech%20Brief_Operation%20Overtrap%20Targets%20Japanese%20Online%20Banking%20Users.pdf - webarchive
- https://www.trendmicro.com/en_us/research/21/h/cinobi-banking-trojan-targets-users-of-cryptocurrency-exchanges-.html - webarchive
- http://www.pwncode.io/2019/12/unpacking-payload-used-in-bottle-ek.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/operation-overtrap-targets-japanese-online-banking-users-via-bottle-exploit-kit-and-brand-new-cinobi-banking-trojan/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cinoshi
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cinoshi.
| Known Synonyms |
|---|
Agniane |
Internal MISP references
UUID 65f75ea8-c06b-4d8d-b757-e992966667b5 which can be used as unique global reference for Cinoshi in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cinoshi - webarchive
- https://www.youtube.com/watch?v=-KJ0HIvmVl0 - webarchive
- https://cyble.com/blog/cinoshi-project-and-the-dark-side-of-free-maas/ - webarchive
- https://twitter.com/suyog41/status/1633807752127475713?s=20 - webarchive
- https://www.zscaler.com/blogs/security-research/agniane-stealer-dark-webs-crypto-threat - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Citadel
Internal MISP references
UUID 7f550cae-98b7-4a0c-bed2-d79227dc6310 which can be used as unique global reference for Citadel in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.citadel - webarchive
- http://www.xylibox.com/2016/02/citadel-0011-atmos.html - webarchive
- https://blog.malwarebytes.com/threat-analysis/2012/11/citadel-a-cyber-criminals-ultimate-weapon/ - webarchive
- https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree - webarchive
- https://vx-underground.org/archive/APTs/2017/2017.12.11/Money%20Taker.pdf - webarchive
- http://blog.jpcert.or.jp/2016/02/banking-trojan--27d6.html - webarchive
- https://www.justice.gov/opa/pr/four-individuals-plead-guilty-rico-conspiracy-involving-bulletproof-hosting-cybercriminals - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Clambling
Clambling was discovered by Trend Micro and TalentJump. It is a custom malware used by an actor they refer to as DRBControl, which targets gambling and betting companies in Southeast Asia. One version of Clambling uses Dropbox as C&C channel to hide its communication.
Internal MISP references
UUID 783c8192-d00d-446c-bf06-0ce0cb4bc2c2 which can be used as unique global reference for Clambling in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.clambling - webarchive
- https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf - webarchive
- https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/chinas-apt-hackers-move-to-ransomware-attacks/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CLASSFON
Internal MISP references
UUID c433e0f1-760c-41e6-bb62-13eaf7bbf1f4 which can be used as unique global reference for CLASSFON in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CLEANTOAD
CLEANTOAD is a disruption tool that will delete file system artifacts, including those related to BLINDTOAD, and will run after a date obtained from a configuration file. The malware injects shellcode into notepad.exe and it overwrites and deletes files, modifies registry keys, deletes services, and clears Windows event logs.
Internal MISP references
UUID c0417767-5b98-43b0-b9e7-e43dc7f53c6a which can be used as unique global reference for CLEANTOAD in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Client Maximus
Internal MISP references
UUID c2bd0771-55d6-4242-986d-4bfd735998ba which can be used as unique global reference for Client Maximus in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ClipBanker
The ClipBanker Trojan is known as an information stealer and spy trojan, it aims to steal and record any type of sensitive information from the infected environment such as browser history, cookies, Outlook data, Skype, Telegram, or cryptocurrency wallet account addresses. The main goal of this threat is to steal confidential information. The ClipBanker uses PowerShell commands for executing malicious activities. The thing that made the ClipBanker unique is its ability to record various banking actions of the user and manipulate them for its own benefit. The distribution method of the ClipBanker is through phishing emails or through social media posts that lure users to download malicious content.
Internal MISP references
UUID 5d6a9b59-96b1-4bc4-824d-ffe208b99462 which can be used as unique global reference for ClipBanker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.clipbanker - webarchive
- https://asec.ahnlab.com/en/35981/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/covid-19-phishing-lure-to-steal-and-mine-cryptocurrency/ - webarchive
- https://www.welivesecurity.com/2019/04/30/buhtrap-backdoor-ransomware-advertising-platform/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://www.cynet.com/attack-techniques-hands-on/threat-research-report-clipbanker-13-second-attack/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict/IOC%20Resource%20for%20Russia-Ukraine%20Conflict-Related%20Cyberattacks-03032022.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Clipog
A keylogger.
Internal MISP references
UUID 0cc6c7a8-9484-4017-97ac-2fd5594f27f8 which can be used as unique global reference for Clipog in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Clop (Windows)
Clop is a ransomware which uses the .clop extension after having encrypted the victim's files. Another unique characteristic belonging with Clop is in the string: "Dont Worry C|0P" included into the ransom notes. It is a variant of CryptoMix ransomware, but it additionally attempts to disable Windows Defender and to remove the Microsoft Security Essentials in order to avoid user space detection.
Internal MISP references
UUID 8071f2d8-cc44-4682-845b-6f39a9f8b587 which can be used as unique global reference for Clop (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.clop - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://fourcore.io/blogs/clop-ransomware-history-adversary-simulation - webarchive
- https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/ - webarchive
- https://www.advanced-intel.com/post/adversarial-perspective-advintel-breach-avoidance-through-monitoring-initial-vulnerabilities - webarchive
- https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/ - webarchive
- http://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive
- https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/ - webarchive
- https://www.bleepingcomputer.com/news/security/indiabulls-group-hit-by-clop-ransomware-gets-24h-leak-deadline/ - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://twitter.com/darb0ng/status/1338692764121251840 - webarchive
- https://www.fsec.or.kr/common/proc/fsec/bbs/163/fileDownLoad/2297.do - webarchive
- https://unit42.paloaltonetworks.com/clop-ransomware/ - webarchive
- https://www.prodaft.com/m/reports/TeslaGun_TLPWHITE.pdf - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-clop - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://github.com/albertzsigovits/malware-notes/blob/master/Ransomware/Clop.md - webarchive
- https://www.telekom.com/en/blog/group/article/cybersecurity-ta505-s-box-of-chocolate-597672 - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://www.notion.so/S2W-LAB-Analysis-of-Clop-Ransomware-suspiciously-related-to-the-Recent-Incident-English-088056baf01242409a6e9f844f0c5f2e - webarchive
- https://www.npu.gov.ua/news/kiberzlochini/kiberpolicziya-vikrila-xakerske-ugrupovannya-u-rozpovsyudzhenni-virusu-shifruvalnika-ta-nanesenni-inozemnim-kompaniyam-piv-milyarda-dolariv-zbitkiv/ - webarchive
- https://www.telekom.com/en/blog/group/article/inside-of-cl0p-s-ransomware-operation-615824 - webarchive
- https://asec.ahnlab.com/en/19542/ - webarchive
- https://www.zdnet.com/article/croatias-largest-petrol-station-chain-impacted-by-cyber-attack/ - webarchive
- https://actu.fr/normandie/rouen_76540/une-rancon-apres-cyberattaque-chu-rouen-ce-reclament-pirates_29475649.html - webarchive
- https://www.boho.or.kr/filedownload.do?attach_file_seq=2808&attach_file_id=EpF2808.pdf - webarchive
- https://www.binance.com/en/blog/421499824684902240/Binance-Helps-Take-Down-Cybercriminal-Ring-Laundering-%24500M-in-Ransomware-Attacks - webarchive
- https://www.notion.so/S2W-LAB-Analysis-of-Clop-Ransomware-suspiciously-related-to-the-Recent-Incident-c26daec604da4db6b3c93e26e6c7aa26 - webarchive
- https://therecord.media/ukrainian-police-arrest-clop-ransomware-members-seize-server-infrastructure/ - webarchive
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/clop-ransomware/ - webarchive
- https://blog.sensecy.com/2020/08/20/global-ransomware-attacks-in-2020-the-top-4-vulnerabilities/ - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/ransomware-gang-urges-victims-customers-to-demand-a-ransom-payment/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.trendmicro.com/en_in/research/21/k/global-operations-lead-to-arrests-of-alleged-members-of-gandcrab.html - webarchive
- https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/ - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://medium.com/s2wlab/operation-synctrek-e5013df8d167 - webarchive
- https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-double-extortion-and-beyond-revil-clop-and-conti - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/cryptomix-clop-ransomware-says-its-targeting-networks-not-computers/ - webarchive
- https://www.bleepingcomputer.com/news/security/ta505-hackers-behind-maastricht-university-ransomware-attack/ - webarchive
- https://www.mandiant.com/resources/mandiant-red-team-emulates-fin11-tactics - webarchive
- https://www.bleepingcomputer.com/news/security/microsoft-links-raspberry-robin-worm-to-clop-ransomware-attacks/ - webarchive
- https://krebsonsecurity.com/2021/06/ukrainian-police-nab-six-tied-to-clop-ransomware/ - webarchive
- https://medium.com/@Sebdraven/unpacking-clop-416b83718e0f - webarchive
- https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/ - webarchive
- https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html - webarchive
- https://www.telekom.com/en/blog/group/article/eager-beaver-a-short-overview-of-the-restless-threat-actor-ta505-609546 - webarchive
- https://securelist.com/modern-ransomware-groups-ttps/106824/ - webarchive
- https://www.flashpoint-intel.com/blog/cl0p-and-revil-escalate-their-ransomware-tactics/ - webarchive
- https://www.zdnet.com/article/german-tech-giant-software-ag-down-after-ransomware-attack/ - webarchive
- https://github.com/albertzsigovits/malware-notes/blob/master/Clop.md - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://asec.ahnlab.com/wp-content/uploads/2021/01/Analysis_ReportCLOP_Ransomware.pdf - webarchive
- https://www.splunk.com/en_us/blog/security/clop-ransomware-detection-threat-research-release-april-2021.html - webarchive
- https://www.hornetsecurity.com/en/security-information/clop-clop-ta505-html-malspam-analysis/ - webarchive
- https://research.loginsoft.com/threat-research/taming-the-storm-understanding-and-mitigating-the-consequences-of-cve-2023-27350/ - webarchive
- https://github.com/Tera0017/TAFOF-Unpacker - webarchive
- https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound - webarchive
- https://blog.fox-it.com/2020/11/16/ta505-a-brief-history-of-their-time/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-tahoe - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf - webarchive
- https://www.youtube.com/watch?v=PqGaZgepNTE - webarchive
- https://www.telekom.com/en/blog/group/article/cybersecurity-ta505-returns-with-a-new-bag-of-tricks-602104 - webarchive
- https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/ - webarchive
- https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/ - webarchive
- https://www.carbonblack.com/blog/cb-tau-threat-intelligence-notification-cryptomix-clop-ransomware-disables-startup-repair-removes-edits-shadow-volume-copies/ - webarchive
- https://www.bleepingcomputer.com/news/security/ransomware-gang-says-they-stole-2-million-credit-cards-from-e-land/ - webarchive
- https://www.bleepingcomputer.com/news/security/clop-ransomware-gang-is-back-hits-21-victims-in-a-single-month/ - webarchive
- https://www.mandiant.com/resources/financially-motivated-actors-are-expanding-access-into-ot - webarchive
- https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2020.pdf?__blob=publicationFile&v=2 - webarchive
- https://www.cert.ssi.gouv.fr/cti/CERTFR-2019-CTI-009/ - webarchive
- https://www.vice.com/en/article/wx5eyx/meet-the-ransomware-gang-behind-one-of-the-biggest-supply-chain-hacks-ever - webarchive
- https://labs.sentinelone.com/breaking-ta505s-crypter-with-an-smt-solver/ - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CLOUDBURST
CLOUDBURST aka NickelLoader is an HTTP(S) downloader.
It recognizes a set of four basic commands, all five letters long, like abcde, avdrq, gabnc and dcrqv (alternatively: eknag, eacec, hjmwk, wohnp). The most important functionality is to load a received buffer, either as a DLL via the MemoryModule implementation, or as a shellcode.
It uses AES for encryption and decryption of network traffic. It usually sends the following information back to its C&C server: computer name, product name and the list of running processes. Typically, it uses two hardcoded parameter names for its initial HTTP POST requests: gametype and type (alternatively: type and code).
The CLOUDBURST payload is disguised as mscoree.dll and is side-loaded via a legitimate Windows binary PresentationHost.exe with the argument -embeddingObject. It comes either as a trojanized plugin project for Notepad++ (usually FingerText by erinata), or as a standalone DLL loaded by a dropper, which is a trojanized plugin project as well (usually NppyPlugin by Jari Pennanen).
The CLOUDBURST malware was used in Operation DreamJob attacks against an aerospace company and a network running Microsoft Intune software in Q2-Q3 2022.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CLOUDBURST.
| Known Synonyms |
|---|
NickelLoader |
Internal MISP references
UUID 3f320960-77a2-4525-8d19-95b6028ec0d5 which can be used as unique global reference for CLOUDBURST in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudburst - webarchive
- https://www.mandiant.com/resources/blog/lightshow-north-korea-unc2970 - webarchive
- https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Lazarus-campaigns-and-backdoors-in-2022-2023.pdf - webarchive
- https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CloudEyE
CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CloudEyE.
| Known Synonyms |
|---|
GuLoader |
vbdropper |
Internal MISP references
UUID 966f54ae-1781-4f2e-8b32-57a242a00bb9 which can be used as unique global reference for CloudEyE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye - webarchive
- https://www.fortinet.com/blog/threat-research/spoofed-saudi-purchase-order-drops-guloader-part-two - webarchive
- https://inquest.net/blog/2022/08/29/office-files-rtf-files-shellcode-and-more-shenanigans - webarchive
- https://research.checkpoint.com/2020/guloader-cloudeye/ - webarchive
- https://research.checkpoint.com/2023/unveiling-the-shadows-the-dark-alliance-between-guloader-and-remcos/ - webarchive
- https://www.spamhaus.com/resource-center/dissecting-the-new-shellcode-based-variant-of-guloader-cloudeye/ - webarchive
- https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 - webarchive
- https://twitter.com/VK_Intel/status/1252678206852907011 - webarchive
- http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa - webarchive
- https://www.youtube.com/watch?v=gk7fCC5RiAQ - webarchive
- https://www.joesecurity.org/blog/3535317197858305930 - webarchive
- https://www.vmray.com/cyber-security-blog/guloader-evasion-techniques-threat-bulletin/ - webarchive
- https://www.youtube.com/watch?v=K3Yxu_9OUxU - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://www.youtube.com/watch?v=-FxyzuRv6Wg - webarchive
- https://twitter.com/TheEnergyStory/status/1240608893610459138 - webarchive
- https://twitter.com/VK_Intel/status/1257206565146370050 - webarchive
- https://www.crowdstrike.com/blog/guloader-malware-analysis/ - webarchive
- https://www.intrinsec.com/wp-content/uploads/2023/09/TLP-CLEAR-20230912-EN-GuLoader-Information-report.pdf - webarchive
- https://cert-agid.gov.it/news/malware/tecniche-per-semplificare-lanalisi-del-malware-guloader/ - webarchive
- https://labs.bitdefender.com/2020/03/5-times-more-coronavirus-themed-malware-reports-during-march/?utm_campaign=twitter&utm_medium=twitter&utm_source=twitter - webarchive
- https://twitter.com/TheEnergyStory/status/1239110192060608513 - webarchive
- https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/research/playing-with-guloader-anti-vm-techniques-malware/ - webarchive
- https://umbrella.cisco.com/blog/navigating-cybersecurity-during-a-pandemic-latest-malware-and-threat-actors - webarchive
- https://www.youtube.com/watch?v=N0wAh26wShE - webarchive
- https://research.checkpoint.com/2023/cloud-based-malware-delivery-the-evolution-of-guloader/ - webarchive
- https://threatresearch.ext.hp.com/wp-content/uploads/2021/10/HP-Wolf-Security-Threat-Insights-Report-Q3-2021.pdf - webarchive
- https://threatresearch.ext.hp.com/javascript-malware-dispensing-rats-into-the-wild/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/coronavirus-threat-landscape-update - webarchive
- https://www.vmray.com/cyber-security-blog/azorult-delivered-by-guloader-malware-analysis-spotlight/ - webarchive
- https://twitter.com/sysopfb/status/1258809373159305216 - webarchive
- https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ - webarchive
- https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/ - webarchive
- https://hidocohen.medium.com/guloaders-anti-analysis-techniques-e0d4b8437195 - webarchive
- https://elis531989.medium.com/dancing-with-shellcodes-cracking-the-latest-version-of-guloader-75083fb15cb4 - webarchive
- https://www.proofpoint.com/us/threat-insight/post/guloader-popular-new-vb6-downloader-abuses-cloud-services - webarchive
- https://www.vmray.com/cyber-security-blog/malware-analysis-spotlight-guloader - webarchive
- https://medium.com/@ZainWare/analyzing-guloader-42c1d6a73dfa - webarchive
- https://www.elastic.co/security-labs/getting-gooey-with-guloader-downloader - webarchive
- https://malwation.com/malware-config-extraction-diaries-1-guloader/ - webarchive
- https://blog.morphisec.com/guloader-the-rat-downloader - webarchive
- https://clickallthethings.wordpress.com/2021/03/06/oleobject1-bin-ole10native-shellcode/ - webarchive
- https://threatresearch.ext.hp.com/malware-campaigns-targeting-african-banking-sector/ - webarchive
- https://twitter.com/VK_Intel/status/1255537954304524288 - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/hakbit-ransomware-campaign-against-germany-austria-switzerland - webarchive
- https://malwarebookreports.com/guloader-navigating-a-maze-of-intricacy/ - webarchive
- https://kienmanowar.wordpress.com/2020/06/27/quick-analysis-note-about-guloader-or-cloudeye/ - webarchive
- https://research.checkpoint.com/2020/threat-actors-migrating-to-the-cloud/ - webarchive
- https://www.crowdstrike.com/blog/guloader-dissection-reveals-new-anti-analysis-techniques-and-code-injection-redundancy/ - webarchive
- https://blog.vincss.net/2020/05/re014-guloader-antivm-techniques.html - webarchive
- https://cert.pl/en/posts/2021/04/keeping-an-eye-on-guloader-reverse-engineering-the-loader/ - webarchive
- https://blog.malwarebytes.com/scams/2020/08/sba-phishing-scams-from-malware-to-advanced-social-engineering/ - webarchive
- https://gi7w0rm.medium.com/cloudeye-from-lnk-to-shellcode-4b5f1d6d877 - webarchive
- https://malpedia.caad.fkie.fraunhofer.de/details/win.guloader - webarchive
- https://experience.mandiant.com/trending-evil-2/p/1 - webarchive
- https://news.sophos.com/en-us/2020/07/14/raticate-rats-as-service-with-commercial-crypter/?cmp=30728 - webarchive
- https://labs.k7computing.com/?p=20156 - webarchive
- https://labs.vipre.com/unloading-the-guloader/ - webarchive
- https://asec.ahnlab.com/en/55978/ - webarchive
- https://www.microsoft.com/en-us/security/blog/2023/04/13/threat-actors-strive-to-cause-tax-day-headaches/ - webarchive
- https://labs.k7computing.com/?p=21725Lokesh - webarchive
- https://sansorg.egnyte.com/dl/ALlvwK6fp0 - webarchive
- https://forensicitguy.github.io/guloader-executing-shellcode-callbacks/ - webarchive
- https://any.run/cybersecurity-blog/deobfuscating-guloader/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CloudWizard
Internal MISP references
UUID 4d941367-b22e-4d01-930e-c757b58eff58 which can be used as unique global reference for CloudWizard in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CloudDuke
F-Secure describes CloudDuke as a malware toolset known to consist of, at least, a downloader, a loader and two backdoor variants. The CloudDuke downloader will download and execute additional malware from a preconfigured location. Interestingly, that location may be either a web address or a Microsoft OneDrive account. Both CloudDuke backdoor variants support simple backdoor functionality, similar to SeaDuke. While one variant will use a preconfigured C&C server over HTTP or HTTPS, the other variant will use a Microsoft OneDrive account to exchange commands and stolen data with its operators.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CloudDuke.
| Known Synonyms |
|---|
CloudLook |
MiniDionis |
Internal MISP references
UUID 40baac36-2fd0-49b3-b05b-1087d60f4f2c which can be used as unique global reference for CloudDuke in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CMSBrute
Internal MISP references
UUID ad960c5c-f2a1-405e-a32a-31f75b7c6859 which can be used as unique global reference for CMSBrute in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CMSTAR
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CMSTAR.
| Known Synonyms |
|---|
meciv |
Internal MISP references
UUID e4e15ab4-9ba6-444a-b154-2854757e792e which can be used as unique global reference for CMSTAR in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cmstar - webarchive
- https://researchcenter.paloaltonetworks.com/2016/03/digital-quartermaster-scenario-demonstrated-in-attacks-against-the-mongolian-government/ - webarchive
- https://researchcenter.paloaltonetworks.com/2017/09/unit42-threat-actors-target-government-belarus-using-cmstar-trojan - webarchive
- https://twitter.com/ClearskySec/status/963829930776723461 - webarchive
- https://unit42.paloaltonetworks.com/unit42-threat-actors-target-government-belarus-using-cmstar-trojan - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CoalaBot
Internal MISP references
UUID 7acd9a27-f550-4c47-9fc8-429b61b04217 which can be used as unique global reference for CoalaBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CobaltMirage FRP
This Go written malware was observed during campaign of COBALT MIRAGE; it includes FRP (Fast Reverse Proxy) published by fatedier on GitHub (https://github.com/fatedier/frp) and other projects additionally.
Internal MISP references
UUID a9bebdbf-24b3-40e0-9596-2adf60c3abf8 which can be used as unique global reference for CobaltMirage FRP in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cobalt Strike
Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.
The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cobalt Strike.
| Known Synonyms |
|---|
Agentemis |
BEACON |
CobaltStrike |
cobeacon |
Internal MISP references
UUID 1a1d3ea4-972e-4c48-8d85-08d9db8f1550 which can be used as unique global reference for Cobalt Strike in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike - webarchive
- https://intel471.com/blog/malware-before-ransomware-trojan-information-stealer-cobalt-strike - webarchive
- https://medium.com/@shabarkin/pointer-hunting-cobalt-strike-globally-a334ac50619a - webarchive
- https://teamt5.org/tw/posts/mjib-holds-briefing-on-chinese-hackers-attacks-on-taiwanese-government-agencies/ - webarchive
- https://security.macnica.co.jp/blog/2022/05/iso.html - webarchive
- https://www.esentire.com/security-advisories/ransomware-hackers-attack-a-top-safety-testing-org-using-tactics-and-techniques-borrowed-from-chinese-espionage-groups - webarchive
- https://unit42.paloaltonetworks.com/cloaked-ursa-online-storage-services-campaigns/ - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/karakurt-threat-mitigation - webarchive
- https://blog.group-ib.com/apt41-world-tour-2021 - webarchive
- https://businessinsights.bitdefender.com/tech-advisory-manageengine-cve-2022-47966 - webarchive
- https://www.first.org/resources/papers/conf2023/FIRSTCON23-TLPCLEAR-Staubmann-Busy-Bees.pptx - webarchive
- https://malwareandstuff.com/mustang-panda-joins-the-covid19-bandwagon/ - webarchive
- https://embee-research.ghost.io/decoding-a-cobalt-strike-vba-loader-with-cyberchef/ - webarchive
- https://tccontre.blogspot.com/2019/11/cobaltstrike-beacondll-your-not.html - webarchive
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-annex-download.pdf - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/how-cybercriminals-abuse-cloud-tunneling-services - webarchive
- https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis - webarchive
- https://ak100117.medium.com/analyzing-cobalt-strike-powershell-payload-64d55ed3521b - webarchive
- https://twitter.com/TheDFIRReport/status/1359669513520873473 - webarchive
- https://www.prevailion.com/what-wicked-webs-we-unweave/ - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/543/original/CTIR_casestudy_1.pdf - webarchive
- https://www.picussecurity.com/resource/blog/ttps-used-in-the-solarwinds-breach - webarchive
- https://www.trendmicro.com/en_us/research/22/f/black-basta-ransomware-operators-expand-their-attack-arsenal-wit.html - webarchive
- https://www.secureworks.com/research/threat-profiles/tin-woodlawn - webarchive
- https://blog.cobaltstrike.com/ - webarchive
- https://isc.sans.edu/diary/27308 - webarchive
- https://mal-eats.net/2021/05/10/campo_new_attack_campaign_targeting_japan/ - webarchive
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-batloader - webarchive
- https://www.youtube.com/watch?v=C733AyPzkoc - webarchive
- https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf - webarchive
- https://www.macnica.net/file/mpression_automobile.pdf - webarchive
- https://thedfirreport.com/2022/09/26/bumblebee-round-two/ - webarchive
- https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/ - webarchive
- https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-kingswood - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-275a - webarchive
- https://www2.deloitte.com/content/dam/Deloitte/dk/Documents/Grabngo/Aarhus_miniseminar_291118.pdf - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war - webarchive
- https://www.incibe-cert.es/sites/default/files/contenidos/estudios/doc/incibe-cert_estudio_analisis_nobelium_2022_v1.pdf - webarchive
- https://blog.cyble.com/2022/06/07/bumblebee-loader-on-the-rise/ - webarchive
- https://sixdub.medium.com/using-kaitai-to-parse-cobalt-strike-beacon-configs-f5f0552d5a6e - webarchive
- https://www.macnica.net/file/mpressioncss_ta_report_2019.pdf - webarchive
- https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/ - webarchive
- https://experience.mandiant.com/trending-evil-2/p/1 - webarchive
- https://www.mandiant.com/resources/spear-phish-ukrainian-entities - webarchive
- https://www.microsoft.com/security/blog/2021/07/29/bazacall-phony-call-centers-lead-to-exfiltration-and-ransomware/ - webarchive
- https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/ - webarchive
- https://www.getrevue.co/profile/80vul/issues/hunting-cobalt-strike-dns-redirectors-by-using-zoomeye-580734 - webarchive
- https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/ - webarchive
- https://www.youtube.com/watch?v=WW0_TgWT2gs - webarchive
- https://www.accenture.com/us-en/blogs/security/ransomware-hades - webarchive
- https://thedfirreport.com/2021/05/02/trickbot-brief-creds-and-beacons/ - webarchive
- https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ - webarchive
- https://inteloperator.medium.com/the-default-63-6f-62-61-6c-74-strike-8ac9ee0de1b7 - webarchive
- https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_9_yanagishita-tamada-nakatsuru-ishimaru_en.pdf - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/bb-ebook-finding-beacons-in-the-dark.pdf - webarchive
- https://www.inde.nz/blog/different-kind-of-zoombomb - webarchive
- https://skyblue.team/posts/scanning-virustotal-firehose/ - webarchive
- https://blogs.blackberry.com/en/2020/12/mountlocker-ransomware-as-a-service-offers-double-extortion-capabilities-to-affiliates - webarchive
- https://cluster25.io/2022/05/03/a-strange-link-between-a-destructive-malware-and-the-loader-of-a-ransomware-group-isaacwiper-vs-vatet/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/mtp-2021-0914.pdf - webarchive
- https://www.trustedsec.com/blog/tailoring-cobalt-strike-on-target/ - webarchive
- https://blogs.blackberry.com/en/2021/08/blackberry-prevents-threat-actor-group-ta575-and-dridex-malware - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/locked-loaded-and-in-the-wrong-hands-legitimate-tools-weaponized-for-ransomware-in-2021 - webarchive
- https://isc.sans.edu/forums/diary/Excel+spreadsheets+push+SystemBC+malware/27060/ - webarchive
- https://cocomelonc.github.io/malware/2022/09/06/malware-tricks-23.html - webarchive
- https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html - webarchive
- https://www.binarydefense.com/analysis-of-hancitor-when-boring-begets-beacon - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/csi-evidence-indicators-for-targeted-ransomware-attacks-part-ii/ - webarchive
- https://shells.systems/in-memory-shellcode-decoding-to-evade-avs/ - webarchive
- https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ - webarchive
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ - webarchive
- https://lab52.io/blog/beyond-appearances-unknown-actor-using-apt29s-ttp-against-chinese-users/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://blog.talosintelligence.com/2020/12/quarterly-ir-report-fall-2020-q4.html - webarchive
- https://www.ic3.gov/Media/News/2021/210823.pdf - webarchive
- https://www.blackarrow.net/leveraging-microsoft-teams-to-persist-and-cover-up-cobalt-strike-traffic/ - webarchive
- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ - webarchive
- https://securityscorecard.com/research/the-increase-in-ransomware-attacks-on-local-governments - webarchive
- https://www.fintechsecurity.com.hk/slides/01.Dmitry-Annual-Group-IB-report-High-Tech-Crime-Trends.pdf - webarchive
- https://www.advintel.io/post/blackcat-in-a-shifting-threat-landscape-it-helps-to-land-on-your-feet-tech-dive - webarchive
- https://blog.talosintelligence.com/2021/10/squirrelwaffle-emerges.html - webarchive
- https://unit42.paloaltonetworks.com/fireeye-red-team-tool-breach/ - webarchive
- https://labs.sentinelone.com/inside-a-trickbot-cobaltstrike-attack-server/ - webarchive
- https://blog.talosintelligence.com/2022/06/avoslocker-new-arsenal.html - webarchive
- https://cert.gov.ua/article/37704 - webarchive
- https://www.guidepointsecurity.com/yet-another-cobalt-strike-loader-guid-edition/ - webarchive
- https://twitter.com/VK_Intel/status/1294320579311435776 - webarchive
- https://thedfirreport.com/2022/03/07/2021-year-in-review/ - webarchive
- http://blog.nsfocus.net/murenshark - webarchive
- https://redcanary.com/blog/intelligence-insights-december-2021 - webarchive
- https://www.cobaltstrike.com/support - webarchive
- https://github.com/sophos-cybersecurity/solarwinds-threathunt - webarchive
- https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html - webarchive
- https://www.trendmicro.com/en_us/research/21/i/remote-code-execution-zero-day--cve-2021-40444--hits-windows--tr.html - webarchive
- https://labs.f-secure.com/blog/detecting-cobalt-strike-default-modules-via-named-pipe-analysis - webarchive
- https://documents.trendmicro.com/assets/white_papers/wp-earth-baku-an-apt-group-targeting-indo-pacific-countries.pdf - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ - webarchive
- https://twitter.com/alex_lanstein/status/1399829754887524354 - webarchive
- https://www.youtube.com/watch?v=FC9ARZIZglI - webarchive
- https://isc.sans.edu/forums/diary/Emotet%20infection%20with%20Cobalt%20Strike/28824/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf - webarchive
- https://blog.morphisec.com/vmware-identity-manager-attack-backdoor - webarchive
- https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations-wp.pdf - webarchive
- https://blog.morphisec.com/proxyshell-exchange-exploitation-now-leads-to-an-increasing-amount-of-cobaltstrike-backdoors - webarchive
- https://www.intel471.com/blog/Cobalt-strike-cybercriminals-trickbot-qbot-hancitor - webarchive
- https://news.sophos.com/en-us/2021/05/07/new-lemon-duck-variants-exploiting-microsoft-exchange-server/?cmp=30728 - webarchive
- https://resource.redcanary.com/rs/003-YRU-314/images/2021-Threat-Detection-Report.pdf - webarchive
- https://bmcder.com/blog/extracting-cobalt-strike-from-windows-error-reporting - webarchive
- https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf - webarchive
- https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2 - webarchive
- https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/ - webarchive
- https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-011/ - webarchive
- https://www.macnica.net/file/mpressioncss_2018-1h-report_mnc_rev3_nopw.pdf - webarchive
- https://www.trendmicro.com/en_us/research/22/j/water-labbu-abuses-malicious-dapps-to-steal-cryptocurrency.html - webarchive
- https://isc.sans.edu/diary/rss/27176 - webarchive
- https://blog.google/threat-analysis-group/initial-access-broker-repurposing-techniques-in-targeted-attacks-against-ukraine/ - webarchive
- https://asec.ahnlab.com/en/31811/ - webarchive
- https://norfolkinfosec.com/jeshell-an-oceanlotus-apt32-backdoor/ - webarchive
- https://www.mandiant.com/media/12596/download - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/growling-bears-make-thunderous-noise.html - webarchive
- https://blog.cyble.com/2022/05/20/malware-campaign-targets-infosec-community-threat-actor-uses-fake-proof-of-concept-to-deliver-cobalt-strike-beacon/ - webarchive
- https://401trg.com/burning-umbrella/
- https://www.istrosec.com/blog/apt-sk-cobalt/ - webarchive
- https://nsfocusglobal.com/insights-into-ransomware-spread-using-exchange-1-day-vulnerabilities-1-2/ - webarchive
- https://blog.morphisec.com/log4j-exploit-targets-vulnerable-unifi-network-applications - webarchive
- https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader - webarchive
- https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a - webarchive
- https://www.cynet.com/orion-threat-alert-flight-of-the-bumblebee/ - webarchive
- https://embee-research.ghost.io/ghidra-entropy-analysis-locating-decryption-functions/ - webarchive
- https://isc.sans.edu/diary/Bumblebee+Malware+from+TransferXL+URLs/28664 - webarchive
- https://cert.gov.ua/article/703548 - webarchive
- https://blog.exatrack.com/melofee/ - webarchive
- https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus - webarchive
- https://www.sentinelone.com/blog/threat-actor-uac-0056-targeting-ukraine-with-fake-translation-software/ - webarchive
- https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution - webarchive
- https://zero.bs/cobaltstrike-beacons-analyzed.html - webarchive
- https://www.cynet.com/blog/orion-threat-alert-qakbot-ttps-arsenal-and-the-black-basta-ransomware/ - webarchive
- https://isc.sans.edu/diary/26752 - webarchive
- https://twitter.com/felixw3000/status/1521816045769662468 - webarchive
- https://web.archive.org/web/20230209123148/https://www.cybereason.com/hubfs/THREAT%20ALERT%20GootLoader%20-%20Large%20payload%20leading%20to%20compromise%20(BLOG).pdf - webarchive
- https://blog.talosintelligence.com/2022/05/mustang-panda-targets-europe.html - webarchive
- https://attackiq.com/2022/06/03/attack-graph-response-to-us-cert-aa22-152a-karakurt-data-extortion-group/ - webarchive
- https://blog.group-ib.com/opera1er-apt - webarchive
- https://github.com/Sentinel-One/CobaltStrikeParser/blob/master/parse_beacon_config.py - webarchive
- https://news.sophos.com/en-us/2021/05/05/intervention-halts-a-proxylogon-enabled-attack - webarchive
- https://redcanary.com/blog/grief-ransomware/ - webarchive
- https://twitter.com/ffforward/status/1324281530026524672 - webarchive
- https://x.com/embee_research/status/1737325167024738425?s=46 - webarchive
- https://www.sekoia.io/en/nobeliums-envyscout-infection-chain-goes-in-the-registry-targeting-embassies/ - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing - webarchive
- https://www.0ffset.net/reverse-engineering/malware-analysis/squirrelwaffle-custom-packer/ - webarchive
- https://blog.nviso.eu/2022/07/20/analysis-of-a-trojanized-jquery-script-gootloader-unleashed/ - webarchive
- https://www.ncsc.gov.ie/pdfs/HSE_Conti_140521_UPDATE.pdf - webarchive
- https://www.secureworks.com/research/darktortilla-malware-analysis - webarchive
- https://decoded.avast.io/luigicamastra/backdoored-client-from-mongolian-ca-monpass/ - webarchive
- https://www.trendmicro.com/en_us/research/21/a/earth-wendigo-injects-javascript-backdoor-to-service-worker-for-.html - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/ - webarchive
- https://mp.weixin.qq.com/s/peIpPJLt4NuJI1a31S_qbQ - webarchive
- https://www.secureworks.com/blog/detecting-cobalt-strike-cybercrime-attacks - webarchive
- https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks - webarchive
- https://www.advanced-intel.com/post/anatomy-of-attack-inside-bazarbackdoor-to-ryuk-ransomware-one-group-via-cobalt-strike - webarchive
- https://blog.cyble.com/2022/06/23/matanbuchus-loader-resurfaces/ - webarchive
- https://twitter.com/MsftSecIntel/status/1522690116979855360 - webarchive
- https://www.huntress.com/blog/cobalt-strike-analysis-of-obfuscated-malware - webarchive
- https://blog.nviso.eu/2022/03/22/cobalt-strike-overview-part-7/ - webarchive
- https://www.npu.gov.ua/news/kiberzlochini/kiberpolicziya-vikrila-transnaczionalne-zlochinne-ugrupovannya-u-nanesenni-inozemnim-kompaniyam-120-miljoniv-dolariv-zbitkiv/ - webarchive
- https://www.truesec.com/hub/blog/proxyshell-qbot-and-conti-ransomware-combined-in-a-series-of-cyber-attacks - webarchive
- https://mergene.medium.com/enterprise-scale-threat-hunting-network-beacon-detection-with-unsupervised-machine-learning-and-277c4c30304f - webarchive
- https://blog.talosintelligence.com/2021/11/attackers-use-domain-fronting-technique.html - webarchive
- https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa21-265a - webarchive
- https://blogs.vmware.com/networkvirtualization/2020/11/trick-or-threat-ryuk-ransomware-targets-the-health-care-industry.html/ - webarchive
- https://medium.com/walmartglobaltech/socgholish-campaigns-and-initial-access-kit-4c4283fea8ee - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-009.pdf - webarchive
- https://twitter.com/cglyer/status/1480742363991580674 - webarchive
- https://newtonpaul.com/analysing-fileless-malware-cobalt-strike-beacon/ - webarchive
- https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf - webarchive
- https://asec.ahnlab.com/en/34549/ - webarchive
- https://twitter.com/th3_protoCOL/status/1433414685299142660?s=20 - webarchive
- https://cyber.wtf/2022/03/23/what-the-packer/ - webarchive
- https://www.welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/ - webarchive
- https://www.youtube.com/watch?v=6SDdUVejR2w - webarchive
- https://www.bleepingcomputer.com/news/security/emotet-now-drops-cobalt-strike-fast-forwards-ransomware-attacks/ - webarchive
- https://malcat.fr/blog/lnk-forensic-and-config-extraction-of-a-cobalt-strike-beacon/ - webarchive
- https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/ - webarchive
- https://medium.com/walmartglobaltech/investigation-into-the-state-of-nim-malware-part-2-a28bffffa671 - webarchive
- https://www.crowdstrike.com/blog/how-falcon-complete-disrupts-ecrime-operators-wizard-spider/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/diving-deeper-into-the-kaseya-vsa-attack-revil-returns-and-other-hackers-are-riding-their-coattails/ - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf - webarchive
- https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/ - webarchive
- https://www.esentire.com/blog/icedid-to-cobalt-strike-in-under-20-minutes - webarchive
- https://www.youtube.com/watch?v=GfbxHy6xnbA - webarchive
- https://decoded.avast.io/luigicamastra/backdoored-client-from-mongolian-ca-monpass - webarchive
- https://twitter.com/TheDFIRReport/status/1356729371931860992 - webarchive
- https://www.microsoft.com/security/blog/2022/04/13/dismantling-zloader-how-malicious-ads-led-to-disabled-security-tools-and-ransomware/ - webarchive
- https://attack.mitre.org/groups/G0096 - webarchive
- https://www.silentpush.com/blog/consequences-the-conti-leaks-and-future-problems - webarchive
- https://www.prodaft.com/m/reports/WizardSpider_TLPWHITE_v.1.4.pdf - webarchive
- https://www.sekoia.io/en/walking-on-apt31-infrastructure-footprints/ - webarchive
- https://awakesecurity.com/blog/catching-the-white-stork-in-flight/ - webarchive
- https://web.br.de/interaktiv/ocean-lotus/en/ - webarchive
- https://www.trendmicro.com/en_us/research/21/g/tracking_cobalt_strike_a_vision_one_investigation.html - webarchive
- https://malware-traffic-analysis.net/2021/09/29/index.html - webarchive
- https://blogs.blackberry.com/en/2021/10/drawing-a-dragon-connecting-the-dots-to-find-apt41 - webarchive
- https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-40-LunghiHorejsi.pdf - webarchive
- https://www.sekoia.io/en/an-insider-insights-into-conti-operations-part-two/ - webarchive
- https://msrc.microsoft.com/blog/2022/10/hunting-for-cobalt-strike-mining-and-plotting-for-fun-and-profit/ - webarchive
- https://intel471.com/blog/china-cybercrime-undergrond-deepmix-tea-horse-road-great-firewall/ - webarchive
- https://www.youtube.com/watch?v=borfuQGrB8g - webarchive
- https://blogs.jpcert.or.jp/en/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html - webarchive
- https://www.malware-traffic-analysis.net/2023/10/03/index.html - webarchive
- https://www.recordedfuture.com/solardeflection-c2-infrastructure-used-by-nobelium-in-company-brand-misuse/ - webarchive
- https://www.trendmicro.com/en_in/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://insight-jp.nttsecurity.com/post/102ho8o/operation-restylink - webarchive
- https://www.qurium.org/alerts/targeted-malware-against-crph/ - webarchive
- https://embee-research.ghost.io/shodan-censys-queries/ - webarchive
- https://kienmanowar.wordpress.com/2022/06/04/quicknote-cobaltstrike-smb-beacon-analysis-2/ - webarchive
- https://decoded.avast.io/threatintel/decoding-cobalt-strike-understanding-payloads/ - webarchive
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/5/ - webarchive
- https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility - webarchive
- https://medium.com/cycraft/china-linked-threat-group-targets-taiwan-critical-infrastructure-smokescreen-ransomware-c2a155aa53d5 - webarchive
- https://malwarelab.eu/posts/fin6-cobalt-strike/ - webarchive
- https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/ - webarchive
- https://unit42.paloaltonetworks.com/cobalt-strike-memory-analysis/ - webarchive
- https://www.mandiant.com/resources/evolution-of-fin7 - webarchive
- https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ - webarchive
- https://research.checkpoint.com/2019/rancor-the-year-of-the-phish/ - webarchive
- https://michaelkoczwara.medium.com/hunting-c2-with-shodan-223ca250d06f - webarchive
- https://research.checkpoint.com/2022/bumblebee-increasing-its-capacity-and-evolving-its-ttps/ - webarchive
- https://mp.weixin.qq.com/s/xPsEXp2J5IE7wNSMEVC24A - webarchive
- https://inquest.net/blog/2022/04/07/ukraine-cyberwar-overview - webarchive
- https://www.secureworks.com/blog/bumblebee-malware-distributed-via-trojanized-installer-downloads - webarchive
- https://www.netskope.com/blog/squirrelwaffle-new-malware-loader-delivering-cobalt-strike-and-qakbot - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/nimzaloader-ta800s-new-initial-access-malware - webarchive
- https://www.deepinstinct.com/2021/05/26/deep-dive-packing-software-cryptone/ - webarchive
- https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/ - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-drake - webarchive
- https://haggis-m.medium.com/malleable-c2-profiles-and-you-7c7ab43e7929 - webarchive
- https://binary.ninja/2022/07/22/reverse-engineering-cobalt-strike.html - webarchive
- https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/ - webarchive
- https://quake.360.cn/quake/#/reportDetail?id=5fc6fedd191038c3b25c4950
- https://www.crowdstrike.com/blog/how-crowdstrike-threat-hunters-identified-a-confluence-exploit/ - webarchive
- https://news.sophos.com/en-us/2021/04/21/nearly-half-of-malware-now-use-tls-to-conceal-communications/ - webarchive
- https://thedfirreport.com/2021/06/28/hancitor-continues-to-push-cobalt-strike/ - webarchive
- https://wbglil.gitbook.io/cobalt-strike/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2020/06/multi-stage-apt-attack-drops-cobalt-strike-using-malleable-c2-feature/ - webarchive
- https://www.esentire.com/blog/conti-affiliate-exposed-new-domain-names-ip-addresses-and-email-addresses-uncovered-by-esentire - webarchive
- https://www.telsy.com/legitimate-sites-used-as-cobalt-strike-c2s-against-indian-government/ - webarchive
- https://www.trendmicro.com/en_us/research/20/i/u-s--justice-department-charges-apt41-hackers-over-global-cyberattacks.html - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-president - webarchive
- https://www.mandiant.com/resources/blog/phished-at-the-request-of-counsel - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-from-shatak-emails-to-the-conti-ransomware - webarchive
- https://unit42.paloaltonetworks.com/bazarloader-network-reconnaissance/ - webarchive
- https://ics-cert.kaspersky.com/publications/reports/2022/06/27/attacks-on-industrial-control-systems-using-shadowpad/ - webarchive
- https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-mohawk - webarchive
- https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone/ - webarchive
- https://www.prodaft.com/m/uploads/SilverFish_TLPWHITE.pdf - webarchive
- https://i.blackhat.com/asia-21/Friday-Handouts/as-21-Tseng-Mem2Img-Memory-Resident-Malware-Detection-via-Convolution-Neural-Network.pdf - webarchive
- https://news.sophos.com/en-us/2020/10/14/inside-a-new-ryuk-ransomware-attack/ - webarchive
- https://www.infinitumit.com.tr/en/conti-ransomware-group-behind-the-karakurt-hacking-team/ - webarchive
- https://assets.virustotal.com/reports/2021trends.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/harvester-new-apt-attacks-asia - webarchive
- https://forensicitguy.github.io/analyzing-cactustorch-hta-cobaltstrike/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0808.pdf - webarchive
- https://thedfirreport.com/2021/01/31/bazar-no-ryuk/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/new-apt-group-chamelgang/#id3 - webarchive
- https://blog.securehat.co.uk/malware-analysis/extracting-the-cobalt-strike-config-from-a-teardrop-loader - webarchive
- https://blog.google/threat-analysis-group/how-we-protect-users-0-day-attacks/ - webarchive
- https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt - webarchive
- https://blog.group-ib.com/REvil_RaaS - webarchive
- https://dansec.medium.com/detecting-malicious-c2-activity-spawnas-smb-lateral-movement-in-cobaltstrike-9d518e68b64 - webarchive
- https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/ - webarchive
- https://community.riskiq.com/article/f0320980 - webarchive
- https://research.nccgroup.com/2022/03/25/mining-data-from-cobalt-strike-beacons/ - webarchive
- https://videos.didierstevens.com/2022/09/06/an-obfuscated-beacon-extra-xor-layer/ - webarchive
- https://www.esentire.com/blog/hacker-infrastructure-used-in-cisco-breach-discovered-attacking-a-top-workforce-management-corporation-russias-evil-corp-gang-suspected-reports-esentire - webarchive
- https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html - webarchive
- https://netresec.com/?b=214d7ff - webarchive
- https://labs.sentinelone.com/the-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration/ - webarchive
- https://github.com/swisscom/detections/blob/main/RYUK/cobaltstrike_c2s.txt - webarchive
- https://www.kroll.com/en/insights/publications/cyber/hive-ransomware-technical-analysis-initial-access-discovery - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0503.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware - webarchive
- https://embee-research.ghost.io/ghidra-basics-shellcode-analysis/ - webarchive
- https://medium.com/walmartglobaltech/investigation-into-the-state-of-nim-malware-14cc543af811 - webarchive
- https://blog.cyble.com/2022/09/07/bumblebee-returns-with-new-infection-technique/ - webarchive
- https://enterprise.verizon.com/resources/reports/2019-data-breach-investigations-report.pdf - webarchive
- https://blog.bushidotoken.net/2022/06/overview-of-russian-gru-and-svr.html - webarchive
- https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/ - webarchive
- https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf - webarchive
- https://www.welivesecurity.com/2022/04/13/eset-takes-part-global-operation-disrupt-zloader-botnets/ - webarchive
- https://securityintelligence.com/posts/trickbot-group-systematically-attacking-ukraine - webarchive
- https://www.advanced-intel.com/post/front-door-into-bazarbackdoor-stealthy-cybercrime-weapon - webarchive
- https://blog.truesec.com/2021/05/05/are-the-notorious-cyber-criminals-evil-corp-actually-russian-spies/ - webarchive
- https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/China/APT/Chimera/Analysis.md - webarchive
- https://www.splunk.com/en_us/blog/security/cloud-federated-credential-abuse-cobalt-strike-threat-research-feb-2021.html - webarchive
- https://speakerdeck.com/aragorntseng/winnti-is-coming-evolution-after-prosecution-at-hitcon2021 - webarchive
- https://socradar.io/new-gootloader-variant-gootbot-changes-the-game-in-malware-tactics/ - webarchive
- https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/ - webarchive
- https://www.mandiant.com/resources/darkside-affiliate-supply-chain-software-compromise - webarchive
- https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html - webarchive
- https://twitter.com/redcanary/status/1334224861628039169 - webarchive
- https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 - webarchive
- https://michaelkoczwara.medium.com/cobalt-strike-powershell-payload-analysis-eecf74b3c2f7 - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/double-extortion-campaigns - webarchive
- https://www.europol.europa.eu/newsroom/news/12-targeted-for-involvement-in-ransomware-attacks-against-critical-infrastructure - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
- https://www.mandiant.com/media/10916/download - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0107.pdf - webarchive
- https://securelist.com/apt-luminousmoth/103332/ - webarchive
- https://twitter.com/vikas891/status/1385306823662587905 - webarchive
- https://thedfirreport.com/2022/04/25/quantum-ransomware/ - webarchive
- https://marcoramilli.com/2022/05/10/a-malware-analysis-in-ru-au-conflict/ - webarchive
- https://community.riskiq.com/article/0bcefe76 - webarchive
- https://news.sophos.com/en-us/2021/10/04/atom-silo-ransomware-actors-use-confluence-exploit-dll-side-load-for-stealthy-attack/ - webarchive
- https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html - webarchive
- https://www.trendmicro.com/en_us/research/23/b/earth-zhulong-familiar-patterns-target-southeast-asian-firms.html - webarchive
- https://twitter.com/GossiTheDog/status/1438500100238577670 - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbasta - webarchive
- https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/ - webarchive
- https://www.wilbursecurity.com/2020/03/trickbot-to-ryuk-in-two-hours/ - webarchive
- https://twitter.com/Unit42_Intel/status/1421117403644186629?s=20 - webarchive
- https://asec.ahnlab.com/en/47455/ - webarchive
- https://www.microsoft.com/security/blog/2020/11/30/threat-actor-leverages-coin-miner-techniques-to-stay-under-the-radar-heres-how-to-spot-them/ - webarchive
- https://i.blackhat.com/USA-20/Thursday/us-20-Chen-Operation-Chimera-APT-Operation-Targets-Semiconductor-Vendors.pdf - webarchive
- https://www.aon.com/cyber-solutions/aon_cyber_labs/cobalt-strike-configuration-extractor-and-parser/ - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-old-dogs-new-tricks.pdf - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://www.cynet.com/attack-techniques-hands-on/quakbot-strikes-with-quaknightmare-exploitation/ - webarchive
- https://socfortress.medium.com/detecting-cobalt-strike-beacons-3f8c9fdcb654 - webarchive
- https://github.com/Apr4h/CobaltStrikeScan - webarchive
- https://cocomelonc.github.io/malware/2023/05/11/malware-tricks-28.html - webarchive
- https://redcanary.com/wp-content/uploads/2022/05/Gootloader.pdf - webarchive
- https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_201_haruyama_jp.pdf - webarchive
- https://twitter.com/RedDrip7/status/1402640362972147717?s=20 - webarchive
- https://isc.sans.edu/diary/rss/28752 - webarchive
- https://www.youtube.com/watch?v=y65hmcLIWDY - webarchive
- https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/ - webarchive
- https://www.telsy.com/download/5972/?uid=d7c082ba55 - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.huntress.com/blog/cybersecurity-advisory-vmware-horizon-servers-actively-being-hit-with-cobalt-strike - webarchive
- https://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike/ - webarchive
- https://www.secureworks.com/blog/detecting-cobalt-strike-government-sponsored-threat-groups - webarchive
- https://github.com/chronicle/GCTI - webarchive
- https://sergiusechel.medium.com/improving-the-network-based-detection-of-cobalt-strike-c2-servers-in-the-wild-while-reducing-the-6964205f6468 - webarchive
- https://twitter.com/Unit42_Intel/status/1461004489234829320 - webarchive
- https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html - webarchive
- https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-dianxun.pdf - webarchive
- https://news.sophos.com/en-us/2021/06/02/amsi-bypasses-remain-tricks-of-the-malware-trade/ - webarchive
- https://thedfirreport.com/2021/03/08/bazar-drops-the-anchor/ - webarchive
- https://blog.netlab.360.com/blackrota-an-obfuscated-backdoor-written-in-go/ - webarchive
- https://medium.com/walmartglobaltech/man1-moskal-hancitor-and-a-side-of-ransomware-d77b4d991618 - webarchive
- https://www.youtube.com/watch?v=pIXl79IPkLI - webarchive
- https://www.cynet.com/understanding-squirrelwaffle/ - webarchive
- https://isc.sans.edu/diary/rss/27618 - webarchive
- https://www.trendmicro.com/en_us/research/21/g/biopass-rat-new-malware-sniffs-victims-via-live-streaming.html - webarchive
- https://cert.gov.ua/article/339662 - webarchive
- https://kienmanowar.wordpress.com/2021/09/06/quick-analysis-cobaltstrike-loader-and-shellcode/ - webarchive
- https://www.fortinet.com/blog/threat-research/the-year-of-the-wiper - webarchive
- https://unit42.paloaltonetworks.com/atoms/obscureserpens/ - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2022/07/cobalt-strikes-again-uac-0056-continues-to-target-ukraine-in-its-latest-campaign/ - webarchive
- https://blogs.blackberry.com/en/2021/11/zebra2104 - webarchive
- https://www.npu.gov.ua/news/kiberzlochini/kiberpolicziya-vikrila-xakerske-ugrupovannya-u-rozpovsyudzhenni-virusu-shifruvalnika-ta-nanesenni-inozemnim-kompaniyam-piv-milyarda-dolariv-zbitkiv/ - webarchive
- https://asec.ahnlab.com/ko/19860/ - webarchive
- https://mp.weixin.qq.com/s/cGS8FocPnUdBconLbbaG-g - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-ransomexx - webarchive
- https://www.zscaler.com/blogs/research/targeted-attack-leverages-india-china-border-dispute-lure-victims - webarchive
- https://blog.talosintelligence.com/2021/05/ctir-case-study.html - webarchive
- https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-seizure-domain-names-used-furtherance-spear - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-riverside - webarchive
- https://thedfirreport.com/2020/08/31/netwalker-ransomware-in-1-hour/ - webarchive
- https://www.trendmicro.com/en_us/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict.html - webarchive
- https://www.darktrace.com/en/blog/catching-apt-41-exploiting-a-zero-day-vulnerability/ - webarchive
- https://community.riskiq.com/article/c88cf7e6 - webarchive
- https://blog.fox-it.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/ - webarchive
- https://www.pentestpartners.com/security-blog/cobalt-strike-walkthrough-for-red-teamers/ - webarchive
- https://www.youtube.com/watch?v=LA-XE5Jy2kU - webarchive
- https://www.trustnet.co.il/blog/virus-alert-to-powershell-encrypted-loader/ - webarchive
- https://nsfocusglobal.com/the-new-apt-group-darkcasino-and-the-global-surge-in-winrar-0-day-exploits/ - webarchive
- https://thedfirreport.com/2021/05/12/conti-ransomware/ - webarchive
- https://cip.gov.ua/en/news/khto-stoyit-za-kiberatakami-na-ukrayinsku-kritichnu-informaciinu-infrastrukturu-statistika-15-22-bereznya - webarchive
- https://rastamouse.me/ntlm-relaying-via-cobalt-strike/ - webarchive
- https://www.malware-traffic-analysis.net/2021/09/17/index.html - webarchive
- https://blog.macnica.net/blog/2020/11/dtrack.html - webarchive
- https://therecord.media/mongolian-certificate-authority-hacked-eight-times-compromised-with-malware/ - webarchive
- https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage - webarchive
- https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack - webarchive
- https://medium.com/cycraft/taiwan-high-tech-ecosystem-targeted-by-foreign-apt-group-5473d2ad8730 - webarchive
- https://content.fireeye.com/m-trends/rpt-m-trends-2020 - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v - webarchive
- https://news.sophos.com/en-us/2021/09/21/cring-ransomware-group-exploits-ancient-coldfusion-server/?cmp=30728 - webarchive
- https://blogs.blackberry.com/en/2022/01/log4u-shell4me - webarchive
- https://blog.talosintelligence.com/2020/06/indigodrop-maldocs-cobalt-strike.html - webarchive
- https://twitter.com/Cryptolaemus1/status/1407135648528711680 - webarchive
- https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/ - webarchive
- https://r136a1.info/2022/05/25/introduction-of-a-pe-file-extractor-for-various-situations/ - webarchive
- https://redcanary.com/blog/gootloader - webarchive
- https://www.lac.co.jp/lacwatch/people/20180521_001638.html - webarchive
- https://www.crowdstrike.com/blog/four-popular-defensive-evasion-techniques-in-2021/ - webarchive
- https://thedfirreport.com/2022/09/12/dead-or-alive-an-emotet-story/ - webarchive
- https://isc.sans.edu/forums/diary/Qakbot+infection+with+Cobalt+Strike+and+VNC+activity/28448/ - webarchive
- https://5851803.fs1.hubspotusercontent-na1.net/hubfs/5851803/Russian%20Ransomware%20C2%20Network%20Discovered%20in%20Censys%20Data.pdf - webarchive
- https://medium.com/walmartglobaltech/signed-dll-campaigns-as-a-service-7760ac676489 - webarchive
- https://www.scmagazine.com/brief/breach/novel-obfuscation-leveraged-by-hive-ransomware - webarchive
- https://paper.seebug.org/1301/ - webarchive
- https://unit42.paloaltonetworks.com/cobalt-strike-team-server/ - webarchive
- https://asec.ahnlab.com/ko/19640/ - webarchive
- https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/ - webarchive
- https://socprime.com/blog/somnia-malware-detection-uac-0118-aka-frwl-launches-cyber-attacks-against-organizations-in-ukraine-using-enhanced-malware-strains/ - webarchive
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - webarchive
- https://www.mandiant.com/resources/defining-cobalt-strike-components - webarchive
- https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf - webarchive
- https://www.advanced-intel.com/post/secret-backdoor-behind-conti-ransomware-operation-introducing-atera-agent - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://www.esentire.com/blog/increase-in-emotet-activity-and-cobalt-strike-deployment - webarchive
- https://www.trendmicro.com/en_us/research/22/g/gootkit-loaders-updated-tactics-and-fileless-delivery-of-cobalt-strike.html - webarchive
- https://boschko.ca/cobalt-strike-process-injection/ - webarchive
- https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos - webarchive
- https://www.varonis.com/blog/hive-ransomware-analysis - webarchive
- https://www.sentinelone.com/blog/hive-ransomware-deploys-novel-ipfuscation-technique/ - webarchive
- https://blog.sonatype.com/new-pymafka-malicious-package-drops-cobalt-strike-on-macos-windows-linux - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/542/original/CTIR_casestudy_2.pdf - webarchive
- https://www.youtube.com/watch?v=XfUTpwZKCDU - webarchive
- http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa - webarchive
- https://www.intrinsec.com/proxynotshell-owassrf-merry-xchange/ - webarchive
- https://file2.api.drift.com/download/drift-prod-file-uploads/417f%2F417f74ae8ddd24aa7c2b43a23093983f/Supply%20Chain%20Attacks_%20Cyber%20Criminals%20Target%20the%20Weakest%20Link.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/grayling-taiwan-cyber-attacks - webarchive
- https://mez0.cc/posts/cobaltstrike-powershell-exec/ - webarchive
- https://svch0st.medium.com/stats-from-hunting-cobalt-strike-beacons-c17e56255f9b - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/787/original/ransomware-chats.pdf - webarchive
- https://stillu.cc/threat-spotlight/2021/11/13/domain-fronting-fastly/ - webarchive
- https://www.bleepingcomputer.com/news/security/fake-antivirus-updates-used-to-deploy-cobalt-strike-in-ukraine/ - webarchive
- https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html - webarchive
- https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2-profile/ - webarchive
- https://www.cybercom.mil/Media/News/Article/3098856/cyber-national-mission-force-discloses-iocs-from-ukrainian-networks/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0118.pdf - webarchive
- https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf - webarchive
- https://cocomelonc.github.io/malware/2022/07/30/malware-av-evasion-8.html - webarchive
- https://cocomelonc.github.io/tutorial/2022/05/09/malware-pers-4.html - webarchive
- https://blog.cobaltstrike.com/2020/11/06/cobalt-strike-4-2-everything-but-the-kitchen-sink/ - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/262/Bitdefender-WhitePaper-An-APT-Blueprint-Gaining-New-Visibility-into-Financial-Threats-interactive.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/cisa-updates-conti-ransomware-alert-with-nearly-100-domain-names/ - webarchive
- https://ti.qianxin.com/blog/articles/Operation-OceanStorm:The-OceanLotus-hidden-under-the-abyss-of-the-deep/ - webarchive
- https://pylos.co/2018/11/18/cozybear-in-from-the-cold/ - webarchive
- https://intel471.com/blog/conti-emotet-ransomware-conti-leaks - webarchive
- https://labs.f-secure.com/blog/detecting-exposed-cobalt-strike-dns-redirectors - webarchive
- https://github.com/infinitumitlabs/Karakurt-Hacking-Team-CTI - webarchive
- https://news.sophos.com/en-us/2021/05/18/the-active-adversary-playbook-2021/?cmp=37153 - webarchive
- https://research.nccgroup.com/2022/03/31/conti-nuation-methods-and-techniques-observed-in-operations-post-the-leaks/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa21-148a - webarchive
- https://www.contextis.com/en/blog/dll-search-order-hijacking - webarchive
- https://embee-research.ghost.io/malware-analysis-decoding-a-simple-hta-loader/ - webarchive
- https://www.guidepointsecurity.com/from-zloader-to-darkside-a-ransomware-story/ - webarchive
- https://blog.reversinglabs.com/blog/threat-analysis-follina-exploit-powers-live-off-the-land-attacks - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/moving-left-ransomware-boom - webarchive
- https://research.checkpoint.com/2023/following-the-scent-of-trickgate-6-year-old-packer-used-to-deploy-the-most-wanted-malware/ - webarchive
- https://www.trendmicro.com/de_de/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html - webarchive
- https://teamt5.org/en/posts/hiding-in-plain-sight-obscuring-c2s-by-abusing-cdn-services - webarchive
- https://thedfirreport.com/2020/10/08/ryuks-return/ - webarchive
- https://news.sophos.com/en-us/2022/02/23/dridex-bots-deliver-entropy-ransomware-in-recent-attacks/ - webarchive
- https://www.advintel.io/post/advintel-s-state-of-emotet-aka-spmtools-displays-over-million-compromised-machines-through-2022 - webarchive
- https://www.bleepingcomputer.com/news/security/phishing-campaign-targets-russian-govt-dissidents-with-cobalt-strike/ - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2021/11/a-multi-stage-powershell-based-attack-targets-kazakhstan/ - webarchive
- https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike - webarchive
- https://research.nccgroup.com/2020/06/15/striking-back-at-retired-cobalt-strike-a-look-at-a-legacy-vulnerability/ - webarchive
- https://medium.com/walmartglobaltech/from-royal-with-love-88fa05ff7f65 - webarchive
- https://blog.truesec.com/2020/12/22/collaboration-between-fin7-and-the-ryuk-group-a-truesec-investigation/ - webarchive
- https://www.huntress.com/blog/hackers-no-hashing-randomizing-api-hashes-to-evade-cobalt-strike-shellcode-detection - webarchive
- https://www.cyberark.com/resources/threat-research/analyzing-malware-with-hooks-stomps-and-return-addresses-2 - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-drbcontrol-uncovering-a-cyberespionage-campaign-targeting-gambling-companies-in-southeast-asia - webarchive
- https://blog.didierstevens.com/2021/11/03/new-tool-cs-extract-key-py/ - webarchive
- https://pkb1s.github.io/Relay-attacks-via-Cobalt-Strike-beacons/ - webarchive
- https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/ - webarchive
- https://www.cyborgsecurity.com/blog/you-dont-know-the-hafnium-of-it/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-007.pdf - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://medium.com/walmartglobaltech/nimar-loader-4f61c090c49e - webarchive
- https://www.crowdstrike.com/blog/how-falcon-complete-stopped-a-solarwinds-serv-u-exploit-campaign/ - webarchive
- https://www.blackhillsinfosec.com/dns-over-https-for-cobalt-strike/ - webarchive
- https://www.bitsight.com/blog/emotet-botnet-rises-again - webarchive
- https://www.mandiant.com/resources/apt41-us-state-governments - webarchive
- https://news.sophos.com/en-us/2022/08/18/cookie-stealing-the-new-perimeter-bypass - webarchive
- https://hello.global.ntt/-/media/ntt/global/insights/white-papers/the-operations-of-winnti-group.pdf - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2022/03/new-spear-phishing-campaign-targets-russian-dissidents/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/hydrochasma-asia-medical-shipping-intelligence-gathering - webarchive
- https://blog.cobaltstrike.com/2020/12/08/a-red-teamer-plays-with-jarm/ - webarchive
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-resident-campaign - webarchive
- https://blog.fox-it.com/2023/11/01/popping-blisters-for-research-an-overview-of-past-payloads-and-exploring-recent-developments/ - webarchive
- https://michaelkoczwara.medium.com/mapping-and-pivoting-cobalt-strike-c2-infrastructure-attributed-to-cve-2021-40444-438786fcd68a - webarchive
- https://www.mcafee.com/enterprise/en-us/assets/reports/rp-ryuk-ransomware-targeting-webservers.pdf - webarchive
- https://www.youtube.com/watch?v=gfYswA_Ronw - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-kingswood - webarchive
- https://vanmieghem.io/blueprint-for-evading-edr-in-2022/ - webarchive
- https://www.domaintools.com/resources/blog/covid-19-phishing-with-a-side-of-cobalt-strike# - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-all-paths-lead-to-cobalt-strike-icedid-emotet-and-qbot - webarchive
- https://embee-research.ghost.io/unpacking-malware-with-hardware-breakpoints-cobalt-strike/ - webarchive
- https://github.com/blackorbird/APT_REPORT/blob/master/Oceanlotus/apt32_report_2019.pdf - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-winter - webarchive
- https://thedfirreport.com/2020/04/24/ursnif-via-lolbins/ - webarchive
- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html - webarchive
- https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/ - webarchive
- https://www.wired.com/story/russias-fancy-bear-hack-us-federal-agency/ - webarchive
- https://blueteamblog.com/darkside-ransomware-operations-preventions-and-detections - webarchive
- https://lab52.io/blog/the-energy-reserves-in-the-eastern-mediterranean-sea-and-a-malicious-campaign-of-apt10-against-turkey/ - webarchive
- https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/ - webarchive
- https://www.trendmicro.com/en_us/research/21/i/examining-the-cring-ransomware-techniques.html - webarchive
- https://mergene.medium.com/enterprise-scale-threat-hunting-network-beacon-detection-with-unsupervised-ml-and-kql-part-2-bff46cfc1e7e - webarchive
- https://malwarebookreports.com/cryptone-cobalt-strike/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0330.pdf - webarchive
- https://isc.sans.edu/diary/28636 - webarchive
- https://blog.prevailion.com/wizard-spider-continues-to-confound-4298370f6903 - webarchive
- https://www.youtube.com/watch?v=ysN-MqyIN7M - webarchive
- https://blog.viettelcybersecurity.com/apt32-deobfuscation-arsenal-deobfuscating-mot-vai-loai-obfucation-toolkit-cua-apt32-phan-2/ - webarchive
- https://www.inky.com/blog/colonial-pipeline-ransomware-hack-unleashes-flood-of-related-phishing-attempts - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-ransomware-attacks-continue - webarchive
- https://www.advintel.io/post/anatomy-of-attack-truth-behind-the-costa-rica-government-ransomware-5-day-intrusion - webarchive
- https://www.hhs.gov/sites/default/files/bazarloader.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-niagara - webarchive
- https://www.cynet.com/attack-techniques-hands-on/new-wave-of-emotet-when-project-x-turns-into-y/ - webarchive
- https://www.wired.com/story/chinese-hackers-taiwan-semiconductor-industry-skeleton-key/ - webarchive
- https://www.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revealing-threat-in-the-shadow-by-chi-en-shen-ashley-oleg-bondarenko - webarchive
- https://www.ironnet.com/blog/tracking-cobalt-strike-servers-used-in-cyberattacks-on-ukraine - webarchive
- https://michaelkoczwara.medium.com/cobalt-strike-hunting-simple-pcap-and-beacon-analysis-f51c36ce6811 - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://breakpoint-labs.com/blog/cobalt-strike-and-ransomware-tracking-an-effective-ransomware-campaign/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ - webarchive
- https://www.recordedfuture.com/chinese-group-tag-22-targets-nepal-philippines-taiwan - webarchive
- https://www.mandiant.com/resources/russian-targeting-gov-business - webarchive
- https://github.com/AmnestyTech/investigations/tree/master/2021-02-24_vietnam - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-249a - webarchive
- https://blog.gigamon.com/2021/09/10/rendering-threats-a-network-perspective/ - webarchive
- https://medium.com/walmartglobaltech/cobaltstrike-stager-utilizing-floating-point-math-9bc13f9b9718 - webarchive
- https://www.cyber.gov.au/sites/default/files/2020-06/ACSC-Advisory-2020-008-Copy-Paste-Compromises.pdf - webarchive
- https://medium.com/walmartglobaltech/cobaltstrike-uuid-stager-ca7e82f7bb64 - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sodinokibi-ransomware-cobalt-strike-pos - webarchive
- https://thedfirreport.com/2021/06/20/from-word-to-lateral-movement-in-1-hour/ - webarchive
- https://unit42.paloaltonetworks.com/bumblebee-malware-projector-libra/ - webarchive
- https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/ - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-datoploader-exploits-proxyshell-to-deliver-qbot-and-cobalt-strike - webarchive
- https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions - webarchive
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - webarchive
- https://unit42.paloaltonetworks.com/cobalt-strike-metadata-encryption-decryption/ - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control - webarchive
- https://www.mdsec.co.uk/2021/07/investigating-a-suspicious-service/ - webarchive
- https://twitter.com/MBThreatIntel/status/1412518446013812737 - webarchive
- https://www.trendmicro.com/en_us/research/21/e/proxylogon-a-coinminer--a-ransomware--and-a-botnet-join-the-part.html - webarchive
- https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government - webarchive
- http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems - webarchive
- https://www.trendmicro.com/en_us/research/21/k/Squirrelwaffle-Exploits-ProxyShell-and-ProxyLogon-to-Hijack-Email-Chains.html - webarchive
- https://thehackernews.com/2022/05/this-new-fileless-malware-hides.html - webarchive
- https://twitter.com/swisscom_csirt/status/1354052879158571008 - webarchive
- https://blog.lumen.com/zuorat-hijacks-soho-routers-to-silently-stalk-networks/ - webarchive
- https://d01a.github.io/syscalls/ - webarchive
- https://twitter.com/AltShiftPrtScn/status/1385103712918642688 - webarchive
- https://www.breachquest.com/conti-leaks-insight-into-a-ransomware-unicorn/ - webarchive
- https://cpj.org/2021/02/vietnam-based-hacking-oceanlotus-targets-journalists - webarchive
- https://blog.nviso.eu/2021/10/21/cobalt-strike-using-known-private-keys-to-decrypt-traffic-part-1/ - webarchive
- https://www.advanced-intel.com/post/hunting-for-corporate-insurance-policies-indicators-of-ransom-exfiltrations - webarchive
- https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/ - webarchive
- https://orangematter.solarwinds.com/2021/01/11/new-findings-from-our-investigation-of-sunburst/ - webarchive
- https://threatpost.com/conti-ransomware-v-3-including-decryptor-leaked/179006/ - webarchive
- https://www.sans.org/webcasts/contrarian-view-solarwinds-119515 - webarchive
- https://blog.cobaltstrike.com/2020/03/04/cobalt-strike-joins-core-impact-at-helpsystems-llc/ - webarchive
- https://www.cybereason.com/blog/cybereason-vs-egregor-ransomware - webarchive
- https://cert.gov.ua/article/619229 - webarchive
- https://www.0ffset.net/reverse-engineering/malware-analysis/squirrelwaffle-main-loader/ - webarchive
- https://www.kroll.com/en/insights/publications/cyber/black-basta-technical-analysis - webarchive
- https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html - webarchive
- https://forensicitguy.github.io/inspecting-powershell-cobalt-strike-beacon/ - webarchive
- https://www.ironnet.com/blog/ransomware-graphic-blog - webarchive
- https://thedfirreport.com/2023/12/04/sql-brute-force-leads-to-bluesky-ransomware/ - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://www.netresec.com/?page=Blog&month=2023-10&post=Forensic-Timeline-of-an-IcedID-Infection - webarchive
- https://blog.group-ib.com/colunmtk_apt41 - webarchive
- https://www.randhome.io/blog/2020/12/20/analyzing-cobalt-strike-for-fun-and-profit/ - webarchive
- https://cybersecurity.att.com/blogs/security-essentials/stories-from-the-soc-powershell-proxyshell-conti-ttps-oh-my - webarchive
- https://news.sophos.com/en-us/2020/10/27/mtr-casebook-an-active-adversary-caught-in-the-act/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-011.pdf - webarchive
- https://thedfirreport.com/2022/01/24/cobalt-strike-a-defenders-guide-part-2/ - webarchive
- https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf - webarchive
- https://twitter.com/elisalem9/status/1398566939656601606 - webarchive
- https://isc.sans.edu/diary/rss/28934 - webarchive
- https://www.cynet.com/attack-techniques-hands-on/threats-looming-over-the-horizon/ - webarchive
- https://awakesecurity.com/blog/detecting-icedid-and-cobalt-strike-beacon-with-network-detection-and-response/ - webarchive
- https://www.mandiant.com/resources/unc2452-merged-into-apt29 - webarchive
- https://unit42.paloaltonetworks.com/cobalt-strike-metadata-encoding-decoding/ - webarchive
- https://michaelkoczwara.medium.com/cobalt-strike-hunting-dll-hijacking-attack-analysis-ffbf8fd66a4e - webarchive
- https://www.carbonblack.com/2020/03/26/the-dukes-of-moscow/ - webarchive
- https://resource.redcanary.com/rs/003-YRU-314/images/2022_ThreatDetectionReport_RedCanary.pdf - webarchive
- https://twitter.com/Unit42_Intel/status/1458113934024757256 - webarchive
- https://blog.nviso.eu/2021/11/03/cobalt-strike-using-process-memory-to-decrypt-traffic-part-3/ - webarchive
- https://twitter.com/AltShiftPrtScn/status/1350755169965924352 - webarchive
- https://twitter.com/AltShiftPrtScn/status/1403707430765273095 - webarchive
- http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf - webarchive
- https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/ - webarchive
- https://www.kroll.com/en/insights/publications/cyber/royal-ransomware-deep-dive - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/cobalt-strike-favorite-tool-apt-crimeware - webarchive
- https://morphuslabs.com/attackers-are-abusing-msbuild-to-evade-defenses-and-implant-cobalt-strike-beacons-edac4ab84f42 - webarchive
- https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html - webarchive
- https://www.malware-traffic-analysis.net/2021/09/29/index.html - webarchive
- https://blogs.blackberry.com/en/2021/10/blackberry-shines-spotlight-on-evolving-cobalt-strike-threat-in-new-book - webarchive
- https://blog.securityonion.net/2022/02/quick-malware-analysis-emotet-epoch-5.html - webarchive
- https://github.com/ThreatConnect-Inc/research-team/blob/master/IOCs/WizardSpider-UNC1878-Ryuk.csv - webarchive
- https://www.trendmicro.com/en_us/research/21/d/hello-ransomware-uses-updated-china-chopper-web-shell-sharepoint-vulnerability.html - webarchive
- https://blog.reconinfosec.com/analysis-of-exploitation-cve-2020-10189/ - webarchive
- https://labs.sentinelone.com/hotcobalt-new-cobalt-strike-dos-vulnerability-that-lets-you-halt-operations/ - webarchive
- https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love - webarchive
- https://www.mandiant.com/resources/sabbath-ransomware-affiliate - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
- https://cybleinc.com/2020/11/17/oceanlotus-continues-with-its-cyber-espionage-operations/ - webarchive
- https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/ - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://www.intezer.com/blog/malware-analysis/cobalt-strike-detect-this-persistent-threat/ - webarchive
- https://www.unh4ck.com/detection-engineering-and-threat-hunting/lateral-movement/detecting-conti-cobaltstrike-lateral-movement-techniques-part-1 - webarchive
- https://x.com/embee_research/status/1736758775326146778 - webarchive
- https://connormcgarr.github.io/thread-hijacking/ - webarchive
- https://www.brighttalk.com/webcast/7451/462719 - webarchive
- https://medium.com/walmartglobaltech/trickbot-crews-new-cobaltstrike-loader-32c72b78e81c - webarchive
- https://www.arashparsa.com/hook-heaps-and-live-free/ - webarchive
- https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures - webarchive
- https://www.unh4ck.com/detection-engineering-and-threat-hunting/lateral-movement/detecting-conti-cobaltstrike-lateral-movement-techniques-part-2 - webarchive
- https://blog.nviso.eu/2021/11/17/cobalt-strike-decrypting-obfuscated-traffic-part-4/ - webarchive
- https://thedfirreport.com/2021/09/13/bazarloader-to-conti-ransomware-in-32-hours/ - webarchive
- https://www.guidepointsecurity.com/blog/a-ransomware-near-miss-proxyshell-a-rat-and-cobalt-strike/ - webarchive
- https://github.com/JPCERTCC/aa-tools/blob/master/cobaltstrikescan.py - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-dupont - webarchive
- https://elastic.github.io/security-research/intelligence/2022/01/03.extracting-cobalt-strike-beacon/article/ - webarchive
- https://www.deepinstinct.com/2021/03/18/cobalt-strike-post-exploitation-attackers-toolkit/ - webarchive
- https://labs.k7computing.com/index.php/cobalt-strikes-deployment-with-hardware-breakpoint-for-amsi-bypass/ - webarchive
- https://github.com/0xjxd/SquirrelWaffle-From-Maldoc-to-Cobalt-Strike/raw/main/2021-10-02%20-%20SquirrelWaffle%20-%20From%20Maldoc%20to%20Cobalt%20Strike.pdf - webarchive
- https://blog.talosintelligence.com/2022/08/manjusaka-offensive-framework.html - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout - webarchive
- https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ - webarchive
- https://www.sekoia.io/en/an-insider-insights-into-conti-operations-part-one - webarchive
- https://blog.morphisec.com/log4j-exploit-hits-again-vulnerable-vmware-horizon-servers-at-risk - webarchive
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - webarchive
- https://www.secureworks.com/blog/hades-ransomware-operators-use-distinctive-tactics-and-infrastructure - webarchive
- https://isc.sans.edu/diary/rss/28448 - webarchive
- https://blog.talosintelligence.com/2021/05/lemon-duck-spreads-wings.html - webarchive
- https://www.sentinelone.com/blog/from-the-front-lines-peering-into-a-pysa-ransomware-attack/ - webarchive
- https://www.bleepingcomputer.com/news/security/vulnerable-microsoft-sql-servers-targeted-with-cobalt-strike/ - webarchive
- https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html - webarchive
- https://www.advintel.io/post/24-hours-from-log4shell-to-local-admin-deep-dive-into-conti-gang-attack-on-fortune-500-dfir - webarchive
- https://www.arashparsa.com/catching-a-malware-with-no-name/ - webarchive
- https://blog.nviso.eu/2021/04/26/anatomy-of-cobalt-strike-dll-stagers/ - webarchive
- https://www.fortinet.com/blog/threat-research/what-we-have-learned-so-far-about-the-sunburst-solarwinds-hack - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-148a - webarchive
- https://explore.group-ib.com/htct/hi-tech_crime_2018 - webarchive
- https://isc.sans.edu/diary/rss/28664 - webarchive
- https://blog.zsec.uk/cobalt-strike-profiles/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-waterfall - webarchive
- https://github.com/dodo-sec/Malware-Analysis/blob/main/Cobalt%20Strike/Indirect%20Syscalls.md - webarchive
- https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/ - webarchive
- https://blog.talosintelligence.com/2020/09/CTIR-quarterly-trends-Q4-2020.html - webarchive
- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ - webarchive
- https://elastic.github.io/security-research/intelligence/2022/01/02.collecting-cobalt-strike-beacons/article/ - webarchive
- https://securityscorecard.com/blog/securityscorecard-finds-usaid-hack-much-larger-than-initially-thought - webarchive
- https://blog.nviso.eu/2021/10/27/cobalt-strike-using-known-private-keys-to-decrypt-traffic-part-2/ - webarchive
- https://www.bleepingcomputer.com/news/security/fake-microsoft-teams-updates-lead-to-cobalt-strike-deployment/ - webarchive
- https://grimminck.medium.com/spoofing-jarm-signatures-i-am-the-cobalt-strike-server-now-a27bd549fc6b - webarchive
- https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/ - webarchive
- https://redcanary.com/blog/getsystem-offsec/ - webarchive
- https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ - webarchive
- https://bmcder.com/blog/cobalt-strike-dfir-listening-to-the-pipes - webarchive
- https://www.netresec.com/?page=Blog&month=2024-01&post=Hunting-for-Cobalt-Strike-in-PCAP - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/sneak-peek-ch1-2-finding-beacons-in-the-dark.pdf - webarchive
- https://services.google.com/fh/files/blogs/gcat_threathorizons_full_jul2023.pdf - webarchive
- https://isc.sans.edu/diary/rss/26862 - webarchive
- https://www.sentinelone.com/blog/bluesky-ransomware-ad-lateral-movement-evasion-and-fast-encryption-puts-threat-on-the-radar/ - webarchive
- https://intel471.com/blog/shipping-companies-ransomware-credentials - webarchive
- https://thehackernews.com/2022/05/malware-analysis-trickbot.html - webarchive
- https://embee-research.ghost.io/combining-pivot-points-to-identify-malware-infrastructure-redline-smokeloader-and-cobalt-strike/ - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-268a - webarchive
- https://blog.fox-it.com/2019/02/26/identifying-cobalt-strike-team-servers-in-the-wild/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/new-apt-group-chamelgang - webarchive
- https://elis531989.medium.com/the-squirrel-strikes-back-analysis-of-the-newly-emerged-cobalt-strike-loader-squirrelwaffle-937b73dbd9f9 - webarchive
- https://securelist.com/a-new-secret-stash-for-fileless-malware/106393/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cobian RAT
Internal MISP references
UUID aa553bbd-f6e4-4774-9ec5-4607aa2004b8 which can be used as unique global reference for Cobian RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cobian_rat - webarchive
- https://securityaffairs.co/wordpress/62573/malware/cobian-rat-backdoor.html - webarchive
- https://cocomelonc.github.io/tutorial/2022/04/20/malware-pers-1.html - webarchive
- https://yoroi.company/research/the-wayback-campaign-a-large-scale-operation-hiding-in-plain-sight/ - webarchive
- https://www.zscaler.com/blogs/research/cobian-rat-backdoored-rat - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CobInt
CobInt, is a self-developed backdoor of the Cobalt group. The modular tool has capabilities to collect initial intelligence information about the compromised machine and stream video from its desktop. If the operator decides that the system is of interest, the backdoor will download and launch CobaltStrike framework stager. It's CRM mailslot module was also observed being downloaded by ISFB.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CobInt.
| Known Synonyms |
|---|
COOLPANTS |
Internal MISP references
UUID 23160942-6de6-41c0-8d8c-44876191c3f0 which can be used as unique global reference for CobInt in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cobint - webarchive
- https://www.netscout.com/blog/asert/double-infection-double-fun - webarchive
- https://www.proofpoint.com/us/threat-insight/post/new-modular-downloaders-fingerprint-systems-part-3-cobint - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-kingswood - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-kingswood - webarchive
- https://www.group-ib.com/blog/renaissance - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/cobalt_upd_ttps/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://asert.arbornetworks.com/double-the-infection-double-the-fun/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cobra Carbon System
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cobra Carbon System.
| Known Synonyms |
|---|
Carbon |
Internal MISP references
UUID f75452f3-6a4a-4cd6-b3e0-089fa320e9b9 which can be used as unique global reference for Cobra Carbon System in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cobra - webarchive
- https://blog.gdatasoftware.com/2015/01/23926-analysis-of-project-cobra - webarchive
- https://securelist.com/analysis/publications/65545/the-epic-turla-operation/ - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-hunter - webarchive
- https://github.com/sisoma2/malware_analysis/tree/master/turla_carbon - webarchive
- https://github.com/hfiref0x/TDL - webarchive
- https://docs.broadcom.com/doc/waterbug-attack-group - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity - webarchive
- https://www.circl.lu/pub/tr-25/ - webarchive
- https://www.youtube.com/watch?v=FttiysUZmDw - webarchive
- https://www.melani.admin.ch/dam/melani/de/dokumente/2016/technical%20report%20ruag.pdf.download.pdf/Report_Ruag-Espionage-Case.pdf - webarchive
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a - webarchive
- https://securelist.com/shedding-skin-turlas-fresh-faces/88069/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www-west.symantec.com/content/dam/symantec/docs/security-center/white-papers/waterbug-attack-group-16-en.pdf - webarchive
- https://www.govcert.ch/downloads/whitepapers/Report_Ruag-Espionage-Case.pdf - webarchive
- https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CockBlocker
Internal MISP references
UUID 77e85a95-6a78-4255-915a-488eb73ee82f which can be used as unique global reference for CockBlocker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CodeKey
Internal MISP references
UUID cb5bad79-707c-493d-8a2b-4c0be38301c5 which can be used as unique global reference for CodeKey in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CodeCore
Ransomware.
Internal MISP references
UUID 3952f4e0-0621-4bc3-bc6f-a848e0e49bd1 which can be used as unique global reference for CodeCore in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cohhoc
Internal MISP references
UUID 9481d7b1-307c-4504-9333-21720b85317b which can be used as unique global reference for Cohhoc in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Coinminer
Coinminer is an unwanted malicious software which uses the victim's computational power (CPU and RAM mostly) to mine for coins (for example Monero or Zcash). The malware achieves persistence by adding one of the opensource miners on startup without the victim's consensus. Most sophisticated coin miners use timer settings or cap the CPU usage in order to remain stealthy.
Internal MISP references
UUID 333e2e87-b9b0-4e2e-9ed9-7259c55a93db which can be used as unique global reference for Coinminer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.coinminer - webarchive
- https://blog.malwarebytes.com/threat-analysis/2018/01/a-coin-miner-with-a-heavens-gate/amp/ - webarchive
- https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html - webarchive
- https://blog.malwarebytes.com/threat-analysis/2018/01/a-coin-miner-with-a-heavens-gate/ - webarchive
- https://secrary.com/ReversingMalware/CoinMiner/ - webarchive
- https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer/ - webarchive
- https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ - webarchive
- https://www.triskelelabs.com/investigating-monero-coin-miner - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
coldbrew
Internal MISP references
UUID b30a19b2-383b-4ca5-a047-00910b8a3e03 which can be used as unique global reference for coldbrew in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ColdLock
Internal MISP references
UUID 140f271b-0be1-4455-96c6-015632ade33a which can be used as unique global reference for ColdLock in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.coldlock - webarchive
- https://www.trendmicro.com/en_us/research/20/i/u-s--justice-department-charges-apt41-hackers-over-global-cyberattacks.html - webarchive
- https://medium.com/cycraft/china-linked-threat-group-targets-taiwan-critical-infrastructure-smokescreen-ransomware-c2a155aa53d5 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cold$eal
Cold$eal is a packer for encrypting (sealing) malware. It contains some AV-evasion techniques as well as some sandbox-detection. It was developed by $@dok (aka Sadok aka Coldseal). It was available as a cryptor service under the url coldseal.us and was later sold as a toolkit consisting of the cryptor and a custom made cryptostub including a FuD garantee backed by free update to the cryptostub. The payload was encrypted using RC4 and added to the cryptostub as a resource. The encryption key itself was stored inside the resource as well. Upon start the cryptostub would extract the key, decrypt the payload and perform a selfinjection using the now decrypted payload. Note: The packed sample provided contains some harmless payload, while the unpacked sample is the bare cryptostub without a payload.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cold$eal.
| Known Synonyms |
|---|
ColdSeal |
Internal MISP references
UUID 8d5b7766-673c-493f-b760-65afd61689cb which can be used as unique global reference for Cold$eal in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.coldseal - webarchive
- https://www.xylibox.com/2012/01/cracking-coldeal-541-fwb.html - webarchive
- https://web.archive.org/web/20190331091056/https://myonlinesecurity.co.uk/fake-cdc-flu-pandemic-warning-delivers-gandcrab-5-2-ransomware/ - webarchive
- http://web.archive.org/web/20181007211751/https://myonlinesecurity.co.uk/return-of-fake-ups-cannot-deliver-malspam-with-an-updated-nemucod-ransomware-and-kovter-payload/ - webarchive
- https://www.xylibox.com/2012/01/coldeal-situation-is-under-control.html - webarchive
- https://www.youtube.com/watch?v=242Tn0IL2jE - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ColdStealer
ColdStealer is a relatively new malicious program that was discovered in 2022. Like many other stealers its main purpose is to steal credentials and information from web browsers, in addition to stealing cryptocurrency wallets, FTP credentials, various files and information about the system such as OS version, system language, processor type and clipboard data. When the infostealer collects information that will be stolen, it saves the information in the ZIP form instead of files in the memory. Doing so will allow the malware to bypass detection as there are no traces of files and execution. The only known method of delivering stolen information to cybercriminals is by sending a ZIP archive to the hardcoded command and control (C2) server.
Internal MISP references
UUID 5869f846-adf8-4798-833e-54c05f9b30f6 which can be used as unique global reference for ColdStealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Colibri Loader
According to cloudsek, Colibri Loader is a form of malware designed to facilitate the installation of additional malware types on an already compromised system. This loader employs various techniques to evade detection, such as excluding the Import Address Table (IAT) and utilizing encrypted strings to complicate analysis. Similar to other loader malware, Colibri can be utilized to deploy information-stealing malware, potentially leading to significant loss of sensitive data. As a result, users should exercise caution when encountering unfamiliar files on their systems.
Internal MISP references
UUID 09926538-a7a0-413b-bc7d-4b20a8f4b515 which can be used as unique global reference for Colibri Loader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.colibri - webarchive
- https://cloudsek.com/in-depth-technical-analysis-of-colibri-loader-malware/ - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/ - webarchive
- https://fr3d.hk/blog/colibri-loader-back-to-basics - webarchive
- https://www.bitsight.com/blog/unpacking-colibri-loader-russian-apt-linked-campaign - webarchive
- https://github.com/Casperinous/colibri_loader - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0919.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Collection RAT
Internal MISP references
UUID 6c6570f3-b407-458f-bb83-647c0b1f5dd9 which can be used as unique global reference for Collection RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CollectorGoomba
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CollectorGoomba.
| Known Synonyms |
|---|
Collector Stealer |
Internal MISP references
UUID 5c0f96fd-54c0-44cd-9caf-b986e3fa2879 which can be used as unique global reference for CollectorGoomba in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.collectorgoomba - webarchive
- https://blog.bushidotoken.net/2022/11/detecting-and-fingerprinting.html - webarchive
- https://www.vmray.com/cyber-security-blog/cutting-off-command-and-control-infrastructure-collectorgoomba-threat-bulletin/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Colony
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Colony.
| Known Synonyms |
|---|
Bandios |
GrayBird |
Internal MISP references
UUID 4db94d24-209a-4edd-b175-3a3085739b94 which can be used as unique global reference for Colony in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Combojack
Internal MISP references
UUID 150cde2c-ae36-4fa5-8d8d-8dedc3de43de which can be used as unique global reference for Combojack in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Combos
Internal MISP references
UUID 2b71a966-da08-4467-a785-cb6abf2fa65e which can be used as unique global reference for Combos in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ComeBacker
ComeBacker was found in a backdoored Visual Studio project that was used to target security researchers in Q4 2020 and early 2021.
It is an HTTP(S) downloader.
It uses the AES CBC cipher implemented through the OpenSSL's EVP interface for decryption of its configuration, and also for encryption and decryption of the client-server communication.
The parameter names in HTTP POST requests of the client are generated randomly. As the initial connection, the client exchanges the keys with the server via the Diffie–Hellman key agreement protocol for the elliptic curve secp521r1. The client generates a random 32-bytes long private key, and the server responds with its public key in a buffer starting with the wide character "0".
Next, the clients sends the current local time, and the server responds with a buffer containing multiple values separated with the pipe symbol. The typical values are the encrypted payload, the export to execute, and the MD5 hash of the decrypted DLL to verify the authenticity of the payload.
There are variants of ComeBacker without statically linked OpenSSL. In that case, the key exchange is omitted and AES CBC is replaced with HC-256.
Internal MISP references
UUID 44240b4b-09d3-4b6b-a077-bce00c35ea38 which can be used as unique global reference for ComeBacker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.comebacker - webarchive
- http://blog.nsfocus.net/stumbzarus-apt-lazarus/ - webarchive
- https://cn.ahnlab.com/global/upload/download/asecreport/ASEC%20REPORT_vol.102_ENG%20(4).pdf - webarchive
- https://download.hauri.net/DownSource/down/dwn_detail_down.html?uid=55 - webarchive
- https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/ - webarchive
- https://norfolkinfosec.com/dprk-malware-targeting-security-researchers/ - webarchive
- https://www.anquanke.com/post/id/230161 - webarchive
- https://norfolkinfosec.com/dprk-targeting-researchers-ii-sys-payload-and-registry-hunting/ - webarchive
- https://www.microsoft.com/security/blog/2021/01/28/zinc-attacks-against-security-researchers/ - webarchive
- https://www.comae.com/posts/pandorabox-north-koreans-target-security-researchers/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Comfoo
Internal MISP references
UUID f5044eda-3119-4fcf-b8af-9b56ab66b9be which can be used as unique global reference for Comfoo in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ComLook
ComLook is a malicious plugin for the mail client "The Bat!", written in C++ and compiled with MSVC 10.0. It implements malicious commands like PutFile, GetFile, SetConfig, GetConfig, and Command. It contains hard-coded email addresses and other information, indicating a target in Azerbaijan. It was first uploaded to VirusTotal on January 12, 2022, and is associated with the APT group Turla. It appears to be a targeted deployment.
Internal MISP references
UUID 7726de54-95cc-4783-b26f-79882f0f6cba which can be used as unique global reference for ComLook in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CommonMagic
Internal MISP references
UUID 600b553b-660b-4bbd-9c5d-4e91af9d276a which can be used as unique global reference for CommonMagic in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ComodoSec
Internal MISP references
UUID bdecbbe9-7646-40cd-a9f3-86a20b13e6da which can be used as unique global reference for ComodoSec in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
COMpfun
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular COMpfun.
| Known Synonyms |
|---|
Reductor RAT |
Internal MISP references
UUID 541d5642-0648-4b5a-97b9-81110f273771 which can be used as unique global reference for COMpfun in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.compfun - webarchive
- https://securelist.com/compfun-http-status-based-trojan/96874/ - webarchive
- https://securelist.com/it-threat-evolution-q2-2020/98230 - webarchive
- https://securelist.com/compfun-successor-reductor/93633/ - webarchive
- https://securelist.com/apt-trends-report-q2-2019/91897/ - webarchive
- https://www.gdatasoftware.com/blog/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Computrace
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Computrace.
| Known Synonyms |
|---|
lojack |
Internal MISP references
UUID d24882f9-8645-4f6a-8a86-2f85daaad685 which can be used as unique global reference for Computrace in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.computrace - webarchive
- https://asert.arbornetworks.com/lojack-becomes-a-double-agent/ - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-twilight - webarchive
- https://www.lastline.com/labsblog/apt28-rollercoaster-the-lowdown-on-hijacked-lojack/ - webarchive
- https://bartblaze.blogspot.de/2014/11/thoughts-on-absolute-computrace.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ComradeCircle
Internal MISP references
UUID 634f1977-6cba-4ad7-9501-09e1eaefde56 which can be used as unique global reference for ComradeCircle in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
concealment_troy
Internal MISP references
UUID db370ffc-c3d2-42fc-b45b-f777d69f98c5 which can be used as unique global reference for concealment_troy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Conficker
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Conficker.
| Known Synonyms |
|---|
Kido |
downadup |
traffic converter |
Internal MISP references
UUID 5f638985-49e1-4059-b2eb-f2ffa397b212 which can be used as unique global reference for Conficker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.conficker - webarchive
- https://www.sophos.com/fr-fr/medialibrary/PDFs/marketing%20material/confickeranalysis.pdf - webarchive
- https://github.com/itaymigdal/malware-analysis-writeups/blob/main/Conficker/Conficker.md - webarchive
- https://redcanary.com/blog/intelligence-insights-january-2022/ - webarchive
- http://contagiodump.blogspot.com/2009/05/win32conficker.html - webarchive
- https://www.kaspersky.com/about/press-releases/2009_kaspersky-lab-analyses-new-version-of-kido--conficker - webarchive
- https://github.com/tillmannw/cnfckr - webarchive
- https://www.minitool.com/backup-tips/conficker-worm.html - webarchive
- https://web.archive.org/web/20160616170611/https://media.blackhat.com/bh-eu-10/presentations/Carrera_Silberman/BlackHat-EU-2010-Carrera-Silberman-State-of-Malware-slides.pdf - webarchive
- http://www.csl.sri.com/users/vinod/papers/Conficker/addendumC/index.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Confucius
Internal MISP references
UUID fe43c7e6-1d62-4421-9d85-519f53e8073f which can be used as unique global reference for Confucius in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.confucius - webarchive
- https://researchcenter.paloaltonetworks.com/2016/09/unit42-confucius-says-malware-families-get-further-by-abusing-legitimate-websites/ - webarchive
- https://researchcenter.paloaltonetworks.com/2017/11/unit42-recent-inpage-exploits-lead-multiple-malware-families/ - webarchive
- https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html - webarchive
- https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat - webarchive
- https://blog.nsfocus.net/aptconfuciuspakistanibo/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Conti (Windows)
Conti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems. It was first observed in 2020 and it is thought to be led by a Russia-based cybercrime group that goes under the Wizard Spider pseudonym. In early May 2022, the US government announced a reward of up to $10 million for information on the Conti ransomware gang.
Internal MISP references
UUID c9dca6f3-2a84-4abe-8f33-ccb7a7a0246c which can be used as unique global reference for Conti (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.conti - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://cocomelonc.github.io/investigation/2022/03/27/malw-inv-conti-1.html - webarchive
- https://www.youtube.com/watch?v=hmaWy9QIC7c - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf - webarchive
- https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/ - webarchive
- https://blog.talosintelligence.com/2022/05/conti-and-hive-ransomware-operations.html - webarchive
- https://www.bleepingcomputer.com/news/security/hhs-conti-ransomware-encrypted-80-percent-of-irelands-hse-it-systems/ - webarchive
- https://news.sophos.com/en-us/2022/02/22/cyberthreats-during-russian-ukrainian-tensions-what-can-we-learn-from-history-to-be-prepared/ - webarchive
- https://www.first.org/resources/papers/conf2023/FIRSTCON23-TLPCLEAR-Staubmann-Busy-Bees.pptx - webarchive
- https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/ - webarchive
- https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/ - webarchive
- https://unit42.paloaltonetworks.com/conti-ransomware-gang/ - webarchive
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-annex-download.pdf - webarchive
- https://news.sophos.com/en-us/2022/02/28/conti-and-karma-actors-attack-healthcare-provider-at-same-time-through-proxyshell-exploits/?cmp=30728 - webarchive
- https://www.trmlabs.com/post/analysis-corroborates-suspected-ties-between-conti-and-ryuk-ransomware-groups-and-wizard-spider - webarchive
- https://www.prevailion.com/what-wicked-webs-we-unweave/ - webarchive
- https://www.truesec.com/hub/blog/proxyshell-qbot-and-conti-ransomware-combined-in-a-series-of-cyber-attacks - webarchive
- https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.zscaler.com/blogs/security-research/conti-ransomware-attacks-persist-updated-version-despite-leaks - webarchive
- https://www.cyberark.com/resources/threat-research-blog/conti-group-leaked - webarchive
- https://intel471.com/blog/conti-leaks-cybercrime-fire-team - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa21-265a - webarchive
- https://medium.com/@lcam/lighting-the-exfiltration-infrastructure-of-a-lockbit-affiliate-and-more-f57fbb7a4e79 - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://research.nccgroup.com/2022/04/29/adventures-in-the-land-of-bumblebee-a-new-malicious-loader/ - webarchive
- https://www.bleepingcomputer.com/news/security/conti-ransomware-gang-takes-over-trickbot-malware-operation/ - webarchive
- https://securityintelligence.com/posts/trickbot-conti-crypters-where-are-they-now/ - webarchive
- https://www.mbsd.jp/research/20210413/conti-ransomware/ - webarchive
- https://arcticwolf.com/resources/blog/conti-ransomware-leak-analyzed - webarchive
- https://www.elliptic.co/blog/conti-ransomware-nets-at-least-25.5-million-in-four-months - webarchive
- https://www.advintel.io/post/ransomware-advisory-log4shell-exploitation-for-initial-access-lateral-movement - webarchive
- https://cti-league.com/wp-content/uploads/2021/02/CTI-League-Darknet-Report-2021.pdf - webarchive
- https://github.com/cdong1012/ContiUnpacker - webarchive
- https://www.bankinfosecurity.com/cybercrime-moves-conti-ransomware-absorbs-trickbot-malware-a-18573 - webarchive
- https://www.cybereason.com/blog/cybereason-vs.-conti-ransomware - webarchive
- https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel - webarchive
- https://medium.com/@arnozobec/analyzing-conti-leaks-without-speaking-russian-only-methodology-f5aecc594d1b - webarchive
- https://unit42.paloaltonetworks.com/bumblebee-malware-projector-libra/ - webarchive
- https://www.esentire.com/blog/analysis-of-leaked-conti-intrusion-procedures-by-esentires-threat-response-unit-tru - webarchive
- https://www.trendmicro.com/en_us/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict.html - webarchive
- https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/ - webarchive
- https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape - webarchive
- https://www.silentpush.com/blog/consequences-the-conti-leaks-and-future-problems - webarchive
- https://www.hse.ie/eng/services/publications/conti-cyber-attack-on-the-hse-full-report.pdf - webarchive
- https://www.prodaft.com/m/reports/WizardSpider_TLPWHITE_v.1.4.pdf - webarchive
- https://news.sophos.com/en-us/2021/02/16/what-to-expect-when-youve-been-hit-with-conti-ransomware/ - webarchive
- https://twitter.com/TheDFIRReport/status/1498642512935800833 - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf - webarchive
- https://thedfirreport.com/2021/05/12/conti-ransomware/ - webarchive
- https://damonmccoy.com/papers/Ransomware_eCrime22.pdf - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-as-a-service-enabler-of-widespread-attacks - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-by-the-numbers/lockbit-conti-and-blackcat-lead-pack-amid-rise-in-active-raas-and-extortion-groups-ransomware-in-q1-2022 - webarchive
- http://chuongdong.com/reverse%20engineering/2020/12/15/ContiRansomware/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict/IOC%20Resource%20for%20Russia-Ukraine%20Conflict-Related%20Cyberattacks-03032022.pdf - webarchive
- https://blog.reversinglabs.com/blog/conversinglabs-ep-2-conti-pivots-as-ransomware-as-a-service-struggles - webarchive
- https://www.sekoia.io/en/an-insider-insights-into-conti-operations-part-two/ - webarchive
- https://www.bleepingcomputer.com/news/security/angry-conti-ransomware-affiliate-leaks-gangs-attack-playbook/ - webarchive
- https://www.connectwise.com/resources/conti-profile - webarchive
- https://www.darktrace.com/en/blog/the-double-extortion-business-conti-ransomware-gang-finds-new-avenues-of-negotiation/ - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v - webarchive
- https://assets.sentinelone.com/ransomware-enterprise/conti-ransomware-unpacked - webarchive
- https://documents.trendmicro.com/assets/pdf/datasheet-ransomware-in-Q1-2022.pdf - webarchive
- https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html - webarchive
- https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/787/original/ransomware-chats.pdf?1651576098 - webarchive
- https://twitter.com/AltShiftPrtScn/status/1417849181012647938 - webarchive
- https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/ - webarchive
- https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf - webarchive
- https://cocomelonc.github.io/investigation/2022/04/11/malw-inv-conti-2.html - webarchive
- https://eclypsium.com/2022/06/02/conti-targets-critical-firmware/ - webarchive
- https://www.advanced-intel.com/post/hunting-for-corporate-insurance-policies-indicators-of-ransom-exfiltrations - webarchive
- https://yoroi.company/research/conti-ransomware-source-code-a-well-designed-cots-ransomware/ - webarchive
- https://threatpost.com/conti-ransomware-v-3-including-decryptor-leaked/179006/ - webarchive
- https://www.bleepingcomputer.com/news/security/conti-ransomwares-internal-chats-leaked-after-siding-with-russia/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://medium.com/cycraft/the-road-to-ransomware-resilience-c1ca37036efd - webarchive
- https://www.youtube.com/watch?v=uORuVVQzZ0A - webarchive
- https://www.secureworks.com/blog/gold-ulrick-leaks-reveal-organizational-structure-and-relationships - webarchive
- https://www.advintel.io/post/hydra-with-three-heads-blackbyte-the-future-of-ransomware-subsidiary-groups - webarchive
- https://www.ironnet.com/blog/ransomware-graphic-blog - webarchive
- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf - webarchive
- https://www.advanced-intel.com/post/secret-backdoor-behind-conti-ransomware-operation-introducing-atera-agent - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-double-extortion-and-beyond-revil-clop-and-conti - webarchive
- https://cluster25.io/2022/03/02/contis-source-code-deep-dive-into/ - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html - webarchive
- https://www.eldiario.es/tecnologia/capos-cibercrimen-avisan-contratacaran-si-hackea-rusia_1_8795458.html - webarchive
- https://cybersecurity.att.com/blogs/security-essentials/stories-from-the-soc-powershell-proxyshell-conti-ttps-oh-my - webarchive
- https://www.esentire.com/blog/conti-affiliate-exposed-new-domain-names-ip-addresses-and-email-addresses-uncovered-by-esentire - webarchive
- https://github.com/whichbuffer/Conti-Ransomware-IOC - webarchive
- https://blogs.vmware.com/security/2022/09/threat-report-illuminating-volume-shadow-deletion.html - webarchive
- https://securityandtechnology.org/wp-content/uploads/2021/04/IST-Ransomware-Task-Force_Final_Report.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/ryuk-successor-conti-ransomware-releases-data-leak-site/ - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-from-shatak-emails-to-the-conti-ransomware - webarchive
- https://0xthreatintel.medium.com/reversing-conti-ransomware-bfce15019e74 - webarchive
- https://ke-la.com/to-attack-or-not-to-attack-targeting-the-healthcare-sector-in-the-underground-ecosystem/ - webarchive
- https://www.bleepingcomputer.com/news/security/hackers-use-contis-leaked-ransomware-to-attack-russian-companies/ - webarchive
- https://arcticwolf.com/resources/blog/karakurt-web - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://ke-la.com/zooming-into-darknet-threats-targeting-jp-orgs-kela/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-group-targets-esxi-hypervisors-with-its-linux-variant.html - webarchive
- https://github.com/TheParmak/conti-leaks-englished - webarchive
- https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html - webarchive
- https://unit42.paloaltonetworks.com/luna-moth-callback-phishing/ - webarchive
- https://www.secureworks.com/blog/gold-ulrick-continues-conti-operations-despite-public-disclosures - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/787/original/ransomware-chats.pdf - webarchive
- https://www.crowdstrike.com/blog/wizard-spider-adversary-update/ - webarchive
- https://www.justice.gov/opa/pr/multiple-foreign-nationals-charged-connection-trickbot-malware-and-conti-ransomware - webarchive
- https://www.clearskysec.com/wp-content/uploads/2021/02/Conti-Ransomware.pdf - webarchive
- https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/ - webarchive
- https://therecord.media/conti-leaks-the-panama-papers-of-ransomware/ - webarchive
- https://therecord.media/disgruntled-ransomware-affiliate-leaks-the-conti-gangs-technical-manuals/ - webarchive
- https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider - webarchive
- https://twitter.com/AltShiftPrtScn/status/1350755169965924352 - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/ - webarchive
- https://www.mbsd.jp/2022/03/08/assets/images/MBSD_Summary_of_ContiLeaks_Rev3.pdf - webarchive
- https://cocomelonc.github.io/malware/2023/01/04/malware-tricks-26.html - webarchive
- https://securityaffairs.co/wordpress/128190/cyber-crime/conti-ransomware-takes-over-trickbot.html - webarchive
- https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/ - webarchive
- https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/ - webarchive
- https://threatpost.com/conti-ransomware-decryptor-trickbot-source-code-leaked/178727/ - webarchive
- https://www.threatstop.com/blog/conti-ransomware-source-code-leaked - webarchive
- https://krebsonsecurity.com/2021/10/conti-ransom-gang-starts-selling-access-to-victims/ - webarchive
- https://areteir.com/wp-content/uploads/2020/08/Arete_Insight_Is-Conti-the-new-Ryuk_August2020.pdf - webarchive
- https://securelist.com/modern-ransomware-groups-ttps/106824/ - webarchive
- https://www.cynet.com/attack-techniques-hands-on/shelob-moonlight-spinning-a-larger-web/ - webarchive
- https://www.bleepingcomputer.com/news/security/karakurt-revealed-as-data-extortion-arm-of-conti-cybercrime-syndicate/ - webarchive
- https://www.bleepingcomputer.com/news/security/cisa-updates-conti-ransomware-alert-with-nearly-100-domain-names/ - webarchive
- https://github.com/EmissarySpider/ransomware-descendants - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/the-sound-of-malware.html - webarchive
- https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker - webarchive
- https://www.crowdstrike.com/blog/how-to-defend-against-conti-darkside-revil-and-other-ransomware/ - webarchive
- https://www.domaintools.com/resources/blog/the-most-prolific-ransomware-families-a-defenders-guide - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://securityaffairs.com/141666/cyber-crime/lockbit-green-ransomware-variant.html - webarchive
- https://cocomelonc.github.io/tutorial/2022/04/02/malware-injection-18.html - webarchive
- https://therecord.media/conti-ransomware-gang-chats-leaked-by-pro-ukraine-member/ - webarchive
- https://www.unh4ck.com/detection-engineering-and-threat-hunting/lateral-movement/detecting-conti-cobaltstrike-lateral-movement-techniques-part-1 - webarchive
- https://medium.com/@whickey000/how-i-cracked-conti-ransomware-groups-leaked-source-code-zip-file-e15d54663a8 - webarchive
- https://intel471.com/blog/conti-emotet-ransomware-conti-leaks - webarchive
- https://www.unh4ck.com/detection-engineering-and-threat-hunting/lateral-movement/detecting-conti-cobaltstrike-lateral-movement-techniques-part-2 - webarchive
- https://thedfirreport.com/2021/09/13/bazarloader-to-conti-ransomware-in-32-hours/ - webarchive
- https://www.coveware.com/blog/2022/1/26/ransomware-as-a-service-innovation-curve - webarchive
- https://thedfirreport.com/2021/12/13/diavol-ransomware/ - webarchive
- https://marcoramilli.com/2021/11/07/conti-ransomware-cheat-sheet/ - webarchive
- https://lifars.com/wp-content/uploads/2021/10/ContiRansomware_Whitepaper.pdf - webarchive
- https://research.nccgroup.com/2022/03/31/conti-nuation-methods-and-techniques-observed-in-operations-post-the-leaks/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/log4j-vulnerabilities-attacks - webarchive
- https://redcanary.com/blog/intelligence-insights-november-2021/ - webarchive
- https://content.secureworks.com/-/media/Files/US/Reports/Monthly%20Threat%20Intelligence/Secureworks_ECO1_ThreatIntelligenceExecutiveReport2022Vol2.ashx - webarchive
- https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound - webarchive
- https://www.ic3.gov/Media/News/2021/210521.pdf - webarchive
- https://www.sekoia.io/en/an-insider-insights-into-conti-operations-part-one - webarchive
- https://news.sophos.com/en-us/2021/02/16/conti-ransomware-evasive-by-nature/ - webarchive
- https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/ - webarchive
- https://attackiq.com/2022/06/15/attack-graph-emulating-the-conti-ransomware-teams-behaviors/ - webarchive
- https://www.dragos.com/blog/industry-news/dragos-ics-ot-ransomware-analysis-q4-2021/ - webarchive
- https://nakedsecurity.sophos.com/2021/08/06/conti-ransomware-affiliate-goes-rogue-leaks-company-data/ - webarchive
- https://www.threatstop.com/blog/first-conti-then-hive-costa-rica-gets-hit-with-ransomware-again - webarchive
- https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti - webarchive
- https://cyware.com/news/ransomware-becomes-deadlier-conti-makes-the-most-money-39e17bae/ - webarchive
- https://share.vx-underground.org/Conti/ - webarchive
- https://www.bleepingcomputer.com/news/security/conti-ransomware-source-code-leaked-by-ukrainian-researcher/ - webarchive
- https://intel471.com/blog/conti-vs-monti-a-reinvention-or-just-a-simple-rebranding - webarchive
- https://blog.qualys.com/vulnerabilities-threat-research/2021/11/18/conti-ransomware - webarchive
- https://medium.com/walmartglobaltech/from-royal-with-love-88fa05ff7f65 - webarchive
- https://research.checkpoint.com/2022/leaks-of-conti-ransomware-group-paint-picture-of-a-surprisingly-normal-tech-start-up-sort-of/ - webarchive
- https://www.advintel.io/post/24-hours-from-log4shell-to-local-admin-deep-dive-into-conti-gang-attack-on-fortune-500-dfir - webarchive
- https://cocomelonc.github.io/malware/2023/02/10/malware-analysis-8.html - webarchive
- https://threatpost.com/affiliate-leaks-conti-ransomware-playbook/168442/ - webarchive
- https://www.prodaft.com/m/reports/Conti_TLPWHITE_v1.6_WVcSEtc.pdf - webarchive
- https://blogs.blackberry.com/en/2022/09/the-curious-case-of-monti-ransomware-a-real-world-doppelganger - webarchive
- https://blog.bushidotoken.net/2022/04/lessons-from-conti-leaks.html - webarchive
- https://arcticwolf.com/resources/blog/conti-and-akira-chained-together/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-007.pdf - webarchive
- https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/ - webarchive
- https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/ - webarchive
- https://www.redhotcyber.com/post/il-ransomware-conti-si-schiera-a-favore-della-russia - webarchive
- https://www.youtube.com/watch?v=cYx7sQRbjGA - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-conti - webarchive
- https://blog.talosintelligence.com/2021/09/Conti-leak-translation.html - webarchive
- https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox - webarchive
- https://securelist.com/luna-black-basta-ransomware/106950 - webarchive
- https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf - webarchive
- https://intel471.com/blog/shipping-companies-ransomware-credentials - webarchive
- https://thehackernews.com/2022/05/malware-analysis-trickbot.html - webarchive
- https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-ii-the-office/ - webarchive
- https://www.dragos.com/blog/industry-news/suspected-conti-ransomware-activity-in-the-auto-manufacturing-sector/ - webarchive
- https://www.cyberscoop.com/ransomware-gang-conti-bounced-back/ - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://www.bleepingcomputer.com/news/security/taiwanese-apple-and-tesla-contractor-hit-by-conti-ransomware/ - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://www.ncsc.gov.ie/pdfs/HSE_Conti_140521_UPDATE.pdf - webarchive
- https://twitter.com/AltShiftPrtScn/status/1423188974298861571 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Contopee
FireEye described this malware as a proxy-aware backdoor that communicates using a custom-encrypted binary protocol. It may use the registry to store optional configuration data. The backdoor has been observed to support 26 commands that include directory traversal, file system manipulation, data archival and transmission, and command execution.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Contopee.
| Known Synonyms |
|---|
WHITEOUT |
Internal MISP references
UUID 4181ebb5-cce9-4fb1-81a1-c3f34cb643de which can be used as unique global reference for Contopee in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.contopee - webarchive
- https://web.archive.org/web/20160527050022/https://www.symantec.com/connect/blogs/swift-attackers-malware-linked-more-financial-attacks - webarchive
- https://content.fireeye.com/apt/rpt-apt38 - webarchive
- https://www.symantec.com/connect/blogs/swift-attackers-malware-linked-more-financial-attacks - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CookieBag
Internal MISP references
UUID 9afa9b7e-e2c1-4725-8d8d-cec7933cc63b which can be used as unique global reference for CookieBag in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CopperStealer
According to PCRIsk, CopperStealer, also known as Mingloa, is a malicious program designed to steal sensitive/personal information. It also has the capability to cause chain infections (i.e., download/install additional malware).
Significant activity of CopperStealer has been observed in Brazil, India, Indonesia, Pakistan, and the Philippines. At the time of research, this malware had been noted being spread via websites offering illegal activation tools ("cracks") for licensed software products.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CopperStealer.
| Known Synonyms |
|---|
Mingloa |
Internal MISP references
UUID 87afcc5d-27f6-4427-b43c-4621a66e5041 which can be used as unique global reference for CopperStealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.copper_stealer - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/now-you-see-it-now-you-dont-copperstealer-performs-widespread-theft - webarchive
- https://www.trendmicro.com/en_us/research/22/h/copperstealer-distributes-malicious-chromium-browser-extension-steal-cryptocurrencies.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Corebot
Internal MISP references
UUID 495377c4-1be5-4c65-ba66-94c221061415 which can be used as unique global reference for Corebot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.corebot - webarchive
- https://www.crowdstrike.com/blog/ecrime-ecosystem/ - webarchive
- https://malwarebreakdown.com/2017/09/11/re-details-malspam-downloads-corebot-banking-trojan/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report_BosonSpider.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CoreDN
Internal MISP references
UUID 331f0c80-a795-48aa-902e-0b0d57de85f5 which can be used as unique global reference for CoreDN in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.coredn - webarchive
- https://blog.alyac.co.kr/2105 - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/ - webarchive
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/#atricle-content - webarchive
- https://www.symantec.com/security-center/writeup/2018-021216-4405-99#technicaldescription - webarchive
- https://blog.talosintelligence.com/2019/01/fake-korean-job-posting.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Coreshell
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Coreshell.
| Known Synonyms |
|---|
SOURFACE |
Internal MISP references
UUID 579cc23d-4ba4-419f-bf8a-f235ed33125e which can be used as unique global reference for Coreshell in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.coreshell - webarchive
- https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf - webarchive
- https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/ - webarchive
- http://www.malware-reversing.com/2012/12/3-disclosure-of-another-0day-malware.html - webarchive
- https://contagiodump.blogspot.de/2017/02/russian-apt-apt28-collection-of-samples.html - webarchive
- http://malware.prevenity.com/2014/08/malware-info.html - webarchive
- http://www2.fireeye.com/rs/fireye/images/rpt-apt28.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CoronaVirus Ransomware
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CoronaVirus Ransomware.
| Known Synonyms |
|---|
CoronaVirus Cover-Ransomware |
Internal MISP references
UUID ba683942-1524-459a-ad46-827464967164 which can be used as unique global reference for CoronaVirus Ransomware in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CosmicDuke
Internal MISP references
UUID 14990e2c-81a2-4750-b9a8-7535d152e437 which can be used as unique global reference for CosmicDuke in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cotx RAT
Internal MISP references
UUID 47190b56-5176-4e8b-8c78-fcc10e511fa2 which can be used as unique global reference for Cotx RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cotx - webarchive
- https://st.drweb.com/static/new-www/news/2021/april/drweb_research_attacks_on_russian_research_institutes_en.pdf - webarchive
- https://vb2020.vblocalhost.com/uploads/VB2020-20.pdf - webarchive
- https://vblocalhost.com/uploads/VB2020-Ozawa-etal.pdf - webarchive
- https://www.trendmicro.com/en_in/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html - webarchive
- https://www.socinvestigation.com/chinese-new-backdoor-deployed-for-cyberespionage/ - webarchive
- https://vb2020.vblocalhost.com/uploads/VB2020-Ozawa-etal.pdf - webarchive
- https://nao-sec.org/2020/01/an-overhead-view-of-the-royal-road.html - webarchive
- https://vblocalhost.com/uploads/VB2020-20.pdf - webarchive
- https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-Targeted-attack-on-industrial-enterprises-and-public-institutions-En.pdf - webarchive
- https://www.youtube.com/watch?v=1WfPlgtfWnQ - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://www.proofpoint.com/us/threat-insight/post/chinese-apt-operation-lagtime-it-targets-government-information-technology - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cova
Internal MISP references
UUID cad667c1-be0a-49db-b2fb-462082a04fbe which can be used as unique global reference for Cova in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Covicli
Covicli is a modified SSLeay32 dynamic library designated as a backdoor. The dynamic library allows the attacker to communicate with the C2 over openSSL.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Covicli.
| Known Synonyms |
|---|
Covically |
Internal MISP references
UUID e8986c0c-2997-425d-ae4e-529f82d3fa48 which can be used as unique global reference for Covicli in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Covid22
Destructive "joke" malware that ultimately deploys a wiper for the MBR.
Internal MISP references
UUID d4796a4f-63f0-42f0-a043-fb91416c29d2 which can be used as unique global reference for Covid22 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CoViper
PCRisk notes that CoViper is yet another Coronavirus/COVID-19-themed malware infection, most likely proliferated as a file related to the pandemic. It operates by rewriting the system Master Boot Record (MBR). It does not delete the original, but rather creates a backup and replaces it with a custom MBR.
Typically, malicious software that modifies MBRs do so to prevent the Operating System (OS) from being booted (i.e., started). It also displays a screen-encompassing message, often containing a ransom message - this disables user access to the device.
Internal MISP references
UUID 4d7d8496-52a6-47dc-abfe-4997af6dc465 which can be used as unique global reference for CoViper in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
COZYDUKE
CozyDuke is not simply a malware toolset; rather, it is a modular malware platform formed around a core backdoor component. This component can be instructed by the C&C server to download and execute arbitrary modules, and it is these modules that provide CozyDuke with its vast array of functionality. Known CozyDuke modules include: • Command execution module for executing arbitrary Windows Command Prompt commands • Password stealer module • NT LAN Manager (NTLM) hash stealer module • System information gathering module • Screenshot module
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular COZYDUKE.
| Known Synonyms |
|---|
Cozer |
CozyBear |
CozyCar |
EuroAPT |
Internal MISP references
UUID b461afd0-f5fd-4c25-8367-4235a6e8b9b1 which can be used as unique global reference for COZYDUKE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
crackshot
CRACKSHOT is a downloader that can download files, including binaries, and run them from the hard disk or execute them directly in memory. It is also capable of placing itself into a dormant state.
Internal MISP references
UUID cfa111c1-3740-4832-8e89-12a536f4fff9 which can be used as unique global reference for crackshot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CradleCore
Internal MISP references
UUID 6fb5bfff-4b10-43a4-ad3c-a1578f39e83e which can be used as unique global reference for CradleCore in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CRAT
According to Cisco Talos, CRAT is a remote access trojan with plugin capabilites, used by Lazarus since at least May 2020.
Internal MISP references
UUID ca901b56-b733-44af-aee2-38da79188dcb which can be used as unique global reference for CRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.crat - webarchive
- https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html - webarchive
- https://www.secrss.com/articles/18635 - webarchive
- https://mp.weixin.qq.com/s/2sV-DrleHiJMSpSCW0kAMg - webarchive
- https://suspected.tistory.com/269 - webarchive
- https://blog.talosintelligence.com/2020/11/crat-and-plugins.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CREAMSICLE
Internal MISP references
UUID 9d193a65-dc18-4832-9daa-aab245cd1c86 which can be used as unique global reference for CREAMSICLE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CredoMap
Internal MISP references
UUID 37e6844c-4e45-4297-ac6e-afc98d37d994 which can be used as unique global reference for CredoMap in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.credomap - webarchive
- https://cert.gov.ua/article/341128 - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-009.pdf - webarchive
- https://blog.bushidotoken.net/2022/06/overview-of-russian-gru-and-svr.html - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ - webarchive
- https://securityscorecard.com/research/apt28s-stealer-called-credomap - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Credraptor
Internal MISP references
UUID ac75d0a3-bb99-4453-9567-a6c8ba87a706 which can be used as unique global reference for Credraptor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CreepySnail
Internal MISP references
UUID a95d4aaa-302e-4a3c-a071-ba8eed978920 which can be used as unique global reference for CreepySnail in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CreepExfil
Internal MISP references
UUID fc743725-2fa6-48dd-8797-57e298375505 which can be used as unique global reference for CreepExfil in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Crenufs
Internal MISP references
UUID e8682902-7748-423a-8ba9-6f00d9fe7331 which can be used as unique global reference for Crenufs in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Crimson RAT
It was first discovered in 2017 and has since been used to attack organizations around the world. The malware is often distributed through phishing emails or by exploiting vulnerabilities in outdated security software. Once Crimson RAT is installed on a computer, it can be used to steal data, spy on users, and even take control of the infected computers.
Some of the features of Crimson RAT include:
Remote control of infected computers Data theft, such as passwords, files, and emails User spying Takeover of infected computers Locking of infected computers Extortion of payments
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Crimson RAT.
| Known Synonyms |
|---|
SEEDOOR |
Scarimson |
Internal MISP references
UUID a61fc694-a88a-484d-a648-db35b49932fd which can be used as unique global reference for Crimson RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.crimson - webarchive
- https://twitter.com/katechondic/status/1502206599166939137 - webarchive
- https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf - webarchive
- https://www.seqrite.com/blog/operation-honey-trap-apt36-targets-defense-organizations-in-india/ - webarchive
- https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html - webarchive
- https://www.secrss.com/articles/24995 - webarchive
- https://s.tencent.com/research/report/669.html - webarchive
- https://anchorednarratives.substack.com/p/trouble-in-asia-and-the-middle-east - webarchive
- https://www.proofpoint.com/us/threat-insight/post/new-whiteshadow-downloader-uses-microsoft-sql-retrieve-malware - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://mp.weixin.qq.com/s/ELYDvdMiiy4FZ3KpmAddZQ - webarchive
- https://twitter.com/teamcymru_S2/status/1501955802025836546 - webarchive
- https://www.amnesty.org/download/Documents/ASA3383662018ENGLISH.PDF - webarchive
- https://www.zscaler.com/blogs/security-research/catching-rats-over-custom-protocols - webarchive
- https://securelist.com/transparent-tribe-part-1/98127/ - webarchive
- https://blog.talosintelligence.com/2022/03/transparent-tribe-new-campaign.html?m=1 - webarchive
- https://securelist.com/transparent-tribe-part-2/98233/ - webarchive
- https://www.trendmicro.com/en_us/research/22/a/investigating-apt36-or-earth-karkaddans-attack-chain-and-malware.html - webarchive
- https://blog.yoroi.company/research/transparent-tribe-four-years-later - webarchive
- https://twitter.com/teamcymru/status/1351228309632385027 - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/investigating-apt36-or-earth-karkaddan-attack-chain-and-malware-arsenal/IoCs_Investigating%20APT36%20or%20Earth%20Karkaddan%20Attack%20Chain%20and%20Malware%20Arsenal.rtf - webarchive
- https://www.secureworks.com/research/threat-profiles/copper-fieldstone - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/investigating-apt36-or-earth-karkaddan-attack-chain-and-malware-arsenal/Earth%20Karkaddan%20APT-%20Adversary%20Intelligence%20and%20Monitoring%20Report.pdf - webarchive
- https://mp.weixin.qq.com/s/xUM2x89GuB8uP6otN612Fg - webarchive
- https://team-cymru.com/blog/2021/07/02/transparent-tribe-apt-infrastructure-mapping-2/ - webarchive
- https://labs.k7computing.com/index.php/transparent-tribe-targets-educational-institution/ - webarchive
- https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://mp.weixin.qq.com/s/AhxP5HmROtMsFBiUxj0cFg - webarchive
- https://www.seqrite.com/blog/transparent-tribe-apt-actively-lures-indian-army-amidst-increased-targeting-of-educational-institutions - webarchive
- https://www.bleepingcomputer.com/news/security/hackers-use-modified-mfa-tool-against-indian-govt-employees/ - webarchive
- https://blog.cluster25.duskrise.com/2023/10/12/cve-2023-38831-russian-attack - webarchive
- https://cybleinc.com/2021/04/30/transparent-tribe-operating-with-a-new-variant-of-crimson-rat/ - webarchive
- https://www.4hou.com/posts/vLzM - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
- https://team-cymru.com/blog/2021/04/16/transparent-tribe-apt-infrastructure-mapping/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CrimsonIAS
According to ThreatConnect, CrimsonIAS is a Delphi-written backdoor dating back to at least 2017. It enables operators to run command line tools, exfiltrate files, and upload files to the infected machine. CrimsonIAS is notable as it listens for incoming connections only; making it different from typical Windows backdoors that beacons out.
Internal MISP references
UUID 6f2a68d1-06a9-4657-98d8-590a6446e475 which can be used as unique global reference for CrimsonIAS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cring
Ransomware.
Internal MISP references
UUID f5a19987-d0b6-4cc3-89ab-d4540f2e9744 which can be used as unique global reference for Cring in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cring - webarchive
- https://twitter.com/swisscom_csirt/status/1354052879158571008 - webarchive
- https://news.sophos.com/en-us/2021/09/21/cring-ransomware-group-exploits-ancient-coldfusion-server/?cmp=30728 - webarchive
- https://www.trendmicro.com/en_us/research/21/i/examining-the-cring-ransomware-techniques.html - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-Vulnerability-in-Fortigate-VPN-servers-is-exploited-in-Cring-ransomware-attacks-En.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CrossLock
Internal MISP references
UUID 505dc6be-56f3-49ca-be11-45b3e78a4ac2 which can be used as unique global reference for CrossLock in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CROSSWALK
According to FireEye, CROSSWALK is a skeletal, modular backdoor capable of system survey and adding modules in response to C&C replies.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CROSSWALK.
| Known Synonyms |
|---|
Motnug |
ProxIP |
TOMMYGUN |
Internal MISP references
UUID 7ca7c08b-36fd-46b3-8b9e-a8b0d4743433 which can be used as unique global reference for CROSSWALK in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.crosswalk - webarchive
- https://www.carbonblack.com/2019/09/04/cb-tau-threat-intelligence-notification-state-sponsored-espionage-group-targeting-multiple-verticals-with-crosswalk/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ - webarchive
- https://thehackernews.com/2021/01/researchers-disclose-undocumented.html - webarchive
- https://www.carbonblack.com/2019/09/30/cb-threat-analysis-unit-technical-analysis-of-crosswalk/ - webarchive
- https://www.youtube.com/watch?v=FttiysUZmDw - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/grayfly-china-sidewalk-malware - webarchive
- https://www.welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/ - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/apt41-indictments-china-espionage - webarchive
- https://www.youtube.com/watch?v=8x-pGlWpIYI - webarchive
- https://content.fireeye.com/apt-41/rpt-apt41/ - webarchive
- https://twitter.com/MrDanPerez/status/1159459082534825986 - webarchive
- https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Croxloader
According to Trend Micro, this is a custom loader for win.cobalt_strike, used by Earth Longzhi (a subgroup of APT41).
Internal MISP references
UUID 48d697ec-aa34-4d98-83e4-17b736d59a85 which can be used as unique global reference for Croxloader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CruLoader
Internal MISP references
UUID 22d90775-cdcc-4c80-bb0a-1503275671c7 which can be used as unique global reference for CruLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Crutch
Internal MISP references
UUID e7dc138f-00cb-4db6-a6e7-3ecac853285d which can be used as unique global reference for Crutch in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cryakl
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cryakl.
| Known Synonyms |
|---|
CryLock |
Internal MISP references
UUID 32fa6c53-b4fc-47f8-894c-1ea74180e02f which can be used as unique global reference for Cryakl in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cryakl - webarchive
- https://twitter.com/albertzsigovits/status/1217866089964679174 - webarchive
- https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process - webarchive
- https://securelist.ru/shifrovalshhik-cryakl-ili-fantomas-razbushevalsya/24070/ - webarchive
- https://securelist.com/cis-ransomware/104452/ - webarchive
- https://unit42.paloaltonetworks.com/trigona-ransomware-update/ - webarchive
- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Cryakl-B/detailed-analysis.aspx - webarchive
- https://bartblaze.blogspot.com/2016/02/vipasana-ransomware-new-ransom-on-block.html - webarchive
- https://hackmag.com/security/ransomware-russian-style/ - webarchive
- https://twitter.com/demonslay335/status/971164798376468481 - webarchive
- https://www.telekom.com/en/blog/group/article/lockdata-auction-631300 - webarchive
- https://securelist.com/the-return-of-fantomas-or-how-we-deciphered-cryakl/86511/ - webarchive
- https://twitter.com/bartblaze/status/1305197264332369920 - webarchive
- https://ke-la.com/the-ideal-ransomware-victim-what-attackers-are-looking-for/ - webarchive
- https://blog.checkpoint.com/2015/11/04/offline-ransomware-encrypts-your-data-without-cc-communication/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryLocker
Internal MISP references
UUID 980ea9fa-d29d-4a44-bb87-0c050f8ddeaf which can be used as unique global reference for CryLocker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CrypMic
Internal MISP references
UUID 2fe1dd8c-23d8-40a6-b042-bd2c4012fea6 which can be used as unique global reference for CrypMic in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.crypmic - webarchive
- https://www.cert.pl/news/single/cryptxxx-crypmic-ransomware-dystrybuowany-ramach-exploit-kitow/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/crypmic-ransomware-wants-to-follow-cryptxxx/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Crypt0l0cker
Internal MISP references
UUID 38b38f8c-944d-4062-bf35-561e8a81c8d2 which can be used as unique global reference for Crypt0l0cker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryptBot
A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.
Internal MISP references
UUID 2274aaf6-4807-4cda-8f5b-16a757f4ff23 which can be used as unique global reference for CryptBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot - webarchive
- https://www.bleepingcomputer.com/news/security/malicious-kmspico-installers-steal-your-cryptocurrency-wallets/ - webarchive
- https://asec.ahnlab.com/en/35981/ - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://asec.ahnlab.com/en/31683/ - webarchive
- https://experience.mandiant.com/trending-evil-2/p/1 - webarchive
- https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ - webarchive
- https://www.mandiant.com/resources/russian-targeting-gov-business - webarchive
- https://asec.ahnlab.com/en/31802/ - webarchive
- https://research.openanalysis.net/cryptbot/botnet/yara/config/2023/03/16/cryptbot.html - webarchive
- https://www.gdatasoftware.com/blog/2020/02/35802-bitbucket-abused-as-malware-slinger - webarchive
- https://www.bleepingcomputer.com/news/security/revamped-cryptbot-malware-spread-by-pirated-software-sites/ - webarchive
- https://blog.google/technology/safety-security/continuing-our-work-to-hold-cybercriminal-ecosystems-accountable/ - webarchive
- https://asec.ahnlab.com/en/26052/ - webarchive
- https://blogs.blackberry.com/en/2022/03/threat-thursday-cryptbot-infostealer - webarchive
- https://asec.ahnlab.com/en/24423/ - webarchive
- https://fr3d.hk/blog/cryptbot-too-good-to-be-true - webarchive
- https://redcanary.com/wp-content/uploads/2021/12/KMSPico-V5.pdf - webarchive
- https://regmedia.co.uk/2023/04/28/handout_google_cryptbot_complaint.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CrypticConvo
CrypticConvo is a dropper trojan which appears to be embedded in an automatic generator framework to deliver the FakeM trojan. According to PaloaltoNetworks CrypticConvo and several additional trojans are believed to be included in a meta framework used by the "Scarlet Mimic" threat actor in order to quickly evade AV systems.
Internal MISP references
UUID 972fbb7b-6945-42d8-ba88-a7b4e6fc1ad4 which can be used as unique global reference for CrypticConvo in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryptNET
According to OALabs, this ransomware has the following features: * Files are encrypted with AES CBC using a generated 256 bit key and IV. * The generated AES keys are encrypted using a hard coded RSA key and appended to the encrypted files.
Internal MISP references
UUID 99c468a2-c69f-4c9c-9941-0627052001b2 which can be used as unique global reference for CryptNET in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryptoClippy
Internal MISP references
UUID 7c296221-3945-4803-b25f-1e221b513f0d which can be used as unique global reference for CryptoClippy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryptoDarkRubix
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CryptoDarkRubix.
| Known Synonyms |
|---|
Ranet |
Internal MISP references
UUID c6d09bb2-5673-4b2b-b2cb-5d14f2568189 which can be used as unique global reference for CryptoDarkRubix in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryptoJoker
CryptoJoker is an open source ransomware written in C#. CryptoJoker uses a combination of a "custom XOR" encryption and RSA. A private public/private pair key is generated for every computer.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CryptoJoker.
| Known Synonyms |
|---|
PlutoCrypt |
Internal MISP references
UUID 01cb8122-7a24-436f-85d3-d6a306800f10 which can be used as unique global reference for CryptoJoker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryptoLocker
CryptoLocker is a new sophisticated malware that was launched in the late 2013. It is designed to attack Windows operating system by encrypting all the files from the system using a RSA-2048 public key. To decrypt the mentioned files, the user has to pay a ransom (usually 300 USD/EUR) or 2 BitCoins.
Internal MISP references
UUID c5a783da-9ff3-4427-84c5-428480b21cc7 which can be used as unique global reference for CryptoLocker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptolocker - webarchive
- https://sites.temple.edu/care/ci-rw-attacks/ - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://docs.microsoft.com/en-us/security/compass/human-operated-ransomware - webarchive
- https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf - webarchive
- https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group - webarchive
- https://www.secureworks.com/research/cryptolocker-ransomware - webarchive
- https://www.justice.gov/opa/pr/us-leads-multi-national-action-against-gameover-zeus-botnet-and-cryptolocker-ransomware - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-evergreen - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-evergreen - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryptoLuck
Internal MISP references
UUID 3ec67717-acd5-401b-8e9f-47e79edd07a0 which can be used as unique global reference for CryptoLuck in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryptoMix
A variant of CryptoMix is win.clop.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CryptoMix.
| Known Synonyms |
|---|
Azer |
CryptFile2 |
Internal MISP references
UUID 55d5742e-20f5-4c9a-887a-4dbd5b37d921 which can be used as unique global reference for CryptoMix in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptomix - webarchive
- https://www.bleepingcomputer.com/news/security/work-cryptomix-ransomware-variant-released/ - webarchive
- https://labs.sentinelone.com/breaking-ta505s-crypter-with-an-smt-solver/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-azer-cryptomix-ransomware-variant-released/ - webarchive
- https://www.cert.pl/en/news/single/technical-analysis-of-cryptomixcryptfile2-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryptoPatronum
CryptoPatronum is a ransomware that encrypts user data through AES-256 (CBC) and it asks for BTC / ETH in order to get back the original files. In the ransom note there is not a title but only a reference to crsss.exe: its original file name. Once the files are encrypted, CryptoPatronum adds a .enc extension.
Internal MISP references
UUID 738acbd6-d0b7-40fd-bc1b-d7fbb74cbbf9 which can be used as unique global reference for CryptoPatronum in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cryptorium
Internal MISP references
UUID b7240444-94a6-4d57-a6b3-ca38182eff7a which can be used as unique global reference for Cryptorium in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryptoShield
Internal MISP references
UUID 6855c491-1b18-4414-9e78-8bc17f0b5b98 which can be used as unique global reference for CryptoShield in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptoshield - webarchive
- https://www.bleepingcomputer.com/news/security/revenge-ransomware-a-cryptomix-variant-being-distributed-by-rig-exploit-kit/ - webarchive
- http://www.broadanalysis.com/2017/03/14/rig-exploit-kit-via-the-eitest-delivers-cryptoshieldrevenge-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryptoShuffler
Internal MISP references
UUID 87048a24-7339-4d4e-a141-661cd32a6f1d which can be used as unique global reference for CryptoShuffler in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cryptowall
CryptoWall is a ransomware, is usually spread by spam and phishing emails, malicious ads, hacked websites, or other malware and uses a Trojan horse to deliver the malicious payload.
Internal MISP references
UUID 1cb63b32-cc65-4cdc-945a-e06a88cdd94b which can be used as unique global reference for Cryptowall in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptowall - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://sites.temple.edu/care/ci-rw-attacks/ - webarchive
- https://ryancor.medium.com/genetic-analysis-of-cryptowall-ransomware-843f86055c7f - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryptoWire
Internal MISP references
UUID bc0c1e48-102c-4e6b-9b86-c442c4798159 which can be used as unique global reference for CryptoWire in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryptoFortress
Internal MISP references
UUID ae4aa1ef-4da0-4952-9583-9d47f84edad9 which can be used as unique global reference for CryptoFortress in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryptoRansomeware
Internal MISP references
UUID 2f65f056-6cba-4a5b-9aaf-daf31eb76fc2 which can be used as unique global reference for CryptoRansomeware in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CryptXXXX
Internal MISP references
UUID fd54ff8b-d34a-4a58-9ee1-2c47f28cb3e8 which can be used as unique global reference for CryptXXXX in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Crytox
Ransomware.
Internal MISP references
UUID c7fb0acb-018b-47eb-8555-5a0291e2505e which can be used as unique global reference for Crytox in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CsExt
Internal MISP references
UUID c6a46f63-3ff1-4952-8350-fad9816b45c9 which can be used as unique global reference for CsExt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
csharp-streamer RAT
Internal MISP references
UUID 54d757df-8da2-4f6e-8789-8790d6a73e46 which can be used as unique global reference for csharp-streamer RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CTB Locker
Internal MISP references
UUID e8e28718-fe55-4d31-8b84-f8ff0acf0614 which can be used as unique global reference for CTB Locker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ctb_locker - webarchive
- https://samvartaka.github.io/malware/2015/11/20/ctb-locker - webarchive
- https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/how-groove-gang-is-shaking-up-the-ransomware-as-a-service-market-to-empower-affiliates/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cuba
Ransomware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cuba.
| Known Synonyms |
|---|
COLDDRAW |
Internal MISP references
UUID 6d9dfc5f-4ebf-404b-ab5e-e6497867fe65 which can be used as unique global reference for Cuba in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cuba - webarchive
- https://unit42.paloaltonetworks.com/cuba-ransomware-tropical-scorpius/ - webarchive
- https://www.mandiant.com/resources/unc2596-cuba-ransomware - webarchive
- https://www.it-connect.fr/le-ransomware-cuba-sen-prend-aux-serveurs-exchange/ - webarchive
- https://blog.group-ib.com/hancitor-cuba-ransomware - webarchive
- https://www.fortinet.com/blog/threat-research/ransomware-roundup-gwisin-kriptor-cuba-and-more - webarchive
- https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/ - webarchive
- https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-threat-report-a-quick-primer-on-cuba-ransomware - webarchive
- https://shared-public-reports.s3-eu-west-1.amazonaws.com/Cuba+Ransomware+Group+-+on+a+roll.pdf - webarchive
- https://www.ic3.gov/Media/News/2021/211203-2.pdf - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://id-ransomware.blogspot.com/2019/12/cuba-ransomware.html - webarchive
- https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-cuba-ransomware/ - webarchive
- https://lab52.io/blog/cuba-ransomware-analysis/ - webarchive
- https://securelist.com/cuba-ransomware/110533/ - webarchive
- https://www.elastic.co/security-labs/cuba-ransomware-malware-analysis - webarchive
- https://www.trendmicro.com/en_us/research/22/f/cuba-ransomware-group-s-new-variant-found-using-optimized-infect.html - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/aa22-335a-stopransomware-cuba-ransomware.pdf - webarchive
- https://www.guidepointsecurity.com/blog/using-hindsight-to-close-a-cuba-cold-case/ - webarchive
- https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf - webarchive
- https://www.quorumcyber.com/threat-actors/scattered-spider-threat-actor-profile/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cuegoe
Internal MISP references
UUID 1dc53eb8-ffae-4823-9c11-3c01514398b9 which can be used as unique global reference for Cuegoe in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cuegoe - webarchive
- http://blog.malwaremustdie.org/2014/08/another-country-sponsored-malware.html - webarchive
- https://www.eff.org/deeplinks/2014/01/vietnamese-malware-gets-personal - webarchive
- https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cueisfry
Internal MISP references
UUID 64d40102-c296-4a85-9b9c-b3afb6d58e09 which can be used as unique global reference for Cueisfry in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cur1Downloader
Potential Lazarus sample.
Internal MISP references
UUID cca4f240-ac69-437e-b02a-5483ebef5087 which can be used as unique global reference for Cur1Downloader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cur1_downloader - webarchive
- https://mp.weixin.qq.com/s/nnLqUBPX8xZ3hCr5u-iSjQ - webarchive
- https://twitter.com/RedDrip7/status/1595365451495706624 - webarchive
- https://blogs.jpcert.or.jp/ja/2023/05/dangerouspassword.html - webarchive
- https://securelist.com/bluenoroff-methods-bypass-motw/108383/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Curator
Profero describes this as a ransomware family using CryptoPP as library to enable file encryption with the Salsa20 algorithm and protecting the encryption keys with RSA2048.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Curator.
| Known Synonyms |
|---|
Ever101 |
SunnyDay |
Internal MISP references
UUID f1d2093b-e008-4591-8a67-5b9c7684b8c6 which can be used as unique global reference for Curator in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.curator - webarchive
- https://www.sentinelone.com/labs/custom-branded-ransomware-the-vice-society-group-and-the-threat-of-outsourced-development/ - webarchive
- https://shared-public-reports.s3.eu-west-1.amazonaws.com/Secrets_behind_the_mysterious_ever101_ransomware.pdf - webarchive
- https://seguranca-informatica.pt/analysis-of-the-sunnyday-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cursed Murderer
Ransomware.
Internal MISP references
UUID 600a73bf-d699-4400-ac35-6aed4ae5e528 which can be used as unique global reference for Cursed Murderer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CustomerLoader
CustomerLoader is a .Net-based loader that drops more than 40 different malware families. It appeared in June 2023 and is being distributed via phishing, YouTube videos and malicious websites.
Internal MISP references
UUID b002e530-38d5-48cf-90a9-5731871fae32 which can be used as unique global reference for CustomerLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.customerloader - webarchive
- https://blog.sekoia.io/customerloader-a-new-malware-distributing-a-wide-variety-of-payloads/#h-c2-servers - webarchive
- https://inside.harfanglab.io/blog/articles/cyber-threat-intelligence/loader-galore-taskloader-at-the-start-of-a-pay-per-install-infection-chain/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cutlet
Internal MISP references
UUID 8945d785-9d43-49ee-b210-4adeb8a24ab9 which can be used as unique global reference for Cutlet in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cutlet - webarchive
- http://www.vkremez.com/2017/12/lets-learn-cutlet-atm-malware-internals.html - webarchive
- https://blog.talosintelligence.com/2019/05/10-years-of-virtual-dynamite.html - webarchive
- https://explore.group-ib.com/htct/hi-tech_crime_2018 - webarchive
- https://www.fintechsecurity.com.hk/slides/01.Dmitry-Annual-Group-IB-report-High-Tech-Crime-Trends.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cutwail
Internal MISP references
UUID 9e8655fc-5bba-4efd-b3c0-db89ee2e0e0b which can be used as unique global reference for Cutwail in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cutwail - webarchive
- https://www.mimecast.com/blog/how-to-slam-a-door-on-the-cutwail-botnet-enforce-dmarc/ - webarchive
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/ - webarchive
- https://www.shadowserver.org/news/has-the-sun-set-on-the-necurs-botnet/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/ - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_5_sajo-takeda-niwa_en.pdf - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://darknetdiaries.com/episode/110/ - webarchive
- https://web.archive.org/web/20160616170611/https://media.blackhat.com/bh-eu-10/presentations/Carrera_Silberman/BlackHat-EU-2010-Carrera-Silberman-State-of-Malware-slides.pdf - webarchive
- https://github.com/pan-unit42/tweets/blob/master/2020-09-07-Dridex-IOCs.txt - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-essex - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://securityintelligence.com/dridex-campaign-propelled-by-cutwail-botnet-and-powershell/ - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-essex - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CyberGate
According to Subex Secure, CyberGate is a Remote Access Trojan (RAT) that allows an attacker to gain unauthorized access to the victim’s system. Attackers can remotely connect to the compromised system from anywhere around the world. The Malware author generally uses this program to steal private information like passwords, files, etc. It might also be used to install malicious software on the compromised systems.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CyberGate.
| Known Synonyms |
|---|
Rebhip |
Internal MISP references
UUID 062d8577-d6e6-4c97-bcac-eb6eb1a50a8d which can be used as unique global reference for CyberGate in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.cybergate - webarchive
- https://blog.reversinglabs.com/blog/rats-in-the-library - webarchive
- https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process - webarchive
- https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process - webarchive
- https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf - webarchive
- https://www.zscaler.com/blogs/security-research/cybergate-rat-and-redline-stealer-delivered-ongoing-autoit-malware-campaigns - webarchive
- https://www.zscaler.com/blogs/security-research/catching-rats-over-custom-protocols - webarchive
- https://sectrio.com/wp-content/uploads/2021/08/cybergate-threat-report.pdf - webarchive
- https://www.subexsecure.com/pdf/malware-reports/2021-05/cybergate-threat-report.pdf - webarchive
- https://citizenlab.ca/2015/12/packrat-report/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CyberSplitter
Internal MISP references
UUID 8bde6075-8c5b-4ff1-be9a-4e2b1d3419aa which can be used as unique global reference for CyberSplitter in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
CycBot
Internal MISP references
UUID dcdd98a7-aad2-4a96-a787-9c4665bbb1b8 which can be used as unique global reference for CycBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Cyrat
According to gdatasoftware, Cyrat ransomware uses Fernet to encrypt files. This is a symmetric encryption method meant for small data files that fit into RAM. While Fernet is not unusual itself, it is not common for ransomware and in this case even problematic.
Internal MISP references
UUID 1995ed0a-81d9-43ca-9b38-6f001af84bbc which can be used as unique global reference for Cyrat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
cysxl
Internal MISP references
UUID 8db13fca-8f75-44dd-b507-e4d3f9c69d78 which can be used as unique global reference for cysxl in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dacls (Windows)
According to PCrisk, Dacls is the name of a remote access Trojan (RAT), a malicious program that allows cyber criminals to control infected computers remotely.
Research shows that this malware is tied to Lazarus Group (a group of cyber criminals) and targets Linux and the Windows Operating System. Typically, cyber criminals use RATs to steal sensitive, confidential information, infect systems with other malware, and so on. In any case, no RAT is harmless and should be uninstalled immediately.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Dacls (Windows).
| Known Synonyms |
|---|
MATA |
Internal MISP references
UUID 7c2b19be-f06b-4b21-b003-144e92d291d1 which can be used as unique global reference for Dacls (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dacls - webarchive
- https://blog.netlab.360.com/dacls-the-dual-platform-rat/ - webarchive
- https://malwareandstuff.com/peb-where-magic-is-stored/ - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/dark-river-you-can-t-see-them-but-they-re-there/ - webarchive
- https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/ - webarchive
- https://www.sygnia.co/mata-framework - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/18092216/Updated-MATA-attacks-Eastern-Europe_full-report_ENG.pdf - webarchive
- https://blogs.vmware.com/security/2022/11/threat-analysis-active-c2-discovery-using-protocol-emulation-part4-dacls-aka-mata.html - webarchive
- https://vblocalhost.com/uploads/VB2021-Park.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DADJOKE
DADJOKE was discovered as being distributed via email, targeting a South-East Asian Ministry of Defense. It is delivered as an embedded EXE file in a Word document using remote templates and a unique macro using multiple GET requests. The payload is deployed using load-order hijacking with a benign Windows Defender executable. Stage 1 has only beacon+download functionality, made to look like a PNG file. Additional analysis by Kaspersky found 8 campaigns over 2019 and no activity prior to January 2019, DADJOKE is attributed with medium confidence to APT40.
Internal MISP references
UUID 3cf1aa5a-c19d-4b50-a604-e445e1e2b4f1 which can be used as unique global reference for DADJOKE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dadjoke - webarchive
- https://wemp.app/posts/80ab2b2d-4e0e-4960-94b7-4d452a06fd38?utm_source=latest-posts - webarchive
- https://prezi.com/view/jGyAzyy5dTOkDrtwsJi5/ - webarchive
- https://www.youtube.com/watch?v=vx9IB88wXSE - webarchive
- https://twitter.com/ClearskySec/status/1110941178231484417 - webarchive
- https://medium.com/@Sebdraven/apt-40-in-malaysia-61ed9c9642e9 - webarchive
- https://twitter.com/a_tweeter_user/status/1154764787823316993 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DADSTACHE
Internal MISP references
UUID cd9aac83-bdd0-4622-ae77-405d5b9c1dc5 which can be used as unique global reference for DADSTACHE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dadstache - webarchive
- https://medium.com/insomniacs/apt40-goes-from-template-injections-to-ole-linkings-for-payload-delivery-99eb43170a97 - webarchive
- https://twitter.com/killamjr/status/1204584085395517440 - webarchive
- https://twitter.com/cyb3rops/status/1199978327697694720 - webarchive
- https://medium.com/insomniacs/dad-theres-a-rat-in-here-e3729b65bf7a - webarchive
- https://www.elastic.co/blog/advanced-techniques-used-in-malaysian-focused-apt-campaign - webarchive
- https://danielplohmann.github.io/blog/2020/07/10/kf-sandbox-necromancy.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dairy
Internal MISP references
UUID 92960f1f-5099-4e38-a177-14a5e3b8d601 which can be used as unique global reference for Dairy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DanaBot
Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social engineering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on “quality over quantity” in email-based threats. DanaBot’s modular nature enables it to download additional components, increasing the flexibility and robust stealing and remote monitoring capabilities of this banker.
Internal MISP references
UUID 4f7decd4-054b-4dd7-89cc-9bdb248f7c8a which can be used as unique global reference for DanaBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot - webarchive
- https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree - webarchive
- https://www.youtube.com/watch?v=04RsqP_P9Ss - webarchive
- https://malverse.it/costruiamo-un-config-extractor-per-danabot-parte-1 - webarchive
- https://www.zscaler.com/blogs/security-research/spike-danabot-malware-activity - webarchive
- https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/ - webarchive
- https://www.lastline.com/labsblog/evolution-of-excel-4-0-macro-weaponization/ - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf - webarchive
- https://asert.arbornetworks.com/danabots-travels-a-global-perspective/ - webarchive
- https://www.zscaler.com/blogs/security-research/danabot-launches-ddos-attack-against-ukrainian-ministry-defense - webarchive
- https://security-soup.net/decoding-a-danabot-downloader/ - webarchive
- https://www.welivesecurity.com/2018/12/06/danabot-evolves-beyond-banking-trojan-new-spam/ - webarchive
- https://assets.virustotal.com/reports/2021trends.pdf - webarchive
- https://securelist.com/financial-cyberthreats-in-2020/101638/ - webarchive
- https://www.fortinet.com/blog/threat-research/breakdown-of-a-targeted-danabot-attack.html - webarchive
- https://www.welivesecurity.com/2018/09/21/danabot-targeting-europe-adds-new-features/ - webarchive
- https://resources.malwarebytes.com/files/2020/05/CTNT_Q1_2020_COVID-Report_Final.pdf - webarchive
- https://malwareandstuff.com/deobfuscating-danabots-api-hashing/ - webarchive
- https://blog.yoroi.company/research/dissecting-the-danabot-paylaod-targeting-italy/ - webarchive
- https://www.bitdefender.com/blog/hotforsecurity/popular-npm-repositories-compromised-in-man-in-the-middle-attack/ - webarchive
- https://www.esentire.com/blog/from-darkgate-to-danabot - webarchive
- https://www.mandiant.com/resources/blog/detecting-disrupting-malvertising-backdoors - webarchive
- https://blogs.blackberry.com/en/2021/11/threat-thursday-danabot-malware-as-a-service - webarchive
- https://www.proofpoint.com/us/threat-insight/post/danabot-gains-popularity-and-targets-us-organizations-large-campaigns - webarchive
- https://www.proofpoint.com/us/threat-insight/post/danabot-new-banking-trojan-surfaces-down-under-0 - webarchive
- https://asec.ahnlab.com/en/30445/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/new-year-new-version-danabot - webarchive
- https://www.mandiant.com/resources/supply-chain-node-js - webarchive
- https://twitter.com/f0wlsec/status/1459892481760411649 - webarchive
- https://www.trustwave.com/Resources/SpiderLabs-Blog/DanaBot-Riding-Fake-MYOB-Invoice-Emails/ - webarchive
- https://research.checkpoint.com/danabot-demands-a-ransom-payment/ - webarchive
- https://blog.lexfo.fr/danabot-malware.html - webarchive
- https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ - webarchive
- https://www.esentire.com/blog/danabots-latest-move-deploying-icedid - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://flashpoint.io/blog/danabot-version-3-what-you-need-to-know/ - webarchive
- https://www.welivesecurity.com/2019/02/07/danabot-updated-new-cc-communication/ - webarchive
- https://www.gdatasoftware.com/blog/2019/05/31695-strange-bits-smuggling-malware-github - webarchive
- https://enterprise.verizon.com/resources/reports/2019-data-breach-investigations-report.pdf - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-110a - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://news.sophos.com/en-us/2021/10/24/node-poisoning-hijacked-package-delivers-coin-miner-and-credential-stealing-backdoor - webarchive
- https://www.proofpoint.com/us/threat-insight/post/danabot-control-panel-revealed - webarchive
- https://www.zscaler.com/blogs/security-research/technical-analysis-danabot-obfuscation-techniques - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
danbot
Danbot is a backdoor malware that is originally written in C#. Recent versions of Danbot are written in C++. Danbot is capable of giving a remote attacker remote access features such as running a cmd command, upload and download files, move and copy files. The backdoor commands are transmitted by either using HTTP or DNS protocols. The commands are encapsulated in an XML file that gets stored in disk. Danbot's backdoor component picks up the XML file where it decodes and decrypts the commands.
Internal MISP references
UUID 98d3c6b3-c29f-46ba-b24d-88b135cd3183 which can be used as unique global reference for danbot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.danbot - webarchive
- https://dragos.com/wp-content/uploads/Dragos-Oil-and-Gas-Threat-Perspective-2019.pdf - webarchive
- https://www.clearskysec.com/wp-content/uploads/2021/08/Siamesekitten.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-lyceum - webarchive
- https://www.youtube.com/watch?v=FttiysUZmDw - webarchive
- https://cyberx-labs.com/blog/deep-dive-into-the-lyceum-danbot-malware/ - webarchive
- https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf - webarchive
- https://otx.alienvault.com/pulse/5d4301edb3f3406ac01acc0f - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkBit
Internal MISP references
UUID abf5436b-23e4-4dec-8c98-0e95a499be78 which can be used as unique global reference for DarkBit in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkbit - webarchive
- https://github.com/albertzsigovits/malware-notes/blob/master/Ransomware-Windows-DarkBit/README.md - webarchive
- https://blogs.blackberry.com/en/2023/02/darkbit-ransomware-targets-israel - webarchive
- https://www.microsoft.com/en-us/security/blog/2023/04/07/mercury-and-dev-1084-destructive-attack-on-hybrid-environment/ - webarchive
- https://labs.k7computing.com/index.php/muddywater-back-with-darkbit/ - webarchive
- https://twitter.com/luc4m/status/1626535098039271425 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkCloud Stealer
Stealer is written in Visual Basic.
Internal MISP references
UUID 43601d72-1df5-4d95-8cdc-ad9754aa5d72 which can be used as unique global reference for DarkCloud Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkComet
DarkComet is one of the most famous RATs, developed by Jean-Pierre Lesueur in 2008. After being used in the Syrian civil war in 2011, Lesuer decided to stop developing the trojan. Indeed, DarkComet is able to enable control over a compromised system through use of a simple graphic user interface. Experts think that this user friendliness is the key of its mass success.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DarkComet.
| Known Synonyms |
|---|
Breut |
Fynloski |
klovbot |
Internal MISP references
UUID 5086a6e0-53b2-4d96-9eb3-a0237da2e591 which can be used as unique global reference for DarkComet in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkcomet - webarchive
- https://www.sentinelone.com/labs/modifiedelephant-apt-and-a-decade-of-fabricating-evidence/ - webarchive
- https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf - webarchive
- https://blog.talosintelligence.com/2022/06/avoslocker-new-arsenal.html - webarchive
- https://businessinsights.bitdefender.com/tech-advisory-manageengine-cve-2022-47966 - webarchive
- https://www.sentinelone.com/wp-content/uploads/2022/02/Modified-Elephant-APT-and-a-Decade-of-Fabricating-Evidence-SentinelLabs.pdf - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/how-cybercriminals-abuse-cloud-tunneling-services - webarchive
- https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/ - webarchive
- https://www.secureworks.com/research/threat-profiles/aluminum-saratoga - webarchive
- https://asec.ahnlab.com/wp-content/uploads/2021/11/Lazarus-%EA%B7%B8%EB%A3%B9%EC%9D%98-NukeSped-%EC%95%85%EC%84%B1%EC%BD%94%EB%93%9C-%EB%B6%84%EC%84%9D-%EB%B3%B4%EA%B3%A0%EC%84%9C.pdf - webarchive
- https://github.com/threatland/TL-TROJAN/tree/master/TL.RAT/RAT.Win.DarkComet - webarchive
- https://www.tgsoft.it/files/report/download.asp?id=7481257469 - webarchive
- https://www.secureworks.com/research/threat-profiles/copper-fieldstone - webarchive
- http://contagiodump.blogspot.com/2012/06/rat-samples-from-syrian-targeted.html - webarchive
- https://content.fireeye.com/apt/rpt-apt38 - webarchive
- https://www.sysnet.ucsd.edu/sysnet/miscpapers/darkmatter-www20.pdf - webarchive
- https://blog.malwarebytes.com/threat-analysis/2012/10/dark-comet-2-electric-boogaloo/ - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/elfin-apt33-espionage - webarchive
- https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html - webarchive
- https://www.fireeye.com/blog/threat-research/2016/06/apt_group_sends_spea.html - webarchive
- https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DARKDEW
Mandiant associates this with UNC4191, this malware spreads to removable drives.
Internal MISP references
UUID 16d9f98d-4da6-419d-89f7-8c30418255ae which can be used as unique global reference for DARKDEW in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkEye
Internal MISP references
UUID ccbc93b4-fd7a-4926-88f3-bcf5a1c530a5 which can be used as unique global reference for DarkEye in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkGate
First documented in 2018, DarkGate is a commodity loader with features that include the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation. DarkGate makes use of legitimate AutoIt files and typically runs multiple AutoIt scripts. New versions of DarkGate have been advertised on a Russian language eCrime forum since May 2023.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DarkGate.
| Known Synonyms |
|---|
Meh |
MehCrypter |
Internal MISP references
UUID 977ef666-33b7-41d4-9d98-15ab0d16bede which can be used as unique global reference for DarkGate in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate - webarchive
- https://decoded.avast.io/janrubin/meh-2-2/ - webarchive
- https://decoded.avast.io/janrubin/complex-obfuscation-meh/ - webarchive
- https://www.zerofox.com/blog/the-underground-economist-volume-3-issue-12/ - webarchive
- https://embee-research.ghost.io/practical-signatures-for-identifying-malware-with-yara/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/battleroyal-darkgate-cluster-spreads-email-and-fake-browser-updates - webarchive
- https://blog.sekoia.io/darkgate-internals/ - webarchive
- https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign - webarchive
- https://embee-research.ghost.io/decoding-a-simple-visual-basic-vbs-script-darkgate-loader/ - webarchive
- https://www.truesec.com/hub/blog/darkgate-loader-delivered-via-teams - webarchive
- https://www.mandiant.com/resources/blog/detecting-disrupting-malvertising-backdoors - webarchive
- https://www.esentire.com/blog/from-darkgate-to-danabot - webarchive
- https://github.security.telekom.com/2023/08/darkgate-loader.html - webarchive
- https://www.netskope.com/jp/blog/new-darkgate-variant-uses-a-new-loading-approach - webarchive
- https://0xtoxin.github.io/threat%20breakdown/DarkGate-Camapign-Analysis/ - webarchive
- https://securelist.com/emotet-darkgate-lokibot-crimeware-report/110286/ - webarchive
- https://www.trellix.com/about/newsroom/stories/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/ - webarchive
- https://github.com/prodaft/malware-ioc/blob/master/PTI-66/DarkGate.md - webarchive
- https://x.com/embee_research/status/1736758775326146778 - webarchive
- https://medium.com/@DCSO_CyTec/shortandmalicious-darkgate-d9102a457232 - webarchive
- https://www.aon.com/cyber-solutions/aon_cyber_labs/darkgate-keylogger-analysis-masterofnone/ - webarchive
- https://www.trendmicro.com/en_us/research/23/j/darkgate-opens-organizations-for-attack-via-skype-teams.html - webarchive
- https://github.com/telekom-security/malware_analysis/blob/main/darkgate/extractor.py - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkIRC
Internal MISP references
UUID 8258311c-0d64-4c6b-ab94-915e2cc267f0 which can be used as unique global reference for DarkIRC in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkLoader
Internal MISP references
UUID 269be5a3-471c-4a4b-a5d7-97ce75579213 which can be used as unique global reference for DarkLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkMe
Internal MISP references
UUID 1dda5df9-5c92-44a4-b1c7-a09b71bc1553 which can be used as unique global reference for DarkMe in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkMegi
Internal MISP references
UUID 3521faaa-1136-4e50-9fe2-3f33359e8b1d which can be used as unique global reference for DarkMegi in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Darkmoon
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Darkmoon.
| Known Synonyms |
|---|
Chymine |
Internal MISP references
UUID 81ca4876-b4a4-43e9-b8a9-8a88709dd3d2 which can be used as unique global reference for Darkmoon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkmoon - webarchive
- http://contagiodump.blogspot.com/2010/01/jan-17-trojan-darkmoonb-exe-haiti.html - webarchive
- http://contagiodump.blogspot.com/2010/07/cve-2010-2568-keylogger-win32chyminea.html - webarchive
- https://www.f-secure.com/v-descs/trojan-downloader_w32_chymine_a.shtml - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkPink
Internal MISP references
UUID f3522624-a704-4d74-8c21-1c863ab6d5eb which can be used as unique global reference for DarkPink in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkPulsar
Internal MISP references
UUID 1aecd6eb-80e2-4598-8504-d93f69c7a8f0 which can be used as unique global reference for DarkPulsar in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkRat
Internal MISP references
UUID bcff979f-2b4b-41cc-86c9-fe1ea3adce6e which can be used as unique global reference for DarkRat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkShell
DarkShell is a DDoS bot seemingly of Chinese origin, discovered in 2011. During 2011, DarkShell was reported to target the industrial food processing industry.
Internal MISP references
UUID 7fcb9d77-a685-4705-86f0-e62a7302e836 which can be used as unique global reference for DarkShell in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkshell - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/darkshell-ddos-botnet-evolves-with-variants/ - webarchive
- https://www.botconf.eu/wp-content/uploads/2015/12/OK-P13-Liu-Ya-Automatically-Classify-Unknown-Bots-by-The-Register-Messages.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkSide (Windows)
FireEye describes DARKSIDE as a ransomware written in C and configurable to target files whether on fixed, removable disks, or network shares. The malware can be customized by the affiliates to create a build for specific victims.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DarkSide (Windows).
| Known Synonyms |
|---|
BlackMatter |
Internal MISP references
UUID 625bcba0-faab-468e-b5ab-61116cb1b5cf which can be used as unique global reference for DarkSide (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darkside - webarchive
- https://www.maltego.com/blog/chasing-darkside-affiliates-identifying-threat-actors-connected-to-darkside-ransomware-using-maltego-intel-471-1/ - webarchive
- https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/ - webarchive
- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html - webarchive
- https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.html - webarchive
- https://www.bleepingcomputer.com/news/security/darkside-ransomware-rushes-to-cash-out-7-million-in-bitcoin/ - webarchive
- https://blog.group-ib.com/blackmatter# - webarchive
- https://medium.com/s2wlab/w1-jun-en-story-of-the-week-ransomware-on-the-darkweb-af491d33868b - webarchive
- https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/ - webarchive
- https://chuongdong.com/reverse%20engineering/2021/05/06/DarksideRansomware/ - webarchive
- https://blueteamblog.com/darkside-ransomware-operations-preventions-and-detections - webarchive
- https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html - webarchive
- https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/ - webarchive
- https://labs.bitdefender.com/2021/01/darkside-ransomware-decryption-tool/ - webarchive
- https://news.sophos.com/en-us/2021/05/11/a-defenders-view-inside-a-darkside-ransomware-attack/ - webarchive
- https://therecord.media/popular-hacking-forum-bans-ransomware-ads/ - webarchive
- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/ - webarchive
- https://therecord.media/ransomware-gang-wants-to-short-the-stock-price-of-their-victims/ - webarchive
- https://twitter.com/sysopfb/status/1422280887274639375 - webarchive
- https://www.elliptic.co/blog/darkside-ransomware-has-netted-over-90-million-in-bitcoin - webarchive
- https://therecord.media/darkside-ransomware-gang-moves-some-of-its-bitcoin-after-revil-got-hit-by-law-enforcement/ - webarchive
- https://www.mandiant.com/resources/burrowing-your-way-into-vpns - webarchive
- https://github.com/sisoma2/malware_analysis/tree/master/blackmatter - webarchive
- https://www.acronis.com/en-us/articles/darkside-ransomware/ - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://asec.ahnlab.com/en/34549/ - webarchive
- https://www.secjuice.com/blue-team-detection-darkside-ransomware/ - webarchive
- https://www.bloomberg.com/news/articles/2021-05-13/colonial-pipeline-paid-hackers-nearly-5-million-in-ransom - webarchive
- https://www.advanced-intel.com/post/from-dawn-to-silent-night-darkside-ransomware-initial-attack-vector-evolution - webarchive
- https://www.youtube.com/watch?v=qxPXxWMI2i4 - webarchive
- https://www.bleepingcomputer.com/news/security/darkside-ransomware-made-90-million-in-just-nine-months/ - webarchive
- https://www.glimps.fr/lockbit3-0/ - webarchive
- https://ghoulsec.medium.com/mal-series-13-darkside-ransomware-c13d893c36a6 - webarchive
- https://brandefense.io/darkside-ransomware-analysis-report/ - webarchive
- https://symantec.broadcom.com/hubfs/Attacks-Against-Critical_Infrastructrure.pdf - webarchive
- https://www.intel471.com/blog/darkside-ransomware-shut-down-revil-avaddon-cybercrime - webarchive
- https://www.hhs.gov/sites/default/files/demystifying-blackmatter.pdf - webarchive
- https://www.microsoft.com/security/blog/2022/04/13/dismantling-zloader-how-malicious-ads-led-to-disabled-security-tools-and-ransomware/ - webarchive
- https://blog.360totalsecurity.com/en/darksides-targeted-ransomware-analysis-report-for-critical-u-s-infrastructure-2/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-as-a-service-enabler-of-widespread-attacks - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa21-131a - webarchive
- https://www.elliptic.co/blog/elliptic-follows-bitcoin-ransoms-paid-by-darkside-ransomware-victims - webarchive
- https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-gang-rises-from-the-ashes-of-darkside-revil/ - webarchive
- https://www.repubblica.it/economia/finanza/2021/04/28/news/un_sospetto_attacco_telematico_blocca_le_filiali_della_bcc_di_roma-298485827/ - webarchive
- https://blog.cyble.com/2021/08/05/blackmatter-under-the-lens-an-emerging-ransomware-group-looking-for-affiliates/ - webarchive
- https://www.trendmicro.com/en_us/research/21/e/what-we-know-about-darkside-ransomware-and-the-us-pipeline-attac.html - webarchive
- https://www.databreaches.net/a-chat-with-darkside/ - webarchive
- https://www.flashpoint-intel.com/blog/darkside-ransomware-links-to-revil-difficult-to-dismiss/ - webarchive
- https://www.technologyreview.com/2021/05/24/1025195/colonial-pipeline-ransomware-bitdefender/ - webarchive
- https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf - webarchive
- https://community.riskiq.com/article/fdf74f23 - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/noberus-blackcat-ransomware-ttps - webarchive
- https://www.metabaseq.com/recursos/inside-darkside-the-ransomware-that-attacked-colonial-pipeline# - webarchive
- https://github.com/Haxrein/Malware-Analysis-Reports/blob/main/darkside_ransomware_technical_analysis_report.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://zawadidone.nl/darkside-ransomware-analysis/ - webarchive
- https://www.reuters.com/technology/colonial-pipeline-halts-all-pipeline-operations-after-cybersecurity-attack-2021-05-08/ - webarchive
- https://therecord.media/an-interview-with-blackmatter-a-new-ransomware-group-thats-learning-from-the-mistakes-of-darkside-and-revil/ - webarchive
- https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions - webarchive
- http://chuongdong.com/reverse%20engineering/2021/05/06/DarksideRansomware/ - webarchive
- https://socprime.com/blog/affiliates-vs-hunters-fighting-the-darkside/ - webarchive
- https://www.nozominetworks.com/blog/colonial-pipeline-ransomware-attack-revealing-how-darkside-works/ - webarchive
- https://www.deepinstinct.com/2021/06/04/the-ransomware-conundrum-a-look-into-darkside/ - webarchive
- https://www.crowdstrike.com/blog/falcon-protects-from-darkside-ransomware/ - webarchive
- https://unit42.paloaltonetworks.com/darkside-ransomware/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/are-virtual-machines-the-new-gold-for-cyber-criminals/ - webarchive
- https://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/ - webarchive
- https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html - webarchive
- https://www.bleepingcomputer.com/news/security/darkside-ransomware-gang-returns-as-new-blackmatter-operation/ - webarchive
- https://www.recordedfuture.com/blackmatter-ransomware-successor-darkside-revil/ - webarchive
- https://www.bleepingcomputer.com/news/security/darkside-ransomware-servers-reportedly-seized-revil-restricts-targets/ - webarchive
- https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/ - webarchive
- https://twitter.com/embee_research/status/1678631524374020098?s=46 - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/ - webarchive
- https://www.elliptic.co/blog/darkside-bitcoins-on-the-move-following-government-cyberattack-against-revil-ransomware-group - webarchive
- https://www.databreachtoday.com/blogs/darkside-ransomware-gang-launches-affiliate-program-p-2968 - webarchive
- https://securityintelligence.com/posts/darkside-oil-pipeline-ransomware-attack/ - webarchive
- https://www.wsj.com/articles/colonial-pipeline-ceo-tells-why-he-paid-hackers-a-4-4-million-ransom-11621435636 - webarchive
- https://www.cybereason.com/blog/cybereason-vs-darkside-ransomware - webarchive
- https://www.varonis.com/blog/darkside-ransomware/ - webarchive
- https://zetter.substack.com/p/anatomy-of-one-of-the-first-darkside - webarchive
- https://www.bleepingcomputer.com/news/security/darkside-ransomware-is-creating-a-secure-data-leak-service-in-iran/ - webarchive
- https://www.crowdstrike.com/blog/how-to-defend-against-conti-darkside-revil-and-other-ransomware/ - webarchive
- https://www.dragos.com/blog/industry-news/recommendations-following-the-colonial-pipeline-cyber-attack/ - webarchive
- https://threatpost.com/guess-fashion-data-loss-ransomware/167754/ - webarchive
- https://www.ic3.gov/Media/News/2021/211101.pdf - webarchive
- https://www.nozominetworks.com/blog/how-to-analyze-malware-for-technical-writing/ - webarchive
- https://blog.gigamon.com/2021/05/17/tracking-darkside-and-ransomware-the-network-view/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/MTP-2021-0804.pdf - webarchive
- https://blog.group-ib.com/blackmatter2 - webarchive
- https://www.bleepingcomputer.com/news/security/darkside-affiliates-claim-gangs-bitcoins-in-deposit-on-hacker-forum/ - webarchive
- https://www.bleepingcomputer.com/news/security/popular-russian-hacking-forum-xss-bans-all-ransomware-topics/ - webarchive
- https://blogs.keysight.com/blogs/tech/nwvs.entry.html/2021/05/18/darkside_ransomware-QfsV.html - webarchive
- https://twitter.com/ValthekOn/status/1422385890467491841?s=20 - webarchive
- https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout - webarchive
- https://www.youtube.com/watch?v=NIiEcOryLpI - webarchive
- https://twitter.com/GelosSnake/status/1451465959894667275 - webarchive
- https://www.digitalshadows.com/blog-and-research/ransomware-as-a-service-rogue-affiliates-and-whats-next/ - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/evolving-danger-ransomware-extortion - webarchive
- https://www.bleepingcomputer.com/news/security/us-chemical-distributor-shares-info-on-darkside-ransomware-data-theft/ - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-2/ - webarchive
- https://id-ransomware.blogspot.com/2020/08/darkside-ransomware.html - webarchive
- https://www.digitalshadows.com/blog-and-research/darkside-the-new-ransomware-group-behind-highly-targeted-attacks/ - webarchive
- https://www.intel471.com/blog/darkside-ransomware-colonial-pipeline-attack - webarchive
- https://www.crowdstrike.com/blog/how-ransomware-adversaries-reacted-to-the-darkside-pipeline-attack/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-waterfall - webarchive
- https://twitter.com/JAMESWT_MHT/status/1388301138437578757 - webarchive
- https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/ - webarchive
- https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/ - webarchive
- https://blogs.blackberry.com/en/2021/09/threat-thursday-blackmatter-ransomware-as-a-service - webarchive
- https://www.sentinelone.com/blog/meet-darkside-and-their-ransomware-sentinelone-customers-protected/ - webarchive
- https://id-ransomware.blogspot.com/2021/07/blackmatter-ransomware.html - webarchive
- http://ti.dbappsecurity.com.cn/blog/index.php/2021/05/10/darkside/ - webarchive
- https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox - webarchive
- https://zawadidone.nl/2020/10/05/darkside-ransomware-analysis.html - webarchive
- https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-189a - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/ - webarchive
- https://securityscorecard.com/blog/new-evidence-supports-assessment-that-darkside-likely-responsible-for-colonial-pipeline-ransomware-attack-others-targeted - webarchive
- https://www.bleepingcomputer.com/news/security/chemical-distributor-pays-44-million-to-darkside-ransomware/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://cybergeeks.tech/a-step-by-step-analysis-of-a-new-version-of-darkside-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Darksky
DarkSky is a botnet that is capable of downloading malware, conducting a number of network and application-layer distributed denial-of-service (DDoS) attacks, and detecting and evading security controls, such as sandboxes and virtual machines. It is advertised for sale on the dark web for $20. Much of the malware that DarkSky has available to download onto targeted systems is associated with cryptocurrency-mining activity. The DDoS attacks that DarkSky can perform include DNS amplification attacks, TCP (SYN) flood, UDP flood, and HTTP flood. The botnet can also perform a check to determine whether or not the DDoS attack succeeded and turn infected systems into a SOCKS/HTTP proxy to route traffic to a remote server.
Internal MISP references
UUID d5f2e3c4-adf4-4156-98b1-b207f70522bb which can be used as unique global reference for Darksky in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkStRat
Internal MISP references
UUID b9692126-e6e9-4ab3-8494-959fd1269ff4 which can be used as unique global reference for DarkStRat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkTequila
Dark Tequila is a complex malicious campaign targeting Mexican users, with the primary purpose of stealing financial information, as well as login credentials to popular websites that range from code versioning repositories to public file storage accounts and domain registrars.
Internal MISP references
UUID 374080b4-5e6c-4992-a7f5-def1f2975494 which can be used as unique global reference for DarkTequila in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkTortilla
DarkTortilla is a complex and highly configurable .NET-based crypter that has possibly been active since at least August 2015. It typically delivers popular information stealers and remote access trojans (RATs) such as AgentTesla, AsyncRat, NanoCore, and RedLine. While it appears to primarily deliver commodity malware, Secureworks® Counter Threat Unit™ (CTU) researchers identified DarkTortilla samples delivering targeted payloads such as Cobalt Strike and Metasploit. It can also deliver "addon packages" such as additional malicious payloads, benign decoy documents, and executables. It features robust anti-analysis and anti-tamper controls that can make detection, analysis, and eradication challenging.
From January 2021 through May 2022, an average of 93 unique DarkTortilla samples per week were uploaded to the VirusTotal analysis service. Code similarities suggest possible links between DarkTortilla and other malware: a crypter operated by the RATs Crew threat group, which was active between 2008 and 2012, and the Gameloader malware that emerged in 2021.
Internal MISP references
UUID fa08ee9c-d0e8-4c49-8a4d-af8e36206219 which can be used as unique global reference for DarkTortilla in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Darktrack RAT
According to PCrisk, DarkTrack is a malicious program classified as a Remote Access Trojan (RAT). This type of malware enables remote access and control over an infected device. The level of control these programs have varies, however, some can allow user-level manipulation of the affected machine.
The functionalities of RATs likewise varies and so does the scope of potential misuse. DarkTrack has a broad range of functions/capabilities, which make this Trojan a highly-dangerous piece of software.
Internal MISP references
UUID fc91803f-610c-4ad5-ba0c-b78d65abc6db which can be used as unique global reference for Darktrack RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.darktrack_rat - webarchive
- https://ti.qianxin.com/uploads/2020/09/17/69da886eecc7087e9dac2d3ea4c66ba8.pdf - webarchive
- https://www.tgsoft.it/files/report/download.asp?id=7481257469 - webarchive
- https://nioguard.blogspot.de/2017/05/targeted-attack-against-ukrainian.html - webarchive
- https://cracked.to/Thread-Release-RAT-Dark-track-alien-4-1 - webarchive
- http://news.softpedia.com/news/free-darktrack-rat-has-the-potential-of-being-the-best-rat-on-the-market-508179.shtml - webarchive
- https://www.facebook.com/darktrackrat/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkVNC
According to Enigmasoft, DarkVNC malware is a hacking tool that is available for purchase online. it is can be used as a Virtual Network Computing service, which means that the attackers can get full access to the targeted system via this malware. However, unlike a genuine Virtual Network Computing utility, the DarkVNC threat operates in the background silently. Therefore, it is highly likely that the victims may not notice that their systems have been compromised.
Internal MISP references
UUID 302b2b26-9833-4da7-94f5-a7bd152ad40c which can be used as unique global reference for DarkVNC in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Daserf
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Daserf.
| Known Synonyms |
|---|
Muirim |
Nioupale |
Internal MISP references
UUID 70f6c71f-bc0c-4889-86e3-ef04e5b8415b which can be used as unique global reference for Daserf in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.daserf - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography/ - webarchive
- https://researchcenter.paloaltonetworks.com/2017/07/unit42-tick-group-continues-attacks/ - webarchive
- https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-butler - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DataExfiltrator
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DataExfiltrator.
| Known Synonyms |
|---|
FileSender |
Internal MISP references
UUID 96d727c3-bac6-4c7e-8868-b7237df55ecd which can be used as unique global reference for DataExfiltrator in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Datper
Internal MISP references
UUID 827490bf-19b8-4d14-83b3-7da67fbe436c which can be used as unique global reference for Datper in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.datper - webarchive
- http://blog.jpcert.or.jp/2017/08/detecting-datper-malware-from-proxy-logs.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/operation-endtrade-finding-multi-stage-backdoors-that-tick/ - webarchive
- https://www.macnica.net/file/mpressioncss_ta_report_2019.pdf - webarchive
- https://www.macnica.net/file/mpressioncss_2018-1h-report_mnc_rev3_nopw.pdf - webarchive
- https://www.macnica.net/file/mpressioncss_ta_report_2019_2_nopw.pdf - webarchive
- https://www.macnica.net/mpressioncss/feature_05.html/ - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography/ - webarchive
- https://nao-sec.org/2020/01/an-overhead-view-of-the-royal-road.html - webarchive
- https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Daxin
Symantec describes this as a malware written as Windows kernel driver, used by China-linked threat actors. The malware has a custom TCP/IP stack and is capable of hijacking connections.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Daxin.
| Known Synonyms |
|---|
DELIMEAT |
Internal MISP references
UUID 63bf3200-5e7b-4e29-ba1c-6bf834c15459 which can be used as unique global reference for Daxin in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.daxin - webarchive
- https://www.reuters.com/technology/new-chinese-hacking-tool-found-spurring-us-warning-allies-2022-02-28/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-malware-espionage-analysis - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage - webarchive
- https://www.mandiant.com/resources/blog/chinese-espionage-tactics - webarchive
- https://gist.github.com/usualsuspect/839fbc54e0d76bb2626329cd94274cd6 - webarchive
- https://www.nzz.ch/technologie/china-soll-mit-praezedenzloser-malware-regierungen-ausspioniert-haben-ld.1672292 - webarchive
- https://twitter.com/M_haggis/status/1498399791276912640 - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage-analysis - webarchive
- https://www.bleepingcomputer.com/news/security/chinese-cyberspies-target-govts-with-their-most-advanced-backdoor/ - webarchive
- https://teamt5.org/tw/posts/backdoor-of-driver-analysis-Daxin/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DBatLoader
This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DBatLoader.
| Known Synonyms |
|---|
ModiLoader |
NatsoLoader |
Internal MISP references
UUID 17e0756b-6cc6-4c25-825c-5fd85c236218 which can be used as unique global reference for DBatLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader - webarchive
- https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html - webarchive
- https://malcat.fr/blog/exploit-steganography-and-delphi-unpacking-dbatloader/ - webarchive
- https://www.netskope.com/blog/dbatloader-abusing-discord-to-deliver-warzone-rat - webarchive
- https://zero2auto.com/2020/08/20/dbatloader-modiloader-first-stage/ - webarchive
- https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 - webarchive
- https://securityintelligence.com/posts/email-campaigns-leverage-updated-dbatloader-deliver-rats-stealers/ - webarchive
- https://news.sophos.com/en-us/2020/09/24/email-delivered-modi-rat-attack-pastes-powershell-commands - webarchive
- https://www.zscaler.com/blogs/security-research/dbatloader-actively-distributing-malwares-targeting-european-businesses - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DBoxAgent
This malware uses DropBox as C&C channel.
Internal MISP references
UUID 407002c1-1781-4d1c-90bb-3d859f5c2943 which can be used as unique global reference for DBoxAgent in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DcDcrypt
Ransomware written in .NET.
Internal MISP references
UUID 6192f006-e1ba-47cb-b388-af82e4435a51 which can be used as unique global reference for DcDcrypt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DCRat
DCRat is a typical RAT that has been around since at least June 2019.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DCRat.
| Known Synonyms |
|---|
DarkCrystal RAT |
Internal MISP references
UUID b32ffb50-8ef1-4c78-a71a-bb23089b4de6 which can be used as unique global reference for DCRat in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat - webarchive
- https://www.zscaler.com/blogs/security-research/freecryptoscam-new-cryptocurrency-scam-leads-installation-backdoors-and - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-40-LunghiHorejsi.pdf - webarchive
- https://community.riskiq.com/article/50c77491 - webarchive
- https://www.youtube.com/watch?v=ElqmQDySy48 - webarchive
- https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://muha2xmad.github.io/malware-analysis/dcrat/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0919.pdf - webarchive
- https://www.fireeye.com/blog/threat-research/2020/05/analyzing-dark-crystal-rat-backdoor.html - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus - webarchive
- https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html - webarchive
- https://blogs.infoblox.com/cyber-threat-intelligence/cyber-campaign-briefs/malspam-campaign-delivers-dark-crystal-rat-dcrat/ - webarchive
- https://tccontre.blogspot.com/2019/10/dcrat-malware-evades-sandbox-that-use.html - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://embee-research.ghost.io/dcrat-manual-de-obfuscation/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war - webarchive
- https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ - webarchive
- https://kienmanowar.wordpress.com/2023/04/08/quicknote-uncovering-suspected-malware-distributed-by-individuals-from-vietnam/ - webarchive
- https://cert.gov.ua/article/405538 - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
- https://www.zscaler.com/blogs/security-research/snip3-crypter-reveals-new-ttps-over-time - webarchive
- https://cert.gov.ua/article/160530 - webarchive
- https://forensicitguy.github.io/snip3-crypter-dcrat-vbs/ - webarchive
- https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DCSrv
A ransomware as used by MosesStaff, built around the DiskCryptor tool.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DCSrv.
| Known Synonyms |
|---|
DCrSrv |
Internal MISP references
UUID 7b2609aa-fc3f-4693-a3f1-da4cac77490c which can be used as unique global reference for DCSrv in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DDKeylogger
Internal MISP references
UUID 78796a09-cac4-47fc-9e31-9f2ff5b8e377 which can be used as unique global reference for DDKeylogger in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DDKONG
Internal MISP references
UUID cae8384d-b01b-4f9c-a31b-f693e12ea6b2 which can be used as unique global reference for DDKONG in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ddkong - webarchive
- https://unit42.paloaltonetworks.com/atoms/rancortaurus/ - webarchive
- https://nao-sec.org/2020/01/an-overhead-view-of-the-royal-road.html - webarchive
- https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/ - webarchive
- https://unit42.paloaltonetworks.com/rancor-cyber-espionage-group-uses-new-custom-malware-to-attack-southeast-asia/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-overbrook - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DEADWOOD
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DEADWOOD.
| Known Synonyms |
|---|
Agrius |
DETBOSIT |
SQLShred |
Internal MISP references
UUID b3ce3d4d-f115-4bd0-8d30-2b63e060b286 which can be used as unique global reference for DEADWOOD in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.deadwood - webarchive
- https://www.sentinelone.com/wp-content/uploads/2021/05/SentinelLabs_From-Wiper-to-Ransomware-The-Evolution-of-Agrius.pdf - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/ - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/ - webarchive
- https://www.welivesecurity.com/2022/12/07/fantasy-new-agrius-wiper-supply-chain-attack/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DealPly
Internal MISP references
UUID 4f32b912-59a9-4dae-9118-28d78e01fbfc which can be used as unique global reference for DealPly in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dealply - webarchive
- https://kienmanowar.wordpress.com/2021/05/11/quick-analysis-note-about-dealply-adware/ - webarchive
- https://www.catonetworks.com/blog/the-dga-algorithm-used-by-dealply-and-bujo/ - webarchive
- https://securelist.com/threat-in-your-browser-extensions/107181 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
dearcry
According to PCrisk, DearCry ransomware has been observed infecting systems via ProxyLogon vulnerabilities of Microsoft Exchange servers - mail and calendaring servers developed by Microsoft. While a patch has been released addressing these vulnerabilities, thousands of Microsoft Exchange servers remained unpatched at the time of research.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular dearcry.
| Known Synonyms |
|---|
DoejoCrypt |
Internal MISP references
UUID 793f0f9d-fc1c-43e1-9010-2052a1cf696d which can be used as unique global reference for dearcry in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dearcry - webarchive
- https://www.youtube.com/watch?v=Hhx9Q2i7zGo - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-102b - webarchive
- https://www.youtube.com/watch?v=MRTdGUy1lfw - webarchive
- https://www.advanced-intel.com/post/adversarial-perspective-advintel-breach-avoidance-through-monitoring-initial-vulnerabilities - webarchive
- https://lifars.com/wp-content/uploads/2021/04/DearCry_Ransomware.pdf - webarchive
- https://www.youtube.com/watch?v=qmCjtigVVR0 - webarchive
- https://news.sophos.com/en-us/2021/03/15/dearcry-ransomware-attacks-exploit-exchange-server-vulnerabilities/ - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://www.youtube.com/watch?v=6lSfxsrs61s&t=5s - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DeathRansom
Also known as Wacatac ransomware due to its .wctc extension.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DeathRansom.
| Known Synonyms |
|---|
deathransom |
wacatac |
Internal MISP references
UUID 2bc6623a-d7d6-48fc-af79-647648f455aa which can be used as unique global reference for DeathRansom in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.deathransom - webarchive
- https://id-ransomware.blogspot.com/2019/11/wacatac-ransomware.html - webarchive
- https://dissectingmalwa.re/quick-and-painless-reversing-deathransom-wacatac.html - webarchive
- https://github.com/albertzsigovits/malware-notes/blob/master/DeathRansom.md - webarchive
- https://www.fortinet.com/blog/threat-research/death-ransom-new-strain-ransomware.html - webarchive
- https://asec.ahnlab.com/1269 - webarchive
- https://www.fortinet.com/blog/threat-research/death-ransom-attribution.html - webarchive
- https://twitter.com/Amigo_A_/status/1196898012645220354 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DECAF
Ransomware written in Go.
Internal MISP references
UUID c70e97ea-73bb-4342-a8cd-6cbe0e589bec which can be used as unique global reference for DECAF in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Decebal
Internal MISP references
UUID fba088fb-2659-48c3-921b-12c6791e6d58 which can be used as unique global reference for Decebal in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DeepCreep
Internal MISP references
UUID a29e21f9-b193-4369-8351-95860d56de03 which can be used as unique global reference for DeepCreep in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DeepRAT
Internal MISP references
UUID 355ace5a-ae57-45b8-b49d-e3286c4c18cc which can be used as unique global reference for DeepRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Defray
Defray is ransomware that appeared in 2017, and is targeted ransomware, mainly on the healthcare vertical.
The distribution of Defray has several notable characteristics: According to Proofpoint: " Defray is currently being spread via Microsoft Word document attachments in email The campaigns are as small as several messages each The lures are custom crafted to appeal to the intended set of potential victims The recipients are individuals or distribution lists, e.g., group@ and websupport@ Geographic targeting is in the UK and US Vertical targeting varies by campaign and is narrow and selective "
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Defray.
| Known Synonyms |
|---|
Glushkov |
Internal MISP references
UUID bbc6dbe3-0ade-4b80-a1cb-c19e23ea8b88 which can be used as unique global reference for Defray in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.defray - webarchive
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-dupont - webarchive
- https://www.proofpoint.com/us/threat-insight/post/defray-new-ransomware-targeting-education-and-healthcare-verticals - webarchive
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/4 - webarchive
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3 - webarchive
- https://www.bleepingcomputer.com/news/security/government-software-provider-tyler-technologies-hit-by-ransomware/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/new-defray-ransomware-targets-education-and-healthcare-verticals - webarchive
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/5/ - webarchive
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/2/ - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf - webarchive
- https://www.trendmicro.com/en_us/research/20/k/weaponizing-open-source-software-for-targeted-attacks.html - webarchive
- https://www.youtube.com/watch?v=LUxOcpIRxmg - webarchive
- https://threatvector.cylance.com/en_us/home/threat-spotlight-defray-ransomware-hits-healthcare-and-education.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Deimos
Described by Elastic as being associated with win.jupyter, and being used in the context of initial access, persistence, and C&C capabilities.
Internal MISP references
UUID e369e45e-0e92-4811-822e-5e598285465e which can be used as unique global reference for Deimos in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DeimosC2
Trend Micro describes DeimosC2 as an open-source C&C framework that was released in June 2020. It is a fully-functional framework that allows for multiple attackers to access, create payloads for, and interact with victim computers. As a post-exploitation C&C framework, DeimosC2 will generate the payloads that need to be manually executed on computer servers that have been compromised through other means such as social engineering, exploitation, or brute-force attacks. Once it is deployed, the threat actors will gain the same access to the systems as the user account that the payload was executed as, either as an administrator or a regular user. Note that DeimosC2 does not perform active or privilege escalation of any kind.
Internal MISP references
UUID 1f1a894f-7a1b-4b98-9280-d33cf884a539 which can be used as unique global reference for DeimosC2 in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.deimos_c2 - webarchive
- https://www.trendmicro.com/en_us/research/22/k/deimosc2-what-soc-analysts-and-incident-responders-need-to-know.html - webarchive
- https://5851803.fs1.hubspotusercontent-na1.net/hubfs/5851803/Russian%20Ransomware%20C2%20Network%20Discovered%20in%20Censys%20Data.pdf - webarchive
- https://censys.com/russian-ransomware-c2-network-discovered-in-censys-data/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DeliveryCheck
According to CERT-UA, this malware makes use of XSLT (Extensible Stylesheet Language Transformations) and COM-hijacking. Its specificity is the presence of a server part, which is usually installed on compromised MS Exchange servers in the form of a MOF (Managed Object Format) file using the Desired State Configuration (DCS) PowerShell tool), effectively turning a legitimate server into a malware control center.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DeliveryCheck.
| Known Synonyms |
|---|
CAPIBAR |
GAMEDAY |
Internal MISP references
UUID 73ef709e-c88d-4737-a3fb-81d7ece5c97d which can be used as unique global reference for DeliveryCheck in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Delta(Alfa,Bravo, ...)
Internal MISP references
UUID 0be67307-670d-4558-bcf7-1387047bca4b which can be used as unique global reference for Delta(Alfa,Bravo, ...) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DeltaStealer
Rust-based infostealer.
Internal MISP references
UUID 3b38cd03-a387-43ce-b8d9-c337d51a84d0 which can be used as unique global reference for DeltaStealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dented
Dented is a banking bot written in C. It supports IE, Firefox, Chrome, Opera and Edge and comes with a simple POS grabber. Due to its modularity, reverse socks 5, tor and vnc can be added.
Internal MISP references
UUID 0404cb3e-1390-4010-a368-80ee585ddd59 which can be used as unique global reference for Dented in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Deprimon
According to ESET Research, DePriMon is a malicious downloader, with several stages and using many non-traditional techniques. To achieve persistence, the malware registers a new local port monitor – a trick falling under the “Port Monitors” technique in the MITRE ATT&CK knowledgebase. For that, the malware uses the “Windows Default Print Monitor” name; that’s why we have named it DePriMon. Due to its complexity and modular architecture, researcher believe it to be a framework.
DePriMon has been active since at least March 2017. DePriMon was detected in a private company, based in Central Europe, and at dozens of computers in the Middle East.
Internal MISP references
UUID 17429ed4-6106-4a28-9a76-f19cd476d94b which can be used as unique global reference for Deprimon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DeputyDog
Internal MISP references
UUID ff4254e5-f301-4804-9a0f-e010af56576c which can be used as unique global reference for DeputyDog in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.deputydog - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-keystone - webarchive
- https://web.archive.org/web/20130924130243/https://www.fireeye.com/blog/technical/cyber-exploits/2013/09/operation-deputydog-zero-day-cve-2013-3893-attack-against-japanese-targets.html - webarchive
- https://www.fireeye.com/blog/threat-research/2013/09/operation-deputydog-zero-day-cve-2013-3893-attack-against-japanese-targets.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DeriaLock
Internal MISP references
UUID 52e0bcba-e352-4d7b-82ee-9169f18dca5a which can be used as unique global reference for DeriaLock in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DeroHE
DeroHE is a ransomware that was spread to users after IObit, a Windows utility developer, was hacked. The malware is delivered a DLL that is sideloaded by a legitimate, signed IObit License Manager application.
Internal MISP references
UUID d348373e-df43-4916-ac23-4f6e344c59e1 which can be used as unique global reference for DeroHE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Derusbi (Windows)
A DLL backdoor also reported publicly as “Derusbi”, capable of obtaining directory, file, and drive listing; creating a reverse shell; performing screen captures; recording video and audio; listing, terminating, and creating processes; enumerating, starting, and deleting registry keys and values; logging keystrokes, returning usernames and passwords from protected storage; and renaming, deleting, copying, moving, reading, and writing to files.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Derusbi (Windows).
| Known Synonyms |
|---|
PHOTO |
Internal MISP references
UUID 7ea00126-add3-407e-b69d-d4aa1b3049d5 which can be used as unique global reference for Derusbi (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.derusbi - webarchive
- https://web.archive.org/web/20180310053107/https://www.rsaconference.com/writable/presentations/file_upload/hta-w02-dissecting-derusbi.pdf - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf - webarchive
- https://attack.mitre.org/groups/G0096 - webarchive
- http://www.novetta.com/wp-content/uploads/2014/11/Derusbi.pdf - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference_slides/2015/Pun-etal-VB2015.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-keystone - webarchive
- https://www.threatconnect.com/the-anthem-hack-all-roads-lead-to-china/ - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://web.archive.org/web/20151216071054/http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family - webarchive
- https://nao-sec.org/2020/01/an-overhead-view-of-the-royal-road.html - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-firestone - webarchive
- https://cybergeeks.tech/analyzing-apt19-malware-using-a-step-by-step-method/ - webarchive
- https://www.trendmicro.com/en_us/research/21/g/biopass-rat-new-malware-sniffs-victims-via-live-streaming.html - webarchive
- https://attack.mitre.org/groups/G0001/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-mohawk - webarchive
- https://www.rsa.com/content/dam/en/white-paper/rsa-incident-response-emerging-threat-profile-shell-crew.pdf - webarchive
- https://unit42.paloaltonetworks.com/rancor-cyber-espionage-group-uses-new-custom-malware-to-attack-southeast-asia/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DesertBlade
According to Microsoft, this was used in a limited destructive malware attack in early March 2022 impacting a single Ukrainian entity. DesertBlade is responsible for iteratively overwriting and then deleting overwritten files on all accessible drives (sparing the system if it is a domain controller).
Internal MISP references
UUID 9a23d11d-1a32-47c8-a35e-accb88a2a370 which can be used as unique global reference for DesertBlade in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.desertblade - webarchive
- https://www.youtube.com/watch?v=mrTdSdMMgnk - webarchive
- https://www.microsoft.com/en-us/security/business/security-insider/wp-content/uploads/2023/03/A-year-of-Russian-hybrid-warfare-in-Ukraine_MS-Threat-Intelligence-1.pdf - webarchive
- https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Devil's Rat
Internal MISP references
UUID 44168d77-338d-46ad-a5f6-c17c2b6b0631 which can be used as unique global reference for Devil's Rat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DevOpt
Internal MISP references
UUID 7d7a870d-725f-4ea3-b344-9c1ad0500618 which can be used as unique global reference for DevOpt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dexbia
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Dexbia.
| Known Synonyms |
|---|
CONIME |
Internal MISP references
UUID 4792fe0d-5c2f-44b1-861a-4b0501ccd335 which can be used as unique global reference for Dexbia in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dexphot
Dexphot is a cryptominer Malware attacking windows machines to gain profit from their resources. It implements many techniques to evade common security systems and a file-less technology to become inject malicious behavior. According to Microsoft the Dexphot It hijacked legitimate system processes to disguise malicious activity. If not stopped, Dexphot is equipped by monitoring services and scheduled tasks triggering re-infection when defenders attempt to remove the malware.
Internal MISP references
UUID b9f6de53-13b3-4246-96d5-010851c75bdb which can be used as unique global reference for Dexphot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dexter
Dexter is a computer virus or point of sale malware which infects computers running Microsoft Windows and was discovered by IT security firm Seculert, in December 2012. It infects PoS systems worldwide and steals sensitive information such as Credit Card and Debit Card information.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Dexter.
| Known Synonyms |
|---|
LusyPOS |
Internal MISP references
UUID f44e6d03-54c0-47af-b228-0040299c349c which can be used as unique global reference for Dexter in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dexter - webarchive
- https://securitykitten.github.io/2014/12/01/lusypos-and-tor.html - webarchive
- https://volatility-labs.blogspot.com/2012/12/unpacking-dexter-pos-memory-dump.html - webarchive
- https://www.trustwave.com/Resources/SpiderLabs-Blog/The-Dexter-Malware--Getting-Your-Hands-Dirty/ - webarchive
- http://contagiodump.blogspot.com/2012/12/dexter-pos-infostealer-samples-and.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/infostealer-dexter-targets-checkout-systems/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dharma
According to MalwareBytes, the Dharma Ransomware family is installed manually by attackers hacking into computers over Remote Desktop Protocol Services (RDP). The attackers will scan the Internet for computers running RDP, usually on TCP port 3389, and then attempt to brute force the password for the computer.
Once they gain access to the computer they will install the ransomware and let it encrypt the computer. If the attackers are able to encrypt other computers on the network, they will attempt to do so as well.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Dharma.
| Known Synonyms |
|---|
Arena |
Crysis |
Wadhrama |
ncov |
Internal MISP references
UUID 9c90b876-e94d-4ea5-9f30-fdc6dd6b5aef which can be used as unique global reference for Dharma in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dharma - webarchive
- https://www.advanced-intel.com/post/inside-phobos-ransomware-dharma-past-underground - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/negasteal-uses-hastebin-for-fileless-delivery-of-crysis-ransomware - webarchive
- https://securelist.com/cis-ransomware/104452/ - webarchive
- https://twitter.com/JakubKroustek/status/1087808550309675009 - webarchive
- https://services.google.com/fh/files/blogs/google_fog_of_war_research_report.pdf - webarchive
- https://www.vice.com/en/article/wxqz54/secret-service-network-investigative-technique-ransomware - webarchive
- https://www.zscaler.com/blogs/security-research/ransomware-delivered-using-rdp-brute-force-attack - webarchive
- https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-april-1st-2022-i-can-fight-with-a-keyboard/ - webarchive
- https://www.theregister.com/2019/11/11/dharma_decryption_promises_data_recovery/ - webarchive
- https://www.crowdstrike.com/blog/ransomware-preparedness-a-call-to-action/ - webarchive
- https://www.npu.gov.ua/news/kiberzlochini/kiberpolicziya-vikrila-transnaczionalne-zlochinne-ugrupovannya-u-nanesenni-inozemnim-kompaniyam-120-miljoniv-dolariv-zbitkiv/ - webarchive
- https://www.europol.europa.eu/newsroom/news/12-targeted-for-involvement-in-ransomware-attacks-against-critical-infrastructure - webarchive
- http://web.archive.org/web/20191008053714/http://esec-lab.sogeti.com/posts/2016/06/07/the-story-of-yet-another-ransomfailware.html - webarchive
- https://thedfirreport.com/2020/06/16/the-little-ransomware-that-couldnt-dharma/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/dharma-ransomware-uses-av-tool-to-distract-from-malicious-activities/ - webarchive
- https://www.justice.gov/usao-dc/press-release/file/1021186/download - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.youtube.com/watch?v=LUxOcpIRxmg - webarchive
- https://asec.ahnlab.com/en/54937/ - webarchive
- https://nakedsecurity.sophos.com/2018/09/11/the-rise-of-targeted-ransomware/ - webarchive
- https://s3.documentcloud.org/documents/6986753/Secret-Service-Seattle-NIT-Warrant-Application.pdf - webarchive
- https://cyberveille-sante.gouv.fr/cyberveille-sante/1821-france-retour-dexperience-suite-une-attaque-par-rancongiciel-contre-une - webarchive
- https://www.carbonblack.com/2018/07/10/carbon-black-tau-threat-analysis-recent-dharma-ransomware-highlights-attackers-continued-use-open-source-tools/ - webarchive
- https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox - webarchive
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/ - webarchive
- https://news.sophos.com/en-us/2020/08/12/color-by-numbers-inside-a-dharma-ransomware-as-a-service-attack/ - webarchive
- https://docs.microsoft.com/en-us/security/compass/human-operated-ransomware - webarchive
- https://www.acronis.com/en-us/articles/Dharma-ransomware/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-arena-crysis-ransomware-variant-released/ - webarchive
- https://www.group-ib.com/media/iran-cybercriminals/ - webarchive
- https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://research.checkpoint.com/2018/the-ransomware-doctor-without-a-cure/ - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DiamondFox
According to PCrisk, DiamondFox is highly modular malware offered as malware-as-a-service, and is for sale on various hacker forums. Therefore, cyber criminals who are willing to use DiamondFox do not necessarily require any technical knowledge to perform their attacks.
Once purchased, this malware can be used to log keystrokes, steal credentials (e.g., usernames, email addresses, passwords), hijack cryptocurrency wallets, perform distributed denial of service (DDoS) attacks, and to carry out other malicious tasks.
DiamondFox allows cyber criminals to choose which plug-ins to keep activated and see infection statistics in real-time.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DiamondFox.
| Known Synonyms |
|---|
Crystal |
Gorynch |
Gorynych |
Internal MISP references
UUID 7368ab0c-ef4b-4f53-a746-f150b8afa665 which can be used as unique global reference for DiamondFox in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.diamondfox - webarchive
- https://blog.malwarebytes.com/threat-analysis/2017/04/diamond-fox-p2/ - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://blog.malwarebytes.com/threat-analysis/2017/03/diamond-fox-p1/ - webarchive
- https://fr3d.hk/blog/diamondfox-bank-robbers-will-be-replaced - webarchive
- https://github.com/samoceyn/Diamondfox-Technical-Analysis-Report/blob/6375314ccecdf3fe450f975a384bcc1b16f068a8/D%C4%B0AMONDFOX%20Technical%20Analysis%20Report.PDF - webarchive
- https://www.scmagazine.com/inside-diamondfox/article/578478/ - webarchive
- https://blog.cylance.com/a-study-in-bots-diamondfox - webarchive
- http://blog.checkpoint.com/2017/05/10/diamondfox-modular-malware-one-stop-shop/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Diavol
A ransomware with potential ties to Wizard Spider.
Internal MISP references
UUID 6fa944af-3def-437a-8a52-9234782b5bb8 which can be used as unique global reference for Diavol in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.diavol - webarchive
- https://www.bleepingcomputer.com/news/security/trickbot-gang-developer-arrested-when-trying-to-leave-korea/ - webarchive
- https://securityintelligence.com/posts/analysis-of-diavol-ransomware-link-trickbot-gang/ - webarchive
- https://www.bleepingcomputer.com/news/security/fbi-links-diavol-ransomware-to-the-trickbot-cybercrime-group/ - webarchive
- https://heimdalsecurity.com/blog/is-diavol-ransomware-connected-to-wizard-spider/ - webarchive
- https://medium.com/walmartglobaltech/diavol-resurfaces-91dd93c7d922 - webarchive
- https://arcticwolf.com/resources/blog/karakurt-web - webarchive
- https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider - webarchive
- https://www.binarydefense.com/threat_watch/new-ransomware-diavol-being-dropped-by-trickbot/ - webarchive
- https://www.bleepingcomputer.com/news/security/diavol-ransomware-sample-shows-stronger-connection-to-trickbot-gang/ - webarchive
- https://chuongdong.com/reverse%20engineering/2021/12/17/DiavolRansomware/ - webarchive
- https://thedfirreport.com/2021/12/13/diavol-ransomware/ - webarchive
- https://medium.com/walmartglobaltech/diavol-the-enigma-of-ransomware-1fd78ffda648 - webarchive
- https://www.scythe.io/library/adversary-emulation-diavol-ransomware-threatthursday - webarchive
- https://www.ic3.gov/Media/News/2022/220120.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DICELOADER
A RAT written in .NET, used by FIN7 since 2021. In some instances dropped by ps1.powertrash.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DICELOADER.
| Known Synonyms |
|---|
Lizar |
Internal MISP references
UUID f8e7673a-c8dc-406a-851e-48756074b5c6 which can be used as unique global reference for DICELOADER in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DILLJUICE
APT10's fork of the (open-source) Quasar RAT.
Internal MISP references
UUID 81c95462-62ba-4182-bba0-707e1f6cc1eb which can be used as unique global reference for DILLJUICE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DilongTrash
Downloader.
Internal MISP references
UUID 8d910ebf-131b-452c-8cc2-0226887259a0 which can be used as unique global reference for DilongTrash in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dimnie
Internal MISP references
UUID 8f5ce8a6-c5fe-4c62-b25b-6ce0f3b724c5 which can be used as unique global reference for Dimnie in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DinodasRAT
Internal MISP references
UUID a8eaa325-3e89-41af-9de0-ae2c992148a5 which can be used as unique global reference for DinodasRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DinoTrain
Downloader.
Internal MISP references
UUID 8f4c0f4a-4b3f-4bce-be08-fabf4ec45399 which can be used as unique global reference for DinoTrain in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DirCrypt
Internal MISP references
UUID 61b2dd12-2381-429d-bb64-e3210804a462 which can be used as unique global reference for DirCrypt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DirtyMoe
Internal MISP references
UUID 9f324aaf-a54e-4532-bfc1-b23f1a77abbf which can be used as unique global reference for DirtyMoe in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dirtymoe - webarchive
- https://decoded.avast.io/martinchlumecky/dirtymoe-3/ - webarchive
- https://decoded.avast.io/martinchlumecky/dirtymoe-1/ - webarchive
- https://decoded.avast.io/martinchlumecky/dirtymoe-rootkit-driver/ - webarchive
- https://thehackernews.com/2022/03/purple-fox-hackers-spotted-using-new.html - webarchive
- https://decoded.avast.io/martinchlumecky/dirtymoe-5/ - webarchive
- https://decoded.avast.io/martinchlumecky/dirtymoe-4/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Disk Knight
Internal MISP references
UUID 1e5d8ec2-e609-482d-93ef-8a0ab74b3da5 which can be used as unique global reference for Disk Knight in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DispCashBR
Internal MISP references
UUID 9e343fd7-3809-49af-9903-db7daeac339b which can be used as unique global reference for DispCashBR in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DispenserXFS
Internal MISP references
UUID 3bbf08fd-f147-4b23-9d48-a53ac836bc05 which can be used as unique global reference for DispenserXFS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DistTrack
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DistTrack.
| Known Synonyms |
|---|
Shamoon |
Internal MISP references
UUID 25d03501-1fe0-4d5e-bc75-c00fbdaa83df which can be used as unique global reference for DistTrack in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.disttrack - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat - webarchive
- https://afyonluoglu.org/PublicWebFiles/Reports-TR/2017%20FireEye%20M-Trends%20Report.pdf - webarchive
- http://contagiodump.blogspot.com/2012/08/shamoon-or-disttracka-samples.html - webarchive
- https://securelist.com/shamoon-the-wiper-copycats-at-work/ - webarchive
- https://web.archive.org/web/20120818235442/https://www.symantec.com/connect/blogs/shamoon-attacks - webarchive
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=5758557d-6e3a-4174-90f3-fa92a712ecd9&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments - webarchive
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=ad6f8259-2bb4-4f7f-b8e1-710b35a4cbed&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments - webarchive
- https://www.codeandsec.com/Sophisticated-CyberWeapon-Shamoon-2-Malware-Analysis - webarchive
- https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/ - webarchive
- https://web.archive.org/web/20190331181353/https://www.symantec.com/connect/blogs/greenbug-cyberespionage-group-targeting-middle-east-possible-links-shamoon - webarchive
- https://www.zdnet.com/article/fbi-warns-about-ongoing-attacks-against-software-supply-chain-companies/ - webarchive
- http://researchcenter.paloaltonetworks.com/2017/03/unit42-shamoon-2-delivering-disttrack/ - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/ - webarchive
- http://www.vinransomware.com/blog/detailed-threat-analysis-of-shamoon-2-0-malware - webarchive
- http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/?adbsc=social68389776&adbid=804134348374970368&adbpl=tw&adbpr=4487645412 - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/ - webarchive
- https://resources.cylera.com/hubfs/Cylera%20Labs/Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf - webarchive
- https://content.fireeye.com/m-trends/rpt-m-trends-2017 - webarchive
- https://malwareindepth.com/shamoon-2012/ - webarchive
- https://symantec.broadcom.com/hubfs/Attacks-Against-Critical_Infrastructrure.pdf - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/shamoon-destructive-threat-re-emerges-new-sting-its-tail - webarchive
- https://www.symantec.com/connect/blogs/greenbug-cyberespionage-group-targeting-middle-east-possible-links-shamoon - webarchive
- https://unit42.paloaltonetworks.com/unit42-second-wave-shamoon-2-attacks-identified/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Divergent
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Divergent.
| Known Synonyms |
|---|
Novter |
Internal MISP references
UUID 7ca1e2ad-6cf4-44cc-8559-2f71e4fb2801 which can be used as unique global reference for Divergent in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.divergent - webarchive
- https://www.microsoft.com/security/blog/2019/09/26/bring-your-own-lolbin-multi-stage-fileless-nodersok-campaign-delivers-rare-node-js-based-malware/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/new-fileless-botnet-novter-distributed-by-kovcoreg-malvertising-campaign/ - webarchive
- https://blog.talosintelligence.com/2019/09/divergent-analysis.html - webarchive
- https://www.cert-pa.it/notizie/devergent-malware-fileless/ - webarchive
- https://documents.trendmicro.com/assets/Tech-Brief-New-Fileless-Botnet-Novter-Distributed-by-KovCoreG-Malvertising-Campaign.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Diztakun
Internal MISP references
UUID 5e73185c-6070-45ed-88de-ed75580582eb which can be used as unique global reference for Diztakun in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DLRAT
Internal MISP references
UUID b3f0f3a8-a50e-457b-a5dc-e17110ccac2f which can be used as unique global reference for DLRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DMA Locker
Internal MISP references
UUID 1248cdf7-4180-4098-b1d0-389aa523a0ed which can be used as unique global reference for DMA Locker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dma_locker - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/02/dma-locker-a-new-ransomware-but-no-reason-to-panic/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/05/dma-locker-4-0-known-ransomware-preparing-for-a-massive-distribution/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/02/dma-locker-strikes-back/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DMSniff
DMSniff is a point-of-sale malware previously only privately sold. It has been used in breaches of small- and medium-sized businesses in the restaurant and entertainment industries. It uses a domain generation algorithm (DGA) to create lists of command-and-control domains on the fly.
Internal MISP references
UUID f716681e-c1fd-439a-83aa-3147bb9f082f which can be used as unique global reference for DMSniff in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dmsniff - webarchive
- https://www.flashpoint-intel.com/blog/dmsniff-pos-malware-actively-leveraged-target-medium-sized-businesses/ - webarchive
- https://medium.com/walmartglobaltech/gazavat-expiro-dmsniff-connection-and-dga-analysis-8b965cc0221d - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DneSpy
DneSpy collects information, takes screenshots, and downloads and executes the latest version of other malicious components in the infected system. The malware is designed to receive a “policy” file in JSON format with all the commands to execute. The policy file sent by the C&C server can be changed and updated over time, making dneSpy flexible and well-designed. The output of each executed command is zipped, encrypted, and exfiltrated to the C&C server. These characteristics make dneSpy a fully functional espionage backdoor.
Internal MISP references
UUID 7c35d10d-b3da-459e-a272-da2ea7cee4c2 which can be used as unique global reference for DneSpy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DNSChanger
Internal MISP references
UUID 92db05a0-7d7e-40c3-94c8-ce3cd5e36daa which can be used as unique global reference for DNSChanger in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DNSMessenger
DNSMessenger makes use of DNS TXT record queries and responses to create a bidirectional Command and Control (C2) channel. This allows the attacker to use DNS communications to submit new commands to be run on infected machines and return the results of the command execution to the attacker.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DNSMessenger.
| Known Synonyms |
|---|
TEXTMATE |
Internal MISP references
UUID b376580e-aba1-4ac9-9c2d-2df429efecf6 which can be used as unique global reference for DNSMessenger in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dnsmessenger - webarchive
- https://blog.apnic.net/2022/03/31/how-to-detect-and-prevent-common-data-exfiltration-attacks/ - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf - webarchive
- http://wraithhacker.com/2017/10/11/more-info-on-evolved-dnsmessenger/ - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
- https://blog.talosintelligence.com/2017/10/dnsmessenger-sec-campaign.html - webarchive
- https://blog.talosintelligence.com/2017/03/dnsmessenger.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DNSpionage
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DNSpionage.
| Known Synonyms |
|---|
Agent Drable |
AgentDrable |
Webmask |
Internal MISP references
UUID ef46bd90-91d0-4208-b3f7-08b65acb8438 which can be used as unique global reference for DNSpionage in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dnspionage - webarchive
- https://www.zdnet.com/article/source-code-of-iranian-cyber-espionage-tools-leaked-on-telegram/ - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-edgewater - webarchive
- https://www.virusbulletin.com/uploads/pdf/magazine/2019/VB2019-Mercer-Rascagneres.pdf - webarchive
- https://blog-cert.opmd.fr/dnspionage-focus-on-internal-actions/ - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ - webarchive
- https://www.youtube.com/watch?v=ws1k44ZhJ3g - webarchive
- https://www.us-cert.gov/ncas/alerts/AA19-024A - webarchive
- https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html - webarchive
- https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html - webarchive
- https://nsfocusglobal.com/apt34-event-analysis-report/ - webarchive
- https://www.lastline.com/labsblog/threat-actor-cold-river-network-traffic-analysis-and-a-deep-dive-on-agent-drable/ - webarchive
- https://www.mandiant.com/resources/blog/global-dns-hijacking-campaign-dns-record-manipulation-at-scale - webarchive
- https://marcoramilli.com/2019/04/23/apt34-webmask-project/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
dnWipe
Internal MISP references
UUID 0f6c16ec-e15c-480b-a5d3-cf5efe71821a which can be used as unique global reference for dnWipe in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DogHousePower
DogHousePower is a PyInstaller-based ransomware targeting web and database servers. It is delivered through a PowerShell downloader and was hosted on Github.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DogHousePower.
| Known Synonyms |
|---|
Shelma |
Internal MISP references
UUID 14d3518a-d8cb-4fbd-80aa-8bec4fc8ad13 which can be used as unique global reference for DogHousePower in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Minodo
Since late February 2023, Minodo Backdoor campaigns have been employed to deliver either the Project Nemesis information stealer or more sophisticated backdoors like Cobalt Strike. This backdoor collects basic system information, which it then transmits to the C2 server. In return, it receives an AES-encrypted payload. Notably, the Minodo Backdoor is designed to contact a different C2 address for domain-joined systems. This suggests that more capable backdoors, such as Cobalt Strike, are downloaded on higher-value targets instead of Project Nemesis.
Internal MISP references
UUID 37169b2f-344e-4913-ab91-d447d597ffa7 which can be used as unique global reference for Minodo in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DONOT
Donot malware is a sophisticated, high-level malware toolkit designed to collect and exfiltrate information from vulnerable systems. It has been used in targeted attacks against government and military organizations in Asia. Donot malware is highly complex and well-crafted, and it poses a serious threat to information security.
Internal MISP references
UUID 6d22d9e1-b38d-4a6f-a4bb-1121ced4adfc which can be used as unique global reference for DONOT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
donut_injector
Donut is an open-source in-memory injector/loader, designed for execution of VBScript, JScript, EXE, DLL files and dotNET assemblies. It was used during attacks against U.S. organisations according to Threat Hunter Team (Symantec) and U.S. Defence contractors (Unit42). Github: https://github.com/TheWover/donut
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular donut_injector.
| Known Synonyms |
|---|
Donut |
Internal MISP references
UUID d713f337-b9c7-406d-88e4-3352b2523c73 which can be used as unique global reference for donut_injector in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.donut_injector - webarchive
- https://thewover.github.io/Introducing-Donut/ - webarchive
- https://cocomelonc.github.io/malware/2022/07/30/malware-av-evasion-8.html - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DoorMe
Internal MISP references
UUID b91e1d34-cabd-404f-84d2-51a4f9840ffb which can be used as unique global reference for DoorMe in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.doorme - webarchive
- https://www.elastic.co/security-labs/update-to-the-REF2924-intrusion-set-and-related-campaigns - webarchive
- https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/new-apt-group-chamelgang/ - webarchive
- http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DoppelDridex
DoppelDridex is a fork of Indrik Spider's Dridex malware. DoppelDridex has been run as a parallel operation to Dridex with a different malware versioning system, different RSA key, and with different infrastructure.
Internal MISP references
UUID b634a2ac-da01-43c0-b823-a235497a10a8 which can be used as unique global reference for DoppelDridex in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.doppeldridex - webarchive
- https://team-cymru.com/blog/2021/11/03/webinject-panel-administration-a-vantage-point-into-multiple-threat-actor-campaigns/ - webarchive
- https://www.bleepingcomputer.com/news/security/log4j-vulnerability-now-used-to-install-dridex-banking-malware/ - webarchive
- https://security-soup.net/doppeldridex-delivered-via-slack-and-discord/ - webarchive
- https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/ - webarchive
- https://blogs.blackberry.com/en/2021/11/zebra2104 - webarchive
- https://www.0ffset.net/reverse-engineering/malware-analysis/dridex-veh-api-obfuscation/ - webarchive
- https://redcanary.com/blog/grief-ransomware/ - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-110a - webarchive
- https://medium.com/s2wlab/operation-synctrek-e5013df8d167 - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf - webarchive
- https://www.fortinet.com/blog/threat-research/new-dridex-variant-being-spread-by-crafted-excel-document?&web_view=true - webarchive
- https://cyber-anubis.github.io/malware%20analysis/dridex/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://inquest.net/blog/2021/12/20/dont-bring-dridex-home-holidays - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/ta575-uses-squid-game-lures-distribute-dridex-malware - webarchive
- https://twitter.com/BrettCallow/status/1453557686830727177?s=20 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DoppelPaymer
Doppelpaymer is a ransomware family that encrypts user data and later on it asks for a ransom in order to restore original files. It is recognizable by its trademark file extension added to encrypted files: .doppeled. It also creates a note file named: ".how2decrypt.txt".
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DoppelPaymer.
| Known Synonyms |
|---|
Pay OR Grief |
Internal MISP references
UUID 16a76dcf-92cb-4371-8440-d6b3adbb081b which can be used as unique global reference for DoppelPaymer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.doppelpaymer - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/ - webarchive
- https://www.fireeye.com/blog/threat-research/2020/07/financially-motivated-actors-are-expanding-access-into-ot.html - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1 - webarchive
- https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/ - webarchive
- https://ke-la.com/to-attack-or-not-to-attack-targeting-the-healthcare-sector-in-the-underground-ecosystem/ - webarchive
- https://www.bleepingcomputer.com/news/security/laptop-maker-compal-hit-by-ransomware-17-million-demanded/ - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.heise.de/news/Uniklinik-Duesseldorf-Ransomware-DoppelPaymer-soll-hinter-dem-Angriff-stecken-4908608.html - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf - webarchive
- https://intel471.com/blog/ransomware-attack-access-merchants-infostealer-escrow-service/ - webarchive
- https://ke-la.com/zooming-into-darknet-threats-targeting-jp-orgs-kela/ - webarchive
- https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/ - webarchive
- https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/ - webarchive
- https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/ - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://apnews.com/article/virus-outbreak-elections-georgia-voting-2020-voting-c191f128b36d1c0334c9d0b173daa18c - webarchive
- https://www.bleepingcomputer.com/news/security/foxconn-electronics-giant-hit-by-ransomware-34-million-ransom/ - webarchive
- https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/ - webarchive
- https://twitter.com/AltShiftPrtScn/status/1385103712918642688 - webarchive
- https://twitter.com/vikas891/status/1385306823662587905 - webarchive
- https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf - webarchive
- https://killingthebear.jorgetesta.tech/actors/evil-corp - webarchive
- https://www.ic3.gov/Media/News/2020/201215-1.pdf - webarchive
- https://techcrunch.com/2020/03/01/visser-breach/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-009.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/fake-microsoft-teams-updates-lead-to-cobalt-strike-deployment/ - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations-wp.pdf - webarchive
- https://lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf - webarchive
- https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/ - webarchive
- https://www.bleepingcomputer.com/news/security/doppelpaymer-ransomware-launches-site-to-post-victims-data/ - webarchive
- https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/ransomware-attackers-use-your-cloud-backups-against-you/ - webarchive
- https://www.trendmicro.com/en_us/research/21/a/an-overview-of-the-doppelpaymer-ransomware.html - webarchive
- https://blog.chainalysis.com/reports/ransomware-connections-maze-egregor-suncrypt-doppelpaymer - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.mandiant.com/resources/financially-motivated-actors-are-expanding-access-into-ot - webarchive
- https://www.zdnet.com/article/ransomware-gang-says-it-breached-one-of-nasas-it-contractors/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://twitter.com/BrettCallow/status/1453557686830727177?s=20 - webarchive
- https://www.zscaler.com/blogs/security-research/doppelpaymer-continues-cause-grief-through-rebranding - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-heron - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-heron - webarchive
- https://sites.temple.edu/care/ci-rw-attacks/ - webarchive
- https://www.crowdstrike.com/blog/how-doppelpaymer-hunts-and-kills-windows-processes/ - webarchive
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/ - webarchive
- https://redcanary.com/blog/grief-ransomware/ - webarchive
- https://lka.polizei.nrw/presse/schlag-gegen-international-agierendes-netzwerk-von-cyber-kriminellen - webarchive
- https://www.bleepingcomputer.com/news/security/core-doppelpaymer-ransomware-gang-members-targeted-in-europol-operation/ - webarchive
- https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-009/ - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/ - webarchive
- https://medium.com/s2wlab/operation-synctrek-e5013df8d167 - webarchive
- https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/ - webarchive
- https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html - webarchive
- https://www.armor.com/resources/threat-intelligence/the-evolution-of-doppel-spider-from-bitpaymer-to-grief-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NgrBot
Internal MISP references
UUID 91191c0a-96d8-40b8-b8fb-daa0ad009c87 which can be used as unique global reference for NgrBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dorkbot_ngrbot - webarchive
- https://krebsonsecurity.com/2019/10/mariposa-botnet-author-darkcode-crime-forum-admin-arrested-in-germany/ - webarchive
- http://stopmalvertising.com/rootkits/analysis-of-ngrbot.html - webarchive
- https://research.checkpoint.com/dorkbot-an-investigation/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/the-dorkbot-rises/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dorshel
Internal MISP references
UUID d3b5a884-1fd6-4cc4-9837-7d8ee8817711 which can be used as unique global reference for Dorshel in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dorshel - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks - webarchive
- https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dosia
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Dosia.
| Known Synonyms |
|---|
DDOSIA |
Internal MISP references
UUID eabd30ed-d2ec-43b5-b790-7381f93a3a03 which can be used as unique global reference for Dosia in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dosia - webarchive
- https://www.sentinelone.com/labs/noname05716-the-pro-russian-hacktivist-group-targeting-nato/ - webarchive
- https://noname.be42late.co/ - webarchive
- https://viuleeenz.github.io/posts/2023/05/extracting-ddosia-targets-from-process-memory/ - webarchive
- https://decoded.avast.io/martinchlumecky/ddosia-project-how-noname05716-is-trying-to-improve-the-efficiency-of-ddos-attacks/ - webarchive
- https://blog.sekoia.io/following-noname05716-ddosia-projects-targets/ - webarchive
- https://www.team-cymru.com/post/a-blog-with-noname - webarchive
- https://medium.com/@b42labs/data-insights-from-russian-cyber-militants-noname057-9f4db98f60e - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DOSTEALER
According to Mandiant, DOSTEALER is a dataminer that mines browser login and cookie data. It is also capable of taking screenshots and logging keystrokes.
Internal MISP references
UUID 3b4bf82d-5c57-4ea2-847d-f2fd292ba730 which can be used as unique global reference for DOSTEALER in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dot Ransomware
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Dot Ransomware.
| Known Synonyms |
|---|
MZP Ransomware |
Internal MISP references
UUID fc63c3ea-23ed-448d-9d66-3fb87ebea4ba which can be used as unique global reference for Dot Ransomware in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DOUBLEBACK
DOUBLEBACK is a newly discovered fileless malware deployed as part of an attack campaign that took place in December 2020. The threat actors responsible for the operations are tracked as UNC2529 by researchers. According to their findings, DOUBLEBACK is the final payload delivered onto the compromised systems. Its task is to establish and maintain a backdoor on the victim's machine.
Internal MISP references
UUID 1cda1810-f705-4d6b-9c9e-f509f8c7f5c5 which can be used as unique global reference for DOUBLEBACK in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.doubleback - webarchive
- https://research.loginsoft.com/threat-research/from-innocence-to-malice-the-onenote-malware-campaign-uncovered/ - webarchive
- https://www.fireeye.com/blog/threat-research/2021/05/unc2529-triple-double-trifecta-phishing-campaign.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DoubleFantasy (Windows)
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DoubleFantasy (Windows).
| Known Synonyms |
|---|
VALIDATOR |
Internal MISP references
UUID 46a523ca-be25-4f59-bc01-2c006c58bf80 which can be used as unique global reference for DoubleFantasy (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.doublefantasy - webarchive
- https://fmnagisa.wordpress.com/2020/08/27/revisiting-equationgroups-fanny-worm-or-dementiawheel/ - webarchive
- https://securelist.com/equation-the-death-star-of-malware-galaxy/68750/ - webarchive
- https://twitter.com/Int2e_/status/1294565186939092994 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DoubleFinger
Internal MISP references
UUID 4f1e5142-0f62-48ee-a4a7-d8072fd78dcf which can be used as unique global reference for DoubleFinger in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DoublePulsar
Internal MISP references
UUID 32984744-c0f9-43f7-bfca-c3276248a4fa which can be used as unique global reference for DoublePulsar in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.doublepulsar - webarchive
- https://labs.nettitude.com/blog/a-quick-analysis-of-the-latest-shadow-brokers-dump/ - webarchive
- https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/ - webarchive
- https://github.com/countercept/doublepulsar-c2-traffic-decryptor - webarchive
- https://www.symantec.com/blogs/threat-intelligence/buckeye-windows-zero-day-exploit - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DoubleZero
A wiper identified by CERT-UA on March 17th, written in C#.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DoubleZero.
| Known Synonyms |
|---|
FiberLake |
Internal MISP references
UUID 7b4234ff-a7c2-4991-b4bf-6e13c57103cd which can be used as unique global reference for DoubleZero in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.doublezero - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/ - webarchive
- https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4Vwwd - webarchive
- https://securelist.com/new-ransomware-trends-in-2022/106457/ - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/ - webarchive
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-doublezero - webarchive
- https://www.microsoft.com/en-us/security/business/security-insider/wp-content/uploads/2023/03/A-year-of-Russian-hybrid-warfare-in-Ukraine_MS-Threat-Intelligence-1.pdf - webarchive
- https://www.splunk.com/en_us/blog/security/threat-update-doublezero-destructor.html - webarchive
- https://cert.gov.ua/article/38088 - webarchive
- https://cybersecurity.att.com/blogs/labs-research/analysis-on-recent-wiper-attacks-examples-and-how-they-wiper-malware-works - webarchive
- https://unit42.paloaltonetworks.com/doublezero-net-wiper/ - webarchive
- https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html - webarchive
- https://cip.gov.ua/en/news/khto-stoyit-za-kiberatakami-na-ukrayinsku-kritichnu-informaciinu-infrastrukturu-statistika-15-22-bereznya - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ - webarchive
- https://www.youtube.com/watch?v=mrTdSdMMgnk - webarchive
- https://www.nextgov.com/cybersecurity/2022/03/ukrainian-cyber-lead-least-4-types-malware-are-targeting-ukrainian-institutions/363558/ - webarchive
- https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Downdelph
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Downdelph.
| Known Synonyms |
|---|
DELPHACY |
Internal MISP references
UUID e6a077cb-42cc-4193-9006-9ceda8c0dff2 which can be used as unique global reference for Downdelph in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.downdelph - webarchive
- https://labs.sentinelone.com/a-deep-dive-into-zebrocys-dropper-docs/ - webarchive
- https://contagiodump.blogspot.de/2017/02/russian-apt-apt28-collection-of-samples.html - webarchive
- http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf - webarchive
- https://www.picussecurity.com/blog/picus-10-critical-mitre-attck-techniques-t1055-process-injection - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Downeks
Internal MISP references
UUID c8149b45-7d28-421e-bc6f-25c4b8698b92 which can be used as unique global reference for Downeks in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.downeks - webarchive
- http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments/?adbsc=social69739136&adbid=826218465723756545&adbpl=tw&adbpr=4487645412 - webarchive
- https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DownPaper
DownPaper, sometimes delivered as sami.exe, is a Backdoor trojan. Its main functionality is to download and run a second stage. This malware has been observed in campaigns involving Charming Kitten, an Iranian cyberespionage group.
Internal MISP references
UUID 227862fd-ae83-4e3d-bb69-cc1a45a13aed which can be used as unique global reference for DownPaper in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DramNudge
Internal MISP references
UUID 627a044b-1c84-409c-9f58-95b46d5d51ba which can be used as unique global reference for DramNudge in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DRATzarus
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DRATzarus.
| Known Synonyms |
|---|
ThreatNeedle |
Internal MISP references
UUID 1ff3afab-8b3f-4b9c-90c7-61062d2dfe0b which can be used as unique global reference for DRATzarus in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dratzarus - webarchive
- http://blog.nsfocus.net/stumbzarus-apt-lazarus/ - webarchive
- https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/ - webarchive
- https://vblocalhost.com/uploads/VB2021-Park.pdf - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Lazarus-campaigns-and-backdoors-in-2022-2023.pdf - webarchive
- https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DreamBot
2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*) 2014 Dreambot (Gozi ISFB variant)
In 2014, a variant of Gozi ISFB was developed. Mainly, the dropper performs additional anti-vm checks (vmware, vbox, qemu), while the actual bot-dll remains unchanged in most parts. New functionality, such as TOR support, was added though and often, the Fluxxy fast-flux network is used.
See win.gozi for additional historical information.
Internal MISP references
UUID ac4fbbb0-9a21-49ce-be82-e44cb02a7819 which can be used as unique global reference for DreamBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dreambot - webarchive
- https://lokalhost.pl/gozi_tree.txt - webarchive
- https://www.youtube.com/watch?v=EyDiIAt__dI - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://medium.com/csis-techblog/the-end-of-dreambot-a-loved-piece-of-gozi-24cc9bfc8122 - webarchive
- https://community.riskiq.com/article/30f22a00 - webarchive
- https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality - webarchive
- https://medium.com/csis-techblog/installcapital-when-adware-becomes-pay-per-install-cyber-crime-15516249a451 - webarchive
- https://research.checkpoint.com/2020/gozi-the-malware-with-a-thousand-faces/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dridex
OxCERT blog describes Dridex as "an evasive, information-stealing malware variant; its goal is to acquire as many credentials as possible and return them via an encrypted tunnel to a Command-and-Control (C&C) server. These C&C servers are numerous and scattered all over the Internet, if the malware cannot reach one server it will try another. For this reason, network-based measures such as blocking the C&C IPs is effective only in the short-term." According to MalwareBytes, "Dridex uses an older tactic of infection by attaching a Word document that utilizes macros to install malware. However, once new versions of Microsoft Office came out and users generally updated, such a threat subsided because it was no longer simple to infect a user with this method." IBM X-Force discovered "a new version of the Dridex banking Trojan that takes advantage of a code injection technique called AtomBombing to infect systems. AtomBombing is a technique for injecting malicious code into the 'atom tables' that almost all versions of Windows uses to store certain application data. It is a variation of typical code injection attacks that take advantage of input validation errors to insert and to execute malicious code in a legitimate process or application. Dridex v4 is the first malware that uses the AtomBombing process to try and infect systems."
Internal MISP references
UUID b4216929-1626-4444-bdd7-bfd4b68a766e which can be used as unique global reference for Dridex in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dridex - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://viql.github.io/dridex/ - webarchive
- https://www.sentinelone.com/labs/sanctions-be-damned-from-dridex-to-macaw-the-evolution-of-evil-corp/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-drake - webarchive
- https://malwarebookreports.com/cryptone-cobalt-strike/ - webarchive
- https://threatresearch.ext.hp.com/dridex-malicious-document-analysis-automating-the-extraction-of-payload-urls/ - webarchive
- https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/ - webarchive
- https://github.com/pan-unit42/tweets/blob/master/2020-09-07-Dridex-IOCs.txt - webarchive
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/ - webarchive
- https://en.wikipedia.org/wiki/Maksim_Yakubets - webarchive
- https://securityintelligence.com/posts/raspberry-robin-worm-dridex-malware/ - webarchive
- https://www.cert.pl/en/news/single/talking-dridex-part-0-inside-the-dropper/ - webarchive
- https://www.justice.gov/opa/pr/officials-announce-international-operation-targeting-transnational-criminal-organization - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/dridex-financial-trojan.pdf - webarchive
- https://securityintelligence.com/dridexs-cold-war-enter-atombombing/ - webarchive
- https://unit42.paloaltonetworks.com/banking-trojan-techniques/ - webarchive
- https://cyber-anubis.github.io/malware%20analysis/dridex/ - webarchive
- https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions - webarchive
- https://securityintelligence.com/dridex-campaign-propelled-by-cutwail-botnet-and-powershell/ - webarchive
- https://twitter.com/TheDFIRReport/status/1356729371931860992 - webarchive
- https://www.microsoft.com/security/blog/2021/02/01/what-tracking-an-attacker-email-infrastructure-tells-us-about-persistent-cybercriminal-operations/ - webarchive
- https://threatresearch.ext.hp.com/wp-content/uploads/2021/03/HP_Bromium_Threat_Insights_Report_Q4_2020.pdf - webarchive
- https://unit42.paloaltonetworks.com/excel-add-ins-dridex-infection-chain - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf - webarchive
- https://www.flashpoint-intel.com/blog-dridex-banking-trojan-returns/ - webarchive
- https://www.pandasecurity.com/mediacenter/src/uploads/2017/10/Informe_Dridex_Revisado_FINAL_EN-2.pdf - webarchive
- https://www.atomicmatryoshka.com/post/malware-headliners-dridex - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://blogs.blackberry.com/en/2021/08/blackberry-prevents-threat-actor-group-ta575-and-dridex-malware - webarchive
- https://inquest.net/blog/2021/12/20/dont-bring-dridex-home-holidays - webarchive
- https://twitter.com/Cryptolaemus1/status/1407135648528711680 - webarchive
- https://www.proofpoint.com/us/threat-insight/post/holiday-lull-not-so-much - webarchive
- https://cdn2.hubspot.net/hubfs/507516/ANB_MIR_Dridex_PRv7_final.pdf - webarchive
- https://www.govcert.admin.ch/blog/28/the-rise-of-dridex-and-the-role-of-esps - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://www.deepinstinct.com/2021/05/26/deep-dive-packing-software-cryptone/ - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-drake - webarchive
- https://intezer.com/blog/intezer-analyze/fantastic-payloads-and-where-we-find-them - webarchive
- https://malcat.fr/blog/cutting-corners-against-a-dridex-downloader/ - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://medium.com/s2wlab/operation-synctrek-e5013df8d167 - webarchive
- https://community.riskiq.com/article/e4fb7245 - webarchive
- https://unit42.paloaltonetworks.com/travel-themed-phishing/ - webarchive
- https://news.sophos.com/en-us/2021/04/21/nearly-half-of-malware-now-use-tls-to-conceal-communications/ - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html - webarchive
- https://www.blueliv.com/downloads/documentation/reports/Network_insights_of_Dyre_and_Dridex_Trojan_bankers.pdf - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/01/vb2019-paper-rich-headers-leveraging-mysterious-artifact-pe-format/ - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
- https://home.treasury.gov/news/press-releases/sm845 - webarchive
- https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree - webarchive
- https://www.sophos.com/en-us/medialibrary/pdfs/technical-papers/sophos-2021-threat-report.pdf - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf - webarchive
- https://thedfirreport.com/2020/08/03/dridex-from-word-to-domain-dominance/ - webarchive
- https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/ - webarchive
- https://www.prodaft.com/m/uploads/SilverFish_TLPWHITE.pdf - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-010.pdf - webarchive
- https://assets.virustotal.com/reports/2021trends.pdf - webarchive
- https://news.sophos.com/en-us/2020/02/18/nearly-a-quarter-of-malware-now-communicates-using-tls/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0118.pdf - webarchive
- https://isc.sans.edu/forums/diary/Recent+Dridex+activity/26550/ - webarchive
- https://killingthebear.jorgetesta.tech/actors/evil-corp - webarchive
- https://threatresearch.ext.hp.com/detecting-ta551-domains/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-345a - webarchive
- https://yoroi.company/research/office-documents-may-the-xll-technique-change-the-threat-landscape-in-2022/ - webarchive
- https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-1112.pdf - webarchive
- https://blogs.vmware.com/networkvirtualization/2021/03/analysis-of-a-new-dridex-campaign.html/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://resource.redcanary.com/rs/003-YRU-314/images/2021-Threat-Detection-Report.pdf - webarchive
- https://blog.morphisec.com/obfuscated-vbscript-drops-zloader-ursnif-qakbot-dridex - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-heron - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://community.riskiq.com/article/2cd1c003 - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-heron - webarchive
- https://www.proofpoint.com/us/blog/security-briefs/threat-actors-pair-tax-themed-lures-covid-19-healthcare-themes - webarchive
- https://unit42.paloaltonetworks.com/wireshark-tutorial-decrypting-https-traffic/ - webarchive
- https://gaissecurity.com/uploads/csirt/EN-Dridex-banking-trojan.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/log4j-vulnerabilities-attacks - webarchive
- https://adalogics.com/blog/the-state-of-advanced-code-injections - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader/ - webarchive
- https://www.sentinelone.com/wp-content/uploads/2022/02/S1_-SentinelLabs_SanctionsBeDamned_final_02.pdf - webarchive
- https://securelist.com/analysis/publications/78531/dridex-a-history-of-evolution/ - webarchive
- https://www.deepinstinct.com/blog/types-of-dropper-malware-in-microsoft-office - webarchive
- https://news.sophos.com/en-us/2022/02/23/dridex-bots-deliver-entropy-ransomware-in-recent-attacks/ - webarchive
- https://reaqta.com/2020/06/dridex-the-secret-in-a-postmessage/ - webarchive
- https://twitter.com/felixw3000/status/1382614469713530883?s=20 - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process - webarchive
- https://github.com/rad9800/talks/blob/main/MALWARE_MADNESS.pdf - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
- https://www.youtube.com/watch?v=1VB15_HgUkg - webarchive
- https://blog.lexfo.fr/dridex-malware.html - webarchive
- https://votiro.com/blog/anatomy-of-a-well-crafted-ups-fedex-and-dhl-phishing-email-during-covid-19/ - webarchive
- https://assets.sentinelone.com/sentinellabs/sentinellabs_EvilCorp - webarchive
- https://www.welivesecurity.com/2018/01/26/friedex-bitpaymer-ransomware-work-dridex-authors/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf - webarchive
- https://www.cert.ssi.gouv.fr/ioc/CERTFR-2020-IOC-003/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/ - webarchive
- https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/ - webarchive
- https://medium.com/walmartglobaltech/wastedloader-or-dridexloader-4f47c9b3ae77 - webarchive
- https://muha2xmad.github.io/unpacking/dridex/ - webarchive
- https://artik.blue/malware3 - webarchive
- https://aaqeel01.wordpress.com/2021/02/07/dridex-malware-analysis/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-005.pdf - webarchive
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/ - webarchive
- https://www.secureworks.com/research/dridex-bugat-v5-botnet-takeover-operation - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://intel471.com/blog/privateloader-malware - webarchive
- https://www.appgate.com/blog/reverse-engineering-dridex-and-automating-ioc-extraction - webarchive
- https://www.intel471.com/blog/cybercrime-russia-china-iran-nation-state - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DRIFTPIN
Driftpin is a small and simple backdoor that enables the attackers to assess the victim. When executed the trojan connects to a C&C server and receives commands to grab screenshots, enumerate running processes and get information about the system and campaign ID.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DRIFTPIN.
| Known Synonyms |
|---|
Spy.Agent.ORM |
Toshliph |
Internal MISP references
UUID 76f6f047-1362-4651-bd2f-9ca10c119e8d which can be used as unique global reference for DRIFTPIN in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.driftpin - webarchive
- https://www.welivesecurity.com/2015/09/08/carbanak-gang-is-back-and-packing-new-guns/ - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-niagara - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
- https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dripion
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Dripion.
| Known Synonyms |
|---|
Masson |
Internal MISP references
UUID a752676f-06c1-426c-9fcb-6c199afc74af which can be used as unique global reference for Dripion in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DriveOcean
Communicates via Google Drive.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DriveOcean.
| Known Synonyms |
|---|
Google Drive RAT |
Internal MISP references
UUID 730a4e94-4f9b-4f34-a1f3-1c97d341332c which can be used as unique global reference for DriveOcean in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Drokbk
Internal MISP references
UUID b29c0d53-597d-41c9-a1d0-04dbaa4917f8 which can be used as unique global reference for Drokbk in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.drokbk - webarchive
- https://www.microsoft.com/en-us/security/blog/2023/04/18/nation-state-threat-actor-mint-sandstorm-refines-tradecraft-to-attack-high-value-targets/ - webarchive
- https://www.secureworks.com/blog/drokbk-malware-uses-github-as-dead-drop-resolver - webarchive
- https://www.esentire.com/blog/exploitation-of-vmware-horizon-servers-by-tunnelvision-threat-actor - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DropBook
DropBook is a backdoor developed by the Molerats group and first appeared in late 2020. The backdoor abuses Facebook and Dropbox platforms for C2 purposes, where fake Facebook accounts are used by the operators to control the backdoor by posting commands on the accounts.
Internal MISP references
UUID 8c142a72-0efb-4850-b684-bc6b5300f85e which can be used as unique global reference for DropBook in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dropbook - webarchive
- https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf - webarchive
- https://www.cybereason.com/blog/new-malware-arsenal-abusing-cloud-platforms-in-middle-east-espionage-campaign - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DROPSHOT
Internal MISP references
UUID cfdb02f2-a767-4abb-b04c-333a02cdd7e2 which can be used as unique global reference for DROPSHOT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dropshot - webarchive
- https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html - webarchive
- https://www.megabeets.net/decrypting-dropshot-with-radare2-and-cutter-part-2/ - webarchive
- https://www.megabeets.net/decrypting-dropshot-with-radare2-and-cutter-part-1/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dtrack
Dtrack is a Remote Administration Tool (RAT) developed by the Lazarus group. Its core functionality includes operations to upload a file to the victim's computer, download a file from the victim's computer, dump disk volume data, persistence and more.
A variant of Dtrack was found on Kudankulam Nuclear Power Plant (KNPP) which was used for a targeted attack.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Dtrack.
| Known Synonyms |
|---|
Preft |
TroyRAT |
Internal MISP references
UUID 414f95e1-aabe-4aa9-b9be-53e0826f62c1 which can be used as unique global reference for Dtrack in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dtrack - webarchive
- https://media.defense.gov/2023/Feb/09/2003159161/-1/-1/0/CSA_RANSOMWARE_ATTACKS_ON_CI_FUND_DPRK_ACTIVITIES.PDF - webarchive
- https://marcoramilli.com/2019/11/04/is-lazarus-apt38-targeting-critical-infrastructures/ - webarchive
- https://securelist.com/dtrack-targeting-europe-latin-america/107798/ - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revealing-threat-in-the-shadow-by-chi-en-shen-ashley-oleg-bondarenko - webarchive
- https://securelist.com/andariel-deploys-dtrack-and-maui-ransomware/107063/ - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://github.com/jeFF0Falltrades/IoCs/blob/master/APT/dtrack_lazarus_group.md - webarchive
- https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf - webarchive
- https://securelist.com/my-name-is-dtrack/93338/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/stonefly-north-korea-espionage - webarchive
- https://twitter.com/ShadowChasing1/status/1399369260577681426?s=20 - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
- https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/ - webarchive
- https://blog.macnica.net/blog/2020/11/dtrack.html - webarchive
- https://www.cyberbit.com/dtrack-apt-malware-found-in-nuclear-power-plant/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DualToy (Windows)
Internal MISP references
UUID 440daef1-385d-42fd-a714-462590d4ce6b which can be used as unique global reference for DualToy (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DarkHotel
Internal MISP references
UUID 309d0745-bbfd-43bc-b2c4-511592a475bf which can be used as unique global reference for DarkHotel in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dubnium_darkhotel - webarchive
- http://blog.jpcert.or.jp/2016/06/asruex-malware-infecting-through-shortcut-files.html - webarchive
- https://securelist.com/blog/research/71713/darkhotels-attacks-in-2015/ - webarchive
- https://blogs.technet.microsoft.com/mmpc/2016/06/09/reverse-engineering-dubnium-2/3/ - webarchive
- https://www.reuters.com/article/us-health-coronavirus-who-hack-exclusive/exclusive-elite-hackers-target-who-as-coronavirus-cyberattacks-spike-idUSKBN21A3BN - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DUBrute
Internal MISP references
UUID 2236a08f-dfbd-4f92-9d73-a895c34766ad which can be used as unique global reference for DUBrute in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DUCKTAIL
According to Tony Lambert, this is a malware written in .NET. It was observed to be delivered using the .NET Single File deployment feature.
Internal MISP references
UUID 9313d400-2b39-4c0f-a967-554b71a23e70 which can be used as unique global reference for DUCKTAIL in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ducktail - webarchive
- https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html - webarchive
- https://www.f-secure.com/content/dam/labs/docs/WithSecure_Research_DUCKTAIL.pdf - webarchive
- https://www.deepinstinct.com/blog/ducktail-threat-operation-re-emerges-with-new-lnk-powershell-and-other-custom-tactics-to-avoid-detection - webarchive
- https://yoroi.company/research/ducktail-dissecting-a-complex-infection-chain-started-from-social-engineering/ - webarchive
- https://labs.withsecure.com/assets/BlogFiles/Publications/WithSecure_Research_DUCKTAIL.pdf - webarchive
- https://www.zscaler.com/blogs/security-research/look-ducktail - webarchive
- https://forensicitguy.github.io/analyzing-net-core-single-file-ducktail/ - webarchive
- https://labs.withsecure.com/content/dam/labs/docs/WithSecure_Research_DUCKTAIL.pdf - webarchive
- https://www.appgate.com/blog/vietnamese-information-stealer-campaigns-target-professionals-on-linkedin - webarchive
- https://securelist.com/ducktail-fashion-week/111017/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dumador
Internal MISP references
UUID ea59906d-b5e1-4749-8494-9ad9a09510b5 which can be used as unique global reference for Dumador in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DuQu
Internal MISP references
UUID 7344cee0-87c9-46a1-85aa-0d3c8c9c8cc6 which can be used as unique global reference for DuQu in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.duqu - webarchive
- http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet_research.pdf - webarchive
- https://cocomelonc.github.io/tutorial/2022/05/09/malware-pers-4.html - webarchive
- https://docs.broadcom.com/doc/w32-duqu-11-en - webarchive
- https://www.crysys.hu/publications/files/tedi/ukatemicrysys_territorialdispute.pdf - webarchive
- https://web.archive.org/web/20230416140914if_/http://www.chinaview.cn/20230411/4e0fa0f4fd1d408aaddeef8be63a4757/202304114e0fa0f4fd1d408aaddeef8be63a4757_20230411161526_0531.pdf - webarchive
- https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/ - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/10/20114955/Bartholomew-GuerreroSaade-VB2016.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DUSTMAN
In 2019, multiple destructive attacks were observed targeting entities within the Middle East. The National Cyber Security Centre (NCSC), a part of the National Cybersecurity Authority (NCA), detected a new malware named "DUSTMAN" that was detonated on December 29, 2019. Based on analyzed evidence and artifacts found on machines in a victim’s network that were not wiped by the malware. NCSC assess that the threat actor behind the attack had some kind of urgency on executing the files on the date of the attack due to multiple OPSEC failures observed on the infected network. NCSC is calling the malware used in this attack "DUSTMAN" after the filename and string embedded in the malware. "DUSTMAN" can be considered as a new variant of "ZeroCleare" malware, published in December 2019.
Internal MISP references
UUID daa3d1e4-9265-4f1c-b1bd-9242ac570681 which can be used as unique global reference for DUSTMAN in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dustman - webarchive
- https://swapcontext.blogspot.com/2020/01/dustman-apt-art-of-copy-paste.html - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/ - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/ - webarchive
- https://twitter.com/Irfan_Asrar/status/1213544175355908096 - webarchive
- https://www.linkedin.com/posts/iasrar_dustman-report-in-english-activity-6619216346083393537-NV1z/ - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://www.scribd.com/document/442225568/Saudi-Arabia-CNA-report - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Duuzer
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Duuzer.
| Known Synonyms |
|---|
Escad |
Internal MISP references
UUID a5eb921e-17db-46de-a907-09f9ad05a7d7 which can be used as unique global reference for Duuzer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.duuzer - webarchive
- https://www.symantec.com/connect/blogs/wannacry-ransomware-attacks-show-strong-links-lazarus-group - webarchive
- https://www.secureworks.com/research/threat-profiles/nickel-academy - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=5b9850b9-0fdd-48a9-b595-9234207ae7df&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DYEPACK
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DYEPACK.
| Known Synonyms |
|---|
BanSwift |
swift |
Internal MISP references
UUID 8420653b-1412-45a1-9a2d-6aa9b9eaf906 which can be used as unique global reference for DYEPACK in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dyepack - webarchive
- https://web.archive.org/web/20160527050022/https://www.symantec.com/connect/blogs/swift-attackers-malware-linked-more-financial-attacks - webarchive
- https://www.anomali.com/blog/evidence-of-stronger-ties-between-north-korea-and-swift-banking-attacks - webarchive
- https://securelist.com/lazarus-under-the-hood/77908/ - webarchive
- https://media.ccc.de/v/froscon2021-2670-der_cyber-bankraub_von_bangladesch - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://github.com/649/APT38-DYEPACK - webarchive
- https://content.fireeye.com/apt/rpt-apt38 - webarchive
- https://securelist.com/blog/sas/77908/lazarus-under-the-hood/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
DynamicStealer
Dynamic Stealer is a Github Project C# written code by L1ghtN4n. This code collects passwords and uploads these to Telegram. According to Cyble this Eternity Stealer leverages code from this project and also Jester Stealer could be rebranded from it.
Internal MISP references
UUID b8b7b6e3-eef1-43cb-a251-e20a3e57d75e which can be used as unique global reference for DynamicStealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Dyre
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Dyre.
| Known Synonyms |
|---|
Dyreza |
Internal MISP references
UUID 1ecbcd20-f238-47ef-874b-08ef93266395 which can be used as unique global reference for Dyre in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dyre - webarchive
- https://blog.malwarebytes.com/threat-analysis/2015/11/a-technical-look-at-dyreza/ - webarchive
- https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree - webarchive
- https://www.forbes.com/sites/thomasbrewster/2017/05/04/dyre-hackers-stealing-millions-from-american-coporates - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/ - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-blackburn - webarchive
- https://www.fireeye.com/blog/threat-research/2015/07/dyre_banking_trojan.html - webarchive
- https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group - webarchive
- https://research.checkpoint.com/2020/graphology-of-an-exploit-playbit/ - webarchive
- https://www.crowdstrike.com/blog/sin-ful-spiders-wizard-spider-and-lunar-spider-sharing-the-same-web/ - webarchive
- https://www.secureworks.com/research/dyre-banking-trojan - webarchive
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-blackburn - webarchive
- https://www.blueliv.com/downloads/documentation/reports/Network_insights_of_Dyre_and_Dridex_Trojan_bankers.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EagerBee
According to Elastic, EagerBee loads additional capabilities using remotely-downloaded PE files, hosted in C2. However, its implementation and coding practices reveal a lack of advanced skills from the author, relying on basic techniques. During their research, they identified string formatting and underlying behavior that aligns with previous research attributed to a Chinese-speaking threat actor referred to as LuckyMouse (APT27, EmissaryPanda).
Internal MISP references
UUID 20615110-ec2a-4ead-a7e4-cadecf1fa6bc which can be used as unique global reference for EagerBee in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EagleMonitorRAT
This RAT written in C# was derived from HorusEyesRat. It was modified by "Arsium" and published on GitHub. There is also a client builder included. Github Source: https://github.com/arsium/EagleMonitorRAT
Internal MISP references
UUID c2839018-3e2a-44ac-9ad6-60dbc0973918 which can be used as unique global reference for EagleMonitorRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EASYNIGHT
FireEye describes EASYNIGHT is a loader observed used with several malware families, including HIGHNOON and HIGHNOON.LITE. The loader often acts as a persistence mechanism via search order hijacking.
Examples include a patched bcrypt.dll with no other modification than an additional import entry, in the observed case "printwin.dll!gzwrite64" (breaking the file signature).
Internal MISP references
UUID 0277b1e5-ea2d-4dec-bbaa-13e25a2d1f1c which can be used as unique global reference for EASYNIGHT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Easy Stealer
Easy Stealer is a new information stealer written in Golang that is under active development. Since July 2023, the information stealer has been sold on the underground market, advertising a variety of capabilities, such as the ability to target crypto wallets and passwords. Based on VirusTotal data, it appears that developer test samples were uploaded in June 2023. The panel for the stealer is installed on the buyer's own infrastructure, allowing for exclusive control. The stated pricing models are: $35 for 7 days, $115 for 30 days, and $250 for 90 days. Given its user-friendly panel design and the affordable price range, combined with similar capabilities to other information stealers, Easy Stealer is likely to see an increase in distribution among various cyber criminals as it continues through active development.
Internal MISP references
UUID 200c9845-b1d0-4197-85df-b0a9cb78ef6e which can be used as unique global reference for Easy Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EDA2
EDA2 is a successor of HiddenTear. Just like HiddenTear it was developed as an open-source project by a security researcher and published on Github. It was meant as "educational ransomware" and purposefully had flaws in the encryption process that allow decryption of ransomed files.
This backfired, when threat actors began to modify HiddenTear and EDA2 source code. Some modifications introduced bugs where encrypted files were destroyed, others fixed the encryption flaws and made decryption without a key impossible.
Internal MISP references
UUID 24fe5fef-6325-4c21-9c35-a0ecd185e254 which can be used as unique global reference for EDA2 in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.eda2_ransom - webarchive
- https://github.com/utkusen/eda2 - webarchive
- https://www.bleepingcomputer.com/news/security/hidden-tear-ransomware-developer-blackmailed-by-malware-developers-using-his-code/ - webarchive
- https://utkusen.com/blog/im-sorry-for-hidden-tear-eda2 - webarchive
- https://unit42.paloaltonetworks.com/covid-19-themed-cyber-attacks-target-government-and-medical-organizations/ - webarchive
- https://twitter.com/JaromirHorejsi/status/815861135882780673 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Egregor
According to Heimdal, Egregor ransomware infection happens via a loader, then, in the victim’s firewall, it enables the Remote Desktop Protocol. After this part, the malware is free to move inside the victim’s network, identifying and disabling all the antivirus software it can find. The next step is the encryption of the data and the insertion of a ransom note named “RECOVER-FILES.txt” in all the compromised folders.
Internal MISP references
UUID cd84bc53-8684-4921-89c7-2cf49512bf61 which can be used as unique global reference for Egregor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.egregor - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.morphisec.com/hubfs/eBooks_and_Whitepapers/EGREGOR%20REPORT%20WEB%20FINAL.pdf - webarchive
- https://blog.malwarebytes.com/ransomware/2020/12/threat-profile-egregor-ransomware-is-making-a-name-for-itself/ - webarchive
- https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound - webarchive
- https://id-ransomware.blogspot.com/2020/09/egregor-ransomware.html - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://ke-la.com/zooming-into-darknet-threats-targeting-jp-orgs-kela/ - webarchive
- https://blog.emsisoft.com/en/37810/ransomware-profile-egregor/ - webarchive
- https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone/ - webarchive
- https://news.sophos.com/en-us/2020/12/08/egregor-ransomware-mazes-heir-apparent/ - webarchive
- https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/ - webarchive
- https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/ - webarchive
- https://ssu.gov.ua/en/novyny/sbu-zablokuvala-diialnist-transnatsionalnoho-khakerskoho-uhrupovannia - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/evolving-danger-ransomware-extortion - webarchive
- https://twitter.com/redcanary/status/1334224861628039169 - webarchive
- https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/lockbit-ransomware-now-encrypts-windows-domains-using-group-policies/ - webarchive
- https://www.bleepingcomputer.com/news/security/metro-vancouvers-transit-system-hit-by-egregor-ransomware/ - webarchive
- https://www.trendmicro.com/en_us/research/20/l/egregor-ransomware-launches-string-of-high-profile-attacks-to-en.html - webarchive
- https://areteir.com/wp-content/uploads/2021/01/01182021_Egregor_Insight.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/ransomware-dev-releases-egregor-maze-master-decryption-keys/ - webarchive
- https://www.trendmicro.com/en_us/research/21/c/egregor-ransomware-cartel-members-arrested.html - webarchive
- https://www.group-ib.com/blog/egregor - webarchive
- https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/ - webarchive
- https://securelist.com/targeted-ransomware-encrypting-data/99255/ - webarchive
- https://www.bleepingcomputer.com/news/security/barnes-and-noble-hit-by-egregor-ransomware-strange-data-leaked/ - webarchive
- https://web.archive.org/web/20201207094648/https://go.group-ib.com/rs/689-LRE-818/images/Group-IB_Egregor_Ransomware.pdf - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2020-1203.pdf - webarchive
- https://therecord.media/frances-lead-cybercrime-investigator-on-the-egregor-arrests-cybercrime/ - webarchive
- https://blog.bushidotoken.net/2022/05/gamer-cheater-hacker-spy.html - webarchive
- https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-007/ - webarchive
- https://www.hornetsecurity.com/en/threat-research/qakbot-reducing-its-on-disk-artifacts/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-009.pdf - webarchive
- https://blog.talosintelligence.com/2021/03/ctir-trends-winter-2020-21.html - webarchive
- https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://blog.chainalysis.com/reports/ransomware-connections-maze-egregor-suncrypt-doppelpaymer - webarchive
- https://www.bleepingcomputer.com/news/security/maze-ransomware-is-shutting-down-its-cybercrime-operation/ - webarchive
- https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware - webarchive
- https://www.bleepingcomputer.com/news/security/kmart-nationwide-retailer-suffers-a-ransomware-attack/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/darkside-ransomware-made-90-million-in-just-nine-months/ - webarchive
- https://www.domaintools.com/resources/blog/the-most-prolific-ransomware-families-a-defenders-guide - webarchive
- https://www.bleepingcomputer.com/news/security/retail-giant-cencosud-hit-by-egregor-ransomware-attack-stores-impacted/ - webarchive
- https://www.bleepingcomputer.com/news/security/translink-confirms-ransomware-data-theft-still-restoring-systems/ - webarchive
- https://www.cybereason.com/blog/cybereason-vs-egregor-ransomware - webarchive
- https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox - webarchive
- https://blog.minerva-labs.com/egregor-ransomware-an-in-depth-analysis - webarchive
- https://securityboulevard.com/2020/10/egregor-sekhmets-cousin/ - webarchive
- https://intel471.com/blog/egregor-arrests-ukraine-sbu-maze-ransomware - webarchive
- https://therecord.media/ransomwhere-project-wants-to-create-a-database-of-past-ransomware-payments/ - webarchive
- https://unit42.paloaltonetworks.com/egregor-ransomware-courses-of-action/ - webarchive
- https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-009/ - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel - webarchive
- https://securityintelligence.com/posts/egregor-ransomware-negotiations-uncovered/ - webarchive
- https://www.appgate.com/news-press/appgate-labs-analyzes-new-family-of-ransomware-egregor - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://www.bleepingcomputer.com/news/security/crytek-confirms-egregor-ransomware-attack-customer-data-theft/ - webarchive
- https://www.intrinsec.com/egregor-prolock/ - webarchive
- https://www.zdnet.com/article/ubisoft-crytek-data-posted-on-ransomware-gangs-site/ - webarchive
- https://www.bleepingcomputer.com/news/security/largest-global-staffing-agency-randstad-hit-by-egregor-ransomware/ - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://securityaffairs.co/wordpress/127826/malware/egregor-sekhmet-decryption-keys.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EHDevel
Internal MISP references
UUID 257da597-7e6d-4405-9b10-b4206bb013ca which can be used as unique global reference for EHDevel in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ekipa RAT
Internal MISP references
UUID 791a0902-7541-444a-a75e-19be97545917 which can be used as unique global reference for Ekipa RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ELECTRICFISH
The application is a command-line utility and its primary purpose is to tunnel traffic between two IP addresses. The application accepts command-line arguments allowing it to be configured with a destination IP address and port, a source IP address and port, a proxy IP address and port, and a user name and password, which can be utilized to authenticate with a proxy server. It will attempt to establish TCP sessions with the source IP address and the destination IP address. If a connection is made to both the source and destination IPs, this malicious utility will implement a custom protocol, which will allow traffic to rapidly and efficiently be tunneled between two machines. If necessary, the malware can authenticate with a proxy to be able to reach the destination IP address. A configured proxy server is not required for this utility.
Internal MISP references
UUID 0f5a2ce1-b44f-4088-a4c0-04456a90c174 which can be used as unique global reference for ELECTRICFISH in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.electricfish - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://adeo.com.tr/wp-content/uploads/2020/05/ADEO-Lazarus-APT38.pdf - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://www.us-cert.gov/ncas/analysis-reports/AR19-129A - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ElectricPowder
Internal MISP references
UUID 31b18d64-815c-4464-8fcc-f084953a75f5 which can be used as unique global reference for ElectricPowder in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Elirks
Elirks is a basic backdoor Trojan, first discovered in 2010, that is primarily used to steal information from compromised systems. Mostly attacks using Elirks occurring in East Asia. One of the unique features of the malware is that it retrieves its C2 address by accessing a pre-determined microblog service or SNS. Attackers create accounts on those services and post encoded IP addresses or the domain names of real C2 servers in advance of distributing the backdoor. Multiple Elirks variants using Japanese blog services for the last couple of years.
Internal MISP references
UUID eb189fd3-ca39-4bc7-be2d-4ea9e89d9ab9 which can be used as unique global reference for Elirks in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.elirks - webarchive
- https://researchcenter.paloaltonetworks.com/2016/09/mile-tea-cyber-espionage-campaign-targets-asia-pacific-businesses-and-government-agencies/ - webarchive
- https://unit42.paloaltonetworks.com/unit42-tracking-elirks-variants-in-japan-similarities-to-previous-attacks/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Elise
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Elise.
| Known Synonyms |
|---|
EVILNEST |
Internal MISP references
UUID 3477a25d-e04b-475e-8330-39f66c10cc01 which can be used as unique global reference for Elise in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.elise - webarchive
- https://www.accenture.com/t20180127T003755Z__w__/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf - webarchive
- https://researchcenter.paloaltonetworks.com/2016/02/emissary-trojan-changelog-did-operation-lotus-blossom-cause-it-to-evolve/ - webarchive
- https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries - webarchive
- https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf - webarchive
- https://www.joesecurity.org/blog/8409877569366580427 - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-elgin - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://www.fireeye.com/blog/threat-research/2020/04/code-grafting-to-unpack-malware-in-emulation.html - webarchive
- https://documents.trendmicro.com/assets/threat-reports/rpt-1h-2014-targeted-attack-trends-in-asia-pacific.pdf - webarchive
- https://securelist.com/blog/research/70726/the-spring-dragon-apt/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ElizaRAT
Internal MISP references
UUID c13fc723-0fd8-4e27-b1d7-a71976ad0268 which can be used as unique global reference for ElizaRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
El Machete APT Backdoor Dropper
This dropper masquerades itself as Adobe software, titled as Adobe.msi. It is used to executes the python written Backdoor used by this threat actor.
Internal MISP references
UUID 66b8cbdc-6190-4568-b615-0ae8a51d2148 which can be used as unique global reference for El Machete APT Backdoor Dropper in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ELMER
ELMER is a non-persistent proxy-aware HTTP backdoor written in Delphi, and is capable of performing file uploads and downloads, file execution, and process and directory listings. To retrieve commands, ELMER sends HTTP GET requests to a hard-coded CnC server, and parses the HTTP response packets received from the CnC server for an integer string corresponding to the command that needs to be executed.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ELMER.
| Known Synonyms |
|---|
Elmost |
Internal MISP references
UUID e0a8bb01-f0c8-4e2c-bd1e-4c84135ba834 which can be used as unique global reference for ELMER in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.elmer - webarchive
- https://attack.mitre.org/software/S0064 - webarchive
- https://www.symantec.com/security-center/writeup/2015-122210-5724-99 - webarchive
- https://attack.mitre.org/groups/G0023 - webarchive
- https://cybergeeks.tech/a-detailed-analysis-of-elmer-backdoor-used-by-apt16/ - webarchive
- https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Emdivi
Internal MISP references
UUID 6bf7aa6a-3003-4222-805e-776cb86dc78a which can be used as unique global reference for Emdivi in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.emdivi - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/attackers-target-organizations-in-japan-transform-local-sites-into-cc-servers-for-emdivi-backdoor/ - webarchive
- https://www.macnica.net/file/security_report_20160613.pdf - webarchive
- https://securelist.com/new-activity-of-the-blue-termite-apt/71876/ - webarchive
- http://blog.jpcert.or.jp/2015/11/decrypting-strings-in-emdivi.html - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/chessmaster-cyber-espionage-campaign/ - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/05/vb2019-paper-apt-cases-exploiting-vulnerabilities-regionspecific-software/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Emissary
Internal MISP references
UUID a171f40a-85eb-4b64-af1d-8860a49b3b40 which can be used as unique global reference for Emissary in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Emotet
While Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets. It is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time. Emotet had been taken down by authorities in January 2021, though it appears to have sprung back to life in November 2021.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Emotet.
| Known Synonyms |
|---|
Geodo |
Heodo |
Internal MISP references
UUID d29eb927-d53d-4af2-b6ce-17b3a1b34fe7 which can be used as unique global reference for Emotet in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-botnet/ - webarchive
- https://blogs.vmware.com/security/2022/08/how-to-replicate-emotet-lateral-movement.html - webarchive
- https://www.cyberscoop.com/trickbot-shutdown-conti-emotet/ - webarchive
- https://unit42.paloaltonetworks.com/domain-parking/ - webarchive
- https://hello.global.ntt/en-us/insights/blog/behind-the-scenes-of-the-emotet-infrastructure - webarchive
- https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/ - webarchive
- https://www.binarydefense.com/emocrash-exploiting-a-vulnerability-in-emotet-malware-for-defense/ - webarchive
- https://www.bleepingcomputer.com/news/security/emotet-malware-now-installs-via-powershell-in-windows-shortcut-files/ - webarchive
- https://www.fortinet.com/blog/threat-research/deep-dive-into-emotet-malware.html - webarchive
- https://blogs.vmware.com/security/2022/03/emotet-c2-configuration-extraction-and-analysis.html - webarchive
- https://www.bleepingcomputer.com/news/security/microsoft-emotet-took-down-a-network-by-overheating-all-computers/ - webarchive
- https://www.seqrite.com/blog/the-return-of-the-emotet-as-the-world-unlocks/ - webarchive
- https://twitter.com/raashidbhatt/status/1237853549200936960 - webarchive
- https://experience.mandiant.com/trending-evil-2/p/1 - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/new-emotet-hijacks-windows-api-evades-sandbox-analysis/ - webarchive
- https://www.welivesecurity.com/2018/11/09/emotet-launches-major-new-spam-campaign/ - webarchive
- https://threatconnect.com/blog/threatconnect-research-roundup-probable-sandworm-infrastructure - webarchive
- https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_workshop_malware-analysis_jp.pdf - webarchive
- https://cofense.com/blog/emotet-sending-malicious-emails-after-three-month-hiatus/ - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf - webarchive
- https://www.tagesschau.de/investigativ/br-recherche/emotet-schadsoftware-103.html - webarchive
- https://securelist.com/financial-cyberthreats-in-2020/101638/ - webarchive
- https://www.blueliv.com/blog/research/where-is-emotet-latest-geolocation-data/ - webarchive
- https://www.govcert.admin.ch/blog/36/severe-ransomware-attacks-against-swiss-smes - webarchive
- https://r3mrum.wordpress.com/2021/01/05/manual-analysis-of-new-powersplit-maldocs-delivering-emotet/ - webarchive
- https://www.netskope.com/blog/you-can-run-but-you-cant-hide-advanced-emotet-updates - webarchive
- https://www.inde.nz/blog/analysis-of-the-latest-wave-of-emotet-malicious-documents - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://cyber.wtf/2021/11/15/guess-whos-back/ - webarchive
- https://unit42.paloaltonetworks.com/emotet-command-and-control/ - webarchive
- https://isc.sans.edu/diary/rss/27036 - webarchive
- https://medium.com/@0xd0cf11e/analyzing-emotet-with-ghidra-part-1-4da71a5c8d69 - webarchive
- https://www.intezer.com/blog/malware-analysis/how-threat-actors-abuse-lnk-files/ - webarchive
- https://github.com/cecio/EMOTET-2020-Reversing - webarchive
- https://therecord.media/over-780000-email-accounts-compromised-by-emotet-have-been-secured/ - webarchive
- https://www.atomicmatryoshka.com/post/malware-headliners-emotet - webarchive
- https://www.netresec.com/?page=Blog&month=2022-05&post=Emotet-C2-and-Spam-Traffic-Video - webarchive
- https://www.hornetsecurity.com/en/threat-research/comeback-emotet/ - webarchive
- https://threatpost.com/emotet-spreading-malicious-excel-files/178444/ - webarchive
- https://www.fortinet.com/blog/threat-research/ms-office-files-involved-again-in-recent-emotet-trojan-campaign-part-ii - webarchive
- https://twitter.com/eduardfir/status/1461856030292422659 - webarchive
- https://portswigger.net/daily-swig/emotet-trojan-implicated-in-wolverine-solutions-ransomware-attack - webarchive
- https://isc.sans.edu/forums/diary/Emotet%20infection%20with%20Cobalt%20Strike/28824/ - webarchive
- https://www.youtube.com/watch?v=_BLOmClsSpc - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/emotet-tests-new-delivery-techniques - webarchive
- https://forensicitguy.github.io/emotet-excel4-macro-analysis/ - webarchive
- https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/ - webarchive
- https://isc.sans.edu/diary/28044 - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker - webarchive
- https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2.html - webarchive
- https://resource.redcanary.com/rs/003-YRU-314/images/2021-Threat-Detection-Report.pdf - webarchive
- https://blogs.jpcert.or.jp/en/2021/02/emotet-notice.html - webarchive
- https://www.trendmicro.com/en_us/research/22/e/bruised-but-not-broken--the-resurgence-of-the-emotet-botnet-malw.html - webarchive
- https://community.riskiq.com/article/2cd1c003 - webarchive
- https://cocomelonc.github.io/persistence/2023/12/10/malware-pers-23.html - webarchive
- https://mirshadx.wordpress.com/2020/11/22/analyzing-an-emotet-dropper-and-writing-a-python-script-to-statically-unpack-payload/ - webarchive
- https://www.deepinstinct.com/blog/the-re-emergence-of-emotet - webarchive
- https://www.heise.de/ct/artikel/Was-Emotet-anrichtet-und-welche-Lehren-die-Opfer-daraus-ziehen-4665958.html - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/emotet-makes-timely-adoption-political-and-elections-lures - webarchive
- https://adalogics.com/blog/the-state-of-advanced-code-injections - webarchive
- https://www.welivesecurity.com/2022/06/16/how-emotet-is-changing-tactics-microsoft-tightening-office-macro-security/ - webarchive
- https://www.picussecurity.com/blog/emotet-technical-analysis-part-2-powershell-unveiled - webarchive
- https://www.vmware.com/content/dam/learn/en/amer/fy23/pdf/1669005_Emotet_Exposed_A_Look_Inside_the_Cybercriminal_Supply_Chain.pdf - webarchive
- https://blog.talosintelligence.com/emotet-switches-to-onenote/ - webarchive
- https://www.hornetsecurity.com/en/security-information/emotet-is-back/ - webarchive
- https://www.berlin.de/sen/justva/presse/pressemitteilungen/2020/pm-11-2020-t-systems-forensik_bericht_public_v1.pdf - webarchive
- https://blog.vincss.net/2021/01/re019-from-a-to-x-analyzing-some-real-cases-which-used-recent-Emotet-samples.html - webarchive
- https://www.intezer.com/mitigating-emotet-the-most-common-banking-trojan/ - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf - webarchive
- https://notes.netbytesec.com/2022/02/technical-malware-analysis-return-of.html - webarchive
- https://www.fortinet.com/blog/threat-research/Trends-in-the-recent-emotet-maldoc-outbreak - webarchive
- https://securelist.com/emotet-darkgate-lokibot-crimeware-report/110286/ - webarchive
- https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2020.pdf?__blob=publicationFile&v=2 - webarchive
- https://www.binarydefense.com/emotet-evolves-with-new-wi-fi-spreader/ - webarchive
- https://www.dragos.com/blog/industry-news/suspected-conti-ransomware-activity-in-the-auto-manufacturing-sector/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/rise-of-lnk-shortcut-files-malware/ - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-110a - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-003.pdf - webarchive
- https://dissectingmalwa.re/return-of-the-mummy-welcome-back-emotet.html - webarchive
- https://threatresearch.ext.hp.com/wp-content/uploads/2022/05/HP-Wolf-Security-Threat-Insights-Report-Q1-2022.pdf - webarchive
- https://krebsonsecurity.com/2021/01/international-action-targets-emotet-crimeware - webarchive
- https://www.youtube.com/watch?v=_mGMJFNJWSk - webarchive
- https://lokalhost.pl/txt/peering.into.spam.botnets.VirusBulletin2017.pdf - webarchive
- https://blog.virustotal.com/2020/11/using-similarity-to-expand-context-and.html - webarchive
- https://blog.intel471.com/2020/04/14/understanding-the-relationship-between-emotet-ryuk-and-trickbot/ - webarchive
- https://www.zdnet.com/article/meet-the-white-hat-group-fighting-emotet-the-worlds-most-dangerous-malware/ - webarchive
- https://securelist.com/the-chronicles-of-emotet/99660/ - webarchive
- https://cyber.wtf/2022/03/23/what-the-packer/ - webarchive
- https://www.bleepingcomputer.com/news/security/emotet-now-drops-cobalt-strike-fast-forwards-ransomware-attacks/ - webarchive
- https://www.telekom.com/en/blog/group/article/cybersecurity-dissecting-emotet-part-two-596128 - webarchive
- https://www.lac.co.jp/lacwatch/people/20201106_002321.html - webarchive
- https://paste.cryptolaemus.com - webarchive
- https://www.cert.pl/en/news/single/analysis-of-emotet-v4/ - webarchive
- https://www.cert.pl/en/news/single/whats-up-emotet/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf - webarchive
- https://blogs.blackberry.com/en/2023/01/emotet-returns-with-new-methods-of-evasion - webarchive
- https://news.sophos.com/en-us/2022/05/04/attacking-emotets-control-flow-flattening/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/comprehensive-look-emotets-fall-2022-return - webarchive
- https://www.picussecurity.com/blog/picus-10-critical-mitre-attck-techniques-t1055-process-injection - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://www.deepinstinct.com/2020/08/12/why-emotets-latest-wave-is-harder-to-catch-than-ever-before/ - webarchive
- https://www.botconf.eu/wp-content/uploads/2019/12/B2019-OReilly-Jarvis-End-to-end-Botnet-Monitoring.pdf - webarchive
- https://blog.malwarebytes.com/botnets/2019/09/emotet-is-back-botnet-springs-back-to-life-with-new-spam-campaign/ - webarchive
- https://cofense.com/flash-bulletin-emotet-epoch-1-changes-c2-communication/ - webarchive
- https://www.cert.ssi.gouv.fr/alerte/CERTFR-2020-ALE-019/ - webarchive
- https://thehackernews.com/2022/02/trickbot-gang-likely-shifting.html - webarchive
- https://www.deepinstinct.com/2021/05/26/deep-dive-packing-software-cryptone/ - webarchive
- https://spamauditor.org/2020/10/the-many-faces-of-emotet/ - webarchive
- https://blogs.vmware.com/security/2022/05/emotet-config-redux.html - webarchive
- https://threatconnect.com/blog/research-roundup-activity-on-previously-identified-apt33-domains/ - webarchive
- https://www.lac.co.jp/lacwatch/alert/20211119_002801.html - webarchive
- https://www.hornetsecurity.com/en/security-informationen-en/webshells-powering-emotet/ - webarchive
- https://security-soup.net/quick-post-spooky-new-powershell-obfuscation-in-emotet-maldocs/ - webarchive
- https://www.youtube.com/watch?v=5_-oR_135ss - webarchive
- https://unit42.paloaltonetworks.com/c2-traffic/ - webarchive
- https://www.zscaler.com/blogs/security-research/return-emotet-malware-analysis - webarchive
- https://forensicitguy.github.io/shortcut-to-emotet-ttp-change/ - webarchive
- https://persianov.net/emotet-malware-analysis-part-1 - webarchive
- https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta542-banker-malware-distribution-service - webarchive
- https://www.youtube.com/watch?v=8PHCZdpNKrw - webarchive
- https://www.zscaler.com/blogs/research/emotet-back-action-after-short-break - webarchive
- https://www.telekom.com/en/blog/group/article/cybersecurity-dissecting-emotet-part-one-592612 - webarchive
- https://kienmanowar.wordpress.com/2022/12/19/z2abimonthly-malware-challege-emotet-back-from-the-dead/ - webarchive
- https://malfind.com/index.php/2018/07/23/deobfuscating-emotets-powershell-payload/ - webarchive
- https://ibm.ent.box.com/s/hs5pcayhbbhjvj8di5sqdpbbd88tsh89 - webarchive
- https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction - webarchive
- https://www.binarydefense.com/emotet-wi-fi-spreader-upgraded/ - webarchive
- https://www.netskope.com/blog/emotet-new-delivery-mechanism-to-bypass-vba-protection - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://research.loginsoft.com/threat-research/from-innocence-to-malice-the-onenote-malware-campaign-uncovered/ - webarchive
- https://hatching.io/blog/powershell-analysis - webarchive
- https://medium.com/@Ilandu/emotet-unpacking-35bbe2980cfb - webarchive
- https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf - webarchive
- https://securelist.com/emotet-modules-and-recent-attacks/106290/ - webarchive
- https://www.cyren.com/blog/articles/example-analysis-of-multi-component-malware - webarchive
- https://de.darktrace.com/blog/emotet-resurgence-cross-industry-campaign-analysis - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader/ - webarchive
- https://www.welivesecurity.com/2023/07/06/whats-up-with-emotet/ - webarchive
- https://isc.sans.edu/forums/diary/Emotet+Stops+Using+0000+in+Spambot+Traffic/28270/ - webarchive
- https://blog.bushidotoken.net/2022/04/lessons-from-conti-leaks.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/exploring-emotet-examining-emotets-activities-infrastructure/ - webarchive
- https://www.bleepingcomputer.com/news/security/united-nations-targeted-with-emotet-malware-phishing-attack/ - webarchive
- https://pl-v.github.io/plv/posts/Emotet-unpacking/ - webarchive
- https://www.symantec.com/blogs/threat-intelligence/evolution-emotet-trojan-distributor - webarchive
- https://www.trendmicro.com/en_no/research/23/c/emotet-returns-now-adopts-binary-padding-for-evasion.html - webarchive
- https://www.gdata.de/blog/2017/10/30110-emotet-beutet-outlook-aus - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_0_JPCERT_en.pdf - webarchive
- https://github.com/d00rt/emotet_research - webarchive
- https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-ii-the-office/ - webarchive
- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/comprehensive-look-emotets-summer-2020-return - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://www.fortinet.com/blog/threat-research/bad-actors-capitalize-current-events-email-scams - webarchive
- https://www.infosecurity-magazine.com/blogs/a-rundown-of-the-emotet-malware/ - webarchive
- https://blogs.vmware.com/networkvirtualization/2022/01/emotet-is-not-dead-yet.html/ - webarchive
- https://www.dsih.fr/article/4483/emotet-de-retour-poc-exchange-0-day-windows-a-quelle-sauce-les-attaquants-prevoient-de-nous-manger-cette-semaine.html - webarchive
- https://unit42.paloaltonetworks.com/emotet-malware-summary-epoch-4-5/ - webarchive
- https://marcoramilli.com/2019/10/14/is-emotet-gang-targeting-companies-with-external-soc/ - webarchive
- https://infosecwriteups.com/unpacking-emotet-trojan-dac7e6119a0a - webarchive
- https://blog.malwarebytes.com/threat-analysis/2021/01/cleaning-up-after-emotet-the-law-enforcement-file/ - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.cronup.com/la-botnet-de-emotet-reinicia-ataques-en-chile-y-latinoamerica/ - webarchive
- https://www.us-cert.gov/ncas/alerts/TA18-201A - webarchive
- https://www.kroll.com/en/insights/publications/cyber/monitor/emotet-analysis-new-lnk-in-the-infection-chain - webarchive
- https://www.anomali.com/blog/mummy-spiders-emotet-malware-is-back-after-a-year-hiatus-wizard-spiders-trickbot-observed-in-its-return - webarchive
- https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmwcb-report-modern-bank-heists-2020.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/emotet-malware-hits-lithuanias-national-public-health-center/ - webarchive
- https://cdn.www.carbonblack.com/wp-content/uploads/2020/05/VMWCB-Report-Modern-Bank-Heists-2020.pdf - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://isc.sans.edu/forums/diary/Emotet+infections+and+followup+malware/24532/ - webarchive
- https://www.bitsight.com/blog/emotet-smb-spreader-back - webarchive
- https://www.trendmicro.com/en_us/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict.html - webarchive
- https://www.hornetsecurity.com/en/security-information/emotet-update-increases-downloads/ - webarchive
- https://www.heise.de/security/artikel/Emotet-Trickbot-Ryuk-ein-explosiver-Malware-Cocktail-4573848.html - webarchive
- https://threatresearch.ext.hp.com/wp-content/uploads/2021/03/HP_Bromium_Threat_Insights_Report_Q4_2020.pdf - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/geofenced-amazon-japan-credential-phishing-volumes-rival-emotet - webarchive
- https://www.cert.govt.nz/it-specialists/advisories/emotet-malware-being-spread-via-email/ - webarchive
- https://blog.reversinglabs.com/blog/conversinglabs-ep-2-conti-pivots-as-ransomware-as-a-service-struggles - webarchive
- https://www.fortinet.com/blog/threat-research/ms-office-files-involved-in-emotet-trojan-campaign-pt-one - webarchive
- https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html - webarchive
- https://notes.netbytesec.com/2021/02/deobfuscating-emotet-macro-and.html - webarchive
- https://www.hornetsecurity.com/en/security-information/awaiting-the-inevitable-return-of-emotet/ - webarchive
- https://thedfirreport.com/2022/09/12/dead-or-alive-an-emotet-story/ - webarchive
- https://cert.grnet.gr/en/blog/reverse-engineering-emotet/ - webarchive
- https://www.secureworks.com/blog/gold-ulrick-leaks-reveal-organizational-structure-and-relationships - webarchive
- https://www.vmray.com/cyber-security-blog/malware-analysis-spotlight-emotets-use-of-cryptography/ - webarchive
- https://intezer.com/blog/intezer-analyze/fantastic-payloads-and-where-we-find-them - webarchive
- https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://www.eurojust.europa.eu/worlds-most-dangerous-malware-emotet-disrupted-through-global-action - webarchive
- https://www.esentire.com/blog/increase-in-emotet-activity-and-cobalt-strike-deployment - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html - webarchive
- https://www.trendmicro.com/en_us/research/22/a/emotet-spam-abuses-unconventional-ip-address-formats-spread-malware.html - webarchive
- https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree - webarchive
- https://thehackernews.com/2022/02/notorious-trickbot-malware-gang-shuts.html - webarchive
- https://medium.com/brim-securitys-knowledge-funnel/hunting-emotet-with-brim-and-zeek-1000c2f5c1ff - webarchive
- https://www.advintel.io/post/corporate-loader-emotet-history-of-x-project-return-for-ransomware - webarchive
- https://blogs.jpcert.or.jp/en/2019/12/emotetfaq.html - webarchive
- https://blog.malwarebytes.com/trojans/2020/07/long-dreaded-emotet-has-returned/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-010.pdf - webarchive
- https://feodotracker.abuse.ch/?filter=version_e - webarchive
- https://unit42.paloaltonetworks.com/wireshark-tutorial-emotet-infection/ - webarchive
- https://persianov.net/emotet-malware-analysis-part-2 - webarchive
- https://www.esentire.com/security-advisories/emotet-activity-identified - webarchive
- https://medium.com/threat-intel/emotet-dangerous-malware-keeps-on-evolving-ac84aadbb8de - webarchive
- https://www.bleepingcomputer.com/news/security/emotet-malware-attacks-return-after-three-month-break/ - webarchive
- https://www.digitalshadows.com/blog-and-research/how-cybercriminals-are-taking-advantage-of-covid-19-scams-fraud-misinformation/ - webarchive
- https://www.tgsoft.it/files/report/download.asp?id=7481257469 - webarchive
- https://blogs.vmware.com/security/2022/05/emotet-moves-to-64-bit-and-updates-its-loader.html - webarchive
- https://blog.talosintelligence.com/2020/11/emotet-2020.html - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://intel471.com/blog/conti-emotet-ransomware-conti-leaks - webarchive
- https://exchange.xforce.ibmcloud.com/collection/18f373debc38779065a26f1958dc260b - webarchive
- https://www.youtube.com/watch?v=q8of74upT_g - webarchive
- https://www.picussecurity.com/blog/emotet-technical-analysis-part-1-reveal-the-evil-code - webarchive
- https://research.checkpoint.com/2023/following-the-scent-of-trickgate-6-year-old-packer-used-to-deploy-the-most-wanted-malware/ - webarchive
- https://www.checkpoint.com/press/2022/march-2022s-most-wanted-malware-easter-phishing-scams-help-emotet-assert-its-dominance/ - webarchive
- https://intezer.com/blog/research/how-hackers-use-binary-padding-to-outsmart-sandboxes/ - webarchive
- https://www.deepinstinct.com/2020/10/12/why-emotets-latest-wave-is-harder-to-catch-than-ever-before-part-2/ - webarchive
- https://intel471.com/blog/emotet-takedown-2021/ - webarchive
- https://www.deepinstinct.com/blog/types-of-dropper-malware-in-microsoft-office - webarchive
- https://www.advintel.io/post/advintel-s-state-of-emotet-aka-spmtools-displays-over-million-compromised-machines-through-2022 - webarchive
- https://www.hornetsecurity.com/en/threat-research/emotet-botnet-takedown/ - webarchive
- https://resecurity.com/blog/article/shortcut-based-lnk-attacks-delivering-malicious-code-on-the-rise - webarchive
- https://speakerdeck.com/fr0gger/x-ray-of-malware-evasion-techniques-analysis-dissection-cure - webarchive
- https://www.spamhaus.com/custom-content/uploads/2021/04/Botnet-update-Q1-2021.pdf - webarchive
- https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol - webarchive
- https://research.checkpoint.com/emotet-tricky-trojan-git-clones/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://www.spamhaus.org/news/article/783/emotet-adds-a-further-layer-of-camouflage - webarchive
- https://www.bitsight.com/blog/emotet-botnet-rises-again - webarchive
- https://github.com/mauronz/binja-emotet - webarchive
- https://asec.ahnlab.com/en/33600/ - webarchive
- https://blog.kryptoslogic.com/malware/2018/10/31/emotet-email-theft.html - webarchive
- https://d00rt.github.io/emotet_network_protocol/ - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-all-paths-lead-to-cobalt-strike-icedid-emotet-and-qbot - webarchive
- https://muha2xmad.github.io/unpacking/emotet-part-2/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf - webarchive
- https://www.wiwo.de/my/technologie/digitale-welt/emotet-netzwerk-wie-eines-der-groessten-hacker-netzwerke-der-welt-lahmgelegt-wurde/27164048.html - webarchive
- https://blog.lumen.com/emotet-redux/ - webarchive
- https://www.youtube.com/watch?v=EyDiIAt__dI - webarchive
- https://twitter.com/Cryptolaemus1/status/1516535343281025032 - webarchive
- https://blog.prevailion.com/wizard-spider-continues-to-confound-4298370f6903 - webarchive
- https://team-cymru.com/blog/2021/01/27/taking-down-emotet/ - webarchive
- https://www.cynet.com/attack-techniques-hands-on/new-wave-of-emotet-when-project-x-turns-into-y/ - webarchive
- https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/ - webarchive
- https://www.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revealing-threat-in-the-shadow-by-chi-en-shen-ashley-oleg-bondarenko - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2021/11/trickbot-helps-emotet-come-back-from-the-dead/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://news.sophos.com/en-us/2020/07/28/emotets-return-is-the-canary-in-the-coal-mine/?cmp=30728 - webarchive
- https://blog.talosintelligence.com/2020/02/coronavirus-themed-malware.html - webarchive
- https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ - webarchive
- https://hello.global.ntt/en-us/insights/blog/emotet-disruption-europol-counterattack - webarchive
- https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-february-mummy-spider/ - webarchive
- https://www.bleepingcomputer.com/news/security/emotet-malware-now-steals-your-email-attachments-to-attack-contacts/ - webarchive
- https://www.youtube.com/watch?v=AkZ5TYBqcU4 - webarchive
- https://www.jpcert.or.jp/english/at/2019/at190044.html - webarchive
- https://www.politie.nl/nieuws/2021/februari/17/politie-bestrijdt-cybercrime-via-nederlandse-infrastructuur.html - webarchive
- https://blogs.cisco.com/security/emotet-is-back - webarchive
- https://www.netskope.com/blog/netskope-threat-coverage-the-return-of-emotet - webarchive
- http://ropgadget.com/posts/defensive_pcres.html - webarchive
- https://www.microsoft.com/security/blog/2021/02/01/what-tracking-an-attacker-email-infrastructure-tells-us-about-persistent-cybercriminal-operations/ - webarchive
- https://blog.nviso.eu/2022/03/23/hunting-emotet-campaigns-with-kusto/ - webarchive
- https://www.bka.de/DE/Presse/Listenseite_Pressemitteilungen/2021/Presse2021/210127_pmEmotet.html - webarchive
- https://kienmanowar.wordpress.com/2022/01/23/quicknote-emotet-epoch4-epoch5-tactics/ - webarchive
- https://www.zeit.de/digital/2021-06/cybercrime-extortion-internet-spyware-ransomware-police-prosecution-hackers - webarchive
- https://www.bleepingcomputer.com/news/security/emotet-trickbot-malware-duo-is-back-infecting-windows-machines/ - webarchive
- https://cocomelonc.github.io/tutorial/2022/04/20/malware-pers-1.html - webarchive
- https://medium.com/@Ilandu/emotet-campaign-6f240f7a5ed5 - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-crestwood - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/q4-2020-threat-report-quarterly-analysis-cybersecurity-trends-tactics-and-themes - webarchive
- https://www.proofpoint.com/us/threat-insight/post/holiday-lull-not-so-much - webarchive
- https://blogs.vmware.com/networkvirtualization/2022/02/emotet-is-not-dead-yet-part-2.html/ - webarchive
- https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://web.archive.org/web/20211223100528/https://cloudsek.com/emotet-2-0-everything-you-need-to-know-about-the-new-variant-of-thbanking-trojan/ - webarchive
- https://isc.sans.edu/diary/rss/28254 - webarchive
- https://www.melani.admin.ch/melani/de/home/dokumentation/newsletter/Trojaner_Emotet_greift_Unternehmensnetzwerke_an.html - webarchive
- https://www.netskope.com/blog/emotet-still-abusing-microsoft-office-macros - webarchive
- https://unit42.paloaltonetworks.com/new-emotet-infection-method/ - webarchive
- https://securelist.com/analysis/publications/69560/the-banking-trojan-emotet-detailed-analysis/ - webarchive
- https://twitter.com/milkr3am/status/1354459859912192002 - webarchive
- https://www.intrinsec.com/emotet-returns-and-deploys-loaders/ - webarchive
- https://download.microsoft.com/download/f/8/1/f816b8b6-bee3-41e5-b6cc-e925a5688f61/Microsoft_Digital_Defense_Report_2020_September.pdf - webarchive
- https://www.gdatasoftware.com/blog/2022/01/malware-vaccines - webarchive
- http://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 - webarchive
- https://www.digitalshadows.com/blog-and-research/emotet-disruption/ - webarchive
- https://blog.cyble.com/2022/04/27/emotet-returns-with-new-ttps-and-delivers-lnk-files-to-its-victims/ - webarchive
- https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ - webarchive
- https://blog.securityonion.net/2022/02/quick-malware-analysis-emotet-epoch-5.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/emotet-adds-new-evasion-technique-and-uses-connected-devices-as-proxy-cc-servers/ - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_4_ogawa-niseki_en.pdf - webarchive
- https://unit42.paloaltonetworks.com/emotet-thread-hijacking/ - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://twitter.com/ContiLeaks/status/1498614197202079745 - webarchive
- https://muha2xmad.github.io/unpacking/emotet-part-1/ - webarchive
- https://unit42.paloaltonetworks.com/attack-chain-overview-emotet-in-december-2020-and-january-2021/ - webarchive
- https://www.fortinet.com/blog/threat-research/notable-droppers-emerge-in-recent-threat-campaigns - webarchive
- https://content.secureworks.com/-/media/Files/US/Reports/Monthly%20Threat%20Intelligence/Secureworks_ECO1_ThreatIntelligenceExecutiveReport2022Vol2.ashx - webarchive
- https://cert-agid.gov.it/news/malware/semplificare-lanalisi-di-emotet-con-python-e-iced-x86/ - webarchive
- https://www.ironnet.com/blog/detecting-a-mummyspider-campaign-and-emotet-infection - webarchive
- https://threatresearch.ext.hp.com/emotets-return-whats-different/ - webarchive
- https://maxkersten.nl/binary-analysis-course/malware-analysis/emotet-droppers/ - webarchive
- https://hello.global.ntt/en-us/insights/blog/shellbot-victim-overlap-with-emotet-network-infrastructure - webarchive
- https://atr-blog.gigamon.com/2020/01/13/emotet-not-your-run-of-the-mill-malware/ - webarchive
- https://cloudblogs.microsoft.com/microsoftsecure/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/?source=mmpc - webarchive
- https://gallery.mailchimp.com/c35aef82661dad887b8162a4f/files/e24e8206-a157-4796-a8cb-2b7262cc76e8/CSIS_Threat_Matrix_H1_2019.pdf - webarchive
- https://www.securityartwork.es/2021/06/16/analisis-campana-emotet/ - webarchive
- https://www.zscaler.com/blogs/security-research/return-emotet-malware - webarchive
- https://www.justice.gov/opa/pr/emotet-botnet-disrupted-international-cyber-operation - webarchive
- https://blog.kryptoslogic.com/malware/2018/08/01/emotet.html - webarchive
- https://resources.malwarebytes.com/files/2020/02/2020_State-of-Malware-Report.pdf - webarchive
- https://blog.threatlab.info/malware-analysis-emotet-infection/ - webarchive
- https://quickheal.co.in/documents/technical-paper/Whitepaper_HowToPM.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/emotet-botnet-switches-to-64-bit-modules-increases-activity/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Empire Downloader
Internal MISP references
UUID aa445513-9616-4f61-a72d-7aff4a10572b which can be used as unique global reference for Empire Downloader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.empire_downloader - webarchive
- https://attack.mitre.org/groups/G0096 - webarchive
- https://www.trellix.com/en-gb/about/newsroom/stories/threat-labs/looking-over-the-nation-state-actors-shoulders.html - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-drake - webarchive
- https://twitter.com/thor_scanner/status/992036762515050496 - webarchive
- https://lab52.io/blog/wirte-group-attacking-the-middle-east/ - webarchive
- https://cocomelonc.github.io/tutorial/2022/04/20/malware-pers-1.html - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-atlas - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-ulrick - webarchive
- https://decoded.avast.io/threatintel/decoding-cobalt-strike-understanding-payloads/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0107.pdf - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-burlap - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-009.pdf - webarchive
- https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-275a - webarchive
- https://redcanary.com/blog/getsystem-offsec/ - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-249a - webarchive
- https://paper.seebug.org/1301/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-firestone - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-heron - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-heron - webarchive
- https://unit42.paloaltonetworks.com/atoms/obscureserpens/ - webarchive
- https://www.cyber.gov.au/sites/default/files/2020-06/ACSC-Advisory-2020-008-Copy-Paste-Compromises.pdf - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://www.mandiant.com/media/12596/download - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Emudbot
Supposedly a worm that was active around 2012-2013.
Internal MISP references
UUID d3189268-443b-42f6-99a2-12d29f309c0b which can be used as unique global reference for Emudbot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Enfal
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Enfal.
| Known Synonyms |
|---|
Lurid |
Internal MISP references
UUID 2a4cacb7-80a1-417e-8b9c-54b4089f35d9 which can be used as unique global reference for Enfal in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.enfal - webarchive
- https://research.checkpoint.com/2020/vicious-panda-the-covid-campaign/ - webarchive
- https://documents.trendmicro.com/assets/wp/wp-detecting-apt-activity-with-network-traffic-analysis.pdf - webarchive
- https://researchcenter.paloaltonetworks.com/2015/05/cmstar-downloader-lurid-and-enfals-new-cousin/ - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://www.bsk-consulting.de/2015/10/17/how-to-write-simple-but-sound-yara-rules-part-2/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-palace - webarchive
- https://attack.mitre.org/groups/G0011 - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-union - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Enigma Loader
According to Trend Micro, this is a downloader, dedicated to stage execution of a second stage malware called Enigma Stealer.
Internal MISP references
UUID 7491f483-f3d2-4f90-be19-df1e3783f66f which can be used as unique global reference for Enigma Loader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Entropy
Entropy is a ransomware first seen in 1st quarter of 2022, is being used in conjunction of Dridex infection. The ransomware uses a custom packer to pack itself which has been seen in some early dridex samples.
Internal MISP references
UUID 8dc64857-abb1-4926-8114-052f9ba4bc33 which can be used as unique global reference for Entropy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.entropy - webarchive
- https://killingthebear.jorgetesta.tech/actors/evil-corp - webarchive
- https://lka.polizei.nrw/presse/schlag-gegen-international-agierendes-netzwerk-von-cyber-kriminellen - webarchive
- https://news.sophos.com/en-us/2022/02/23/dridex-bots-deliver-entropy-ransomware-in-recent-attacks/?cmp=30728 - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://news.sophos.com/en-us/2022/02/23/dridex-bots-deliver-entropy-ransomware-in-recent-attacks/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EntryShell
Fileless malware 'EntryShell', a variant of the KeyBoy malware, due to similarities in backdoor command IDs and debug messages with old KeyBoy samples. The embedded malware config was encrypted with a unique algorithm.
Internal MISP references
UUID 73a0919b-1c81-4af5-a6d1-8fb5ae951269 which can be used as unique global reference for EntryShell in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Enviserv
Internal MISP references
UUID 58071588-708d-447d-9fb4-8c9268142c82 which can be used as unique global reference for Enviserv in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EnvyScout
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular EnvyScout.
| Known Synonyms |
|---|
ROOTSAW |
Internal MISP references
UUID 0890e245-319d-4291-8f49-21dbc9486181 which can be used as unique global reference for EnvyScout in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.envyscout - webarchive
- https://www.incibe-cert.es/sites/default/files/contenidos/estudios/doc/incibe-cert_estudio_analisis_nobelium_2022_v1.pdf - webarchive
- https://blog.bushidotoken.net/2022/06/overview-of-russian-gru-and-svr.html - webarchive
- https://www.sekoia.io/en/nobeliums-envyscout-infection-chain-goes-in-the-registry-targeting-embassies/ - webarchive
- https://cert.pl/posts/2023/04/kampania-szpiegowska-apt29/ - webarchive
- https://unit42.paloaltonetworks.com/cloaked-ursa-online-storage-services-campaigns/ - webarchive
- https://blogs.blackberry.com/en/2023/03/nobelium-targets-eu-governments-assisting-ukraine - webarchive
- https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0503.pdf - webarchive
- https://mrtiepolo.medium.com/sophisticated-apt29-campaign-abuses-notion-api-to-target-the-european-commission-200188059f58 - webarchive
- https://cert-agid.gov.it/news/il-malware-envyscout-apt29-e-stato-veicolato-anche-in-italia/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Epsilon Red
According to PCrisk, Epsilon is a ransomware-type program. This malware is designed to encrypt the data of infected systems in order to demand payment for decryption.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Epsilon Red.
| Known Synonyms |
|---|
BlackCocaine |
Internal MISP references
UUID d6d0bf38-c85c-41d3-bc0e-3477b458563e which can be used as unique global reference for Epsilon Red in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.epsilon_red - webarchive
- https://news.sophos.com/en-us/2021/05/28/epsilonred/ - webarchive
- https://cybleinc.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/ - webarchive
- https://therecord.media/epsilonred-ransomware-group-hits-one-of-indias-financial-software-powerhouses/ - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EquationDrug
Internal MISP references
UUID c4490972-3403-4043-9d61-899c0a440940 which can be used as unique global reference for EquationDrug in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.equationdrug - webarchive
- https://mp.weixin.qq.com/s/3ZQhn32NB6p-LwndB2o2zQ - webarchive
- https://securelist.com/equation-the-death-star-of-malware-galaxy/68750/ - webarchive
- http://artemonsecurity.blogspot.com/2017/03/equationdrug-rootkit-analysis-mstcp32sys.html - webarchive
- https://securelist.com/inside-the-equationdrug-espionage-platform/69203/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Equationgroup (Sorting)
Rough collection EQGRP samples, to be sorted
Internal MISP references
UUID 35c1abaf-8dee-48fe-8329-f6e5612eb7af which can be used as unique global reference for Equationgroup (Sorting) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.equationgroup - webarchive
- https://laanwj.github.io/2016/08/28/feintcloud.html - webarchive
- https://laanwj.github.io/2016/09/04/blatsting-command-and-control.html - webarchive
- https://laanwj.github.io/2016/09/11/buzzdirection.html - webarchive
- https://laanwj.github.io/2016/09/13/blatsting-rsa.html - webarchive
- https://laanwj.github.io/2016/09/23/seconddate-adventures.html - webarchive
- https://laanwj.github.io/2016/09/01/tadaqueos.html - webarchive
- https://laanwj.github.io/2016/08/22/blatsting.html - webarchive
- https://laanwj.github.io/2016/09/09/blatsting-lp-transcript.html - webarchive
- https://research.checkpoint.com/2021/a-deep-dive-into-doublefeature-equation-groups-post-exploitation-dashboard/ - webarchive
- https://laanwj.github.io/2016/09/17/seconddate-cnc.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Erbium Stealer
Erbium is an information stealer advertised and sold as a Malware-as-a-Service on cybercrime forums and Telegram since at least July 2022. Its capabilities are those of a classic information stealer, with a focus on cryptocurrency wallets, and file grabber capabilities.
Internal MISP references
UUID b566fe1f-7ed7-4932-b04d-355facdeab7a which can be used as unique global reference for Erbium Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.erbium_stealer - webarchive
- https://twitter.com/sekoia_io/status/1577222282929311744 - webarchive
- https://twitter.com/abuse_ch/status/1565290110572175361 - webarchive
- https://blog.cluster25.duskrise.com/2022/09/15/erbium-stealer-a-new-infostealer - webarchive
- https://www.bleepingcomputer.com/news/security/new-erbium-password-stealing-malware-spreads-as-game-cracks-cheats/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Erebus (Windows)
Internal MISP references
UUID 06450729-fe60-4348-9717-c13a487738b9 which can be used as unique global reference for Erebus (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Eredel
Eredel Stealer is a low price malware that allows for extracting passwords, cookies, screen desktop from browsers and programs.
According to nulled[.]to:
Supported browsers Chromium Based: Chromium, Google Chrome, Kometa, Amigo, Torch, Orbitum, Opera, Opera Neon, Comodo Dragon, Nichrome (Rambler), Yandex Browser, Maxthon5, Sputnik, Epic Privacy Browser, Vivaldi, CocCoc and other Chromium Based browsers.
- Stealing FileZilla
- Stealing an account from Telegram
- Stealing AutoFill
- Theft of wallets: Bitcoin | Dash | Monero | Electrum | Ethereum | Litecoin
- Stealing files from the desktop. Supports any formats, configurable via telegram-bot
Internal MISP references
UUID acd2555d-b4a1-47b4-983a-fb7b3a402dab which can be used as unique global reference for Eredel in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.eredel - webarchive
- https://webcache.googleusercontent.com/search?q=cache:3hU62-Lr2t8J:https://www.nulled.to/topic/486274-eredel-stealer-lite-private-having-control-via-the-web-panel-multifunctional-stealer/+&cd=1&hl=en&ct=clnk&gl=ch&client=firefox-b-ab - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Erica Ransomware
Internal MISP references
UUID 0f4731b3-b661-4677-9e51-474504313202 which can be used as unique global reference for Erica Ransomware in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Eris
Ransomware.
Internal MISP references
UUID c4531af6-ab25-4266-af41-e01635a93abe which can be used as unique global reference for Eris in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ESPecter
Internal MISP references
UUID 3e89d4e6-f7bd-44fd-ade9-c3d408ce67fb which can be used as unique global reference for ESPecter in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.especter - webarchive
- https://www.binarly.io/posts/Design_issues_of_modern_EDR%E2%80%99s_bypassing_ETW-based_solutions/index.html - webarchive
- https://www.welivesecurity.com/2021/10/05/uefi-threats-moving-esp-introducing-especter-bootkit/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EternalRocks
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular EternalRocks.
| Known Synonyms |
|---|
MicroBotMassiveNet |
Internal MISP references
UUID 10dd9c6a-9baa-40b6-984a-0598c4d9a88f which can be used as unique global reference for EternalRocks in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EternalPetya
According to proofpoint, Bad Rabbit is a strain of ransomware that first appeared in 2017 and is a suspected variant of Petya. Like other strains of ransomware, Bad Rabbit virus infections lock up victims’ computers, servers, or files preventing them from regaining access until a ransom—usually in Bitcoin—is paid.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular EternalPetya.
| Known Synonyms |
|---|
BadRabbit |
Diskcoder.C |
ExPetr |
NonPetya |
NotPetya |
Nyetya |
Petna |
Pnyetya |
nPetya |
Internal MISP references
UUID 6f736038-4f74-435b-8904-6870ee0e23ba which can be used as unique global reference for EternalPetya in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.eternal_petya - webarchive
- https://securityandtechnology.org/wp-content/uploads/2021/04/IST-Ransomware-Task-Force_Final_Report.pdf - webarchive
- https://www.ironnet.com/blog/russian-cyber-attack-campaigns-and-actors - webarchive
- https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat - webarchive
- https://www.crowdstrike.com/blog/fast-spreading-petrwrap-ransomware-attack-combines-eternalblue-exploit-credential-stealing/ - webarchive
- https://www.atlanticcouncil.org/wp-content/uploads/2020/07/Breaking-trust-Shades-of-crisis-across-an-insecure-software-supply-chain.pdf - webarchive
- https://attack.mitre.org/groups/G0034 - webarchive
- https://www.gdatasoftware.com/blog/2017/07/29859-who-is-behind-petna - webarchive
- https://www.cyberscoop.com/russian-hackers-notpetya-charges-gru/ - webarchive
- https://medium.com/@thegrugq/pnyetya-yet-another-ransomware-outbreak-59afd1ee89d4 - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf - webarchive
- https://medium.com/@Ilandu/petya-not-petya-ransomware-9619cbbb0786 - webarchive
- https://pylos.co/2020/11/04/the-enigmatic-energetic-bear/ - webarchive
- https://blogs.technet.microsoft.com/mmpc/2017/06/29/windows-10-platform-resilience-against-the-petya-ransomware-attack/ - webarchive
- https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back - webarchive
- https://www.wired.com/story/us-indicts-sandworm-hackers-russia-cyberwar-unit/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2017/06/eternalpetya-yet-another-stolen-piece-package/ - webarchive
- https://securelist.com/bad-rabbit-ransomware/82851/ - webarchive
- http://www.intezer.com/notpetya-returns-bad-rabbit/ - webarchive
- https://blog.nviso.eu/2022/02/24/threat-update-ukraine-russia-tensions/ - webarchive
- https://www.riskint.blog/post/revisited-fancy-bear-s-new-faces-and-sandworms-too - webarchive
- https://www.welivesecurity.com/2017/06/27/new-ransomware-attack-hits-ukraine - webarchive
- https://blog.malwarebytes.com/cybercrime/2017/07/keeping-up-with-the-petyas-demystifying-the-malware-family/ - webarchive
- https://istari-global.com/spotlight/the-untold-story-of-notpetya/ - webarchive
- https://www.wired.com/story/badrabbit-ransomware-notpetya-russia-ukraine/ - webarchive
- https://labsblog.f-secure.com/2017/10/27/the-big-difference-with-bad-rabbit/ - webarchive
- https://www.atlanticcouncil.org/content-series/tech-at-the-leading-edge/the-russian-cyber-unit-that-hacks-targets-on-site/ - webarchive
- https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/ - webarchive
- https://www.welivesecurity.com/2017/10/24/kiev-metro-hit-new-variant-infamous-diskcoder-ransomware/?utm_content=buffer8ffe4&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer - webarchive
- https://www.washingtonpost.com/world/national-security/russian-military-was-behind-notpetya-cyberattack-in-ukraine-cia-concludes/2018/01/12/048d8506-f7ca-11e7-b34a-b85626af34ef_story.html - webarchive
- https://securelist.com/from-blackenergy-to-expetr/78937/ - webarchive
- https://securelist.com/in-expetrpetyas-shadow-fakecry-ransomware-wave-hits-ukraine/78973/ - webarchive
- https://www.tesorion.nl/en/resources/pdfstore/Report-OSINT-Russia-Ukraine-Conflict-Cyberaspect.pdf - webarchive
- https://www.theguardian.com/technology/2017/jul/03/notpetya-malware-attacks-ukraine-warrant-retaliation-nato-researcher-tomas-minarik - webarchive
- https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/ - webarchive
- http://blog.erratasec.com/2017/06/nonpetya-no-evidence-it-was-smokescreen.html - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-viking - webarchive
- https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/ - webarchive
- https://threatpost.com/ukrainian-man-arrested-charged-in-notpetya-distribution/127391/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0909.pdf - webarchive
- https://securelist.com/big-threats-using-code-similarity-part-1/97239/ - webarchive
- https://blog.talosintelligence.com/2022/02/current-executive-guidance-for-ongoing.html - webarchive
- http://blog.talosintelligence.com/2017/10/bad-rabbit.html - webarchive
- http://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html - webarchive
- https://securelist.com/expetrpetyanotpetya-is-a-wiper-not-ransomware/78902/ - webarchive
- https://therecord.media/mondelez-and-zurich-reach-settlement-in-notpetya-cyberattack-insurance-suit/ - webarchive
- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/september/eternalglue-part-one-rebuilding-notpetya-to-assess-real-world-resilience/ - webarchive
- https://www.wired.com/story/hacker-lexicon-what-is-a-supply-chain-attack/ - webarchive
- https://isc.sans.edu/forums/diary/Checking+out+the+new+Petya+variant/22562/ - webarchive
- https://tisiphone.net/2017/06/28/why-notpetya-kept-me-awake-you-should-worry-too/ - webarchive
- https://securelist.com/schroedingers-petya/78870/ - webarchive
- https://www.crowdstrike.com/blog/petrwrap-technical-analysis-part-2-further-findings-and-potential-for-mbr-recovery/ - webarchive
- https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games - webarchive
- https://www.riskiq.com/blog/labs/badrabbit/ - webarchive
- https://cyberpeaceinstitute.org/ukraine-timeline-of-cyberattacks - webarchive
- https://www.bleepingcomputer.com/news/security/ransomware-attacks-continue-in-ukraine-with-mysterious-wannacry-clone/ - webarchive
- https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/ - webarchive
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/ - webarchive
- https://marcoramilli.com/2022/03/01/diskkill-hermeticwiper-and-notpetya-dissimilarities/ - webarchive
- https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-badrabbit-encryption-routine-specifics.html - webarchive
- https://docs.microsoft.com/en-us/security/compass/human-operated-ransomware - webarchive
- https://www.fireeye.com/blog/threat-research/2017/10/backswing-pulling-a-badrabbit-out-of-a-hat.html - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-110a - webarchive
- https://securelist.com/apt-trends-report-q2-2019/91897/ - webarchive
- https://www.youtube.com/watch?v=mrTdSdMMgnk - webarchive
- https://gvnshtn.com/maersk-me-notpetya/ - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://aguinet.github.io//blog/2020/08/29/miasm-bootloader.html - webarchive
- https://blog.malwarebytes.com/threat-analysis/2017/06/eternalpetya-lost-salsa20-key/ - webarchive
- https://blog.comae.io/petya-2017-is-a-wiper-not-a-ransomware-9ea1d8961d3b - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Eternity Clipper
This malware is part of the Eternity Malware "Framework".
Internal MISP references
UUID 283928b7-2820-4230-a012-59302febff90 which can be used as unique global reference for Eternity Clipper in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.eternity_clipper - webarchive
- https://blog.cyble.com/2022/05/12/a-closer-look-at-eternity-malware/ - webarchive
- https://www.bleepingcomputer.com/news/security/eternity-malware-kit-offers-stealer-miner-worm-ransomware-tools/ - webarchive
- https://www.zscaler.com/blogs/security-research/analysis-lilithbot-malware-and-eternity-threat-group - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Eternity Ransomware
Eternity Framework Ransomware Payload
Internal MISP references
UUID 0554d721-71d7-49ff-965c-1512427b303e which can be used as unique global reference for Eternity Ransomware in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.eternity_ransomware - webarchive
- https://blog.cyble.com/2022/05/12/a-closer-look-at-eternity-malware/ - webarchive
- https://yoroi.company/research/a-deep-dive-into-eternity-group-a-new-emerging-cyber-threat/ - webarchive
- https://www.bleepingcomputer.com/news/security/eternity-malware-kit-offers-stealer-miner-worm-ransomware-tools/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Eternity Stealer
This Stealer is part of the eternity malware project.
Internal MISP references
UUID 94bf44d8-3eb3-42b0-b906-102f2b8548f5 which can be used as unique global reference for Eternity Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.eternity_stealer - webarchive
- https://ke-la.com/information-stealers-a-new-landscape/ - webarchive
- https://yoroi.company/research/a-deep-dive-into-eternity-group-a-new-emerging-cyber-threat/ - webarchive
- https://blog.cyble.com/2022/05/12/a-closer-look-at-eternity-malware/ - webarchive
- https://securityintelligence.com/news/eternity-gang-ransomware-as-a-service-telegram/ - webarchive
- https://blogs.blackberry.com/en/2022/06/threat-spotlight-eternity-project-maas-goes-on-and-on - webarchive
- https://www.zscaler.com/blogs/security-research/analysis-lilithbot-malware-and-eternity-threat-group - webarchive
- https://blog.morphisec.com/nft-malware-new-evasion-abilities - webarchive
- https://blog.sekoia.io/eternityteam-a-new-prominent-threat-group-on-underground-forums/ - webarchive
- https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ - webarchive
- https://twitter.com/3xp0rtblog/status/1509601846494695438 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Eternity Worm
This malware is part of the Eternity Malware "Framework".
Internal MISP references
UUID 9bdffa86-2bed-4d9d-8697-5d70e62015dc which can be used as unique global reference for Eternity Worm in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.eternity_worm - webarchive
- https://blog.cyble.com/2022/05/12/a-closer-look-at-eternity-malware/ - webarchive
- https://yoroi.company/research/a-deep-dive-into-eternity-group-a-new-emerging-cyber-threat/ - webarchive
- https://www.bleepingcomputer.com/news/security/eternity-malware-kit-offers-stealer-miner-worm-ransomware-tools/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EtumBot
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular EtumBot.
| Known Synonyms |
|---|
HighTide |
Internal MISP references
UUID 91af1080-6378-4a90-ba1e-78634cd31efe which can be used as unique global reference for EtumBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.etumbot - webarchive
- https://www.zscaler.com/blogs/research/cnacom-open-source-exploitation-strategic-web-compromise - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-globe - webarchive
- https://www.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-group-2.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Evilbunny
Internal MISP references
UUID dc39dcdf-50e7-4d55-94a0-926853f344f3 which can be used as unique global reference for Evilbunny in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.evilbunny - webarchive
- https://www.gdatasoftware.com/blog/2015/02/24270-babar-espionage-software-finally-found-and-put-under-the-microscope - webarchive
- https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/ - webarchive
- https://web.archive.org/web/20150218192803/http://www.cyphort.com/babar-suspected-nation-state-spyware-spotlight/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EvilExtractor
Internal MISP references
UUID e020212b-03ef-4168-97f5-bb72ff627d94 which can be used as unique global reference for EvilExtractor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EvilGrab
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular EvilGrab.
| Known Synonyms |
|---|
Vidgrab |
Internal MISP references
UUID 438c6d0f-03f0-4b49-89d2-40bf5349c3fc which can be used as unique global reference for EvilGrab in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.evilgrab - webarchive
- https://app.box.com/s/z1uanuv1vn3vw5iket1r6bqrmlra0gpn - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EVILNUM (Windows)
Internal MISP references
UUID da922c36-ca13-4ea2-a22d-471e91ddac93 which can be used as unique global reference for EVILNUM (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.evilnum - webarchive
- https://mp.weixin.qq.com/s/lryl3a65uIz1AwZcfuzp1A - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities - webarchive
- https://docs.broadcom.com/doc/ransom-and-malware-attacks-on-financial-services-institutions - webarchive
- https://unit42.paloaltonetworks.com/cardinal-rat-sins-again-targets-israeli-fin-tech-firms/ - webarchive
- https://github.com/eset/malware-ioc/tree/master/evilnum - webarchive
- https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/ - webarchive
- https://www.zscaler.com/blogs/security-research/return-evilnum-apt-updated-ttps-and-new-targets - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EvilPlayout
A wiper used against in an attack against Iran’s state broadcaster. Using campaign name coined by Check Point in lack of a better name for the wiper component.
Internal MISP references
UUID a90a1c08-00ea-49ad-8f79-9a4461fce48e which can be used as unique global reference for EvilPlayout in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EvilPony
Privately modded version of the Pony stealer.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular EvilPony.
| Known Synonyms |
|---|
CREstealer |
Internal MISP references
UUID e26579d9-1d93-4a3b-a41e-263254d85189 which can be used as unique global reference for EvilPony in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Evrial
Internal MISP references
UUID af3a3ece-e67f-457a-be72-7651bc720342 which can be used as unique global reference for Evrial in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Exaramel (Windows)
Internal MISP references
UUID dd68abd7-b20a-40a5-be53-ae8d45c1dd27 which can be used as unique global reference for Exaramel (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.exaramel - webarchive
- https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/ - webarchive
- https://attack.mitre.org/groups/G0034 - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf - webarchive
- https://pylos.co/wp-content/uploads/2020/02/Threat-Intelligence-and-the-Limits-of-Malware-Analysis.pdf - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/04/ESET_Industry_Report_Government.pdf - webarchive
- https://www.wired.com/story/sandworm-centreon-russia-hack/ - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/01/vb2019-paper-rich-headers-leveraging-mysterious-artifact-pe-format/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ExByte
ExByte is a custom data exfiltration tool and infostealer observed being used during BlackByte ransomware attacks.
Internal MISP references
UUID 42f4fee9-a5c2-4643-be56-fba8700f835d which can be used as unique global reference for ExByte in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.exbyte - webarchive
- https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Excalibur
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Excalibur.
| Known Synonyms |
|---|
Saber |
Sabresac |
Internal MISP references
UUID 3cec2c3c-1669-40cf-8612-eb826f7d2c98 which can be used as unique global reference for Excalibur in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MS Exchange Tool
Internal MISP references
UUID 74f8db32-799c-41e5-9815-6272908ede57 which can be used as unique global reference for MS Exchange Tool in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.exchange_tool - webarchive
- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/ - webarchive
- https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/ - webarchive
- https://github.com/nccgroup/Royal_APT - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Exile RAT
ExileRAT is a simple RAT platform capable of getting information on the system (computer name, username, listing drives, network adapter, process name), getting/pushing files and executing/terminating processes.
Internal MISP references
UUID c932a2f3-1470-4b0c-8412-2d081901277b which can be used as unique global reference for Exile RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ExMatter
Exfiltration tool written in .NET, used by at least one BlackMatter ransomware operator.
Internal MISP references
UUID 615e22f7-1b0e-44a0-a666-b95cb6b5e279 which can be used as unique global reference for ExMatter in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.exmatter - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackmatter-data-exfiltration - webarchive
- https://www.kroll.com/en/insights/publications/cyber/analyzing-exmatter-ransomware-data-exfiltration-tool - webarchive
- https://twitter.com/knight0x07/status/1461787168037240834?s=20 - webarchive
- https://www.netskope.com/blog/blackcat-ransomware-tactics-and-techniques-from-a-targeted-attack - webarchive
- https://www.accenture.com/us-en/blogs/security/stealbit-exmatter-exfiltration-tool-analysis - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Exorcist
According to PCrisk, Exorcist is a ransomware-type malicious program. Systems infected with this malware experience data encryption and users receive ransom demands for decryption. During the encryption process, all compromised files are appended with an extension consisting of a ransom string of characters.
For example, a file originally named "1.jpg" could appear as something similar to "1.jpg.rnyZoV" following encryption. After this process is complete, Exorcist ransomware changes the desktop wallpaper and drops HTML applications - "[random-string]-decrypt.hta" (e.g. "rnyZoV-decrypt.hta") - into affected folders. These files contain identical ransom messages.
Internal MISP references
UUID d742986c-04f0-48ef-aaa3-10eeb0e95be4 which can be used as unique global reference for Exorcist in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Expiro
Expiro malware has been around for more than a decade, and the malware authors sill continue their work and update it with more features. Also the infection routine was changed in samples fround in 2017 (described by McAfee). Expiro "infiltrates" executables on 32- and 64bit Windows OS versions. It has capabilities to install browser extensions, change security behaviour/settings on the infected system, and steal information (e.g. account credentials). There is a newly described EPO file infector source code called m0yv in 2022, which is wrongly identified as expiro by some AVs.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Expiro.
| Known Synonyms |
|---|
Xpiro |
Internal MISP references
UUID fd34b588-7b00-4924-827b-6118bece0af1 which can be used as unique global reference for Expiro in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.expiro - webarchive
- https://www.welivesecurity.com/2013/07/30/versatile-and-infectious-win64expiro-is-a-cross-platform-file-infector/ - webarchive
- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Expiro - webarchive
- https://github.com/GiacomoFerro/malware-analysis/blob/master/report/report-malware.pdf - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/expiro-infects-encrypts-files-to-complicate-repair/ - webarchive
- https://youtu.be/3RYbkORtFnk - webarchive
- https://medium.com/walmartglobaltech/gazavat-expiro-dmsniff-connection-and-dga-analysis-8b965cc0221d - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ExplosiveRAT
Internal MISP references
UUID d3600857-b941-4d47-81ef-02c168396518 which can be used as unique global reference for ExplosiveRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Xtreme RAT
According to Trend MIcro, Extreme RAT (XTRAT, Xtreme Rat) is a Remote Access Trojan that can steal information. This RAT has been used in attacks targeting Israeli and Syrian governments last 2012.
This malware family of backdoors has the capability to receive commands such as File Management (Download, Upload, and Execute Files), Registry Management (Add, Delete, Query, and Modify Registry), Perform Shell Command, Computer Control (Shutdown, Log on/off), and Screen capture from a remote attacker. In addition, it can also log keystrokes of the infected systems.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Xtreme RAT.
| Known Synonyms |
|---|
ExtRat |
Internal MISP references
UUID 6ec2b6b1-c1a7-463a-b135-edb51764cf38 which can be used as unique global reference for Xtreme RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.extreme_rat - webarchive
- https://community.rsa.com/community/products/netwitness/blog/2017/08/02/malspam-delivers-xtreme-rat-8-1-2017 - webarchive
- https://embee-research.ghost.io/practical-queries-for-malware-infrastructure-part-3/ - webarchive
- https://malware.lu/articles/2012/07/22/xtreme-rat-analysis.html - webarchive
- https://www2.slideshare.net/ChiEnAshleyShen/hitcon-2020-cti-village-threat-hunting-and-campaign-tracking-workshoppptx/1 - webarchive
- https://www.symantec.com/connect/blogs/colombians-major-target-email-campaigns-delivering-xtreme-rat - webarchive
- https://mp.weixin.qq.com/s/gWOIRNPLVqX761LW8x-S5g - webarchive
- https://blogs.360.cn/post/APT-C-44.html - webarchive
- https://www.secureworks.com/research/threat-profiles/aluminum-saratoga - webarchive
- https://citizenlab.ca/2015/12/packrat-report/ - webarchive
- https://www.fireeye.com/blog/threat-research/2014/02/xtremerat-nuisance-or-threat.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Eye Pyramid
Internal MISP references
UUID a7489029-21d4-44c9-850a-8f656a98cb22 which can be used as unique global reference for Eye Pyramid in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
EYService
EYService is the main part of the backdoor used by Nazar APT. This a passive backdoor that relies on, now discontinued, Packet Sniffer SDK (PSSDK) from Microolap.
Internal MISP references
UUID 9b287426-e82f-407e-8d12-42dac4241bf8 which can be used as unique global reference for EYService in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.eyservice - webarchive
- https://blog.malwarelab.pl/posts/nazar_eyservice/ - webarchive
- https://www.crysys.hu/publications/files/tedi/ukatemicrysys_territorialdispute.pdf - webarchive
- https://research.checkpoint.com/2020/nazar-spirits-of-the-past/ - webarchive
- https://blog.malwarelab.pl/posts/nazar_eyservice_comm/ - webarchive
- https://www.epicturla.com/blog/the-lost-nazar - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Fabookie
Fabookie is facebook account info stealer.
Internal MISP references
UUID 782aa125-42ff-4ca0-b9b1-362aac08566b which can be used as unique global reference for Fabookie in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.fabookie - webarchive
- https://medium.com/@lcam/updates-from-the-maas-new-threats-delivered-through-nullmixer-d45defc260d1 - webarchive
- https://inside.harfanglab.io/blog/articles/cyber-threat-intelligence/loader-galore-taskloader-at-the-start-of-a-pay-per-install-infection-chain/ - webarchive
- https://ics-cert.kaspersky.com/publications/reports/2021/12/16/pseudomanuscrypt-a-mass-scale-spyware-attack-campaign/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FakeCry
Malware written in .NET that mimics WannaCry.
Internal MISP references
UUID c9ac3322-c176-444c-8d72-603430dca2d0 which can be used as unique global reference for FakeCry in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FakeRean
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FakeRean.
| Known Synonyms |
|---|
Braviax |
Internal MISP references
UUID 653df134-88c9-47e2-99a5-06e0406ab6d4 which can be used as unique global reference for FakeRean in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.fakerean - webarchive
- https://0x3asecurity.wordpress.com/2015/11/30/134260124544/ - webarchive
- https://www.exploit-db.com/docs/english/18387-malware-reverse-engineering-part-1---static-analysis.pdf - webarchive
- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/FakeRean#technicalDiv - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FakeTC
Internal MISP references
UUID 6b0030bc-6e45-43b0-9175-15fe8fbd0942 which can be used as unique global reference for FakeTC in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FakeWord
Internal MISP references
UUID 6eb3546c-cb8b-447c-81d1-9c4c1166581d which can be used as unique global reference for FakeWord in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
fancyfilter
FancyFilter is a piece of code that documents code overlap between frameworks used by Regin and Equation Group.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular fancyfilter.
| Known Synonyms |
|---|
0xFancyFilter |
Internal MISP references
UUID e7d06257-2bc6-45b6-8728-080df9932f90 which can be used as unique global reference for fancyfilter in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Fanny
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Fanny.
| Known Synonyms |
|---|
DEMENTIAWHEEL |
Internal MISP references
UUID 6d441619-c5f5-45ff-bc63-24cecd0b237e which can be used as unique global reference for Fanny in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.fanny - webarchive
- https://fmmresearch.files.wordpress.com/2020/09/theemeraldconnectionreport_fmmr-2.pdf - webarchive
- https://securelist.com/equation-the-death-star-of-malware-galaxy/68750/#_1 - webarchive
- https://research.checkpoint.com/2021/a-deep-dive-into-doublefeature-equation-groups-post-exploitation-dashboard/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf - webarchive
- https://securelist.com/equation-the-death-star-of-malware-galaxy/68750/ - webarchive
- https://fmnagisa.wordpress.com/2020/08/27/revisiting-equationgroups-fanny-worm-or-dementiawheel/ - webarchive
- https://fmmresearch.wordpress.com/2020/09/28/the-emerald-connection-equationgroup-collaboration-with-stuxnet/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FantomCrypt
According to PCrisk, Fantom is a ransomware-type virus that imitates the Windows update procedure while encrypting files. This is unusual, since most ransomware encrypts files stealthily without showing any activity. During encryption, Fantom appends the names of encrypted files with the ".locked4", ".fantom" or ".locked" extension.
Internal MISP references
UUID 29f4ae5a-4ccd-451b-bd3e-d301865da034 which can be used as unique global reference for FantomCrypt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Farseer
Internal MISP references
UUID f197b0a8-6bea-42ea-b57f-8f6f202f7602 which can be used as unique global reference for Farseer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.farseer - webarchive
- https://unit42.paloaltonetworks.com/farseer-previously-unknown-malware-family-bolsters-the-chinese-armoury/ - webarchive
- https://unit42.paloaltonetworks.com/pkplug_chinese_cyber_espionage_group_attacking_asia/ - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-pulling-pkplug-adversary-playbook-long-standing-espionage-activity-chinese-nation-state-adversary/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FastLoader
FastLoader is a small .NET downloader, which name comes from PDB strings seen in samples. It typically downloads TrickBot. It may create a list of processes and uploads it together with screenshot(s). In more recent versions, it employs simple anti-analysis checks (VM detection) and comes with string obfuscations.
Internal MISP references
UUID 21b86dbb-d000-449c-bfe4-41faede4bd89 which can be used as unique global reference for FastLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FastPOS
Internal MISP references
UUID 1bf03bbb-d3a2-4713-923b-218186c86914 which can be used as unique global reference for FastPOS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.fast_pos - webarchive
- http://documents.trendmicro.com/assets/fastPOS-quick-and-easy-credit-card-theft.pdf - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/fastpos-quick-and-easy-credit-card-theft/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/fastpos-updates-in-time-for-retail-sale-season/ - webarchive
- https://www.justice.gov/opa/pr/malware-author-pleads-guilty-role-transnational-cybercrime-organization-responsible-more-568 - webarchive
- http://documents.trendmicro.com/assets/Appendix%20-%20FastPOS%20Updates%20in%20Time%20for%20the%20Retail%20Sale%20Season.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FatalRat
According to PCrisk, FatalRAT is the name of a Remote Access Trojan (RAT). A RAT is a type of malware that allows the attacker to remotely control the infected computer and use it for various purposes.
Typically, RATs are used to access files and other data, watch computing activities on the screen and capture screenshots, steal sensitive information (e.g., login credentials, credit card details).
There are many legitimate remote administration/access tools on the Internet. It is common that cybercriminals use those tools with malicious intent too.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FatalRat.
| Known Synonyms |
|---|
Sainbox RAT |
Internal MISP references
UUID 28697d08-27c0-47a9-bfd6-654cac4d55cc which can be used as unique global reference for FatalRat in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.fatal_rat - webarchive
- https://www.youtube.com/watch?v=gjvnVZc11Vg - webarchive
- https://www.trendmicro.com/en_us/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal.html - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape - webarchive
- https://cybersecurity.att.com/blogs/labs-research/new-sophisticated-rat-in-town-fatalrat-analysis - webarchive
- https://thehackernews.com/2022/03/purple-fox-hackers-spotted-using-new.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FatDuke
According to ESET Research, FatDuke is the current flagship backdoor of APT29 and is only deployed on the most interesting machines. It is generally dropped by the MiniDuke backdoor, but ESET also have seen the operators dropping FatDuke using lateral movement tools such as PsExec.The operators regularly repack this malware in order to evade detections. The most recent sample of FatDuke that ESET have seen was compiled on May 24, 2019. They have seen them trying to regain control of a machine multiple times in a few days, each time with a different sample. Their packer, described in a later section, adds a lot of code, leading to large binaries. While the effective code should not be larger than 1MB, ESET have seen one sample weighing in at 13MB, hence our name for this backdoor component: FatDuke.
Internal MISP references
UUID 4325c84b-9a9b-4e7c-977f-20d7ae817b7e which can be used as unique global reference for FatDuke in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Fauppod
Internal MISP references
UUID e363918a-92ec-49c0-b3b2-1d339200417b which can be used as unique global reference for Fauppod in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.fauppod - webarchive
- http://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive
- https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FCT
Ransomware.
Internal MISP references
UUID a4eb3f1f-2cc6-4a0f-9dd8-6ebc192ec0cd which can be used as unique global reference for FCT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FeedLoad
Internal MISP references
UUID a9cd466f-af46-48fa-906e-15cf27525c7f which can be used as unique global reference for FeedLoad in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Felismus
Internal MISP references
UUID 07a41ea7-17b2-4852-bfd7-54211c477dc0 which can be used as unique global reference for Felismus in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Felixroot
Internal MISP references
UUID e58755ac-3d0c-4ed3-afeb-e929816c8018 which can be used as unique global reference for Felixroot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.felixroot - webarchive
- https://medium.com/@Sebdraven/when-a-malware-is-more-complex-than-the-paper-5822fc7ff257 - webarchive
- https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html - webarchive
- https://cocomelonc.github.io/tutorial/2021/09/06/simple-malware-av-evasion-2.html - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
fengine
Internal MISP references
UUID 3087a4ed-1b6c-49f6-980f-59242825d2ee which can be used as unique global reference for fengine in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Feodo
Feodo (also known as Cridex or Bugat) is a Trojan used to commit e-banking fraud and to steal sensitive information from the victims computer, such as credit card details or credentials.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Feodo.
| Known Synonyms |
|---|
Bugat |
Cridex |
Internal MISP references
UUID 66781866-f064-467d-925d-5e5f290352f0 which can be used as unique global reference for Feodo in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.feodo - webarchive
- https://feodotracker.abuse.ch/ - webarchive
- http://www.sempersecurus.org/2012/08/cridex-analysis-using-volatility.html - webarchive
- http://contagiodump.blogspot.com/2012/08/cridex-analysis-using-volatility-by.html - webarchive
- https://securelist.com/analysis/publications/78531/dridex-a-history-of-evolution/ - webarchive
- https://en.wikipedia.org/wiki/Maksim_Yakubets - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FFDroider
According to PCrisk, FFDroider is a malicious program classified as a stealer. It is designed to extract and exfiltrate sensitive data from infected devices. FFDroider targets popular social media and e-commerce platforms in particular.
Internal MISP references
UUID f557e98e-7e8c-450f-a2a2-abbe81a67a90 which can be used as unique global reference for FFDroider in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ficker Stealer
According to CyberArk, this malware is used to steal sensitive information, including login credentials, credit card information, cryptocurrency wallets and browser information from applications such as WinSCP, Discord, Google Chrome, Electrum, etc. It does all that by implementing a different approach than other stealers (we’ll cover it later). Additionally, FickerStealer can function as a File Grabber and collect additional files from the compromised machine, and it can act as a Downloader to download and execute several second-stage malware.
Internal MISP references
UUID 6ad46852-24f3-4415-a4ab-57a52cd8a1cb which can be used as unique global reference for Ficker Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.fickerstealer - webarchive
- https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus - webarchive
- https://threatresearch.ext.hp.com/wp-content/uploads/2021/03/HP_Bromium_Threat_Insights_Report_Q4_2020.pdf - webarchive
- https://blogs.blackberry.com/en/2021/08/threat-thursday-ficker-infostealer-malware - webarchive
- https://www.binarydefense.com/analysis-of-hancitor-when-boring-begets-beacon - webarchive
- https://www.spamhaus.com/custom-content/uploads/2021/04/Botnet-update-Q1-2021.pdf - webarchive
- https://www.cyberark.com/resources/threat-research-blog/fickerstealer-a-new-rust-player-in-the-market - webarchive
- https://twitter.com/3xp0rtblog/status/1321209656774135810 - webarchive
- https://www.bleepingcomputer.com/news/security/fake-microsoft-store-spotify-sites-spread-info-stealing-malware/ - webarchive
- https://medium.com/csis-techblog/gcleaner-garbage-provider-since-2019-2708e7c87a8a - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FileIce
Internal MISP references
UUID ed0b8ac9-973b-4aaa-9904-8c7ed2e73933 which can be used as unique global reference for FileIce in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Filerase
Filerase is a .net API-based utility capable of propagating and recursively deleting files.
Internal MISP references
UUID e5fbb536-4994-4bd5-b151-6d5e41ed9f5b which can be used as unique global reference for Filerase in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.filerase - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-attackers-employ-new-tool-kit-to-wipe-infected-systems - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/shamoon-destructive-threat-re-emerges-new-sting-its-tail - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Final1stSpy
Internal MISP references
UUID 87467366-679d-425c-8bea-b9f77c543252 which can be used as unique global reference for Final1stSpy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FindPOS
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FindPOS.
| Known Synonyms |
|---|
Poseidon |
Internal MISP references
UUID ae914b9a-67a2-425d-bef0-3a9624a207ba which can be used as unique global reference for FindPOS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.findpos - webarchive
- https://blogs.cisco.com/security/talos/poseidon - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://researchcenter.paloaltonetworks.com/2015/03/findpos-new-pos-malware-family-discovered/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FinFisher RAT
FinFisher is a commercial software used to steal information and spy on affected victims. It began with few functionalities which included password harvesting and information leakage, but now it is mostly known for its full Remote Access Trojan (RAT) capabilities. It is mostly known for being used in governmental targeted and lawful criminal investigations. It is well known for its anti-detection capabilities and use of VMProtect.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FinFisher RAT.
| Known Synonyms |
|---|
FinSpy |
Internal MISP references
UUID 541b64bc-87ec-4cc2-aaee-329355987853 which can be used as unique global reference for FinFisher RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.finfisher - webarchive
- https://netzpolitik.org/2020/our-criminal-complaint-german-state-malware-company-finfisher-raided/ - webarchive
- https://securelist.com/finspy-unseen-findings/104322/ - webarchive
- https://www.msreverseengineering.com/blog/2018/2/21/devirtualizing-finspy-phase-2-first-attempt-at-devirtualization - webarchive
- https://www.msreverseengineering.com/blog/2018/2/21/devirtualizing-finspy-phase-4-second-attempt-at-devirtualization - webarchive
- https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process - webarchive
- https://www.codeandsec.com/FinFisher-Malware-Analysis-Part-2 - webarchive
- https://netzpolitik.org/2022/nach-pfaendung-staatstrojaner-hersteller-finfisher-ist-geschlossen-und-bleibt-es-auch/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2018/01/WP-FinFisher.pdf - webarchive
- https://www.msreverseengineering.com/blog/2018/2/21/finspy-vm-unpacking-tutorial-part-3-devirtualization - webarchive
- https://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html - webarchive
- https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/ - webarchive
- https://www.binarly.io/posts/Design_issues_of_modern_EDR%E2%80%99s_bypassing_ETW-based_solutions/index.html - webarchive
- https://artemonsecurity.blogspot.de/2017/01/finfisher-rootkit-analysis.html - webarchive
- https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/ - webarchive
- https://www.welivesecurity.com/2017/09/21/new-finfisher-surveillance-campaigns/ - webarchive
- https://www.msreverseengineering.com/blog/2018/2/21/devirtualizing-finspy-phase-3-fixing-the-function-related-issues - webarchive
- https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/ - webarchive
- https://github.com/RolfRolles/FinSpyVM - webarchive
- https://securelist.com/apt-trends-report-q2-2019/91897/ - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- http://www.msreverseengineering.com/blog/2018/1/23/a-walk-through-tutorial-with-code-on-statically-unpacking-the-finspy-vm-part-one-x86-deobfuscation - webarchive
- https://www.msreverseengineering.com/blog/2018/2/21/wsbjxrs1jjw7qi4trk9t3qy6hr7dye - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FINTEAM
Recently, Check Point researchers spotted a targeted attack against officials within government finance authorities and representatives in several embassies in Europe. The attack, which starts with a malicious attachment disguised as a top secret US document, weaponizes TeamViewer, the popular remote access and desktop sharing software, to gain full control of the infected computer. This is achieved by sideloading another DLL among the legit TeamViewer.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FINTEAM.
| Known Synonyms |
|---|
TeamBot |
Internal MISP references
UUID 045469d0-5bb2-4ed9-9ee2-a0a08f437433 which can be used as unique global reference for FINTEAM in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Fireball
Internal MISP references
UUID 9ad28356-184c-4f02-89f5-1b70981598c3 which can be used as unique global reference for Fireball in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FireBird RAT
Internal MISP references
UUID 0d63d92b-6d4d-470d-9f13-acce0c76911c which can be used as unique global reference for FireBird RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Fire Chili
The purpose of this rootkit/driver is hiding and protecting malicious artifacts from user-mode components(e.g. files, processes, registry keys and network connections). According to Fortguard Labs, this malware uses Direct Kernel Object Modification (DKOM), which involves undocumented kernel structures and objects, for its operations, why this malware has to rely on specific OS builds.
Internal MISP references
UUID 762ea155-1cec-4c67-9c4f-7e8f4c21e19e which can be used as unique global reference for Fire Chili in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FireCrypt
Internal MISP references
UUID c4346ed0-1d74-4476-a78c-299bce0409bd which can be used as unique global reference for FireCrypt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FireMalv
Internal MISP references
UUID 9715c6bc-4b1e-49a2-b1d8-db4f4c4f042c which can be used as unique global reference for FireMalv in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FirstRansom
Internal MISP references
UUID 1ab17959-6254-49af-af26-d34e87073e49 which can be used as unique global reference for FirstRansom in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FishMaster
A custom loader for CobaltStrike.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FishMaster.
| Known Synonyms |
|---|
JollyJellyfish |
Internal MISP references
UUID dd73f0c7-3bc6-4dc9-a0b7-507490df2a84 which can be used as unique global reference for FishMaster in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.fishmaster - webarchive
- https://decoded.avast.io/luigicamastra/backdoored-client-from-mongolian-ca-monpass/ - webarchive
- https://speakerdeck.com/aragorntseng/winnti-is-coming-evolution-after-prosecution-at-hitcon2021 - webarchive
- https://media-exp1.licdn.com/dms/document/C561FAQHhWFRcWmdCPw/feedshare-document-pdf-analyzed/0/1639591145314?e=1658966400&v=beta&t=_uCcyEVg6b_VDiBTvWQIXtBOdQ1GQAAydqGyq62KA3E - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FiveHands
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FiveHands.
| Known Synonyms |
|---|
Thieflock |
Internal MISP references
UUID 4d0dc7a3-07bf-4cb9-ba86-c7f154c6b678 which can be used as unique global reference for FiveHands in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.fivehands - webarchive
- https://www.rewterz.com/rewterz-news/rewterz-threat-alert-financially-motivated-aggressive-group-carrying-out-ransomware-campaigns-active-iocs - webarchive
- https://www.esentire.com/blog/hacker-infrastructure-used-in-cisco-breach-discovered-attacking-a-top-workforce-management-corporation-russias-evil-corp-gang-suspected-reports-esentire - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126b - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-ransomware-attacks-continue - webarchive
- https://research.nccgroup.com/2021/06/15/handy-guide-to-a-new-fivehands-ransomware-variant/ - webarchive
- https://www.bleepingcomputer.com/news/security/yanluowang-ransomware-operation-matures-with-experienced-affiliates/ - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html - webarchive
- https://www.crowdstrike.com/blog/new-ransomware-variant-uses-golang-packer/ - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-249a - webarchive
- https://www.esentire.com/blog/conti-affiliate-exposed-new-domain-names-ip-addresses-and-email-addresses-uncovered-by-esentire - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Flagpro
According to PICUS, Flagpro is malware that collects information from the victim and executes commands in the victim’s environment. It targets Japan, Taiwan, and English-speaking countries. When a victim is infected with Flagpro malware, the malware can do the following:
Download and execute a tool Execute OS commands and send results Collect and send Windows authentication information
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Flagpro.
| Known Synonyms |
|---|
BUSYICE |
Internal MISP references
UUID f6b10719-0f7a-45bc-9e47-1406b9966890 which can be used as unique global reference for Flagpro in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.flagpro - webarchive
- https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_8_hara_en.pdf - webarchive
- https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech - webarchive
- https://vblocalhost.com/uploads/VB2021-50.pdf - webarchive
- https://jp.security.ntt/resources/EN-BlackTech_2021.pdf - webarchive
- https://insight-jp.nttsecurity.com/post/102h7vx/blacktechflagpro - webarchive
- https://cyberandramen.net/2021/12/12/more-flagpro-more-problems/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Flame
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Flame.
| Known Synonyms |
|---|
sKyWIper |
Internal MISP references
UUID c40dbede-490f-4df4-a242-a2461e3cfc4e which can be used as unique global reference for Flame in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.flame - webarchive
- https://www.symantec.com/connect/blogs/flamer-recipe-bluetoothache - webarchive
- https://github.com/juanandresgs/papers/raw/master/Flame%202.0%20Risen%20from%20the%20Ashes.pdf - webarchive
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=ce2df4da-afe9-4a24-b28c-0fb3ba671d95&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments - webarchive
- https://www.crysys.hu/publications/files/tedi/ukatemicrysys_territorialdispute.pdf - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf - webarchive
- https://web.archive.org/web/20230416140914if_/http://www.chinaview.cn/20230411/4e0fa0f4fd1d408aaddeef8be63a4757/202304114e0fa0f4fd1d408aaddeef8be63a4757_20230411161526_0531.pdf - webarchive
- https://www.crysys.hu/publications/files/skywiper.pdf - webarchive
- https://storage.googleapis.com/chronicle-research/Flame%202.0%20Risen%20from%20the%20Ashes.pdf - webarchive
- https://securelist.com/the-flame-questions-and-answers-51/34344/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FLASHFLOOD
FLASHFLOOD will scan inserted removable drives for targeted files, and copy those files from the removable drive to the FLASHFLOOD-infected system. FLASHFLOOD may also log or copy additional data from the victim computer, such as system information or contacts.
Internal MISP references
UUID 0ce7e94e-da65-43e4-86f0-9a0bb21d1118 which can be used as unique global reference for FLASHFLOOD in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FlawedAmmyy
FlawedAmmyy is a well-known Remote Access Tool (RAT) attributed to criminal gang TA505 and used to get the control of target machines. The name reminds the strong link with the leaked source code of Ammyy Admin from which it took the main structure.
Internal MISP references
UUID 18419355-fd28-41a6-bffe-2df68a7166c4 which can be used as unique global reference for FlawedAmmyy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.flawedammyy - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf - webarchive
- https://attack.mitre.org/software/S0381/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/leaked-source-code-ammyy-admin-turned-flawedammyy-rat - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-tahoe - webarchive
- https://habr.com/ru/company/pt/blog/475328/ - webarchive
- https://secrary.com/ReversingMalware/AMMY_RAT_Downloader/ - webarchive
- https://www.fsec.or.kr/common/proc/fsec/bbs/163/fileDownLoad/2297.do - webarchive
- https://www.sans.org/reading-room/whitepapers/reverseengineeringmalware/unpacking-decrypting-flawedammyy-38930 - webarchive
- https://www.proofpoint.com/us/threat-insight/post/ta505-begins-summer-campaigns-new-pet-malware-downloader-andromut-uae-south - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.proofpoint.com/us/threat-insight/post/ta505-abusing-settingcontent-ms-within-pdf-files-distribute-flawedammyy-rat - webarchive
- https://www.youtube.com/watch?v=N4f2e8Mygag - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://web.archive.org/web/20161223002016/https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks - webarchive
- https://www.macnica.net/file/mpressioncss_2018-1h-report_mnc_rev3_nopw.pdf - webarchive
- https://www.npu.gov.ua/news/kiberzlochini/kiberpolicziya-vikrila-xakerske-ugrupovannya-u-rozpovsyudzhenni-virusu-shifruvalnika-ta-nanesenni-inozemnim-kompaniyam-piv-milyarda-dolariv-zbitkiv/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/operation-ta505/ - webarchive
- https://threatrecon.nshc.net/2019/08/29/sectorj04-groups-increased-activity-in-2019/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/ta505-at-it-again-variety-is-the-spice-of-servhelper-and-flawedammyy/ - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FlawedGrace
According to ProofPoint, FlawedGrace is written in C++ and can be categorized as a Remote Access Trojan (RAT). It seems to have been developed in the second half of 2017 mainly.
FlawedGrace uses a series of commands: FlawedGrace also uses a series of commands, provided below for reference: * desktop_stat * destroy_os * target_download * target_module_load * target_module_load_external * target_module_unload * target_passwords * target_rdp * target_reboot * target_remove * target_script * target_servers * target_update * target_upload
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FlawedGrace.
| Known Synonyms |
|---|
GraceWire |
Internal MISP references
UUID ef591233-4246-414b-9fbd-46838f3e5da2 which can be used as unique global reference for FlawedGrace in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.flawedgrace - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://blog.codsec.com/posts/malware/gracewire_adventure/ - webarchive
- https://www.msreverseengineering.com/blog/2019/1/14/a-quick-solution-to-an-ugly-reverse-engineering-problem - webarchive
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf - webarchive
- https://twitter.com/MsftSecIntel/status/1273359829390655488 - webarchive
- https://research.nccgroup.com/2021/12/01/tracking-a-p2p-network-related-with-ta505/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505 - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/whatta-ta-ta505-ramps-activity-delivers-new-flawedgrace-variant - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-tahoe - webarchive
- https://www.crowdstrike.com/blog/how-falcon-complete-stopped-a-solarwinds-serv-u-exploit-campaign/ - webarchive
- https://www.telekom.com/en/blog/group/article/cybersecurity-ta505-s-box-of-chocolate-597672 - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://www.msreverseengineering.com/blog/2021/3/2/an-exhaustively-analyzed-idb-for-flawedgrace - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://web.archive.org/web/20221115161556/https://blog.codsec.com/posts/malware/gracewire_adventure/ - webarchive
- https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/ - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FlexiSpy (Windows)
Internal MISP references
UUID 2431a1e5-4e64-454a-94c8-8a95f88d2d4a which can be used as unique global reference for FlexiSpy (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FlokiBot
Internal MISP references
UUID 057ff707-a008-4ab8-8370-22b689ed3412 which can be used as unique global reference for FlokiBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.floki_bot - webarchive
- https://www.cylance.com/en_us/blog/threat-spotlight-flokibot-pos-malware.html - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/11/floki-bot-and-the-stealthy-dropper/ - webarchive
- https://www.flashpoint-intel.com/blog/cybercrime/floki-bot-emerges-new-malware-kit/ - webarchive
- https://www.arbornetworks.com/blog/asert/flokibot-flock-bots/ - webarchive
- http://blog.talosintel.com/2016/12/flokibot-collab.html#more - webarchive
- http://adelmas.com/blog/flokibot.php - webarchive
- https://www.flashpoint-intel.com/flokibot-curious-case-brazilian-connector/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FlowCloud
Internal MISP references
UUID b018c5a7-ab70-4df0-b5aa-ceb1efd4b541 which can be used as unique global reference for FlowCloud in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.flowcloud - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/flowcloud-version-413-malware-analysis - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/ta410-group-behind-lookback-attacks-against-us-utilities-sector-returns-new - webarchive
- https://www.ironnet.com/blog/china-cyber-attacks-the-current-threat-landscape - webarchive
- https://nao-sec.org/2021/01/royal-road-redive.html - webarchive
- https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/ - webarchive
- https://www.dragos.com/blog/industry-news/new-ics-threat-activity-group-talonite/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FlowerShop
Internal MISP references
UUID 0024c2d9-673f-4999-b240-4ae61a72c9b9 which can be used as unique global reference for FlowerShop in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Floxif
Internal MISP references
UUID b1b2e501-b68f-4e2e-ab98-85e9bda0fbcd which can be used as unique global reference for Floxif in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Flusihoc
Available since 2015, Flusihoc is a versatile C++ malware capable of a variety of DDoS attacks as directed by a Command and Control server. Flusihoc communicates with its C2 via HTTP in plain text.
Internal MISP references
UUID 79e9df7d-abc8-45bd-abd3-be9b975f1a03 which can be used as unique global reference for Flusihoc in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FlyingDutchman
Internal MISP references
UUID a6f4d003-abe5-46ed-9e71-555b067f4d5a which can be used as unique global reference for FlyingDutchman in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FlyStudio
Internal MISP references
UUID 19228908-ba8b-4718-86b3-209c7f1ae0bf which can be used as unique global reference for FlyStudio in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Fobber
Internal MISP references
UUID bb836040-c161-4932-8f89-bc2ca2e8c1c0 which can be used as unique global reference for Fobber in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.fobber - webarchive
- http://blog.wizche.ch/fobber/malware/analysis/2015/08/10/fobber-encryption.html - webarchive
- http://www.govcert.admin.ch/downloads/whitepapers/govcertch_fobber_analysis.pdf - webarchive
- https://www.govcert.admin.ch/blog/12/analysing-a-new-ebanking-trojan-called-fobber - webarchive
- http://byte-atlas.blogspot.ch/2015/08/knowledge-fragment-unwrapping-fobber.html - webarchive
- https://blog.malwarebytes.com/threat-analysis/2015/06/elusive-hanjuan-ek-caught-in-new-malvertising-campaign/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FONIX
Internal MISP references
UUID f8d501bc-cf5a-4e19-a7fa-fb0aac18cc63 which can be used as unique global reference for FONIX in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ForestTiger
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ForestTiger.
| Known Synonyms |
|---|
ScoringMathTea |
Internal MISP references
UUID 685106fc-05ba-4d3b-90c3-91486986c35d which can be used as unique global reference for ForestTiger in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.forest_tiger - webarchive
- https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Lazarus-campaigns-and-backdoors-in-2022-2023.pdf - webarchive
- https://securelist.com/the-lazarus-group-deathnote-campaign/109490/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Formbook
FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Formbook.
| Known Synonyms |
|---|
win.xloader |
Internal MISP references
UUID 8378b417-605e-4196-b31f-a0c96d75aa50 which can be used as unique global reference for Formbook in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook - webarchive
- https://www.cyren.com/blog/articles/example-analysis-of-multi-component-malware - webarchive
- https://asec.ahnlab.com/en/32149/ - webarchive
- https://github.com/itaymigdal/malware-analysis-writeups/blob/main/FormBook/FormBook.md - webarchive
- https://drive.google.com/file/d/1oxINyIJfMtv_upJqRK9vLSchIBaU8wiU/view - webarchive
- https://threatresearch.ext.hp.com/wp-content/uploads/2021/03/HP_Bromium_Threat_Insights_Report_Q4_2020.pdf - webarchive
- https://www.cyberbit.com/formbook-research-hints-large-data-theft-attack-brewing/ - webarchive
- https://www.malware-traffic-analysis.net/2023/06/05/index.html - webarchive
- https://youtu.be/aQwnHIlGSBM - webarchive
- https://blog.cyble.com/2022/07/01/xloader-returns-with-new-infection-technique/ - webarchive
- https://blog.talosintelligence.com/2018/06/my-little-formbook.html - webarchive
- https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/ - webarchive
- https://isc.sans.edu/diary/26806 - webarchive
- https://research.checkpoint.com/2023/following-the-scent-of-trickgate-6-year-old-packer-used-to-deploy-the-most-wanted-malware/ - webarchive
- https://tccontre.blogspot.com/2020/11/interesting-formbook-crypter.html - webarchive
- https://cert.gov.ua/article/955924 - webarchive
- https://insights.oem.avira.com/a-new-technique-to-analyze-formbook-malware-infections/ - webarchive
- https://www.fortinet.com/blog/threat-research/deep-analysis-formbook-new-variant-delivered-phishing-campaign-part-ii - webarchive
- https://www.hornetsecurity.com/en/threat-research/vba-purging-malspam-campaigns/ - webarchive
- https://www.ciphertechsolutions.com/roboski-global-recovery-automation/ - webarchive
- https://www.fortinet.com/blog/threat-research/excel-document-delivers-multiple-malware-exploiting-cve-2017-11882-part-two - webarchive
- https://www.proofpoint.com/us/threat-insight/post/new-whiteshadow-downloader-uses-microsoft-sql-retrieve-malware - webarchive
- https://www.lac.co.jp/lacwatch/report/20220307_002893.html - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/research/cyberattacks-targeting-ukraine-increase.html - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ - webarchive
- https://elastic.github.io/security-research/intelligence/2022/01/01.formbook-adopts-cabless-approach/article/ - webarchive
- https://www.trendmicro.com/en_us/research/21/i/formbook-adds-latest-office-365-0-day-vulnerability-cve-2021-404.html - webarchive
- https://kienmanowar.wordpress.com/2023/07/06/quicknote-examining-formbook-campaign-via-phishing-emails/ - webarchive
- https://www.peerlyst.com/posts/how-to-understand-formbook-a-new-malware-as-a-service-sudhendu? - webarchive
- https://umbrella.cisco.com/blog/navigating-cybersecurity-during-a-pandemic-latest-malware-and-threat-actors - webarchive
- https://www.fortinet.com/blog/threat-research/excel-document-delivers-malware-by-exploiting-cve-2017-11882 - webarchive
- https://www.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revealing-threat-in-the-shadow-by-chi-en-shen-ashley-oleg-bondarenko - webarchive
- https://www.arbornetworks.com/blog/asert/formidable-formbook-form-grabber/ - webarchive
- https://threatresearch.ext.hp.com/javascript-malware-dispensing-rats-into-the-wild/ - webarchive
- http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html - webarchive
- https://www.fireeye.com/blog/threat-research/2017/10/formbook-malware-distribution-campaigns.html - webarchive
- https://blog.malwarebytes.com/threat-analysis/2021/05/revisiting-the-nsis-based-crypter/ - webarchive
- https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ - webarchive
- https://www.virusbulletin.com/virusbulletin/2019/01/vb2018-paper-inside-formbook-infostealer/ - webarchive
- https://link.medium.com/uaBiIXgUU8 - webarchive
- https://securityintelligence.com/posts/roboski-global-recovery-automation/ - webarchive
- https://yoroi.company/research/office-documents-may-the-xll-technique-change-the-threat-landscape-in-2022/ - webarchive
- https://www.malwarebytes.com/blog/threat-intelligence/2022/20221121-threat-intel-report-final.pdf - webarchive
- https://usualsuspect.re/article/formbook-hiding-in-plain-sight - webarchive
- https://www.connectwise.com/resources/formbook-remcos-rat - webarchive
- https://www.fortinet.com/blog/threat-research/deep-analysis-new-formbook-variant-delivered-phishing-campaign-part-I - webarchive
- https://forensicitguy.github.io/xloader-formbook-velvetsweatshop-spreadsheet/ - webarchive
- https://research.loginsoft.com/threat-research/from-innocence-to-malice-the-onenote-malware-campaign-uncovered/ - webarchive
- https://www.zscaler.com/blogs/security-research/technical-analysis-xloaders-code-obfuscation-version-43 - webarchive
- https://www.cyberbit.com/blog/endpoint-security/formbook-research-hints-large-data-theft-attack-brewing/ - webarchive
- http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ - webarchive
- https://blog.talosintelligence.com/2019/07/sweed-agent-tesla.html - webarchive
- https://news.sophos.com/en-us/2020/05/14/raticate/ - webarchive
- https://www.zscaler.com/blogs/security-research/analysis-xloaders-c2-network-encryption - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://blogs.blackberry.com/en/2021/09/threat-thursday-xloader-infostealer - webarchive
- http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://thisissecurity.stormshield.com/2018/03/29/in-depth-formbook-malware-analysis-obfuscation-and-process-injection/ - webarchive
- https://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails - webarchive
- https://www.botconf.eu/wp-content/uploads/2018/12/2018-R-Jullian-In-depth-Formbook-Malware-Analysis.pdf - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ipfs-a-new-data-frontier-or-a-new-cybercriminal-hideout - webarchive
- https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://www.peerlyst.com/posts/how-to-analyse-formbook-a-new-malware-as-a-service-sudhendu?trk=explore_page_resources_recent - webarchive
- https://blog.netlab.360.com/purecrypter - webarchive
- https://blogs.quickheal.com/formbook-malware-returns-new-variant-uses-steganography-and-in-memory-loading-of-multiple-stages-to-steal-data/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FormerFirstRAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FormerFirstRAT.
| Known Synonyms |
|---|
ffrat |
Internal MISP references
UUID 9aacd2c7-bcd6-4a82-8250-cab2e4e2d402 which can be used as unique global reference for FormerFirstRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.former_first_rat - webarchive
- https://researchcenter.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/ - webarchive
- https://unit42.paloaltonetworks.com/atoms/shallowtaurus/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/ - webarchive
- https://threatvector.cylance.com/en_us/home/breaking-down-ff-rat-malware.html - webarchive
- https://decoded.avast.io/luigicamastra/operation-dragon-castling-apt-group-targeting-betting-companies - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FortuneCrypt
Internal MISP references
UUID 02caba7c-1820-40a3-94ae-dc89b5662b3e which can be used as unique global reference for FortuneCrypt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FoxSocket
Internal MISP references
UUID 61b35242-0e16-4502-a909-f4fd5e32abcb which can be used as unique global reference for FoxSocket in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FRat
A RAT employing Node.js, Sails, and Socket.IO to collect information on a target
Internal MISP references
UUID 695f3381-302f-4fd0-b7a5-4e852291ce91 which can be used as unique global reference for FRat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Freenki Loader
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Freenki Loader.
| Known Synonyms |
|---|
SHUTTERSPEED |
Internal MISP references
UUID f86b675a-b7b2-4a40-b4fd-f62fd96440f1 which can be used as unique global reference for Freenki Loader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.freenki - webarchive
- https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/ - webarchive
- https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html - webarchive
- https://www.trendmicro.com/en_us/research/20/l/who-is-the-threat-actor-behind-operation-earth-kitsune-.html - webarchive
- http://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FriedEx
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FriedEx.
| Known Synonyms |
|---|
BitPaymer |
DoppelPaymer |
IEncrypt |
Internal MISP references
UUID 58ae14a9-c4aa-490c-8404-0eb590f5650d which can be used as unique global reference for FriedEx in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.friedex - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-drake - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/account-with-admin-privileges-abused-to-install-bitpaymer-ransomware-via-psexec - webarchive
- https://www.sentinelone.com/wp-content/uploads/2022/02/S1_-SentinelLabs_SanctionsBeDamned_final_02.pdf - webarchive
- https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/ - webarchive
- https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-evil-corp-ransomware-mimics-payloadbin-gang-to-evade-us-sanctions/ - webarchive
- https://www.crowdstrike.com/blog/hades-ransomware-successor-to-indrik-spiders-wastedlocker/ - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf - webarchive
- https://killingthebear.jorgetesta.tech/actors/evil-corp - webarchive
- https://www.welivesecurity.com/2018/01/26/friedex-bitpaymer-ransomware-work-dridex-authors/ - webarchive
- https://assets.sentinelone.com/sentinellabs/sentinellabs_EvilCorp - webarchive
- https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/ - webarchive
- https://www.bleepingcomputer.com/news/security/doppelpaymer-ransomware-launches-site-to-post-victims-data/ - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.youtube.com/watch?v=LUxOcpIRxmg - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/csi-evidence-indicators-for-targeted-ransomware-attacks/ - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://nakedsecurity.sophos.com/2018/09/11/the-rise-of-targeted-ransomware/ - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-drake - webarchive
- https://sites.temple.edu/care/ci-rw-attacks/ - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/ - webarchive
- https://lka.polizei.nrw/presse/schlag-gegen-international-agierendes-netzwerk-von-cyber-kriminellen - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/research/everis-bitpaymer-ransomware-attack-analysis-dridex/ - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html - webarchive
- https://www.armor.com/resources/threat-intelligence/the-evolution-of-doppel-spider-from-bitpaymer-to-grief-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FudModule
FudModule is a user-mode DLL that gets the ability to read and write arbitrary kernel memory via the BYOVD technique. Its main goal is to turn off Windows system monitoring features, which is done by modifying kernel variables and removing kernel callbacks. Its actions may very likely affect various types of security products, e.g. EDRs, firewalls, antimalware and even digital forensics tools.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FudModule.
| Known Synonyms |
|---|
LIGHTSHOW |
Internal MISP references
UUID 49b53f39-3e13-48e7-a2e3-5e173af343b3 which can be used as unique global reference for FudModule in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.fudmodule - webarchive
- https://securityintelligence.com/posts/defensive-considerations-lazarus-fudmodule/ - webarchive
- https://securityintelligence.com/posts/direct-kernel-object-manipulation-attacks-etw-providers/ - webarchive
- https://asec.ahnlab.com/wp-content/uploads/2022/09/Analysis-Report-on-Lazarus-Groups-Rootkit-Attack-Using-BYOVD_Sep-22-2022.pdf - webarchive
- https://www.mandiant.com/resources/blog/lightshift-and-lightshow - webarchive
- https://asec.ahnlab.com/ko/40495/ - webarchive
- https://www.welivesecurity.com/2022/09/30/amazon-themed-campaigns-lazarus-netherlands-belgium/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2022/papers/VB2022-Lazarus-and-BYOVD-evil-to-the-Windows-core.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
win.fujinama
Fujinama is a custom VB info stealer capable to execute custom commands and custom exfiltrations, keylogging and screenshot. It was involved in the compromise of Leonardo SpA, a major Italian aerospace and defense company.
Internal MISP references
UUID efd4ec64-ad22-424b-9b7a-d9060cc29d3b which can be used as unique global reference for win.fujinama in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FunnySwitch
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FunnySwitch.
| Known Synonyms |
|---|
RouterGod |
Internal MISP references
UUID 58eb97d1-0c29-4596-bd4a-4590b28d988f which can be used as unique global reference for FunnySwitch in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.funnyswitch - webarchive
- https://speakerdeck.com/aragorntseng/winnti-is-coming-evolution-after-prosecution-at-hitcon2021 - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0808.pdf - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/#id5-2 - webarchive
- https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FunnyDream
Internal MISP references
UUID 46417b64-928a-43cd-91a6-ecee4c6cd4a7 which can be used as unique global reference for FunnyDream in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.funny_dream - webarchive
- https://nao-sec.org/2021/01/royal-road-redive.html - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-1208.pdf - webarchive
- https://insight-jp.nttsecurity.com/post/102glv5/pandas-new-arsenal-part-3-smanager - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Furtim
Internal MISP references
UUID c9d78931-318c-4b34-af33-c90f6612a4f1 which can be used as unique global reference for Furtim in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FusionDrive
Internal MISP references
UUID 5de632a3-bf82-4cef-90fa-e7199fdb932c which can be used as unique global reference for FusionDrive in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FuwuqiDrama
FuwuqiDrama is a server-side RAT. It manages client connections by utilizing I/O completion ports, which are usually used in high-performance server applications as an elegant solution to manage many clients at once.
It contains two distinguishing hardcoded lists.
First is a list of ~50 video files of South Korean TV series, having their titles translated to Mandarin Chinese, but encoded in the form of Pinyin romanization. That means the sounds are spelled in Latin alphabet without tone marks, for example meiyounihuobuxiaqu.avi represents Can't Live Without You (a K-drama from 2012) or wulalafufu.avi translates to Ohlala Couple (also from 2012).
Second is the list of the following corporations: NVIDIA, Amazon, Intel, Skype, 360Safe, Rising, Tencent, Mozilla, Adobe, Yahoo, Google. The same list is contained in some of the WannaCryptor samples.
FuwuqiDrama stores its configuration in the INI file data\package_con_x86.cat. It contains the port number and a bot identifier, all within a single section called Fuwuqi – the romanized Chinese word for server.
Internal MISP references
UUID 9284445c-96a8-445d-8e9d-93a093ffbe63 which can be used as unique global reference for FuwuqiDrama in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
FuxSocy
FuxSocy has some similarities to win.cerber but is tracked as its own family for now.
Internal MISP references
UUID 289b4ffd-d406-44b1-99d4-3406dfd24adb which can be used as unique global reference for FuxSocy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gacrux
Internal MISP references
UUID 551140ca-001b-49d8-aa06-82a5aebb02dd which can be used as unique global reference for Gacrux in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GalaxyLoader
GalaxyLoader is a simple .NET loader. Its name stems from the .pdb and the function naming.
It seems to make use of iplogger.com for tracking. It employed WMI to check the system for - IWbemServices::ExecQuery - SELECT * FROM Win32_Processor - IWbemServices::ExecQuery - select * from Win32_VideoController - IWbemServices::ExecQuery - SELECT * FROM AntivirusProduct
Internal MISP references
UUID c12f1363-2bc8-4ffb-8f31-cbb5f85e0ffe which can be used as unique global reference for GalaxyLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
gamapos
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular gamapos.
| Known Synonyms |
|---|
pios |
Internal MISP references
UUID 8f785ee5-1663-4972-9a64-f02e7c46ba66 which can be used as unique global reference for gamapos in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gameover DGA
Internal MISP references
UUID c4afb7c6-cfba-40d7-aa79-a2829828ed92 which can be used as unique global reference for Gameover DGA in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gameover P2P
Gameover ZeuS is a peer-to-peer botnet based on components from the earlier ZeuS trojan. According to a report by Symantec, Gameover Zeus has largely been used for banking fraud and distribution of the CryptoLocker ransomware. In early June 2014, the U.S. Department of Justice announced that an international inter-agency collaboration named Operation Tovar had succeeded in temporarily cutting communication between Gameover ZeuS and its command and control servers.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gameover P2P.
| Known Synonyms |
|---|
GOZ |
Mapp |
ZeuS P2P |
Internal MISP references
UUID ffc8c386-e9d6-4889-afdf-ebf37621bc4f which can be used as unique global reference for Gameover P2P in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.gameover_p2p - webarchive
- https://www.blackhat.com/docs/us-15/materials/us-15-Peterson-GameOver-Zeus-Badguys-And-Backends.pdf - webarchive
- https://web.archive.org/web/20141016080249/http://www.symantec.com/connect/blogs/security-vendors-take-action-against-hidden-lynx-malware - webarchive
- https://www.wired.com/2017/03/russian-hacker-spy-botnet/ - webarchive
- https://www.wired.com/?p=2171700 - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://www.cert.pl/wp-content/uploads/2015/12/2013-06-p2p-rap_en.pdf - webarchive
- https://www.lawfareblog.com/what-point-these-nation-state-indictments - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0909.pdf - webarchive
- https://bin.re/blog/three-variants-of-murofets-dga/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf - webarchive
- https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group - webarchive
- https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/ - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
- https://www.justice.gov/opa/pr/us-leads-multi-national-action-against-gameover-zeus-botnet-and-cryptolocker-ransomware - webarchive
- http://www.syssec-project.eu/m/page-media/3/zeus_malware13.pdf - webarchive
- https://www.intel471.com/blog/cybercrime-russia-china-iran-nation-state - webarchive
- https://nbviewer.org/github/tildedennis/zeusmuseum/blob/master/jupyter_notebooks/gameover/2014-05-28/Gameover%20version%202014-05-28.ipynb - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GamePlayerFramework
Internal MISP references
UUID 3efdc56a-793c-4fbb-99ea-a4d53899713a which can be used as unique global reference for GamePlayerFramework in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gamotrol
Internal MISP references
UUID 9664712b-81f1-4c52-ad4d-a657a120fded which can be used as unique global reference for Gamotrol in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gandcrab
GandCrab was a Ransomware-as-a-Service (RaaS) emerged in January 28, 2018, managed by a criminal organization known to be confident and vocal, while running a rapidly evolving ransomware campaign. Through their aggressive, albeit unusual, marketing strategies and constant recruitment of affiliates, they were able to globally distribute a high volume of their malware.
In a surprising announcement on May 31, 2019, the GandCrab’s operators posted on a dark web forum, announced the end of a little more than a year of ransomware operations, citing staggering profit figures. However, If there’s one thing that sets these threat actors apart from other groups, it is that they are unpredictable; so there is always the possibility that they might re-surface in one form or another.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gandcrab.
| Known Synonyms |
|---|
GrandCrab |
Internal MISP references
UUID a8d83baa-cf2e-4329-92d7-06c8ccdeb275 which can be used as unique global reference for Gandcrab in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.gandcrab - webarchive
- https://www.crowdstrike.com/blog/the-evolution-of-revil-ransomware-and-pinchy-spider/ - webarchive
- http://asec.ahnlab.com/1145 - webarchive
- https://tccontre.blogspot.com/2018/11/re-gandcrab-downloader-theres-more-to.html - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-garden - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1 - webarchive
- https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-shutting-down-after-claiming-to-earn-25-billion/ - webarchive
- https://labs.bitdefender.com/2018/02/gandcrab-ransomware-decryption-tool-available-for-free/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf - webarchive
- https://unit42.paloaltonetworks.com/revil-threat-actors/ - webarchive
- https://vimeo.com/449849549 - webarchive
- https://www.crowdstrike.com/blog/pinchy-spider-adopts-big-game-hunting/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-as-a-service-enabler-of-widespread-attacks - webarchive
- https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/ - webarchive
- https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-operator-arrested-in-belarus/ - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/01/behind-scenes-gandcrabs-operation/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2019/01/vidar-gandcrab-stealer-and-ransomware-combo-observed-in-the-wild/ - webarchive
- https://isc.sans.edu/diary/23417 - webarchive
- https://teamt5.org/en/posts/introducing-the-most-profitable-ransomware-revil/ - webarchive
- https://www.advanced-intel.com/post/the-dark-web-of-intrigue-how-revil-used-the-underground-ecosystem-to-form-an-extortion-cartel - webarchive
- https://www.fortinet.com/blog/threat-research/gandcrab-threat-actors-retire.html - webarchive
- https://www.virusbulletin.com/virusbulletin/2019/11/vb2019-paper-different-ways-cook-crab-gandcrab-ransomware-service-raas-analysed-indepth/ - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://hotforsecurity.bitdefender.com/blog/belarus-authorities-arrest-gandcrab-ransomware-operator-23860.html - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf - webarchive
- https://labs.bitdefender.com/2019/06/good-riddance-gandcrab-were-still-fixing-the-mess-you-left-behind - webarchive
- https://gallery.mailchimp.com/c35aef82661dad887b8162a4f/files/e24e8206-a157-4796-a8cb-2b7262cc76e8/CSIS_Threat_Matrix_H1_2019.pdf - webarchive
- https://www.scmagazine.com/home/security-news/ransomware/gandcrab-ransomware-operators-put-in-retirement-papers/ - webarchive
- https://sensorstechforum.com/killswitch-file-now-available-gandcrab-v4-1-2-ransomware/ - webarchive
- https://www.europol.europa.eu/newsroom/news/pay-no-more-universal-gandcrab-decryption-tool-released-for-free-no-more-ransom - webarchive
- https://www.advanced-intel.com/post/inside-revil-extortionist-machine-predictive-insights - webarchive
- https://blog.talosintelligence.com/2018/05/gandcrab-compromised-sites.html - webarchive
- https://blog.intel471.com/2020/03/31/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/ - webarchive
- https://krebsonsecurity.com/2019/07/whos-behind-the-gandcrab-ransomware/ - webarchive
- https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-distributed-by-exploit-kits-appends-gdcb-extension/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2018/01/gandcrab-ransomware-distributed-by-rig-and-grandsoft-exploit-kits/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-garden - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- http://www.vmray.com/cyber-security-blog/gandcrab-ransomware-evolution-analysis/ - webarchive
- https://www.youtube.com/watch?v=LUxOcpIRxmg - webarchive
- https://www.bleepingcomputer.com/news/security/darkside-ransomware-made-90-million-in-just-nine-months/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ - webarchive
- https://news.sophos.com/en-us/2019/03/05/gandcrab-101-all-about-the-most-widely-distributed-ransomware-of-the-moment/ - webarchive
- https://web.archive.org/web/20190331091056/https://myonlinesecurity.co.uk/fake-cdc-flu-pandemic-warning-delivers-gandcrab-5-2-ransomware/ - webarchive
- https://enterprise.verizon.com/resources/reports/2019-data-breach-investigations-report.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/gandcrab-operators-use-vidar-infostealer-as-a-forerunner/ - webarchive
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/ - webarchive
- https://www.trendmicro.com/en_in/research/21/k/global-operations-lead-to-arrests-of-alleged-members-of-gandcrab.html - webarchive
- https://asec.ahnlab.com/en/41450/ - webarchive
- https://labs.bitdefender.com/2019/02/new-gandcrab-v5-1-decryptor-available-now/ - webarchive
- https://news.sophos.com/en-us/2019/05/24/gandcrab-spreading-via-directed-attacks-against-mysql-servers/ - webarchive
- https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-being-distributed-via-malspam-disguised-as-receipts/ - webarchive
- https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gasket
A backdoor used by Mespinoza ransomware gang to maintain access to a compromised network.
Internal MISP references
UUID 7ed854ba-c280-4d5b-9b84-c61dddd43f66 which can be used as unique global reference for Gasket in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gaudox
Gaudox is a http loader, written in C/C++. The author claims to have put much effort into making this bot efficient and stable. Its rootkit functionality hides it in Windows Explorer (32bit only).
Internal MISP references
UUID 591b2882-65ba-4629-9008-51ed3467510a which can be used as unique global reference for Gaudox in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gauss
Internal MISP references
UUID 5f8be453-8f73-47a2-9c9f-e8b9b02f5691 which can be used as unique global reference for Gauss in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.gauss - webarchive
- http://contagiodump.blogspot.com/2012/08/gauss-samples-nation-state-cyber.html - webarchive
- https://web.archive.org/web/20230416140914if_/http://www.chinaview.cn/20230411/4e0fa0f4fd1d408aaddeef8be63a4757/202304114e0fa0f4fd1d408aaddeef8be63a4757_20230411161526_0531.pdf - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gazer
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gazer.
| Known Synonyms |
|---|
WhiteBear |
Internal MISP references
UUID 0a3047b3-6a38-48ff-8f9c-49a5c28e3ada which can be used as unique global reference for Gazer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.gazer - webarchive
- https://securelist.com/introducing-whitebear/81638/ - webarchive
- https://cocomelonc.github.io/malware/2023/07/26/malware-tricks-35.html - webarchive
- https://cocomelonc.github.io/tutorial/2022/04/26/malware-pers-2.html - webarchive
- https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/ - webarchive
- https://github.com/eset/malware-ioc/tree/master/turla - webarchive
- https://www.youtube.com/watch?v=Pvzhtjl86wc - webarchive
- https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf - webarchive
- https://securelist.com/shedding-skin-turlas-fresh-faces/88069/ - webarchive
- https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/ - webarchive
- https://cocomelonc.github.io/tutorial/2022/06/12/malware-pers-7.html - webarchive
- https://pdfhost.io/v/F0@QElMu2_MacProStorage_2017FinalBitdefenderWhitepaperNetrepserA4en_ENBitdefenderWhitepaperNetrepserA4en_ENindd.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GCleaner
Internal MISP references
UUID 874d6868-08fd-4b66-877d-fd2174f0d275 which can be used as unique global reference for GCleaner in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.gcleaner - webarchive
- https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/ - webarchive
- https://n1ght-w0lf.github.io/malware%20analysis/gcleaner-loader/ - webarchive
- https://bazaar.abuse.ch/browse/signature/GCleaner/ - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
gcman
Internal MISP references
UUID ed0586d1-4ff0-4d39-87c7-1414f600d16e which can be used as unique global reference for gcman in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gdrive
According to Unit 42, this is a .NET X64 malware that is capable of interaction with GoogleDrive, allowing an attacker to have victim information uploaded and payloads delivered.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gdrive.
| Known Synonyms |
|---|
DoomDrive |
GoogleDriveSucks |
Internal MISP references
UUID 61c90604-d0f6-437c-920a-f1d6d9f76c55 which can be used as unique global reference for Gdrive in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.gdrive - webarchive
- https://r136a1.info/2022/07/19/a-look-into-apt29s-new-early-stage-google-drive-downloader/ - webarchive
- https://unit42.paloaltonetworks.com/cloaked-ursa-online-storage-services-campaigns/ - webarchive
- https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GearInformer
Internal MISP references
UUID 5e699f4d-9ff6-49dd-bc04-797f0ab2e128 which can be used as unique global reference for GearInformer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GEARSHIFT
According to FireEye, GEARSHIFT is a memory-only dropper for two keylogger DLLs. It is designed to replace a legitimate Fax Service DLL.
Internal MISP references
UUID 06d80b50-703a-4cf9-989e-b8b1bf71144a which can be used as unique global reference for GEARSHIFT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GEMCUTTER
According to FireEye, GEMCUTTER is used in a similar capacity as BACKBEND (downloader), but maintains persistence by creating a Windows registry run key. GEMCUTTER checks for the presence of the mutex MicrosoftGMMZJ to ensure only one copy of GEMCUTTER is executing. If the mutex doesn't exist, the malware creates it and continues execution; otherwise, the malware signals the MicrosoftGMMExit event.
Internal MISP references
UUID e46ae329-a619-4cfc-8059-af326c11ee79 which can be used as unique global reference for GEMCUTTER in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GeminiDuke
Internal MISP references
UUID f3a4863f-1acd-4476-a8c7-1d4c162426e0 which can be used as unique global reference for GeminiDuke in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Get2
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Get2.
| Known Synonyms |
|---|
FRIENDSPEAK |
GetandGo |
Internal MISP references
UUID f6aa0163-bde3-44a2-8acc-3e7a04cf167d which can be used as unique global reference for Get2 in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.get2 - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://github.com/Tera0017/TAFOF-Unpacker - webarchive
- https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/cybercriminal%20groups/TA505/04-10-2019/Malware%20Analysis%2004-10-2019.md - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf - webarchive
- https://blog.fox-it.com/2020/11/16/ta505-a-brief-history-of-their-time/ - webarchive
- https://www.goggleheadedhacker.com/blog/post/13 - webarchive
- https://elis531989.medium.com/funtastic-packers-and-where-to-find-them-41429a7ef9a7 - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-tahoe - webarchive
- https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader - webarchive
- https://www.proofpoint.com/us/threat-insight/post/coronavirus-threat-landscape-update - webarchive
- https://intel471.com/blog/ta505-get2-loader-malware-december-2020/ - webarchive
- https://www.telekom.com/en/blog/group/article/cybersecurity-ta505-returns-with-a-new-bag-of-tricks-602104 - webarchive
- https://www.telekom.com/en/blog/group/article/eager-beaver-a-short-overview-of-the-restless-threat-actor-ta505-609546 - webarchive
- https://www.telekom.com/en/blog/group/article/cybersecurity-ta505-s-box-of-chocolate-597672 - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://blog.intel471.com/2020/07/15/flowspec-ta505s-bulletproof-hoster-of-choice/ - webarchive
- https://www.telekom.com/en/blog/group/article/inside-of-cl0p-s-ransomware-operation-615824 - webarchive
- https://www.hornetsecurity.com/en/security-information/clop-clop-ta505-html-malspam-analysis/ - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GetMail
Internal MISP references
UUID 6f155c95-3090-4730-8d3b-0b246162a83a which can be used as unique global reference for GetMail in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GetMyPass
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GetMyPass.
| Known Synonyms |
|---|
getmypos |
Internal MISP references
UUID d77eacf7-090f-4cf6-a305-79a372241158 which can be used as unique global reference for GetMyPass in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.getmypass - webarchive
- https://github.com/malware-kitten/securitykitten.github.io/blob/master/_posts/2015-01-08-getmypass-point-of-sale-malware-update.md - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/new-pos-malware-kicks-off-holiday-shopping-weekend/ - webarchive
- https://securitykitten.github.io/2015/01/08/getmypass-point-of-sale-malware-update.html - webarchive
- https://securitykitten.github.io/2014/11/26/getmypass-point-of-sale-malware.html - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/the-evolution-of-point-of-sale-pos-malware - webarchive
- https://github.com/malware-kitten/securitykitten.github.io/blob/master/_posts/2014-11-26-getmypass-point-of-sale-malware.md - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
get_pwd
Internal MISP references
UUID a762023d-8d46-43a8-be01-3b2362963de0 which can be used as unique global reference for get_pwd in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gh0stBins
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gh0stBins.
| Known Synonyms |
|---|
Gh0stBins RAT |
Internal MISP references
UUID 07ef4b03-c512-490c-905a-f7c2e3a47eba which can be used as unique global reference for Gh0stBins in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gh0stTimes
Custom RAT developed by the BlackTech actor, based on the Gh0st RAT.
Internal MISP references
UUID 9c89baf1-9639-4990-b218-14680170944f which can be used as unique global reference for Gh0stTimes in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GHAMBAR
According to Mandiant, GHAMBAR is a remote administration tool (RAT) that communicates with its C2 server using SOAP requests over HTTP. Its capabilities include filesystem manipulation, file upload and download, shell command execution, keylogging, screen capture, clipboard monitoring, and additional plugin execution.
Internal MISP references
UUID 4b9216e7-3a64-4b2e-97fd-54697d87cb72 which can be used as unique global reference for GHAMBAR in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ghole
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ghole.
| Known Synonyms |
|---|
CoreImpact (Modified) |
Gholee |
Internal MISP references
UUID ef4383f6-29fd-4b06-9a1f-b788567fd8fd which can be used as unique global reference for Ghole in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ghole - webarchive
- https://www.clearskysec.com/gholee-a-protective-edge-themed-spear-phishing-campaign/ - webarchive
- https://documents.trendmicro.com/assets/wp/wp-operation-woolen-goldfish.pdf - webarchive
- http://www.trendmicro.it/media/wp/operation-woolen-goldfish-whitepaper-en.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GhostEmperor
Internal MISP references
UUID 968e52d1-e1d1-499a-acdc-b21522646e28 which can be used as unique global reference for GhostEmperor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ghostemperor - webarchive
- https://www.kaspersky.com/about/press-releases/2021_ghostemperor-chinese-speaking-apt-targets-high-profile-victims-using-unknown-rootkit - webarchive
- https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/ - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/30094337/GhostEmperor_technical-details_PDF_eng.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gh0stnet
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gh0stnet.
| Known Synonyms |
|---|
Remosh |
Internal MISP references
UUID e1410684-c695-4c89-ae5f-80ced136afbd which can be used as unique global reference for Gh0stnet in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ghostnet - webarchive
- https://www.nartv.org/2019/03/28/10-years-since-ghostnet/ - webarchive
- https://documents.trendmicro.com/assets/wp/wp-detecting-apt-activity-with-network-traffic-analysis.pdf - webarchive
- https://en.wikipedia.org/wiki/GhostNet - webarchive
- http://contagiodump.blogspot.com/2011/07/jul-25-mac-olyx-gh0st-backdoor-in-rar.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GhostAdmin
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GhostAdmin.
| Known Synonyms |
|---|
Ghost iBot |
Internal MISP references
UUID 6201c337-1599-4ced-be9e-651a624c20be which can be used as unique global reference for GhostAdmin in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GhostLocker
Internal MISP references
UUID 9b050f86-edad-40ed-9a93-b7c03444bfa5 which can be used as unique global reference for GhostLocker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ghost RAT
According to Security Ninja, Gh0st RAT (Remote Access Terminal) is a trojan “Remote Access Tool” used on Windows platforms, and has been used to hack into some of the most sensitive computer networks on Earth.
Below is a list of Gh0st RAT capabilities. Take full control of the remote screen on the infected bot. Provide real time as well as offline keystroke logging. Provide live feed of webcam, microphone of infected host. Download remote binaries on the infected remote host. Take control of remote shutdown and reboot of host. Disable infected computer remote pointer and keyboard input. Enter into shell of remote infected host with full control. Provide a list of all the active processes. Clear all existing SSDT of all existing hooks.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ghost RAT.
| Known Synonyms |
|---|
Farfli |
Gh0st RAT |
PCRat |
Internal MISP references
UUID 225fa6cf-dc9c-4b86-873b-cdf1d9dd3738 which can be used as unique global reference for Ghost RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_rat - webarchive
- https://www.intezer.com/blog/malware-analysis/chinaz-relations/ - webarchive
- https://attack.mitre.org/groups/G0096 - webarchive
- https://blogs.jpcert.or.jp/en/2021/10/gh0sttimes.html - webarchive
- https://documents.trendmicro.com/assets/Appendix_Water-Pamola-Attacked-Online-Shops-Via-Malicious-Orders.pdf - webarchive
- http://download01.norman.no/documents/ThemanyfacesofGh0stRat.pdf - webarchive
- https://blog.prevailion.com/2020/06/the-gh0st-remains-same8.html - webarchive
- https://hackcon.org/uploads/327/05%20-%20Kwak.pdf - webarchive
- https://www.fortinet.com/blog/threat-research/deep-panda-log4shell-fire-chili-rootkits - webarchive
- https://documents.trendmicro.com/assets/white_papers/wp-operation-earth-berberoka.pdf - webarchive
- https://blogs.blackberry.com/en/2021/10/drawing-a-dragon-connecting-the-dots-to-find-apt41 - webarchive
- https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-40-LunghiHorejsi.pdf - webarchive
- https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug.pdf - webarchive
- https://cofense.com/blog/open-source-gh0st-rat-still-haunting-inboxes-15-years-after-release/ - webarchive
- https://intel471.com/blog/china-cybercrime-undergrond-deepmix-tea-horse-road-great-firewall/ - webarchive
- https://labs.bitdefender.com/2018/02/operation-pzchao-a-possible-return-of-the-iron-tiger-apt/ - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/185/Bitdefender-Business-2017-WhitePaper-PZCHAO-crea2452-en-EN-GenericUse.pdf - webarchive
- https://raw.githubusercontent.com/yt0ng/cracking_softcell/main/Cracking_SOFTCLL_TLP_WHITE.pdf - webarchive
- https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/ - webarchive
- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-cloud-snooper-report.pdf - webarchive
- https://s.tencent.com/research/report/836.html - webarchive
- https://asec.ahnlab.com/en/32572/ - webarchive
- https://www.nttsecurity.com/docs/librariesprovider3/default-document-library/craftypanda-analysis-report - webarchive
- https://www.zscaler.com/blogs/security-research/catching-rats-over-custom-protocols - webarchive
- https://blog.cylance.com/the-ghost-dragon - webarchive
- https://attack.mitre.org/groups/G0001/ - webarchive
- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/april/decoding-network-data-from-a-gh0st-rat-variant/ - webarchive
- https://www.trendmicro.com/en_us/research/21/l/collecting-in-the-dark-tropic-trooper-targets-transportation-and-government-organizations.html - webarchive
- https://risky.biz/whatiswinnti/ - webarchive
- https://tccontre.blogspot.com/2021/02/gh0strat-anti-debugging-nested-seh-try.html - webarchive
- https://web.archive.org/web/20170311192337/http://download01.norman.no:80/documents/ThemanyfacesofGh0stRat.pdf - webarchive
- https://www.prevailion.com/the-gh0st-remains-the-same-2/ - webarchive
- https://st.drweb.com/static/new-www/news/2021/april/drweb_research_attacks_on_russian_research_institutes_en.pdf - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/ - webarchive
- https://www.intezer.com/blog-chinaz-relations/ - webarchive
- https://web.archive.org/web/20140816135909/https://www.symantec.com/connect/blogs/inside-back-door-attack - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-fleetwood - webarchive
- https://www.youtube.com/watch?v=uakw2HMGZ-I - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-345a - webarchive
- https://www.seqrite.com/blog/rat-used-by-chinese-cyberspies-infiltrating-indian-businesses/ - webarchive
- https://research.nccgroup.com/2018/04/17/decoding-network-data-from-a-gh0st-rat-variant/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-globe - webarchive
- https://st.drweb.com/static/new-www/news/2020/october/Study_of_the_ShadowPad_APT_backdoor_and_its_relation_to_PlugX_en.pdf - webarchive
- http://www.hexblog.com/?p=1248 - webarchive
- https://attack.mitre.org/groups/G0011 - webarchive
- https://blog.talosintelligence.com/2019/09/panda-evolution.html - webarchive
- https://unit42.paloaltonetworks.com/atoms/iron-taurus/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/north-korea-bitten-bitcoin-bug-financially-motivated-campaigns-reveal-new - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-union - webarchive
- https://attack.mitre.org/groups/G0026 - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/webworm-espionage-rats - webarchive
- https://www.trendmicro.com/en_us/research/22/d/new-apt-group-earth-berberoka-targets-gambling-websites-with-old.html - webarchive
- https://www.welivesecurity.com/2021/02/01/operation-nightscout-supply-chain-attack-online-gaming-asia/ - webarchive
- https://www.cisecurity.org/insights/blog/top-10-malware-march-2022 - webarchive
- https://thehackernews.com/2022/04/chinese-hackers-target-vmware-horizon.html - webarchive
- https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html - webarchive
- https://labs.bitdefender.com/wp-content/uploads/downloads/operation-pzchao-inside-a-highly-specialized-espionage-infrastructure/ - webarchive
- https://medium.com/insomniacs/what-happened-between-the-bigbadwolf-and-the-tiger-925549a105b2 - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-edison - webarchive
- http://www.malware-traffic-analysis.net/2018/01/04/index.html - webarchive
- https://www.trendmicro.com/en_us/research/21/d/water-pamola-attacked-online-shops-via-malicious-orders.html - webarchive
- https://blog.bushidotoken.net/2020/06/deep-dive-darkhotel-apt.html - webarchive
- https://decoded.avast.io/luigicamastra/apt-group-planted-backdoors-targeting-high-profile-networks-in-central-asia - webarchive
- https://www.datanet.co.kr/news/articleView.html?idxno=133346 - webarchive
- http://www.nartv.org/mirror/ghostnet.pdf - webarchive
- https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GhostSecret
Internal MISP references
UUID 0b317327-6783-441f-8634-388599cbbff6 which can be used as unique global reference for GhostSecret in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gibberish
Ransomware.
Internal MISP references
UUID f561656c-19d1-4b07-a193-3293d053e774 which can be used as unique global reference for Gibberish in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Giffy
Internal MISP references
UUID 6ad51e4a-b44d-43c8-9f55-b9fe06a2c06d which can be used as unique global reference for Giffy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GIMMICK (Windows)
Internal MISP references
UUID 59e8424b-f2e6-4542-bbb3-0e62a4596a01 which can be used as unique global reference for GIMMICK (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ginwui
Internal MISP references
UUID 7f768705-d852-4c66-a7e0-76fd5016d07f which can be used as unique global reference for Ginwui in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ginzo Stealer
An information stealer written in .NET.
Internal MISP references
UUID 0edf6463-908a-4c3a-861d-70337c9f67bd which can be used as unique global reference for Ginzo Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ginzo - webarchive
- https://blog.talosintelligence.com/haskers-gang-zingostealer/ - webarchive
- https://twitter.com/struppigel/status/1506933328599044100 - webarchive
- https://ke-la.com/information-stealers-a-new-landscape/ - webarchive
- https://www.govcert.ch/downloads/whitepapers/Unflattening-ConfuserEx-Code-in-IDA.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Glasses
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Glasses.
| Known Synonyms |
|---|
Wordpress Bruteforcer |
Internal MISP references
UUID 1c27b1a3-ea2a-45d2-a982-12e1509aa4ad which can be used as unique global reference for Glasses in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GlassRAT
Internal MISP references
UUID d9e6adf2-4f31-48df-a7ef-cf25d299f68c which can be used as unique global reference for GlassRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GlitchPOS
Internal MISP references
UUID d2e0cbfb-c647-48ec-84e2-ca2199cf7d03 which can be used as unique global reference for GlitchPOS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GlobeImposter
GlobeImposter is a ransomware application which is mainly distributed via "blank slate" spam (the spam has no message content and an attached ZIP file), exploits, malicious advertising, fake updates, and repacked installers. GlobeImposter mimics the Globe ransomware family. This malware may prevent execution of Anti-Virus solutions and other OS related security features and may prevent system restoration.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GlobeImposter.
| Known Synonyms |
|---|
Fake Globe |
Internal MISP references
UUID 73806c57-cef8-4f7b-a78b-7949ef83b2c2 which can be used as unique global reference for GlobeImposter in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.globeimposter - webarchive
- https://blog.360totalsecurity.com/en/globeimposter-which-has-more-than-20-variants-is-still-wildly-growing/ - webarchive
- https://www.acronis.com/en-us/blog/posts/globeimposter-ransomware-holiday-gift-necurs-botnet - webarchive
- https://go.group-ib.com/rs/689-LRE-818/images/Group-IB_Ransomware_whitepaper_eng.pdf - webarchive
- https://asec.ahnlab.com/en/48940/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-swathmore - webarchive
- https://www.emsisoft.com/ransomware-decryption-tools/globeimposter - webarchive
- https://isc.sans.edu/diary/23417 - webarchive
- https://www.crowdstrike.com/blog/ransomware-preparedness-a-call-to-action/ - webarchive
- https://www.sentinelone.com/blog/recent-tzw-campaigns-revealed-as-part-of-globeimposter-malware-family/ - webarchive
- https://blog.fortinet.com/2017/08/05/analysis-of-new-globeimposter-ransomware-variant - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/new-doc-globeimposter-ransomware-variant-malspam-campaign-underway/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/holiday-lull-not-so-much - webarchive
- https://info.phishlabs.com/blog/globe-imposter-ransomware-makes-a-new-run - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf - webarchive
- https://www.youtube.com/watch?v=LUxOcpIRxmg - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://blog.ensilo.com/globeimposter-ransomware-technical - webarchive
- https://asec.ahnlab.com/ko/30284/ - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Globe
Internal MISP references
UUID de8e204c-fb65-447e-92bd-200e1c39648c which can be used as unique global reference for Globe in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GlooxMail
Internal MISP references
UUID 18208674-fe8c-447f-9e1d-9ff9a64b2370 which can be used as unique global reference for GlooxMail in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Glupteba
Glupteba is a trojan horse malware that is one of the top ten malware variants of 2021. After infecting a system, the Glupteba malware can be used to deliver additional malware, steal user authentication information, and enroll the infected system in a cryptomining botnet.
Internal MISP references
UUID 978cfb82-5fe9-46d2-9607-9bcdfeaaa58c which can be used as unique global reference for Glupteba in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.glupteba - webarchive
- https://habr.com/ru/company/solarsecurity/blog/578900/ - webarchive
- https://www.welivesecurity.com/2014/03/18/operation-windigo-the-vivisection-of-a-large-linux-server-side-credential-stealing-malware-campaign/ - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/400/Bitdefender-PR-Whitepaper-MosaicLoader-creat5540-en-EN.pdf - webarchive
- https://www.domaintools.com/resources/blog/identifying-network-infrastructure-related-to-a-who-spoofing-campaign - webarchive
- https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf - webarchive
- https://decoded.avast.io/martinhron/meris-and-trickbot-standing-on-the-shoulders-of-giants/ - webarchive
- https://medium.com/csis-techblog/installcapital-when-adware-becomes-pay-per-install-cyber-crime-15516249a451 - webarchive
- https://news.sophos.com/en-us/2020/06/24/glupteba-report/?cmp=30728 - webarchive
- https://blog.chainalysis.com/reports/2022-crypto-crime-report-preview-malware/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/glupteba-campaign-hits-network-routers-and-updates-cc-servers-with-data-from-bitcoin-transactions/ - webarchive
- https://cocomelonc.github.io/malware/2023/06/19/malware-av-evasion-17.html - webarchive
- https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/1_Complaint.pdf - webarchive
- https://dissectingmalwa.re/the-blame-game-about-false-flags-and-overwritten-mbrs.html - webarchive
- https://blog.google/threat-analysis-group/disrupting-glupteba-operation/ - webarchive
- http://resources.infosecinstitute.com/tdss4-part-1/ - webarchive
- https://thehackernews.com/2022/03/over-200000-microtik-routers-worldwide.html - webarchive
- https://labs.k7computing.com/?p=22319 - webarchive
- https://www.welivesecurity.com/2018/03/22/glupteba-no-longer-windigo/ - webarchive
- https://community.riskiq.com/article/2a36a7d2/description - webarchive
- https://blog.google/technology/safety-security/new-action-combat-cyber-crime/ - webarchive
- https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ - webarchive
- https://nakedsecurity.sophos.com/2020/06/24/glupteba-the-bot-that-gets-secret-messages-from-the-bitcoin-blockchain/ - webarchive
- https://www.trendmicro.com/en_us/research/21/j/ransomware-operators-found-using-new-franchise-business-model.html - webarchive
- https://www.nozominetworks.com/blog/tracking-malicious-glupteba-activity-through-the-blockchain/ - webarchive
- https://www.welivesecurity.com/2011/03/02/tdl4-and-glubteba-piggyback-piggybugs/ - webarchive
- https://krebsonsecurity.com/2022/06/the-link-between-awm-proxy-the-glupteba-botnet/?utm_source=dlvr.it&utm_medium=twitter - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GoBotKR
Internal MISP references
UUID 56060ca3-ee34-4df9-bcaa-70267d8440c1 which can be used as unique global reference for GoBotKR in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
goCryptoLocker
Internal MISP references
UUID f93da83e-0c2f-4dc0-82c6-2fcc6339dcf2 which can be used as unique global reference for goCryptoLocker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.gocryptolocker - webarchive
- https://github.com/LimerBoy/goCryptoLocker/blob/master/main.go - webarchive
- https://id-ransomware.blogspot.com/2020/04/gocryptolocker-ransomware.html - webarchive
- https://twitter.com/GrujaRS/status/1254657823478353920 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Godlike12
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Godlike12.
| Known Synonyms |
|---|
GOSLU |
Internal MISP references
UUID f62ad36f-e274-4fdb-b71d-887f9cd9c215 which can be used as unique global reference for Godlike12 in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.godlike12 - webarchive
- https://www.volexity.com/blog/2020/03/31/storm-cloud-unleashed-tibetan-community-focus-of-highly-targeted-fake-flash-campaign/ - webarchive
- https://securelist.com/holy-water-ongoing-targeted-water-holing-attack-in-asia/96311/ - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
goDoH
Proof of concept for data exfiltration via DoH, written in Go.
Internal MISP references
UUID b54b4238-550f-42a7-9e62-d1ad5e4d3904 which can be used as unique global reference for goDoH in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Godzilla Loader
Internal MISP references
UUID 9cfdc3ea-c838-4ac5-bff2-57c92ec24b48 which can be used as unique global reference for Godzilla Loader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gofing
A file infector written in Go, discovered by Karsten Hahn in February 2022. According to Karsten, despite its internal naming, it is not polymorphic and the virus body is not encrypted. Gofing uses the Coldfire Golang malware development library.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gofing.
| Known Synonyms |
|---|
Velocity Polymorphic Compression Malware |
Internal MISP references
UUID ba142293-2f22-46e3-8b8e-086f3571f14c which can be used as unique global reference for Gofing in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Goggles
Internal MISP references
UUID 7d89e8dc-4999-47e9-b497-b476e368a8d2 which can be used as unique global reference for Goggles in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GoGoogle
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GoGoogle.
| Known Synonyms |
|---|
BossiTossi |
Internal MISP references
UUID 034a3db0-b53c-4ec1-9390-4b6f214e1233 which can be used as unique global reference for GoGoogle in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GOLDBACKDOOR
Internal MISP references
UUID 54f5cf02-6fdc-43b4-af06-87af1a901264 which can be used as unique global reference for GOLDBACKDOOR in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.goldbackdoor - webarchive
- https://github.com/blackorbird/APT_REPORT/blob/master/group123/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf - webarchive
- https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf - webarchive
- https://www.0x0v1.com/rearchive-goldbackdoor/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GoldenEye
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GoldenEye.
| Known Synonyms |
|---|
Petya/Mischa |
Internal MISP references
UUID d7196f6a-757b-4124-ae28-f403e5d84fcb which can be used as unique global reference for GoldenEye in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.goldeneye - webarchive
- https://blog.malwarebytes.com/cybercrime/2017/07/keeping-up-with-the-petyas-demystifying-the-malware-family/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/12/goldeneye-ransomware-the-petyamischa-combo-rebranded/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GoldenHelper
Internal MISP references
UUID 1dd854b4-d8e6-438c-a0b1-6991b8b6ff92 which can be used as unique global reference for GoldenHelper in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.goldenhelper - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/goldenspy-chapter-4-goldenhelper-malware-embedded-in-official-golden-tax-software/ - webarchive
- https://tomiwa-xy.medium.com/static-analysis-of-goldenhelper-malware-golden-tax-malware-d9f85a88e74d - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GoldenSpy
According securityweek, GoldenSpy, the malware was observed as part of a campaign that supposedly started in April 2020, but some of the identified samples suggest the threat has been around since at least December 2016.
One of the compromised organizations, a global technology vendor that conducts government business in the US, Australia and UK, and which recently opened offices in China, became infected after installing “Intelligent Tax,” a piece of software from the Golden Tax Department of Aisino Corporation, which a local bank required for paying local taxes.
Although it worked as advertised, the software was found to install a hidden backdoor to provide remote operators with the possibility to execute Windows commands or upload and run files.
Internal MISP references
UUID 86b8bd8d-19c5-4c7a-befd-0eb6297776bc which can be used as unique global reference for GoldenSpy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.goldenspy - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/goldenspy-chapter-3-new-and-improved-uninstaller/ - webarchive
- https://www.ic3.gov/Media/News/2020/201103-1.pdf - webarchive
- https://www.atlanticcouncil.org/wp-content/uploads/2020/07/Breaking-trust-Shades-of-crisis-across-an-insecure-software-supply-chain.pdf - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/goldenspy-chapter-4-goldenhelper-malware-embedded-in-official-golden-tax-software/ - webarchive
- https://trustwave.azureedge.net/media/16908/the-golden-tax-department-and-emergence-of-goldenspy-malware.pdf - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/ - webarchive
- https://www.bka.de/SharedDocs/Downloads/DE/IhreSicherheit/Warnhinweise/WarnhinweisGOLDENSPY.pdf - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/goldenspy-chapter-two-the-uninstaller/ - webarchive
- https://www.ic3.gov/media/news/2020/200728.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GoldMax
Gold Max is a Golang written command and control backdoor used by the NOBELIUM threat actor group. It uses several different techniques to obfuscate its actions and evade detection. The malware writes an encrypted configuration file to disk, where the file name and AES-256 cipher keys are unique per implant and based on environmental variables and information about the network where it is running.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GoldMax.
| Known Synonyms |
|---|
SUNSHUTTLE |
Internal MISP references
UUID 9a3429d7-e4a8-43c5-8786-0b3a1c841a5f which can be used as unique global reference for GoldMax in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.goldmax - webarchive
- https://umbrella.cisco.com/blog/cybersecurity-threat-spotlight-backdoors-rats-loaders-evasion-techniques - webarchive
- https://securelist.com/tomiris-called-they-want-their-turla-malware-back/109552/ - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-110a - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf - webarchive
- https://x0r19x91.gitlab.io/post/malware-analysis/sunshuttle/ - webarchive
- https://securelist.com/it-threat-evolution-q2-2023/110355/ - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-105a - webarchive
- https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ - webarchive
- https://securelist.com/extracting-type-information-from-go-binaries/104715/ - webarchive
- https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/ - webarchive
- https://www.youtube.com/watch?v=koZkHEJqPrU - webarchive
- https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GoldDragon
GoldDragon was a second-stage backdoor which established a permanent presence on the victim’s system once the first-stage, file-less, PowerShell-based attack leveraging steganography was executed. The initial attack was observed first in December 2017, when a Korean-language spear phishing campaing targeted organizations linked with Pyeongchang Winter Olympics 2018. GoldDragon was delivered once the attacker had gained an initial foothold in the targeted environment.
The malware was capable of a basic reconnaissance, data exfiltration and downloading of additional components from its C&C server.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GoldDragon.
| Known Synonyms |
|---|
Lovexxx |
Internal MISP references
UUID 2297799c-f93c-4903-b9af-32b6b599912c which can be used as unique global reference for GoldDragon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.gold_dragon - webarchive
- https://asec.ahnlab.com/en/31089/ - webarchive
- https://www.youtube.com/watch?v=rfzmHjZX70s - webarchive
- https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html - webarchive
- https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite - webarchive
- https://i.blackhat.com/asia-21/Friday-Handouts/as-21-Kuo-We-Are-About-To-Land-How-CloudDragon-Turns-A-Nightmare-Into-Reality.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Golroted
Internal MISP references
UUID 9cd98c61-0dfa-4af6-b334-65eb43bc8d9d which can be used as unique global reference for Golroted in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GoMet
Internal MISP references
UUID 020a84b4-d717-48e6-9333-07c55523bc57 which can be used as unique global reference for GoMet in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gomorrah stealer
Gomorrah is a stealer with no or little obfuscation that appeared around March 2020. It is sold for about 150$ lifetime for v4 (originally 400$ for v3) or 100$ per month by its developer called "th3darkly / lucifer" (which is also the developer of CosaNostra botnet). The malware's main functionalities are stealing (passwords, cryptocurrency wallets) and loading of tasks and other payloads.
Internal MISP references
UUID ea9a9585-2a99-42b9-a724-bf7af82bb986 which can be used as unique global reference for Gomorrah stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Goodor
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Goodor.
| Known Synonyms |
|---|
Fuerboos |
Internal MISP references
UUID 91b52a5f-420a-484b-8e1e-a91d402db6c5 which can be used as unique global reference for Goodor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.goodor - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks - webarchive
- https://norfolkinfosec.com/a-new-look-at-old-dragonfly-malware-goodor/ - webarchive
- https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GoogleDrive RAT
Internal MISP references
UUID d1298818-6425-49be-9764-9f119d964efd which can be used as unique global reference for GoogleDrive RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GooPic Drooper
Internal MISP references
UUID 1ebb6107-f97b-45f6-ae81-a671ac437181 which can be used as unique global reference for GooPic Drooper in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GootKit
Gootkit is a banking trojan consisting of an x86 loader and a payload embedding nodejs as well as a set of js scripts. The loader downloads the payload, stores it in registry and injects it in a copy of the loader process. The loader also contains two encrypted DLLs intended to be injected into each browser process launched in order to place the payload in man in the browser and allow it to apply the webinjects received from the command and control server on HTTPx exchanges. This allows Gootkit to intercept HTTPx requests and responses, steal their content or modify it according to the webinjects.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GootKit.
| Known Synonyms |
|---|
Waldek |
Xswkit |
talalpek |
Internal MISP references
UUID 329efac7-922e-4d8b-90a9-4a87c3281753 which can be used as unique global reference for GootKit in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.gootkit - webarchive
- https://www.sentinelone.com/blog/gootkit-banking-trojan-persistence-other-capabilities/ - webarchive
- https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/master/Delivery/Gootkit-malware.md - webarchive
- http://www.vkremez.com/2018/04/lets-learn-in-depth-dive-into-gootkit.html - webarchive
- https://dissectingmalwa.re/nicht-so-goot-breaking-down-gootkit-and-jasper-ftcode.html - webarchive
- https://news.drweb.com/show/?i=4338&lng=en - webarchive
- https://www.sentinelone.com/blog/gootkit-banking-trojan-deep-dive-anti-analysis-features/ - webarchive
- https://www.s21sec.com/en/blog/2016/05/reverse-engineering-gootkit/ - webarchive
- https://www.youtube.com/watch?v=242Tn0IL2jE - webarchive
- https://securelist.com/blog/research/76433/inside-the-gootkit-cc-server/ - webarchive
- https://unit42.paloaltonetworks.com/wireshark-tutorial-emotet-infection/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://resource.redcanary.com/rs/003-YRU-314/images/2022_ThreatDetectionReport_RedCanary.pdf - webarchive
- https://www.certego.net/en/news/malware-tales-gootkit/ - webarchive
- http://blog.cert.societegenerale.com/2015/04/analyzing-gootkits-persistence-mechanism.html - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/fake-judicial-spam-leads-to-backdoor-with-fake-certificate-authority/ - webarchive
- https://forums.juniper.net/t5/Security-Now/New-Gootkit-Banking-Trojan-variant-pushes-the-limits-on-evasive/ba-p/319055 - webarchive
- https://dannyquist.github.io/gootkit-reversing-ghidra/ - webarchive
- https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/?cmp=30728 - webarchive
- https://securityintelligence.com/gootkit-bobbing-and-weaving-to-avoid-prying-eyes/ - webarchive
- https://blogs.blackberry.com/en/2020/04/threat-spotlight-gootkit-banking-trojan - webarchive
- https://www.youtube.com/watch?v=QgUlPvEE4aw - webarchive
- https://www.trendmicro.com/en_us/research/20/l/investigating-the-gootkit-loader.html - webarchive
- https://www.us-cert.gov/ncas/alerts/TA16-336A - webarchive
- https://labs.sentinelone.com/gootkit-banking-trojan-deep-dive-anti-analysis-features/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2020/11/german-users-targeted-with-gootkit-banker-or-revil-ransomware/ - webarchive
- https://securelist.com/gootkit-the-cautious-trojan/102731/ - webarchive
- https://blogs.blackberry.com/en/2021/11/revil-under-the-microscope - webarchive
- https://www.trendmicro.com/en_us/research/23/a/gootkit-loader-actively-targets-the-australian-healthcare-indust.html - webarchive
- https://www.trendmicro.com/en_us/research/22/g/gootkit-loaders-updated-tactics-and-fileless-delivery-of-cobalt-strike.html - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://twitter.com/MsftSecIntel/status/1366542130731094021 - webarchive
- https://twitter.com/jhencinski/status/1464268732096815105 - webarchive
- https://securityintelligence.com/gootkit-developers-dress-it-up-with-web-traffic-proxy/ - webarchive
- https://5556002.fs1.hubspotusercontent-na1.net/hubfs/5556002/2022%20PDF%20Download%20Assets/ADA%20Compliant%20pdfs/Reports/PUBLIC_Gootloader%20-%20Foreign%20Intelligence%20Service.pdf - webarchive
- https://www.f5.com/labs/articles/threat-intelligence/tackling-gootkit-s-traps - webarchive
- https://connect.ed-diamond.com/MISC/MISC-100/Analyse-du-malware-bancaire-Gootkit-et-de-ses-mecanismes-de-protection - webarchive
- https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gophe
Internal MISP references
UUID fb2e42bf-6845-4eb3-9fe7-85a447762bce which can be used as unique global reference for Gophe in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gopuram
Internal MISP references
UUID 6dc4e71e-7372-4287-bdee-04da17a0d275 which can be used as unique global reference for Gopuram in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GOTROJ
Internal MISP references
UUID b4446bc0-41a1-4934-9fd0-a73b91589994 which can be used as unique global reference for GOTROJ in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GovRAT
Internal MISP references
UUID 9fbb5822-1660-4651-9f57-b6f83a881786 which can be used as unique global reference for GovRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gozi
2000 Ursnif aka Snifula 2006 Gozi v1.0, Gozi CRM, CRM, Papras 2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*) -> 2010 Gozi Prinimalka -> Vawtrak/Neverquest
In 2006, Gozi v1.0 ('Gozi CRM' aka 'CRM') aka Papras was first observed. It was offered as a CaaS, known as 76Service. This first version of Gozi was developed by Nikita Kurmin, and he borrowed code from Ursnif aka Snifula, a spyware developed by Alexey Ivanov around 2000, and some other kits. Gozi v1.0 thus had a formgrabber module and often is classified as Ursnif aka Snifula.
In September 2010, the source code of a particular Gozi CRM dll version was leaked, which led to Vawtrak/Neverquest (in combination with Pony) via Gozi Prinimalka (a slightly modified Gozi v1.0) and Gozi v2.0 (aka 'Gozi ISFB' aka 'ISFB' aka Pandemyia). This version came with a webinject module.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gozi.
| Known Synonyms |
|---|
CRM |
Gozi CRM |
Papras |
Snifula |
Ursnif |
Internal MISP references
UUID 75329c9e-a218-4299-87b2-8f667cd9e40c which can be used as unique global reference for Gozi in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.gozi - webarchive
- https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree - webarchive
- https://www.secureworks.com/research/gozi - webarchive
- https://blog.gdatasoftware.com/2016/11/29325-analysis-ursnif-spying-on-your-data-since-2007 - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-swathmore - webarchive
- https://github.com/mlodic/ursnif_beacon_decryptor - webarchive
- https://0xtoxin.github.io/threat%20breakdown/Gozi-Italy-Campaign/ - webarchive
- https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html - webarchive
- http://researchcenter.paloaltonetworks.com/2017/02/unit42-banking-trojans-ursnif-global-distribution-networks-identified/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://securelist.com/financial-cyberthreats-in-2020/101638/ - webarchive
- http://blog.malwaremustdie.org/2013/02/the-infection-of-styx-exploit-kit.html - webarchive
- https://therecord.media/gozi-malware-gang-member-arrested-in-colombia/ - webarchive
- https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/gozi-italian-shellcode-dance - webarchive
- https://securityintelligence.com/x-force/wailingcrab-malware-misues-mqtt-messaging-protocol/ - webarchive
- https://lokalhost.pl/gozi_tree.txt - webarchive
- https://www.youtube.com/watch?v=BcFbkjUVc7o - webarchive
- https://www.deepinstinct.com/2021/05/26/deep-dive-packing-software-cryptone/ - webarchive
- https://kostas-ts.medium.com/ursnif-vs-italy-il-pdf-del-destino-5c83d6281072 - webarchive
- https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://medium.com/csis-techblog/chapter-1-from-gozi-to-isfb-the-history-of-a-mythical-malware-family-82e592577fef - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GPCode
Internal MISP references
UUID 127c3d76-6323-4363-93e0-cd06ade0dd52 which can be used as unique global reference for GPCode in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.gpcode - webarchive
- https://www.symantec.com/security_response/writeup.jsp?docid=2007-071711-3132-99&tabid=2 - webarchive
- https://de.securelist.com/analysis/59479/erpresser/ - webarchive
- http://www.zdnet.com/article/whos-behind-the-gpcode-ransomware/ - webarchive
- http://www.xylibox.com/2011/01/gpcode-ransomware-2010-simple-analysis.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GrabBot
Internal MISP references
UUID 0092b005-b032-4e34-9c7e-7dd0e71a85fb which can be used as unique global reference for GrabBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Graftor
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Graftor.
| Known Synonyms |
|---|
MewsSpy |
Internal MISP references
UUID 94b942e2-cc29-447b-97e2-e496cbf2aadf which can be used as unique global reference for Graftor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GRAMDOOR
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GRAMDOOR.
| Known Synonyms |
|---|
Small Sieve |
Internal MISP references
UUID 0dfa69cc-cc70-4944-af42-7e1f923e6b6b which can be used as unique global reference for GRAMDOOR in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.gramdoor - webarchive
- https://thehackernews.com/2022/02/irans-muddywater-hacker-group-using-new.html - webarchive
- https://www.mandiant.com/resources/telegram-malware-iranian-espionage - webarchive
- https://www.inforisktoday.com/muddywater-targets-critical-infrastructure-in-asia-europe-a-18611 - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-055A_Iranian_Government-Sponsored_Actors_Conduct_Cyber_Operations.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Grandoreiro
According to ESET Research, Grandoreirois a Latin American banking trojan targeting Brazil, Mexico, Spain and Peru. As such, it shows unusual effort by its authors to evade detection and emulation, and progress towards a modular architecture.
Internal MISP references
UUID c62219e2-74a3-49c2-a33d-0789b820c467 which can be used as unique global reference for Grandoreiro in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.grandoreiro - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/grandoreiro-banking-malware-resurfaces-for-tax-season - webarchive
- http://www.interior.gob.es/prensa/noticias/-/asset_publisher/GHU8Ap6ztgsg/content/id/13552853 - webarchive
- https://www.zscaler.com/blogs/security-research/grandoreiro-banking-trojan-new-ttps-targeting-various-industry-verticals - webarchive
- https://securelist.com/the-tetrade-brazilian-banking-malware/97779/ - webarchive
- https://www.metabaseq.com/grandoreiro-banking-malware-deciphering-the-dga/ - webarchive
- https://www.incibe.es/sites/default/files/contenidos/estudios/doc/incibe-cert_study_grandoreiro_analysis_2022_v1.pdf - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://therecord.media/spain-arrests-16-for-distributing-the-mekotio-and-grandoreiro-banking-trojans/ - webarchive
- https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/copacabana-barcelona-cross-continental-threat-brazilian-banking-malware - webarchive
- https://seguranca-informatica.pt/the-updated-grandoreiro-malware-equipped-with-latenbot-c2-features-in-q2-2020-now-extended-to-portuguese-banks - webarchive
- https://blueliv.com/resources/reports/MiniReport-Blueliv-Bancos-ESP-LAT.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GrandSteal
Internal MISP references
UUID 626de4fc-cfa4-4fbc-ab35-4c9ab9fdec14 which can be used as unique global reference for GrandSteal in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GraphDrop
PANW Unit 42 describes this malware as capable of up and downloading files as well as loading additional shellcode payloads into selected target processes. It uses the Microsoft Graph API and Dropbox API as C&C channel.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GraphDrop.
| Known Synonyms |
|---|
GraphicalProton |
SPICYBEAT |
Internal MISP references
UUID 15d96a22-118b-4933-8258-e9cc4dd9719a which can be used as unique global reference for GraphDrop in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.graphdrop - webarchive
- https://www.avertium.com/resources/threat-reports/evolution-of-russian-apt29-new-attacks-and-techniques-uncovered - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0727-1.pdf - webarchive
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a - webarchive
- https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/ - webarchive
- https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing - webarchive
- https://www.fortinet.com/blog/threat-research/teamcity-intrusion-saga-apt29-suspected-exploiting-cve-2023-42793 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GraphicalNeutrino
This loader abuses the benign service Notion for data exchange.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GraphicalNeutrino.
| Known Synonyms |
|---|
SNOWYAMBER |
Internal MISP references
UUID cb92a200-b4f0-4983-8d5d-6bf529b66da9 which can be used as unique global reference for GraphicalNeutrino in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.graphical_neutrino - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0727-1.pdf - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0127.pdf - webarchive
- https://www.gov.pl/attachment/ee91f24d-3e67-436d-aa50-7fa56acf789d - webarchive
- https://blogs.blackberry.com/en/2023/03/nobelium-targets-eu-governments-assisting-ukraine - webarchive
- https://mrtiepolo.medium.com/sophisticated-apt29-campaign-abuses-notion-api-to-target-the-european-commission-200188059f58 - webarchive
- https://mssplab.github.io/threat-hunting/2023/06/02/malware-analysis-apt29.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Graphican
According to Symantec, Graphican is an evolution of the known APT15 backdoor Ketrican, which itself was based on a previous malware - BS2005 - also used by APT15. Graphican has the same basic functionality as Ketrican, with the difference between them being Graphican’s use of the Microsoft Graph API and OneDrive to obtain its command-and-control (C&C) infrastructure.
Internal MISP references
UUID ccaefb44-1cbb-4f91-bd2d-ea5735446d1d which can be used as unique global reference for Graphican in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Graphiron
Downloader / information stealer used by UAC-0056, observed since at least October 2022.
Internal MISP references
UUID 968e330d-281e-4647-99fd-d9903aa6bbba which can be used as unique global reference for Graphiron in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Graphite
Trellix describes Graphite as a malware using the Microsoft Graph API and OneDrive for C&C. It was found being deployed in-memory only and served as a downloader for Empire.
Internal MISP references
UUID 8ecc6605-eed1-416c-bc8b-0dc1147d3c2b which can be used as unique global reference for Graphite in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.graphite - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-009.pdf - webarchive
- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ - webarchive
- https://www.trellix.com/en-gb/about/newsroom/stories/threat-labs/prime-ministers-office-compromised.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Graphon
Internal MISP references
UUID 9ab9e88f-b365-4d58-af52-e9d19ab00348 which can be used as unique global reference for Graphon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GraphSteel
This malware was seen during the cyberattacks on Ukrainian state organizations. It is one of two used backdoors written in Go and attributed to UAC-0056 (SaintBear, UNC2589, TA471).
Internal MISP references
UUID 64963521-0181-4220-935a-a6deefa871b2 which can be used as unique global reference for GraphSteel in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.graphsteel - webarchive
- https://inquest.net/blog/2022/04/07/ukraine-cyberwar-overview - webarchive
- https://www.sentinelone.com/blog/threat-actor-uac-0056-targeting-ukraine-with-fake-translation-software/ - webarchive
- https://www.intezer.com/blog/research/elephant-malware-targeting-ukrainian-orgs/ - webarchive
- https://www.mandiant.com/resources/spear-phish-ukrainian-entities - webarchive
- https://cert.gov.ua/article/38374 - webarchive
- https://cip.gov.ua/en/news/khto-stoyit-za-kiberatakami-na-ukrayinsku-kritichnu-informaciinu-infrastrukturu-statistika-15-22-bereznya - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ - webarchive
- https://www.secureworks.com/research/the-growing-threat-from-infostealers - webarchive
- https://www.govinfosecurity.com/cyber-espionage-actor-deploying-malware-using-excel-a-18830 - webarchive
- https://www.cybercom.mil/Media/News/Article/3098856/cyber-national-mission-force-discloses-iocs-from-ukrainian-networks/ - webarchive
- https://businessinsights.bitdefender.com/deep-dive-into-the-elephant-framework-a-new-cyber-threat-in-ukraine - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Grateful POS
POS malware targets systems that run physical point-of-sale device and operates by inspecting the process memory for data that matches the structure of credit card data (Track1 and Track2 data), such as the account number, expiration date, and other information stored on a card’s magnetic stripe. After the cards are first scanned, the personal account number (PAN) and accompanying data sit in the point-of-sale system’s memory unencrypted while the system determines where to send it for authorization. Masked as the LogMein software, the GratefulPOS malware appears to have emerged during the fall 2017 shopping season with low detection ratio according to some of the earliest detections displayed on VirusTotal. The first sample was upload in November 2017. Additionally, this malware appears to be related to the Framework POS malware, which was linked to some of the high-profile merchant breaches in the past.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Grateful POS.
| Known Synonyms |
|---|
FrameworkPOS |
SCRAPMINT |
trinity |
Internal MISP references
UUID f82f8d2c-695e-461a-bd4f-a7dc58531063 which can be used as unique global reference for Grateful POS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.grateful_pos - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://usa.visa.com/dam/VCOM/global/support-legal/documents/cybercrime-groups-targeting-fuel-dispenser-merchants.pdf - webarchive
- http://www.vkremez.com/2017/12/lets-learn-reversing-grateful-point-of.html - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-franklin - webarchive
- https://norfolkinfosec.com/pos-malware-used-at-fuel-pumps/ - webarchive
- https://redcanary.com/blog/frameworkpos-and-the-adequate-persistent-threat/ - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://content.fireeye.com/m-trends/rpt-m-trends-2020 - webarchive
- https://community.rsa.com/community/products/netwitness/blog/2017/12/08/gratefulpos-credit-card-stealing-malware-just-in-time-for-the-shopping-season - webarchive
- https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gratem
Internal MISP references
UUID 5de7bd7f-bbbc-4431-8fd2-a90d25f30fd8 which can be used as unique global reference for Gratem in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gravity RAT
Internal MISP references
UUID 1de27925-f94c-462d-acb6-f75822e05ec4 which can be used as unique global reference for Gravity RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.gravity_rat - webarchive
- https://securelist.com/gravityrat-the-spy-returns/99097/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/antisandbox-techniques/ - webarchive
- https://www.virusbulletin.com/blog/2018/04/gravityrat-malware-takes-your-systems-temperature/ - webarchive
- https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GREASE
Internal MISP references
UUID 4ed079e6-69bd-481b-b873-86ced9ded750 which can be used as unique global reference for GREASE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.grease - webarchive
- https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf - webarchive
- https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-301a - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GreenShaitan
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GreenShaitan.
| Known Synonyms |
|---|
eoehttp |
Internal MISP references
UUID 9d0ddcb9-b0da-436a-af73-d9307609bd17 which can be used as unique global reference for GreenShaitan in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GreetingGhoul
Internal MISP references
UUID b8763a6f-2711-454d-bbde-7408ebe932c1 which can be used as unique global reference for GreetingGhoul in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GreyEnergy
Internal MISP references
UUID 5a683d4f-31a1-423e-a136-d348910ca967 which can be used as unique global reference for GreyEnergy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.grey_energy - webarchive
- https://enterprise.verizon.com/resources/reports/2019-data-breach-investigations-report.pdf - webarchive
- https://securelist.com/greyenergys-overlap-with-zebrocy/89506/ - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-viking - webarchive
- https://blog.nviso.eu/2022/02/24/threat-update-ukraine-russia-tensions/ - webarchive
- https://attack.mitre.org/groups/G0034 - webarchive
- https://github.com/NozomiNetworks/greyenergy-unpacker - webarchive
- https://www.eset.com/int/greyenergy-exposed/ - webarchive
- https://www.nozominetworks.com/2019/02/12/blog/greyenergy-malware-research-paper-maldoc-to-backdoor/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GRILLMARK
This is a proxy-aware HTTP backdoor that is implemented as a service and uses the compromised system's proxy settings to access the internet. C&C traffic is base64 encoded and the files sent to the server are compressed with aPLib.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GRILLMARK.
| Known Synonyms |
|---|
Hellsing Backdoor |
Internal MISP references
UUID 60cc0c72-e903-4dda-967a-9da0e12d4ac5 which can be used as unique global reference for GRILLMARK in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GRIMAGENT
GRIMAGENT is a backdoor that can execute arbitrary commands, download files, create and delete scheduled tasks, and execute programs via scheduled tasks or via the ShellExecute API. The malware persists via a randomly named scheduled task and a registry Run key. The backdoor communicates to hard-coded C&C servers via HTTP requests with portions of its network communications encrypted using both asymmetric and symmetric cryptography. GRIMAGENT was used during some Ryuk Ransomware intrusions in 2020.
Internal MISP references
UUID 57460bae-84ad-402d-8949-9103c5917703 which can be used as unique global reference for GRIMAGENT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.grimagent - webarchive
- https://gibnc.group-ib.com/s/Group-IB_GrimAgent_analysis#pdfviewer - webarchive
- https://www.mandiant.com/resources/fin12-ransomware-intrusion-actor-pursuing-healthcare-targets - webarchive
- https://twitter.com/bryceabdo/status/1352359414746009608 - webarchive
- https://blog.group-ib.com/grimagent - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GrimPlant
This malware was seen during the cyberattacks on Ukrainian state organizations. It is one of two used backdoors written in Go and attributed to UAC-0056 (SaintBear, UNC2589, TA471).
Internal MISP references
UUID 235cba54-256e-48a0-b5dc-5e1aa3247cde which can be used as unique global reference for GrimPlant in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.grimplant - webarchive
- https://inquest.net/blog/2022/04/07/ukraine-cyberwar-overview - webarchive
- https://www.sentinelone.com/blog/threat-actor-uac-0056-targeting-ukraine-with-fake-translation-software/ - webarchive
- https://www.intezer.com/blog/research/elephant-malware-targeting-ukrainian-orgs/ - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2022/04/new-uac-0056-activity-theres-a-go-elephant-in-the-room/ - webarchive
- https://www.mandiant.com/resources/spear-phish-ukrainian-entities - webarchive
- https://cert.gov.ua/article/38374 - webarchive
- https://cip.gov.ua/en/news/khto-stoyit-za-kiberatakami-na-ukrayinsku-kritichnu-informaciinu-infrastrukturu-statistika-15-22-bereznya - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ - webarchive
- https://www.govinfosecurity.com/cyber-espionage-actor-deploying-malware-using-excel-a-18830 - webarchive
- https://www.cybercom.mil/Media/News/Article/3098856/cyber-national-mission-force-discloses-iocs-from-ukrainian-networks/ - webarchive
- https://businessinsights.bitdefender.com/deep-dive-into-the-elephant-framework-a-new-cyber-threat-in-ukraine - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GROK
Internal MISP references
UUID 5ba66415-b482-44ff-8dfa-809329e0e074 which can be used as unique global reference for GROK in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Growtopia
According to PCrisk, Growtopia (also known as CyberStealer) is an information stealer written in the C# programming language. It can obtain system information, steal information from various applications, and capture screenshots. Its developer claims that it has created this software for educational purposes only. This stealer uses the name of a legitimate online game.
Internal MISP references
UUID 5fb7db86-a510-400c-b7d3-4197eef09755 which can be used as unique global reference for Growtopia in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GRUNT
Internal MISP references
UUID 884782cf-9fdc-4f3c-8fba-e878330d0ef5 which can be used as unique global reference for GRUNT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.grunt - webarchive
- https://michaelkoczwara.medium.com/hunting-c2-with-shodan-223ca250d06f - webarchive
- https://ti.qianxin.com/blog/articles/Suspected-Russian-speaking-attackers-use-COVID19-vaccine-decoys-against-Middle-East/ - webarchive
- https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html - webarchive
- https://twitter.com/ItsReallyNick/status/1208141697282117633 - webarchive
- https://www.telsy.com/download/5776/?uid=aca91e397e - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
gsecdump
Internal MISP references
UUID 8410d208-7450-407d-b56c-e5c1ced19632 which can be used as unique global reference for gsecdump in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GSpy
A malware family with a DGA.
Internal MISP references
UUID 4e466824-7081-4163-8d90-895492b55f23 which can be used as unique global reference for GSpy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
GUP Proxy Tool
Internal MISP references
UUID 83d1bf1b-6557-4c2e-aa00-53013be73067 which can be used as unique global reference for GUP Proxy Tool in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Gwisin (Windows)
Ransomware.
Internal MISP references
UUID ef39478b-716a-4b98-b10e-36b8ca22060c which can be used as unique global reference for Gwisin (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.gwisin - webarchive
- https://www.skshieldus.com/download/files/download.do?o_fname=%EA%B7%80%EC%8B%A0(Gwisin)%20%EB%9E%9C%EC%84%AC%EC%9B%A8%EC%96%B4%20%EA%B3%B5%EA%B2%A9%20%EC%A0%84%EB%9E%B5%20%EB%B6%84%EC%84%9D%20%EB%A6%AC%ED%8F%AC%ED%8A%B8.pdf&r_fname=20220824150111854.pdf - webarchive
- https://asec.ahnlab.com/en/41565/ - webarchive
- https://asec.ahnlab.com/en/37483 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
H1N1 Loader
Internal MISP references
UUID 0ecf5aca-05ef-47fb-b114-9f4177faace3 which can be used as unique global reference for H1N1 Loader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HabitsRAT (Windows)
Internal MISP references
UUID b39de9b2-7739-44f4-a03b-1fffa0c0df04 which can be used as unique global reference for HabitsRAT (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hacksfase
Internal MISP references
UUID 2713a763-33fa-45ce-8552-7dd12b6b8ecc which can be used as unique global reference for Hacksfase in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HackSpy
Py2Exe based tool as found on github.
Internal MISP references
UUID 4b5914fd-25e4-4a20-b6f5-faf4b34f49e9 which can be used as unique global reference for HackSpy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hades
According to PCrisk, Hades Locker is an updated version of WildFire Locker ransomware that infiltrates systems and encrypts a variety of data types using AES encryption. Hades Locker appends the names of encrypted files with the ".~HL[5_random_characters] (first 5 characters of encryption password)" extension.
Internal MISP references
UUID ab9b4a89-c35b-42aa-bffb-98fccf7d318f which can be used as unique global reference for Hades in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hades - webarchive
- https://killingthebear.jorgetesta.tech/actors/evil-corp - webarchive
- https://blog.truesec.com/2021/05/05/are-the-notorious-cyber-criminals-evil-corp-actually-russian-spies/ - webarchive
- https://www.accenture.com/us-en/blogs/security/ransomware-hades - webarchive
- https://assets.sentinelone.com/sentinellabs/sentinellabs_EvilCorp - webarchive
- https://www.advanced-intel.com/post/adversarial-perspective-advintel-breach-avoidance-through-monitoring-initial-vulnerabilities - webarchive
- https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://twitter.com/inversecos/status/1381477874046169089?s=20 - webarchive
- https://www.bleepingcomputer.com/news/security/evil-corp-switches-to-hades-ransomware-to-evade-sanctions/ - webarchive
- https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/ - webarchive
- https://awakesecurity.com/blog/incident-response-hades-ransomware-gang-or-hafnium/ - webarchive
- https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions - webarchive
- https://www.sentinelone.com/wp-content/uploads/2022/02/S1_-SentinelLabs_SanctionsBeDamned_final_02.pdf - webarchive
- https://www.secureworks.com/blog/hades-ransomware-operators-use-distinctive-tactics-and-infrastructure - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/unknown-threat-group-using-hades-ransomware - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-winter - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hakbit
Hakbit ransomware is written in .NET. It uploads (some) files to be encrypted to a ftp-server. The ransom note is embedded - in earlier versions as plain string, then as base64 string. In some versions, these strings are slightly obfuscated.
Contact is via an email address hosted on protonmail. Hakbit (original) had hakbit@, more recent "KiraLock" has kiraransom@ (among others of course).
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Hakbit.
| Known Synonyms |
|---|
Thanos Ransomware |
Internal MISP references
UUID 18617856-c6c4-45f8-995f-4916a1b45b05 which can be used as unique global reference for Hakbit in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hakbit - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2020-0610.pdf - webarchive
- https://unit42.paloaltonetworks.com/thanos-ransomware/ - webarchive
- https://securelist.com/cis-ransomware/104452/ - webarchive
- https://securityboulevard.com/2022/03/midas-ransomware-tracing-the-evolution-of-thanos-ransomware-variants/ - webarchive
- https://www.zscaler.com/blogs/security-research/midas-ransomware-tracing-evolution-thanos-ransomware-variants - webarchive
- https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/ - webarchive
- http://id-ransomware.blogspot.com/2019/11/hakbit-ransomware.html - webarchive
- https://unit42.paloaltonetworks.com/prometheus-ransomware/ - webarchive
- https://medium.com/s2wlab/quick-analysis-of-haron-ransomware-feat-avaddon-and-thanos-1ebb70f64dc4 - webarchive
- https://www.carbonblack.com/2020/06/15/tau-threat-analysis-relations-to-hakbit-ransomware/ - webarchive
- https://www.carbonblack.com/2020/06/08/tau-threat-analysis-hakbit-ransomware/ - webarchive
- https://securityintelligence.com/posts/ransomware-encryption-goes-wrong/ - webarchive
- https://www.sekoia.io/en/the-story-of-a-ransomware-builder-from-thanos-to-spook-and-beyond-part-1/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/hakbit-ransomware-campaign-against-germany-austria-switzerland - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://www.justice.gov/usao-edny/press-release/file/1505981/download - webarchive
- https://blog.cyble.com/2021/06/05/prometheus-an-emerging-apt-group-using-thanos-ransomware-to-target-organizations/ - webarchive
- https://www.seqrite.com/blog/thanos-ransomware-evading-anti-ransomware-protection-with-riplace-tactic/ - webarchive
- https://www.cybereason.com/blog/cybereason-vs.-prometheus-ransomware - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HALFRIG
A stager used by APT29 to deploy CobaltStrike.
Internal MISP references
UUID c89b2d7b-82b7-4329-81d0-ed99be4fad96 which can be used as unique global reference for HALFRIG in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hamweq
Internal MISP references
UUID 454fc9f7-b328-451f-806c-68ff5bcd491e which can be used as unique global reference for Hamweq in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hamweq - webarchive
- https://www.youtube.com/watch?v=FAFuSO9oAl0 - webarchive
- https://blag.nullteilerfrei.de/2020/05/31/string-obfuscation-in-the-hamweq-irc-bot/ - webarchive
- https://www.youtube.com/watch?v=JPvcLLYR0tE - webarchive
- https://www.cert.pl/wp-content/uploads/2011/06/201106_hamweq.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hancitor
Hancitor(aka Chanitor) emerged in 2013 which spread via social engineering techniques mainly through phishing mails embedded with malicious link and weaponized Microsoft office document contains malicious macro in it.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Hancitor.
| Known Synonyms |
|---|
Chanitor |
Internal MISP references
UUID 4166ab63-24b0-4448-92ea-21c8deef978d which can be used as unique global reference for Hancitor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hancitor - webarchive
- https://www.0ffset.net/reverse-engineering/malware-analysis/hancitor-maldoc-analysis/ - webarchive
- https://researchcenter.paloaltonetworks.com/2018/02/unit42-compromised-servers-fraud-accounts-recent-hancitor-attacks/ - webarchive
- https://malware-traffic-analysis.net/2021/09/29/index.html - webarchive
- https://researchcenter.paloaltonetworks.com/2016/08/unit42-vb-dropper-and-shellcode-for-hancitor-reveal-new-techniques-behind-uptick/ - webarchive
- https://blog.group-ib.com/hancitor-cuba-ransomware - webarchive
- https://inquest.net/blog/2021/04/16/unearthing-hancitor-infrastructure - webarchive
- https://github.com/OALabs/Lab-Notes/blob/main/Hancitor/hancitor.ipynb - webarchive
- https://medium.com/@crovax/extracting-hancitors-configuration-with-ghidra-7963900494b5 - webarchive
- https://twitter.com/TheDFIRReport/status/1359669513520873473 - webarchive
- https://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/hancitor-making-use-of-cookies-to-prevent-url-scraping - webarchive
- https://blog.minerva-labs.com/new-hancitor-pimp-my-downloader - webarchive
- https://pid4.io/posts/how_to_write_a_hancitor_extractor/ - webarchive
- https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/ - webarchive
- https://researchcenter.paloaltonetworks.com/2018/02/unit42-dissecting-hancitors-latest-2018-packer/ - webarchive
- https://www.malware-traffic-analysis.net/2021/09/29/index.html - webarchive
- https://www.0ffset.net/reverse-engineering/malware-analysis/hancitor-analysing-the-main-loader/ - webarchive
- https://elis531989.medium.com/dissecting-and-automating-hancitors-config-extraction-1a6ed85d99b8 - webarchive
- https://medium.com/walmartglobaltech/man1-moskal-hancitor-and-a-side-of-ransomware-d77b4d991618 - webarchive
- https://researchcenter.paloaltonetworks.com/2016/08/unit42-pythons-and-unicorns-and-hancitoroh-my-decoding-binaries-through-emulation/ - webarchive
- https://www.binarydefense.com/analysis-of-hancitor-when-boring-begets-beacon - webarchive
- https://www.zscaler.com/blogs/research/chanitor-downloader-actively-installing-vawtrak - webarchive
- https://isc.sans.edu/diary/rss/27618 - webarchive
- https://www.intel471.com/blog/Cobalt-strike-cybercriminals-trickbot-qbot-hancitor - webarchive
- https://0ffset.net/reverse-engineering/malware-analysis/reversing-hancitor-again/ - webarchive
- https://unit42.paloaltonetworks.com/wireshark-tutorial-hancitor-followup-malware/ - webarchive
- https://www.fireeye.com/blog/threat-research/2016/09/hancitor_aka_chanit.html - webarchive
- https://www.silentpush.com/blog/pivoting-finding-malware-domains-without-seeing-malicious-activity - webarchive
- https://cyber-anubis.github.io/malware%20analysis/hancitor/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/hancitor-ruckguv-reappear - webarchive
- https://blog.group-ib.com/prometheus-tds - webarchive
- https://www.dodgethissecurity.com/2019/11/01/hancitor-evasive-new-waves-and-how-com-objects-can-use-cached-credentials-for-proxy-authentication/ - webarchive
- https://fidelissecurity.com/threatgeek/archive/me-and-mr-robot-tracking-actor-behind-man1-crypter/ - webarchive
- https://muha2xmad.github.io/malware-analysis/fullHancitor/ - webarchive
- https://isc.sans.edu/forums/diary/Hancitor+activity+resumes+after+a+hoilday+break/26980/ - webarchive
- https://thedfirreport.com/2021/06/28/hancitor-continues-to-push-cobalt-strike/ - webarchive
- https://blog.group-ib.com/switching-side-jobs - webarchive
- https://www.vmray.com/cyber-security-blog/hancitor-multi-step-delivery-process-malware-analysis-spotlight/ - webarchive
- https://www.uperesia.com/hancitor-packer-demystified - webarchive
- https://muha2xmad.github.io/unpacking/hancitor/ - webarchive
- https://www.vkremez.com/2018/11/lets-learn-in-depth-reversing-of.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HappyLocker (HiddenTear?)
Internal MISP references
UUID fa0ffc56-6d82-469e-b624-22882f194ce9 which can be used as unique global reference for HappyLocker (HiddenTear?) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HARDRAIN (Windows)
Internal MISP references
UUID e4948b4c-be46-44a4-81e6-3b1922448083 which can be used as unique global reference for HARDRAIN (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Harnig
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Harnig.
| Known Synonyms |
|---|
Piptea |
Internal MISP references
UUID 619b9665-dac2-47a8-bf7d-942809439c12 which can be used as unique global reference for Harnig in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Haron Ransomware
Internal MISP references
UUID 788c44c1-d1cd-4b17-8fa9-116d682c3661 which can be used as unique global reference for Haron Ransomware in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HavanaCrypt
Internal MISP references
UUID d2f11e7f-4daf-42f0-8304-e59935991745 which can be used as unique global reference for HavanaCrypt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Havex RAT
Havex is a remote access trojan (RAT) that was discovered in 2013 as part of a widespread espionage campaign targeting industrial control systems (ICS) used across numerous industries and attributed to a hacking group referred to as "Dragonfly" and "Energetic Bear". Havex is estimated to have impacted thousands of infrastructure sites, a majority of which were located in Europe and the United States. Within the energy sector, Havex specifically targeted energy grid operators, major electricity generation firms, petroleum pipeline operators, and industrial equipment providers. Havex also impacted organizations in the aviation, defense, pharmaceutical, and petrochemical industries.
Once installed, Havex scanned the infected system to locate any Supervisory Control and Data Acquisition (SCADA) or ICS devices on the network and sent the data back to command and control servers. To do so, the malware leveraged the Open Platform Communications (OPC) standard, which is a universal communication protocol used by ICS components across many industries that facilitates open connectivity and vendor equipment interoperability. Havex used the Distributed Component Object Model (DCOM) to connect to OPC servers inside of an ICS network and collect information such as CLSID, server name, Program ID, OPC version, vendor information, running state, group count, and server bandwidth.
Havex was an intelligence-collection tool used for espionage and not for the disruption or destruction of industrial systems. However, the data collected by Havex would have aided efforts to design and develop attacks against specific targets or industries.
Internal MISP references
UUID c04fc02e-f35a-44b6-a9b0-732bf2fc551a which can be used as unique global reference for Havex RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.havex_rat - webarchive
- https://www.f-secure.com/weblog/archives/00002718.html - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-liberty - webarchive
- https://www.ironnet.com/blog/russian-cyber-attack-campaigns-and-actors - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-083a - webarchive
- https://vblocalhost.com/uploads/VB2021-Slowik.pdf - webarchive
- https://pylos.co/2020/11/04/the-enigmatic-energetic-bear/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Havoc
Havoc is a modern and malleable post-exploitation command and control framework, created by @C5pider.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Havoc.
| Known Synonyms |
|---|
Havokiz |
Internal MISP references
UUID ddbcedee-ac3e-45d3-be2c-d7315d83e6a6 which can be used as unique global reference for Havoc in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.havoc - webarchive
- https://checkmarx.com/blog/first-known-targeted-oss-supply-chain-attacks-against-the-banking-sector/ - webarchive
- https://twitter.com/embee_research/status/1579668721777643520?s=20&t=nDJOv1Yf5mQZKCou7qMrhQ - webarchive
- https://www.zscaler.com/blogs/security-research/havoc-across-cyberspace - webarchive
- https://www.youtube.com/watch?v=ErPKP4Ms28s - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://github.com/HavocFramework/Havoc - webarchive
- https://4pfsec.com/havoc-c2-first-look/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/grayling-taiwan-cyber-attacks - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HAWKBALL
HAWKBALL is a backdoor that attackers can use to collect information from the victim, as well as to deliver payloads. HAWKBALL is capable of surveying the host, creating a named pipe to execute native Windows commands, terminating processes, creating, deleting and uploading files, searching for files, and enumerating drives.
Internal MISP references
UUID dc07507b-959f-4521-be0f-b9ff2b32b909 which can be used as unique global reference for HAWKBALL in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HawkEye Keylogger
HawKeye is a keylogger that is distributed since 2013. Discovered by IBM X-Force, it is currently spread over phishing campaigns targeting businesses on a worldwide scale. It is designed to steal credentials from numerous applications but, in the last observed versions, new "loader capabilities" have been spotted. It is sold by its development team on dark web markets and hacking forums.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HawkEye Keylogger.
| Known Synonyms |
|---|
HawkEye |
HawkEye Reborn |
Predator Pain |
Internal MISP references
UUID 31615066-dbff-4134-b467-d97a337b408b which can be used as unique global reference for HawkEye Keylogger in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hawkeye_keylogger - webarchive
- https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/covid-19-cybercrime-m00nd3v-hawkeye-malware-threat-actor/ - webarchive
- https://www.fortinet.com/blog/threat-research/hawkeye-malware-analysis.html - webarchive
- https://research.checkpoint.com/2023/following-the-scent-of-trickgate-6-year-old-packer-used-to-deploy-the-most-wanted-malware/ - webarchive
- https://cloudblogs.microsoft.com/microsoftsecure/2018/07/11/hawkeye-keylogger-reborn-v8-an-in-depth-campaign-analysis/ - webarchive
- https://blog.talosintelligence.com/2019/04/hawkeye-reborn.html - webarchive
- https://www.ciphertechsolutions.com/roboski-global-recovery-automation/ - webarchive
- https://researchcenter.paloaltonetworks.com/2015/10/surveillance-malware-trends-tracking-predator-pain-and-hawkeye/ - webarchive
- https://www.cyberbit.com/hawkeye-malware-keylogging-technique/ - webarchive
- https://labs.bitdefender.com/2020/03/5-times-more-coronavirus-themed-malware-reports-during-march/?utm_campaign=twitter&utm_medium=twitter&utm_source=twitter - webarchive
- https://github.com/itaymigdal/malware-analysis-writeups/blob/main/HawkEye/HawkEye.md - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-galleon - webarchive
- https://www.fireeye.com/blog/threat-research/2017/07/hawkeye-malware-distributed-in-phishing-campaign.html - webarchive
- https://securityintelligence.com/posts/roboski-global-recovery-automation/ - webarchive
- https://www.govcert.ch/blog/analysis-of-an-unusual-hawkeye-sample/ - webarchive
- https://nakedsecurity.sophos.com/2016/02/29/the-hawkeye-attack-how-cybercrooks-target-small-businesses-for-big-money/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-galleon - webarchive
- https://www.trustwave.com/Resources/SpiderLabs-Blog/How-I-Cracked-a-Keylogger-and-Ended-Up-in-Someone-s-Inbox/ - webarchive
- https://www.secureworks.com/research/gold-galleon-how-a-nigerian-cyber-crew-plunders-the-shipping-industry - webarchive
- http://stopmalvertising.com/malware-reports/analysis-of-the-predator-pain-keylogger.html - webarchive
- https://www.cyberbit.com/blog/endpoint-security/hawkeye-malware-keylogging-technique/ - webarchive
- https://securelist.com/apt-trends-report-q2-2019/91897/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HazyLoad
Internal MISP references
UUID a0d0d428-fd1b-460c-a03a-0003c6daff6d which can be used as unique global reference for HazyLoad in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hazy_load - webarchive
- https://blog.talosintelligence.com/lazarus_new_rats_dlang_and_telegram/ - webarchive
- https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clasiopa-materials-research - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HDMR
HDMR is a ransomware which encrypts user files and adds a .DMR64 extension. It also drops a ransom note named: "!!! READ THIS !!!.hta".
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HDMR.
| Known Synonyms |
|---|
GO-SPORT |
Internal MISP references
UUID d643273f-7a53-4703-bf65-95716d55a5dd which can be used as unique global reference for HDMR in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HDRoot
Internal MISP references
UUID af8df5d7-cd8c-41ea-b9ec-b69ab7811e2d which can be used as unique global reference for HDRoot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HeaderTip
The Chinese threat actor "Scarab" is using a custom backdoor dubbed "HeaderTip" according to SentinelLABS. This malware may be the successor of "Scieron".
Internal MISP references
UUID 994c64f3-ca59-4392-9ab4-0256e79fcfad which can be used as unique global reference for HeaderTip in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.headertip - webarchive
- https://www.sentinelone.com/labs/chinese-threat-actor-scarab-targeting-ukraine/ - webarchive
- https://blogs.blackberry.com/en/2022/04/threat-thursday-headertip-backdoor-shows-attackers-from-china-preying-on-ukraine - webarchive
- https://cert.gov.ua/article/38097 - webarchive
- https://cip.gov.ua/en/news/khto-stoyit-za-kiberatakami-na-ukrayinsku-kritichnu-informaciinu-infrastrukturu-statistika-15-22-bereznya - webarchive
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-headertip - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Headlace
Internal MISP references
UUID 7229ccd9-1f2b-4a71-8119-1f4eb1c04a5d which can be used as unique global reference for Headlace in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Helauto
Internal MISP references
UUID 9af26655-cfba-4e02-bd10-ad1a494e0b5f which can be used as unique global reference for Helauto in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HelloBot (Windows)
Internal MISP references
UUID 64cecfd4-96fd-42a3-8537-fc0e041271a2 which can be used as unique global reference for HelloBot (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HelloKitty (Windows)
Unit42 states that HelloKitty is a ransomware family that first surfaced at the end of 2020, primarily targeting Windows systems. The malware family got its name due to its use of a Mutex with the same name: HelloKittyMutex. The ransomware samples seem to evolve quickly and frequently, with different versions making use of the .crypted or .kitty file extensions for encrypted files. Some newer samples make use of a Golang packer that ensures the final ransomware code is only loaded in memory, most likely to evade detection by security solutions.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HelloKitty (Windows).
| Known Synonyms |
|---|
KittyCrypt |
Internal MISP references
UUID 433c97b5-89ac-4783-a312-8bb890590ff0 which can be used as unique global reference for HelloKitty (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hellokitty - webarchive
- https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape - webarchive
- https://www.cadosecurity.com/post/punk-kitty-ransom-analysing-hellokitty-ransomware-attacks - webarchive
- https://blog.malwarebytes.com/threat-spotlight/2021/03/hellokitty-when-cyberpunk-met-cy-purr-crime/ - webarchive
- https://unit42.paloaltonetworks.com/emerging-ransomware-groups/ - webarchive
- https://cocomelonc.github.io/book/2023/12/13/malwild-book.html - webarchive
- https://www.crowdstrike.com/blog/new-ransomware-variant-uses-golang-packer/ - webarchive
- https://cocomelonc.github.io/malware/2023/01/04/malware-tricks-26.html - webarchive
- https://blog.bushidotoken.net/2022/05/gamer-cheater-hacker-spy.html - webarchive
- https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group - webarchive
- https://id-ransomware.blogspot.com/2020/11/hellokitty-ransomware.html - webarchive
- https://labs.sentinelone.com/hellokitty-ransomware-lacks-stealth-but-still-strikes-home/ - webarchive
- https://medium.com/proferosec-osm/static-unpacker-and-decoder-for-hello-kitty-packer-91a3e8844cb7 - webarchive
- https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html - webarchive
- https://www.intrinsec.com/vice-society-spreads-its-own-ransomware/ - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-249a - webarchive
- https://www.databreaches.net/babuk-re-organizes-as-payload-bin-offers-its-first-leak/ - webarchive
- https://www.speartip.com/resources/fbi-hellokitty-ransomware-adds-ddos-to-extortion-arsenal/ - webarchive
- https://www.bleepingcomputer.com/news/security/hellokitty-ransomware-is-targeting-vulnerable-sonicwall-devices/ - webarchive
- https://twitter.com/fwosar/status/1359167108727332868 - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://www.esentire.com/blog/conti-affiliate-exposed-new-domain-names-ip-addresses-and-email-addresses-uncovered-by-esentire - webarchive
- https://blogs.vmware.com/security/2022/09/threat-report-illuminating-volume-shadow-deletion.html - webarchive
- https://www.ic3.gov/Media/News/2021/211029.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Helminth
Internal MISP references
UUID 19d89300-ff97-4281-ac42-76542e744092 which can be used as unique global reference for Helminth in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.helminth - webarchive
- http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/ - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-gypsy - webarchive
- https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/ - webarchive
- https://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/ - webarchive
- https://cyware.com/blog/apt34-the-helix-kitten-cybercriminal-group-loves-to-meow-middle-eastern-and-international-organizations-48ae - webarchive
- https://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability - webarchive
- https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Heloag
Internal MISP references
UUID bb07e153-2e51-4ce1-97a3-4ec8a936e625 which can be used as unique global reference for Heloag in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HemiGate
Internal MISP references
UUID 3db00976-d81d-4a54-a639-ae087bc2493d which can be used as unique global reference for HemiGate in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Herbst
Internal MISP references
UUID ca8482d9-657b-49fe-8345-6ed962a9735a which can be used as unique global reference for Herbst in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Heriplor
Internal MISP references
UUID 9d4fc43c-28a1-45ea-ac2c-8d53bdce118b which can be used as unique global reference for Heriplor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.heriplor - webarchive
- https://insights.sei.cmu.edu/cert/2019/03/api-hashing-tool-imagine-that.html - webarchive
- https://vblocalhost.com/uploads/VB2021-Slowik.pdf - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks - webarchive
- https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hermes
Internal MISP references
UUID 30a230c1-b598-4d06-90ab-3254d6a626d8 which can be used as unique global reference for Hermes in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hermes - webarchive
- https://vxhive.blogspot.com/2020/11/deep-dive-into-hermes-ransomware.html - webarchive
- https://www.malwarebytes.com/blog/news/2018/03/hermes-ransomware-distributed-to-south-koreans-via-recent-flash-zero-day - webarchive
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/ - webarchive
- https://www.youtube.com/watch?v=9nuo-AGg4p4 - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- http://baesystemsai.blogspot.de/2017/10/taiwan-heist-lazarus-tools.html - webarchive
- https://web.archive.org/web/20200922165625/https://dcso.de/2019/03/18/enterprise-malware-as-a-service/ - webarchive
- https://medium.com/ax1al/reversing-ryuk-eef8ffd55f12 - webarchive
- https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongside - webarchive
- https://i.blackhat.com/eu-20/Wednesday/eu-20-Rivera-From-Zero-To-Sixty-The-Story-Of-North-Koreas-Rapid-Ascent-To-Becoming-A-Global-Cyber-Superpower.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HermeticWiper
According to SentinelLabs, HermeticWiper is a custom-written application with very few standard functions. It abuses a signed driver called "empntdrv.sys" which is associated with the legitimate Software "EaseUS Partition Master Software" to enumerate the MBR and all partitions of all Physical Drives connected to the victims Windows Device and overwrite the first 512 Bytes of every MBR and Partition it can find, rendering them useless. This malware is associated to the malware attacks against Ukraine during Russians Invasion in February 2022.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HermeticWiper.
| Known Synonyms |
|---|
DriveSlayer |
FoxBlade |
KillDisk.NCV |
NEARMISS |
Internal MISP references
UUID db6c1ec5-3961-47ce-9cd1-e650388a15fd which can be used as unique global reference for HermeticWiper in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hermeticwiper - webarchive
- https://securelist.com/webinar-on-cyberattacks-in-ukraine-summary-and-qa/106075/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/growling-bears-make-thunderous-noise.html - webarchive
- https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat - webarchive
- https://www.welivesecurity.com/2022/02/24/hermeticwiper-new-data-wiping-malware-hits-ukraine/ - webarchive
- https://socradar.io/what-you-need-to-know-about-russian-cyber-escalation-in-ukraine/ - webarchive
- https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine - webarchive
- https://twitter.com/fr0gger_/status/1497121876870832128 - webarchive
- https://cip.gov.ua/en/news/khto-stoyit-za-kiberatakami-na-ukrayinsku-kritichnu-informaciinu-infrastrukturu-statistika-15-22-bereznya - webarchive
- https://www.zdnet.com/article/microsoft-finds-foxblade-malware-on-ukrainian-systems-removing-rt-from-windows-app-store/ - webarchive
- https://twitter.com/Sebdraven/status/1496878431719473155 - webarchive
- https://services.google.com/fh/files/blogs/google_fog_of_war_research_report.pdf - webarchive
- https://threatpost.com/microsoft-ukraine-foxblade-trojan-hours-before-russian-invasion/178702/ - webarchive
- https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/ - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-057A_Destructive_Malware_Targeting_Organizations_in_Ukraine.pdf - webarchive
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-hermeticwiper-partyticket - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/digging-into-hermeticwiper.html - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/defenders-blog-on-cyberattacks-targeting-ukraine.html - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict/IOC%20Resource%20for%20Russia-Ukraine%20Conflict-Related%20Cyberattacks-03032022.pdf - webarchive
- https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware - webarchive
- https://blog.nviso.eu/2022/02/24/threat-update-ukraine-russia-tensions/ - webarchive
- https://lifars.com/2022/03/a-closer-look-at-the-russian-actors-targeting-organizations-in-ukraine/ - webarchive
- https://blogs.blackberry.com/en/2022/03/threat-thursday-hermeticwiper - webarchive
- https://www.mandiant.com/resources/information-operations-surrounding-ukraine - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ - webarchive
- https://unit42.paloaltonetworks.com/preparing-for-cyber-impact-russia-ukraine-crisis/ - webarchive
- https://securityintelligence.com/posts/new-destructive-malware-cyber-attacks-ukraine/ - webarchive
- https://www.kaspersky.com/blog/hermeticransom-hermeticwiper-attacks-2022/43825/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia - webarchive
- https://therecord.media/second-data-wiper-attack-hits-ukraine-computer-networks/ - webarchive
- https://blogs.vmware.com/networkvirtualization/2022/03/hermetic-malware-multi-component-threat-targeting-ukraine-organizations.html/ - webarchive
- https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/ - webarchive
- https://www.youtube.com/watch?v=sUlW45c9izU - webarchive
- https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/ - webarchive
- https://www.secureworks.com/blog/disruptive-hermeticwiper-attacks-targeting-ukrainian-organizations - webarchive
- https://www.brighttalk.com/webcast/15591/534324 - webarchive
- https://eln0ty.github.io/malware%20analysis/HermeticWiper/ - webarchive
- https://www.tesorion.nl/en/resources/pdfstore/Report-OSINT-Russia-Ukraine-Conflict-Cyberaspect.pdf - webarchive
- https://inquest.net/blog/2022/04/07/ukraine-cyberwar-overview - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4Vwwd - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/ - webarchive
- https://dgc.org/en/hermeticwiper-malware/ - webarchive
- https://eclypsium.com/2022/06/02/conti-targets-critical-firmware/ - webarchive
- https://thehackernews.com/2022/02/new-wiper-malware-targeting-ukraine.html - webarchive
- https://www.deepinstinct.com/blog/hermeticwiper-malware-the-russian-ukrainian-cyber-war - webarchive
- https://www.englert.one/hermetic-wiper-reverse-code-engineering - webarchive
- https://www.mandiant.com/resources/russia-invasion-ukraine-retaliation - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war - webarchive
- https://www.bitdefender.com/blog/hotforsecurity/five-things-you-need-to-know-about-the-cyberwar-in-ukraine/ - webarchive
- https://cloudsek.com/technical-analysis-of-the-hermetic-wiper-malware-used-to-target-ukraine/ - webarchive
- https://thehackernews.com/2022/02/putin-warns-russian-critical.html - webarchive
- https://t3n.de/news/cyber-attacken-ukraine-wiper-malware-1454318/ - webarchive
- https://www.nextgov.com/cybersecurity/2022/03/ukrainian-cyber-lead-least-4-types-malware-are-targeting-ukrainian-institutions/363558/ - webarchive
- https://learnsentinel.blog/2022/02/28/detecting-malware-kill-chains-with-defender-and-microsoft-sentinel/ - webarchive
- https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/ - webarchive
- https://community.riskiq.com/article/9f59cb85 - webarchive
- https://cyberpeaceinstitute.org/ukraine-timeline-of-cyberattacks - webarchive
- https://www.microsoft.com/en-us/security/business/security-insider/wp-content/uploads/2023/03/A-year-of-Russian-hybrid-warfare-in-Ukraine_MS-Threat-Intelligence-1.pdf - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/ - webarchive
- https://marcoramilli.com/2022/03/01/diskkill-hermeticwiper-and-notpetya-dissimilarities/ - webarchive
- https://elastic.github.io/security-research/intelligence/2022/03/01.hermeticwiper-targets-ukraine/article/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/mtp-2022-0302.pdf - webarchive
- https://blogs.microsoft.com/on-the-issues/2022/12/03/preparing-russian-cyber-offensive-ukraine/ - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2022/03/hermeticwiper-a-detailed-analysis-of-the-destructive-malware-that-targeted-ukraine/ - webarchive
- https://cybersecurity.att.com/blogs/labs-research/analysis-on-recent-wiper-attacks-examples-and-how-they-wiper-malware-works - webarchive
- https://cluster25.io/2022/02/24/ukraine-analysis-of-the-new-disk-wiping-malware/ - webarchive
- https://www.youtube.com/watch?v=mrTdSdMMgnk - webarchive
- https://www.zscaler.com/blogs/security-research/hermeticwiper-resurgence-targeted-attacks-ukraine - webarchive
- https://yoroi.company/research/diskkill-hermeticwiper-a-disruptive-cyber-weapon-targeting-ukraines-critical-infrastructures/ - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-057a - webarchive
- https://brandefense.io/hermeticwiper-technical-analysis-report/ - webarchive
- https://twitter.com/threatintel/status/1496578746014437376 - webarchive
- https://www.splunk.com/en_us/blog/security/detecting-hermeticwiper.html - webarchive
- https://securityboulevard.com/2022/03/isaacwiper-followed-hermeticwiper-attack-on-ukraine-orgs/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HermeticWizard
Internal MISP references
UUID f4400c49-75c6-494a-aa3e-d873404281c1 which can be used as unique global reference for HermeticWizard in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hermeticwizard - webarchive
- https://securelist.com/webinar-on-cyberattacks-in-ukraine-summary-and-qa/106075/ - webarchive
- https://www.brighttalk.com/webcast/15591/534324 - webarchive
- https://inquest.net/blog/2022/04/07/ukraine-cyberwar-overview - webarchive
- https://www.youtube.com/watch?v=mrTdSdMMgnk - webarchive
- https://twitter.com/silascutler/status/1501668345640366091 - webarchive
- https://twitter.com/ET_Labs/status/1502494650640351236 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HerpesBot
Internal MISP references
UUID 4734c5a4-e63b-4bb4-8c01-ab0c638a6c21 which can be used as unique global reference for HerpesBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HesperBot
Internal MISP references
UUID 2637315d-d31e-4b64-aa4b-2fc265b0a1a3 which can be used as unique global reference for HesperBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
heyoka
Internal MISP references
UUID 5833d95c-4131-4cd3-8600-fc40bb834fe3 which can be used as unique global reference for heyoka in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HiAsm
Internal MISP references
UUID c49e1f43-a16a-49b1-b23e-9e49cd20c90b which can be used as unique global reference for HiAsm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hidden Bee
Internal MISP references
UUID f1e4862e-75a3-4843-add3-726a6535019c which can be used as unique global reference for Hidden Bee in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hiddenbee - webarchive
- https://blog.malwarebytes.com/threat-analysis/2018/07/hidden-bee-miner-delivered-via-improved-drive-by-download-toolkit/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2019/08/the-hidden-bee-infection-chain-part-1-the-stegano-pack/ - webarchive
- https://www.freebuf.com/column/175106.html - webarchive
- https://blog.malwarebytes.com/threat-analysis/2018/08/reversing-malware-in-a-custom-format-hidden-bee-elements/ - webarchive
- https://www.freebuf.com/column/174581.html - webarchive
- https://research.checkpoint.com/2023/from-hidden-bee-to-rhadamanthys-the-evolution-of-custom-executable-formats/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-underminer-exploit-kit-discovered-pushing-bootkits-and-coinminers/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2019/05/hidden-bee-lets-go-down-the-rabbit-hole/ - webarchive
- https://www.msreverseengineering.com/blog/2018/9/2/weekend-project-a-custom-ida-loader-module-for-the-hidden-bee-malware-family - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HiddenTear
HiddenTear is an open source ransomware developed by a Turkish programmer and later released as proof of concept on GitHub. The malware generates a local symmetric key in order to encrypt a configurable folder (/test was the default one) and it sends it to a centralized C&C server. Due to its small payload it was used as real attack vector over email phishing campaigns. Variants are still used in attacks.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HiddenTear.
| Known Synonyms |
|---|
Cryptear |
FuckUnicorn |
Internal MISP references
UUID b96be762-56a0-4407-be04-fcba76c1ff29 which can be used as unique global reference for HiddenTear in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hiddentear - webarchive
- https://www.bleepingcomputer.com/news/security/hidden-tear-ransomware-developer-blackmailed-by-malware-developers-using-his-code/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-f-unicorn-ransomware-hits-italy-via-fake-covid-19-infection-map/ - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-2/ - webarchive
- https://utkusen.com/blog/im-sorry-for-hidden-tear-eda2 - webarchive
- https://www.tripwire.com/state-of-security/security-data-protection/cyber-security/hidden-tear-project-forbidden-fruit-is-the-sweetest/ - webarchive
- https://twitter.com/struppigel/status/950787783353884672 - webarchive
- https://dissectingmalwa.re/earn-quick-btc-with-hiddentearmp4-about-open-source-ransomware.html - webarchive
- https://www.slideshare.net/ChristopherDoman/open-source-malware-sharing-is-caring - webarchive
- https://github.com/goliate/hidden-tear - webarchive
- https://twitter.com/JAMESWT_MHT/status/1264828072001495041 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HideDRV
Internal MISP references
UUID 84b30881-00bc-4206-8170-51705a8e26b1 which can be used as unique global reference for HideDRV in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hidedrv - webarchive
- http://www.sekoia.fr/blog/wp-content/uploads/2016/10/Rootkit-analysis-Use-case-on-HIDEDRV-v1.6.pdf - webarchive
- https://contagiodump.blogspot.de/2017/02/russian-apt-apt28-collection-of-samples.html - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-twilight - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HIGHNOON
According to FireEye, HIGHNOON is a backdoor that may consist of multiple components. The components may include a loader, a DLL, and a rootkit. Both the loader and the DLL may be dropped together, but the rootkit may be embedded in the DLL. The HIGHNOON loader may be designed to run as a Windows service.
Internal MISP references
UUID f04c5821-311f-44c9-9d6c-0fe3fd3a1336 which can be used as unique global reference for HIGHNOON in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.highnoon - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf - webarchive
- https://speakerdeck.com/aragorntseng/winnti-is-coming-evolution-after-prosecution-at-hitcon2021 - webarchive
- https://www.fireeye.com/blog/threat-research/2019/08/game-over-detecting-and-stopping-an-apt41-operation.html - webarchive
- https://twitter.com/MrDanPerez/status/1159461995013378048 - webarchive
- https://content.fireeye.com/apt-41/rpt-apt41/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HIGHNOON.BIN
Internal MISP references
UUID 0a86eb46-28b5-4797-af63-75f9b2ef9080 which can be used as unique global reference for HIGHNOON.BIN in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HIGHNOTE
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HIGHNOTE.
| Known Synonyms |
|---|
ChyNode |
Internal MISP references
UUID d9f03a69-507d-4b1d-af6d-e76fca5952b7 which can be used as unique global reference for HIGHNOTE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HijackLoader
According to Rapid7, this is a loader first spotted in July 2023. It implements several evasion techniques including Process Doppelgänging, DLL Search Order Hijacking, and Heaven's Gate. It has been observed to store its malicious payload in the IDAT chunk of PNG file format.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HijackLoader.
| Known Synonyms |
|---|
GHOSTPULSE |
IDAT Loader |
SHADOWLADDER |
Internal MISP references
UUID cbba3bc7-9491-402c-af3b-9a15b8bce122 which can be used as unique global reference for HijackLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hijackloader - webarchive
- https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/ - webarchive
- https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks - webarchive
- https://web.archive.org/web/20231219110155/https://yoroi.company/en/research/innovation-in-cyber-intrusions-the-evolution-of-ta544/ - webarchive
- https://www.zscaler.com/blogs/security-research/technical-analysis-hijackloader - webarchive
- https://www.esentire.com/blog/danabots-latest-move-deploying-icedid - webarchive
- https://alpine-sec.medium.com/hijackloader-targets-hotels-a-technical-analysis-c2795fc4f3a3 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HiKit
Internal MISP references
UUID 35fd4bd7-d510-40fd-b89c-8a1b10dbc3f1 which can be used as unique global reference for HiKit in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hikit - webarchive
- https://www.recordedfuture.com/hidden-lynx-analysis/ - webarchive
- https://web.archive.org/web/20141016080249/http://www.symantec.com/connect/blogs/security-vendors-take-action-against-hidden-lynx-malware - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-keystone - webarchive
- https://attack.mitre.org/groups/G0001/ - webarchive
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/hidden_lynx.pdf - webarchive
- https://www.symantec.com/connect/blogs/security-vendors-take-action-against-hidden-lynx-malware - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HILDACRYPT
A new ransomware family was discovered in August 2019. Called HILDACRYPT, it is named after the Netflix cartoon “Hilda” because the TV show’s YouTube trailer was included in the ransom note of the original version of the malware.
Internal MISP references
UUID fb637fc1-c06b-4b68-b261-0e1c0bd1e17b which can be used as unique global reference for HILDACRYPT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hildacrypt - webarchive
- https://www.acronis.com/en-eu/blog/posts/popular-backup-solutions-easily-disabled-recent-hildacrypt-ransomware/ - webarchive
- https://blog.sonicwall.com/en-us/2019/11/mindhunter-meeting-a-russian-ransomware-cell/ - webarchive
- https://www.acronis.com/en-eu/blog/posts/hildacrypt-ransomware-newcomer-hits-backup-and-anti-virus-solutions/ - webarchive
- https://youtu.be/Oqg20dF8tTA - webarchive
- https://www.bleepingcomputer.com/news/security/hildacrypt-ransomware-developer-releases-decryption-keys/ - webarchive
- https://securitynews.sonicwall.com/xmlpost/hildacrypt-ransomware-actively-spreading-in-the-wild/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
himan
Internal MISP references
UUID ecad37b9-555a-4029-b181-6f272eed7154 which can be used as unique global reference for himan in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Himera Loader
Internal MISP references
UUID b5e83cab-8096-40de-8a5b-5bf0f2e336b2 which can be used as unique global reference for Himera Loader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hisoka
Internal MISP references
UUID b6734ca0-599f-4992-9094-218d01ddfb3a which can be used as unique global reference for Hisoka in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hive (Windows)
Hive is a strain of ransomware that was first discovered in June 2021. Hive was designed to be used by Ransomware-as-a-service providers, to enable novice cyber-criminals to launch ransomware attacks on healthcare providers, energy providers, charities, and retailers across the globe. In 2022 there was a switch from GoLang to Rust.
Internal MISP references
UUID 4aaa039f-6239-46d8-850d-69e9cbd12e9e which can be used as unique global reference for Hive (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hive - webarchive
- https://resources.prodaft.com/wazawaka-report - webarchive
- https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape - webarchive
- https://www.connectwise.com/resources/hive-profile - webarchive
- https://therecord.media/academics-publish-method-for-recovering-data-encrypted-by-the-hive-ransomware/ - webarchive
- https://www.sentinelone.com/blog/hive-ransomware-deploys-novel-ipfuscation-technique/ - webarchive
- https://www.varonis.com/blog/hive-ransomware-analysis - webarchive
- https://blog.talosintelligence.com/2022/05/conti-and-hive-ransomware-operations.html - webarchive
- https://www.microsoft.com/security/blog/2022/07/05/hive-ransomware-gets-upgrades-in-rust/ - webarchive
- https://www.bleepingcomputer.com/news/security/hive-ransomware-uses-new-ipfuscation-trick-to-hide-payload/ - webarchive
- https://www.threatstop.com/blog/first-conti-then-hive-costa-rica-gets-hit-with-ransomware-again - webarchive
- https://unit42.paloaltonetworks.com/emerging-ransomware-groups/ - webarchive
- https://yoroi.company/research/on-the-footsteps-of-hive-ransomware/ - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/787/original/ransomware-chats.pdf - webarchive
- https://securityaffairs.co/wordpress/128232/security/recover-files-hive-ransomware.html - webarchive
- https://labs.sentinelone.com/hive-attacks-analysis-of-the-human-operated-ransomware-targeting-healthcare/ - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v - webarchive
- https://arxiv.org/pdf/2202.08477.pdf - webarchive
- https://yoroi.company/wp-content/uploads/2022/07/Yoroi-On-The-Footsteps-of-Hive-Ransomware.pdf - webarchive
- https://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals - webarchive
- https://www.bleepingcomputer.com/news/security/hive-ransomware-ports-its-linux-vmware-esxi-encryptor-to-rust/ - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/787/original/ransomware-chats.pdf?1651576098 - webarchive
- https://therecord.media/hive-ransomware-shuts-down-california-health-care-organization/ - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-007.pdf - webarchive
- https://www.incibe-cert.es/sites/default/files/contenidos/estudios/doc/incibe-cert_estudio_analisis_hive_2021_v1.pdf - webarchive
- https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group - webarchive
- https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf - webarchive
- https://securelist.com/modern-ransomware-groups-ttps/106824/ - webarchive
- https://www.kroll.com/en/insights/publications/cyber/hive-ransomware-technical-analysis-initial-access-discovery - webarchive
- https://www.malwarebytes.com/blog/threat-intelligence/2022/20221121-threat-intel-report-final.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker - webarchive
- https://www.rapid7.com/blog/post/2023/01/11/increasing-the-sting-of-hive-ransomware/ - webarchive
- https://www.scmagazine.com/brief/breach/novel-obfuscation-leveraged-by-hive-ransomware - webarchive
- https://krebsonsecurity.com/2023/05/russian-hacker-wazawaka-indicted-for-ransomware/ - webarchive
- https://github.com/reecdeep/HiveV5_file_decryptor - webarchive
- https://www.sentinelone.com/labs/nokoyawa-ransomware-new-karma-nemty-variant-wears-thin-disguise/ - webarchive
- https://github.com/rivitna/Malware/tree/main/Hive - webarchive
- https://lifars.com/2022/02/how-to-decrypt-the-files-encrypted-by-the-hive-ransomware/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-hive - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://thehackernews.com/2022/02/master-key-for-hive-ransomware.html - webarchive
- https://blog.group-ib.com/hive - webarchive
- https://www.ic3.gov/Media/News/2021/210825.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hi-Zor RAT
Internal MISP references
UUID 80987ce7-7eb7-4e55-95f8-5c7a9441acab which can be used as unique global reference for Hi-Zor RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HLUX
Internal MISP references
UUID 8e056957-f28b-4b2f-bf58-6b2f7fdd7d62 which can be used as unique global reference for HLUX in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Holcus Installer (Adware)
Adware, tied to eGobbler and Nephos7 campaigns,
Internal MISP references
UUID 379356c7-ec7a-4880-85d5-afe9608d6b60 which can be used as unique global reference for Holcus Installer (Adware) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HOLERUN
Internal MISP references
UUID 1860127d-41cf-4fe8-a58c-9f5304b91fb1 which can be used as unique global reference for HOLERUN in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
homefry
a 64-bit Windows password dumper/cracker that has previously been used in conjunction with AIRBREAK and BADFLICK backdoors. Some strings are obfuscated with XOR x56. The malware accepts up to two arguments at the command line: one to display cleartext credentials for each login session, and a second to display cleartext credentials, NTLM hashes, and malware version for each login session.
Internal MISP references
UUID 1fb57e31-b97e-45c3-a922-a49ed6dd966d which can be used as unique global reference for homefry in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.homefry - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-mohawk - webarchive
- https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HookInjEx
Internal MISP references
UUID b614f291-dbf8-49ed-b110-b69ab6e8c6e5 which can be used as unique global reference for HookInjEx in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HOPLIGHT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HOPLIGHT.
| Known Synonyms |
|---|
HANGMAN |
Internal MISP references
UUID 3e489132-8687-46b3-b9a7-74ba8fafaddf which can be used as unique global reference for HOPLIGHT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hoplight - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.us-cert.gov/ncas/analysis-reports/ar19-304a - webarchive
- https://www.fireeye.com/content/dam/fireeye-www/global/en/blog/threat-research/FireEye_HWP_ZeroDay.pdf - webarchive
- https://www.us-cert.gov/ncas/analysis-reports/AR19-100A - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://labs.sentinelone.com/dprk-hidden-cobra-update-north-korean-malicious-cyber-activity/ - webarchive
- https://securelist.com/apt-trends-report-q2-2019/91897/ - webarchive
- https://www.computing.co.uk/ctg/news/3074007/lazarus-rises-warning-over-new-hoplight-malware-linked-with-north-korea - webarchive
- https://www.secureworks.com/research/threat-profiles/nickel-academy - webarchive
- https://www.us-cert.gov/ncas/analysis-reports/ar20-045g - webarchive
- https://researchcenter.paloaltonetworks.com/2017/08/unit42-blockbuster-saga-continues/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hopscotch
Hopscotch is part of the Regin framework.
Internal MISP references
UUID 0ab4f3ce-5474-4b1e-8ad9-b9ad80e75be8 which can be used as unique global reference for Hopscotch in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HorusEyes RAT
Remote Acess Tool Written in VB.NET.
Internal MISP references
UUID cbe47d19-2f74-4dbc-84b5-44c31518c8a7 which can be used as unique global reference for HorusEyes RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Horus Eyes RAT
Warsaw trojan is a new banking trojan based on the Hours Eyes RAT core engine.
Internal MISP references
UUID 5a368326-d594-4a9b-94ff-7e2d41158006 which can be used as unique global reference for Horus Eyes RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HOTCROISSANT
Internal MISP references
UUID 4500694c-d71a-4d11-8f9c-0036156826b6 which can be used as unique global reference for HOTCROISSANT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hotcroissant - webarchive
- https://www.us-cert.gov/ncas/analysis-reports/ar20-045d - webarchive
- https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/ - webarchive
- https://labs.sentinelone.com/dprk-hidden-cobra-update-north-korean-malicious-cyber-activity/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HOTWAX
HOTWAX is a module that upon starting imports all necessary system API functions, and searches for a .CHM file. HOTWAX decrypts a payload using the Spritz algorithm with a hard-coded key and then searches the target process and attempts to inject the decrypted payload module from the CHM file into the address space of the target process.
Internal MISP references
UUID d5391c00-9a75-457c-9ef0-0a75c5df8348 which can be used as unique global reference for HOTWAX in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hotwax - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180244/Lazarus_Under_The_Hood_PDF_final.pdf - webarchive
- https://securelist.com/lazarus-under-the-hood/77908/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/magazine/2018/VB2018-Kalnai-Poslusny.pdf - webarchive
- https://baesystemsai.blogspot.com/2017/02/lazarus-false-flag-malware.html - webarchive
- https://www.welivesecurity.com/2017/02/16/demystifying-targeted-malware-used-polish-banks/ - webarchive
- https://raw.githubusercontent.com/eric-erki/APT_CyberCriminal_Campagin_Collections/master/2017/2017.05.30.Lazarus_Arisen/Group-IB_Lazarus.pdf - webarchive
- https://content.fireeye.com/apt/rpt-apt38 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Houdini
Houdini is a VBS-based RAT dating back to 2013. Past in the days, it used to be wrapped in an .exe but started being spamvertized or downloaded by other malware directly as .vbs in 2018. In 2019, WSHRAT appeared, a Javascript-based version of Houdini, recoded by the name of Kognito.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Houdini.
| Known Synonyms |
|---|
Hworm |
Jenxcus |
Kognito |
Njw0rm |
WSHRAT |
dinihou |
dunihi |
Internal MISP references
UUID 11775f11-03a0-4ba8-932f-c125dfb66e35 which can be used as unique global reference for Houdini in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.houdini - webarchive
- https://cybersecurity.att.com/blogs/labs-research/alien-labs-2019-analysis-of-threat-groups-molerats-and-apt-c-37 - webarchive
- https://github.com/jeFF0Falltrades/IoCs/blob/master/Broadbased/wsh_rat.md - webarchive
- https://www.youtube.com/watch?v=h3KLKCdMUUY - webarchive
- https://www.cadosecurity.com/post/threat-group-uses-voice-changing-software-in-espionage-attempt - webarchive
- https://blog.talosintelligence.com/2021/09/operation-layover-how-we-tracked-attack.html - webarchive
- https://isc.sans.edu/forums/diary/Houdini+is+Back+Delivered+Through+a+JavaScript+Dropper/28746/ - webarchive
- https://blogs.360.cn/post/APT-C-44.html - webarchive
- https://www.deepinstinct.com/blog/understanding-the-windows-javascript-threat-landscape - webarchive
- https://lab52.io/blog/wirte-group-attacking-the-middle-east/ - webarchive
- https://cofense.com/houdini-worm-transformed-new-phishing-attack/ - webarchive
- https://threatpost.com/ta2541-apt-rats-aviation/178422/ - webarchive
- https://www.youtube.com/watch?v=XDAiS6KBDOs - webarchive
- https://www.fireeye.com/blog/threat-research/2013/09/now-you-see-me-h-worm-by-houdini.html - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/research/cyberattacks-targeting-ukraine-increase.html - webarchive
- https://www.bleepingcomputer.com/news/security/unskilled-hacker-linked-to-years-of-attacks-on-aviation-transport-sectors/ - webarchive
- https://blog.morphisec.com/ahk-rat-loader-leveraged-in-unique-delivery-campaigns - webarchive
- http://blogs.360.cn/post/analysis-of-apt-c-37.html - webarchive
- https://yoroi.company/research/threatening-within-budget-how-wsh-rat-is-abused-by-cyber-crooks/ - webarchive
- https://unit42.paloaltonetworks.com/unit42-houdinis-magic-reappearance/ - webarchive
- https://threatresearch.ext.hp.com/javascript-malware-dispensing-rats-into-the-wild/ - webarchive
- https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ - webarchive
- https://www.binarydefense.com/revenge-is-a-dish-best-served-obfuscated - webarchive
- http://blog.morphisec.com/hworm-houdini-aka-njrat - webarchive
- https://myonlinesecurity.co.uk/more-agenttesla-keylogger-and-nanocore-rat-in-one-bundle/ - webarchive
- https://www.vectra.ai/blogpost/moonlight-middle-east-targeted-attacks - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://mp.weixin.qq.com/s/gWOIRNPLVqX761LW8x-S5g - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HtBot
Internal MISP references
UUID 246f62ee-854a-45e9-8c57-34f1fb72762f which can be used as unique global reference for HtBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
htpRAT
Internal MISP references
UUID e8d1a1f3-3170-4562-9a18-cadf000e48d0 which can be used as unique global reference for htpRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HTran
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HTran.
| Known Synonyms |
|---|
HUC Packet Transmit Tool |
Internal MISP references
UUID 3fb18a77-91ef-4c68-a9a9-fa6bdbea38e8 which can be used as unique global reference for HTran in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.htran - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-mayfair - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf - webarchive
- https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/ - webarchive
- https://www.secureworks.com/research/htran - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-atlas - webarchive
- https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/ - webarchive
- https://www.fireeye.com/blog/threat-research/2021/09/proxyshell-exploiting-microsoft-exchange-servers.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/ - webarchive
- https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers - webarchive
- https://lab52.io/blog/the-energy-reserves-in-the-eastern-mediterranean-sea-and-a-malicious-campaign-of-apt10-against-turkey/ - webarchive
- https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HttpBrowser
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HttpBrowser.
| Known Synonyms |
|---|
HttpDump |
Internal MISP references
UUID 79f93d04-f6c8-4705-9395-7f575a61e82f which can be used as unique global reference for HttpBrowser in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.httpbrowser - webarchive
- https://www.threatconnect.com/blog/threatconnect-discovers-chinese-apt-activity-in-europe/ - webarchive
- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/may/emissary-panda-a-potential-new-malicious-tool/ - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://threatconnect.com/blog/the-anthem-hack-all-roads-lead-to-china/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-union - webarchive
- https://attack.mitre.org/groups/G0026 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
httpdropper
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular httpdropper.
| Known Synonyms |
|---|
httpdr0pper |
Internal MISP references
UUID 78336551-c18e-47ac-8bef-1c0c61c0e0a9 which can be used as unique global reference for httpdropper in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.httpdropper - webarchive
- https://www.sans.org/reading-room/whitepapers/critical/tracing-lineage-darkseoul-36787 - webarchive
- http://www.malware-reversing.com/2013/04/5-south-korea-incident-new-malware.html - webarchive
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/dissecting-operation-troy.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HTTPSnoop
Cisco Talos states that HTTPSnoop is a simple, yet effective, backdoor that consists of novel techniques to interface with Windows HTTP kernel drivers and devices to listen to incoming requests for specific HTTP(S) URLs and execute that content on the infected endpoint.
Internal MISP references
UUID f585fba9-4a75-4752-bfdd-a0049e4d8d63 which can be used as unique global reference for HTTPSnoop in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HTTP(S) uploader
The HTTP(S) uploader is a Lazarus tool responsible for data exfiltration, by using the HTTP or HTTPS protocols.
It accepts up to 10 command line parameters: a 29-byte decryption key, a C&C for data exfiltration, the name of a local RAR split volume, the name of the multivolume archive on the server side, the size of a RAR split (max 200,000 kB), the starting index of a split, the ending index of a split, and the switch -p with a proxy IP address and port
Internal MISP references
UUID 50723d62-ecf2-49de-9ce2-911045ae63f0 which can be used as unique global reference for HTTP(S) uploader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.httpsuploader - webarchive
- https://www.welivesecurity.com/2022/09/30/amazon-themed-campaigns-lazarus-netherlands-belgium/ - webarchive
- https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf - webarchive
- https://securelist.com/lazarus-threatneedle/100803/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
http_troy
Internal MISP references
UUID 339b3e7c-7a4a-4a1a-94b6-555f15a0b265 which can be used as unique global reference for http_troy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HUI Loader
A loader that has been used by multiple threat actor groups since 2015.
Internal MISP references
UUID 1cb6ed37-3017-45b9-b186-1e16d46a8dd2 which can be used as unique global reference for HUI Loader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hui_loader - webarchive
- https://blogs.jpcert.or.jp/ja/2022/05/HUILoader.html - webarchive
- https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader - webarchive
- https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/ - webarchive
- https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_9_yanagishita-tamada-nakatsuru-ishimaru_en.pdf - webarchive
- https://medium.com/@morimolymoly/hui-loader-malware-analysis-note-4fa0e1c791d3 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hunter Stealer
Internal MISP references
UUID c93fdbb9-aafc-441d-a66f-aaf038f10bd3 which can be used as unique global reference for Hunter Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hupigon
Internal MISP references
UUID 40157734-eb33-4187-bcc8-2cd168db6fda which can be used as unique global reference for Hupigon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HuskLoader
Internal MISP references
UUID 06649edb-d078-4403-a628-6295d1bc4ad8 which can be used as unique global reference for HuskLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Hussar
Internal MISP references
UUID d3d86184-3c5c-478b-8f8b-f56f1a02247d which can be used as unique global reference for Hussar in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HxDef
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HxDef.
| Known Synonyms |
|---|
HacDef |
HackDef |
HackerDefender |
Internal MISP references
UUID 906adc27-757d-42bd-b8a2-f8a134077343 which can be used as unique global reference for HxDef in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HyperBro
HyperBro is a RAT that has been observed to target primarily within the gambling industries, though it has been spotted in other places as well. The malware typically consists of 3 or more components: a) a genuine loader typically with a signed certification b) a malicious DLL loader loaded from the former component via DLL hijacking c) an encrypted and compressed blob that decrypts to a PE-based payload which has its C2 information hardcoded within.
Internal MISP references
UUID b7f1abd3-870b-42ca-9bd1-5931126c68d5 which can be used as unique global reference for HyperBro in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hyperbro - webarchive
- https://www.bleepingcomputer.com/news/security/german-govt-warns-of-apt27-hackers-backdooring-business-networks/ - webarchive
- https://web.archive.org/web/20200307113010/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1574947864.pdf - webarchive
- https://cyware.com/news/apt27-group-targets-german-organizations-with-hyperbro-2c43b7cf/ - webarchive
- https://vblocalhost.com/uploads/VB2020-Shank-Piccolini.pdf - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/incident-response-polar-ransomware-apt27/ - webarchive
- https://www.tra.gov.ae/assets/mTP39Tp6.pdf.aspx - webarchive
- https://www.mandiant.com/resources/unc215-chinese-espionage-campaign-in-israel - webarchive
- https://www.fireeye.com/blog/threat-research/2021/08/unc215-chinese-espionage-campaign-in-israel.html - webarchive
- https://team-cymru.com/2020/03/25/how-the-iranian-cyber-security-agency-detects-emissary-panda-malware/ - webarchive
- https://www.intrinsec.com/apt27-analysis/ - webarchive
- https://www.sstic.org/media/SSTIC2020/SSTIC-actes/pivoter_tel_bernard_ou_comment_monitorer_des_attaq/SSTIC2020-Slides-pivoter_tel_bernard_ou_comment_monitorer_des_attaquants_ngligents-lunghi.pdf - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-drbcontrol-uncovering-a-cyberespionage-campaign-targeting-gambling-companies-in-southeast-asia - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/h/iron-tiger-compromises-chat-application-mimi,-targets-windows,-mac,-and-linux-users/IOCs-IronTiger-compromises-chat-application-mimi-targets-windows-mac-linux-users.txt - webarchive
- https://www.trendmicro.com/en_us/research/22/h/irontiger-compromises-chat-app-Mimi-targets-windows-mac-linux-users.html - webarchive
- https://www.welivesecurity.com/2020/12/10/luckymouse-ta428-compromise-able-desktop - webarchive
- https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia - webarchive
- https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/ - webarchive
- https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html - webarchive
- http://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/ - webarchive
- https://securelist.com/luckymouse-hits-national-data-center/86083/ - webarchive
- https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf?__blob=publicationFile&v=10 - webarchive
- https://www.mandiant.com/resources/blog/chinese-espionage-tactics - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-union - webarchive
- https://blog.sekoia.io/luckymouse-uses-a-backdoored-electron-app-to-target-macos/ - webarchive
- https://www.welivesecurity.com/2020/12/10/luckymouse-ta428-compromise-able-desktop/ - webarchive
- https://blog.team-cymru.com/2020/03/25/how-the-iranian-cyber-security-agency-detects-emissary-panda-malware/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/04/ESET_Industry_Report_Government.pdf - webarchive
- https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HYPERSCRAPE
Internal MISP references
UUID d532739b-327c-4c15-b272-e37e89183f0f which can be used as unique global reference for HYPERSCRAPE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HyperSSL (Windows)
Sideloader used by EmissaryPanda
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HyperSSL (Windows).
| Known Synonyms |
|---|
FOCUSFJORD |
Soldier |
Sysupdate |
Internal MISP references
UUID 84f43641-77bc-4dcb-a104-150e8574da22 which can be used as unique global reference for HyperSSL (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.hyperssl - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/04/ESET_Industry_Report_Government.pdf - webarchive
- https://web.archive.org/web/20200307113010/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1574947864.pdf - webarchive
- https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html - webarchive
- https://norfolkinfosec.com/emissary-panda-dll-backdoor/ - webarchive
- https://www.sstic.org/media/SSTIC2021/SSTIC-actes/Taking_Advantage_of_PE_Metadata_or_How_To_Complete/SSTIC2021-Article-Taking_Advantage_of_PE_Metadata_or_How_To_Complete_your_Favorite_Threat_Actor_Sample_Collection-lunghi.pdf - webarchive
- https://vblocalhost.com/uploads/VB2020-Shank-Piccolini.pdf - webarchive
- https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ - webarchive
- https://www.sstic.org/media/SSTIC2021/SSTIC-actes/Taking_Advantage_of_PE_Metadata_or_How_To_Complete/SSTIC2021-Slides-Taking_Advantage_of_PE_Metadata_or_How_To_Complete_your_Favorite_Threat_Actor_Sample_Collection-lunghi.pdf - webarchive
- https://www.tra.gov.ae/assets/mTP39Tp6.pdf.aspx - webarchive
- https://www.mandiant.com/resources/blog/chinese-espionage-tactics - webarchive
- https://twitter.com/ESETresearch/status/1594937054303236096 - webarchive
- https://www.mandiant.com/resources/unc215-chinese-espionage-campaign-in-israel - webarchive
- https://www.fireeye.com/blog/threat-research/2021/08/unc215-chinese-espionage-campaign-in-israel.html - webarchive
- https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
HZ RAT
Internal MISP references
UUID eaaebc38-73d8-48b7-9927-2d2523870795 which can be used as unique global reference for HZ RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Icarus
Icarus is a modular stealer software, written in .NET. One module is the open source r77 rootkit.
Internal MISP references
UUID 8f1225ba-a636-488b-a288-ab777708a205 which can be used as unique global reference for Icarus in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IcedID
According to Proofpoint, IcedID (aka BokBot) is a malware originally classified as a banking malware and was first observed in 2017. It also acts as a loader for other malware, including ransomware. The well-known IcedID version consists of an initial loader which contacts a Loader C2 server, downloads the standard DLL Loader, which then delivers the standard IcedID Bot. IcedID is developed and operated by the actor named LUNAR SPIDER.
As previously published, historically there has been just one version of IcedID that has remained constant since 2017. * In November 2022, Proofpoint researchers observed the first new variant of IcedID Proofpoint dubbed 'IcedID Lite' distributed as a follow-on payload in a TA542 Emotet campaign. It was dropped by the Emotet malware soon after the actor returned to the e-crime landscape after a nearly four-month break. * The IcedID Lite Loader observed in November 2022 contains a static URL to download a 'Bot Pack' file with a static name (botpack.dat) which results in the IcedID Lite DLL Loader, and then delivers the Forked version of IcedID Bot, leaving out the webinjects and backconnect functionality that would typically be used for banking fraud. * Starting in February 2023, Proofpoint observed the new Forked variant of IcedID. This variant was distributed by TA581 and one unattributed threat activity cluster which acted as initial access facilitators. The campaigns used a variety of email attachments such as Microsoft OneNote attachments and somewhat rare to see .URL attachments, which led to the Forked variant of IcedID.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular IcedID.
| Known Synonyms |
|---|
BokBot |
IceID |
Internal MISP references
UUID 26f5afaf-0bd7-4741-91ab-917bdd837330 which can be used as unique global reference for IcedID in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://intel471.com/blog/malware-before-ransomware-trojan-information-stealer-cobalt-strike - webarchive
- https://team-cymru.com/blog/2021/11/03/webinject-panel-administration-a-vantage-point-into-multiple-threat-actor-campaigns/ - webarchive
- https://www.team-cymru.com/post/inside-the-icedid-backconnect-protocol - webarchive
- https://www.youtube.com/watch?v=oZ4bwnjcXWg - webarchive
- https://securityintelligence.com/icedid-operators-using-atsengine-injection-panel-to-hit-e-commerce-sites/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://kienmanowar.wordpress.com/2020/08/16/manual-unpacking-icedid-write-up/ - webarchive
- https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/ - webarchive
- https://www.fortinet.com/blog/threat-research/spoofed-invoice-drops-iced-id - webarchive
- https://twitter.com/embee_research/status/1592067841154756610?s=20 - webarchive
- https://blog.malwarebytes.com/threat-analysis/2019/12/new-version-of-icedid-trojan-uses-steganographic-payloads/ - webarchive
- https://documents.trendmicro.com/assets/rpt/rpt-navigating-new-frontiers-trend-micro-2021-annual-cybersecurity-report.pdf - webarchive
- https://therecord.media/meet-prometheus-the-secret-tds-behind-some-of-todays-malware-campaigns/ - webarchive
- https://research.loginsoft.com/threat-research/icedid-malware-traversing-through-its-various-incarnations/ - webarchive
- https://www.socinvestigation.com/icedid-banking-trojan-returns-with-new-ttps-detection-response/ - webarchive
- https://matth.dmz42.org/posts/2022/automatically-unpacking-icedid-stage1-with-angr/ - webarchive
- https://isc.sans.edu/diary/28636 - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.binarydefense.com/icedid-gziploader-analysis/ - webarchive
- https://www.silentpush.com/blog/icedid-command-and-control-infrastructure - webarchive
- https://twitter.com/embee_research/status/1592067841154756610?s=20&t=hEALPAWr1LIt9pXcVpxjRQ - webarchive
- https://www.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revealing-threat-in-the-shadow-by-chi-en-shen-ashley-oleg-bondarenko - webarchive
- https://threatpost.com/exchange-servers-speared-in-icedid-phishing-campaign/179137/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-all-paths-lead-to-cobalt-strike-icedid-emotet-and-qbot - webarchive
- https://unit42.paloaltonetworks.com/teasing-secrets-malware-configuration-parsing - webarchive
- https://ceriumnetworks.com/threat-of-the-month-icedid-malware/ - webarchive
- https://labs.sentinelone.com/evasive-maneuvers-massive-icedid-campaign-aims-for-stealth-with-benign-macros/ - webarchive
- https://blogs.juniper.net/en-us/threat-research/covid-19-and-fmla-campaigns-used-to-install-new-icedid-banking-malware - webarchive
- https://blog.minerva-labs.com/icedid-maas - webarchive
- https://www.intezer.com/blog/research/conversation-hijacking-campaign-delivering-icedid/ - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://aaqeel01.wordpress.com/2021/04/09/icedid-analysis/ - webarchive
- https://blog.group-ib.com/prometheus-tds - webarchive
- https://thedfirreport.com/2021/06/20/from-word-to-lateral-movement-in-1-hour/ - webarchive
- https://www.cybereason.com/blog/cybereason-vs.-quantum-locker-ransomware - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-ransomexx - webarchive
- https://www.esentire.com/blog/icedid-to-cobalt-strike-in-under-20-minutes - webarchive
- https://zero2auto.com/2020/06/22/unpacking-visual-basic-packers/ - webarchive
- https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/ - webarchive
- https://www.splunk.com/en_us/blog/security/detecting-icedid-could-it-be-a-trickbot-copycat.html - webarchive
- https://github.com/0xThiebaut/PCAPeek/ - webarchive
- https://tccontre.blogspot.com/2020/08/learning-from-iceid-loader-including.html - webarchive
- https://securityintelligence.com/posts/itg23-crypters-cooperation-between-cybercriminal-groups/ - webarchive
- https://isc.sans.edu/diary/29740 - webarchive
- https://www.vkremez.com/2018/09/lets-learn-deeper-dive-into.html - webarchive
- https://thedfirreport.com/2021/05/12/conti-ransomware/ - webarchive
- https://eln0ty.github.io/malware%20analysis/IcedID/ - webarchive
- https://blogs.blackberry.com/en/2023/01/emotet-returns-with-new-methods-of-evasion - webarchive
- https://www.bleepingcomputer.com/news/security/hackers-target-ukrainian-govt-with-icedid-malware-zimbra-exploits/ - webarchive
- https://blog.cyberint.com/icedid-stealer-man-in-the-browser-banking-trojan - webarchive
- https://www.microsoft.com/security/blog/2021/04/09/investigating-a-unique-form-of-email-delivery-for-icedid-malware/ - webarchive
- https://blog.unpac.me/2023/05/03/unpacme-weekly-new-version-of-icedid-loader - webarchive
- https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary - webarchive
- https://www.youtube.com/watch?v=wObF9n2UIAM - webarchive
- https://www.youtube.com/watch?v=7Dk7NkIbVqY - webarchive
- https://www.netresec.com/?page=Blog&month=2022-10&post=IcedID-BackConnect-Protocol - webarchive
- https://digitalguardian.com/blog/iceid-banking-trojan-targeting-banks-payment-card-providers-e-commerce-sites - webarchive
- https://unit42.paloaltonetworks.com/wireshark-quiz-icedid-answers/ - webarchive
- https://medium.com/walmartglobaltech/icedid-leverages-privateloader-7744771bf87f - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html - webarchive
- https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240 - webarchive
- https://isc.sans.edu/diary/IcedID+%28Bokbot%29+with+Dark+VNC+and+Cobalt+Strike/28884 - webarchive
- https://michaelkoczwara.medium.com/hunting-c2-with-shodan-223ca250d06f - webarchive
- https://malwation.com/icedid-malware-technical-analysis-report/ - webarchive
- https://tccontre.blogspot.com/2021/01/ - webarchive
- https://www.youtube.com/watch?v=YEqLIR6hfOM - webarchive
- https://www.spreaker.com/user/16860719/proofpoint-e29-mix-v1 - webarchive
- https://cert.gov.ua/article/39609 - webarchive
- https://github.com/f0wl/deICEr - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.elastic.co/security-labs/icedids-network-infrastructure-is-alive-and-well - webarchive
- https://blog.talosintelligence.com/2020/12/quarterly-ir-report-fall-2020-q4.html - webarchive
- https://www.nri-secure.co.jp/blog/explaining-the-tendency-of-malware-icedid - webarchive
- https://www.secureworks.com/blog/gold-ulrick-leaks-reveal-organizational-structure-and-relationships - webarchive
- https://www.cybereason.com/blog/cybereason-vs-egregor-ransomware - webarchive
- https://www.netresec.com/?page=Blog&month=2023-02&post=How-to-Identify-IcedID-Network-Traffic - webarchive
- https://www.ironnet.com/blog/ransomware-graphic-blog - webarchive
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - webarchive
- https://www.netresec.com/?page=Blog&month=2023-10&post=Forensic-Timeline-of-an-IcedID-Infection - webarchive
- https://blog.fox-it.com/2018/08/09/bokbot-the-rebirth-of-a-banker/ - webarchive
- https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf - webarchive
- https://isc.sans.edu/forums/diary/TA551+Shathak+pushes+IcedID+Bokbot/28092/ - webarchive
- https://www.crowdstrike.com/blog/bokbots-man-in-the-browser-overview/ - webarchive
- https://dshield.org/diary/Recent+IcedID+Bokbot+activity/29740/ - webarchive
- https://www.esentire.com/blog/conti-affiliate-exposed-new-domain-names-ip-addresses-and-email-addresses-uncovered-by-esentire - webarchive
- https://blogs.vmware.com/security/2021/07/icedid-analysis-and-detection.html - webarchive
- https://unit42.paloaltonetworks.com/atoms/monsterlibra/ - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://medium.com/@dawid.golak/icedid-aka-bokbot-analysis-with-ghidra-560e3eccb766 - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-swathmore - webarchive
- https://isc.sans.edu/diary/rss/28934 - webarchive
- https://www.intrinsec.com/emotet-returns-and-deploys-loaders/ - webarchive
- https://download.microsoft.com/download/f/8/1/f816b8b6-bee3-41e5-b6cc-e925a5688f61/Microsoft_Digital_Defense_Report_2020_September.pdf - webarchive
- https://awakesecurity.com/blog/detecting-icedid-and-cobalt-strike-beacon-with-network-detection-and-response/ - webarchive
- https://unit42.paloaltonetworks.com/wireshark-tutorial-emotet-infection/ - webarchive
- https://news.sophos.com/en-us/2020/02/18/nearly-a-quarter-of-malware-now-communicates-using-tls/ - webarchive
- https://team-cymru.com/blog/2021/05/19/tracking-bokbot-infrastructure/ - webarchive
- https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-two.html - webarchive
- https://www.crowdstrike.com/blog/sin-ful-spiders-wizard-spider-and-lunar-spider-sharing-the-same-web/ - webarchive
- https://blog.reconinfosec.com/an-encounter-with-ta551-shathak - webarchive
- https://isc.sans.edu/diary/Google+ads+lead+to+fake+software+pages+pushing+IcedID+Bokbot/29344 - webarchive
- https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/ - webarchive
- https://twitter.com/Unit42_Intel/status/1645851799427874818 - webarchive
- https://securityintelligence.com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/ - webarchive
- https://www.group-ib.com/blog/icedid - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0118.pdf - webarchive
- https://threatresearch.ext.hp.com/detecting-ta551-domains/ - webarchive
- https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html - webarchive
- https://blogs.vmware.com/security/2021/07/hunting-icedid-and-unpacking-automation-with-qiling.html - webarchive
- https://www.cynet.com/attack-techniques-hands-on/shelob-moonlight-spinning-a-larger-web/ - webarchive
- https://netresec.com/?b=214d7ff - webarchive
- https://blog.reversinglabs.com/blog/code-reuse-across-packers-and-dll-loaders - webarchive
- https://www.fortinet.com/blog/threat-research/deep-dive-icedid-malware-analysis-of-child-processes.html - webarchive
- https://www.youtube.com/watch?v=wMXD4Sv1Alw - webarchive
- https://www.silentpush.com/blog/malicious-infrastructure-as-a-service - webarchive
- https://github.com/telekom-security/icedid_analysis - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-1112.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker - webarchive
- https://www.trendmicro.com/en_ie/research/22/l/icedid-botnet-distributors-abuse-google-ppc-to-distribute-malware.html - webarchive
- https://www.trendmicro.com/en_us/research/21/d/a-spike-in-bazarcall-and-icedid-activity.html - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
- https://resource.redcanary.com/rs/003-YRU-314/images/2021-Threat-Detection-Report.pdf - webarchive
- https://research.loginsoft.com/threat-research/from-innocence-to-malice-the-onenote-malware-campaign-uncovered/ - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://www.trendmicro.com/en_us/research/21/j/ransomware-operators-found-using-new-franchise-business-model.html - webarchive
- https://blog.google/threat-analysis-group/initial-access-broker-repurposing-techniques-in-targeted-attacks-against-ukraine/ - webarchive
- https://intel471.com/blog/conti-emotet-ransomware-conti-leaks - webarchive
- https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/ - webarchive
- https://securityintelligence.com/icedid-banking-trojan-spruces-up-injection-tactics-to-add-stealth/ - webarchive
- https://securityintelligence.com/posts/trickbot-group-systematically-attacking-ukraine - webarchive
- https://blog.nviso.eu/2023/03/20/icedids-vnc-backdoors-dark-cat-anubis-keyhole/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/fork-ice-new-era-icedid - webarchive
- https://www.team-cymru.com/post/a-visualizza-into-recent-icedid-campaigns - webarchive
- http://www.intezer.com/icedid-banking-trojan-shares-code-pony-2-0-trojan/ - webarchive
- https://content.secureworks.com/-/media/Files/US/Reports/Monthly%20Threat%20Intelligence/Secureworks_ECO1_ThreatIntelligenceExecutiveReport2022Vol2.ashx - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout - webarchive
- https://www.crowdstrike.com/blog/digging-into-bokbots-core-module/ - webarchive
- https://www.f5.com/labs/articles/threat-intelligence/icedid-banking-trojan-uses-covid-19-pandemic-to-lure-new-victims - webarchive
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - webarchive
- https://blog.talosintelligence.com/2020/07/valak-emerges.html - webarchive
- https://www.uptycs.com/blog/icedid-campaign-spotted-being-spiced-with-excel-4-macros - webarchive
- https://nikpx.github.io/malware/analysis/2022/03/09/BokBot - webarchive
- https://drive.google.com/file/d/1jB0CsDvAADSrBeGxoi5gzyx8eQIiOJ2G/view - webarchive
- https://securelist.com/malicious-spam-campaigns-delivering-banking-trojans/102917 - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://elis531989.medium.com/funtastic-packers-and-where-to-find-them-41429a7ef9a7 - webarchive
- https://resecurity.com/blog/article/shortcut-based-lnk-attacks-delivering-malicious-code-on-the-rise - webarchive
- https://gist.github.com/psrok1/e6bf5851d674edda03a201e7f24a5e6b - webarchive
- https://blog.bushidotoken.net/2022/04/lessons-from-conti-leaks.html - webarchive
- https://isc.sans.edu/forums/diary/How+the+Contact+Forms+campaign+tricks+people/28142/ - webarchive
- https://thedfirreport.com/2022/04/25/quantum-ransomware/ - webarchive
- https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution - webarchive
- https://www.mimecast.com/globalassets/documents/whitepapers/taa551-treatresearch_final-1.15.21.pdf - webarchive
- https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf - webarchive
- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ - webarchive
- https://twitter.com/felixw3000/status/1521816045769662468 - webarchive
- https://www.fortinet.com/blog/threat-research/icedid-malware-analysis-part-one.html - webarchive
- https://forensicitguy.github.io/analyzing-icedid-document/ - webarchive
- https://github.com/Lastline-Inc/iocs-tools/tree/main/2021-07-IcedID-Part-2 - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware - webarchive
- https://research.checkpoint.com/2021/melting-ice-tracking-icedid-servers-with-a-few-simple-steps/ - webarchive
- https://unit42.paloaltonetworks.com/ta551-shathak-icedid/ - webarchive
- https://4rchib4ld.github.io/blog/IcedIDOnMyNeckImTheCoolest/ - webarchive
- https://blog.talosintelligence.com/2018/04/icedid-banking-trojan.html - webarchive
- https://www.bleepingcomputer.com/news/security/microsoft-exchange-targeted-for-icedid-reply-chain-hijacking-attacks/ - webarchive
- https://www.first.org/resources/papers/amsterdam23/IcedID-FIRST-AMS-2023.pdf - webarchive
- https://www.elastic.co/security-labs/unpacking-icedid - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/rise-of-lnk-shortcut-files-malware/ - webarchive
- https://www.team-cymru.com/post/from-chile-with-malware - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ - webarchive
- https://intel471.com/blog/malvertising-surges-to-distribute-malware - webarchive
- https://www.microsoft.com/security/blog/2020/12/09/edr-in-block-mode-stops-icedid-cold/ - webarchive
- https://blogs.juniper.net/en-us/threat-research/iceid-campaign-strikes-back - webarchive
- https://www.team-cymru.com/post/inside-the-icedid-backconnect-protocol-part-2 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IcedID Downloader
Internal MISP references
UUID c3be9189-f8f2-45e4-b6a3-8960fd5ffc16 which can be used as unique global reference for IcedID Downloader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid_downloader - webarchive
- https://www.netresec.com/?page=Blog&month=2023-10&post=Forensic-Timeline-of-an-IcedID-Infection - webarchive
- https://securityintelligence.com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/ - webarchive
- https://threatray.com/blog/a-new-icedid-gziploader-variant/ - webarchive
- http://www.intezer.com/icedid-banking-trojan-shares-code-pony-2-0-trojan/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Icefog
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Icefog.
| Known Synonyms |
|---|
Fucobha |
Internal MISP references
UUID 48cdcbcf-38a8-4c68-a85e-42989ca28861 which can be used as unique global reference for Icefog in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.icefog - webarchive
- https://speakerdeck.com/ashley920/into-the-fog-the-return-of-icefog-apt - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0616.pdf - webarchive
- https://nao-sec.org/2020/01/an-overhead-view-of-the-royal-road.html - webarchive
- https://www.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revealing-threat-in-the-shadow-by-chi-en-shen-ashley-oleg-bondarenko - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf - webarchive
- http://www.kz-cert.kz/page/502 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
win.icexloader
IceXLoader is a commercial malware used to download and deploy additional malware on infected machines. The latest version is written in Nim, a relatively new language utilized by threat actors the past two years, most notably by the NimzaLoader variant of BazarLoader used by the TrickBot group.
The v1 was written in AutoIT.
Internal MISP references
UUID eb1b3335-9002-49ad-b917-fcc188556d49 which can be used as unique global reference for win.icexloader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ice IX
The ICE IX bot is a banking trojan derived of the Zeus botnet because it uses significant parts of Zeus’s source code. ICE IX communicates using the HTTP protocol, so it can be considered to be a third-generation botnet. While it has been used for a variety of purposes, a primary threat of ICE IX comes from its manipulation of banking operations on compromised machines. As with any bot, execution of the bot results in establishing a master-slave relationship between the botmaster and the compromised computer.
Internal MISP references
UUID 44a1706e-f6dc-43ea-ac85-9a4f2407b9a3 which can be used as unique global reference for Ice IX in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ice_ix - webarchive
- https://www.virusbulletin.com/virusbulletin/2012/08/inside-ice-ix-bot-descendent-zeus - webarchive
- https://securelist.com/ice-ix-the-first-crimeware-based-on-the-leaked-zeus-sources/29577/ - webarchive
- https://securelist.com/ice-ix-not-cool-at-all/29111/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/zeus-gets-another-update/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IconDown
Internal MISP references
UUID 4f7ae3da-948c-4f74-8229-d5d7461f9c7d which can be used as unique global reference for IconDown in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IconicStealer
Follow-up payload in 3CX supply chain incident, which according to Volexity is an infostealer collecting information about the system and browser using an embedded copy of the SQLite3 library.
Internal MISP references
UUID 24fed92f-7e8f-449f-857f-d409d3bf8b48 which can be used as unique global reference for IconicStealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.iconic_stealer - webarchive
- https://www.trendmicro.com/en_us/research/23/c/information-on-attacks-involving-3cx-desktop-app.html - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/3cx-supply-chain-attack - webarchive
- https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise - webarchive
- https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/ - webarchive
- https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IcyHeart
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular IcyHeart.
| Known Synonyms |
|---|
Troxen |
Internal MISP references
UUID bcc8b6ea-9295-4a22-a70d-422b1fd9814e which can be used as unique global reference for IcyHeart in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IDKEY
Internal MISP references
UUID 3afecded-3461-45f9-8159-e8328e56a916 which can be used as unique global reference for IDKEY in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IISniff
Internal MISP references
UUID 3b746f77-214b-44f9-9ef2-0ae6b52561d6 which can be used as unique global reference for IISniff in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.iisniff - webarchive
- https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Anatomy-Of-Native-Iis-Malware-wp.pdf - webarchive
- https://www.welivesecurity.com/2021/08/06/anatomy-native-iis-malware/ - webarchive
- https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Anatomy-Of-Native-Iis-Malware.pdf - webarchive
- https://www.trustwave.com/Resources/SpiderLabs-Blog/The-Curious-Case-of-the-Malicious-IIS-Module/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IISpy
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular IISpy.
| Known Synonyms |
|---|
BadIIS |
Internal MISP references
UUID 74afd7ae-8349-4186-9c85-82a45a2486c9 which can be used as unique global reference for IISpy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IMAPLoader
Internal MISP references
UUID ffcd59c0-56d0-4693-9804-e46e5dcd21ce which can be used as unique global reference for IMAPLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Imecab
Internal MISP references
UUID 0ea585ef-bd32-4f5b-a3fe-bb48dc0956c7 which can be used as unique global reference for Imecab in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Imminent Monitor RAT
MITRE describes Imminent Monitor as a commodity remote access tool (RAT) offered for sale from 2012 until 2019, when an operation was conducted to take down the Imminent Monitor infrastructure. Various cracked versions and variations of this RAT are still in circulation.
Internal MISP references
UUID 53021414-97ad-4102-9cff-7a0e1997f867 which can be used as unique global reference for Imminent Monitor RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.imminent_monitor_rat - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://unit42.paloaltonetworks.com/imminent-monitor-a-rat-down-under/ - webarchive
- https://www.trendmicro.com/en_us/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-ameri.html - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-trinity - webarchive
- https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/ - webarchive
- https://www.tripwire.com/state-of-security/featured/man-jailed-using-webcam-rat-women-bedrooms/ - webarchive
- https://itsjack.cc/blog/2016/01/imminent-monitor-4-rat-analysis-a-glance/ - webarchive
- https://www.politie.nl/nieuws/2021/mei/19/04-aanhouding-in-onderzoek-naar-cybercrime.html - webarchive
- https://www.atomicmatryoshka.com/post/infographic-apts-in-south-america - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-american-entities-with-commodity-rats/BlindEagleIOCList.txt - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Immortal Stealer
ZScaler describes Immortal Stealer as a windows malware written in .NET designed to steal sensitive information from an infected machine. The Immortal stealer is sold on the dark web with different build-based subscriptions.
Internal MISP references
UUID 5f688e85-5f33-4ae6-880a-fc2e5146dd28 which can be used as unique global reference for Immortal Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ImprudentCook
ImprudentCook is an HTTP(S) downloader.
It was delivered in the Operation DreamJob type of activity targeting aerospace and defense companies in South Africa (in Q2 2022) and in Central Europe (in H1 2023), and against an unknown sector in South Korea back in Q2 2021.
It uses the AES cipher implemented through Windows Cryptographic Providers for decryption of its binary configuration, and also for encryption and decryption of the client-server communication.
It’s hidden in an ADS stream (:dat or :zone) of its dropper, together with its configuration (:rsrc) and an AES-128 CBC key with an initialization vector for its decryption (:kgb or :data).
It contains two characteristic arrays of strings that represent cookie names for web services, including Bing, Daum and GitHub:
-
iKc;uid;OAX;DMP_UID;PCID;_gid;_gat;csrftoken;NID;1P_JAR;JSESSIONID;WLS;SNID; utma;BID;SRCHD;GsCK_AC;spintop;eader;XSRF-TOKEN;gat_gtag_UA;webid enabled;EDGE_V;dtck_channel;dtmulti;UUID;XUID;ZIA;IUID;SSID;_gh_sess;_octo
-
channel;post_titles;xfw_exp;wiht_clkey;SGPCOUPLE;NRTK;fbp;uaid;SRCHUSR;GUC;HPVN;dtck_ blog;dtck_media;MUIDB;SRCHHPGUSR;SiteMain
It contains a string, "5.40" or "5.60", looking like version information.
Internal MISP references
UUID 76269425-73c2-4ce5-aab5-da744ad6bc1f which can be used as unique global reference for ImprudentCook in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
INCONTROLLER
Internal MISP references
UUID 3ed3e880-1b93-4ca2-9e9d-0e429c4c895f which can be used as unique global reference for INCONTROLLER in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Incubator
Keylogger written in Visual Basic dating back to at least 2012.
Internal MISP references
UUID b03201bd-8307-4c66-915e-d8f623084abe which can be used as unique global reference for Incubator in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.incubator - webarchive
- https://www.sentinelone.com/labs/modifiedelephant-apt-and-a-decade-of-fabricating-evidence/ - webarchive
- https://www.sentinelone.com/wp-content/uploads/2022/02/Modified-Elephant-APT-and-a-Decade-of-Fabricating-Evidence-SentinelLabs.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IndigoDrop
Internal MISP references
UUID e98b19ce-82c3-472d-98d1-d81341af4267 which can be used as unique global reference for IndigoDrop in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Industrial Spy
A ransomware that emerged in April 2022.
Internal MISP references
UUID 69fc6a53-3ef1-47e8-bcdb-e300d2a972a7 which can be used as unique global reference for Industrial Spy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Industroyer
Industroyer is a malware framework considered to have been used in the cyberattack on Ukraine’s power grid on December 17, 2016. The attack cut a fifth of Kiev, the capital, off power for one hour. It is the first ever known malware specifically designed to attack electrical grids.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Industroyer.
| Known Synonyms |
|---|
Crash |
CrashOverride |
Internal MISP references
UUID 610d5ce7-c9c8-4fb1-94d9-69b7cb5397b6 which can be used as unique global reference for Industroyer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.industroyer - webarchive
- https://www.ironnet.com/blog/russian-cyber-attack-campaigns-and-actors - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf - webarchive
- https://pylos.co/wp-content/uploads/2020/02/Threat-Intelligence-and-the-Limits-of-Malware-Analysis.pdf - webarchive
- https://www.domaintools.com/resources/blog/visibility-monitoring-and-critical-infrastructure-security - webarchive
- https://www.mandiant.com/resources/mandiant-red-team-emulates-fin11-tactics - webarchive
- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - webarchive
- https://blog.nviso.eu/2022/02/24/threat-update-ukraine-russia-tensions/ - webarchive
- https://dragos.com/blog/crashoverride/CrashOverride-01.pdf - webarchive
- https://www.riskint.blog/post/revisited-fancy-bear-s-new-faces-and-sandworms-too - webarchive
- https://cert.gov.ua/article/39518 - webarchive
- https://www.tesorion.nl/en/resources/pdfstore/Report-OSINT-Russia-Ukraine-Conflict-Cyberaspect.pdf - webarchive
- https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/ - webarchive
- https://www.virusbulletin.com/conference/vb2017/abstracts/last-minute-paper-industroyer-biggest-threat-industrial-control-systems-stuxnet/ - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-viking - webarchive
- https://www.welivesecurity.com/2017/06/12/industroyer-biggest-threat-industrial-control-systems-since-stuxnet/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf - webarchive
- https://en.wikipedia.org/wiki/Industroyer - webarchive
- https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games - webarchive
- https://hub.dragos.com/hubfs/Whitepaper-Downloads/Dragos_Manufacturing%20Threat%20Perspective_1120.pdf - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-110a - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/01/vb2019-paper-rich-headers-leveraging-mysterious-artifact-pe-format/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
INDUSTROYER2
Internal MISP references
UUID fa54359c-4a3f-45ea-a941-f2105aa27ef4 which can be used as unique global reference for INDUSTROYER2 in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.industroyer2 - webarchive
- https://pylos.co/2022/04/23/industroyer2-in-perspective/ - webarchive
- https://blogs.blackberry.com/en/2022/05/threat-thursday-malware-rebooted-how-industroyer2-takes-aim-at-ukraine-infrastructure - webarchive
- https://services.google.com/fh/files/blogs/google_fog_of_war_research_report.pdf - webarchive
- https://www.nozominetworks.com/blog/industroyer2-nozomi-networks-labs-analyzes-the-iec-104-payload/ - webarchive
- https://www.netresec.com/?page=Blog&month=2022-04&post=Industroyer2-IEC-104-Analysis - webarchive
- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - webarchive
- https://www.nozominetworks.com/downloads/US/Nozomi-Networks-WP-Industroyer2.pdf - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ - webarchive
- https://cert.gov.ua/article/39518 - webarchive
- https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/ - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://twitter.com/silascutler/status/1513870210398363651 - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4Vwwd - webarchive
- https://www.mandiant.com/resources/industroyer-v2-old-malware-new-tricks - webarchive
- https://www.splunk.com/en_us/blog/security/threat-update-industroyer2.html - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war - webarchive
- https://blog.scadafence.com/industroyer2-attack - webarchive
- https://blog.eset.ie/2022/04/12/industroyer2-industroyer-reloaded/ - webarchive
- https://www.microsoft.com/en-us/security/business/security-insider/wp-content/uploads/2023/03/A-year-of-Russian-hybrid-warfare-in-Ukraine_MS-Threat-Intelligence-1.pdf - webarchive
- https://www.ntop.org/cybersecurity/how-ntopng-monitors-iec-60870-5-104-traffic/ - webarchive
- https://cybersecurity.att.com/blogs/labs-research/analysis-on-recent-wiper-attacks-examples-and-how-they-wiper-malware-works - webarchive
- https://www.youtube.com/watch?v=mrTdSdMMgnk - webarchive
- https://www.mandiant.com/resources/blog/gru-disruptive-playbook - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Inferno
Internal MISP references
UUID 7638ac2e-0cdc-4101-8e3d-54b7b74a9c92 which can be used as unique global reference for Inferno in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
InfinityLock
InfinityLock ransomware is a type of malicious software that encrypts a victim's files and demands a ransom payment in order to decrypt them. It is spread through phishing emails and malicious websites. Once a computer is infected with InfinityLock, it encrypts all important files, such as documents, photos, and videos. It then displays a message that demands the victim pay a ransom of $1,000 in Bitcoin in order to decrypt the files. If the victim does not pay the ransom, the files will be lost permanently.
Internal MISP references
UUID 37fca614-e29a-4029-8afd-d3de61aa3ba0 which can be used as unique global reference for InfinityLock in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
InfoDot
Ransomware.
Internal MISP references
UUID e0ce5055-45cd-46d2-971f-bb3904ec43a1 which can be used as unique global reference for InfoDot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Infy
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Infy.
| Known Synonyms |
|---|
Foudre |
Internal MISP references
UUID 53616ce4-9b8e-45a0-b380-9e778cd95ae2 which can be used as unique global reference for Infy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.infy - webarchive
- https://researchcenter.paloaltonetworks.com/2017/08/unit42-prince-persia-ride-lightning-infy-returns-foudre/ - webarchive
- https://www.intezer.com/prince-of-persia-the-sands-of-foudre/ - webarchive
- https://download.bitdefender.com/resources/files/News/CaseStudies/study/393/Bitdefender-Whitepaper-Iranian-APT-Makes-a-Comeback-with-Thunder-and-Lightning-Backdoor-and-Espionage-Combo.pdf - webarchive
- https://cloud.tencent.com/developer/article/1738806 - webarchive
- https://github.com/pan-unit42/iocs/blob/master/prince_of_persia/hashes.csv - webarchive
- https://research.checkpoint.com/2021/after-lightning-comes-thunder/ - webarchive
- http://researchcenter.paloaltonetworks.com/2016/05/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/ - webarchive
- http://researchcenter.paloaltonetworks.com/2016/06/unit42-prince-of-persia-game-over/ - webarchive
- https://researchcenter.paloaltonetworks.com/2016/05/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Inlock
Internal MISP references
UUID 3071e2d4-c692-4054-a7bf-db9af6fe3b63 which can be used as unique global reference for Inlock in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
InnaputRAT
InnaputRAT, a RAT capable of exfiltrating files from victim machines, was distributed by threat actors using phishing and Godzilla Loader. The RAT has evolved through multiple variants dating back to 2016. Recent campaigns distributing InnaputRAT beaconed to live C2 as of March 26, 2018.
Internal MISP references
UUID dd486e92-54fe-4306-9aab-05863cb6c6e1 which can be used as unique global reference for InnaputRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
win.innfirat
InnifiRAT is coded in .NET and targets personal data on infected devices, with it's top priority appearing to be bitcoin and litecoin wallet data.
InffiRAT also includes a backdoor which allows attackers to control the infected host remotely. Possibilities include loggin key stroke, taking pictures with webcam, accessing confidential information, formatting drives, and more.
It attempts to steal browser cookies to steal usernames and passwords and monitors the users activities with screenshot functionality.
Internal MISP references
UUID b6aec7a7-7ebc-4aad-bcdf-1c3cb7044e3c which can be used as unique global reference for win.innfirat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Interception (Windows)
ESET noticed attacks against aerospace and military companies in Europe and the Middle East that took place between September and December 2019, which featured this family. They found a number of hints that points towards Lazarus as potential origin.
Internal MISP references
UUID fa022849-248c-4620-86b4-2a36c704b288 which can be used as unique global reference for Interception (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Invicta Stealer
According to Cyble, The Invicta Stealer can collect system information, system hardware details, wallet data, and browser data and extract information from applications like Steam and Discord.
Internal MISP references
UUID 00a078bf-90db-4275-b7bd-0da757dd2284 which can be used as unique global reference for Invicta Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
InvisiMole
InvisiMole had a modular architecture, starting with a wrapper DLL, and performing its activities using two other modules that were embedded in its resources, named RC2FM and RC2CL. They were feature-rich backdoors and turned the affected computer into a video camera, letting the attackers to spy the victim. The malicious actors behind this malware were active at least since 2013 in highly targeted campaigns with only a few dozen compromised computers in Ukraine and Russia. The wrapper DLL posed as a legitimate mpr.dll library and was placed in the same folder as explorer.exe, which made it being loaded during the Windows startup into the Windows Explorer process instead of the legitimate library. Malware came in both 32-bit and 64-bit versions, which made this persistence technique functional on both architectures.
The smaller of the modules, RC2FM, contained a backdoor with fifteen supported commands indexed by numbers. The commands could perform simple changes on the system and spying features like capturing sounds, taking screenshots or monitoring all fixed and removable drives.
The second module, RC2CL, offered features for collecting as much data about the infected computer as possible, rather than for making system changes. The module supported up to 84 commands such as file system operations, file execution, registry key manipulation, remote shell activation, wireless network scanning, listing of installed software etc. Though the backdoor was capable of interfering with the system (e.g. to log off a user, terminate a process or shut down the system), it mostly provided passive operations. Whenever possible, it tried to hide its activities by restoring the original file access time or safe-deleting its traces.
Internal MISP references
UUID 22755fda-497e-4ef0-823e-5cb6d8701420 which can be used as unique global reference for InvisiMole in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.invisimole - webarchive
- https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf - webarchive
- https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal/ - webarchive
- https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/ - webarchive
- https://cocomelonc.github.io/malware/2022/11/27/malware-tricks-24.html - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/04/ESET_Industry_Report_Government.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IPStorm (Windows)
Internal MISP references
UUID c32661f5-8281-424e-9726-c5beb1ab2c5e which can be used as unique global reference for IPStorm (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ironcat
Internal MISP references
UUID c6fc8419-afb1-4e99-a6cf-4288ead2381b which can be used as unique global reference for Ironcat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IRONHALO
IRONHALO is a downloader that uses the HTTP protocol to retrieve a Base64 encoded payload from a hard-coded command-and-control (CnC) server and uniform resource locator (URL) path.
The encoded payload is written to a temporary file, decoded and executed in a hidden window. The encoded and decoded payloads are written to files named igfxHK[%rand%].dat and igfxHK[%rand%].exe respectively, where [%rand%] is a 4-byte hexadecimal number based on the current timestamp. It persists by copying itself to the current user’s Startup folder.
Internal MISP references
UUID 44599616-3849-4960-9379-05307287ff80 which can be used as unique global reference for IRONHALO in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ironhalo - webarchive
- https://www.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revealing-threat-in-the-shadow-by-chi-en-shen-ashley-oleg-bondarenko - webarchive
- https://www.symantec.com/security-center/writeup/2015-122210-5128-99 - webarchive
- https://www.fireeye.com/blog/threat-research/2015/12/the_eps_awakens.html - webarchive
- https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IronNetInjector
According to Mitre, IronNetInjector is a Turla toolchain that utilizes scripts from the open-source IronPython implementation of Python with a .NET injector to drop one or more payloads including ComRAT.
Internal MISP references
UUID 5ec639ab-f6c1-4cbb-87b1-d59344878e98 which can be used as unique global reference for IronNetInjector in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IronWind
Internal MISP references
UUID 91c94b56-68c6-4249-a718-e0dc00de8fce which can be used as unique global reference for IronWind in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IsaacWiper
According to Recorded Future, IsaacWiper is a destructive malware that overwrites all physical disks and logical volumes on a victim’s machine.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular IsaacWiper.
| Known Synonyms |
|---|
LASAINRAW |
Internal MISP references
UUID 6fb2d1bb-f8a4-4f73-9ea7-a4a9aae4f609 which can be used as unique global reference for IsaacWiper in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.isaacwiper - webarchive
- https://securelist.com/webinar-on-cyberattacks-in-ukraine-summary-and-qa/106075/ - webarchive
- https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat - webarchive
- https://securityintelligence.com/posts/new-wiper-malware-used-against-ukranian-organizations/ - webarchive
- https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine - webarchive
- https://cip.gov.ua/en/news/khto-stoyit-za-kiberatakami-na-ukrayinsku-kritichnu-informaciinu-infrastrukturu-statistika-15-22-bereznya - webarchive
- https://twitter.com/ESETresearch/status/1521910890072842240 - webarchive
- https://cluster25.io/2022/05/03/a-strange-link-between-a-destructive-malware-and-the-loader-of-a-ransomware-group-isaacwiper-vs-vatet/ - webarchive
- https://thehackernews.com/2022/03/second-new-isaacwiper-data-wiper.html - webarchive
- https://lifars.com/2022/03/a-closer-look-at-the-russian-actors-targeting-organizations-in-ukraine/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ - webarchive
- https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/ - webarchive
- https://www.brighttalk.com/webcast/15591/534324 - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/ - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4Vwwd - webarchive
- https://www.recordedfuture.com/isaacwiper-continues-trend-wiper-attacks-against-ukraine/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2022/03/double-header-isaacwiper-and-caddywiper/ - webarchive
- https://www.nextgov.com/cybersecurity/2022/03/ukrainian-cyber-lead-least-4-types-malware-are-targeting-ukrainian-institutions/363558/ - webarchive
- https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/mtp-2022-0324.pdf - webarchive
- https://www.microsoft.com/en-us/security/business/security-insider/wp-content/uploads/2023/03/A-year-of-Russian-hybrid-warfare-in-Ukraine_MS-Threat-Intelligence-1.pdf - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/ - webarchive
- https://experience.mandiant.com/trending-evil-2/p/1 - webarchive
- https://cybersecurity.att.com/blogs/labs-research/analysis-on-recent-wiper-attacks-examples-and-how-they-wiper-malware-works - webarchive
- https://www.youtube.com/watch?v=mrTdSdMMgnk - webarchive
- https://securityboulevard.com/2022/03/isaacwiper-followed-hermeticwiper-attack-on-ukraine-orgs/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ISFB
2006 Gozi v1.0, Gozi CRM, CRM, Papras 2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*)
In September 2010, the source code of a particular Gozi CRM dll version was leaked. This led to two main branches: one became known as Gozi Prinimalka, which was merge with Pony and became Vawtrak/Neverquest.
The other branch became known as Gozi ISFB, or ISFB in short. Webinject functionality was added to this version.
There is one panel which often was used in combination with ISFB: IAP. The panel's login page comes with the title 'Login - IAP'. The body contains 'AUTHORIZATION', 'Name:', 'Password:' and a single button 'Sign in' in a minimal design. Often, the panel is directly accessible by entering the C2 IP address in a browser. But there are ISFB versions which are not directly using IAP. The bot accesses a gate, which is called the 'Dreambot' gate. See win.dreambot for further information.
ISFB often was protected by Rovnix. This led to a further complication in the naming scheme - many companies started to call ISFB Rovnix. Because the signatures started to look for Rovnix, other trojans protected by Rovnix (in particular ReactorBot and Rerdom) sometimes got wrongly labelled.
In April 2016 a combination of Gozi ISFB and Nymaim was detected. This breed became known as GozNym. The merge uses a shellcode-like version of Gozi ISFB, that needs Nymaim to run. The C2 communication is performed by Nymaim.
See win.gozi for additional historical information.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ISFB.
| Known Synonyms |
|---|
Gozi ISFB |
IAP |
Pandemyia |
Internal MISP references
UUID a171321e-4968-4ac0-8497-3250c1f0d77d which can be used as unique global reference for ISFB in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.isfb - webarchive
- https://www.cyberbit.com/new-ursnif-malware-variant/ - webarchive
- https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/ - webarchive
- https://github.com/gbrindisi/malware/tree/master/windows/gozi-isfb - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://0xtoxin.github.io/threat%20breakdown/Gozi-Italy-Campaign/ - webarchive
- https://www.fidelissecurity.com/threatgeek/threat-intelligence/gozi-v3-technical-update/ - webarchive
- https://redcanary.com/resources/webinars/deep-dive-process-injection/ - webarchive
- https://isc.sans.edu/forums/diary/Reviewing+the+spam+filters+Malspam+pushing+GoziISFB/23245 - webarchive
- https://0xc0decafe.com/malware-analysts-guide-to-aplib-decompression/ - webarchive
- https://www.zdnet.com/article/ursnif-trojan-has-targeted-over-100-italian-banks/ - webarchive
- https://mal-eats.net/2021/05/10/campo_new_attack_campaign_targeting_japan/ - webarchive
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-batloader - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://research.nccgroup.com/2021/05/04/rm3-curiosities-of-the-wildest-banking-malware/ - webarchive
- https://lokalhost.pl/gozi_tree.txt - webarchive
- https://www.justice.gov/opa/pr/officials-announce-international-operation-targeting-transnational-criminal-organization - webarchive
- https://www.youtube.com/watch?v=jlc7Ahp8Iqg - webarchive
- https://www.cylance.com/en_us/blog/threat-spotlight-ursnif-infostealer-malware.html - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://malware.love/malware_analysis/reverse_engineering/2020/11/27/analyzing-a-vbs-dropper.html - webarchive
- https://blog.morphisec.com/ursnif/gozi-delivery-excel-macro-4.0-utilization-uptick-ocr-bypass - webarchive
- https://blog.talosintelligence.com/2020/09/salfram-robbing-place-without-removing.html - webarchive
- https://www.proofpoint.com/us/blog/security-briefs/ta544-targets-italian-organizations-ursnif-malware - webarchive
- https://arielkoren.com/blog/2016/11/01/ursnif-malware-deep-technical-dive/ - webarchive
- https://labs.sentinelone.com/enter-the-maze-demystifying-an-affiliate-involved-in-maze-snow/ - webarchive
- https://news.sophos.com/en-us/2019/12/24/gozi-v3-tracked-by-their-own-stealth/ - webarchive
- https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html - webarchive
- https://blog.fox-it.com/2021/05/04/rm3-curiosities-of-the-wildest-banking-malware/ - webarchive
- https://securityintelligence.com/posts/itg23-crypters-cooperation-between-cybercriminal-groups/ - webarchive
- https://www.vkremez.com/2018/08/lets-learn-in-depth-reversing-of-recent.html - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/ - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://securityintelligence.com/meet-goznym-the-banking-malware-offspring-of-gozi-isfb-and-nymaim/ - webarchive
- https://www.botconf.eu/wp-content/uploads/2019/12/B2019-OReilly-Jarvis-End-to-end-Botnet-Monitoring.pdf - webarchive
- https://www.cleafy.com/cleafy-labs/digital-banking-fraud-how-the-gozi-malware-work - webarchive
- https://blog.malwarebytes.com/threat-analysis/2017/04/binary-options-malvertising-campaign-drops-isfb-banking-trojan/ - webarchive
- https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/gozi-italian-shellcode-dance - webarchive
- https://www.proofpoint.com/us/threat-insight/post/holiday-lull-not-so-much - webarchive
- https://www.youtube.com/watch?v=KvOpNznu_3w - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_5_sajo-takeda-niwa_en.pdf - webarchive
- https://medium.com/walmartglobaltech/signed-dll-campaigns-as-a-service-7760ac676489 - webarchive
- https://www.deepinstinct.com/2021/05/26/deep-dive-packing-software-cryptone/ - webarchive
- https://www.cybereason.com/blog/cybereason-vs-egregor-ransomware - webarchive
- https://intezer.com/blog/intezer-analyze/fantastic-payloads-and-where-we-find-them - webarchive
- https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/ - webarchive
- https://decoded.avast.io/vladimirmartyanov/zloader-the-silent-night/ - webarchive
- https://www.esentire.com/blog/batloader-continues-to-abuse-google-search-ads-to-deliver-vidar-stealer-and-ursnif - webarchive
- https://www.darktrace.com/en/blog/the-resurgence-of-the-ursnif-banking-trojan/ - webarchive
- https://blog.talosintelligence.com/2019/01/amp-tracks-ursnif.html - webarchive
- https://blog.yoroi.company/research/the-ursnif-gangs-keep-threatening-italy/ - webarchive
- https://github.com/mlodic/ursnif_beacon_decryptor - webarchive
- https://twitter.com/JAMESWT_MHT/status/1712783250446328114?t=iLKXzsZuS1TTa0i9sZFkQA&s=19 - webarchive
- http://benkow.cc/DreambotSAS19.pdf - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-010.pdf - webarchive
- https://blog.group-ib.com/gozi-latest-ttps - webarchive
- https://journal.cecyf.fr/ojs/index.php/cybin/article/view/15 - webarchive
- https://blog.qualys.com/vulnerabilities-threat-research/2022/05/08/ursnif-malware-banks-on-news-events-for-phishing-attacks - webarchive
- https://blog.yoroi.company/research/ursnif-long-live-the-steganography/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/coronavirus-threat-landscape-update - webarchive
- https://0ffset.net/reverse-engineering/malware-analysis/analyzing-isfb-second-loader/ - webarchive
- https://therecord.media/gozi-malware-gang-member-arrested-in-colombia/ - webarchive
- https://isc.sans.edu/forums/diary/German+language+malspam+pushes+Ursnif/25732/ - webarchive
- https://securityintelligence.com/posts/ursnif-cerberus-android-malware-bank-transfers-italy/ - webarchive
- https://threatresearch.ext.hp.com/detecting-ta551-domains/ - webarchive
- https://www.tgsoft.it/files/report/download.asp?id=7481257469 - webarchive
- https://www.fortinet.com/blog/threat-research/ursnif-variant-spreading-word-document.html - webarchive
- https://0ffset.net/reverse-engineering/malware-analysis/analysing-isfb-loader/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
- https://blog.morphisec.com/obfuscated-vbscript-drops-zloader-ursnif-qakbot-dridex - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://www.bridewell.com/insights/news/detail/hunting-for-ursnif - webarchive
- http://blog.talosintelligence.com/2018/03/gozi-isfb-remains-active-in-2018.html - webarchive
- https://www.cyberbit.com/blog/endpoint-security/new-ursnif-malware-variant/ - webarchive
- https://insight-jp.nttsecurity.com/post/102i7af/steelclovergoogle - webarchive
- https://www.tgsoft.it/files/report/download.asp?id=568531345 - webarchive
- https://www.cybereason.com/blog/new-ursnif-variant-targets-japan-packed-with-new-features - webarchive
- https://www.lastline.com/labsblog/evolution-of-excel-4-0-macro-weaponization/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader/ - webarchive
- https://blog.talosintelligence.com/2020/07/valak-emerges.html - webarchive
- https://www.proofpoint.com/us/threat-insight/post/urlzone-top-malware-japan-while-emotet-and-line-phishing-round-out-landscape-0 - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/out-sandbox-wikiloader-digs-sophisticated-evasion - webarchive
- https://www.fortinet.com/blog/threat-research/new-variant-of-ursnif-continuously-targeting-italy - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://intel471.com/blog/ettersilent-maldoc-builder-macro-trickbot-qbot/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/phishing-campaigns-featuring-ursnif-trojan/ - webarchive
- https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/ - webarchive
- https://research.checkpoint.com/2020/gozi-the-malware-with-a-thousand-faces/ - webarchive
- https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf - webarchive
- https://blog.minerva-labs.com/attackers-insert-themselves-into-the-email-conversation-to-spread-malware - webarchive
- https://kostas-ts.medium.com/ursnif-vs-italy-il-pdf-del-destino-5c83d6281072 - webarchive
- https://0ffset.net/reverse-engineering/analyzing-com-mechanisms-in-malware/ - webarchive
- https://www.hornetsecurity.com/en/security-information/firefox-send-sends-ursnif-malware/ - webarchive
- https://blog.yoroi.company/research/ursnif-the-latest-evolution-of-the-most-popular-banking-malware/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta544-targets-geographies-italy-japan-range-malware - webarchive
- https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://medium.com/csis-techblog/chapter-1-from-gozi-to-isfb-the-history-of-a-mythical-malware-family-82e592577fef - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ISMAgent
Internal MISP references
UUID 67457708-1edd-4ef1-9ec0-1c5eb7c75fe2 which can be used as unique global reference for ISMAgent in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ismagent - webarchive
- https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/greenbug-espionage-telco-south-asia - webarchive
- https://cyware.com/blog/apt34-the-helix-kitten-cybercriminal-group-loves-to-meow-middle-eastern-and-international-organizations-48ae - webarchive
- https://unit42.paloaltonetworks.com/atoms/evasive-serpens/ - webarchive
- http://www.clearskysec.com/ismagent/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ISMDoor
Internal MISP references
UUID e09d8dd6-6857-4607-a0ba-9c8d2a66083b which can be used as unique global reference for ISMDoor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ismdoor - webarchive
- http://www.clearskysec.com/greenbug/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/greenbug-espionage-telco-south-asia - webarchive
- https://unit42.paloaltonetworks.com/atoms/evasive-serpens/ - webarchive
- https://web.archive.org/web/20190331181353/https://www.symantec.com/connect/blogs/greenbug-cyberespionage-group-targeting-middle-east-possible-links-shamoon - webarchive
- https://www.symantec.com/connect/blogs/greenbug-cyberespionage-group-targeting-middle-east-possible-links-shamoon - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
iSpy Keylogger
Internal MISP references
UUID 8c95cb51-1044-4dcd-9cac-ad9f2e3b9070 which can be used as unique global reference for iSpy Keylogger in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IsraBye
Internal MISP references
UUID c5cec575-325c-44b8-af24-4feb330eec8a which can be used as unique global reference for IsraBye in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ISR Stealer
ISR Stealer is a modified version of the Hackhound Stealer. It is written in VB and often comes in a .NET-wrapper. ISR Stealer makes use of two Nirsoft tools: Mail PassView and WebBrowserPassView.
Incredibly, it uses an hard-coded user agent string: HardCore Software For : Public
Internal MISP references
UUID 27bab2fb-d324-42c2-9df3-669bb87c3989 which can be used as unique global reference for ISR Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IsSpace
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular IsSpace.
| Known Synonyms |
|---|
NfLog RAT |
Internal MISP references
UUID a3f41c96-a5c8-4dfe-b7fa-d9d75f97979a which can be used as unique global reference for IsSpace in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.isspace - webarchive
- https://unit42.paloaltonetworks.com/atoms/shallowtaurus/ - webarchive
- https://unit42.paloaltonetworks.com/watering-hole-attack-on-aerospace-firm-exploits-cve-2015-5122-to-install-isspace-backdoor/ - webarchive
- http://csecybsec.com/download/zlab/20180713_CSE_APT28_X-Agent_Op-Roman%20Holiday-Report_v6_1.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-express - webarchive
- http://researchcenter.paloaltonetworks.com/2017/01/unit42-dragonok-updates-toolset-targets-multiple-geographic-regions/ - webarchive
- https://wikileaks.org/vault7/document/2015-09-20150911-280-CSIT-15085-NfLog/2015-09-20150911-280-CSIT-15085-NfLog.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-overbrook - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
IXWare
Internal MISP references
UUID 5710dffa-ec02-4e5c-848e-47af13f729d7 which can be used as unique global reference for IXWare in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Jackal
According to Kaspersky Labs, this malware tool set has been used by APT group GoldenJackal, which has been observed since 2019 and which usually targets government and diplomatic entities in the Middle East and South Asia with espionage. It consists of multiple components and is written in .NET.
Internal MISP references
UUID 5f601f0a-13f7-40b5-9cf1-2eb50d5bad64 which can be used as unique global reference for Jackal in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JackPOS
Internal MISP references
UUID 3acb37f4-5614-4932-b12f-9f1c256895f2 which can be used as unique global reference for JackPOS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Jaff
Internal MISP references
UUID 2c51a717-726b-4813-9fcc-1265694b128e which can be used as unique global reference for Jaff in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.jaff - webarchive
- https://clairelevin.github.io/malware/2023/02/14/jaff.html - webarchive
- http://malware-traffic-analysis.net/2017/05/16/index.html - webarchive
- https://www.proofpoint.com/us/threat-insight/post/jaff-new-ransomware-from-actors-behind-distribution-of-dridex-locky-bart - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Jager Decryptor
Internal MISP references
UUID 13a7a2ff-c945-4b42-a112-dcf09f9ed9c9 which can be used as unique global reference for Jager Decryptor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Jaku
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Jaku.
| Known Synonyms |
|---|
C3PRO-RACOON |
EQUINOX |
KCNA Infostealer |
Reconcyc |
Internal MISP references
UUID 0f02ea79-5833-46e0-8458-c4a863a5a112 which can be used as unique global reference for Jaku in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.jaku - webarchive
- https://www.brighttalk.com/webcast/7451/538775 - webarchive
- https://www-01.ibm.com/support/docview.wss?uid=ssg1S1010146 - webarchive
- https://www.forcepoint.com/sites/default/files/resources/files/report_jaku_analysis_of_botnet_campaign_en_0.pdf - webarchive
- https://securelist.com/whos-really-spreading-through-the-bright-star/68978/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JanelaRAT
According to Zscaler, JanelaRAT is a heavily modified variant of BX RAT. Its focus is set on harvesting LATAM financial data and its method of extracting window titles for transmission underscores its targeted and stealthy nature. With an adaptive approach utilizing dynamic socket configuration and exploiting DLL side-loading from trusted sources, JanelaRAT poses a significant threat.
Internal MISP references
UUID d8455b0c-1d0b-4857-8e6a-abc6892cf7b9 which can be used as unique global reference for JanelaRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Janeleiro
Internal MISP references
UUID 2ebce129-d59e-401c-9259-9009d9b2d50f which can be used as unique global reference for Janeleiro in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
jason
Jason is a graphic tool implemented to perform Microsoft exchange account brute-force in order to “harvest” the highest possible emails and accounts information. Distributed in a ZIP container the interface is quite intuitive: the Microsoft exchange address and its version shall be provided. Three brute-force methods could be selected: EWS (Exchange Web Service), OAB (Offline Address Book) or both (All). Username and password list can be selected and threads number should be provided in order to optimize the attack balance.
Internal MISP references
UUID e101a605-c30f-4222-9549-4745d0d769cd which can be used as unique global reference for jason in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.jason - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-gypsy - webarchive
- https://marcoramilli.com/2019/06/06/apt34-jason-project/ - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://twitter.com/P3pperP0tts/status/1135503765287657472 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Jasus
Internal MISP references
UUID af6e89ec-0adb-4ce6-b4e6-610827e722ea which can be used as unique global reference for Jasus in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JCry
Ransomware written in Go.
Internal MISP references
UUID fea703ec-9b24-4119-96b3-7ae6bec3b203 which can be used as unique global reference for JCry in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Jeno
Ransomware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Jeno.
| Known Synonyms |
|---|
Jest |
Valeria |
Internal MISP references
UUID a1d7e117-4ca9-4d67-a4dd-53626827ed2f which can be used as unique global reference for Jeno in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JessieConTea
JessieConTea is a remote access trojan that uses HTTP(S) for communication. It supports around 30 commands that include operations on the victim’s filesystem, basic process management, file exfiltration (both plain and zipped), and the download and execution of additional tools from the attacker’s arsenal. The commands are indexed by 32-bit integers, starting with the value 0x60D49D97.
The malware was delivered in-the-wild via trojanized applications like DeFi Wallet or Citrix Workspace.
JessieConTea generates POST parameters with a specific parameter name, jsessid, from which the initial part of its name is derived. Also, it contains a specific RTTI symbol ".?AVCHttpConn@@", which inspired the second part of the name. It uses RC4 for C&C traffic encryption.
Internal MISP references
UUID 8f286f97-30c8-4281-887b-9cbede9f1e1e which can be used as unique global reference for JessieConTea in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.jessiecontea - webarchive
- https://securelist.com/lazarus-trojanized-defi-app/106195/ - webarchive
- https://cn.ahnlab.com/global/upload/download/asecreport/ASEC%20REPORT_vol.102_ENG%20(4).pdf - webarchive
- https://blog.talosintelligence.com/2019/01/fake-korean-job-posting.html - webarchive
- https://asec.ahnlab.com/en/57685/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JhoneRAT
Cisco Talos identified JhoneRAT in January 2020. The RAT is delivered through cloud services (Google Drive) and also submits stolen data to them (Google Drive, Twitter, ImgBB, GoogleForms). The actors using JhoneRAT target Saudi Arabia, Iraq, Egypt, Libya, Algeria, Morocco, Tunisia, Oman, Yemen, Syria, UAE, Kuwait, Bahrain and Lebanon.
Internal MISP references
UUID 6dd8c953-f500-46dd-bacf-78772222f011 which can be used as unique global reference for JhoneRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.jhone_rat - webarchive
- https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html - webarchive
- https://blog.talosintelligence.com/2020/01/jhonerat.html - webarchive
- https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf - webarchive
- https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Jigsaw
According to PCrisk, Jigsaw is ransomware that uses the AES algorithm to encrypt various files stored on computers. Targeted files include .jpg, .docx, .mp3, .mp4, and many others.
Internal MISP references
UUID 910c3fd2-56e5-4f1d-8df0-2aa0b293b7d9 which can be used as unique global reference for Jigsaw in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Jimmy
Internal MISP references
UUID 551b568f-68fa-4483-a10c-a6452ae6289e which can be used as unique global reference for Jimmy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JLORAT
Internal MISP references
UUID 8d3ed9af-c136-47a4-a0d2-50c8248435a4 which can be used as unique global reference for JLORAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Joanap
Internal MISP references
UUID bbbef449-2fe6-4c25-a85c-69af9fa6208b which can be used as unique global reference for Joanap in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.joanap - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=5b9850b9-0fdd-48a9-b595-9234207ae7df&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://www.us-cert.gov/ncas/analysis-reports/AR18-149A - webarchive
- https://app.box.com/s/xyyord0b806e6or2nh92coxw2areyyx4 - webarchive
- https://www.acalvio.com/lateral-movement-technique-employed-by-hidden-cobra/ - webarchive
- https://www.secureworks.com/research/threat-profiles/nickel-academy - webarchive
- https://www.symantec.com/connect/blogs/attackers-target-dozens-global-banks-new-malware - webarchive
- https://www.us-cert.gov/ncas/alerts/TA18-149A - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Joao
Internal MISP references
UUID 8201c8d2-1dab-4473-bbdf-42952b3d5fc6 which can be used as unique global reference for Joao in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
win.JobCrypter
Internal MISP references
UUID 30c047ea-27c9-4b01-8532-bcaa661be85f which can be used as unique global reference for win.JobCrypter in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Jolob
Internal MISP references
UUID 97f12ca8-dc84-4a8c-b4c6-8ec1d1e79631 which can be used as unique global reference for Jolob in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JQJSNICKER
Internal MISP references
UUID 2e457b93-de45-4b1d-8e1d-b8d19c2c555a which can be used as unique global reference for JQJSNICKER in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JripBot
Internal MISP references
UUID e895a0d2-fe4b-4793-9440-9db2d56a97f2 which can be used as unique global reference for JripBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.jripbot - webarchive
- https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/ - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/10/20114955/Bartholomew-GuerreroSaade-VB2016.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JSOutProx
JSOutProx is a sophisticated attack framework built using both Javascript and .NET. It uses the .NET (de)serialization feature to interact with a Javascript file which is the core module running on a victim machine. Once the malware is run on the victim, the framework can load several plugins performing additional malicious activities on the target.
Internal MISP references
UUID 5e4fbe90-c043-4ac3-9fd5-d9e7d9bb173f which can be used as unique global reference for JSOutProx in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.jsoutprox - webarchive
- https://www.fortinet.com/blog/threat-research/adversary-playbook-javascript-rat-looking-for-that-government-cheese - webarchive
- https://twitter.com/zlab_team/status/1208022180241530882 - webarchive
- https://www.seqrite.com/documents/en/white-papers/whitepaper-multi-staged-jsoutprox-rat-target-indian-co-operative-banks-and-finance-companies.pdf - webarchive
- https://blog.yoroi.company/research/unveiling-jsoutprox-a-new-enterprise-grade-implant/ - webarchive
- https://blogs.quickheal.com/multi-staged-jsoutprox-rat-targets-indian-cooperative-banks-and-finance-companies/ - webarchive
- https://www.zscaler.com/blogs/research/targeted-attacks-indian-government-and-financial-institutions-using-jsoutprox-rat - webarchive
- https://yoroi.company/research/financial-institutions-in-the-sight-of-new-jsoutprox-attack-waves/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JSSLoader
Internal MISP references
UUID 5db89188-568d-40d2-9320-5fb4a06fbd51 which can be used as unique global reference for JSSLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.jssloader - webarchive
- https://www.malwarebytes.com/blog/threat-intelligence/2022/08/jssloader-the-shellcode-edition - webarchive
- https://www.microsoft.com/en-us/security/blog/2023/09/12/malware-distributor-storm-0324-facilitates-ransomware-access/ - webarchive
- https://blog.morphisec.com/new-jssloader-trojan-delivered-through-xll-files - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/jssloader-recoded-and-reloaded - webarchive
- https://www.splunk.com/en_us/blog/security/fin7-tools-resurface-in-the-field-splinter-or-copycat.html - webarchive
- https://blog.morphisec.com/vmware-identity-manager-attack-backdoor - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/ - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-2/ - webarchive
- https://www.bleepingcomputer.com/news/security/malicious-microsoft-excel-add-ins-used-to-deliver-rat-malware/ - webarchive
- https://malwarebytes.app.box.com/s/ym6r7o5hq0rx2nxjbctfv2sw5vx386ni - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://www.secureworks.com/blog/excel-add-ins-deliver-jssloader-malware - webarchive
- https://www.mandiant.com/resources/evolution-of-fin7 - webarchive
- https://www.morphisec.com/hubfs/eBooks_and_Whitepapers/FIN7%20JSSLOADER%20FINAL%20WEB.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JuicyPotato
As described on the Github repository page, "A sugared version of RottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM".
Internal MISP references
UUID 4dc0dccf-ac68-4464-b193-6519ffe00617 which can be used as unique global reference for JuicyPotato in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.juicy_potato - webarchive
- https://github.com/ohpe/juicy-potato - webarchive
- https://www.sentinelone.com/blog/bluesky-ransomware-ad-lateral-movement-evasion-and-fast-encryption-puts-threat-on-the-radar/ - webarchive
- https://lifars.com/wp-content/uploads/2020/06/Cryptocurrency-Miners-XMRig-Based-CoinMiner-by-Blue-Mockingbird-Group.pdf - webarchive
- https://www.welivesecurity.com/2021/08/09/iispy-complex-server-side-backdoor-antiforensic-features/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
JUMPALL
According to FireEye, JUMPALL is a malware dropper that has been observed dropping HIGHNOON/ZXSHELL/SOGU.
Internal MISP references
UUID a08db33d-4c37-4075-bd49-c3ab66a339db which can be used as unique global reference for JUMPALL in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Jupiter
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Jupiter.
| Known Synonyms |
|---|
EarlyRAT |
Internal MISP references
UUID 47baaed8-073c-4a13-92dc-434210ea3cd0 which can be used as unique global reference for Jupiter in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KAgent
Internal MISP references
UUID eab42a8e-22e7-49e4-8a26-44f14b6f67bb which can be used as unique global reference for KAgent in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kami
A Telegram bot with browser stealing capabilities, written using the .NET framework.
Internal MISP references
UUID d78ade16-d038-44b6-adfa-2439dcaf4d87 which can be used as unique global reference for Kami in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Karagany
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Karagany.
| Known Synonyms |
|---|
Karagny |
Internal MISP references
UUID 857e61fe-ccb2-426b-ad7b-696112f48dbb which can be used as unique global reference for Karagany in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.karagany - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-liberty - webarchive
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/Dragonfly_Threat_Against_Western_Energy_Suppliers.pdf - webarchive
- https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector - webarchive
- https://vblocalhost.com/uploads/VB2021-Slowik.pdf - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks - webarchive
- https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kardon Loader
According to ASERT, Kardon Loader is a fully featured downloader, enabling the download and installation of other malware, eg. banking trojans/credential theft etc.This malware has been on sale by an actor under the username Yattaze, starting in late April. The actor offers the sale of the malware as a standalone build with charges for each additional rebuild, or the ability to set up a botshop in which case any customer can establish their own operation and further sell access to a new customer base.
Internal MISP references
UUID 8b33ba21-9af7-4536-bd02-23dd863147e8 which can be used as unique global reference for Kardon Loader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Karius
According to checkpoint, Karius is a banking trojan in development, borrowing code from Ramnit, Vawtrack as well as Trickbot, currently implementing webinject attacks only.
It comes with an injector that loads an intermediate "proxy" component, which in turn loads the actual banker component.
Communication with the c2 are in json format and encrypted with RC4 with a hardcoded key.
In the initial version, observed in March 2018, the webinjects were hardcoded in the binary, while in subsequent versions, they were received by the c2.
Internal MISP references
UUID 8a01c3be-17b7-4e5a-b0b2-6c1f5ccb82cf which can be used as unique global reference for Karius in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.karius - webarchive
- https://research.checkpoint.com/banking-trojans-development/ - webarchive
- https://dissectmalware.wordpress.com/2018/03/28/multi-stage-powershell-script/ - webarchive
- https://securityintelligence.com/posts/from-ramnit-to-bumblebee-via-neverquest - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Karkoff
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Karkoff.
| Known Synonyms |
|---|
CACTUSPIPE |
MailDropper |
OILYFACE |
Internal MISP references
UUID a45c16d9-6945-428c-af46-0436903f9329 which can be used as unique global reference for Karkoff in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.karkoff - webarchive
- https://blog.telsy.com/apt34-aka-oilrig-attacks-lebanon-government-entities-with-maildropper-implant/ - webarchive
- https://blog.yoroi.company/research/karkoff-2020-a-new-apt34-espionage-operation-involves-lebanon-government/ - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-edgewater - webarchive
- https://mp.weixin.qq.com/s/o_EVjBVN2sQ1q7cl4rUXoQ - webarchive
- https://cyware.com/blog/apt34-the-helix-kitten-cybercriminal-group-loves-to-meow-middle-eastern-and-international-organizations-48ae - webarchive
- https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html - webarchive
- https://www.trendmicro.com/en_us/research/23/b/new-apt34-malware-targets-the-middle-east.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Karma
Ransomware.
Internal MISP references
UUID 2667c9a6-4811-4535-95a1-3b75ba853a03 which can be used as unique global reference for Karma in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.karma - webarchive
- https://blog.cyble.com/2021/08/24/a-deep-dive-analysis-of-karma-ransomware/ - webarchive
- https://news.sophos.com/en-us/2022/02/28/conti-and-karma-actors-attack-healthcare-provider-at-same-time-through-proxyshell-exploits/?cmp=30728 - webarchive
- https://www.sentinelone.com/labs/nokoyawa-ransomware-new-karma-nemty-variant-wears-thin-disguise/ - webarchive
- https://www.youtube.com/watch?v=hgz5gZB3DxE - webarchive
- https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://blogs.blackberry.com/en/2021/11/threat-thursday-karma-ransomware - webarchive
- https://www.sentinelone.com/labs/karma-ransomware-an-emerging-threat-with-a-hint-of-nemty-pedigree/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KasperAgent
Internal MISP references
UUID d9c14095-8885-406c-b56b-06f3a1a88c1c which can be used as unique global reference for KasperAgent in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kazuar
Internal MISP references
UUID bab92070-3589-4b7e-bf05-4f54bfefc2ca which can be used as unique global reference for Kazuar in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.kazuar - webarchive
- https://www.picussecurity.com/blog/picus-10-critical-mitre-attck-techniques-t1055-process-injection - webarchive
- https://cert.gov.ua/article/5213167 - webarchive
- https://securelist.com/tomiris-called-they-want-their-turla-malware-back/109552/ - webarchive
- https://twitter.com/msftsecintel/status/1681695399084539908 - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://securelist.com/sunburst-backdoor-kazuar/99981/ - webarchive
- https://www.epicturla.com/blog/sysinturla - webarchive
- https://securelist.com/it-threat-evolution-q2-2023/110355/ - webarchive
- http://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/ - webarchive
- https://securelist.com/apt-trends-report-q1-2021/101967/ - webarchive
- https://youtu.be/SW8kVkwDOrc?t=24706 - webarchive
- https://unit42.paloaltonetworks.com/pensive-ursa-uses-upgraded-kazuar-backdoor/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KazyLoader
According to Karsten Hahn, a straightforward loader that runs assemblies from images.
Internal MISP references
UUID a6f86df6-d822-4143-bdfe-149e70bcf1a0 which can be used as unique global reference for KazyLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KDC Sponge
Internal MISP references
UUID 77c4a0e7-7ee1-446a-bc5d-8dd596d9d5fc which can be used as unique global reference for KDC Sponge in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kegotip
Internal MISP references
UUID 96bb088c-7bb7-4a07-a9d7-a3cbb45d5755 which can be used as unique global reference for Kegotip in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KEKW
Ransomware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular KEKW.
| Known Synonyms |
|---|
KEKW-Locker |
Internal MISP references
UUID b178de96-14a3-49f1-a957-c83f86e23e83 which can be used as unique global reference for KEKW in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kelihos
Internal MISP references
UUID 7d69892e-d582-4545-8798-4a9a84a821ea which can be used as unique global reference for Kelihos in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.kelihos - webarchive
- https://lokalhost.pl/txt/peering.into.spam.botnets.VirusBulletin2017.pdf - webarchive
- https://www.justice.gov/opa/pr/russian-national-convicted-charges-relating-kelihos-botnet - webarchive
- https://www.bleepingcomputer.com/news/security/us-convicts-russian-national-behind-kelihos-botnet-crypting-service/ - webarchive
- https://www.shadowserver.org/news/has-the-sun-set-on-the-necurs-botnet/ - webarchive
- https://www.wired.com/2017/04/fbi-took-russias-spam-king-massive-botnet/ - webarchive
- https://www.crowdstrike.com/blog/inside-the-takedown-of-zombie-spider-and-the-kelihos-botnet/ - webarchive
- https://www.crowdstrike.com/blog/farewell-to-kelihos-and-zombie-spider/ - webarchive
- https://www.cyberscoop.com/doj-kelihos-botnet-peter-levashov-severa/ - webarchive
- https://en.wikipedia.org/wiki/Kelihos_botnet - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Keona
Internal MISP references
UUID b74ad48b-ac26-4748-adac-b824defbe315 which can be used as unique global reference for Keona in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KerrDown
Internal MISP references
UUID bd9e21d1-7da3-4699-816f-0e368a63bc18 which can be used as unique global reference for KerrDown in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.kerrdown - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.amnesty.de/sites/default/files/2021-02/Amnesty-Bericht-Vietnam-Click-And-Bait-Blogger-Deutschland-Spionage-Menschenrechtsverteidiger-Februar-2021.pdf - webarchive
- https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/ - webarchive
- https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2020-1110.pdf - webarchive
- https://tradahacking.vn/th%C6%B0%E1%BB%9Fng-t%E1%BA%BFt-fbcbbed49da7 - webarchive
- https://github.com/AmnestyTech/investigations/tree/master/2021-02-24_vietnam - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/tin-woodlawn - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://blog.cystack.net/word-based-malware-attack/ - webarchive
- https://norfolkinfosec.com/jeshell-an-oceanlotus-apt32-backdoor/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ketrican
Ketrican is a backdoor trojan used by APT 15.
Internal MISP references
UUID 86cd2563-b343-4cce-ac2d-a17afbc77dfd which can be used as unique global reference for Ketrican in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ketrican - webarchive
- https://www.ptsecurity.com/ww-en/analytics/antisandbox-techniques/ - webarchive
- https://www.intezer.com/blog/research/the-evolution-of-apt15s-codebase-2020/ - webarchive
- https://www.welivesecurity.com/2019/07/18/okrum-ke3chang-targets-diplomatic-missions/ - webarchive
- https://www.verfassungsschutz.de/embed/broschuere-2020-06-bfv-cyber-brief-2020-01.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ketrum
Intezer found this family mid May 2020, which appears to be a merger of the family Ketrican and Okrum.
Internal MISP references
UUID 99d6cb80-bae2-4a97-8ec7-401f9570f237 which can be used as unique global reference for Ketrum in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KeyBase
KeyBase is a .NET credential stealer and keylogger that first emerged in February 2015. It often incorporates Nirsoft tools such as MailPassView and WebBrowserPassView for additional credential grabbing.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular KeyBase.
| Known Synonyms |
|---|
Kibex |
Internal MISP references
UUID 8a7bb20e-7e90-4330-8f53-744bd5519f6f which can be used as unique global reference for KeyBase in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.keybase - webarchive
- https://th3l4b.blogspot.com/2015/10/keybase-loggerclipboardcredsstealer.html - webarchive
- https://isc.sans.edu/forums/diary/Malicious+Office+files+using+fileless+UAC+bypass+to+drop+KEYBASE+malware/22011/ - webarchive
- https://community.rsa.com/community/products/netwitness/blog/2018/02/15/malspam-delivers-keybase-keylogger-2-11-2017 - webarchive
- https://www.virusbulletin.com/virusbulletin/2016/07/new-keylogger-block/ - webarchive
- https://unit42.paloaltonetworks.com/keybase-threat-grows-despite-public-takedown-a-picture-is-worth-a-thousand-words/ - webarchive
- https://voidsec.com/keybase-en/ - webarchive
- https://unit42.paloaltonetworks.com/keybase-keylogger-malware-family-exposed/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KeyBoy
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular KeyBoy.
| Known Synonyms |
|---|
TSSL |
Internal MISP references
UUID 28c13455-7f95-40a5-9568-1e8732503507 which can be used as unique global reference for KeyBoy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.keyboy - webarchive
- https://www.pwc.co.uk/issues/cyber-security-data-privacy/research/the-keyboys-are-back-in-town.html - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-hobart - webarchive
- https://citizenlab.ca/2016/11/parliament-keyboy/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/ - webarchive
- https://blog.rapid7.com/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
APT3 Keylogger
Internal MISP references
UUID 68039fbe-2eee-4666-b809-32a011e9852a which can be used as unique global reference for APT3 Keylogger in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.keylogger_apt3 - webarchive
- https://twitter.com/smoothimpact/status/773631684038107136 - webarchive
- http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong - webarchive
- https://cocomelonc.github.io/malware/2023/05/11/malware-tricks-28.html - webarchive
- https://intrusiontruth.wordpress.com/2017/05/09/apt3-is-boyusec-a-chinese-intelligence-contractor/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KEYMARBLE
Internal MISP references
UUID 0c213d7f-8c71-4341-aeb0-13be71fbf4e5 which can be used as unique global reference for KEYMARBLE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.keymarble - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://research.checkpoint.com/north-korea-turns-against-russian-targets/ - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://www.us-cert.gov/ncas/analysis-reports/AR18-221A - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KGH_SPY
Internal MISP references
UUID d073b11a-a941-48b9-8e88-b59ffab9fcda which can be used as unique global reference for KGH_SPY in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Khonsari
A compact ransomware written in .NET and delivered as follow-up to Log4J exploitation, targeting Windows servers.
Internal MISP references
UUID 76a7c43f-73d7-4f4f-acac-1fcaa150bf72 which can be used as unique global reference for Khonsari in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.khonsari - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/log4j-vulnerabilities-attacks - webarchive
- https://assets.virustotal.com/reports/2021trends.pdf - webarchive
- https://www.cadosecurity.com/analysis-of-novel-khonsari-ransomware-deployed-by-the-log4shell-vulnerability/ - webarchive
- https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation - webarchive
- https://cloudsek.com/technical-analysis-of-khonsari-ransomware-campaign-exploiting-the-log4shell-vulnerability/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KHRAT
According to Unit42, KHRAT is a Trojan that registers victims using their infected machine’s username, system language and local IP address. KHRAT provides the threat actors typical RAT features and access to the victim system, including keylogging, screenshot capabilities, remote shell access and so on.
Internal MISP references
UUID 361d3f09-8bc8-4b5a-803f-8686cf346047 which can be used as unique global reference for KHRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.khrat - webarchive
- https://unit42.paloaltonetworks.com/atoms/rancortaurus/ - webarchive
- https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/ - webarchive
- https://unit42.paloaltonetworks.com/rancor-cyber-espionage-group-uses-new-custom-malware-to-attack-southeast-asia/ - webarchive
- https://www.forcepoint.com/de/blog/x-labs/trojanized-adobe-installer-used-install-dragonok-s-new-custom-backdoor - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kikothac
Internal MISP references
UUID f2ca304f-6577-4f3a-983c-beec447a9493 which can be used as unique global reference for Kikothac in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KillAV
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular KillAV.
| Known Synonyms |
|---|
BURNTCIGAR |
Internal MISP references
UUID ad6ac685-e13f-4522-9805-644f82818347 which can be used as unique global reference for KillAV in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.killav - webarchive
- https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/ - webarchive
- https://news.sophos.com/en-us/2022/12/13/signed-driver-malware-moves-up-the-software-trust-chain/ - webarchive
- https://www.mandiant.com/resources/unc2596-cuba-ransomware - webarchive
- https://cyber.aon.com/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/ - webarchive
- https://www.quorumcyber.com/threat-actors/scattered-spider-threat-actor-profile/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KillDisk
KillDisk is a generic detection name used by ESET to refer to destructive malware with disk wiping capabilities, such as damaging boot sectors and overwriting then deleting (system) files, followed by a reboot to render the machine unusable. Although all KillDisk malware has similar functionality, as a generic detection, individual samples do not necessarily have strong code similarities or relationships. Such generic malware detections usually have many “sub-families”, distinguished by the detection suffix (e.g. KillDisk.NBO, KillDisk.NCV, and KillDisk.NCX). Sub-family variants that do have strong code similarities, are sometimes seen in separate cyberattacks and thus can help researchers make connections between them.
Internal MISP references
UUID e81f3e3f-966c-4c99-8d4b-fc0a1d3bb027 which can be used as unique global reference for KillDisk in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.killdisk - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-viking - webarchive
- https://www.welivesecurity.com/2017/01/05/killdisk-now-targeting-linux-demands-250k-ransom-cant-decrypt - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/ - webarchive
- https://blog.nviso.eu/2022/02/24/threat-update-ukraine-russia-tensions/ - webarchive
- https://attack.mitre.org/groups/G0034 - webarchive
- http://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/ - webarchive
- https://www.youtube.com/watch?v=mrTdSdMMgnk - webarchive
- http://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KilllSomeOne
Internal MISP references
UUID 4d431d90-9dd5-4a77-9084-c010d6504f78 which can be used as unique global reference for KilllSomeOne in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KimJongRat
Internal MISP references
UUID 61edd17b-322d-45dc-a6a0-31c13ec2338e which can be used as unique global reference for KimJongRat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kimsuky
Internal MISP references
UUID 860643d6-5693-4e4e-ad1f-56c49faa10a7 which can be used as unique global reference for Kimsuky in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.kimsuky - webarchive
- https://blog.alyac.co.kr/2347 - webarchive
- https://blog.prevailion.com/2019/09/autumn-aperture-report.html - webarchive
- https://cocomelonc.github.io/tutorial/2022/04/20/malware-pers-1.html - webarchive
- https://inquest.net/blog/2021/08/23/kimsuky-espionage-campaign - webarchive
- https://www.boho.or.kr/filedownload.do?attach_file_seq=2652&attach_file_id=EpF2652.pdf - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference_slides/2019/VB2019-Kim.pdf - webarchive
- https://threatmon.io/unraveling-the-layers-analysis-of-kimsukys-multi-staged-cyberattack/ - webarchive
- https://medium.com/walmartglobaltech/pivoting-on-a-sharpext-to-profile-kimusky-panels-for-great-good-1920dc1bcef9 - webarchive
- https://vblocalhost.com/presentations/operation-newton-hi-kimsuky-did-an-appleseed-really-fall-on-newtons-head/ - webarchive
- https://www.pwc.co.uk/issues/cyber-security-data-privacy/research/tracking-kimsuky-north-korea-based-cyber-espionage-group-part-1.html - webarchive
- https://asec.ahnlab.com/en/37396/ - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/ - webarchive
- https://asec.ahnlab.com/en/30532/ - webarchive
- https://cocomelonc.github.io/malware/2022/08/26/malware-pers-9.html - webarchive
- https://threatconnect.com/blog/threatconnect-research-roundup-probable-sandworm-infrastructure - webarchive
- https://metaswan.github.io/posts/Malware-Kimsuky-group's-resume-impersonation-malware - webarchive
- https://asec.ahnlab.com/en/53046/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kingminer
Internal MISP references
UUID 04d95343-fd44-471d-bfe7-908994a98ea7 which can be used as unique global reference for Kingminer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.kingminer - webarchive
- https://www.bleepingcomputer.com/news/security/vulnerable-microsoft-sql-servers-targeted-with-cobalt-strike/ - webarchive
- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophos-labs-kingminer-botnet-report.pdf - webarchive
- https://asec.ahnlab.com/en/32572/ - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/354/Bitdefender-PR-Whitepaper-KingMiner-creat4610-en-EN-GenericUse.pdf - webarchive
- https://news.sophos.com/en-us/2020/06/09/kingminer-report/ - webarchive
- https://www.trendmicro.com/en_us/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KINS
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular KINS.
| Known Synonyms |
|---|
Kasper Internet Non-Security |
Maple |
Internal MISP references
UUID 07f6bbff-a09a-4580-96ea-62795a8dae11 which can be used as unique global reference for KINS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.kins - webarchive
- https://blog.malwarebytes.com/threat-analysis/2014/02/hiding-in-plain-sight-a-story-about-a-sneaky-banking-trojan/ - webarchive
- https://github.com/nyx0/KINS - webarchive
- https://www.vkremez.com/2018/10/lets-learn-exploring-zeusvm-banking.html - webarchive
- https://securityintelligence.com/zeus-maple-variant-targets-canadian-online-banking-customers/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KIVARS (Windows)
Internal MISP references
UUID 6c585194-96d3-463d-ac21-aa942439cc26 which can be used as unique global reference for KIVARS (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.kivars - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/kivars-with-venom-targeted-attacks-upgrade-with-64-bit-support/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt - webarchive
- https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Klackring
Microsoft describes that threat actor ZINC is using Klackring as a malware dropped by ComeBacker, both being used to target security researchers.
Internal MISP references
UUID 03a4eb90-8d88-49c7-a973-2201115ea5a8 which can be used as unique global reference for Klackring in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KleptoParasite Stealer
KleptoParasite Stealer is advertised on Hackforums as a noob-friendly stealer. It is modular and comes with a IP retriever module, a Outlook stealer (32bit/64bit) and a Chrome/Firefox stealer (32bit/64bit). Earlier versions come bundled (loader plus modules), newer versions come with a loader (167k) that grabs the modules.
PDB-strings suggest a relationship to JogLog v6 and v7.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular KleptoParasite Stealer.
| Known Synonyms |
|---|
Joglog |
Parasite |
Internal MISP references
UUID 618b6f23-fc83-4aff-8b0a-7f7138be625c which can be used as unique global reference for KleptoParasite Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KlingonRAT
Internal MISP references
UUID 5f501884-2c72-4780-aaa6-c6b65e84fad8 which can be used as unique global reference for KlingonRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KLRD
Internal MISP references
UUID 70459959-5a20-482e-b714-2733f5ff310e which can be used as unique global reference for KLRD in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Knot
Ransomware.
Internal MISP references
UUID 0479b7cd-982e-430e-a96e-338aec8ae3cf which can be used as unique global reference for Knot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Koadic
Koadic is an open-source post-exploitation framework for Windows, created by zerosum0x0 and available on GitHub. The framework is written in Python and can generate JScript and VBScript payloads which can be written to disk or mapped directly into memory. Its capabilities include remote desktop access, command execution, lateral movement via SMB, file transfer, credential theft using Mimikatz, port scanning, and system information collection. It can also collect specific system information and targeted files based on their name or extension.
Internal MISP references
UUID 3b5faa15-e87e-4aaf-b791-2c5e593793e6 which can be used as unique global reference for Koadic in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.koadic - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-drake - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-ulster - webarchive
- https://www.prodaft.com/m/uploads/SilverFish_TLPWHITE.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-trinity - webarchive
- https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf - webarchive
- https://blog.tofile.dev/2020/11/28/koadic_jarm.html - webarchive
- https://labs.bitdefender.com/2020/03/5-times-more-coronavirus-themed-malware-reports-during-march/?utm_campaign=twitter&utm_medium=twitter&utm_source=twitter - webarchive
- http://www.secureworks.com/research/threat-profiles/cobalt-ulster - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-drake - webarchive
- https://github.com/zerosum0x0/koadic - webarchive
- https://resources.malwarebytes.com/files/2021/02/LazyScripter.pdf - webarchive
- https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KoiVM
A loader written in .NET.
Internal MISP references
UUID 4b7c6af1-1980-452f-9405-e42d0066ff2d which can be used as unique global reference for KoiVM in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KokoKrypt
Internal MISP references
UUID f7674d06-450a-4150-9180-afef94cce53c which can be used as unique global reference for KokoKrypt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KOMPROGO
KOMPROGO is a signature backdoor used by APT32 that is capable of process, file, and registry management, Creating a reverse shell, running WMI queries, retrieving information about the infected system.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular KOMPROGO.
| Known Synonyms |
|---|
Splinter RAT |
Internal MISP references
UUID 116f4c5f-fd51-4e90-995b-f16c46523c06 which can be used as unique global reference for KOMPROGO in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.komprogo - webarchive
- https://www.symantec.com/security_response/earthlink_writeup.jsp?docid=2015-120808-5327-99 - webarchive
- https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/SpyRATsofOceanLotusMalwareWhitePaper.pdf - webarchive
- https://ruxcon.org.au/assets/2017/slides/bart-RuxCon-Presentation.pptx - webarchive
- https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Konni
Konni is a remote administration tool, observed in the wild since early 2014. The Konni malware family is potentially linked to APT37, a North-Korean cyber espionage group active since 2012. The group primary victims are South-Korean political organizations, as well as Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East.
Internal MISP references
UUID f982fa2d-f78f-4fe1-a86d-d10471a3ebcf which can be used as unique global reference for Konni in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.konni - webarchive
- https://wezard4u.tistory.com/6693 - webarchive
- https://www.securonix.com/blog/stiffbizon-detection-new-attack-campaign-observed/ - webarchive
- https://threatmon.io/the-konni-apt-chronicle-tracing-their-intelligence-driven-attack-chain/ - webarchive
- https://nsfocusglobal.com/the-new-apt-group-darkcasino-and-the-global-surge-in-winrar-0-day-exploits/ - webarchive
- http://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2022/01/konni-evolves-into-stealthier-rat/ - webarchive
- https://cocomelonc.github.io/tutorial/2021/09/06/simple-malware-av-evasion-2.html - webarchive
- https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/ - webarchive
- https://blog.alyac.co.kr/2474 - webarchive
- https://medium.com/d-hunter/a-look-into-konni-2019-campaign-b45a0f321e9b - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-227a - webarchive
- https://blog.fortinet.com/2017/08/15/a-quick-look-at-a-new-konni-rat-variant - webarchive
- https://cluster25.io/wp-content/uploads/2022/01/Konni_targeting_Russian_diplomatic_sector.pdf - webarchive
- https://cocomelonc.github.io/malware/2022/09/06/malware-tricks-23.html - webarchive
- http://blog.talosintelligence.com/2017/07/konni-references-north-korean-missile-capabilities.html - webarchive
- https://blog.lumen.com/new-konni-campaign-targeting-russian-ministry-of-foreign-affairs/ - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/ - webarchive
- https://e.cyberint.com/hubfs/Cyberint_Konni%20Malware%202019%20Campaign_Report.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/hackers-take-over-diplomats-email-target-russian-deputy-minister/ - webarchive
- https://vallejo.cc/2017/07/08/analysis-of-new-variant-of-konni-rat/ - webarchive
- https://www.bleepingcomputer.com/news/security/north-korean-hackers-attack-eu-targets-with-konni-rat-malware/ - webarchive
- https://cocomelonc.github.io/tutorial/2022/05/02/malware-pers-3.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KoobFace
Internal MISP references
UUID 9430ce27-c8c5-44fb-9255-47d76a8903b3 which can be used as unique global reference for KoobFace in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Korlia
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Korlia.
| Known Synonyms |
|---|
Bisonal |
Internal MISP references
UUID 52d98d2f-db62-430d-8658-5cadaeff6cd7 which can be used as unique global reference for Korlia in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.korlia - webarchive
- https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/ - webarchive
- https://nao-sec.org/2020/01/an-overhead-view-of-the-royal-road.html - webarchive
- https://github.com/malware-kitten/securitykitten.github.io/blob/master/_posts/2014-11-25-curious-korlia.md - webarchive
- https://www.sentinelone.com/labs/targets-of-interest-russian-organizations-increasingly-under-attack-by-chinese-apts/ - webarchive
- https://web.archive.org/web/20130920120931/https:/www.rsaconference.com/writable/presentations/file_upload/cle-t04_final_v1.pdf - webarchive
- https://research.checkpoint.com/2020/vicious-panda-the-covid-campaign/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-huntley - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0919.pdf - webarchive
- https://www.slideshare.net/StefanoMaccaglia/bsides-ir-in-heterogeneous-environment - webarchive
- https://www.ptsecurity.com/upload/corporate/ww-en/pt-esc/winnti-2020-eng.pdf - webarchive
- http://asec.ahnlab.com/tag/Operation%20Bitter%20Biscuit - webarchive
- https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html - webarchive
- https://asec.ahnlab.com/1298 - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_3_takai_jp.pdf - webarchive
- https://www.youtube.com/watch?v=_fstHQSK-kk - webarchive
- https://global.ahnlab.com/global/upload/download/asecreport/ASEC%20REPORT_vol.93_ENG.pdf - webarchive
- https://securitykitten.github.io/2014/11/25/curious-korlia.html - webarchive
- https://unit42.paloaltonetworks.com/unit42-bisonal-malware-used-attacks-russia-south-korea/ - webarchive
- https://researchcenter.paloaltonetworks.com/2018/07/unit42-bisonal-malware-used-attacks-russia-south-korea/ - webarchive
- https://www.ptsecurity.com/upload/corporate/ru-ru/pt-esc/winnti-2020-rus.pdf - webarchive
- https://www.ptsecurity.com/upload/corporate/ru-ru/webinars/ics/winnti-shadowpad.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kovter
Kovter is a Police Ransomware
Feb 2012 - Police Ransomware Aug 2013 - Became AD Fraud Mar 2014 - Ransomware to AD Fraud malware June 2014 - Distributed from sweet orange exploit kit Dec 2014 - Run affiliated node Apr 2015 - Spread via fiesta and nuclear pack May 2015 - Kovter become fileless 2016 - Malvertising campaign on Chrome and Firefox June 2016 - Change in persistence July 2017 - Nemucod and Kovter was packed together Jan 2018 - Cyclance report on Persistence
Internal MISP references
UUID af3a0643-7a80-4b8f-961b-aea18e78715e which can be used as unique global reference for Kovter in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.kovter - webarchive
- https://www.cybereason.com/blog/how-click-fraud-commodity-malware-transforms-into-an-advanced-threat - webarchive
- https://github.com/ewhitehats/kovterTools/blob/master/KovterWhitepaper.pdf - webarchive
- https://www.symantec.com/connect/blogs/kovter-malware-learns-poweliks-persistent-fileless-registry-update - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-345a - webarchive
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2015/01/major-malvertising-campaign-hits-sites-with-combined-total-monthly-traffic-of-1-5bn-visitors/ - webarchive
- https://github.com/itaymigdal/malware-analysis-writeups/blob/main/Kovter/Kovter.md - webarchive
- https://0xchrollo.github.io/articles/unpacking-kovter-malware/ - webarchive
- https://0x00sec.org/t/analyzing-modern-malware-techniques-part-1/18663 - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/kovter-an-evolving-malware-gone-fileless - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KPOT Stealer
KPOT is an information-stealing Trojan horse that can steal information from infected computers. It is distributed through phishing emails and malicious websites. Once executed on a computer, KPOT can steal passwords, credit card numbers, and other personal information.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular KPOT Stealer.
| Known Synonyms |
|---|
Khalesi |
Kpot |
Internal MISP references
UUID b1fe4226-1783-48d4-b1d2-417703a03b3d which can be used as unique global reference for KPOT Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.kpot_stealer - webarchive
- https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal - webarchive
- https://www.flashpoint-intel.com/blog/malware-campaign-targets-jaxx-cryptocurrency-wallet-users/ - webarchive
- https://isc.sans.edu/diary/26010 - webarchive
- https://github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/kpot2/KPOT.md - webarchive
- https://blag.nullteilerfrei.de/2020/04/26/use-ghidra-to-decrypt-strings-of-kpotstealer-malware/ - webarchive
- https://isc.sans.edu/diary/25934 - webarchive
- https://blog.ensilo.com/game-of-trojans-dissecting-khalesi-infostealer-malware - webarchive
- https://news.drweb.com/show/?i=13242&lng=en - webarchive
- https://umbrella.cisco.com/blog/navigating-cybersecurity-during-a-pandemic-latest-malware-and-threat-actors - webarchive
- https://www.zdnet.com/article/revil-ransomware-gang-acquires-kpot-malware/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/ - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://medium.com/s2wlab/deep-analysis-of-kpot-stealer-fb1d2be9c5dd - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Krachulka
According to ESET, this malware family is a banking trojan and was active in Brazil until the middle of 2019. Its most noticeable characteristic was its usage of well-known cryptographic methods to encrypt strings, as opposed to the majority of Latin American banking trojans that mainly use custom encryption schemes.
Internal MISP references
UUID 1ddcb067-e876-4eff-8bb7-e28c089d99a3 which can be used as unique global reference for Krachulka in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kraken
A ransomware that was active in 2018.
Internal MISP references
UUID 3d7ae6b9-8161-470e-a7b6-752151b21657 which can be used as unique global reference for Kraken in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.kraken - webarchive
- https://securingtomorrow.mcafee.com/mcafee-labs/fallout-exploit-kit-releases-the-kraken-ransomware-on-its-victims/ - webarchive
- https://www.bleepingcomputer.com/news/security/kraken-cryptor-ransomware-masquerading-as-superantispyware-security-program/ - webarchive
- https://web.archive.org/web/20160616170611/https://media.blackhat.com/bh-eu-10/presentations/Carrera_Silberman/BlackHat-EU-2010-Carrera-Silberman-State-of-Malware-slides.pdf - webarchive
- https://www.recordedfuture.com/kraken-cryptor-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KrakenKeylogger
KrakenKeylogger is a .NET based Infostealer malware sold in Underground hacking forums
Internal MISP references
UUID 6b15469a-64ff-4edc-99dd-60f7a277d5c1 which can be used as unique global reference for KrakenKeylogger in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KrBanker
ThreatPost describes KRBanker (Blackmoon) as a banking Trojan designed to steal user credentials from various South Korean banking institutions. It was discovered in early 2014 and since then has adopted a variety of infection and credential stealing techniques.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular KrBanker.
| Known Synonyms |
|---|
BlackMoon |
Internal MISP references
UUID f4008c19-e81a-492a-abfe-f177e1ac5bce which can be used as unique global reference for KrBanker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.krbanker - webarchive
- https://fidelissecurity.com/threatgeek/threat-intelligence/blackmoon-banking-trojan-new-framework/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/Updated-Blackmoon-Banking-Trojan - webarchive
- https://zairon.wordpress.com/2014/04/15/trojan-banking-47d18761d46d8e7c4ad49cc575b0acc2bb3f49bb56a3d29fb1ec600447cb89a4/ - webarchive
- http://researchcenter.paloaltonetworks.com/2016/05/unit42-krbanker-targets-south-korea-through-adware-and-exploit-kits-2/ - webarchive
- https://www.peppermalware.com/2019/03/analysis-of-blackmoon-banking-trojans.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KrDownloader
Internal MISP references
UUID c346faf0-9eb4-4f8a-8547-30e6641b8972 which can be used as unique global reference for KrDownloader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kronos
Kronos malware is a sophisticated banking Trojan that first emerged in 2014. It is designed to target financial institutions and steal sensitive banking information. The malware is primarily spread through phishing campaigns and exploit kits. Once installed on a victim's computer, Kronos can capture login credentials, credit card details, and other personal information by keylogging and form grabbing techniques. It can also bypass security measures such as two-factor authentication. Kronos employs advanced evasion techniques to avoid detection by antivirus software and actively updates itself to evade security patches. It has been known to target a wide range of banking systems and has affected numerous organizations worldwide. The malware continues to evolve, making it a significant threat to online banking security.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Kronos.
| Known Synonyms |
|---|
Osiris |
Internal MISP references
UUID 62a7c823-9af0-44ee-ac05-8765806d2a17 which can be used as unique global reference for Kronos in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.kronos - webarchive
- https://www.proofpoint.com/us/threat-insight/post/kronos-reborn - webarchive
- https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree - webarchive
- https://www.securonix.com/securonix-threat-research-kronos-osiris-banking-trojan-attack - webarchive
- https://blog.morphisec.com/long-live-osiris-banking-trojan-targets-german-ip-addresses - webarchive
- https://therecord.media/osiris-banking-trojan-shuts-down-as-new-ares-variant-emerges/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/kronos-banking-trojan-used-to-deliver-new-point-of-sale-malware - webarchive
- https://twitter.com/3xp0rtblog/status/1294157781415743488 - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/10/new-looking-sundown-ek-drops-smoke-loader-kronos-banker/ - webarchive
- https://securityintelligence.com/the-father-of-zeus-kronos-malware-discovered/ - webarchive
- https://research.checkpoint.com/deep-dive-upas-kit-vs-kronos/ - webarchive
- https://vx-underground.org/archive/APTs/2017/2017.12.11/Money%20Taker.pdf - webarchive
- https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware/ - webarchive
- https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware-p2/ - webarchive
- https://dissectingmalwa.re/osiris-the-god-of-afterlifeand-banking-malware.html - webarchive
- https://unit42.paloaltonetworks.com/banking-trojan-techniques/ - webarchive
- https://www.trendmicro.com/en_us/research/22/g/gootkit-loaders-updated-tactics-and-fileless-delivery-of-cobalt-strike.html - webarchive
- https://www.zdnet.com/article/security-researcher-malwaretech-pleads-guilty/ - webarchive
- https://intel471.com/blog/privateloader-malware - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/operation-black-atlas-endangers-in-store-card-payments-and-smbs-worldwide-switches-between-blackpos-and-other-tools/ - webarchive
- https://www.zscaler.com/blogs/security-research/ares-malware-grandson-kronos-banking-trojan - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KryptoCibule
Internal MISP references
UUID 8039c56c-3be1-4344-81cf-6c21b06bbaa6 which can be used as unique global reference for KryptoCibule in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KSL0T
A keylogger used by Turla.
Internal MISP references
UUID aa93d030-abef-4215-bc9e-6c7483562d19 which can be used as unique global reference for KSL0T in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ksl0t - webarchive
- https://0ffset.net/reverse-engineering/malware-analysis/analyzing-turlas-keylogger-2/ - webarchive
- https://0ffset.wordpress.com/2018/10/05/post-0x17-2-turla-keylogger/ - webarchive
- https://0ffset.net/reverse-engineering/malware-analysis/analyzing-turlas-keylogger-1/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kuaibu
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Kuaibu.
| Known Synonyms |
|---|
Barys |
Gofot |
Kuaibpy |
Internal MISP references
UUID 7d8943a4-b710-48d3-9352-e9b42516d2b7 which can be used as unique global reference for Kuaibu in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kuluoz
Internal MISP references
UUID f9b3757e-99c7-4999-8b79-87609407f895 which can be used as unique global reference for Kuluoz in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kurton
Internal MISP references
UUID 1fc49b8c-647a-4484-a2f6-e6f2311f8b58 which can be used as unique global reference for Kurton in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kutaki
Cofense characterizes Kutaki as a data stealer that uses old-school techniques to detect sandboxes and debugging. Kutaki however works quite well against unhardened virtual machines and other analysis devices. By backdooring a legitimate application, it can fool unsophisticated detection methodologies.
Internal MISP references
UUID ff40299b-dc45-4a1c-bfe2-3864682b8fea which can be used as unique global reference for Kutaki in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Kwampirs
Kwampirs is a family of malware which uses SMB to spread. It typically will not execute or deploy in environments in which there is no publicly available admin$ share. It is a fully featured backdoor which can download additional modules. Typical C2 traffic is over HTTP and includes "q=[ENCRYPTED DATA]" in the URI.
Internal MISP references
UUID 2fc93875-eebb-41ff-a66e-84471c6cd5a3 which can be used as unique global reference for Kwampirs in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.kwampirs - webarchive
- http://www.documentcloud.org/documents/6821581-FLASH-CP-000111-MW-Downgraded-Version.html - webarchive
- https://www.atlanticcouncil.org/wp-content/uploads/2020/07/Breaking-trust-Shades-of-crisis-across-an-insecure-software-supply-chain.pdf - webarchive
- https://www.zdnet.com/article/fbi-re-sends-alert-about-supply-chain-attacks-for-the-third-time-in-three-months/ - webarchive
- https://resources.cylera.com/hubfs/Cylera%20Labs/Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia - webarchive
- https://thehackernews.com/2022/03/researchers-find-new-evidence-linking.html - webarchive
- https://blog.reversinglabs.com/blog/unpacking-kwampirs-rat - webarchive
- https://resources.cylera.com/new-evidence-linking-kwampirs-malware-to-shamoon-apts - webarchive
- https://www.securityartwork.es/2019/03/13/orangeworm-group-kwampirs-analysis-update/ - webarchive
- https://www.zdnet.com/article/fbi-warns-about-ongoing-attacks-against-software-supply-chain-companies/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ladon
According to its self-description, Ladon is a multi-threaded plug-in comprehensive scanning artifact for large-scale network penetration, including port scanning, service identification, network assets, password blasting, high-risk vulnerability detection and one click getshell. It supports batch a segment / b segment / C segment and cross network segment scanning, as well as URL, host and domain name list scanning.
Internal MISP references
UUID 5c63623b-aa84-41a5-9e3e-f338edf72291 which can be used as unique global reference for Ladon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ladon - webarchive
- https://asec.ahnlab.com/en/47455/ - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://asec.ahnlab.com/en/56236/ - webarchive
- https://github.com/k8gege/Ladon - webarchive
- https://www.paloaltonetworks.com/blog/security-operations/through-the-cortex-xdr-lens-uncovering-a-new-activity-group-targeting-governments-in-the-middle-east-and-africa/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LALALA Stealer
Internal MISP references
UUID 62f1846f-3026-4824-b739-8f9ae5e9c8bb which can be used as unique global reference for LALALA Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lalala_stealer - webarchive
- https://blog.prevailion.com/2020/03/the-curious-case-of-criminal-curriculum.html - webarchive
- https://securitynews.sonicwall.com/xmlpost/lalala-infostealer-which-comes-with-batch-and-powershell-scripting-combo/ - webarchive
- https://twitter.com/luc4m/status/1276477397102145538 - webarchive
- https://www.hornetsecurity.com/en/security-information/information-stealer-campaign-targeting-german-hr-contacts/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lambert (Windows)
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Lambert (Windows).
| Known Synonyms |
|---|
Plexor |
Internal MISP references
UUID 3af9397a-b4f7-467d-93af-b3d77dcfc38d which can be used as unique global reference for Lambert (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lambert - webarchive
- https://securelist.com/blog/research/77990/unraveling-the-lamberts-toolkit/ - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://twitter.com/CPResearch/status/1484502090068242433 - webarchive
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7ca2e331-2209-46a8-9e60-4cb83f9602de&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments - webarchive
- https://www.symantec.com/connect/blogs/longhorn-tools-used-cyberespionage-group-linked-vault-7 - webarchive
- https://ti.qianxin.com/blog/articles/network-weapons-of-cia/ - webarchive
- https://www.youtube.com/watch?v=jeLd-gw2bWo - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LambLoad
According to Microsoft, this is a downloader used in a supply chain attack involving a malicious variant of an application developed by CyberLink. It is centered around a legitimate CyberLink application installer that has been modified to include malicious code that downloads, decrypts, and loads a second-stage payload. The file, which was signed using a valid certificate issued to CyberLink Corp., is hosted on legitimate update infrastructure owned by CyberLink and includes checks to limit the time window for execution and evade detection by security products.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular LambLoad.
| Known Synonyms |
|---|
OfficeCertTea |
Internal MISP references
UUID a67f59fd-92dc-43b0-b9df-220384dbe5a4 which can be used as unique global reference for LambLoad in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lambload - webarchive
- https://www.microsoft.com/en-us/security/blog/2023/11/22/diamond-sleet-supply-chain-compromise-distributes-a-modified-cyberlink-installer/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Lazarus-campaigns-and-backdoors-in-2022-2023.pdf - webarchive
- https://securelist.com/the-lazarus-group-deathnote-campaign/109490/ - webarchive
- https://www.welivesecurity.com/2022/09/30/amazon-themed-campaigns-lazarus-netherlands-belgium/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lamdelin
Internal MISP references
UUID da79cf10-df9f-4cd3-bbce-ae9f357633f0 which can be used as unique global reference for Lamdelin in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LaplasClipper
Clipboard stealer.
Internal MISP references
UUID cc2c0c2a-b233-4d51-9e0a-ae91043c952c which can be used as unique global reference for LaplasClipper in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.laplas - webarchive
- https://blog.cyble.com/2022/11/02/new-laplas-clipper-distributed-by-smokeloader/ - webarchive
- https://twitter.com/Gi7w0rm/status/1604999633792647169 - webarchive
- https://any.run/cybersecurity-blog/analyzing-laplasclipper-malware/ - webarchive
- https://embee-research.ghost.io/laplas-clipper-infrastructure/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LatentBot
FireEye describes this malware as a highly obfuscated bot that has been in the wild since mid-2013. It has managed to leave hardly any traces on the Internet, is capable of watching its victims without ever being noticed, and can even corrupt a hard disk, thus making a PC useless.
Using Dynamic Threat Intelligence, they have observed multiple campaigns targeting multiple industries in the United States, United Kingdom, South Korea, Brazil, United Arab Emirates, Singapore, Canada, Peru and Poland – primarily in the financial services and insurance sectors. Although the infection strategy is not new, the final payload dropped – which they named LATENTBOT – caught attention since it implements several layers of obfuscation, a unique exfiltration mechanism, and has been very successful at infecting multiple organizations.
Internal MISP references
UUID 7fc74551-013f-4dd1-8da9-9266edcc45d0 which can be used as unique global reference for LatentBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.latentbot - webarchive
- https://cys-centrum.com/ru/news/module_trojan_for_unauthorized_access - webarchive
- http://malware-traffic-analysis.net/2017/04/25/index.html - webarchive
- https://blog.malwarebytes.com/threat-analysis/2017/06/latentbot/ - webarchive
- https://www.cert.pl/news/single/latentbot-modularny-i-silnie-zaciemniony-bot/ - webarchive
- https://www.fireeye.com/blog/threat-research/2015/12/latentbot_trace_me.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Laturo Stealer
Internal MISP references
UUID e1958a69-49c3-43a2-ba80-6e5cd5bbcd13 which can be used as unique global reference for Laturo Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LazarDoor
Internal MISP references
UUID 1045b4f1-5a85-4448-a7a9-abc964bdae72 which can be used as unique global reference for LazarDoor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LazarLoader
Internal MISP references
UUID 42bce8d3-8705-44fb-bd88-4af16c6bd28f which can be used as unique global reference for LazarLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
KillDisk (Lazarus)
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular KillDisk (Lazarus).
| Known Synonyms |
|---|
KillDisk.NBO |
Internal MISP references
UUID 6f377d0b-9eaa-474c-8cf8-0718ee2b0efc which can be used as unique global reference for KillDisk (Lazarus) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lazarus_killdisk - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/new-killdisk-variant-hits-financial-organizations-in-latin-america/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/magazine/2018/VB2018-Kalnai-Poslusny.pdf - webarchive
- https://www.welivesecurity.com/2018/04/03/lazarus-killdisk-central-american-casino/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Laziok
Internal MISP references
UUID 686a9217-3978-47c0-9989-dd2a3438ba72 which can be used as unique global reference for Laziok in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.laziok - webarchive
- https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=802 - webarchive
- https://www.symantec.com/connect/blogs/new-reconnaissance-threat-trojanlaziok-targets-energy-sector - webarchive
- https://www.gdatasoftware.com/blog/2015/05/24280-dissecting-the-kraken - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LazyCat
Internal MISP references
UUID 454db469-724a-4084-873c-906abf91d0d5 which can be used as unique global reference for LazyCat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LCPDot
Internal MISP references
UUID 23dd327e-5d1d-4b75-993e-5d79d9fc0a70 which can be used as unique global reference for LCPDot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lcpdot - webarchive
- https://research.nccgroup.com/2022/05/05/north-koreas-lazarus-and-their-initial-access-trade-craft-using-social-media-and-social-engineering/ - webarchive
- https://cn.ahnlab.com/global/upload/download/asecreport/ASEC%20REPORT_vol.102_ENG%20(4).pdf - webarchive
- https://vblocalhost.com/uploads/VB2021-Park.pdf - webarchive
- https://securelist.com/lazarus-trojanized-defi-app/106195/ - webarchive
- https://global.ahnlab.com/global/upload/download/asecreport/ASEC%20REPORT_vol.102_ENG%20(4).pdf - webarchive
- https://blogs.jpcert.or.jp/en/2021/01/Lazarus_malware2.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LDR4
A further branch of the URSNIF collection of malware families. According to Mandiant, it no longer has focus on banking fraud but generic backdoor capabilities instead.
Internal MISP references
UUID c429622f-cbdf-47d6-88e8-091283ed5703 which can be used as unique global reference for LDR4 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Leakthemall
Ransomware.
Internal MISP references
UUID 526add8e-ed78-4e8e-8d4c-152570fe566e which can be used as unique global reference for Leakthemall in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Leash
Internal MISP references
UUID 8faf7592-be5c-44af-b1ca-2bd8caec195d which can be used as unique global reference for Leash in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lemon Duck
Lemon Duck is a monerocrypto-mining malware with capabilitiy to spread rapidly across the entire network. The malware runs its payload mainly in memory. Internal network spreading is performed by SMB RCE Vulnerability (CVE-2017-0144), or brute-force attacks.
Internal MISP references
UUID ff1896f4-8774-4c15-9353-918e3dc2e840 which can be used as unique global reference for Lemon Duck in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lemonduck - webarchive
- https://www.crowdstrike.com/blog/lemonduck-botnet-targets-docker-for-cryptomining-operations/ - webarchive
- https://www.bleepingcomputer.com/news/security/vulnerable-microsoft-sql-servers-targeted-with-cobalt-strike/ - webarchive
- https://news.sophos.com/en-us/2019/10/01/lemon_duck-powershell-malware-cryptojacks-enterprise-networks/ - webarchive
- https://therecord.media/lemonduck-botnet-evolves-to-allow-hands-on-keyboard-intrusions/ - webarchive
- https://www.trendmicro.com/en_us/research/21/e/proxylogon-a-coinminer--a-ransomware--and-a-botnet-join-the-part.html - webarchive
- https://cybotsai.com/lemon-duck-attack/ - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/373/Bitdefender-PR-Whitepaper-LemonDuck-creat4826-en-EN-GenericUse.pdf - webarchive
- https://www.microsoft.com/security/blog/2021/07/29/when-coin-miners-evolve-part-2-hunting-down-lemonduck-and-lemoncat-attacks/ - webarchive
- https://www.microsoft.com/security/blog/2021/07/22/when-coin-miners-evolve-part-1-exposing-lemonduck-and-lemoncat-modern-mining-malware-infrastructure/ - webarchive
- https://notes.netbytesec.com/2021/06/lemon-duck-cryptominer-technical.html - webarchive
- https://success.trendmicro.com/solution/000261916 - webarchive
- https://asec.ahnlab.com/en/31811/ - webarchive
- https://news.sophos.com/en-us/2021/05/07/new-lemon-duck-variants-exploiting-microsoft-exchange-server/?cmp=30728 - webarchive
- https://blog.talosintelligence.com/2021/05/lemon-duck-spreads-wings.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Leouncia
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Leouncia.
| Known Synonyms |
|---|
shoco |
Internal MISP references
UUID 41da41aa-0729-428a-8b82-636600f8e230 which can be used as unique global reference for Leouncia in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lethic
Lethic is a spambot dating back to 2008. It is known to be distributing low-level pharmaceutical spam.
Internal MISP references
UUID 342f5c56-861c-4a06-b5db-85c3c424f51f which can be used as unique global reference for Lethic in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lethic - webarchive
- http://resources.infosecinstitute.com/win32lethic-botnet-analysis/ - webarchive
- http://www.vkremez.com/2017/11/lets-learn-lethic-spambot-survey-of.html - webarchive
- http://www.malware-traffic-analysis.net/2017/11/02/index.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LetMeOut
Internal MISP references
UUID 007697bc-463e-4f90-93e3-8f8fdeff147a which can be used as unique global reference for LetMeOut in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LgoogLoader
LgoogLoader is an installer that drops three files: a batch file, an AutoIt interpreter, and an AutoIt script. After downloading, it executes the batch file.
Internal MISP references
UUID edf1bb94-cc6b-46fd-a922-18fd2a0f323f which can be used as unique global reference for LgoogLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lgoogloader - webarchive
- https://inside.harfanglab.io/blog/articles/cyber-threat-intelligence/loader-galore-taskloader-at-the-start-of-a-pay-per-install-infection-chain/ - webarchive
- https://blog.polyswarm.io/nullmixer-drops-multiple-malware-families - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Liderc
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Liderc.
| Known Synonyms |
|---|
LEMPO |
Internal MISP references
UUID ed825d46-be1e-4d36-b828-1b85274773dd which can be used as unique global reference for Liderc in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.liderc - webarchive
- https://blog.talosintelligence.com/2019/09/tortoiseshell-fake-veterans.html - webarchive
- https://about.fb.com/news/2021/07/taking-action-against-hackers-in-iran/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/i-knew-you-were-trouble-ta456-targets-defense-contractor-alluring-social-media - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0330.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LIGHTBUNNY
Internal MISP references
UUID ea790924-8a81-4141-9e5c-14a205af170f which can be used as unique global reference for LIGHTBUNNY in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LightlessCan
LightlessCan is a complex HTTP(S) RAT, that is a successor of the Lazarus RAT named BlindingCan.
In Q2 2022 and Q1 2023, it was deployed in targeted attacks against an aerospace company in Spain and a technology company in India.
Besides the support for commands already present in BlindingCan, its most significant update is mimicked functionality of many native Windows commands: • ipconfig • net • netsh advfirewall firewall • netstat • reg • sc • ping (for both IPv4 and IPv6 protocols) • wmic process call create • nslookup • schstasks • systeminfo • arp
These native commands are often abused by the attackers after they have gotten a foothold in the target’s system. Lightless is able to execute them discreetly within the RAT itself, rather than being executed visibly in the system console. This provides stealthiness, both in evading real-time monitoring solutions like EDRs, and postmortem digital forensic tools.
LightlessCan use RC6 for decryption of its configuration, and also for encryption and decryption of network traffic.
Internal MISP references
UUID 4a00dbe4-91b7-4cfc-a6a2-528ccc9a4303 which can be used as unique global reference for LightlessCan in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lightlesscan - webarchive
- https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Lazarus-campaigns-and-backdoors-in-2022-2023.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LightNeuron
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular LightNeuron.
| Known Synonyms |
|---|
NETTRANS |
XTRANS |
Internal MISP references
UUID 96b0b8fa-79b6-4519-a794-f6f325f96fd7 which can be used as unique global reference for LightNeuron in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lightneuron - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.welivesecurity.com/2020/03/12/tracking-turla-new-backdoor-armenian-watering-holes/ - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-hunter - webarchive
- https://www.welivesecurity.com/2019/05/07/turla-lightneuron-email-too-far/ - webarchive
- https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments - webarchive
- https://securelist.com/apt-trends-report-q2-2018/86487/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lightning Stealer
Lightning stealer can target 30+ Firefox and Chromium-based browsers and steal crypto wallets, Telegram data, Discord tokens, and Steam user’s data. Unlike other info stealers, Lightning Stealer stores all the stolen data in the JSON format for exfiltration.
Internal MISP references
UUID 48a21f7a-3dc9-4524-9628-10ed0f762bb4 which can be used as unique global reference for Lightning Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LIGHTWORK
According to Mandiant, LIGHTWORK is a disruption tool written in C++ that implements the IEC-104 protocol to modify the state of RTUs over TCP. It crafts configurable IEC-104 ASDU messages, to change the state of RTU IOAs to ON or OFF. This sample works in tandem with PIEHOP, which sets up the execution.
Internal MISP references
UUID 01cbe4cc-43ba-4bc8-9fee-9daf63dda335 which can be used as unique global reference for LIGHTWORK in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ligsterac
Internal MISP references
UUID 7d328c7b-7dc8-4891-bbd1-a05dedc8bac4 which can be used as unique global reference for Ligsterac in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lilith
Internal MISP references
UUID c443dc36-f439-46d8-8ce7-07d3532a412b which can be used as unique global reference for Lilith in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lilith - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/operation-endtrade-finding-multi-stage-backdoors-that-tick/ - webarchive
- https://github.com/werkamsus/Lilith - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/591/original/062521_SideCopy_%281%29.pdf - webarchive
- https://yoroi.company/research/a-deep-dive-into-eternity-group-a-new-emerging-cyber-threat/ - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/591/original/062521_SideCopy_%281%29.pdf?1625657388 - webarchive
- https://www.zscaler.com/blogs/security-research/analysis-lilithbot-malware-and-eternity-threat-group - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/594/original/Network_IOCs_list_for_coverage.txt?1625657479 - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/592/original/Hashes_IOCs_for_coverage.txt - webarchive
- https://www.trendmicro.com/en_us/research/21/l/collecting-in-the-dark-tropic-trooper-targets-transportation-and-government-organizations.html - webarchive
- https://blog.cyble.com/2022/07/12/new-ransomware-groups-on-the-rise/ - webarchive
- https://asec.ahnlab.com/ko/58215/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clasiopa-materials-research - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
limedownloader
Internal MISP references
UUID a70436b1-559d-48af-836f-f46074cd8ef3 which can be used as unique global reference for limedownloader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
limeminer
Internal MISP references
UUID 3819bc21-8c15-48ee-8e68-ee2a0c5f82a7 which can be used as unique global reference for limeminer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LimePad
Internal MISP references
UUID 0cae4bcd-9656-434d-81c1-c55801b3eaa3 which can be used as unique global reference for LimePad in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LimeRAT
## Description Simple yet powerful RAT for Windows machines. This project is simple and easy to understand, It should give you a general knowledge about dotNET malwares and how it behaves.
Main Features
- .NET
- Coded in Visual Basic .NET, Client required framework 2.0 or 4.0 dependency, And server is 4.0
- Connection
- Using pastebin.com as ip:port , Instead of noip.com DNS. And Also using multi-ports
- Plugin
- Using plugin system to decrease stub's size and lower the AV detection
- Encryption
- The communication between server & client is encrypted with AES
- Spreading
- Infecting all files and folders on USB drivers
- Bypass
- Low AV detection and undetected startup method
- Lightweight
- Payload size is about 25 KB
- Anti Virtual Machines
- Uninstall itself if the machine is virtual to avoid scanning or analyzing
- Ransomware
- Encrypting files on all HHD and USB with .Lime extension
- XMR Miner
- High performance Monero CPU miner with user idle\active optimizations
- DDoS
- Creating a powerful DDOS attack to make an online service unavailable
- Crypto Stealer
- Stealing Cryptocurrency sensitive data
- Screen-Locker
- Prevents user from accessing their Windows GUI
- And more
- On Connect Auto Task
- Force enable Windows RDP
- Persistence
- File manager
- Passowrds stealer
- Remote desktop
- Bitcoin grabber
- Downloader
- Keylogger
Internal MISP references
UUID 771dbe6a-3f01-4bd4-8edd-070b2eb9df66 which can be used as unique global reference for LimeRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.limerat - webarchive
- https://blog.morphisec.com/tracking-hcrypt-an-active-crypter-as-a-service - webarchive
- https://blog.reversinglabs.com/blog/rats-in-the-library - webarchive
- https://blog.yoroi.company/research/limerat-spreads-in-the-wild/ - webarchive
- https://www.youtube.com/watch?v=x-g-ZLeX8GM - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://lab52.io/blog/literature-lover-targeting-colombia-with-limerat/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-american-entities-with-commodity-rats/BlindEagleIOCList.txt - webarchive
- https://www.trendmicro.com/en_us/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-ameri.html - webarchive
- https://blogs.juniper.net/en-us/threat-research/new-pastebin-like-service-used-in-multiple-malware-campaigns - webarchive
- https://felipetarijon.github.io/2022-12-12-limerat-infecting-unskilled-threat-actors/ - webarchive
- https://lab52.io/blog/apt-c-36-recent-activity-analysis/ - webarchive
- https://threatmon.io/apt-blind-eagles-malware-arsenal-technical-analysis/ - webarchive
- https://blog.talosintelligence.com/2022/04/asyncrat-3losh-update.html - webarchive
- https://any.run/cybersecurity-blog/limerat-malware-analysis/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/targeted-attack-on-government-agencies.html - webarchive
- https://www.trendmicro.com/en_us/research/21/i/Water-Basilisk-Uses-New-HCrypt-Variant-to-Flood-Victims-with-RAT-Payloads.html - webarchive
- https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf - webarchive
- https://github.com/NYAN-x-CAT/Lime-RAT/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Limitail
Internal MISP references
UUID dcd1f76d-5a40-4c58-b01e-a749871fe50b which can be used as unique global reference for Limitail in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LinseningSvr
Internal MISP references
UUID 9a66df8d-ce65-49d6-a648-c1a5ea58cbc2 which can be used as unique global reference for LinseningSvr in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LIONTAIL
Internal MISP references
UUID bad7ba1a-f945-436a-82ce-f125c82e2164 which can be used as unique global reference for LIONTAIL in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Listrix
Internal MISP references
UUID 54c8a055-a4be-4ec0-9943-ecad929e0dac which can be used as unique global reference for Listrix in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.listrix - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks - webarchive
- https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LiteDuke
According to CarbonBlack, LiteDuke is a third stage backdoor. It appears to use the same dropper as PolyglotDuke. Its payload makes use of an AES encrypted SQLite database to store its configuration. LiteDuke supports a large number of individual commands including host information retrieval, file upload and download, and the ability to execute other code. LiteDuke C2 servers appear to be compromised servers, and the malware communicates with them using normal HTTP requests. It attempts to use a realistic User-Agent string to blend in better with normal HTTP traffic. ESET have dubbed it LiteDuke because it uses SQLite to store information such as its configuration.
Internal MISP references
UUID ae7352bd-86e9-455d-bdc3-0567886a8392 which can be used as unique global reference for LiteDuke in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LiteHTTP
According to AlienVault, LiteHTTP bot is a new HTTP bot programmed in C#. The bot has the ability to collect system information, download and execute programs, and update and kill other bots present on the system.
The source is on GitHub: https://github.com/zettabithf/LiteHTTP
Internal MISP references
UUID 2f9e1221-0a59-447b-a9e8-bedb010cd3d8 which can be used as unique global reference for LiteHTTP in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LOBSHOT
According to PCrisk, LOBSHOT is a type of malware with a feature called hVNC (Hidden Virtual Network Computing) that allows attackers to access a victim's computer without being noticed. The hVNC component is effective in evading fraud detection systems. Also, LOBSHOT is being used to carry out financial crimes through the use of banking trojan and information-stealing functionalities.
Internal MISP references
UUID c30db30e-e29a-4f62-bda0-c284fa7c6f6d which can be used as unique global reference for LOBSHOT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LockBit (Windows)
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular LockBit (Windows).
| Known Synonyms |
|---|
ABCD Ransomware |
Internal MISP references
UUID fd035735-1ab9-419d-a94c-d560612e970b which can be used as unique global reference for LockBit (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lockbit - webarchive
- https://www.bleepingcomputer.com/news/security/lockbit-ransomware-recruiting-insiders-to-breach-corporate-networks/ - webarchive
- https://www.prodaft.com/m/reports/LockBit_Case_Report___TLPWHITE.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockbit-targets-servers - webarchive
- https://intel471.com/blog/conti-ransomware-cooperation-maze-lockbit-ragnar-locker - webarchive
- https://therecord.media/australian-cybersecurity-agency-warns-of-spike-in-lockbit-ransomware-attacks/ - webarchive
- https://blog.cyble.com/2021/08/16/a-deep-dive-analysis-of-lockbit-2-0/ - webarchive
- https://therecord.media/missed-opportunity-bug-in-lockbit-ransomware-allowed-free-decryptions/ - webarchive
- https://twitter.com/MsftSecIntel/status/1522690116979855360 - webarchive
- https://medium.com/s2wlab/w4-july-en-story-of-the-week-ransomware-on-the-darkweb-c61965d0386a - webarchive
- https://cybergeeks.tech/a-technical-analysis-of-the-leaked-lockbit-3-0-builder/ - webarchive
- https://blog.cyble.com/2022/07/05/lockbit-3-0-ransomware-group-launches-new-version/ - webarchive
- https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.trendmicro.com/en_us/research/22/g/lockbit-ransomware-group-augments-its-latest-variant--lockbit-3-.html - webarchive
- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html - webarchive
- https://www.youtube.com/watch?v=C733AyPzkoc - webarchive
- https://medium.com/@lcam/lighting-the-exfiltration-infrastructure-of-a-lockbit-affiliate-and-more-f57fbb7a4e79 - webarchive
- https://securelist.com/new-ransomware-trends-in-2022/106457/ - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html - webarchive
- https://www.cybereason.com/blog/rising-threat-from-lockbit-ransomware - webarchive
- https://www.glimps.fr/lockbit3-0/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel - webarchive
- https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions - webarchive
- https://blog.lexfo.fr/lockbit-malware.html - webarchive
- https://www.trendmicro.com/en_us/research/21/h/lockbit-resurfaces-with-version-2-0-ransomware-detections-in-chi.html - webarchive
- https://www.bleepingcomputer.com/news/security/lockbit-victim-estimates-cost-of-ransomware-attack-to-be-42-million/ - webarchive
- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ - webarchive
- https://chuongdong.com/reverse%20engineering/2022/03/19/LockbitRansomware/ - webarchive
- https://www.bleepingcomputer.com/news/security/march-2023-broke-ransomware-attack-records-with-459-incidents/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-by-the-numbers/lockbit-conti-and-blackcat-lead-pack-amid-rise-in-active-raas-and-extortion-groups-ransomware-in-q1-2022 - webarchive
- https://unit42.paloaltonetworks.com/emerging-ransomware-groups/ - webarchive
- https://lifars.com/wp-content/uploads/2022/02/LockBitRansomware_Whitepaper.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-april-1st-2022-i-can-fight-with-a-keyboard/ - webarchive
- https://www.ic3.gov/Media/News/2022/220204.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/uk-rail-network-merseyrail-likely-hit-by-lockbit-ransomware/ - webarchive
- https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack - webarchive
- https://www.mbsd.jp/2021/10/27/assets/images/MBSD_WhitePaper_A-deep-dive-analysis-of-LockBit2.0_Ransomware.pdf - webarchive
- https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities - webarchive
- https://github.com/albertzsigovits/malware-notes/blob/master/Ransomware/Lockbit.md - webarchive
- https://www.advanced-intel.com/post/from-russia-with-lockbit-ransomware-inside-look-preventive-solutions - webarchive
- https://documents.trendmicro.com/assets/pdf/datasheet-ransomware-in-Q1-2022.pdf - webarchive
- https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-lockbit - webarchive
- https://www.zdnet.com/article/ransomware-hits-helicopter-maker-kopter/ - webarchive
- https://medium.com/@amgedwageh/lockbit-ransomware-analysis-notes-93a542fc8511 - webarchive
- https://www.lemagit.fr/actualites/252516821/Ransomware-LockBit-30-commence-a-etre-utilise-dans-des-cyberattaques - webarchive
- https://github.com/prodaft/malware-ioc/tree/master/PTI-257 - webarchive
- https://www.cisa.gov/sites/default/files/2023-06/aa23-165a_understanding_TA_LockBit_0.pdf - webarchive
- https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf - webarchive
- https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/481/original/010421_LockBit_Interview.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/d/thwarting-loaders-from-socgholish-to-blisters-lockbit-payload/iocs-thwarting-loaders-socgholish-blister.txt - webarchive
- https://therecord.media/an-interview-with-blackmatter-a-new-ransomware-group-thats-learning-from-the-mistakes-of-darkside-and-revil/ - webarchive
- https://ke-la.com/lockbit-2-0-interview-with-russian-osint/ - webarchive
- https://asec.ahnlab.com/en/41450/ - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/ - webarchive
- https://securityscorecard.com/research/the-increase-in-ransomware-attacks-on-local-governments - webarchive
- https://techcommunity.microsoft.com/t5/security-compliance-and-identity/part-2-lockbit-2-0-ransomware-bugs-and-database-recovery/ba-p/3254421 - webarchive
- https://www.bleepingcomputer.com/news/security/energy-group-erg-reports-minor-disruptions-after-ransomware-attack/ - webarchive
- https://www.connectwise.com/resources/lockbit-profile - webarchive
- https://socradar.io/lockbit-3-another-upgrade-to-worlds-most-active-ransomware/ - webarchive
- https://resources.prodaft.com/wazawaka-report - webarchive
- https://security.packt.com/understanding-lockbit/ - webarchive
- https://www.logpoint.com/en/blog/hunting-lockbit-variations-using-logpoint/ - webarchive
- https://news.sophos.com/en-us/2022/04/12/attackers-linger-on-government-agency-computers-before-deploying-lockbit-ransomware/ - webarchive
- https://asec.ahnlab.com/ko/39682/ - webarchive
- https://ke-la.com/zooming-into-darknet-threats-targeting-jp-orgs-kela/ - webarchive
- https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html - webarchive
- https://www.recordedfuture.com/blackmatter-ransomware-successor-darkside-revil/ - webarchive
- https://seguranca-informatica.pt/malware-analysis-details-on-lockbit-ransomware/ - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom - webarchive
- https://amgedwageh.medium.com/lockbit-ransomware-analysis-notes-93a542fc8511 - webarchive
- https://www.trendmicro.com/en_no/research/22/d/Thwarting-Loaders-From-SocGholish-to-BLISTERs-LockBit-Payload.html - webarchive
- https://analyst1.com/ransomware-diaries-volume-1/ - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/ - webarchive
- https://www.seqrite.com/blog/indian-power-sector-targeted-with-latest-lockbit-3-0-variant/ - webarchive
- https://www.trendmicro.com/en_us/research/22/d/Thwarting-Loaders-From-SocGholish-to-BLISTERs-LockBit-Payload.html - webarchive
- https://www.glimps.fr/dcouverte-dune-nouvelle-version-du-ramsomware-lockbit/ - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://blog.minerva-labs.com/lockbit-3.0-aka-lockbit-black-is-here-with-a-new-icon-new-ransom-note-new-wallpaper-but-less-evasiveness - webarchive
- https://securelist.com/modern-ransomware-groups-ttps/106824/ - webarchive
- https://cluster25.io/2022/07/06/lockbit-3-0-making-the-ransomware-great-again/ - webarchive
- https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-gets-aggressive-with-triple-extortion-tactic/ - webarchive
- https://id-ransomware.blogspot.com/search?q=lockbit - webarchive
- https://github.com/EmissarySpider/ransomware-descendants - webarchive
- https://krebsonsecurity.com/2023/05/russian-hacker-wazawaka-indicted-for-ransomware/ - webarchive
- https://securityaffairs.com/141666/cyber-crime/lockbit-green-ransomware-variant.html - webarchive
- https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-moves-victims-to-lockbit-after-shutdown/ - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool - webarchive
- https://therecord.media/conti-ransomware-gang-chats-leaked-by-pro-ukraine-member/ - webarchive
- https://www.fortinet.com/blog/threat-research/ransomware-roundup-new-variants - webarchive
- https://www.netskope.com/blog/netskope-threat-coverage-lockbit - webarchive
- https://medium.com/s2wblog/quick-overview-of-leaked-lockbit-3-0-black-builder-program-880ae511d085 - webarchive
- https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf - webarchive
- https://news.sophos.com/en-us/2020/10/21/lockbit-attackers-uses-automated-attack-tools-to-identify-tasty-targets - webarchive
- https://securelist.com/crimeware-report-lockbit-switchsymb/110068/ - webarchive
- https://yoroi.company/research/hunting-the-lockbit-gangs-exfiltration-infrastructures/ - webarchive
- https://www.coveware.com/blog/2022/1/26/ransomware-as-a-service-innovation-curve - webarchive
- https://www.crowdstrike.com/blog/how-crowdstrike-prevents-volume-shadow-tampering-by-lockbit-ransomware/ - webarchive
- https://research.loginsoft.com/threat-research/taming-the-storm-understanding-and-mitigating-the-consequences-of-cve-2023-27350/ - webarchive
- https://skyblue.team/posts/hive-recovery-from-lockbit-2.0/ - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1 - webarchive
- https://redcanary.com/blog/intelligence-insights-november-2021/ - webarchive
- https://umbrella.cisco.com/blog/cybersecurity-threat-spotlight-blackmatter-lockbit-thor - webarchive
- https://www.bleepingcomputer.com/news/security/popular-russian-hacking-forum-xss-bans-all-ransomware-topics/ - webarchive
- https://securityintelligence.com/posts/lockbit-ransomware-attacks-surge-affiliate-recruitment/ - webarchive
- https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound - webarchive
- https://www.dragos.com/blog/industry-news/dragos-ics-ot-ransomware-analysis-q4-2021/ - webarchive
- https://www.dr.dk/nyheder/viden/teknologi/frygtede-skulle-lukke-alle-vindmoeller-nu-aabner-vestas-op-om-hacking-angreb - webarchive
- https://www.fortinet.com/blog/threat-research/emerging-lockbit-campaign - webarchive
- https://www.bleepingcomputer.com/news/security/lockbit-ransomware-now-encrypts-windows-domains-using-group-policies/ - webarchive
- https://www.intrinsec.com/alphv-ransomware-gang-analysis - webarchive
- https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques/ - webarchive
- https://www.seqrite.com/blog/uncovering-lockbit-blacks-attack-chain-and-anti-forensic-activity/ - webarchive
- https://medium.com/s2wlab/w4-jan-en-story-of-the-week-ransomware-on-the-darkweb-7595544363b1 - webarchive
- https://www.bleepingcomputer.com/news/security/ransomware-attack-hits-italys-lazio-region-affects-covid-19-site/ - webarchive
- https://blog.talosintelligence.com/2020/09/CTIR-quarterly-trends-Q4-2020.html - webarchive
- https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/ - webarchive
- https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/ - webarchive
- https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ - webarchive
- https://news.sophos.com/en-us/2022/11/30/lockbit-3-0-black-attacks-and-leaks-reveal-wormable-capabilities-and-tooling/ - webarchive
- https://www.crowdstrike.com/blog/better-together-global-attitude-survey-takeaways-2021/ - webarchive
- https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/ - webarchive
- https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-claims-attack-on-bridgestone-americas/ - webarchive
- https://unit42.paloaltonetworks.com/lockbit-2-ransomware/ - webarchive
- https://www.crypsisgroup.com/insights/ransomwares-new-trend-exfiltration-and-extortion - webarchive
- https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf - webarchive
- https://asec.ahnlab.com/en/35822/ - webarchive
- https://intel471.com/blog/privateloader-malware - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://techcommunity.microsoft.com/t5/security-compliance-and-identity/part-1-lockbit-2-0-ransomware-bugs-and-database-recovery/ba-p/3254354 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LockerGoga
According to Trend Micro, LockerGoga is a ransomware that has been used in multiple attacks, most notably against Altran Technologies and Norsk Hydro. It encrypts a range of documents and source code files but certain versions had little to no whitelist that would protect import system files such as the Windows Boot Manager.
Internal MISP references
UUID a4a6469d-6753-4195-9635-f11d458525f9 which can be used as unique global reference for LockerGoga in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lockergoga - webarchive
- https://www.fireeye.com/blog/threat-research/2020/07/financially-motivated-actors-are-expanding-access-into-ot.html - webarchive
- https://blog.talosintelligence.com/lockergoga/ - webarchive
- https://dragos.com/wp-content/uploads/Spyware-Stealer-Locker-Wiper-LockerGoga-Revisited.pdf - webarchive
- https://www.abuse.io/lockergoga.txt - webarchive
- https://www.npu.gov.ua/news/kiberzlochini/kiberpolicziya-vikrila-transnaczionalne-zlochinne-ugrupovannya-u-nanesenni-inozemnim-kompaniyam-120-miljoniv-dolariv-zbitkiv/ - webarchive
- https://www.europol.europa.eu/newsroom/news/12-targeted-for-involvement-in-ransomware-attacks-against-critical-infrastructure - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://content.fireeye.com/m-trends/rpt-m-trends-2020 - webarchive
- https://www.nrk.no/norge/skreddersydd-dobbeltangrep-mot-hydro-1.14480202 - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf - webarchive
- https://www.govcert.admin.ch/blog/36/severe-ransomware-attacks-against-swiss-smes - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/csi-evidence-indicators-for-targeted-ransomware-attacks-part-ii/ - webarchive
- https://www.helpnetsecurity.com/2019/04/02/aurora-decrypter-mira-decrypter/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.mandiant.com/resources/financially-motivated-actors-are-expanding-access-into-ot - webarchive
- https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880 - webarchive
- https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html - webarchive
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/ - webarchive
- https://www.bleepingcomputer.com/news/security/fbi-issues-alert-for-lockergoga-and-megacortex-ransomware/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-lockergoga-ransomware-allegedly-used-in-altran-attack/ - webarchive
- https://www.youtube.com/watch?v=o6eEN0mUakM - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LockFile
A ransomware first observed in July 2021.
Internal MISP references
UUID 97879260-ee50-4c7e-8d87-4bb134d1fdaf which can be used as unique global reference for LockFile in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lockfile - webarchive
- https://decoded.avast.io/threatintel/decryptor-for-atomsilo-and-lockfile-ransomware/ - webarchive
- https://www.csoonline.com/article/3631517/lockfile-ransomware-uses-intermittent-encryption-to-evade-detection.html - webarchive
- https://news.sophos.com/en-us/2021/08/27/lockfile-ransomwares-box-of-tricks-intermittent-encryption-and-evasion/ - webarchive
- https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader - webarchive
- https://news.sophos.com/en-us/2021/08/23/proxyshell-vulnerabilities-in-microsoft-exchange-what-to-do/ - webarchive
- https://thehackernews.com/2021/08/lockfile-ransomware-bypasses-protection.html - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows - webarchive
- https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://nsfocusglobal.com/insights-into-ransomware-spread-using-exchange-1-day-vulnerabilities-1-2/ - webarchive
- https://twitter.com/VirITeXplorer/status/1428750497872232459 - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://blog.cyble.com/2021/08/25/lockfile-ransomware-using-proxyshell-attack-to-deploy-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Locky
Locky is a high profile ransomware family that first appeared in early 2016 and was observed being active until end of 2017. It encrypts files on the victim system and asks for ransom in order to have back original files. In its first version it added a .locky extension to the encrypted files, and in recent versions it added the .lukitus extension. The ransom amount is defined in BTC and depends on the actor.
Internal MISP references
UUID 24c9bb9f-1f9a-4e01-95d8-86c51733e11c which can be used as unique global reference for Locky in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.locky - webarchive
- http://blog.talosintelligence.com/2017/06/necurs-locky-campaign.html - webarchive
- https://thisissecurity.stormshield.com/2018/03/20/de-obfuscating-jump-chains-with-binary-ninja/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-as-a-service-enabler-of-widespread-attacks - webarchive
- https://threatpost.com/ransomware-gang-arrested-locky-hospitals/155842/ - webarchive
- https://dissectingmalwa.re/picking-locky.html - webarchive
- https://vixra.org/pdf/2002.0183v1.pdf - webarchive
- http://securityaffairs.co/wordpress/49094/malware/zepto-ransomware.html - webarchive
- https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process - webarchive
- http://web.archive.org/web/20181007211751/https://myonlinesecurity.co.uk/return-of-fake-ups-cannot-deliver-malspam-with-an-updated-nemucod-ransomware-and-kovter-payload/ - webarchive
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/ - webarchive
- https://blog.botfrei.de/2017/08/weltweite-spamwelle-verbreitet-teufliche-variante-des-locky/ - webarchive
- https://www.bleepingcomputer.com/news/security/locky-ransomware-switches-to-the-lukitus-extension-for-encrypted-files/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/ - webarchive
- https://www.bleepingcomputer.com/news/security/locky-ransomware-returns-but-targets-only-windows-xp-and-vista/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://storage.googleapis.com/pub-tools-public-publication-data/pdf/ce44cbda9fdc061050c1d2a5dec0270874a9dc85.pdf - webarchive
- https://www.cylance.com/en_us/blog/threat-spotlight-locky-ransomware.html - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/03/look-into-locky/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://blog.malwarebytes.com/threat-analysis/2017/01/locky-bart-ransomware-and-backend-server-analysis/ - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Locky (Decryptor)
Internal MISP references
UUID cd55cfa8-1e20-417b-9997-754b600f9f49 which can be used as unique global reference for Locky (Decryptor) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Locky Loader
For the lack of a better name, this is a VBS-based loader that was used in beginning of 2018 to deliver win.locky.
Internal MISP references
UUID 62c17ebb-4ea5-43bd-96fc-d9ac8d464aa2 which can be used as unique global reference for Locky Loader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LockPOS
Internal MISP references
UUID d2c111bf-ba0d-498a-8ca8-4cc508855872 which can be used as unique global reference for LockPOS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lock_pos - webarchive
- https://www.cylance.com/en_us/blog/threat-spotlight-lockpos-point-of-sale-malware.html - webarchive
- https://www.cyberbit.com/new-lockpos-malware-injection-technique/ - webarchive
- https://www.arbornetworks.com/blog/asert/lockpos-joins-flock/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Loda
Loda is a previously undocumented AutoIT malware with a variety of capabilities for spying on victims. Proofpoint first observed Loda in September of 2016 and it has since grown in popularity. The name Loda is derived from a directory to which the malware author chose to write keylogger logs. It should be noted that some antivirus products currently detect Loda as “Trojan.Nymeria”, although the connection is not well-documented.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Loda.
| Known Synonyms |
|---|
LodaRAT |
Nymeria |
Internal MISP references
UUID 8098d303-cb5f-4eff-b62e-96bb5ef4329f which can be used as unique global reference for Loda in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.loda - webarchive
- https://blog.talosintelligence.com/attributing-yorotrooper/ - webarchive
- https://blog.talosintelligence.com/2021/02/kasablanka-lodarat.html - webarchive
- https://zerophagemalware.com/2018/01/23/maldoc-rtf-drop-loda-logger/ - webarchive
- https://ti.qianxin.com/blog/articles/Kasablanka-Group-Probably-Conducted-Compaigns-Targeting-Russia/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/introducing-loda-malware - webarchive
- https://blog.talosintelligence.com/yorotrooper-espionage-campaign-cis-turkey-europe/ - webarchive
- https://blog.talosintelligence.com/2020/02/loda-rat-grows-up.html - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/reservations-requested-ta558-targets-hospitality-and-travel - webarchive
- https://blog.talosintelligence.com/2020/09/lodarat-update-alive-and-well.html - webarchive
- https://blog.talosintelligence.com/get-a-loda-this/ - webarchive
- https://mp.weixin.qq.com/s/mstwBMkS0G3Et4GOji2mwA - webarchive
- https://www.silentpush.com/blog/more-lodarat-infrastructure-targeting-bangladesh-uncovered - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LODEINFO
Internal MISP references
UUID 9429e1b3-31fb-4e52-ad78-e3d377f10fcb which can be used as unique global reference for LODEINFO in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lodeinfo - webarchive
- https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/ - webarchive
- https://blogs.jpcert.or.jp/ja/2020/02/LODEINFO.html - webarchive
- https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/ - webarchive
- https://www.macnica.net/pdf/mpressioncss_ta_report_2019_4_en.pdf - webarchive
- https://www.macnica.net/file/mpressioncss_ta_report_2019_4.pdf - webarchive
- https://blogs.jpcert.or.jp/en/2020/02/malware-lodeinfo-targeting-japan.html - webarchive
- https://twitter.com/jpcert_ac/status/1351355443730255872 - webarchive
- https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/ - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
- https://blogs.jpcert.or.jp/en/2021/02/LODEINFO-3.html - webarchive
- https://blogs.jpcert.or.jp/ja/2020/06/LODEINFO-2.html - webarchive
- https://www.cyberandramen.net/2020/06/analysis-of-lodeinfo-maldoc.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Logedrut
Internal MISP references
UUID 70cd1eb4-0410-47c6-8817-418380240d85 which can be used as unique global reference for Logedrut in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LogPOS
Internal MISP references
UUID 2789b246-d762-4d38-8cc8-302293e314da which can be used as unique global reference for LogPOS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.logpos - webarchive
- https://securitykitten.github.io/2015/11/16/logpos-new-point-of-sale-malware-using-mailslots.html - webarchive
- https://github.com/malware-kitten/securitykitten.github.io/blob/master/_posts/2015-11-16-logpos-new-point-of-sale-malware-using-mailslots.md - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Logtu
Internal MISP references
UUID eda979a7-89eb-4dcb-858d-8232e2c47d1e which can be used as unique global reference for Logtu in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.logtu - webarchive
- https://news.drweb.ru/show/?i=14177 - webarchive
- https://www.socinvestigation.com/chinese-new-backdoor-deployed-for-cyberespionage/ - webarchive
- https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-Targeted-attack-on-industrial-enterprises-and-public-institutions-En.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LoJax
Internal MISP references
UUID 15228ae0-26f9-44d8-8d6e-87b0bd2d2aba which can be used as unique global reference for LoJax in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lojax - webarchive
- https://habr.com/ru/amp/post/668154/ - webarchive
- https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/ - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf - webarchive
- https://www.youtube.com/watch?v=VeoXT0nEcFU - webarchive
- https://symantec-blogs.broadcom.com/blogs/election-security/apt28-espionage-military-government - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LokiLocker
LokiLocker is a .Net ransomware, which was seen first in August 2021. This malware is protected with NETGuard (modified ConfuserEX) using the additional KoiVM virtualization plugin. The victims were observed ti be scattered around the world, with main concentation in Estern Europe and Asia (BlackBerry).
Internal MISP references
UUID 3642aa5a-61b3-4de9-b124-8ecb8b53351d which can be used as unique global reference for LokiLocker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lokilocker - webarchive
- https://asec.ahnlab.com/en/52570/ - webarchive
- https://blogs.blackberry.com/en/2022/03/lokilocker-ransomware - webarchive
- https://www.theregister.com/2022/03/16/blackberry_lokilocker_ransomware/ - webarchive
- https://www.msspalert.com/cybersecurity-research/lokilocker-ransomware-may-use-false-flag-to-avoid-identification/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Loki Password Stealer (PWS)
"Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets." - PhishMe
Loki-Bot employs function hashing to obfuscate the libraries utilized. While not all functions are hashed, a vast majority of them are.
Loki-Bot accepts a single argument/switch of ‘-u’ that simply delays execution (sleeps) for 10 seconds. This is used when Loki-Bot is upgrading itself.
The Mutex generated is the result of MD5 hashing the Machine GUID and trimming to 24-characters. For example: “B7E1C2CC98066B250DDB2123“.
Loki-Bot creates a hidden folder within the %APPDATA% directory whose name is supplied by the 8th thru 13th characters of the Mutex. For example: “%APPDATA%\ C98066\”.
There can be four files within the hidden %APPDATA% directory at any given time: “.exe,” “.lck,” “.hdb” and “.kdb.” They will be named after characters 13 thru 18 of the Mutex. For example: “6B250D.” Below is the explanation of their purpose:
FILE EXTENSION FILE DESCRIPTION .exe A copy of the malware that will execute every time the user account is logged into .lck A lock file created when either decrypting Windows Credentials or Keylogging to prevent resource conflicts .hdb A database of hashes for data that has already been exfiltrated to the C2 server .kdb A database of keylogger data that has yet to be sent to the C2 server
If the user is privileged, Loki-Bot sets up persistence within the registry under HKEY_LOCAL_MACHINE. If not, it sets up persistence under HKEY_CURRENT_USER.
The first packet transmitted by Loki-Bot contains application data.
The second packet transmitted by Loki-Bot contains decrypted Windows credentials.
The third packet transmitted by Loki-Bot is the malware requesting C2 commands from the C2 server. By default, Loki-Bot will send this request out every 10 minutes after the initial packet it sent.
Communications to the C2 server from the compromised host contain information about the user and system including the username, hostname, domain, screen resolution, privilege level, system architecture, and Operating System.
The first WORD of the HTTP Payload represents the Loki-Bot version.
The second WORD of the HTTP Payload is the Payload Type. Below is the table of identified payload types:
BYTE PAYLOAD TYPE 0x26 Stolen Cryptocurrency Wallet 0x27 Stolen Application Data 0x28 Get C2 Commands from C2 Server 0x29 Stolen File 0x2A POS (Point of Sale?) 0x2B Keylogger Data 0x2C Screenshot
The 11th byte of the HTTP Payload begins the Binary ID. This might be useful in tracking campaigns or specific threat actors. This value value is typically “ckav.ru”. If you come across a Binary ID that is different from this, take note!
Loki-Bot encrypts both the URL and the registry key used for persistence using Triple DES encryption.
The Content-Key HTTP Header value is the result of hashing the HTTP Header values that precede it. This is likely used as a protection against researchers who wish to poke and prod at Loki-Bot’s C2 infrastructure.
Loki-Bot can accept the following instructions from the C2 Server:
BYTE INSTRUCTION DESCRIPTION 0x00 Download EXE & Execute 0x01 Download DLL & Load #1 0x02 Download DLL & Load #2 0x08 Delete HDB File 0x09 Start Keylogger 0x0A Mine & Steal Data 0x0E Exit Loki-Bot 0x0F Upgrade Loki-Bot 0x10 Change C2 Polling Frequency 0x11 Delete Executables & Exit
Suricata Signatures RULE SID RULE NAME 2024311 ET TROJAN Loki Bot Cryptocurrency Wallet Exfiltration Detected 2024312 ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M1 2024313 ET TROJAN Loki Bot Request for C2 Commands Detected M1 2024314 ET TROJAN Loki Bot File Exfiltration Detected 2024315 ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M1 2024316 ET TROJAN Loki Bot Screenshot Exfiltration Detected 2024317 ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M2 2024318 ET TROJAN Loki Bot Request for C2 Commands Detected M2 2024319 ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M2
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Loki Password Stealer (PWS).
| Known Synonyms |
|---|
Burkina |
Loki |
LokiBot |
LokiPWS |
Internal MISP references
UUID b8fa5036-813f-4887-b4d4-bb17b4a7eba0 which can be used as unique global reference for Loki Password Stealer (PWS) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lokipws - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/evasive-urls-in-spam-part-2/ - webarchive
- https://www.trendmicro.com/en_us/research/21/h/new-campaign-sees-lokibot-delivered-via-multiple-methods.html - webarchive
- https://cybergeeks.tech/how-to-expose-a-potential-cybercriminal-due-to-misconfigurations/ - webarchive
- https://ivanvza.github.io/posts/lokibot_analysis - webarchive
- https://research.checkpoint.com/2023/following-the-scent-of-trickgate-6-year-old-packer-used-to-deploy-the-most-wanted-malware/ - webarchive
- https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/spammed-png-file-hides-lokibot/ - webarchive
- https://isc.sans.edu/diary/27282 - webarchive
- https://www.infoblox.com/wp-content/uploads/infoblox-whitepaper-deep-analysis-of-a-recent-lokibot-attack.pdf - webarchive
- https://lab52.io/blog/a-twisted-malware-infection-chain/ - webarchive
- https://github.com/R3MRUM/loki-parse - webarchive
- https://www.ciphertechsolutions.com/roboski-global-recovery-automation/ - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://www.lac.co.jp/lacwatch/report/20220307_002893.html - webarchive
- https://www.youtube.com/watch?v=-FxyzuRv6Wg - webarchive
- https://cocomelonc.github.io/tutorial/2021/09/06/simple-malware-av-evasion-2.html - webarchive
- http://reversing.fun/posts/2021/06/08/lokibot.html - webarchive
- https://blog.fortinet.com/2017/05/17/new-loki-variant-being-spread-via-pdf-file - webarchive
- https://labs.bitdefender.com/2020/03/5-times-more-coronavirus-themed-malware-reports-during-march/?utm_campaign=twitter&utm_medium=twitter&utm_source=twitter - webarchive
- https://phishme.com/loki-bot-malware/ - webarchive
- https://resources.malwarebytes.com/files/2020/05/CTNT_Q1_2020_COVID-Report_Final.pdf - webarchive
- https://malcat.fr/blog/reversing-a-nsis-dropper-using-quick-and-dirty-shellcode-emulation/ - webarchive
- https://www.atomicmatryoshka.com/post/malware-headliners-lokibot - webarchive
- https://medium.com/@paul.k.burbage/the-tale-of-the-pija-droid-firefinch-4d304fde5ca2 - webarchive
- https://www.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revealing-threat-in-the-shadow-by-chi-en-shen-ashley-oleg-bondarenko - webarchive
- https://github.com/d00rt/hijacked_lokibot_version/blob/master/doc/LokiBot_hijacked_2018.pdf - webarchive
- https://research.checkpoint.com/2019/select-code_execution-from-using-sqlite/ - webarchive
- http://reversing.fun/reversing/2021/06/08/lokibot.html - webarchive
- https://www.youtube.com/watch?v=N0wAh26wShE - webarchive
- https://www.sans.org/reading-room/whitepapers/malicious/loki-bot-information-stealer-keylogger-more-37850 - webarchive
- https://blog.prevailion.com/2020/02/the-triune-threat-mastermana-returns.html - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://marcoramilli.com/2019/10/28/sweed-targeting-precision-engineering-companies-in-italy/ - webarchive
- https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/ - webarchive
- https://securityintelligence.com/posts/roboski-global-recovery-automation/ - webarchive
- http://blog.reversing.xyz/reversing/2021/06/08/lokibot.html - webarchive
- https://blog.yoroi.company/research/aggah-how-to-run-a-botnet-without-renting-a-server-for-more-than-a-year/ - webarchive
- https://cysinfo.com/nefarious-macro-malware-drops-loki-bot-across-gcc-countries/ - webarchive
- https://malcat.fr/blog/statically-unpacking-a-simple-net-dropper/ - webarchive
- https://www.lastline.com/blog/password-stealing-malware-loki-bot/ - webarchive
- https://isc.sans.edu/diary/24372 - webarchive
- https://r3mrum.wordpress.com/2017/05/07/loki-bot-atrifacts/ - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://www.fortinet.com/blog/threat-research/lokibot-targets-microsoft-office-document-using-vulnerabilities-and-macros - webarchive
- https://blog.talosintelligence.com/2019/07/sweed-agent-tesla.html - webarchive
- https://news.sophos.com/en-us/2020/05/14/raticate/ - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/02/lokibot-dissecting-cc-panel-deployments/ - webarchive
- https://www.youtube.com/watch?v=K3Yxu_9OUxU - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://cybergeeks.tech/how-to-expose-a-potential-cybercriminal-due-to-misconfigurations - webarchive
- https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html - webarchive
- https://securelist.com/loki-bot-stealing-corporate-passwords/87595/ - webarchive
- http://www.malware-traffic-analysis.net/2017/06/12/index.html - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/loki-info-stealer-propagates-through-lzh-files - webarchive
- https://clickallthethings.wordpress.com/2020/03/31/lokibot-getting-equation-editor-shellcode/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/commodity-net-packers-use-embedded-images-hide-payloads - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lokorrito
According to ESET, this is a banking trojan that was active mainly in Mexico until the beginning of 2020, with builds for Brazil, Chile, and Colombia also having been identified.
Internal MISP references
UUID 5e8f3d59-15bc-492c-afdb-4b71e0417142 which can be used as unique global reference for Lokorrito in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LOLSnif
Internal MISP references
UUID 397bfb34-5643-4d21-a5b1-6950750fb89f which can be used as unique global reference for LOLSnif in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lolsnif - webarchive
- https://thedfirreport.com/2020/04/24/ursnif-via-lolbins/ - webarchive
- https://medium.com/@vishal_thakur/lolsnif-malware-e6cb2e731e63 - webarchive
- https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ - webarchive
- https://research.checkpoint.com/2020/gozi-the-malware-with-a-thousand-faces/ - webarchive
- https://www.telekom.com/en/blog/group/article/lolsnif-tracking-another-ursnif-based-targeted-campaign-600062 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LONGWATCH
The primary function of LONGWATCH is a keylogger that outputs keystrokes to a log.txt file in the Windows temp folder.
Internal MISP references
UUID 08106bd2-975b-421c-8794-366452fb0109 which can be used as unique global reference for LONGWATCH in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.longwatch - webarchive
- https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html - webarchive
- https://cyware.com/blog/apt34-the-helix-kitten-cybercriminal-group-loves-to-meow-middle-eastern-and-international-organizations-48ae - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
looChiper
LooChiper is a Ransomware. It uses a nice but scary name: LooCipher. The name is at the same time an allusion to its capabilities (thank to the term “Cipher”) and to the popular mythological figure, Lucifer. Despite its evocative nickname, the functionalities of this malware are pretty straight forward, not very different from those belonging to many other ransomware families.
Internal MISP references
UUID 4b83ba50-7d50-48b4-bb70-fcbcacd23340 which can be used as unique global reference for looChiper in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lookback
Internal MISP references
UUID bb038b04-622b-4df6-b867-601284e8da0e which can be used as unique global reference for Lookback in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lookback - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/witchetty-steganography-espionage - webarchive
- https://www.proofpoint.com/us/threat-insight/post/lookback-forges-ahead-continued-targeting-united-states-utilities-sector-reveals - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/ta410-group-behind-lookback-attacks-against-us-utilities-sector-returns-new - webarchive
- https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks - webarchive
- https://www.ironnet.com/blog/china-cyber-attacks-the-current-threat-landscape - webarchive
- https://nao-sec.org/2021/01/royal-road-redive.html - webarchive
- https://pylos.co/wp-content/uploads/2020/02/Threat-Intelligence-and-the-Limits-of-Malware-Analysis.pdf - webarchive
- https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/ - webarchive
- https://threatgen.com/taking-a-closer-look-at-the-lookback-malware-campaign-part-1/ - webarchive
- https://www.dragos.com/blog/industry-news/new-ics-threat-activity-group-talonite/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
L0rdix
L0rdix is a multipurpose .NET remote access tool (RAT) first discovered being sold on underground forums in November 2018. Out of the box, L0rdix supports eight commands, although custom commands can be defined and added. These include:
Download and execute Update Open page (visible) Open page (invisible) Cmd Kill process Upload file HTTP Flood
L0rdix can extract credentials from common web browsers and steal data from crypto wallets and a target's clipboard. Optionally, L0rdix can deploy a cryptominer (XMRig) to its bots.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular L0rdix.
| Known Synonyms |
|---|
lordix |
Internal MISP references
UUID fa61a690-fd9c-4036-97fb-bf3674aa60b2 which can be used as unique global reference for L0rdix in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lordix - webarchive
- https://blog.ensilo.com/l0rdix-attack-tool - webarchive
- https://github.com/cryptogramfan/Malware-Analysis-Scripts/blob/master/decrypt_l0rdix_c2.py - webarchive
- https://www.bromium.com/decrypting-l0rdix-rats-c2/ - webarchive
- https://twitter.com/hexlax/status/1058356670835908610 - webarchive
- https://www.bromium.com/an-analysis-of-l0rdix-rat-panel-and-builder/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lorenz
Tesorion describes Lorenz as a ransomware with design and implementation flaws, leading to impossible decryption with tools provided by the attackers. A free decryptor for 2021 versions was made available via the NoMoreRansom initiative. A new version of the malware was discovered in March 2022, for which again was provided a free decryptor, while the ransomware operators are not able to provide tools to decrypt affected files.
Internal MISP references
UUID 3ec79052-d8c0-49b2-9204-42f9d8f035f8 which can be used as unique global reference for Lorenz in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lorenz - webarchive
- https://therecord.media/free-decrypter-available-for-lorenz-ransomware/ - webarchive
- https://www.tesorion.nl/en/posts/lorenz-ransomware-analysis-and-a-free-decryptor/ - webarchive
- https://www.cybereason.com/blog/cybereason-vs.-lorenz-ransomware - webarchive
- https://arcticwolf.com/resources/blog/lorenz-ransomware-getting-dumped/ - webarchive
- https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/ - webarchive
- https://twitter.com/AltShiftPrtScn/status/1423190900516302860?s=20 - webarchive
- https://www.tesorion.nl/en/posts/lorenz-ransomware-rebound-corruption-and-irrecoverable-files/ - webarchive
- https://www.bleepingcomputer.com/news/security/meet-lorenz-a-new-ransomware-gang-targeting-the-enterprise/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Loup
Frank Boldewin describes Loup as a small cli-tool to cash out NCR devices (ATM).
Internal MISP references
UUID 8ab39736-68f4-4b51-9b48-7034da1cac71 which can be used as unique global reference for Loup in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LOWBALL
LOWBALL, uses the legitimate Dropbox cloud-storage service to act as the CnC server. It uses the Dropbox API with a hardcoded bearer access token and has the ability to download, upload, and execute files. The communication occurs via HTTPS over port 443.
Internal MISP references
UUID 484b9fd9-76c6-41af-a85b-189b0fc94909 which can be used as unique global reference for LOWBALL in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lowball - webarchive
- https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html - webarchive
- https://kindredsec.com/2019/08/12/an-overview-of-public-platform-c2s/ - webarchive
- https://kindredsec.wordpress.com/2019/08/12/an-overview-of-public-platform-c2s/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LOWKEY
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular LOWKEY.
| Known Synonyms |
|---|
PortReuse |
Internal MISP references
UUID 515d1318-c3b1-4d40-a321-31b3baf75414 which can be used as unique global reference for LOWKEY in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lowkey - webarchive
- https://www.fireeye.com/blog/threat-research/2019/10/lowkey-hunting-for-the-missing-volume-serial-id.html - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Winnti.pdf - webarchive
- https://www.welivesecurity.com/2019/10/21/winnti-group-skip2-0-microsoft-sql-server-backdoor/ - webarchive
- https://www.mandiant.com/resources/apt41-us-state-governments - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LOWZERO
Internal MISP references
UUID 1efd4902-ff9e-4e71-8867-6eddb9bc456c which can be used as unique global reference for LOWZERO in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LPEClient
LPEClient is an HTTP(S) downloader that expects two command line parameters: an encrypted string containing two URLs (a primary and a secondary C&C server), and the path on the victim's file system to store the downloaded payload.
It sends detailed information about the victim's environment, like computer name, type and number of processors, computer manufacturer, product name, major and minor Windows versions, architecture, memory information, installed security software and the version of the ntoskrnl.exe from its version-information resource.
LPEClient uses specific 32-bit values to represent its execution state (0x59863F09 when connecting via the WinHTTP interface, 0xA9348B57 via WinINet), or the nature of HTTP requests to the C&C servers (0xF07D6B34 when sending system information, 0xEF8C0D51 when requesting a DLL payload, 0xCB790A25 when reporting the successful loading of the DLL, 0xD7B20A96 when reporting the state of the the DLL execution). As the final step, malware looks for the export CloseEnv and executes it.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular LPEClient.
| Known Synonyms |
|---|
LPEClientTea |
Internal MISP references
UUID 754c8f79-743b-49fc-971e-bcd60edef9d8 which can be used as unique global reference for LPEClient in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lpeclient - webarchive
- https://securelist.com/unveiling-lazarus-new-campaign/110888/ - webarchive
- https://securelist.com/lazarus-threatneedle/100803/ - webarchive
- https://vblocalhost.com/uploads/VB2021-Lee-etal.pdf - webarchive
- https://securelist.com/the-lazarus-group-deathnote-campaign/109490/ - webarchive
- https://vblocalhost.com/uploads/VB2021-Park.pdf - webarchive
- https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
lsassDumper
This in Go written malware is lsass process memory dumper, which was custom developed by threat actors according to Security Joes. It has the capability to automatically exfiltrate the results to the free file transfer service "transfer.sh".
Internal MISP references
UUID f6e9f1f3-91ba-40af-aa2d-d0d5e824b791 which can be used as unique global reference for lsassDumper in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lu0Bot
According to PCrisk, Lu0bot es un software malicioso. El malware es ligero, por lo que su uso de los recursos del sistema es bajo. Esto complica la detección de Lu0bot, ya que no causa síntomas significativos, como una grave disminución del rendimiento del sistema.
El programa malicioso funciona como un recolector de telemetría.
Internal MISP references
UUID d81c068d-7420-40ee-ab50-5f29b2ccc314 which can be used as unique global reference for Lu0Bot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LuaDream
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular LuaDream.
| Known Synonyms |
|---|
DreamLand |
Internal MISP references
UUID a6fee19a-21e4-4e2c-9c1f-a38d0732f661 which can be used as unique global reference for LuaDream in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.luadream - webarchive
- https://www.sentinelone.com/labs/sandman-apt-china-based-adversaries-embrace-lua/ - webarchive
- https://www.sentinelone.com/labs/sandman-apt-a-mystery-group-targeting-telcos-with-a-luajit-toolkit/ - webarchive
- https://r136a1.dev/2023/09/22/more-on-dreamland/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Luca Stealer
According to PCRisk, The Luca stealer can extract a variety of information from compromised machines. It targets data related to the following: operating system, device name, CPUs, desktop environment, network interface, user account name, preferred system language, running processes, etc.
This malicious program can steal information from over thirty Chromium-based browsers. From these applications, Luca can obtain Internet cookies, account log-in credentials (usernames/passwords), and credit card numbers. Additionally, the stealer can extract data from password manager and cryptowallet browser extensions compatible with over twenty browsers.
This malware also targets various messaging applications like Telegram, Discord, ICQ, Skype, Element, etc. It likewise aims to acquire information from gaming-related software such as Steam and Uplay (Ubisoft Connect). Furthermore, some versions of Luca can take screenshots and download the files stored on victims' devices.
Internal MISP references
UUID e9693255-762b-447a-9dfa-2ea1a35fe39c which can be used as unique global reference for Luca Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lucifer
Internal MISP references
UUID 54093130-035f-4f2c-b98c-a660156fbbda which can be used as unique global reference for Lucifer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Luminosity RAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Luminosity RAT.
| Known Synonyms |
|---|
LuminosityLink |
Internal MISP references
UUID e145863e-f3bd-489c-91f6-0c2b7e9cc59a which can be used as unique global reference for Luminosity RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.luminosity_rat - webarchive
- https://www.proofpoint.com/us/threat-insight/post/Light-After-Dark - webarchive
- https://umbrella.cisco.com/blog/2017/01/18/finding-the-rats-nest/ - webarchive
- https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf - webarchive
- https://krebsonsecurity.com/2018/07/luminositylink-rat-author-pleads-guilty/ - webarchive
- https://www.secureworks.com/research/threat-profiles/copper-fieldstone - webarchive
- https://researchcenter.paloaltonetworks.com/2016/07/unit42-investigating-the-luminositylink-remote-access-trojan-configuration/ - webarchive
- http://malwarenailed.blogspot.com/2016/07/luminosity-rat-re-purposed.html - webarchive
- https://researchcenter.paloaltonetworks.com/2018/02/unit42-rat-trapped-luminositylink-falls-foul-vermin-eradication-efforts/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lumma Stealer
Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Lumma Stealer.
| Known Synonyms |
|---|
LummaC2 Stealer |
Internal MISP references
UUID a14270e4-2b5e-4a90-9ccd-0b68690dbc3e which can be used as unique global reference for Lumma Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma - webarchive
- https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/ - webarchive
- https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx - webarchive
- https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks - webarchive
- https://www.intrinsec.com/lumma_stealer_actively_deployed_in_multiple_campaigns/ - webarchive
- https://twitter.com/sekoia_io/status/1572889505497223169 - webarchive
- https://twitter.com/fumik0_/status/1559474920152875008 - webarchive
- https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ - webarchive
- https://www.youtube.com/watch?v=lmMA4WYJEOY - webarchive
- https://medium.com/s2wblog/lumma-stealer-targets-youtubers-via-spear-phishing-email-ade740d486f7 - webarchive
- https://www.esentire.com/blog/the-case-of-lummac2-v4-0 - webarchive
- https://twitter.com/Ishusoka/status/1614028229307928582 - webarchive
- https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11 - webarchive
- https://outpost24.com/blog/everything-you-need-to-know-lummac2-stealer - webarchive
- https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer - webarchive
- https://outpost24.com/blog/lummac2-anti-sandbox-technique-trigonometry-human-detection/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
LunchMoney
An uploader that can exfiltrate files to Dropbox.
Internal MISP references
UUID fb0167e5-3457-46ec-a6d1-b8e4ad9bc89b which can be used as unique global reference for LunchMoney in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lurk
Internal MISP references
UUID 929112e4-e252-4273-b3c2-fd414cfb2776 which can be used as unique global reference for Lurk in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Luzo
Internal MISP references
UUID 8c0d3012-9dcb-46d3-964f-8a3c5b58d1b2 which can be used as unique global reference for Luzo in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lyceum .NET DNS Backdoor
This .NET written malware is used as backdoor using the dns protocol by a state sponsored threat actor. It implements additional capabilities (e.g. execution of commands, taking screenshots, listing diles/directories/installed applications, and uploading/downloading/execution of files). There are also variants using HTTP (.Net) and also one written in Golang.
Internal MISP references
UUID e7117036-5142-4a07-ae85-c3ddba7f1d75 which can be used as unique global reference for Lyceum .NET DNS Backdoor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lyceum_dns_backdoor_dotnet - webarchive
- https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor - webarchive
- https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lyceum .NET TCP Backdoor
This .Net written malware is used as backdoor using the http protocol by a state sponsored threat actor. It implements additional capabilities (e.g. execution of commands, taking screenshots, listing diles/directories/installed applications, and uploading/downloading/execution of files). There are also variants using DNS (.Net) and also one written in Golang.
Internal MISP references
UUID 92e533c5-b32a-411a-9fcc-733854c4a18c which can be used as unique global reference for Lyceum .NET TCP Backdoor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lyceum Golang HTTP Backdoor
This Golang written malware is used as backdoor using the http protocol by a state sponsored threat actor (TA). This backdoor is running in a loop of three stages: - Check the connectivity - Registration of the victim - Retrieval and execution of commands This TA is using also variants .NET backdoors utilizing HTTP and DNS.
Internal MISP references
UUID 61fda7db-5e82-4e8c-a629-e8cc36151dec which can be used as unique global reference for Lyceum Golang HTTP Backdoor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Lyposit
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Lyposit.
| Known Synonyms |
|---|
Adneukine |
Bomba Locker |
Lucky Locker |
Internal MISP references
UUID 0dea3e9d-b443-40f6-a9e0-ba622850ee8a which can be used as unique global reference for Lyposit in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.lyposit - webarchive
- http://malware.dontneedcoffee.com/2013/05/unveiling-locker-bomba-aka-lucky-locker.html - webarchive
- http://malware.dontneedcoffee.com/2012/11/inside-view-of-lyposit-aka-for-its.html - webarchive
- https://blog.avast.com/2013/05/20/lockscreen-win32lyposit-displayed-as-a-fake-macos-app/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
M00nD3V Logger
According Zscaler, M00nD3V Logger has the ability to steal confidential information, such as browser passwords, FTP client passwords, email client passwords, DynDNS credentials, JDownloader credentials; capture Windows keystrokes; and gain access to the webcam and hook the clipboard. In all, it has the ability to steal passwords from 42 applications.
Internal MISP references
UUID 737a73d5-40a2-4779-a84b-bdbefd1af4c9 which can be used as unique global reference for M00nD3V Logger in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
m0yv
Modular x86/x64 file infector created/used by Maze ransomware developer. According to the author, it has been mistakenly tagged by AVs as Expiro.
Internal MISP references
UUID 73db5c33-c05c-4835-af4d-9223516b0915 which can be used as unique global reference for m0yv in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.m0yv - webarchive
- https://github.com/baderj/domain_generation_algorithms/blob/master/m0yv/dga.py - webarchive
- https://www.bleepingcomputer.com/news/security/ransomware-dev-releases-egregor-maze-master-decryption-keys/ - webarchive
- https://github.com/baderj/domain_generation_algorithms/blob/master/expiro/dga.py - webarchive
- https://securityaffairs.co/wordpress/127826/malware/egregor-sekhmet-decryption-keys.html - webarchive
- https://youtu.be/3RYbkORtFnk - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MACAMAX
Internal MISP references
UUID 94dce4b9-69c9-4cc3-8377-dba04a162bc4 which can be used as unique global reference for MACAMAX in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Macaw
Internal MISP references
UUID 523883ea-b865-4713-b5ed-bb1a808f35cf which can be used as unique global reference for Macaw in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.macaw - webarchive
- https://killingthebear.jorgetesta.tech/actors/evil-corp - webarchive
- https://www.bleepingcomputer.com/news/security/evil-corp-demands-40-million-in-new-macaw-ransomware-attacks/ - webarchive
- https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Machete
According to ESET, Machete’s dropper is a RAR SFX executable. Three py2exe components are dropped: GoogleCrash.exe, Chrome.exe and GoogleUpdate.exe. A single configuration file, jer.dll, is dropped, and it contains base64‑encoded text that corresponds to AES‑encrypted strings. GoogleCrash.exe is the main component of the malware. It schedules execution of the other two components and creates Windows Task Scheduler tasks to achieve persistence. Regarding the geolocation of victims, Chrome.exe collects data about nearby Wi-Fi networks and sends it to the Mozilla Location Service API. In short, this application provides geolocation coordinates when it’s given other sources of data such as Bluetooth beacons, cell towers or Wi-Fi access points. Then the malware takes latitude and longitude coordinates to build a Google Maps URL. The GoogleUpdate.exe component is responsible for communicating with the remote C&C server. The configuration to set the connection is read from the jer.dll file: domain name, username and password. The principal means of communication for Machete is via FTP, although HTTP communication was implemented as a fallback in 2019.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Machete.
| Known Synonyms |
|---|
El Machete |
Internal MISP references
UUID 9a724a1d-7eb1-4e2b-8cc3-e1b41e8b5cff which can be used as unique global reference for Machete in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.machete - webarchive
- https://threatvector.cylance.com/en_us/home/threat-spotlight-machete-info-stealer.html - webarchive
- https://www.cylance.com/en_us/blog/el-machete-malware-attacks-cut-through-latam.html - webarchive
- https://securelist.com/el-machete/66108/ - webarchive
- https://www.welivesecurity.com/2019/08/05/sharpening-machete-cyberespionage/ - webarchive
- https://medium.com/@verovaleros/el-machete-what-do-we-know-about-the-apt-targeting-latin-america-be7d11e690e6 - webarchive
- https://www.atomicmatryoshka.com/post/infographic-apts-in-south-america - webarchive
- https://static1.squarespace.com/static/5a01100f692ebe0459a1859f/t/5da340ded5ccf627e1764059/1570980068506/Day3-1130-Green-A+study+of+Machete+cyber+espionage+operations+in+Latin+America.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MadMax
Internal MISP references
UUID 42760c2c-bf00-4ace-871c-6dcbbd90b2de which can be used as unique global reference for MadMax in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Magala
Internal MISP references
UUID 192f93bc-fcf6-4aaf-ae2f-d9435a67e48b which can be used as unique global reference for Magala in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Maggie
According to DCSO, this malware is written as a Extended Stored Procedure for a MSSQL server. The backdoor has capabilities to bruteforce logins to other MSSQL servers, adding a special hardcoded backdoor user in the case of successfully bruteforcing admin logins.
Internal MISP references
UUID 2e4a63ab-9a04-472f-aad0-3eb4835a4697 which can be used as unique global reference for Maggie in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.maggie - webarchive
- https://medium.com/@DCSO_CyTec/tracking-down-maggie-4d889872513d - webarchive
- https://www.sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/ - webarchive
- https://medium.com/@DCSO_CyTec/mssql-meet-maggie-898773df3b01 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MagicRAT
According to Talos, MagicRAT is programmed in C++ programming language and uses the Qt Framework by statically linking it to the RAT on 32- and 64-bit versions. The Qt Framework is a programming library for developing graphical user interfaces, of which this RAT has none. Talos thinks that the objective was to increase the complexity of the code, thus making human analysis harder. On the other hand, since there are very few examples (if any) of malware programmed with Qt Framework, this also makes machine learning and heuristic analysis detection less reliable. The RAT uses the Qt classes throughout its entire code. The configuration is dynamically stored in a QSettings class eventually being saved to disk, a typical functionality provided by that class.
MagicRAT provides the operator with a remote shell on the victim's system for arbitrary command execution, along with the ability to rename, move and delete files on the endpoint. The operator can determine the timing for the implant to sleep, change the C2 URLs and delete the implant from the infected system.
Internal MISP references
UUID ace607fa-d2ad-4097-aa01-0aa748644b8e which can be used as unique global reference for MagicRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.magic_rat - webarchive
- https://media.defense.gov/2023/Feb/09/2003159161/-1/-1/0/CSA_RANSOMWARE_ATTACKS_ON_CI_FUND_DPRK_ACTIVITIES.PDF - webarchive
- https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - webarchive
- https://www.attackiq.com/2023/01/05/emulating-the-highly-sophisticated-north-korean-adversary-lazarus-group/ - webarchive
- https://blog.talosintelligence.com/2022/09/lazarus-magicrat.html - webarchive
- https://www.youtube.com/watch?v=nUjxH1gW53s - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Magniber
According to TXOne, The Magniber ransomware was first identified in late 2017 when it was discovered using the Magnitude Exploit Kit to conduct malvertising attacks against users in South Korea. However, it has remained active since then, continually updating its tactics by employing new obfuscation techniques and methods of evasion. In April 2022, Magniber gained notoriety for disguising itself as a Windows update file to lure victims into installing it. It then began spreading via JavaScript in September 2022.
Internal MISP references
UUID fedac411-0638-48dc-8ac5-1b4171fa8a29 which can be used as unique global reference for Magniber in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.magniber - webarchive
- https://www.bleepingcomputer.com/news/security/magniber-ransomware-gang-now-exploits-internet-explorer-flaws-in-attacks/ - webarchive
- https://www.bleepingcomputer.com/news/security/fake-windows-10-updates-infect-you-with-magniber-ransomware/ - webarchive
- https://www.malwarebytes.com/blog/news/2018/07/magniber-ransomware-improves-expands-within-asia - webarchive
- https://blog.malwarebytes.com/threat-analysis/2017/10/magniber-ransomware-exclusively-for-south-koreans/ - webarchive
- https://asec.ahnlab.com/en/30645/ - webarchive
- https://blog.google/threat-analysis-group/magniber-ransomware-actors-used-a-variant-of-microsoft-smartscreen-bypass/ - webarchive
- https://asec.ahnlab.com/en/41889/ - webarchive
- http://asec.ahnlab.com/1124 - webarchive
- https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/ - webarchive
- https://asec.ahnlab.com/en/19273/ - webarchive
- https://teamt5.org/tw/posts/internet-explorer-the-vulnerability-ridden-browser/ - webarchive
- https://www.youtube.com/watch?v=lqWJaaofNf4 - webarchive
- https://hshrzd.wordpress.com/2023/03/30/magniber-ransomware-analysis/ - webarchive
- https://www.crowdstrike.com/blog/magniber-ransomware-caught-using-printnightmare-vulnerability/ - webarchive
- https://therecord.media/printnightmare-vulnerability-weaponized-by-magniber-ransomware-gang/ - webarchive
- https://decoded.avast.io/janvojtesek/exploit-kits-vs-google-chrome/ - webarchive
- https://medium.com/coinmonks/passive-income-of-cyber-criminals-dissecting-bitcoin-multiplier-scam-b9d2b6048372 - webarchive
- https://forensicitguy.github.io/analyzing-magnitude-magniber-appx/ - webarchive
- https://decoded.avast.io/janvojtesek/magnitude-exploit-kit-still-alive-and-kicking/ - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-printnightmare-and-magniber-ransomware - webarchive
- https://www.cybereason.com/blog/threat-analysis-msi-masquerading-as-software-installer - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mailto
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mailto.
| Known Synonyms |
|---|
Koko Ransomware |
NetWalker |
Internal MISP references
UUID 722aab64-a02a-40fc-8c05-6b0344fad9b8 which can be used as unique global reference for Mailto in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mailto - webarchive
- https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/ - webarchive
- https://ics-cert.kaspersky.com/media/KASPERSKY_H1_2020_ICS_REPORT_EN.pdf - webarchive
- https://id-ransomware.blogspot.com/2019/09/koko-ransomware.html - webarchive
- https://www.youtube.com/watch?v=q8of74upT_g - webarchive
- https://www.bleepingcomputer.com/news/security/michigan-state-university-network-breached-in-ransomware-attack/ - webarchive
- https://www.crowdstrike.com/blog/analysis-of-ecrime-menu-style-toolkits/ - webarchive
- https://ke-la.com/to-attack-or-not-to-attack-targeting-the-healthcare-sector-in-the-underground-ecosystem/ - webarchive
- https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound - webarchive
- https://www.bleepingcomputer.com/news/security/enel-group-hit-by-ransomware-again-netwalker-demands-14-million - webarchive
- https://danusminimus.github.io/Zero2Auto-Netwalker-Walkthrough/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/ReportCSIT-20081e.pdf - webarchive
- https://lopqto.me/posts/automated-dynamic-import-resolving - webarchive
- https://www.zeit.de/digital/2021-06/cybercrime-extortion-internet-spyware-ransomware-police-prosecution-hackers - webarchive
- https://seguranca-informatica.pt/netwalker-ransomware-full-analysis/ - webarchive
- https://download.microsoft.com/download/f/8/1/f816b8b6-bee3-41e5-b6cc-e925a5688f61/Microsoft_Digital_Defense_Report_2020_September.pdf - webarchive
- https://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/ - webarchive
- https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/ - webarchive
- https://www.ic3.gov/media/news/2020/200929-2.pdf - webarchive
- https://www.ucsf.edu/news/2020/06/417911/update-it-security-incident-ucsf - webarchive
- https://krebsonsecurity.com/2021/01/arrest-seizures-tied-to-netwalker-ransomware - webarchive
- https://tccontre.blogspot.com/2020/05/netwalker-ransomware-api-call.html - webarchive
- https://zero2auto.com/2020/05/19/netwalker-re/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/an-in-depth-look-at-mailto-ransomware-part-one-of-three/ - webarchive
- https://www.incibe-cert.es/blog/ransomware-netwalker-analisis-y-medidas-preventivas - webarchive
- https://blog.talosintelligence.com/2020/09/CTIR-quarterly-trends-Q4-2020.html - webarchive
- https://www.advanced-intel.com/post/netwalker-ransomware-group-enters-advanced-targeting-game - webarchive
- https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/ - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/ - webarchive
- https://cert-agid.gov.it/news/netwalker-il-ransomware-che-ha-beffato-lintera-community/ - webarchive
- https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/ - webarchive
- https://cti-league.com/wp-content/uploads/2021/02/CTI-League-Darknet-Report-2021.pdf - webarchive
- https://www.justice.gov/opa/pr/department-justice-launches-global-action-against-netwalker-ransomware - webarchive
- https://www.justice.gov/usao-mdfl/press-release/file/1360846/download - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/darkside-ransomware-made-90-million-in-just-nine-months/ - webarchive
- https://www.bleepingcomputer.com/news/security/netwalker-ransomware-affiliate-sentenced-to-80-months-in-prison/ - webarchive
- https://www.deepinstinct.com/2021/05/26/deep-dive-packing-software-cryptone/ - webarchive
- https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/ - webarchive
- https://www.bleepingcomputer.com/news/security/netwalker-ransomware-infecting-users-via-coronavirus-phishing/ - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://sites.temple.edu/care/ci-rw-attacks/ - webarchive
- https://www.cybereason.com/blog/cybereason-vs.-netwalker-ransomware - webarchive
- https://0x00-0x7f.github.io/Netwalker-from-Powershell-reflective-loader-to-injected-Dll/ - webarchive
- https://s3.documentcloud.org/documents/21199896/vachon-desjardins-court-docs.pdf - webarchive
- https://therecord.media/ransomwhere-project-wants-to-create-a-database-of-past-ransomware-payments/ - webarchive
- https://www.bleepingcomputer.com/news/security/enel-group-hit-by-ransomware-again-netwalker-demands-14-million/ - webarchive
- https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/an-in-depth-look-at-mailto-ransomware-part-two-of-three/ - webarchive
- https://www.bleepingcomputer.com/news/security/mailto-netwalker-ransomware-targets-enterprise-networks/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://blogs.blackberry.com/en/2021/03/zerologon-to-ransomware - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/an-in-depth-look-at-mailto-ransomware-part-three-of-three/ - webarchive
- https://thedfirreport.com/2020/08/31/netwalker-ransomware-in-1-hour/ - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://zengo.com/bitcoin-ransomware-detective-ucsf/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/take-a-netwalk-on-the-wild-side/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mail-O
Internal MISP references
UUID d41f513c-97e2-4588-a669-aa93b6378ef1 which can be used as unique global reference for Mail-O in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mail_o - webarchive
- https://rt-solar.ru/upload/iblock/b55/Ataki-na-FOIV_otchet-NKTSKI-i-Rostelekom_Solar_otkrytyy.pdf - webarchive
- https://blog.group-ib.com/task - webarchive
- https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/ - webarchive
- https://www.sentinelone.com/labs/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op - webarchive
- https://therecord.media/fsb-nktski-foreign-cyber-mercenaries-breached-russian-federal-agencies/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MajikPos
Internal MISP references
UUID c1144eb8-a2bc-48d7-b0fb-18f124c1f8d9 which can be used as unique global reference for MajikPos in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Makadocs
Internal MISP references
UUID 996e73e9-b093-4987-9992-f52008e55b24 which can be used as unique global reference for Makadocs in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.makadocs - webarchive
- http://contagiodump.blogspot.com/2012/12/nov-2012-backdoorw32makadocs-sample.html - webarchive
- https://www.symantec.com/connect/blogs/malware-targeting-windows-8-uses-google-docs - webarchive
- https://kindredsec.com/2019/08/12/an-overview-of-public-platform-c2s/ - webarchive
- https://kindredsec.wordpress.com/2019/08/12/an-overview-of-public-platform-c2s/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MakLoader
Internal MISP references
UUID 7e088669-3ddb-4cc5-bc9b-ae59f61ada82 which can be used as unique global reference for MakLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Makop
BeforeCrypt describes that MAKOP Ransomware first appeared in 2020 as an offshoot of the PHOBOS variant, and that it has infected a number of computers since then. Files encrypted by MAKOP often have the extension “.makop”. You may also notice that your desktop wallpaper has changed. MAKOP uses RSA encryption. There are no known free decryption tools capable of decrypting files encrypted by MAKOP.
Internal MISP references
UUID db4ca498-5481-4b68-8024-edd51d552c38 which can be used as unique global reference for Makop in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.makop - webarchive
- https://www.microsoft.com/security/blog/2021/02/01/what-tracking-an-attacker-email-infrastructure-tells-us-about-persistent-cybercriminal-operations/ - webarchive
- https://blog.morphisec.com/the-fair-upgrade-variant-of-phobos-ransomware - webarchive
- https://lifars.com/wp-content/uploads/2021/08/Makop-Ransomware-Whitepaper-case-studyNEW-1.pdf - webarchive
- https://twitter.com/siri_urz/status/1221797493849018368 - webarchive
- https://medium.com/@lcam/makop-the-toolkit-of-a-criminal-gang-53cd44563c11 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Maktub
According to PCrisk, Maktub is ransomware distributed via zipped Word documents. Once the file is extracted and opened, Maktub infiltrates the system and encrypts files stored on the victim's computer. Maktub ransomware adds a .NORV, .gyul (or other random) extension to each file encrypted, thus, making it straightforward to determine which files are encrypted.
Internal MISP references
UUID bdb27944-1f79-46f7-a0d7-c344429790c2 which can be used as unique global reference for Maktub in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.maktub - webarchive
- https://bartblaze.blogspot.de/2018/04/maktub-ransomware-possibly-rebranded-as.html - webarchive
- https://www.intezer.com/iron-cybercrime-group-under-the-scope-2/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/03/maktub-locker-beautiful-and-dangerous/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MalumPOS
Internal MISP references
UUID 159b0dbf-52f6-4690-a545-0f890ba7b9b7 which can be used as unique global reference for MalumPOS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mamba
According to PCrisk, Mamba is an updated variant of high-risk ransomware called Phobos. After successful infiltration, Mamba encrypts stored files and appends filenames with the ".mamba" extension plus the victim's unique ID and developer's email address.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mamba.
| Known Synonyms |
|---|
DiskCryptor |
HDDCryptor |
Internal MISP references
UUID df320366-7970-4af0-b1f4-9f9492dede53 which can be used as unique global reference for Mamba in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mamba - webarchive
- https://securelist.com/the-return-of-mamba-ransomware/79403/ - webarchive
- https://www.ic3.gov/Media/News/2021/210323.pdf - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/bksod-by-ransomware-hddcryptor-uses-commercial-tools-to-encrypt-network-shares-and-lock-hdds/ - webarchive
- https://www.youtube.com/watch?v=LUxOcpIRxmg - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ManameCrypt
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ManameCrypt.
| Known Synonyms |
|---|
CryptoHost |
Internal MISP references
UUID 54cd671e-b7e4-4dd3-9bfa-dc0ba5105944 which can be used as unique global reference for ManameCrypt in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.manamecrypt - webarchive
- https://www.gdatasoftware.com/blog/2016/04/28234-manamecrypt-a-ransomware-that-takes-a-different-route - webarchive
- https://www.bleepingcomputer.com/news/security/cryptohost-decrypted-locks-files-in-a-password-protected-rar-file/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mango
Internal MISP references
UUID e3be5820-5cf9-4455-9b46-c88e7fbebd85 which can be used as unique global reference for Mango in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mangzamel
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mangzamel.
| Known Synonyms |
|---|
junidor |
mengkite |
vedratve |
Internal MISP references
UUID ed3a94c9-8a5a-4ae7-bdd9-b000e01df3a0 which can be used as unique global reference for Mangzamel in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mangzamel - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2018GlobalThreatReport.pdf - webarchive
- https://www.hybrid-analysis.com/sample/5d631d77401615d53f3ce3dbc2bfee5d934602dc35d488aa7cebf9b3ff1c4816?environmentId=2 - webarchive
- https://www.youtube.com/watch?v=NFJqD-LcpIg - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Manifestus
Internal MISP references
UUID 5b75db42-b8f2-4e52-81d3-f329e49e1af2 which can be used as unique global reference for Manifestus in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ManItsMe
Internal MISP references
UUID 13b0d9ff-0be0-4539-8c86-dfca7a0e79f6 which can be used as unique global reference for ManItsMe in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Manjusaka (Windows)
Cisco Talos compared this RAT to Cobalt Strike and Sliver. Written in Rust.
Internal MISP references
UUID 402a569c-6fc1-4ba3-b570-f85ce7538eef which can be used as unique global reference for Manjusaka (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Maoloa
Ransomware family closely related to GlobeImposter, notable for its use of SHACAL-2 encryption algorithm.
Internal MISP references
UUID 9fe92a48-6822-4ec0-b52b-d089f98590ec which can be used as unique global reference for Maoloa in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.maoloa - webarchive
- https://id-ransomware.blogspot.com/2019/02/maoloa-ransomware.html - webarchive
- https://www.sangfor.com/blog/cybersecurity/alert-new-globeimposter-olympian-gods-20-coming - webarchive
- https://news.sophos.com/en-us/2022/07/20/ooda-x-ops-takes-on-burgeoning-sql-server-attacks/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MAPIget
Internal MISP references
UUID 8a97307f-a029-4c43-88e1-debed2b80b14 which can be used as unique global reference for MAPIget in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Marap
Marap is a downloader, named after its command and control (C&C) phone home parameter "param" spelled backwards. It is written in C and contains a few notable anti-analysis features.
Internal MISP references
UUID c2c3ac24-6921-4bba-a2c8-ac3d364feaeb which can be used as unique global reference for Marap in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.marap - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf - webarchive
- https://www.proofpoint.com/us/threat-insight/post/new-modular-downloaders-fingerprint-systems-prepare-more-part-1-marap - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mariposa
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mariposa.
| Known Synonyms |
|---|
Autorun |
Palevo |
Rimecud |
Internal MISP references
UUID 6adb6fa0-1974-4d24-9c39-e76d5356cf6a which can be used as unique global reference for Mariposa in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mariposa - webarchive
- https://krebsonsecurity.com/2019/10/mariposa-botnet-author-darkcode-crime-forum-admin-arrested-in-germany/ - webarchive
- https://defintel.com/docs/Mariposa_Analysis.pdf - webarchive
- https://www.us-cert.gov/ics/advisories/ICSA-10-090-01 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MarkiRAT
Internal MISP references
UUID c19ac191-a881-437f-ae82-7bec174590cb which can be used as unique global reference for MarkiRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MarraCrypt
Internal MISP references
UUID bbe77240-d8e5-41b5-88ac-e9a91aa54a13 which can be used as unique global reference for MarraCrypt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mars
Ransomware written in Delphi.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mars.
| Known Synonyms |
|---|
MarsDecrypt |
Internal MISP references
UUID 0b71ab98-912a-47a5-a1e0-1d7bd4fe9a4e which can be used as unique global reference for Mars in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mars Stealer
3xp0rt describes Mars Stealer as an improved successor of Oski Stealer, supporting stealing from current browsers and targeting crypto currencies and 2FA plugins.
Internal MISP references
UUID a5c1a9bd-5c1c-4987-8844-2c38e7b83507 which can be used as unique global reference for Mars Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mars_stealer - webarchive
- https://drive.google.com/file/d/14cmYxzowVLyuiS5qDGOKzgI2_vak2Fve/view - webarchive
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-mars-stealer - webarchive
- https://x-junior.github.io/malware%20analysis/MarsStealer/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf - webarchive
- https://www.esentire.com/blog/fake-chrome-setup-leads-to-netsupportmanager-rat-and-mars-stealer - webarchive
- https://www.microsoft.com/security/blog/2022/05/17/in-hot-pursuit-of-cryware-defending-hot-wallets-from-attacks/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-meta-information-stealer-distributed-in-malspam-campaign/ - webarchive
- https://blog.cyble.com/2022/08/02/fake-atomic-wallet-website-distributing-mars-stealer/ - webarchive
- https://isc.sans.edu/diary/Arkei+Variants%3A+From+Vidar+to+Mars+Stealer/28468 - webarchive
- https://ke-la.com/information-stealers-a-new-landscape/ - webarchive
- https://resources.infosecinstitute.com/topic/mars-stealer-malware-analysis/ - webarchive
- https://3xp0rt.com/posts/mars-stealer - webarchive
- https://threatmon.io/mars-stealer-malware-analysis-threatmon/ - webarchive
- https://isc.sans.edu/diary/rss/28468 - webarchive
- https://cert.gov.ua/article/38606 - webarchive
- https://blog.morphisec.com/threat-research-mars-stealer - webarchive
- https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ - webarchive
- https://blog.sekoia.io/mars-a-red-hot-information-stealer/ - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/ - webarchive
- https://cyberint.com/blog/research/mars-stealer/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Masad Stealer
Internal MISP references
UUID 8a85df9f-5295-4570-948a-67c2489bdd2d which can be used as unique global reference for Masad Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MASS Logger
MassLogger is a .NET credential stealer. It starts with a launcher that uses simple anti-debugging techniques which can be easily bypassed when identified. This first stage loader eventually XOR-decrypts the second stage assembly which then decrypts, loads and executes the final MassLogger payload.
Internal MISP references
UUID e1a09bf8-974a-4cc4-9ffd-758bed7a785e which can be used as unique global reference for MASS Logger in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.masslogger - webarchive
- https://www.gdatasoftware.com/blog/2020/06/36129-harmful-logging-diving-into-masslogger - webarchive
- https://fr3d.hk/blog/masslogger-frankenstein-s-creation - webarchive
- https://decoded.avast.io/anhho/masslogger-v3-a-net-stealer-with-serious-obfuscation/ - webarchive
- https://maxkersten.nl/binary-analysis-course/malware-analysis/rezer0v4-loader/ - webarchive
- https://www.seqrite.com/blog/masslogger-an-emerging-spyware-and-keylogger/ - webarchive
- https://blog.talosintelligence.com/2021/02/masslogger-cred-exfil.html - webarchive
- https://twitter.com/pancak3lullz/status/1255893734241304576 - webarchive
- https://www.fireeye.com/blog/threat-research/2020/08/bypassing-masslogger-anti-analysis-man-in-the-middle-approach.html - webarchive
- https://medium.com/@mariohenkel/decrypt-masslogger-2-4-0-0-configuration-eff3ee0720a7 - webarchive
- https://blog.talosintelligence.com/2021/04/a-year-of-fajan-evolution-and-bloomberg.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Matanbuchus
According to PCrisk, Matanbuchus is a loader-type malicious program offered by its developers as Malware-as-a-Service (MaaS). This piece of software is designed to cause chain infections.
Since it is used as a MaaS, both the malware it infiltrates into systems, and the attack reasons can vary - depending on the cyber criminals operating it. Matanbuchus has been observed being used in attacks against US universities and high schools, as well as a Belgian high-tech organization.
Internal MISP references
UUID e30f2243-9e69-4b09-97ab-1643929b97ad which can be used as unique global reference for Matanbuchus in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.matanbuchus - webarchive
- https://r136a1.info/2022/05/25/introduction-of-a-pe-file-extractor-for-various-situations/ - webarchive
- https://medium.com/@DCSO_CyTec/a-deal-with-the-devil-analysis-of-a-recent-matanbuchus-sample-3ce991951d6a - webarchive
- https://research.openanalysis.net/matanbuchus/loader/yara/triage/dumpulator/emulation/2022/06/19/matanbuchus-triage.html - webarchive
- https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/ - webarchive
- https://unit42.paloaltonetworks.com/matanbuchus-malware-as-a-service/ - webarchive
- https://isc.sans.edu/diary/rss/28752 - webarchive
- https://www.cybereason.com/blog/threat-analysis-msi-masquerading-as-software-installer - webarchive
- https://blog.cyble.com/2022/06/23/matanbuchus-loader-resurfaces/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Matiex
Matiex Keylogger is being sold in the underground forums, due to their gained popularity, and can also be used as MaaS (Malware-as-a-service) because of their ease of use, competitive pricing and immediate response from support.
Internal MISP references
UUID b946f5d5-6503-471a-b3cd-c6c6d6149768 which can be used as unique global reference for Matiex in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Matrix Banker
Internal MISP references
UUID 59717468-271e-4d15-859a-130681c17ddb which can be used as unique global reference for Matrix Banker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Matrix Ransom
Matrix is a ransomware that encrypts a victim's files and demands a ransom in cryptocurrency to decrypt them. It is distributed through phishing emails, hacking toolkits, and software downloaders. Matrix is a serious threat and can cause significant damage to a victim's data.
Internal MISP references
UUID 118ced99-5942-497f-885a-2b25d0569b4b which can be used as unique global reference for Matrix Ransom in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.matrix_ransom - webarchive
- https://www.blackhoodie.re/assets/archive/Matrix_Ransomware_blackhoodie.pdf - webarchive
- https://unit42.paloaltonetworks.com/matrix-ransomware/ - webarchive
- https://blogs.blackberry.com/en/2018/11/threat-spotlight-inside-vssdestroy-ransomware - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf - webarchive
- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-matrix-report.pdf - webarchive
- https://news.sophos.com/en-us/2019/01/30/matrix-targeted-small-scale-canary-in-the-coal-mine-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Matryoshka RAT
Internal MISP references
UUID c8a7c6e7-c6d3-4978-8a1d-190162de5e0d which can be used as unique global reference for Matryoshka RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Matsnu
Internal MISP references
UUID f566d597-d0c4-4932-b738-ac5774eedb7a which can be used as unique global reference for Matsnu in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Maudi
Specialized PoisonIvy Sideloader.
Internal MISP references
UUID feb5ac55-7b28-47aa-9e9e-5007d838c0d5 which can be used as unique global reference for Maudi in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Maui Ransomware
Internal MISP references
UUID 0a531358-f943-40f9-a41d-e5e7944a9619 which can be used as unique global reference for Maui Ransomware in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.maui - webarchive
- https://media.defense.gov/2023/Feb/09/2003159161/-1/-1/0/CSA_RANSOMWARE_ATTACKS_ON_CI_FUND_DPRK_ACTIVITIES.PDF - webarchive
- https://securelist.com/andariel-deploys-dtrack-and-maui-ransomware/107063/ - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-187a - webarchive
- https://stairwell.com/wp-content/uploads/2022/07/Stairwell-Threat-Report-Maui-Ransomware.pdf - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/aa22-187a-north-korean%20state-sponsored-cyber-actors-use-maui-ransomware-to-target-the-hph-sector.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Maxtrilha
Banking trojan written in Delphi, targeting customers of European and South American banks.
Internal MISP references
UUID 65799ce1-793d-4730-8d80-d829d7619dc6 which can be used as unique global reference for Maxtrilha in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Maze
Maze Ransomware encrypts files and makes them inaccessible while adding a custom extension containing part of the ID of the victim. The ransom note is placed inside a text file and an htm file. There are a few different extensions appended to files which are randomly generated.
Actors are known to exfiltrate the data from the network for further extortion. It spreads mainly using email spam and various exploit kits (Spelevo, Fallout).
The code of Maze ransomware is highly complicated and obfuscated, which helps to evade security solutions using signature-based detections.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Maze.
| Known Synonyms |
|---|
ChaCha |
Internal MISP references
UUID 266c9377-34ef-4670-afa3-28bc0ba7f44e which can be used as unique global reference for Maze in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.maze - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/ - webarchive
- https://krebsonsecurity.com/2019/12/ransomware-gangs-now-outing-victim-businesses-that-dont-pay-up/ - webarchive
- https://intel471.com/blog/conti-ransomware-cooperation-maze-lockbit-ragnar-locker - webarchive
- https://download.bitdefender.com/resources/files/News/CaseStudies/study/318/Bitdefender-TRR-Whitepaper-Maze-creat4351-en-EN-GenericUse.pdf - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/ - webarchive
- https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/ - webarchive
- https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/ - webarchive
- https://github.com/albertzsigovits/malware-notes/blob/master/Maze.md - webarchive
- https://www.crowdstrike.com/blog/maze-ransomware-deobfuscation/ - webarchive
- https://nakedsecurity.sophos.com/2020/06/04/nuclear-missile-contractor-hacked-in-maze-ransomware-attack/ - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/543/original/CTIR_casestudy_1.pdf - webarchive
- https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-village - webarchive
- https://securelist.com/targeted-ransomware-encrypting-data/99255/ - webarchive
- https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-009.pdf - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://www.bleepingcomputer.com/news/security/maze-ransomware-now-delivered-by-spelevo-exploit-kit/ - webarchive
- https://blog.chainalysis.com/reports/ransomware-connections-maze-egregor-suncrypt-doppelpaymer - webarchive
- https://research.checkpoint.com/2020/graphology-of-an-exploit-playbit/ - webarchive
- https://cti-league.com/wp-content/uploads/2021/02/CTI-League-Darknet-Report-2021.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/darkside-ransomware-made-90-million-in-just-nine-months/ - webarchive
- https://therecord.media/ransomwhere-project-wants-to-create-a-database-of-past-ransomware-payments/ - webarchive
- https://www.cityofpensacola.com/DocumentCenter/View/18879/Deloitte-Executive-Summary-PDF - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel - webarchive
- https://www.bleepingcomputer.com/news/security/crytek-confirms-egregor-ransomware-attack-customer-data-theft/ - webarchive
- https://blogs.quickheal.com/maze-ransomware-continues-threat-consumers/ - webarchive
- https://www.telsy.com/wp-content/uploads/Maze_Vaccine.pdf - webarchive
- https://github.com/albertzsigovits/malware-notes/blob/master/Ransomware/Maze.md - webarchive
- https://labs.sentinelone.com/enter-the-maze-demystifying-an-affiliate-involved-in-maze-snow/ - webarchive
- https://labs.sentinelone.com/case-study-catching-a-human-operated-maze-ransomware-attack-in-action/ - webarchive
- https://www.bleepingcomputer.com/news/security/data-leak-marketplaces-aim-to-take-over-the-extortion-economy/ - webarchive
- https://cocomelonc.github.io/tutorial/2021/09/06/simple-malware-av-evasion-2.html - webarchive
- https://id-ransomware.blogspot.com/2019/05/chacha-ransomware.html - webarchive
- https://www.bleepingcomputer.com/news/security/ransomware-dev-releases-egregor-maze-master-decryption-keys/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-2/ - webarchive
- https://www.bleepingcomputer.com/news/security/maze-ransomware-now-encrypts-via-virtual-machines-to-evade-detection/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/csi-evidence-indicators-for-targeted-ransomware-attacks-part-ii/ - webarchive
- https://blog.sensecy.com/2020/08/20/global-ransomware-attacks-in-2020-the-top-4-vulnerabilities/ - webarchive
- https://web.archive.org/save/https://news.cognizant.com/2020-04-18-cognizant-security-update - webarchive
- https://www.bleepingcomputer.com/news/security/chipmaker-maxlinear-reports-data-breach-after-maze-ransomware-attack/ - webarchive
- https://www.bleepingcomputer.com/news/security/maze-ransomware-behind-pensacola-cyberattack-1m-ransom-demand/ - webarchive
- https://www.zdnet.com/article/ransomware-gang-publishes-tens-of-gbs-of-internal-data-from-lg-and-xerox/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.docdroid.net/dUpPY5s/maze.pdf - webarchive
- https://blog.talosintelligence.com/2020/12/quarterly-ir-report-fall-2020-q4.html - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/ - webarchive
- https://media-exp1.licdn.com/dms/document/C4E1FAQHyhJYCWxq5eg/feedshare-document-pdf-analyzed/0?e=1584129600&v=beta&t=9wTDR-mZPDF4ET7ABNgE2ab9g8e9wxQrhXsxI1cSX8U - webarchive
- https://www.bleepingcomputer.com/news/security/ransomware-attackers-use-your-cloud-backups-against-you/ - webarchive
- https://blog.talosintelligence.com/2019/12/IR-Lessons-Maze.html - webarchive
- https://securityaffairs.co/wordpress/127826/malware/egregor-sekhmet-decryption-keys.html - webarchive
- https://www.bleepingcomputer.com/news/security/allied-universal-breached-by-maze-ransomware-stolen-data-leaked/ - webarchive
- https://www.fireeye.com/blog/threat-research/2020/07/financially-motivated-actors-are-expanding-access-into-ot.html - webarchive
- https://ke-la.com/to-attack-or-not-to-attack-targeting-the-healthcare-sector-in-the-underground-ecosystem/ - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://ke-la.com/zooming-into-darknet-threats-targeting-jp-orgs-kela/ - webarchive
- https://download.microsoft.com/download/f/8/1/f816b8b6-bee3-41e5-b6cc-e925a5688f61/Microsoft_Digital_Defense_Report_2020_September.pdf - webarchive
- https://news.sophos.com/en-us/2020/12/08/egregor-ransomware-mazes-heir-apparent/ - webarchive
- https://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/ - webarchive
- https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-village - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/ - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/wp-spark-state-of-ransomware.pdf - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-345a - webarchive
- https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html - webarchive
- https://www.bleepingcomputer.com/news/security/maze-ransomware-is-shutting-down-its-cybercrime-operation/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/maze-ransomware-releases-files-stolen-from-city-of-pensacola/ - webarchive
- https://www.domaintools.com/resources/blog/the-most-prolific-ransomware-families-a-defenders-guide - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/escape-from-the-maze/ - webarchive
- https://statescoop.com/baltimore-ransomware-crowdstrike-extortion/ - webarchive
- https://blog.minerva-labs.com/egregor-ransomware-an-in-depth-analysis - webarchive
- https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-009/ - webarchive
- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/ - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1 - webarchive
- https://research.checkpoint.com/2023/following-the-scent-of-trickgate-6-year-old-packer-used-to-deploy-the-most-wanted-malware/ - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/evolving-danger-ransomware-extortion - webarchive
- https://oag.ca.gov/system/files/Letter%204.pdf - webarchive
- https://www.crowdstrike.com/blog/ransomware-preparedness-a-call-to-action/ - webarchive
- https://news.sophos.com/en-us/2020/09/22/mtr-casebook-blocking-a-15-million-maze-ransomware-attack/ - webarchive
- https://securelist.com/maze-ransomware/99137/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf - webarchive
- https://www.proofpoint.com/us/threat-insight/post/ta2101-plays-government-imposter-distribute-malware-german-italian-and-us - webarchive
- https://blog.redteam.pl/2020/05/sodinokibi-revil-ransomware.html - webarchive
- https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-007/ - webarchive
- https://adversary.crowdstrike.com/adversary/twisted-spider/ - webarchive
- https://blog.talosintelligence.com/2020/09/CTIR-quarterly-trends-Q4-2020.html - webarchive
- https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/ - webarchive
- https://www.mandiant.com/resources/financially-motivated-actors-are-expanding-access-into-ot - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware - webarchive
- https://www.zataz.com/cyber-attaque-a-lencontre-des-serveurs-de-bouygues-construction/ - webarchive
- https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/ - webarchive
- https://sites.temple.edu/care/ci-rw-attacks/ - webarchive
- https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf - webarchive
- https://news.sophos.com/en-us/2020/09/17/maze-attackers-adopt-ragnar-locker-virtual-machine-technique/ - webarchive
- https://techcrunch.com/2020/03/26/chubb-insurance-breach-ransomware/ - webarchive
- https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf - webarchive
- https://killbit.medium.com/applying-the-diamond-model-to-cognizant-msp-and-maze-ransomware-and-a-policy-assessment-498f01bd723f - webarchive
- https://twitter.com/certbund/status/1192756294307995655 - webarchive
- https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html - webarchive
- https://www.trendmicro.com/en_us/research/20/l/the-impact-of-modern-ransomware-on-manufacturing-networks.html - webarchive
- https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/ - webarchive
- https://www.brighttalk.com/webcast/7451/408167/navigating-maze-analysis-of-a-rising-ransomware-threat - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MBRlock
This ransomware modifies the master boot record of the victim's computer so that it shows a ransom note before Windows starts.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MBRlock.
| Known Synonyms |
|---|
DexLocker |
Internal MISP references
UUID 41177275-7e6d-4ebd-a4df-d2cc733f7791 which can be used as unique global reference for MBRlock in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mbrlock - webarchive
- http://id-ransomware.blogspot.com.tr/2018/02/mbrlock-hax-ransomware.html - webarchive
- https://app.any.run/tasks/0a7e643f-7562-4575-b8a5-747bd6b5f02d - webarchive
- https://www.hybrid-analysis.com/sample/dfc56a704b5e031f3b0d2d0ea1d06f9157758ad950483b44ac4b77d33293cb38?environmentId=100 - webarchive
- https://www.bleepingcomputer.com/news/security/dexcrypt-mbrlocker-demands-30-yuan-to-gain-access-to-computer/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MBR Locker
Ransomware overwriting the system's MBR, making it impossible to boot into Windows.
Internal MISP references
UUID 1f7fc94c-218a-4571-85b6-5667544bf230 which can be used as unique global reference for MBR Locker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mebromi
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mebromi.
| Known Synonyms |
|---|
MyBios |
Internal MISP references
UUID 342be00c-cf68-45a6-8f90-3a2d2d20bda6 which can be used as unique global reference for Mebromi in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mebromi - webarchive
- http://www.theregister.co.uk/2011/09/14/bios_rootkit_discovered/ - webarchive
- https://www.webroot.com//blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/ - webarchive
- https://www.symantec.com/connect/blogs/bios-threat-showing-again - webarchive
- http://contagiodump.blogspot.com/2011/09/mebromi-bios-rootkit-affecting-award.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MECHANICAL
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MECHANICAL.
| Known Synonyms |
|---|
GoldStamp |
Internal MISP references
UUID cd055701-89ad-41be-b4d9-69460876fdee which can be used as unique global reference for MECHANICAL in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mechanical - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-301a - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Medre
Internal MISP references
UUID 243ae1f7-183e-4ea9-82cf-3353a0ef78f4 which can be used as unique global reference for Medre in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Medusa (Windows)
Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predecessor made use of IRC.
Internal MISP references
UUID 237a1c2d-eb14-483d-9a2e-82f10b63ec06 which can be used as unique global reference for Medusa (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.medusa - webarchive
- https://news.drweb.com/show/?i=10302&lng=en - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://zerophagemalware.com/2017/10/13/rig-ek-via-malvertising-drops-a-miner/ - webarchive
- https://www.arbornetworks.com/blog/asert/medusahttp-ddos-slithers-back-spotlight/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MedusaLocker
A Windows ransomware that will run certain tasks to prepare the target system for the encryption of files. MedusaLocker avoids executable files, probably to avoid rendering the targeted system unusable for paying the ransom. It uses a combination of AES and RSA-2048, and reportedly appends extensions such as .encrypted, .bomber, .boroff, .breakingbad, .locker16, .newlock, .nlocker, and .skynet.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MedusaLocker.
| Known Synonyms |
|---|
AKO Doxware |
AKO Ransomware |
MedusaReborn |
Internal MISP references
UUID 77e7221f-d3db-4d13-bcde-e6d7a494f424 which can be used as unique global reference for MedusaLocker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.medusalocker - webarchive
- https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/ - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1 - webarchive
- https://asec.ahnlab.com/en/48940/ - webarchive
- https://id-ransomware.blogspot.com/2020/01/ako-ransomware.html - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-181a - webarchive
- https://twitter.com/siri_urz/status/1215194488714346496?s=20 - webarchive
- https://www.bleepingcomputer.com/news/security/march-2023-broke-ransomware-attack-records-with-459-incidents/ - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://www.theta.co.nz/news-blogs/cyber-security-blog/part-3-analysing-medusalocker-ransomware/ - webarchive
- https://www.theta.co.nz/news-blogs/cyber-security-blog/part-1-analysing-medusalocker-ransomware/ - webarchive
- https://www.cybereason.com/blog/medusalocker-ransomware - webarchive
- https://blog.cyble.com/2023/03/15/unmasking-medusalocker-ransomware/ - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-2/ - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/wp-spark-state-of-ransomware.pdf - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-345a - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-181A_stopransomware_medusalocker.pdf - webarchive
- https://dissectingmalwa.re/try-not-to-stare-medusalocker-at-a-glance.html - webarchive
- http://id-ransomware.blogspot.com/2019/10/medusalocker-ransomware.html - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/ - webarchive
- https://www.theta.co.nz/news-blogs/cyber-security-blog/part-2-analysing-medusalocker-ransomware/ - webarchive
- https://www.mandiant.com/resources/chasing-avaddon-ransomware - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/ - webarchive
- https://blog.talosintelligence.com/2020/04/medusalocker.html - webarchive
- https://www.carbonblack.com/2020/06/03/tau-threat-analyis-medusa-locker-ransomware/ - webarchive
- https://cloudsek.com/technical-analysis-of-medusalocker-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Meduza Stealer
Internal MISP references
UUID 20edd63e-d1a8-4aae-a0a6-50f5bb1cf65f which can be used as unique global reference for Meduza Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.meduza - webarchive
- https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-meduza-f1bbd2efb84f - webarchive
- https://www.zerofox.com/blog/the-underground-economist-volume-3-issue-12/ - webarchive
- https://russianpanda.com/2023/06/28/Meduza-Stealer-or-The-Return-of-The-Infamous-Aurora-Stealer/ - webarchive
- https://cert.gov.ua/article/6276652 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MegaCortex
Megacortex is a ransomware used in targeted attacks against corporations. Once the ransomware is run it tries to stop security related services and after that it starts its own encryption process adding a .aes128ctr or .megac0rtx extension to the encrypted files. It is used to be carried from downloaders and trojans, it has no own propagation capabilities.
Internal MISP references
UUID 3f09884e-dddc-4513-8720-a28fe21ab9a8 which can be used as unique global reference for MegaCortex in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.megacortex - webarchive
- https://www.fireeye.com/blog/threat-research/2020/07/financially-motivated-actors-are-expanding-access-into-ot.html - webarchive
- https://blog.malwarebytes.com/detections/ransom-megacortex/ - webarchive
- https://news.sophos.com/en-us/2019/05/03/megacortex-ransomware-wants-to-be-the-one/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/incident-response-polar-ransomware-apt27/ - webarchive
- https://threatpost.com/megacortex-ransomware-mass-distribution/146933/ - webarchive
- https://www.npu.gov.ua/news/kiberzlochini/kiberpolicziya-vikrila-transnaczionalne-zlochinne-ugrupovannya-u-nanesenni-inozemnim-kompaniyam-120-miljoniv-dolariv-zbitkiv/ - webarchive
- https://news.sophos.com/en-us/2019/05/10/megacortex-deconstructed-mysteries-mount-as-analysis-continues/ - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.europol.europa.eu/newsroom/news/12-targeted-for-involvement-in-ransomware-attacks-against-critical-infrastructure - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf - webarchive
- https://www.trendmicro.com/vinfo/pl/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/csi-evidence-indicators-for-targeted-ransomware-attacks-part-ii/ - webarchive
- https://www.mandiant.com/resources/financially-motivated-actors-are-expanding-access-into-ot - webarchive
- https://www.computing.co.uk/ctg/news/3084818/warning-over-lockergoga-and-megacortex-ransomware-attacks-targeting-private-industry-in-western-countries - webarchive
- https://www.bleepingcomputer.com/news/security/new-megacortex-ransomware-changes-windows-passwords-threatens-to-publish-data/ - webarchive
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/ - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://www.bleepingcomputer.com/news/security/elusive-megacortex-ransomware-found-here-is-what-we-know/ - webarchive
- https://www.bleepingcomputer.com/news/security/fbi-issues-alert-for-lockergoga-and-megacortex-ransomware/ - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://www.bleepingcomputer.com/news/security/bitdefender-releases-free-megacortex-ransomware-decryptor/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MegaCreep
Internal MISP references
UUID 394ddd91-b673-4607-b253-fe19b98008b5 which can be used as unique global reference for MegaCreep in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MeguminTrojan
Megumin Trojan, is a malware focused on multiple fields (DDoS, Miner, Loader, Clipper).
Internal MISP references
UUID 76cd241a-c265-4a33-8ce7-db2d3647b489 which can be used as unique global reference for MeguminTrojan in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mekotio
Internal MISP references
UUID bfebb298-66e3-4250-82e8-910b7dd8618c which can be used as unique global reference for Mekotio in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mekotio - webarchive
- http://www.interior.gob.es/prensa/noticias/-/asset_publisher/GHU8Ap6ztgsg/content/id/13552853 - webarchive
- https://threatresearch.ext.hp.com/wp-content/uploads/2022/05/HP-Wolf-Security-Threat-Insights-Report-Q1-2022.pdf - webarchive
- https://www.microsoft.com/security/blog/2021/11/11/html-smuggling-surges-highly-evasive-loader-technique-increasingly-used-in-banking-malware-targeted-attacks/ - webarchive
- https://therecord.media/spain-arrests-16-for-distributing-the-mekotio-and-grandoreiro-banking-trojans/ - webarchive
- https://www.advintel.io/post/economic-growth-digital-inclusion-specialized-crime-financial-cyber-fraud-in-latam - webarchive
- https://www.welivesecurity.com/2020/08/13/mekotio-these-arent-the-security-updates-youre-looking-for/ - webarchive
- https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/rooty-dolphin-uses-mekotio-to-target-bank-clients-in-south-america-and-europe/ - webarchive
- https://twitter.com/hpsecurity/status/1509185858146082816 - webarchive
- https://research.checkpoint.com/2021/mekotio-banker-returns-with-improved-stealth-and-ancient-encryption/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Melcoz
Internal MISP references
UUID e3e289bb-3ac2-4f93-becd-540720501884 which can be used as unique global reference for Melcoz in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Meow
According to PCrisk, MEOW is ransomware based on other ransomware called CONTI. MEOW encrypts files and appends the ".MEOW" extension to their filenames. It also drops the "readme.txt" file (a ransom note). An example of how MEOW ransomware modifies filenames: it renames "1.jpg" to "1.jpg.MEOW", "2.png" to "2.png.MEOW", and so forth.
Internal MISP references
UUID ee27ec81-3c41-4562-ae6b-58a7ce6f0485 which can be used as unique global reference for Meow in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MercurialGrabber
Internal MISP references
UUID 5fa45856-2960-47c4-ad73-df0ff142ae12 which can be used as unique global reference for MercurialGrabber in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Merdoor
Internal MISP references
UUID bf604927-77df-46e5-9bdb-ee9b631461a2 which can be used as unique global reference for Merdoor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Merlin
Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.
Internal MISP references
UUID 427e4b41-adf6-4d4d-a83f-6d96b5ab4a3e which can be used as unique global reference for Merlin in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.merlin - webarchive
- http://lockboxx.blogspot.com/2018/02/intro-to-using-gscript-for-red-teams.html - webarchive
- https://michaelkoczwara.medium.com/hunting-c2-with-shodan-223ca250d06f - webarchive
- https://github.com/Ne0nd0g/merlin - webarchive
- https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ - webarchive
- http://lockboxx.blogspot.com/2018/02/merlin-for-red-teams.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mespinoza
Mespinosa is a ransomware which encrypts file using an asymmetric encryption and adds .pysa as file extension. According to dissectingmalware the extension "pysa" is probably derived from the Zanzibari Coin with the same name.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mespinoza.
| Known Synonyms |
|---|
pysa |
Internal MISP references
UUID 68a7ca8e-2902-43f2-ad23-a77b4c48221d which can be used as unique global reference for Mespinoza in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mespinoza - webarchive
- https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/ - webarchive
- https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/ - webarchive
- https://www.hhs.gov/sites/default/files/mespinoza-goldburlap-cyborgspider-analystnote-tlpwhite.pdf - webarchive
- https://blogs.blackberry.com/en/2021/06/pysa-loves-chachi-a-new-golang-rat - webarchive
- https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/ - webarchive
- https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html - webarchive
- https://www.sentinelone.com/blog/from-the-front-lines-peering-into-a-pysa-ransomware-attack/ - webarchive
- https://www.prodaft.com/m/reports/PYSA_TLPWHITE_3.0.pdf - webarchive
- https://www.cert.ssi.gouv.fr/cti/CERTFR-2020-CTI-002/ - webarchive
- https://blog.cyble.com/2021/11/29/pysa-ransomware-under-the-lens-a-deep-dive-analysis/ - webarchive
- https://www.lacework.com/blog/pysa-ransomware-gang-adds-linux-support/ - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/ - webarchive
- https://unit42.paloaltonetworks.com/gasket-and-magicsocks-tools-install-mespinoza-ransomware/ - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-burlap - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-inside-the-destructive-pysa-ransomware - webarchive
- https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://securelist.com/modern-ransomware-groups-ttps/106824/ - webarchive
- https://id-ransomware.blogspot.com/2019/10/mespinoza-ransomware.html - webarchive
- https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ - webarchive
- https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/ - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf - webarchive
- https://twitter.com/inversecos/status/1456486725664993287 - webarchive
- https://twitter.com/campuscodi/status/1347223969984897026 - webarchive
- https://dissectingmalwa.re/another-one-for-the-collection-mespinoza-pysa-ransomware.html - webarchive
- https://www.ic3.gov/Media/News/2021/210316.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.zdnet.com/article/france-warns-of-new-ransomware-gang-targeting-local-governments/ - webarchive
- https://www.prodaft.com/resource/detail/pysa-ransomware-group-depth-analysis - webarchive
- https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/ransomware-gangs-script-shows-exactly-the-files-theyre-after/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MetadataBin
Ransomware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MetadataBin.
| Known Synonyms |
|---|
Ransomware32 |
Internal MISP references
UUID 750c5b2c-1489-4e11-b21d-c49b651d9227 which can be used as unique global reference for MetadataBin in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
METALJACK
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular METALJACK.
| Known Synonyms |
|---|
denesRAT |
Internal MISP references
UUID 64304fcc-5bc8-4000-9be2-4fc7a482897a which can be used as unique global reference for METALJACK in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.metaljack - webarchive
- https://www.secrss.com/articles/17900 - webarchive
- https://www.youtube.com/watch?v=ftjDH65kw6E - webarchive
- https://ti.qianxin.com/blog/articles/coronavirus-analysis-of-global-outbreak-related-cyber-attacks/ - webarchive
- https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html - webarchive
- https://s.tencent.com/research/report/944.html - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2020-1110.pdf - webarchive
- https://m.threatbook.cn/detail/2527 - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://blog.viettelcybersecurity.com/apt32-deobfuscation-arsenal-deobfuscating-mot-vai-loai-obfucation-toolkit-cua-apt32-phan-1/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Metamorfo
According to BitDefender, Metamorfo is a family of banker Trojans that has been active since mid-2018. It primarily targets Brazilians and is delivered mostly through Office files rigged with macros in spam attachments. Metamorfo is a potent piece of malware, whose primary capability is theft of banking information and other personal data from the user and exfiltration of it to the C2 server.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Metamorfo.
| Known Synonyms |
|---|
Casbaneiro |
Internal MISP references
UUID 18dc3e7a-600d-4e5f-a283-86156b938530 which can be used as unique global reference for Metamorfo in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.metamorfo - webarchive
- https://twitter.com/MsftSecIntel/status/1418706916922986504 - webarchive
- https://cofense.com/blog/autohotkey-banking-trojan/ - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/333/Bitdefender-PR-Whitepaper-Metamorfo-creat4500-en-EN-GenericUse.pdf - webarchive
- https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerou - webarchive
- https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html - webarchive
- https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767 - webarchive
- https://github.com/jeFF0Falltrades/IoCs/blob/master/Broadbased/metamorfo.md - webarchive
- https://blog.talosintelligence.com/2018/11/metamorfo-brazilian-campaigns.html - webarchive
- https://umbrella.cisco.com/blog/navigating-cybersecurity-during-a-pandemic-latest-malware-and-threat-actors - webarchive
- https://www.advintel.io/post/economic-growth-digital-inclusion-specialized-crime-financial-cyber-fraud-in-latam - webarchive
- https://blog.ensilo.com/metamorfo-avast-abuser - webarchive
- https://www.botconf.eu/wp-content/uploads/2019/12/B2019-Soucek-Hornak-DemystifyingBankingTrojansFromLatinAmerica.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MetaStealer
On March 7, 2022, KELA observed a threat actor named META announcing the launch of META – a new information-stealing malware, available for sale for USD125 per month or USD1000 for unlimited use. The actor claimed it has the same functionality, code, and panel as the Redline stealer, but with several improvements.
Internal MISP references
UUID 9b7758fc-2fca-4b07-b669-34461fc95a67 which can be used as unique global reference for MetaStealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.metastealer - webarchive
- https://russianpanda.com/2023/11/20/MetaStealer-Redline's-Doppelganger/ - webarchive
- https://ke-la.com/information-stealers-a-new-landscape/ - webarchive
- https://medium.com/walmartglobaltech/metastealer-string-decryption-and-dga-overview-5f38f76830cd - webarchive
- https://www.accenture.com/us-en/blogs/security/information-stealer-malware-on-dark-web - webarchive
- https://research.nccgroup.com/2022/05/20/metastealer-filling-the-racoon-void/ - webarchive
- https://russianpanda.com/2023/12/28/MetaStealer-Part-2/ - webarchive
- https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem - webarchive
- https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-meta-8ae628dfab8c - webarchive
- https://isc.sans.edu/forums/diary/Windows+MetaStealer+Malware/28522/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Meteor
A wiper used in an attack against the Iranian train system.
Internal MISP references
UUID 066250ee-9279-47ad-b289-e266ede11921 which can be used as unique global reference for Meteor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.meteor - webarchive
- https://threatpost.com/novel-meteor-wiper-used-in-attack-that-crippled-iranian-train-system/168262/ - webarchive
- https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/ - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/ - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/ - webarchive
- https://labs.sentinelone.com/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll/ - webarchive
- https://twitter.com/cpresearch/status/1541753913732366338 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Meterpreter (Windows)
Internal MISP references
UUID 13a5c0ae-8e2d-4a38-8b6c-7d746e159991 which can be used as unique global reference for Meterpreter (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.meterpreter - webarchive
- https://www.countercraftsec.com/blog/post/shellcode-detection-using-realtime-kernel-monitoring/ - webarchive
- https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/China/APT/Chimera/Analysis.md - webarchive
- https://securelist.com/tomiris-called-they-want-their-turla-malware-back/109552/ - webarchive
- https://www.recordedfuture.com/chinese-group-calypso-exploiting-microsoft-exchange/ - webarchive
- https://www.wired.com/story/russias-fancy-bear-hack-us-federal-agency/ - webarchive
- http://schierlm.users.sourceforge.net/avevasion.html - webarchive
- https://securelist.com/shedding-skin-turlas-fresh-faces/88069/ - webarchive
- https://asec.ahnlab.com/ko/26705/ - webarchive
- https://blog.morphisec.com/fin7-attacks-restaurant-industry - webarchive
- https://www.cynet.com/attack-techniques-hands-on/threats-looming-over-the-horizon/ - webarchive
- https://www.first.org/resources/papers/conf2023/FIRSTCON23-TLPCLEAR-Staubmann-Busy-Bees.pptx - webarchive
- https://www.bleepingcomputer.com/news/security/log4j-vulnerability-now-used-to-install-dridex-banking-malware/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/how-cybercriminals-abuse-cloud-tunneling-services - webarchive
- https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis - webarchive
- https://asec.ahnlab.com/en/56236/ - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-franklin - webarchive
- https://explore.group-ib.com/htct/hi-tech_crime_2018 - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0107.pdf - webarchive
- https://vx-underground.org/archive/APTs/2017/2017.12.11/Money%20Taker.pdf - webarchive
- https://news.sophos.com/en-us/2021/06/02/amsi-bypasses-remain-tricks-of-the-malware-trade/ - webarchive
- https://michaelkoczwara.medium.com/hunting-c2-with-shodan-223ca250d06f - webarchive
- https://research.checkpoint.com/2022/bumblebee-increasing-its-capacity-and-evolving-its-ttps/ - webarchive
- https://thedfirreport.com/2022/09/26/bumblebee-round-two/ - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-abusing-notepad-plugins-for-evasion-and-persistence - webarchive
- https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealthy-malware-targeting-linux - webarchive
- https://blog.lumen.com/no-longer-just-theory-black-lotus-labs-uncovers-linux-executables-deployed-as-stealth-windows-loaders/ - webarchive
- https://redcanary.com/blog/getsystem-offsec/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/chasing-currents-espionage-south-china-sea - webarchive
- https://blog.talosintelligence.com/2022/05/mustang-panda-targets-europe.html - webarchive
- https://cybleinc.com/2020/11/17/oceanlotus-continues-with-its-cyber-espionage-operations/ - webarchive
- https://news.sophos.com/en-us/2022/08/18/cookie-stealing-the-new-perimeter-bypass - webarchive
- https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/ - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-winter - webarchive
- https://unit42.paloaltonetworks.com/atoms/obscureserpens/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-301a - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-268a - webarchive
- https://securityintelligence.com/posts/trickbot-group-systematically-attacking-ukraine - webarchive
- https://www.fintechsecurity.com.hk/slides/01.Dmitry-Annual-Group-IB-report-High-Tech-Crime-Trends.pdf - webarchive
- https://www.cisa.gov/sites/default/files/2023-09/aa23-250a-apt-actors-exploit-cve-2022-47966-and-cve-2022-42475.pdf - webarchive
- https://asec.ahnlab.com/en/53046/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mevade
A botnet that used Tor .onion links for C&C.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mevade.
| Known Synonyms |
|---|
SBC |
Sefnit |
Internal MISP references
UUID 3454bd71-29e1-498b-82d8-111aeadedee5 which can be used as unique global reference for Mevade in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mevade - webarchive
- https://www.youtube.com/watch?v=FttiysUZmDw - webarchive
- https://blog.fox-it.com/2013/09/05/large-botnet-cause-of-recent-tor-network-overload/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/sefnit-trojan-just/ - webarchive
- https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mewsei
Internal MISP references
UUID 48cb12ee-c60a-46cd-b376-39226027c616 which can be used as unique global reference for Mewsei in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MgBot
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MgBot.
| Known Synonyms |
|---|
BLame |
MgmBot |
Internal MISP references
UUID d97c2c0c-ef3a-4512-846a-f4cdeee7787a which can be used as unique global reference for MgBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mgbot - webarchive
- https://blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat/ - webarchive
- https://vb2020.vblocalhost.com/uploads/VB2020-43.pdf - webarchive
- https://www.youtube.com/watch?v=LeKi0KfzOow&list=PLffioUnqXWkdzWcZXH-bzPVgcs2R4r7iS&index=1&t=2154s - webarchive
- https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware - webarchive
- https://www.welivesecurity.com/2023/04/26/evasive-panda-apt-group-malware-updates-popular-chinese-software/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/ - webarchive
- https://twitter.com/GossiTheDog/status/1438500100238577670 - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/apt-attacks-telecoms-africa-mgbot - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Miancha
Internal MISP references
UUID a3370013-6c47-422e-a4d4-1b86ee71e5e5 which can be used as unique global reference for Miancha in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Micrass
Internal MISP references
UUID 6c09cc53-7160-47c6-8df8-3e0d42deb5a6 which can be used as unique global reference for Micrass in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MicroBackdoor
Open-source lightweight backdoor for C2 communication. GitHub: https://github.com/Cr4sh/MicroBackdoor
Internal MISP references
UUID 07c7b7dc-cec8-4542-b351-ce7d757812d7 which can be used as unique global reference for MicroBackdoor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.microbackdoor - webarchive
- https://github.com/cr4sh/microbackdoor - webarchive
- https://ti.qianxin.com/blog/articles/Analysis-of-attack-activities-of-suspected-aptorganization-unc1151-against-ukraine-and-other-countries/ - webarchive
- https://inquest.net/blog/2022/04/07/ukraine-cyberwar-overview - webarchive
- https://www.mandiant.com/resources/spear-phish-ukrainian-entities - webarchive
- https://cert.gov.ua/article/37626 - webarchive
- https://cip.gov.ua/en/news/khto-stoyit-za-kiberatakami-na-ukrayinsku-kritichnu-informaciinu-infrastrukturu-statistika-15-22-bereznya - webarchive
- https://attackiq.com/2022/04/29/attack-graph-response-to-unc1151-continued-targeting-of-ukraine/ - webarchive
- https://www.cybercom.mil/Media/News/Article/3098856/cyber-national-mission-force-discloses-iocs-from-ukrainian-networks/ - webarchive
- https://cluster25.io/2022/03/08/ghostwriter-unc1151-adopts-microbackdoor-variants-in-cyber-operations-against-targets-in-ukraine/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Microcin
Internal MISP references
UUID 185d8b28-0179-4ec6-a3c8-201b1936b9aa which can be used as unique global reference for Microcin in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.microcin - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07170759/Microcin_Technical_4PDF_eng_final_s.pdf - webarchive
- https://securelist.com/microcin-is-here/97353/ - webarchive
- https://www.welivesecurity.com/2020/05/14/mikroceen-spying-backdoor-high-profile-networks-central-asia/ - webarchive
- https://securelist.com/microcin-is-here/97353 - webarchive
- https://www.welivesecurity.com/2020/05/14/mikroceen-spying-backdoor-high-profile-networks-central-asia - webarchive
- https://securelist.com/a-simple-example-of-a-complex-cyberattack/82636 - webarchive
- https://securelist.com/a-simple-example-of-a-complex-cyberattack/82636/ - webarchive
- https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://securelist.com/apt-trends-report-q2-2019/91897/ - webarchive
- https://github.com/dlegezo/common - webarchive
- https://decoded.avast.io/luigicamastra/apt-group-planted-backdoors-targeting-high-profile-networks-in-central-asia/ - webarchive
- https://decoded.avast.io/luigicamastra/apt-group-planted-backdoors-targeting-high-profile-networks-in-central-asia - webarchive
- https://st.drweb.com/static/new-www/news/2020/july/Study_of_the_APT_attacks_on_state_institutions_in_Kazakhstan_and_Kyrgyzstan_en.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Micropsia
This malware written in Delphi is an information stealing malware family dubbed "MICROPSIA". It has s wide range of data theft functionality built in.
Internal MISP references
UUID b37f312f-a0b1-41a9-88ae-da2844c19cae which can be used as unique global reference for Micropsia in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.micropsia - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/mantis-palestinian-attacks - webarchive
- https://blog.talosintelligence.com/2022/02/arid-viper-targets-palestine.html - webarchive
- http://blog.talosintelligence.com/2017/06/palestine-delphi.html - webarchive
- http://researchcenter.paloaltonetworks.com/2017/04/unit42-targeted-attacks-middle-east-using-kasperagent-micropsia/ - webarchive
- https://github.com/jeFF0Falltrades/IoCs/blob/master/APT/micropsia_apt_c_23.md - webarchive
- https://research.checkpoint.com/apt-attack-middle-east-big-bang/ - webarchive
- https://about.fb.com/wp-content/uploads/2021/04/Technical-threat-report-Arid-Viper-April-2021.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Midas
This malware written in C# is a variant of the Thanos ransomware family and emerged in October 2021 and is obfuscated using SmartAssembly. In 2022, ThreatLabz analysed a report of Midas ransomware was slowly deployed over a two month period (ZScaler). This ransomware features also its own data leak site as part of its double extortion strategy.
Internal MISP references
UUID e5043a7f-2c38-4015-978e-253a7cdbda97 which can be used as unique global reference for Midas in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.midas - webarchive
- https://securityboulevard.com/2022/03/midas-ransomware-tracing-the-evolution-of-thanos-ransomware-variants/ - webarchive
- https://www.zscaler.com/blogs/security-research/midas-ransomware-tracing-evolution-thanos-ransomware-variants - webarchive
- https://news.sophos.com/en-us/2022/01/25/windows-services-lay-the-groundwork-for-a-midas-ransomware-attack/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mikoponi
Internal MISP references
UUID 87abb59d-0012-4d45-9e75-136372b25bf8 which can be used as unique global reference for Mikoponi in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Milan
Internal MISP references
UUID 5b1fe92d-9a78-4543-8efb-7c674492d0d2 which can be used as unique global reference for Milan in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MILKMAID
Internal MISP references
UUID 801d8a6a-b7ba-4557-af5d-1005e53145e2 which can be used as unique global reference for MILKMAID in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Milum
In August 2019, Kaspersky Labs discovered a malware they dubbed Milum (naming based on internal file name fragments) when investigating an operation they named WildPressure. It is written in C++ using STL, primarily to parse JSON. Functionality includes bidirectional file transmission and remote command execution.
Internal MISP references
UUID d1942959-9c6f-462b-87bf-da6ed914669d which can be used as unique global reference for Milum in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.milum - webarchive
- https://securelist.com/wildpressure-targets-industrial-in-the-middle-east/96360/ - webarchive
- https://securelist.com/wildpressure-targets-macos/103072/ - webarchive
- https://ics-cert.kaspersky.com/media/KASPERSKY_H1_2020_ICS_REPORT_EN.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
mim221
Internal MISP references
UUID 83ebded5-6ce5-471a-9bfe-db7cca6b3756 which can be used as unique global reference for mim221 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mimic Ransomware
According to PCrisk, Mimic is a ransomware-type program. Malware within this classification is designed to encrypt data and demand ransoms for decryption. Evidence suggests that Mimic is based on the leaked CONTI ransomware builder. Mimic campaigns have been observed targeting English and Russian speaking users.
Internal MISP references
UUID 40e57c70-c83b-4820-87fd-f684f4960268 which can be used as unique global reference for Mimic Ransomware in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MimiKatz
Varonis summarizes Mimikatz as an open-source application that allows users to view and save authentication credentials like Kerberos tickets. Benjamin Delpy continues to lead Mimikatz developments, so the toolset works with the current release of Windows and includes the most up-to-date attacks.
Attackers commonly use Mimikatz to steal credentials and escalate privileges: in most cases, endpoint protection software and anti-virus systems will detect and delete it. Conversely, pentesters use Mimikatz to detect and exploit vulnerabilities in your networks so you can fix them.
Internal MISP references
UUID 588fb91d-59c6-4667-b299-94676d48b17b which can be used as unique global reference for MimiKatz in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mimikatz - webarchive
- https://www.esentire.com/security-advisories/ransomware-hackers-attack-a-top-safety-testing-org-using-tactics-and-techniques-borrowed-from-chinese-espionage-groups - webarchive
- https://bitdefender.com/files/News/CaseStudies/study/332/Bitdefender-Whitepaper-Chafer-creat4491-en-EN-interactive.pdf - webarchive
- https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/incident-response-polar-ransomware-apt27/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-drake - webarchive
- https://lab52.io/blog/the-energy-reserves-in-the-eastern-mediterranean-sea-and-a-malicious-campaign-of-apt10-against-turkey/ - webarchive
- https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks - webarchive
- https://www.trendmicro.com/en_us/research/21/i/examining-the-cring-ransomware-techniques.html - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/witchetty-steganography-espionage - webarchive
- https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis - webarchive
- https://asec.ahnlab.com/en/56236/ - webarchive
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=5758557d-6e3a-4174-90f3-fa92a712ecd9&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments - webarchive
- https://raw.githubusercontent.com/yt0ng/cracking_softcell/main/Cracking_SOFTCLL_TLP_WHITE.pdf - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.slideshare.net/yurikamuraki5/active-directory-240348605 - webarchive
- https://blog.xpnsec.com/exploring-mimikatz-part-1/ - webarchive
- https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/ - webarchive
- https://www.wired.com/story/chinese-hackers-taiwan-semiconductor-industry-skeleton-key/ - webarchive
- https://hub.dragos.com/hubfs/116-Whitepapers/Dragos_Intel_WP_InitAccess-IndEnvirons-Final.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/tin-woodlawn - webarchive
- https://www.verfassungsschutz.de/download/broschuere-2021-01-bfv-cyber-brief-2021-01.pdf - webarchive
- https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf - webarchive
- https://www.verfassungsschutz.de/embed/broschuere-2020-06-bfv-cyber-brief-2020-01.pdf - webarchive
- https://ics-cert.kaspersky.com/media/KASPERSKY_Steganography_in_targeted_attacks_EN.pdf - webarchive
- https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/china-apt-antlion-taiwan-financial-attacks - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-kingswood - webarchive
- https://www.welivesecurity.com/2022/09/06/worok-big-picture/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-275a - webarchive
- https://www.zdnet.com/article/fbi-says-an-iranian-hacking-group-is-attacking-f5-networking-devices/ - webarchive
- https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/Vorfaelle/Exchange-Schwachstellen-2021/MSExchange_Schwachstelle_Detektion_Reaktion.pdf - webarchive
- https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf - webarchive
- https://attack.mitre.org/groups/G0011 - webarchive
- https://www.crowdstrike.com/blog/overwatch-elite-call-escalation-vital-to-containing-attack/ - webarchive
- https://www.hvs-consulting.de/lazarus-report/ - webarchive
- https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-152a - webarchive
- https://unit42.paloaltonetworks.com/atoms/obscureserpens/ - webarchive
- https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-ransomexx - webarchive
- https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/operation-harvest-a-deep-dive-into-a-long-term-campaign/ - webarchive
- https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions - webarchive
- https://thedfirreport.com/2020/08/31/netwalker-ransomware-in-1-hour/ - webarchive
- https://www.accenture.com/us-en/blogs/security/ransomware-hades - webarchive
- https://attack.mitre.org/groups/G0096 - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-vinewood - webarchive
- https://attack.mitre.org/groups/G0034 - webarchive
- http://blog.gentilkiwi.com/securite/un-observateur-evenements-aveugle - webarchive
- https://www.crowdstrike.com/blog/credential-theft-mimikatz-techniques/ - webarchive
- https://awakesecurity.com/blog/catching-the-white-stork-in-flight/ - webarchive
- https://www.secureworks.com/blog/ongoing-campaign-leveraging-exchange-vulnerability-potentially-linked-to-iran - webarchive
- https://yoroi.company/research/shadows-from-the-past-threaten-italian-enterprises/ - webarchive
- https://twitter.com/swisscom_csirt/status/1354052879158571008 - webarchive
- https://paraflare.com/attack-lifecycle-detection-of-an-operational-technology-breach/ - webarchive
- https://medium.com/cycraft/taiwan-high-tech-ecosystem-targeted-by-foreign-apt-group-5473d2ad8730 - webarchive
- https://www.sentinelone.com/blog/detecting-a-rogue-domain-controller-dcshadow-attack/ - webarchive
- https://www.breachquest.com/conti-leaks-insight-into-a-ransomware-unicorn/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/locked-loaded-and-in-the-wrong-hands-legitimate-tools-weaponized-for-ransomware-in-2021 - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-burlap - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-009.pdf - webarchive
- https://unit42.paloaltonetworks.com/trigona-ransomware-update/ - webarchive
- https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/ - webarchive
- https://5851803.fs1.hubspotusercontent-na1.net/hubfs/5851803/Russian%20Ransomware%20C2%20Network%20Discovered%20in%20Censys%20Data.pdf - webarchive
- https://www.secureworks.com/research/samsam-ransomware-campaigns - webarchive
- https://www.ic3.gov/Media/News/2021/210823.pdf - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-drake - webarchive
- https://www.kroll.com/en/insights/publications/cyber/black-basta-technical-analysis - webarchive
- https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://decoded.avast.io/luigicamastra/apt-group-planted-backdoors-targeting-high-profile-networks-in-central-asia - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions - webarchive
- https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos - webarchive
- https://www.rsa.com/content/dam/en/white-paper/the-shadows-of-ghosts-carbanak-report.pdf - webarchive
- https://www.ic3.gov/Media/News/2021/210527.pdf - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://www.varonis.com/blog/hive-ransomware-analysis - webarchive
- https://asec.ahnlab.com/ko/39682/ - webarchive
- https://blog.talosintelligence.com/2022/06/avoslocker-new-arsenal.html - webarchive
- http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa - webarchive
- https://www.matteomalvica.com/blog/2020/01/30/mimikatz-lsass-dump-windg-pykd/ - webarchive
- https://www.mandiant.com/resources/mandiant-red-team-emulates-fin11-tactics - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/grayling-taiwan-cyber-attacks - webarchive
- https://www.fireeye.com/blog/threat-research/2021/08/unc215-chinese-espionage-campaign-in-israel.html - webarchive
- https://labs.f-secure.com/blog/catching-lazarus-threat-intelligence-to-real-detection-logic-part-two - webarchive
- https://www.mandiant.com/resources/unc215-chinese-espionage-campaign-in-israel - webarchive
- https://www.intrinsec.com/apt27-analysis/ - webarchive
- https://www.infinitumit.com.tr/en/conti-ransomware-group-behind-the-karakurt-hacking-team/ - webarchive
- https://assets.virustotal.com/reports/2021trends.pdf - webarchive
- https://www.theta.co.nz/news-blogs/cyber-security-blog/snakes-ladders-the-offensive-use-of-python-on-windows/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/grayfly-china-sidewalk-malware - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-152A_Karakurt_Data_Extortion_Group.pdf - webarchive
- https://noticeofpleadings.com/nickel/# - webarchive
- https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf - webarchive
- https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe/ - webarchive
- https://asec.ahnlab.com/ko/56256/ - webarchive
- https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers - webarchive
- https://www.ic3.gov/media/news/2020/200917-1.pdf - webarchive
- https://resource.redcanary.com/rs/003-YRU-314/images/2021-Threat-Detection-Report.pdf - webarchive
- https://ti.qianxin.com/blog/articles/Operation-OceanStorm:The-OceanLotus-hidden-under-the-abyss-of-the-deep/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-campaign-telecoms-asia-middle-east - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/elfin-apt33-espionage - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-hickman - webarchive
- https://www.f-secure.com/content/dam/f-secure/en/consulting/our-thinking/collaterals/digital/f-secure-consulting-incident-readiness-proactive-response-guide-2020.pdf - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/leafminer-espionage-middle-east - webarchive
- https://www.devo.com/blog/detect-and-investigate-hafnium-using-devo/ - webarchive
- https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf - webarchive
- https://news.sophos.com/en-us/2021/05/18/the-active-adversary-playbook-2021/?cmp=37153 - webarchive
- https://blog.reversinglabs.com/blog/threat-analysis-follina-exploit-powers-live-off-the-land-attacks - webarchive
- https://www.secureworks.com/blog/ransomware-deployed-by-adversary - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/microsoft-exchange-server-protection - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/moving-left-ransomware-boom - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout - webarchive
- https://securelist.com/the-sessionmanager-iis-backdoor/106868/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-china-ngo-government-attacks - webarchive
- https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/ - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-franklin - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-atlas - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/double-extortion-campaigns - webarchive
- https://blogs.blackberry.com/en/2022/09/the-curious-case-of-monti-ransomware-a-real-world-doppelganger - webarchive
- https://github.com/gentilkiwi/mimikatz - webarchive
- https://volatility-labs.blogspot.com/2021/10/memory-forensics-r-illustrated.html - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
- https://www.wired.com/story/how-mimikatz-became-go-to-hacker-tool/ - webarchive
- https://blog.redteam.pl/2020/05/sodinokibi-revil-ransomware.html - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-007.pdf - webarchive
- https://www.secureworks.com/research/bronze-vinewood-targets-supply-chains - webarchive
- https://twitter.com/inversecos/status/1456486725664993287 - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbasta - webarchive
- https://www.infinitumit.com.tr/apt-35/ - webarchive
- https://news.sophos.com/en-us/2022/08/18/cookie-stealing-the-new-perimeter-bypass - webarchive
- https://asec.ahnlab.com/en/47455/ - webarchive
- https://www.mandiant.com/resources/blog/alphv-ransomware-backup - webarchive
- https://www.trendmicro.com/en_us/research/21/a/targeted-attack-using-chopper-aspx-web-shell-exposed-via-managed.html - webarchive
- https://attackiq.com/2022/06/03/attack-graph-response-to-us-cert-aa22-152a-karakurt-data-extortion-group/ - webarchive
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/ - webarchive
- https://www.microsoft.com/security/blog/2021/11/18/iranian-targeting-of-it-sector-on-the-rise/ - webarchive
- https://i.blackhat.com/USA-20/Thursday/us-20-Chen-Operation-Chimera-APT-Operation-Targets-Semiconductor-Vendors.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-kingswood - webarchive
- https://securelist.com/the-lazarus-group-deathnote-campaign/109490/ - webarchive
- https://www.cisa.gov/sites/default/files/2023-09/aa23-250a-apt-actors-exploit-cve-2022-47966-and-cve-2022-42475.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mindware
Ransomware, potential rebranding of win.sfile.
Internal MISP references
UUID cfd0ab21-12e6-4c95-acc7-a8f488ed1706 which can be used as unique global reference for Mindware in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MINEBRIDGE
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MINEBRIDGE.
| Known Synonyms |
|---|
GazGolder |
Internal MISP references
UUID 663d4310-51ea-4ac1-9426-b9e9c5210471 which can be used as unique global reference for MINEBRIDGE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.minebridge - webarchive
- https://www.fireeye.com/blog/threat-research/2020/01/stomp-2-dis-brilliance-in-the-visual-basics.html - webarchive
- https://www.zscaler.com/blogs/security-research/return-minebridge-rat-new-ttps-and-social-engineering-lures - webarchive
- https://www.zscaler.com/blogs/security-research/demystifying-full-attack-chain-minebridge-rat - webarchive
- https://blog.morphisec.com/minebridge-on-the-rise-sophisticated-delivery-mechanism - webarchive
- https://labs.sentinelone.com/breaking-ta505s-crypter-with-an-smt-solver/ - webarchive
- https://www.bleepingcomputer.com/news/security/windows-finger-command-abused-by-phishing-to-download-malware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MiniASP
Internal MISP references
UUID a4f8bacf-2076-4e00-863c-874cdd833a41 which can be used as unique global reference for MiniASP in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
miniBlindingCan
miniBlindingCan is an HTTP(S) orchestrator.
It is a variant of the BlindingCan RAT, having the same command parsing logic, but supporting only a small subset of commands available previously. The main operations are the update of the malware configuration, and the download and execution of additional payloads from the attackers' C&C.
The miniBlindingCan malware was used in Operation DreamJob attacks against aerospace and media companies in Q2-Q3 2022.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular miniBlindingCan.
| Known Synonyms |
|---|
AIRDRY.V2 |
EventHorizon |
Internal MISP references
UUID d266693e-0564-47e7-93ac-128d491efcab which can be used as unique global reference for miniBlindingCan in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.miniblindingcan - webarchive
- https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing - webarchive
- https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Lazarus-campaigns-and-backdoors-in-2022-2023.pdf - webarchive
- https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MiniDuke
The MiniDuke toolset consists of multiple downloader and backdoor components
Internal MISP references
UUID 3d164ab8-58a5-433c-bbc9-b81a869ac8c8 which can be used as unique global reference for MiniDuke in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.miniduke - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.circl.lu/files/tr-14/circl-analysisreport-miniduke-stage3-public.pdf - webarchive
- https://kindredsec.com/2019/08/12/an-overview-of-public-platform-c2s/ - webarchive
- https://www.carbonblack.com/2020/03/26/the-dukes-of-moscow/ - webarchive
- https://www.fireeye.com/blog/threat-research/2013/02/its-a-kind-of-magic-1.html - webarchive
- https://research.checkpoint.com/2022/native-function-and-assembly-code-invocation/ - webarchive
- https://cybergeeks.tech/how-to-defeat-the-russian-dukes-a-step-by-step-analysis-of-miniduke-used-by-apt29-cozy-bear/ - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-hemlock - webarchive
- https://kindredsec.wordpress.com/2019/08/12/an-overview-of-public-platform-c2s/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MiniStealer
Internal MISP references
UUID 01e605b0-aadc-40a3-986f-f0795fd20401 which can be used as unique global reference for MiniStealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
miniTypeFrame
miniTYPEFRAME is a variant of TYPEFRAME, a RAT for Windows.
Its functionality is reduced to serve mostly as a proxy module. Its commands are indexed by 16-bit integers, usually in the range 0x8027–0x8044.
Internal MISP references
UUID fbf135fa-1194-4532-846a-eb1716e0b426 which can be used as unique global reference for miniTypeFrame in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MintStealer
Internal MISP references
UUID 15c036d3-e1d8-4e4a-850c-20ce65bdd24c which can be used as unique global reference for MintStealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mirage
Internal MISP references
UUID 6f6da371-2d62-4245-9aa3-8570e39222ae which can be used as unique global reference for Mirage in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mirage - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-palace - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/ - webarchive
- https://st.drweb.com/static/new-www/news/2020/july/Study_of_the_APT_attacks_on_state_institutions_in_Kazakhstan_and_Kyrgyzstan_en.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MirageFox
Internal MISP references
UUID b3e89b03-c5af-41cd-88b8-e15335abbb30 which can be used as unique global reference for MirageFox in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mirai (Windows)
Internal MISP references
UUID 2edd3051-b1b5-47f2-9155-8c97f791dfb7 which can be used as unique global reference for Mirai (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mirai - webarchive
- https://enterprise.verizon.com/resources/reports/2019-data-breach-investigations-report.pdf - webarchive
- https://assets.virustotal.com/reports/2021trends.pdf - webarchive
- https://dev.azure.com/Mastadamus/Mirai%20Botnet%20Analysis/_wiki/wikis/Mirai-Botnet-Analysis.wiki/12/Anatomy-of-An-Mirai-Botnet-Attack - webarchive
- https://www.incapsula.com/blog/new-mirai-variant-ddos-us-college.html - webarchive
- https://blog.netlab.360.com/wo-men-kan-dao-de-wu-ke-lan-bei-ddosgong-ji-xi-jie/ - webarchive
- https://securelist.com/blog/research/77621/newish-mirai-spreader-poses-new-risks/ - webarchive
- https://unit42.paloaltonetworks.com/moobot-d-link-devices/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tough-times-for-ukrainian-honeypot/ - webarchive
- https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ - webarchive
- https://twitter.com/PhysicalDrive0/status/830070569202749440 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MirrorBlast
According to Minerva Labs, MirrorBlast malware is a trojan that is known for attacking users’ browsers. It usually pretends to be a legitimate browser add-on however it has now evolved additional capabilities, whereby other malwares are installed simultaneously. Recently, this trojan is thought to have tentative links to TA505 and PYSA groups.
Internal MISP references
UUID be347289-5ca5-4b49-b5ef-8443883736c1 which can be used as unique global reference for MirrorBlast in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mirrorblast - webarchive
- https://www.proofpoint.com/us/daily-ruleset-update-summary-20210924 - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/whatta-ta-ta505-ramps-activity-delivers-new-flawedgrace-variant - webarchive
- https://frsecure.com/blog/the-rebol-yell-new-rebol-exploit/ - webarchive
- https://threatresearch.ext.hp.com/mirrorblast-and-ta505-examining-similarities-in-tactics-techniques-and-procedures/ - webarchive
- https://blog.morphisec.com/explosive-new-mirrorblast-campaign-targets-financial-companies - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MirrorKey
According to Trend Micro, this is a loader for win.transbox, used by threat actor Earth Yako.
Internal MISP references
UUID 7340174e-3ff7-4293-acd0-1a82433a7777 which can be used as unique global reference for MirrorKey in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Misdat
Internal MISP references
UUID d1597713-fe7a-45bd-8b59-1a13c7e097d8 which can be used as unique global reference for Misdat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Misfox
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Misfox.
| Known Synonyms |
|---|
MixFox |
ModPack |
Internal MISP references
UUID b4c33277-ec15-4bb3-89ef-314ecfa100da which can be used as unique global reference for Misfox in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Misha
Undocumented information stealer targeting multiple browsers and cryptocurrences. Internal project name appears to be "misha".
Internal MISP references
UUID 3f32d0bf-61b9-495b-88ca-77f4a254336d which can be used as unique global reference for Misha in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mispadu
According to ESET Research, Mispadu is an ambitious Latin American banking trojan that utilizes McDonald’s malvertising and extends its attack surface to web browsers. It is used to target the general public and its main goals are monetary and credential theft. In Brazil, ESET has seen it distributing a malicious Google Chrome extension that attempts to steal credit card data and online banking data, and that compromises the Boleto payment system.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mispadu.
| Known Synonyms |
|---|
URSA |
Internal MISP references
UUID ffc9ffcc-24f4-4e60-ab02-a75b007359fa which can be used as unique global reference for Mispadu in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mispadu - webarchive
- https://seguranca-informatica.pt/ursa-trojan-is-back-with-a-new-dance/#.YyXEkaRBzIU - webarchive
- https://blog.scilabs.mx/cyber-threat-profile-malteiro/ - webarchive
- https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/ - webarchive
- https://seguranca-informatica.pt/threat-analysis-the-emergent-ursa-trojan-impacts-many-countries-using-a-sophisticated-loader/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/mispadu-banking-trojan-resurfaces - webarchive
- https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MISTCLOAK
Mandiant associates this with UNC4191, this malware decrypts and runs DARKDEW.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MISTCLOAK.
| Known Synonyms |
|---|
HIUPAN |
Internal MISP references
UUID 1e6bc052-73de-453d-ba6c-658c82fe21d4 which can be used as unique global reference for MISTCLOAK in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MISTYVEAL
Internal MISP references
UUID d594d6c1-6d10-4fe8-acda-397df91c73ba which can be used as unique global reference for MISTYVEAL in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Miuref
Internal MISP references
UUID 4c786624-4a55-46e6-849d-b65552034235 which can be used as unique global reference for Miuref in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MMON
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MMON.
| Known Synonyms |
|---|
Kaptoxa |
Internal MISP references
UUID a6d12f4f-57f6-4873-9c68-e079fef5e5fb which can be used as unique global reference for MMON in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MM Core
Internal MISP references
UUID 6363cc2f-08f1-47a0-adbf-5cf19ea89ffd which can be used as unique global reference for MM Core in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MobiRAT
Internal MISP references
UUID e33aa1f8-a631-4274-afe0-f2fd3426332e which can be used as unique global reference for MobiRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mocky LNK
LNK files used to lure and orchestrate execution of various scripts, interacting with the Mocky API service.
Internal MISP references
UUID 0eb52072-a2db-4689-bc2d-ac0ae65bdd8c which can be used as unique global reference for Mocky LNK in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mocton
Internal MISP references
UUID 7132c1de-9a3f-4f08-955f-ab6f7a09e17d which can be used as unique global reference for Mocton in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ModernLoader
According to PCrisk, ModernLoader, also known as Avatar Bot and AvatarLoader, is a malicious program that has minimalistic loader and RAT (Remote Access Trojan) functionalities.
Loader-type malware is designed to infect devices with additional malicious programs, while RATs enable remote access/control over infected machines. ModernLoader is capable of executing basic commands and injecting malicious modules into systems.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ModernLoader.
| Known Synonyms |
|---|
AvatarBot |
Internal MISP references
UUID a3932600-e1fd-4fbe-b651-8da31109ee15 which can be used as unique global reference for ModernLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MoDi RAT
Internal MISP references
UUID 1f36d78b-6f3d-469e-8a60-5ecaebe9d80a which can be used as unique global reference for MoDi RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ModPipe
ModPipe is point-of-sale (POS) malware capable of accessing sensitive information stored in devices running ORACLE MICROS Restaurant Enterprise Series (RES) 3700 POS – a management software suite used by hundreds of thousands of bars, restaurants, hotels and other hospitality establishments worldwide. ModPipe uses modular architecture consisting of basic components and downloadable modules. One of them – named GetMicInfo – contains an algorithm designed to gather database passwords by decrypting them from Windows registry values. Exfiltrated credentials allow ModPipe's operators access to database contents, including various definitions and configuration, status tables and information about POS transactions.
Internal MISP references
UUID a4b3d07a-b3ce-4128-9c5c-caa218518a00 which can be used as unique global reference for ModPipe in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.modpipe - webarchive
- https://www.foregenix.com/blog/modpipe-malware-has-a-new-module-that-siphons-payment-card-data - webarchive
- https://www.welivesecurity.com/2020/11/12/hungry-data-modpipe-backdoor-hits-pos-software-hospitality-sector/ - webarchive
- https://www.kroll.com/en/insights/publications/cyber/modpipe-pos-malware-new-hooking-targets-extract-card-data - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ModPOS
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ModPOS.
| Known Synonyms |
|---|
straxbot |
Internal MISP references
UUID 026d638b-cc51-4eff-97fc-d61215a1a70a which can be used as unique global reference for ModPOS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mofksys
Internal MISP references
UUID 818a9036-a74f-4017-af07-cba9a471b316 which can be used as unique global reference for Mofksys in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Moisha Ransomware
Internal MISP references
UUID 16c5d8f9-c2f1-4599-bc93-bc02497deff8 which can be used as unique global reference for Moisha Ransomware in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Moker
Internal MISP references
UUID 90a1a61e-3e69-4b92-ac11-9095ac2d9cf4 which can be used as unique global reference for Moker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.moker - webarchive
- https://breakingmalware.com/malware/moker-part-1-dissecting-a-new-apt-under-the-microscope/ - webarchive
- http://blog.ensilo.com/moker-a-new-apt-discovered-within-a-sensitive-network - webarchive
- https://blog.malwarebytes.com/threat-analysis/2017/04/elusive-moker-trojan/ - webarchive
- https://breakingmalware.com/malware/moker-part-2-capabilities/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mokes (Windows)
Internal MISP references
UUID 3a711d44-2a70-418d-92c1-692c3d3b13c2 which can be used as unique global reference for Mokes (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mokes - webarchive
- https://securelist.com/mokes-and-buerak-distributed-under-the-guise-of-security-certificates/96324/ - webarchive
- https://securelist.com/from-linux-to-windows-new-family-of-cross-platform-desktop-backdoors-discovered/73503/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mole
Internal MISP references
UUID aaeaf9ee-2f3d-4141-9d45-ec383ba8445f which can be used as unique global reference for Mole in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MoleNet
MoleNet is a .NET downloader malware used by the Molerats group in targeted attacks in the Middle East. Before downloading additional payloads, it first collects information about the infected machine using WMI queries and sends the data to its operators. It was first discovered in 2020, however, Cybereason researchers showed that it has been in use since at least 2019, with infrastructure that operated since 2017.
Internal MISP references
UUID 76842aa1-f06d-49cf-90df-158346525f91 which can be used as unique global reference for MoleNet in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Molerat Loader
Internal MISP references
UUID b50408c3-6676-4d3f-8a97-9114c215b67a which can be used as unique global reference for Molerat Loader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.molerat_loader - webarchive
- https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/ - webarchive
- https://www.0ffset.net/reverse-engineering/malware-analysis/molerats-string-decryption/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/new-ta402-molerats-malware-targets-governments-middle-east - webarchive
- http://www.clearskysec.com/iec/ - webarchive
- https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Monero Miner
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Monero Miner.
| Known Synonyms |
|---|
CoinMiner |
Internal MISP references
UUID c57a4168-cd09-4611-a665-bbcede80f42b which can be used as unique global reference for Monero Miner in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.monero_miner - webarchive
- https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealthy-malware-targeting-linux - webarchive
- https://www.welivesecurity.com/2017/09/28/monero-money-mining-malware/ - webarchive
- https://news.sophos.com/en-us/2021/10/24/node-poisoning-hijacked-package-delivers-coin-miner-and-credential-stealing-backdoor - webarchive
- https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer/ - webarchive
- https://asec.ahnlab.com/en/37526/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Money Message
A new ransomware gang hitting companies in worldwide firstly spotted by Zscaler.
Internal MISP references
UUID 07dff193-2fad-4de6-83ad-046c6b95be46 which can be used as unique global reference for Money Message in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.moneymessage - webarchive
- https://resources.securityscorecard.com/research/analysis-money-message-ransomware - webarchive
- https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/ - webarchive
- https://yoroi.company/research/money-ransomware-the-latest-double-extortion-group/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
mongall
Internal MISP references
UUID e0627961-fc28-4b7d-bb44-f937defa052a which can be used as unique global reference for mongall in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MontysThree
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MontysThree.
| Known Synonyms |
|---|
MT3 |
Internal MISP references
UUID 8a6013a1-5e5c-41f5-bd8e-c86ea7f108d9 which can be used as unique global reference for MontysThree in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MoonBounce
MoonBounce is a malware embedded into a modified UEFI firmware. Placed into SPI flash, it can provide persistence across full reinstall and even disk replacements. MoonBounce deploys user-mode malware through in-memory staging with a small footprint.
Internal MISP references
UUID 04ce84dc-f471-48b6-8456-348cd85af39f which can be used as unique global reference for MoonBounce in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.moonbounce - webarchive
- https://www.binarly.io/posts/A_deeper_UEFI_dive_into_MoonBounce/index.html - webarchive
- https://habr.com/ru/amp/post/668154/ - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/01/19115831/MoonBounce_technical-details_eng.pdf - webarchive
- https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MoonWind
Internal MISP references
UUID 8465177f-16c8-47fc-a4c8-f4c0409fe460 which can be used as unique global reference for MoonWind in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MoriAgent
Internal MISP references
UUID 3de9ccf5-4756-4c5b-9086-6664f5a9b761 which can be used as unique global reference for MoriAgent in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.moriagent - webarchive
- https://twitter.com/Timele9527/status/1272776776335233024 - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-055A_Iranian_Government-Sponsored_Actors_Conduct_Cyber_Operations.pdf - webarchive
- https://live.paloaltonetworks.com/t5/custom-signatures/how-to-stop-mortiagent-malware-using-the-snort-rule/td-p/326590# - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-055a - webarchive
- https://www.inforisktoday.com/muddywater-targets-critical-infrastructure-in-asia-europe-a-18611 - webarchive
- https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Moriya
This tool is a passive backdoor which allows attackers to inspect all incoming traffic to the infected machine, filter out packets that are marked as designated for the malware and respond to them. This forms a covert channel over which attackers are able to issue shell commands and receive back their outputs.
Internal MISP references
UUID 4dd511a6-be5f-40ae-9a9f-aaf354f7ea2e which can be used as unique global reference for Moriya in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Morphine
Internal MISP references
UUID 9de41613-7762-4a88-8e9a-4e621a127f32 which can be used as unique global reference for Morphine in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MortalKombat
Internal MISP references
UUID ff3b11e4-3450-4db5-a2ed-5c45cd875330 which can be used as unique global reference for MortalKombat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Morto
Internal MISP references
UUID c931dc7d-9373-4545-911c-ad5589670c40 which can be used as unique global reference for Morto in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.morto - webarchive
- http://contagiodump.blogspot.com/2011/08/aug-28-morto-tsclient-rdp-worm-with.html - webarchive
- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Morto.A - webarchive
- https://www.f-secure.com/weblog/archives/00002227.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MosaicRegressor
Internal MISP references
UUID 45e780f0-aa06-4427-8393-ef1d358e354f which can be used as unique global reference for MosaicRegressor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Moserpass
Internal MISP references
UUID 0dc319a2-96b5-420d-85ec-07f34f457402 which can be used as unique global reference for Moserpass in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mosquito
Internal MISP references
UUID 663df641-d396-4e93-93bd-bb9609ceb0ba which can be used as unique global reference for Mosquito in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mosquito - webarchive
- https://www.welivesecurity.com/2018/05/22/turla-mosquito-shift-towards-generic-tools/ - webarchive
- https://www.welivesecurity.com/2020/03/12/tracking-turla-new-backdoor-armenian-watering-holes/ - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-hunter - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2020-0312.pdf - webarchive
- https://securelist.com/shedding-skin-turlas-fresh-faces/88069/ - webarchive
- https://www.recordedfuture.com/turla-apt-infrastructure/ - webarchive
- https://cocomelonc.github.io/tutorial/2022/05/02/malware-pers-3.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mount Locker
According to BlackBerry, MountLocker is a Ransomware-as-a-Service (RaaS), active since July 2020 The MountLocker ransomware was updated during early November 2020 to broaden the targeting of file types and evade security software. Victim’s files are encrypted using ChaCha20, and file encryption keys are encrypted using RSA-2048. The ransomware appears to be somewhat secure; there are no trivial weaknesses allowing for easy key recovery and decryption of data. MountLocker does however use a cryptographically insecure method for key generation that may be prone to attack.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mount Locker.
| Known Synonyms |
|---|
DagonLocker |
MountLocker |
QuantumLocker |
Internal MISP references
UUID b5814e05-532a-4262-a8da-82fd0d7605ee which can be used as unique global reference for Mount Locker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mount_locker - webarchive
- https://news.sophos.com/en-us/2021/03/31/sophos-mtr-in-real-time-what-is-astro-locker-team/ - webarchive
- https://securityintelligence.com/posts/itg23-crypters-cooperation-between-cybercriminal-groups/ - webarchive
- https://www.bleepingcomputer.com/news/security/biotech-research-firm-miltenyi-biotec-hit-by-ransomware-data-leaked/ - webarchive
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - webarchive
- https://dissectingmalwa.re/between-a-rock-and-a-hard-place-exploring-mount-locker-ransomware.html - webarchive
- https://github.com/Finch4/Malware-Analysis-Reports/tree/main/MountLocker - webarchive
- https://www.bleepingcomputer.com/news/security/mount-locker-ransomware-joins-the-multi-million-dollar-ransom-game/ - webarchive
- https://blogs.blackberry.com/en/2020/12/mountlocker-ransomware-as-a-service-offers-double-extortion-capabilities-to-affiliates - webarchive
- https://www.bleepingcomputer.com/news/security/mount-locker-ransomware-now-targets-your-turbotax-tax-returns/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-virtual-machines - webarchive
- https://chuongdong.com/reverse%20engineering/2021/05/23/MountLockerRansomware/ - webarchive
- https://community.riskiq.com/article/47766fbd - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v - webarchive
- https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/ - webarchive
- https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/ - webarchive
- https://intel471.com/blog/how-cybercriminals-create-turbulence-for-the-transportation-industry - webarchive
- https://securityscorecard.pathfactory.com/research/quantum-ransomware - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://securityintelligence.com/posts/trickbot-conti-crypters-where-are-they-now/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/ - webarchive
- https://www.guidepointsecurity.com/mount-locker-ransomware-steps-up-counter-ir-capabilities/ - webarchive
- https://kienmanowar.wordpress.com/2021/08/04/quicknote-mountlocker-some-pseudo-code-snippets/ - webarchive
- https://blogs.blackberry.com/en/2021/11/zebra2104 - webarchive
- https://www.trendmicro.com/en_us/research/21/j/ransomware-operators-found-using-new-franchise-business-model.html - webarchive
- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ - webarchive
- https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf - webarchive
- https://www.cybereason.com/blog/cybereason-vs.-quantum-locker-ransomware - webarchive
- https://www.intezer.com/blog/malware-analysis/how-threat-actors-abuse-lnk-files/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Moure
Internal MISP references
UUID bd3468e4-5e00-46e6-a884-6eda1b246394 which can be used as unique global reference for Moure in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
mozart
According to PCrisk, Mozart is malicious software that allows attackers (cyber criminals) to execute various commands on an infected computer through the DNS protocol. This communication method helps cyber criminals to avoid detection via security software. Mozart is categorized as a malware loader and executes commands that cause download and installation of malicious software.
Internal MISP references
UUID dde61acb-8c0f-4a3a-8450-96e233f2ddc1 which can be used as unique global reference for mozart in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MPKBot
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MPKBot.
| Known Synonyms |
|---|
MPK |
Internal MISP references
UUID 2363dc9f-822a-4581-8d5f-1fc436e70621 which can be used as unique global reference for MPKBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MQsTTang
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MQsTTang.
| Known Synonyms |
|---|
QMAGENT |
Internal MISP references
UUID aed28126-b8ab-4ab5-a2c6-89898fe689c9 which can be used as unique global reference for MQsTTang in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MRAC
Ransomware.
Internal MISP references
UUID 3eee33df-76c5-4962-ac35-b0d98c37a81a which can be used as unique global reference for MRAC in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MrDec
Ransomware.
Internal MISP references
UUID 1e301d67-cd12-4f46-bcb3-c60f9b78c4d0 which can be used as unique global reference for MrDec in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MrPeter
Internal MISP references
UUID 677123aa-3a1a-4443-a968-4f6f4bc6b3c2 which can be used as unique global reference for MrPeter in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MuddyC2Go
Internal MISP references
UUID c22da013-96f4-4dfa-ab24-544da231500e which can be used as unique global reference for MuddyC2Go in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.muddyc2go - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/iran-apt-seedworm-africa-telecoms - webarchive
- https://www.deepinstinct.com/blog/muddyc2go-latest-c2-framework-used-by-iranian-apt-muddywater-spotted-in-israel - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MulCom
Internal MISP references
UUID a756ad8a-ac29-49c0-aee8-f3030e7ddeca which can be used as unique global reference for MulCom in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Multigrain POS
Internal MISP references
UUID c513c490-7c76-42ab-a51f-cc780faa7146 which can be used as unique global reference for Multigrain POS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
murkytop
a command-line reconnaissance tool. It can be used to execute files as a different user, move, and delete files locally, schedule remote AT jobs, perform host discovery on connected networks, scan for open ports on hosts in a connected network, and retrieve information about the OS, users, groups, and shares on remote hosts.
Internal MISP references
UUID 2685ea45-06f4-46e0-9397-eff8844db855 which can be used as unique global reference for murkytop in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.murkytop - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-mohawk - webarchive
- https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Murofet
Internal MISP references
UUID f7081626-130a-48d5-83a9-759b3ef198ec which can be used as unique global reference for Murofet in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.murofet - webarchive
- https://www.wired.com/2017/03/russian-hacker-spy-botnet/ - webarchive
- https://bin.re/blog/three-variants-of-murofets-dga/ - webarchive
- https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mutabaha
Internal MISP references
UUID 771113e1-8550-4dc2-b2ad-7298ae381cb5 which can be used as unique global reference for Mutabaha in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MyDogs
Internal MISP references
UUID 77d74e8c-664a-42b7-a55d-735ea138a898 which can be used as unique global reference for MyDogs in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mydogs - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/ - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/research/tracking-kimsuky-north-korea-based-cyber-espionage-group-part-1.html - webarchive
- https://www.pwc.co.uk/issues/cyber-security-data-privacy/research/tracking-kimsuky-north-korea-based-cyber-espionage-group-part-2.html - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/research/tracking-kimsuky-north-korea-based-cyber-espionage-group-part-1.htmlhttps://www.pwc.co.uk/issues/cyber-security-data-privacy/research/tracking-kimsuky-north-korea-based-cyber-espionage-group-part-2.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MyDoom
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MyDoom.
| Known Synonyms |
|---|
Mimail |
Novarg |
Internal MISP references
UUID ac3483f9-522e-4fbc-b072-e5f76972e7b3 which can be used as unique global reference for MyDoom in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom - webarchive
- https://www.giac.org/paper/gcih/619/mydoom-backdoor/106503 - webarchive
- http://ivanlef0u.fr/repo/madchat/vxdevl/papers/analysis/mydoom_b_analysis.pdf - webarchive
- https://www.malware-traffic-analysis.net/2018/12/19/index.html - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://www.giac.org/paper/gcih/568/mydoom-dom-anlysis-mydoom-virus/106069 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MyKings Spreader
Internal MISP references
UUID ec9b2bf4-1c0b-4f3c-aaa6-909b19503eed which can be used as unique global reference for MyKings Spreader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mykings_spreader - webarchive
- https://decoded.avast.io/janrubin/the-king-is-dead-long-live-mykings/ - webarchive
- https://sophos.files.wordpress.com/2019/12/mykings_report_final.pdf - webarchive
- http://download.ahnlab.com/kr/site/library/[AhnLab]Analysis%20Report_MyKings%20Botnet.pdf
- https://www.proofpoint.com/us/threat-insight/post/smominru-monero-mining-botnet-making-millions-operators - webarchive
- https://blog.talosintelligence.com/2020/07/valak-emerges.html - webarchive
- http://blog.netlab.360.com/mykings-the-botnet-behind-multiple-active-spreading-botnets/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MyloBot
According to PCrisk, MyloBot is a high-risk trojan-type virus that allows cyber criminals to control the infected machine. MyloBot can be considered as a botnet, since all infected computers are connected to a single network. Depending on cyber criminals' goals, infected machines might be misused or have additional infections applied.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MyloBot.
| Known Synonyms |
|---|
FakeDGA |
WillExec |
Internal MISP references
UUID 98d375cb-f940-4bc7-a61e-f47bdcdc48e2 which can be used as unique global reference for MyloBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.mylobot - webarchive
- https://github.com/360netlab/DGA/issues/36 - webarchive
- https://www.bitsight.com/blog/mylobot-investigating-proxy-botnet - webarchive
- http://www.freebuf.com/column/153424.html - webarchive
- http://blog.talosintelligence.com/2017/10/threat-round-up-1020-1017.html - webarchive
- https://ti.qianxin.com/blog/articles/Analysis-of-Recent-Activities-of-the-Mylobot-Botnet-EN/ - webarchive
- https://www.deepinstinct.com/2018/06/20/meet-mylobot-a-new-highly-sophisticated-never-seen-before-botnet-thats-out-in-the-wild/ - webarchive
- https://blogs.akamai.com/sitr/2021/01/detecting-mylobot-unseen-dga-based-malware-using-deep-learning.html - webarchive
- https://blog.centurylink.com/mylobot-continues-global-infections/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MysterySnail
Internal MISP references
UUID c9b5b0b2-45af-43f2-8eb4-e13493c1342e which can be used as unique global reference for MysterySnail in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Mystic Stealer
According to ZScaler, a new information stealer that was first advertised in April 2023, capable of stealing credentials from nearly 40 web browsers and more than 70 browser extensions, also targeting cryptocurrency wallets, Steam, and Telegram. The code is heavily obfuscated making use of polymorphic string obfuscation, hash-based import resolution, and runtime calculation of constants. Mystic implements a custom binary protocol that is encrypted with RC4.
Internal MISP references
UUID 226a9241-e4de-49d0-bb30-4550221f3f9f which can be used as unique global reference for Mystic Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
MZRevenge
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MZRevenge.
| Known Synonyms |
|---|
MaMo434376 |
Internal MISP references
UUID 5cb1091c-bfe7-440c-a8c7-b652e205e65b which can be used as unique global reference for MZRevenge in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
N40
Botnet with focus on banks in Latin America and South America. Relies on DLL Sideloading attacks to execute malicious DLL files. Uses legitimate VMWare executable in attacks. As of March 2019, the malware is under active development with updated versions coming out on persistent basis.
Internal MISP references
UUID 6f0109a5-7cec-4a49-8b27-e18ad5c6cae6 which can be used as unique global reference for N40 in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.n40 - webarchive
- https://socprime.com/en/news/attackers-exploit-dll-hijacking-to-bypass-smartscreen/ - webarchive
- http://blog.en.elevenpaths.com/2018/05/new-report-malware-attacks-chilean.html - webarchive
- http://reversingminds-blog.logdown.com/posts/7807545-analysis-of-advanced-brazilian-banker-malware - webarchive
- https://www.slideshare.net/elevenpaths/n40-the-botnet-created-in-brazil-which-evolves-to-attack-the-chilean-banking-sector - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nabucur
Internal MISP references
UUID ddf63295-cdba-4c70-a4c6-623ba2b5e6dd which can be used as unique global reference for Nabucur in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NACHOCHEESE
According to FireEye, NACHOCHEESE is a command-line tunneler that accepts delimited C&C IPs or domains via command-line and gives actors shell access to a victim's system.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular NACHOCHEESE.
| Known Synonyms |
|---|
Cyruslish |
TWOPENCE |
VIVACIOUSGIFT |
Internal MISP references
UUID abd22cec-49ee-431f-a2e6-e4722b3e44bb which can be used as unique global reference for NACHOCHEESE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nachocheese - webarchive
- https://www.virusbulletin.com/uploads/pdf/magazine/2018/VB2018-Kalnai-Poslusny.pdf - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-239b - webarchive
- https://baesystemsai.blogspot.com/2017/02/lazarus-false-flag-malware.html - webarchive
- https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/apt/rpt-apt38-2018.pdf - webarchive
- https://www.welivesecurity.com/2017/02/16/demystifying-targeted-malware-used-polish-banks/ - webarchive
- https://raw.githubusercontent.com/eric-erki/APT_CyberCriminal_Campagin_Collections/master/2017/2017.05.30.Lazarus_Arisen/Group-IB_Lazarus.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nagini
Internal MISP references
UUID 0ec7d065-3418-43ba-a0cc-1e06471893ad which can be used as unique global reference for Nagini in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Naikon
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Naikon.
| Known Synonyms |
|---|
Sacto |
Internal MISP references
UUID dfb745f1-600a-4d31-a3b0-57bd0a72ac2e which can be used as unique global reference for Naikon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.naikon - webarchive
- https://securelist.com/analysis/publications/69953/the-naikon-apt/ - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nanocore RAT
Nanocore is a Remote Access Tool used to steal credentials and to spy on cameras. It as been used for a while by numerous criminal actors as well as by nation state threat actors.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Nanocore RAT.
| Known Synonyms |
|---|
Nancrat |
NanoCore |
Internal MISP references
UUID f9aa9004-8811-4091-a471-38f81dbcadc4 which can be used as unique global reference for Nanocore RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore - webarchive
- https://www.secureworks.com/research/darktortilla-malware-analysis - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/elfin-indictments-iran-espionage - webarchive
- https://blog.talosintelligence.com/2022/01/nanocore-netwire-and-asyncrat-spreading.html - webarchive
- https://blog.360totalsecurity.com/en/vendetta-new-threat-actor-from-europe/ - webarchive
- https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-trinity - webarchive
- https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html - webarchive
- https://www.trendmicro.com/en_us/research/21/k/campaign-abusing-rats-uses-fake-websites.html - webarchive
- https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://github.com/threatland/TL-TROJAN/tree/master/TL.RAT/RAT.Win.Nanocore - webarchive
- https://www.bleepingcomputer.com/news/security/nanocore-rat-author-gets-33-months-in-prison/ - webarchive
- https://medium.com/@mariohenkel/decrypting-nanocore-config-and-dump-all-plugins-f4944bfaba52 - webarchive
- https://www.trendmicro.com/en_us/research/21/i/Water-Basilisk-Uses-New-HCrypt-Variant-to-Flood-Victims-with-RAT-Payloads.html - webarchive
- https://blog.talosintelligence.com/2021/04/a-year-of-fajan-evolution-and-bloomberg.html - webarchive
- https://mp.weixin.qq.com/s/mstwBMkS0G3Et4GOji2mwA - webarchive
- https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html - webarchive
- https://www.ciphertechsolutions.com/roboski-global-recovery-automation/ - webarchive
- https://assets.virustotal.com/reports/2021trends.pdf - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://www.proofpoint.com/us/threat-insight/post/new-whiteshadow-downloader-uses-microsoft-sql-retrieve-malware - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/how-cybercriminals-abuse-cloud-tunneling-services - webarchive
- https://zero2auto.com/2020/06/07/dealing-with-obfuscated-macros/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/new-threat-actor-spoofs-philippine-government-covid-19-health-data-widespread - webarchive
- https://community.riskiq.com/article/24759ad2 - webarchive
- https://www.zscaler.com/blogs/security-research/catching-rats-over-custom-protocols - webarchive
- https://labs.bitdefender.com/2020/03/5-times-more-coronavirus-themed-malware-reports-during-march/?utm_campaign=twitter&utm_medium=twitter&utm_source=twitter - webarchive
- https://threatrecon.nshc.net/2019/09/19/sectorh01-continues-abusing-web-services/ - webarchive
- https://umbrella.cisco.com/blog/navigating-cybersecurity-during-a-pandemic-latest-malware-and-threat-actors - webarchive
- https://blog.morphisec.com/syk-crypter-discord - webarchive
- https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ - webarchive
- https://medium.com/@the_abjuri5t/nanocore-rat-hunting-guide-cb185473c1e0 - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/image-file-trickery-part-ii-fake-icon-delivers-nanocore/ - webarchive
- https://goggleheadedhacker.com/blog/post/11 - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/ - webarchive
- https://securityintelligence.com/posts/roboski-global-recovery-automation/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-345a - webarchive
- https://www.gdatasoftware.com/blog/global-pandemic-remcos-tesla-netwire - webarchive
- https://www.ic3.gov/media/news/2020/200917-1.pdf - webarchive
- https://blog.talosintelligence.com/2020/02/coronavirus-themed-malware.html - webarchive
- https://www.crowdstrike.com/blog/weaponizing-disk-image-files-analysis/ - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://community.riskiq.com/article/ade260c6 - webarchive
- https://www.zscaler.com/blogs/research/multistage-freedom-loader-used-spread-azorult-and-nanocore-rat - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/elfin-apt33-espionage - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://www.cisecurity.org/insights/blog/top-10-malware-march-2022 - webarchive
- https://blog.cluster25.duskrise.com/2023/10/12/cve-2023-38831-russian-attack - webarchive
- https://malwareindepth.com/defeating-nanocore-and-cypherit/ - webarchive
- https://medium.com/@M3HS1N/malware-analysis-nanocore-rat-6cae8c6df918 - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages - webarchive
- https://intel471.com/blog/privateloader-malware - webarchive
- https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage - webarchive
- https://medium.com/@mariohenkel/decrypting-nanocore-config-and-dump-all-plugins-f4944bfaba52?sk=00be46bc5bf99e8ab67369152ceb0332 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NanoLocker
Internal MISP references
UUID 00e1373c-fddf-4b06-9770-e980cc0ada6b which can be used as unique global reference for NanoLocker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NAPLISTENER
Internal MISP references
UUID c5a291c8-c317-48b4-aad1-d5e9d68c2fc5 which can be used as unique global reference for NAPLISTENER in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.naplistener - webarchive
- https://www.elastic.co/de/security-labs/naplistener-more-bad-dreams-from-the-developers-of-siestagraph - webarchive
- https://www.elastic.co/security-labs/ref2924-howto-maintain-persistence-as-an-advanced-threat - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Narilam
Internal MISP references
UUID f5a262c7-59ed-42d1-884d-f8d29acf353f which can be used as unique global reference for Narilam in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nautilus
Internal MISP references
UUID d8295eba-60ef-4900-8091-d694180de565 which can be used as unique global reference for Nautilus in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nautilus - webarchive
- https://www.ncsc.gov.uk/alerts/turla-group-malware - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-hunter - webarchive
- https://www.ncsc.gov.uk/news/turla-group-exploits-iran-apt-to-expand-coverage-of-victims - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NavRAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular NavRAT.
| Known Synonyms |
|---|
JinhoSpy |
Internal MISP references
UUID ec0cad2c-0c13-491a-a869-1dc1758c8872 which can be used as unique global reference for NavRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.navrat - webarchive
- https://www.youtube.com/watch?v=rfzmHjZX70s - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://norfolkinfosec.com/how-to-analyzing-a-malicious-hangul-word-processor-document-from-a-dprk-threat-actor-group/ - webarchive
- https://i.blackhat.com/asia-21/Friday-Handouts/as-21-Kuo-We-Are-About-To-Land-How-CloudDragon-Turns-A-Nightmare-Into-Reality.pdf - webarchive
- https://blog.talosintelligence.com/2018/05/navrat.html?m=1 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
nccTrojan
Internal MISP references
UUID 85056c54-f8f1-4a98-93cb-322cc1deb52c which can be used as unique global reference for nccTrojan in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ncctrojan - webarchive
- https://vblocalhost.com/uploads/VB2020-Ozawa-etal.pdf - webarchive
- https://sebdraven.medium.com/actor-behind-operation-lagtime-targets-russia-f8c277dc52a9 - webarchive
- https://www.socinvestigation.com/chinese-new-backdoor-deployed-for-cyberespionage/ - webarchive
- https://vblocalhost.com/uploads/VB2020-20.pdf - webarchive
- https://insight-jp.nttsecurity.com/post/102gr6l/ta428ncctrojan - webarchive
- https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-Targeted-attack-on-industrial-enterprises-and-public-institutions-En.pdf - webarchive
- https://www.youtube.com/watch?v=1WfPlgtfWnQ - webarchive
- https://twitter.com/ESETresearch/status/1441139057682104325?s=20 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nebulae
Internal MISP references
UUID 76c75ed0-95ba-4393-8020-4400bdc49de6 which can be used as unique global reference for Nebulae in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nebulae - webarchive
- https://www.bleepingcomputer.com/news/security/cyberspies-target-military-organizations-with-new-nebulae-backdoor/ - webarchive
- https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf - webarchive
- https://twitter.com/SyscallE/status/1390339497804636166 - webarchive
- https://www.securityweek.com/chinese-cyberspies-target-military-organizations-asia-new-malware - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Necurs
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Necurs.
| Known Synonyms |
|---|
nucurs |
Internal MISP references
UUID 53ad08a6-cca9-401a-a6da-3c0bff2890eb which can be used as unique global reference for Necurs in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.necurs - webarchive
- https://www.blueliv.com/wp-content/uploads/2018/07/Blueliv-Necurs-report-2017.pdf - webarchive
- https://blogs.microsoft.com/on-the-issues/2020/03/10/necurs-botnet-cyber-crime-disrupt/ - webarchive
- https://www.trustwave.com/Resources/SpiderLabs-Blog/Necurs-Recurs/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-riverview - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf - webarchive
- https://research.nccgroup.com/2021/12/01/tracking-a-p2p-network-related-with-ta505/ - webarchive
- https://lokalhost.pl/txt/peering.into.spam.botnets.VirusBulletin2017.pdf - webarchive
- https://cofense.com/necurs-targeting-banks-pub-file-drops-flawedammyy/ - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-riverview - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/the-new-face-of-necurs-noteworthy-changes-to-necurs-behaviors - webarchive
- https://www.bitsight.com/blog/joint-effort-with-microsoft-to-takedown-massive-criminal-botnet-necurs - webarchive
- http://blog.talosintelligence.com/2017/03/necurs-diversifies.html - webarchive
- https://www.proofpoint.com/us/threat-insight/post/holiday-lull-not-so-much - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://blog.avast.com/botception-with-necurs-botnet-distributes-script-with-bot-capabilities-avast-threat-labs - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://www.shadowserver.org/news/has-the-sun-set-on-the-necurs-botnet/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/necurs-evolves-to-evade-spam-detection-via-internet-shortcut-file/ - webarchive
- https://www.bitsighttech.com/blog/necurs-proxy-module-with-ddos-features - webarchive
- https://www.cert.pl/en/news/single/necurs-hybrid-spam-botnet/ - webarchive
- https://bin.re/blog/the-dgas-of-necurs/ - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NedDnLoader
NedDnLoader is an HTTP(S) downloader that uses AES for C&C trafic encryption.
It sends detailed information about the victim's environment, like computer name, user name, type and free disk space of all drives, and a list of currently running processes. It uses three typical parameter names for HTTP POST requests: ned, gl, hl. The usual payload downloaded with NedDnLoader is Torisma.
The internal DLL name of NedDnLoader is usually Dn.dll, Dn64.dll or DnDll.dll. It is deployed either as a standalone payload or within a trojanized MFC application project. It contains specific RTTI symbols like ".?AVCWininet_Protocol@@" or ".?AVCMFC_DLLApp@@".
Internal MISP references
UUID f061ad00-c215-478e-ae31-77fcdc2f4963 which can be used as unique global reference for NedDnLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.neddnloader - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020OverWatchNowheretoHide.pdf - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/ - webarchive
- https://securelist.com/the-lazarus-group-deathnote-campaign/109490/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.telsy.com/lazarus-gate/ - webarchive
- https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nefilim
According to Vitali Kremez and Michael Gillespie, this ransomware shares much code with Nemty 2.5. A difference is removal of the RaaS component, which was switched to email communications for payments. Uses AES-128, which is then protected RSA2048.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Nefilim.
| Known Synonyms |
|---|
Nephilim |
Internal MISP references
UUID 895f088e-a862-462c-a754-6593c6a471da which can be used as unique global reference for Nefilim in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nefilim - webarchive
- https://labs.sentinelone.com/meet-nemty-successor-nefilim-nephilim-ransomware/ - webarchive
- https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/ - webarchive
- https://www.fireeye.com/blog/threat-research/2020/07/financially-motivated-actors-are-expanding-access-into-ot.html - webarchive
- https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/ - webarchive
- https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-as-a-service-enabler-of-widespread-attacks - webarchive
- https://www.picussecurity.com/resource/blog/how-to-beat-nefilim-ransomware-attacks - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/evolving-danger-ransomware-extortion - webarchive
- https://www.trendmicro.com/en_us/research/21/b/nefilim-ransomware.html - webarchive
- https://www.bleepingcomputer.com/news/security/home-appliance-giant-whirlpool-hit-in-nefilim-ransomware-attack/ - webarchive
- https://www.trendmicro.com/en_us/research/21/f/nefilim-modern-ransomware-attack-story.html - webarchive
- https://securelist.com/evolution-of-jsworm-ransomware/102428/ - webarchive
- https://documents.trendmicro.com/assets/white_papers/wp-modern-ransomwares-double-extortion-tactics.pdf - webarchive
- https://blog.qualys.com/vulnerabilities-research/2021/05/12/nefilim-ransomware - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-mansard - webarchive
- https://intel471.com/blog/how-cybercriminals-create-turbulence-for-the-transportation-industry - webarchive
- https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/ - webarchive
- https://www.cert.govt.nz/it-specialists/advisories/active-ransomware-campaign-leveraging-remote-access-technologies/ - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/wp-spark-state-of-ransomware.pdf - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-345a - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/ - webarchive
- https://www.mandiant.com/resources/financially-motivated-actors-are-expanding-access-into-ot - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://id-ransomware.blogspot.com/2020/03/nefilim-ransomware.html - webarchive
- https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/ - webarchive
- https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/nefilim-ransomware-threatens-to-expose-stolen-data - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nemesis
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Nemesis.
| Known Synonyms |
|---|
Project Nemesis |
Internal MISP references
UUID 2f115fca-2f72-4c20-a93e-9618e51f6e2b which can be used as unique global reference for Nemesis in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nemim
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Nemim.
| Known Synonyms |
|---|
Nemain |
Internal MISP references
UUID 5ce7906e-b1fd-4860-b3e2-ac9c72033428 which can be used as unique global reference for Nemim in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nemty
Nemty is a ransomware that was discovered in September 2019. Fortinet states that they found it being distributed through similar ways as Sodinokibi and also noted artfifacts they had seen before in Gandcrab.
Internal MISP references
UUID 465696be-d576-4750-9469-89e19984f3df which can be used as unique global reference for Nemty in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nemty - webarchive
- https://labs.sentinelone.com/meet-nemty-successor-nefilim-nephilim-ransomware/ - webarchive
- https://github.com/albertzsigovits/malware-notes/blob/master/Nemty.md - webarchive
- https://www.fortinet.com/blog/threat-research/nemty-ransomware-early-stage-threat.html - webarchive
- https://www.bleepingcomputer.com/news/security/nemty-ransomware-decryptor-released-recover-files-for-free/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/nemty-ransomware-learning-by-doing/ - webarchive
- https://medium.com/csis-techblog/the-nemty-affiliate-model-13f5cf7ab66b - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/ - webarchive
- https://www.lastline.com/labsblog/nemty-ransomware-scaling-up-apac-mailboxes-swarmed-dual-downloaders/ - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://securelist.com/evolution-of-jsworm-ransomware/102428/ - webarchive
- https://www.bleepingcomputer.com/news/security/fake-paypal-site-spreads-nemty-ransomware/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-nemty-ransomware-may-spread-via-compromised-rdp-connections/ - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/ - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-mansard - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nemty-ransomware-trik-botnet - webarchive
- https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://raw.githubusercontent.com/k-vitali/Malware-Misc-RE/master/2019-08-24-nemty-ransomware-notes.vk.raw - webarchive
- https://www.bleepingcomputer.com/news/security/nemty-ransomware-gets-distribution-from-rig-exploit-kit/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.sentinelone.com/labs/karma-ransomware-an-emerging-threat-with-a-hint-of-nemty-pedigree/ - webarchive
- https://www.sentinelone.com/labs/nokoyawa-ransomware-new-karma-nemty-variant-wears-thin-disguise/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/ - webarchive
- https://www.tesorion.nl/en/posts/nemty-update-decryptors-for-nemty-1-5-and-1-6/ - webarchive
- https://www.tesorion.nl/nemty-update-decryptors-for-nemty-1-5-and-1-6/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nerbian RAT
Proofpoint observed distribution of this RAT since late April 2022, it is written on Go and incorporates code from various open-source Git repositories.
Internal MISP references
UUID 3dba4da9-7fe0-4b12-a0ed-c55065b87481 which can be used as unique global reference for Nerbian RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
neshta
Neshta is a 2005 Belarusian file infector virus written in Delphi. The name of the virus comes from the Belarusian word "nesta" meaning "something."
Internal MISP references
UUID 13d2482d-21fc-4044-891e-a7fb2b1660e9 which can be used as unique global reference for neshta in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.neshta - webarchive
- https://www.virusradar.com/en/Win32_Neshta.A/description - webarchive
- https://www.mandiant.com/resources/pe-file-infecting-malware-ot - webarchive
- https://www.virusbulletin.com/virusbulletin/2014/08/bird-s-nest - webarchive
- https://threatvector.cylance.com/en_us/home/threat-spotlight-neshta-file-infector-endures.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NESTEGG
NESTEGG is a memory-only backdoor that can proxy commands to other infected systems using a custom routing scheme. It accepts commands to upload and download files, list and delete files, list and terminate processes, and start processes. NESTEGG also creates Windows Firewall rules that allows the backdoor to bind to a specified port number to allow for inbound traffic.
Internal MISP references
UUID fce1f9a7-bac7-4b11-8ea7-3c72931cd14a which can be used as unique global reference for NESTEGG in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nestegg - webarchive
- https://youtu.be/8hJyLkLHH8Q?t=1208 - webarchive
- https://securelist.com/lazarus-under-the-hood/77908/ - webarchive
- https://www.documentcloud.org/documents/4834259-Park-Jin-Hyok-Complaint.html - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180231/LazarusUnderTheHood_PDF_final_for_securelist.pdf - webarchive
- https://youtu.be/_kzFNQySEMw?t=789 - webarchive
- https://content.fireeye.com/apt/rpt-apt38 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NetC
Internal MISP references
UUID 0bc03bfa-1439-4162-bb33-ec9f8f952ee5 which can be used as unique global reference for NetC in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NetDooka
A RAT written in .NET, delivered with a driver to protect it from deletion. Observed being dropped by PrivateLoader.
Internal MISP references
UUID dc6f887b-0c35-471f-9b18-2bf0a4ff357a which can be used as unique global reference for NetDooka in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NETEAGLE
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular NETEAGLE.
| Known Synonyms |
|---|
Neteagle_Scout |
ScoutEagle |
Internal MISP references
UUID 3bb8052e-8ed2-48e3-a2cf-7358bae8c6b5 which can be used as unique global reference for NETEAGLE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.neteagle - webarchive
- https://www.mandiant.com/sites/default/files/2021-09/rpt-apt30.pdf - webarchive
- https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/eagle-eye-is-back-apt30/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NetfilterRootkit
Internal MISP references
UUID 731d992c-f2e0-4e56-a148-b8df5caee8e3 which can be used as unique global reference for NetfilterRootkit in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.netfilter - webarchive
- https://blog.bushidotoken.net/2022/05/gamer-cheater-hacker-spy.html - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/405/Bitdefender-DT-Whitepaper-Fivesys-creat5699-en-EN.pdf - webarchive
- https://blog.360totalsecurity.com/en/netfilter-rootkit-ii-continues-to-hold-whql-signatures/ - webarchive
- https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/ - webarchive
- https://www.vice.com/en/article/pkbzxv/hackers-tricked-microsoft-into-certifying-malware-that-could-spy-on-users - webarchive
- https://www.gdatasoftware.com/blog/microsoft-signed-a-malicious-netfilter-rootkit - webarchive
- https://www.intezer.com/blog/malware-analysis/fast-insights-for-a-microsoft-signed-netfilter-rootkit/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NetFlash
Internal MISP references
UUID 88b2b4ac-9e46-4bc6-b4f6-bf5ddd70ad31 which can be used as unique global reference for NetFlash in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NetKey
Internal MISP references
UUID b8ec2602-c5e5-4b49-a50e-bb3d9676abc3 which can be used as unique global reference for NetKey in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Netrepser
Internal MISP references
UUID 7c6ed154-3232-4b7a-80c3-8052ce0c7333 which can be used as unique global reference for Netrepser in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NetSpy
Freely available network reconnaissance tool.
Internal MISP references
UUID a7cc22b7-0d05-480f-b7f8-a6e6c658dd8f which can be used as unique global reference for NetSpy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NetSupportManager RAT
Enigma Software notes that NetSupport Manager is a genuine application, which was first released about twenty years ago. The purpose of the NetSupport Manager tool is to enable users to receive remote technical support or provide remote computer assistance. However, cyber crooks have hijacked this useful application and misappropriated it to use it in their harmful campaigns. The name of the modified version of the NetSupport Manager has been labeled the NetSupport Manager RAT.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular NetSupportManager RAT.
| Known Synonyms |
|---|
NetSupport |
Internal MISP references
UUID 42562c47-08e1-46bc-962c-28d1831d092b which can be used as unique global reference for NetSupportManager RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.netsupportmanager_rat - webarchive
- https://blog.sucuri.net/2020/11/css-js-steganography-in-fake-flash-player-update-malware.html - webarchive
- https://www.malwarebytes.com/blog/threat-intelligence/2023/09/atomic-macos-stealer-delivered-via-malvertising - webarchive
- https://researchcenter.paloaltonetworks.com/2017/09/unit42-hoeflertext-popups-targeting-google-chrome-users-now-pushing-rat-malware/ - webarchive
- https://blogs.vmware.com/security/2023/11/netsupport-rat-the-rat-king-returns.html - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/operation-ta505-part2/ - webarchive
- https://www.trellix.com/about/newsroom/stories/research/new-techniques-of-fake-browser-updates/ - webarchive
- https://medium.com/walmartglobaltech/socgholish-campaigns-and-initial-access-kit-4c4283fea8ee - webarchive
- https://decoded.avast.io/janrubin/parrot-tds-takes-over-web-servers-and-threatens-millions/ - webarchive
- https://asec.ahnlab.com/en/45312/ - webarchive
- https://blog.prevailion.com/2020/03/the-curious-case-of-criminal-curriculum.html - webarchive
- https://medium.com/walmartglobaltech/smartapesg-4605157a5b80 - webarchive
- https://www.esentire.com/blog/fake-chrome-setup-leads-to-netsupportmanager-rat-and-mars-stealer - webarchive
- http://www.netsupportmanager.com/index.asp - webarchive
- https://www.bleepingcomputer.com/news/security/hacked-steam-accounts-spreading-remote-access-trojan/ - webarchive
- https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ - webarchive
- https://www.bleepingcomputer.com/news/security/malicious-web-redirect-service-infects-16-500-sites-to-push-malware/ - webarchive
- https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks - webarchive
- https://www.trendmicro.com/en_us/research/23/c/new-opcjacker-malware-distributed-via-fake-vpn-malvertising.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NetTraveler
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular NetTraveler.
| Known Synonyms |
|---|
TravNet |
Internal MISP references
UUID 3a26ee44-3224-48f3-aefb-3978c972d928 which can be used as unique global reference for NetTraveler in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nettraveler - webarchive
- https://www.proofpoint.com/us/threat-insight/post/nettraveler-apt-targets-russian-european-interests - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07170728/Guerrero-Saade-Raiu-VB2017.pdf - webarchive
- https://cybergeeks.tech/dissecting-apt21-samples-using-a-step-by-step-approach/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NetWire RC
Netwire is a RAT, its functionality seems focused on password stealing and keylogging, but includes remote control capabilities as well.
Keylog files are stored on the infected machine in an obfuscated form. The algorithm is:
for i in range(0,num_read):
buffer[i] = ((buffer[i]-0x24)^0x9D)&0xFF
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular NetWire RC.
| Known Synonyms |
|---|
NetWeird |
NetWire |
Recam |
Internal MISP references
UUID 1acd0c6c-7aff-462e-94ff-7544b1692740 which can be used as unique global reference for NetWire RC in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.netwire - webarchive
- https://blog.talosintelligence.com/2022/01/nanocore-netwire-and-asyncrat-spreading.html - webarchive
- https://www.sentinelone.com/labs/modifiedelephant-apt-and-a-decade-of-fabricating-evidence/ - webarchive
- https://mp.weixin.qq.com/s/yrDzybPVTbu_9SrZPlSNKA - webarchive
- https://www.amnesty.org/en/latest/research/2020/06/india-human-rights-defenders-targeted-by-a-coordinated-spyware-operation/ - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-trinity - webarchive
- https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html - webarchive
- https://research.checkpoint.com/2023/following-the-scent-of-trickgate-6-year-old-packer-used-to-deploy-the-most-wanted-malware/ - webarchive
- https://www.zscaler.com/blogs/security-research/look-hydrojiin-campaign - webarchive
- http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa - webarchive
- https://blog.talosintelligence.com/2021/04/a-year-of-fajan-evolution-and-bloomberg.html - webarchive
- https://www.sentinelone.com/wp-content/uploads/2022/02/Modified-Elephant-APT-and-a-Decade-of-Fabricating-Evidence-SentinelLabs.pdf - webarchive
- https://lmntrix.com/lab/analysis-of-netwire-rat/ - webarchive
- https://threatpost.com/ta2541-apt-rats-aviation/178422/ - webarchive
- https://www.ciphertechsolutions.com/roboski-global-recovery-automation/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/new-whiteshadow-downloader-uses-microsoft-sql-retrieve-malware - webarchive
- https://www.bleepingcomputer.com/news/security/unskilled-hacker-linked-to-years-of-attacks-on-aviation-transport-sectors/ - webarchive
- https://community.riskiq.com/article/24759ad2 - webarchive
- https://www.secureworks.com/blog/netwire-rat-steals-payment-card-data - webarchive
- https://www.theregister.com/2023/03/10/fbi_netwire_seizure/ - webarchive
- https://resources.malwarebytes.com/files/2020/05/CTNT_Q1_2020_COVID-Report_Final.pdf - webarchive
- https://www.zscaler.com/blogs/security-research/catching-rats-over-custom-protocols - webarchive
- https://umbrella.cisco.com/blog/navigating-cybersecurity-during-a-pandemic-latest-malware-and-threat-actors - webarchive
- https://threatresearch.ext.hp.com/wp-content/uploads/2021/10/HP-Wolf-Security-Threat-Insights-Report-Q3-2021.pdf - webarchive
- https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader - webarchive
- https://maskop9.wordpress.com/2019/01/30/analysis-of-netwiredrc-trojan/ - webarchive
- https://context-cdn.washingtonpost.com/notes/prod/default/documents/b19a6f2e-55a1-4915-9c2d-5fae0110418c/note/b463d38b-2384-4bb0-a94b-b1b17223ffd0. - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf - webarchive
- https://decoded.avast.io/adolfstreda/the-tangle-of-wiryjmpers-obfuscation/ - webarchive
- https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://securityintelligence.com/posts/roboski-global-recovery-automation/ - webarchive
- https://www.gdatasoftware.com/blog/global-pandemic-remcos-tesla-netwire - webarchive
- https://yoroi.company/research/new-cyber-operation-targets-italy-digging-into-the-netwire-attack-chain/ - webarchive
- https://news.drweb.ru/show/?i=13281&c=23 - webarchive
- https://blogs.blackberry.com/en/2021/09/threat-thursday-netwire-rat-is-coming-down-the-line - webarchive
- https://drive.google.com/file/d/1dD2sWYES_hrPsoql4G0aVF9ILIxAS4Fd/view - webarchive
- https://mp.weixin.qq.com/s/xUM2x89GuB8uP6otN612Fg - webarchive
- https://www.youtube.com/watch?v=TeQdZxP0RYY - webarchive
- https://research.loginsoft.com/threat-research/from-innocence-to-malice-the-onenote-malware-campaign-uncovered/ - webarchive
- https://drive.google.com/file/d/13prt2ve_sHNRRiGthB07qtfuinftJX35/view - webarchive
- https://blog.talosintelligence.com/2021/09/operation-armor-piercer.html - webarchive
- https://blog.vincss.net/2020/03/re011-unpack-crypter-cua-malware-netwire-bang-x64dbg.html - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://news.sophos.com/en-us/2020/05/14/raticate/ - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/elfin-apt33-espionage - webarchive
- http://blog.talosintelligence.com/2017/12/recam-redux-deconfusing-confuserex.html - webarchive
- https://news.sophos.com/en-us/2020/07/14/raticate-rats-as-service-with-commercial-crypter/?cmp=30728 - webarchive
- https://www.cybereason.com/blog/cybereason-exposes-malware-targeting-us-taxpayers - webarchive
- https://www.circl.lu/pub/tr-23/ - webarchive
- https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 - webarchive
- http://researchcenter.paloaltonetworks.com/2014/08/new-release-decrypting-netwire-c2-traffic/ - webarchive
- https://www.fortinet.com/blog/threat-research/threat-actors-prey-on-eager-travelers - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Neuron
Internal MISP references
UUID 101c2c0e-c082-4b5a-b820-2da789e839d9 which can be used as unique global reference for Neuron in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.neuron - webarchive
- https://www.ncsc.gov.uk/alerts/turla-group-malware - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-hunter - webarchive
- https://www.ncsc.gov.uk/news/turla-group-exploits-iran-apt-to-expand-coverage-of-victims - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Neutrino
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Neutrino.
| Known Synonyms |
|---|
Kasidet |
Internal MISP references
UUID 3760920e-4d1a-40d8-9e60-508079499076 which can be used as unique global reference for Neutrino in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.neutrino - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/credit-card-scraping-kasidet-builder-leads-to-spike-in-detections/ - webarchive
- http://www.peppermalware.com/2019/01/analysis-of-neutrino-bot-sample-2018-08-27.html - webarchive
- https://malwarebreakdown.com/2017/04/03/shadow-server-domains-leads-to-rig-exploit-kit-dropping-smoke-loader-which-downloads-neutrino-bot-aka-kasidet - webarchive
- https://blog.malwarebytes.com/threat-analysis/2015/08/inside-neutrino-botnet-builder/ - webarchive
- https://www.zscaler.com/blogs/research/malicious-office-files-dropping-kasidet-and-dridex - webarchive
- http://malware.dontneedcoffee.com/2014/06/neutrino-bot-aka-kasidet.html - webarchive
- https://journal.cecyf.fr/ojs/index.php/cybin/article/view/22 - webarchive
- http://blog.ptsecurity.com/2019/08/finding-neutrino.html - webarchive
- https://securityblog.switch.ch/2017/07/07/94-ch-li-domain-names-hijacked-and-used-for-drive-by/ - webarchive
- https://web.archive.org/web/20191223034907/http://blog.ptsecurity.com/2019/08/finding-neutrino.html - webarchive
- https://blog.malwarebytes.com/threat-analysis/2017/02/new-neutrino-bot-comes-in-a-protective-loader/ - webarchive
- https://blog.malwarebytes.com/cybercrime/2017/01/post-holiday-spam-campaign-delivers-neutrino-bot/ - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/01/vb2019-paper-rich-headers-leveraging-mysterious-artifact-pe-format/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Neutrino POS
Internal MISP references
UUID a954e642-4cf4-4293-a4b0-c82cf2db785d which can be used as unique global reference for Neutrino POS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NewBounce
Internal MISP references
UUID 1695fd64-5e6a-456f-97a4-d09937920543 which can be used as unique global reference for NewBounce in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NewCore RAT
Internal MISP references
UUID f18b17a7-9124-42e8-a2f2-4a1a9839aee8 which can be used as unique global reference for NewCore RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.newcore_rat - webarchive
- https://meltx0r.github.io/tech/2020/02/12/goblin-panda-apt.html - webarchive
- https://blog.viettelcybersecurity.com/p1-chien-dich-cua-nhom-apt-trung-quoc-goblin-panda-tan-cong-vao-viet-nam-loi-dung-dai-dich-covid-19/ - webarchive
- https://drive.google.com/file/d/11otA_VmL061KcFC5MhDYuNdIKHYbpyrd/view - webarchive
- https://securelist.com/cycldek-bridging-the-air-gap/97157/ - webarchive
- https://nao-sec.org/2020/01/an-overhead-view-of-the-royal-road.html - webarchive
- https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations - webarchive
- https://medium.com/@Sebdraven/goblin-panda-continues-to-target-vietnam-bc2f0f56dcd6 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NewPass
Internal MISP references
UUID c1dbbd04-050c-47ce-8164-791f17a4a6b4 which can be used as unique global reference for NewPass in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NewPosThings
Internal MISP references
UUID 48f95941-8369-4f80-b2b4-abbacd4bc411 which can be used as unique global reference for NewPosThings in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.newposthings - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/operation-black-atlas-endangers-in-store-card-payments-and-smbs-worldwide-switches-between-blackpos-and-other-tools/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/newposthings-has-new-pos-things/ - webarchive
- https://www.fireeye.com/blog/threat-research/2016/04/multigrain_pointo.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NewsReels
Internal MISP references
UUID 1d32e7c3-840e-4247-b28b-818cb1c4ae7c which can be used as unique global reference for NewsReels in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NewCT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular NewCT.
| Known Synonyms |
|---|
CT |
Internal MISP references
UUID ec50a75e-81f0-48b3-b1df-215eac646421 which can be used as unique global reference for NewCT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.new_ct - webarchive
- https://unit42.paloaltonetworks.com/atoms/shallowtaurus/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-express - webarchive
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-quantum-entanglement.pdf - webarchive
- http://csecybsec.com/download/zlab/20180713_CSE_APT28_X-Agent_Op-Roman%20Holiday-Report_v6_1.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nexster Bot
Internal MISP references
UUID de3aae04-130b-4c5f-b67c-03f872e76697 which can be used as unique global reference for Nexster Bot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NexusLogger
Internal MISP references
UUID dd1408ac-e288-4389-87f3-7650706f1d51 which can be used as unique global reference for NexusLogger in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ngioweb (Windows)
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ngioweb (Windows).
| Known Synonyms |
|---|
Grobios |
Internal MISP references
UUID 35fd764f-8723-4663-9bbf-5b02a64ec02e which can be used as unique global reference for Ngioweb (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NGLite
According to Unit42, NGLite is a backdoor Trojan that is only capable of running commands received through its C2 channel. While the capabilities are standard for a backdoor, NGLite uses a novel C2 channel that leverages a decentralized network based on the legitimate NKN to communicate between the backdoor and the actors.
Internal MISP references
UUID 3bd8a411-5a99-4cf9-bde9-b7c55e79acf8 which can be used as unique global reference for NGLite in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nibiru
Internal MISP references
UUID 5a998606-a9a9-42ad-affb-9be37e11ec25 which can be used as unique global reference for Nibiru in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NightClub
Internal MISP references
UUID 7b9747fa-291a-497b-ae0a-b0760b2b62e5 which can be used as unique global reference for NightClub in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nightclub - webarchive
- https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/ - webarchive
- https://i.blackhat.com/BH-US-23/Presentations/US-23-MatthieuFaou-MoustachedBouncer.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nighthawk
C2 framework.
Internal MISP references
UUID c8b9aa40-9c55-4283-851c-635673f87182 which can be used as unique global reference for Nighthawk in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nighthawk - webarchive
- https://michaelkoczwara.medium.com/hunting-c2-with-shodan-223ca250d06f - webarchive
- https://web.archive.org/web/20220505170100/https://suspicious.actor/2022/05/05/mdsec-nighthawk-study.html - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice - webarchive
- https://github.com/kevoreilly/CAPEv2/blob/master/modules/processing/parsers/CAPE/Nighthawk.py - webarchive
- https://github.com/struppigel/hedgehog-tools/blob/main/nighthawk_str_decoder.py - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NightSky
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular NightSky.
| Known Synonyms |
|---|
Night Sky |
Internal MISP references
UUID 5c8dc23a-86a8-4fee-9fa3-371c9d7b4f1c which can be used as unique global reference for NightSky in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nightsky - webarchive
- https://www.bleepingcomputer.com/news/security/night-sky-is-the-latest-ransomware-targeting-corporate-networks/ - webarchive
- https://www.youtube.com/watch?v=Yzt_zOO8pDM - webarchive
- https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader - webarchive
- https://twitter.com/cglyer/status/1480742363991580674 - webarchive
- https://twitter.com/cglyer/status/1480734487000453121 - webarchive
- https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://www.cynet.com/attack-techniques-hands-on/threats-looming-over-the-horizon/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NimbleMamba
NimbleMamba is a new implant used by TA402/Molerats group as replacement of LastConn. It uses guardrails to ensure that victims are within the TA's target region. It is written in C# and delivered as an obfuscated .NET executable. One seen obfuscator is SmartAssembly.
Internal MISP references
UUID b52a6512-7b0c-431a-8680-93f12921ba46 which can be used as unique global reference for NimbleMamba in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nimbo-C2 (Windows)
According to the author, Nimbo-C2 is yet another (simple and lightweight) C2 framework. The agent currently supports Windows x64 and Linux. It's written in Nim, with some usage of .NET (by dynamically loading the CLR to the process).
Internal MISP references
UUID bda7efa0-e08d-453e-95d4-9307c5104a69 which can be used as unique global reference for Nimbo-C2 (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NimGrabber
Malware written in Nim, stealing data including discord tokens from browsers, exfiltrating the results via a Discord webhook.
Internal MISP references
UUID 5f998c1d-0377-404d-8ece-dd3486758a44 which can be used as unique global reference for NimGrabber in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nimplant
Part of Mythic C2, written in Nim. Considered deprecated, as it is only compatible with Mythic 2.1.
Internal MISP references
UUID b8ecda1e-206e-4ab5-b9d7-e50276ba22ea which can be used as unique global reference for Nimplant in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nimrev
Backdoor written in Nim.
Internal MISP references
UUID 69981781-962a-409a-93c6-cb5377257de8 which can be used as unique global reference for Nimrev in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NimBlackout
According to its author, NimBlackout is an adaptation of the @Blackout project originally developed in C++ by @ZeroMemoryEx, which consists of removing AV/EDRs using the gmer (BYOVD) driver. The main reason for this project was to understand how BYOVD attacks work, and then to provide a valid PoC developed in Nim.
Internal MISP references
UUID 904152c4-7483-41e7-acbb-884a7b32bce4 which can be used as unique global reference for NimBlackout in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NineRAT
Internal MISP references
UUID 2f9982ac-0029-4f4c-b316-4d127dc5f043 which can be used as unique global reference for NineRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NirCmd
NirCmd is a benign tool by NirSoft that provides various functionalities. Among these is e.g. a capability to start regedit as SYSTEM, which is sometimes abused for privilege escalation, or other functionality abusable for other malicious purposes. It is also frequently flagged by AV engines.
Internal MISP references
UUID 51047f06-d824-4b84-a69c-97808b18f6bf which can be used as unique global reference for NirCmd in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
nitlove
Internal MISP references
UUID 1bdd56fe-beca-4652-af39-87b5e45ae130 which can be used as unique global reference for nitlove in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nitol
Internal MISP references
UUID e1fb348b-5e2b-4a26-95af-431065498ff5 which can be used as unique global reference for Nitol in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nitol - webarchive
- https://asec.ahnlab.com/en/44504/ - webarchive
- https://blogs.technet.microsoft.com/microsoft_blog/2012/09/13/microsoft-disrupts-the-emerging-nitol-botnet-being-spread-through-an-unsecure-supply-chain/ - webarchive
- https://en.wikipedia.org/wiki/Nitol_botnet - webarchive
- https://krebsonsecurity.com/tag/nitol/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nitro
Ransomware family which requires payment in Discord gift cards ("Discord Nitro").
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Nitro.
| Known Synonyms |
|---|
Hydra |
Internal MISP references
UUID a81635fc-7bb7-4cd1-b26c-ea8ce6cb2763 which can be used as unique global reference for Nitro in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nitro - webarchive
- https://documents.trendmicro.com/assets/wp/wp-detecting-apt-activity-with-network-traffic-analysis.pdf - webarchive
- https://github.com/nightfallgt/nitro-ransomware - webarchive
- https://twitter.com/malwrhunterteam/status/1430616882231578624 - webarchive
- https://www.bleepingcomputer.com/news/security/discord-nitro-gift-codes-now-demanded-as-ransomware-payments/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nitrokod
A Turkish cryptominer campaign.
Internal MISP references
UUID d52552e2-17dc-425a-bfc8-ee6a037c704c which can be used as unique global reference for Nitrokod in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NixScare Stealer
Internal MISP references
UUID a49d1134-f4d9-4778-bbd4-c70655be9cf6 which can be used as unique global reference for NixScare Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NjRAT
RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."
It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular NjRAT.
| Known Synonyms |
|---|
Bladabindi |
Lime-Worm |
Internal MISP references
UUID ff611c24-289e-4f2d-88d2-cfbf771a4e4b which can be used as unique global reference for NjRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat - webarchive
- https://lab52.io/blog/very-very-lazy-lazyscripters-scripts-double-compromise-in-a-single-obfuscation/ - webarchive
- https://embee-research.ghost.io/practical-queries-for-malware-infrastructure-part-3/ - webarchive
- https://attack.mitre.org/groups/G0096 - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/591/original/062521_SideCopy_%281%29.pdf - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ - webarchive
- https://blog.talosintelligence.com/2021/09/operation-layover-how-we-tracked-attack.html - webarchive
- https://infosecwriteups.com/part1-static-code-analysis-of-the-rat-njrat-2f273408df43 - webarchive
- https://www.4hou.com/posts/VoPM - webarchive
- https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf - webarchive
- https://www.trendmicro.com/en_us/research/21/k/campaign-abusing-rats-uses-fake-websites.html - webarchive
- https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://blogs.360.cn/post/APT-C-44.html - webarchive
- https://pylos.co/wp-content/uploads/2020/02/Threat-Intelligence-and-the-Limits-of-Malware-Analysis.pdf - webarchive
- https://cybergeeks.tech/just-another-analysis-of-the-njrat-malware-a-step-by-step-approach/ - webarchive
- http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf - webarchive
- https://www.trendmicro.com/en_us/research/21/i/Water-Basilisk-Uses-New-HCrypt-Variant-to-Flood-Victims-with-RAT-Payloads.html - webarchive
- https://mp.weixin.qq.com/s/mstwBMkS0G3Et4GOji2mwA - webarchive
- https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html - webarchive
- https://intel471.com/blog/china-cybercrime-undergrond-deepmix-tea-horse-road-great-firewall/ - webarchive
- https://www.ciphertechsolutions.com/roboski-global-recovery-automation/ - webarchive
- https://www.menlosecurity.com/blog/isomorph-infection-in-depth-analysis-of-a-new-html-smuggling-campaign/ - webarchive
- https://github.com/itsKindred/malware-analysis-writeups/blob/master/bashar-bachir-chain/bashar-bachir-analysis.pdf - webarchive
- https://www.proofpoint.com/us/threat-insight/post/new-whiteshadow-downloader-uses-microsoft-sql-retrieve-malware - webarchive
- https://labs.k7computing.com/?p=21904 - webarchive
- https://github.com/threatland/TL-TROJAN/tree/master/TL.RAT/RAT.Win.njRAT - webarchive
- https://di.sclosu.re/en/njrat-malware-spreading-through-discord-cdn-and-facebook-ads/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-american-entities-with-commodity-rats/BlindEagleIOCList.txt - webarchive
- https://www.trendmicro.com/en_us/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-ameri.html - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/591/original/062521_SideCopy_%281%29.pdf?1625657388 - webarchive
- http://blogs.360.cn/post/analysis-of-apt-c-37.html - webarchive
- https://cyberandramen.net/2022/01/12/analysis-of-njrat-powerpoint-macros/ - webarchive
- https://www.zscaler.com/blogs/security-research/catching-rats-over-custom-protocols - webarchive
- https://blog.fortinet.com/2016/11/30/bladabindi-remains-a-constant-threat-by-using-dynamic-dns-services - webarchive
- https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ - webarchive
- https://blog.morphisec.com/syk-crypter-discord - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ - webarchive
- https://blog.talosintelligence.com/2021/08/rat-campaign-targets-latin-america.html - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/ - webarchive
- https://securityintelligence.com/posts/roboski-global-recovery-automation/ - webarchive
- https://unit42.paloaltonetworks.com/njrat-pastebin-command-and-control - webarchive
- https://www.bleepingcomputer.com/news/security/fake-microsoft-teams-updates-lead-to-cobalt-strike-deployment/ - webarchive
- https://www.secureworks.com/research/threat-profiles/copper-fieldstone - webarchive
- https://www.ecucert.gob.ec/wp-content/uploads/2022/03/alerta-APTs-2022-03-23.pdf - webarchive
- https://blog.nviso.eu/2020/09/01/epic-manchego-atypical-maldoc-delivery-brings-flurry-of-infostealers/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/reservations-requested-ta558-targets-hospitality-and-travel - webarchive
- https://ti.360.net/blog/articles/analysis-of-apt-c-27/ - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/594/original/Network_IOCs_list_for_coverage.txt?1625657479 - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://news.sophos.com/en-us/2020/05/14/raticate/ - webarchive
- https://www.vectra.ai/blogpost/moonlight-middle-east-targeted-attacks - webarchive
- https://blog.reversinglabs.com/blog/rats-in-the-library - webarchive
- https://blog.sonatype.com/bladabindi-njrat-rat-in-jdb.js-npm-malware - webarchive
- https://forensicitguy.github.io/njrat-installed-from-msi/ - webarchive
- https://www.trendmicro.com/en_us/research/20/i/wind-up-windscribe-vpn-bundled-with-backdoor.html - webarchive
- https://www.trendmicro.com/en_us/research/23/a/earth-bogle-campaigns-target-middle-east-with-geopolitical-lures.html - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://securelist.com/apt-trends-report-q2-2019/91897/ - webarchive
- https://mp.weixin.qq.com/s/gWOIRNPLVqX761LW8x-S5g - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://malwr-analysis.com/2020/06/21/njrat-malware-analysis/ - webarchive
- https://intel471.com/blog/privateloader-malware - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/592/original/Hashes_IOCs_for_coverage.txt - webarchive
- https://blog.talosintelligence.com/2021/07/sidecopy.html - webarchive
- https://www.microsoft.com/security/blog/2021/11/11/html-smuggling-surges-highly-evasive-loader-technique-increasingly-used-in-banking-malware-targeted-attacks/ - webarchive
- https://www.seqrite.com/documents/en/white-papers/Whitepaper-OperationSideCopy.pdf - webarchive
- https://asec.ahnlab.com/1369 - webarchive
- https://twitter.com/ESETresearch/status/1449132020613922828 - webarchive
- https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains - webarchive
- https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
nmass malware
It's .NET Rat with harcoded key
Internal MISP references
UUID c0a8dc47-13fa-45d7-b55a-e69d798b3244 which can be used as unique global reference for nmass malware in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nocturnal Stealer
Internal MISP references
UUID 94793dbc-3649-40a4-9ccc-1b32846ecb3a which can be used as unique global reference for Nocturnal Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NodeStealer
Internal MISP references
UUID e7890226-7e39-4902-bbce-e384e0847303 which can be used as unique global reference for NodeStealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nokki
Nokki is a RAT type malware which is believe to evolve from Konni RAT. This malware has been tied to attacks containing politically-motivated lures targeting Russian and Cambodian speaking individuals or organizations. Researchers discovered a tie to the threat actor group known as Reaper also known as APT37.
Internal MISP references
UUID f3cbe9ca-e65e-41af-8eb2-1e9877434124 which can be used as unique global reference for Nokki in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nokki - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/ - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nokoyawa Ransomware
Internal MISP references
UUID 934a633a-21f7-4010-a83a-0b64c365355d which can be used as unique global reference for Nokoyawa Ransomware in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nokoyawa - webarchive
- https://www.zscaler.com/blogs/security-research/nokoyawa-ransomware-rust-or-bust - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-007.pdf - webarchive
- https://www.sentinelone.com/labs/nokoyawa-ransomware-new-karma-nemty-variant-wears-thin-disguise/ - webarchive
- https://github.com/MalGamy/YARA_Rules/blob/main/Nokoyawa.yara - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v - webarchive
- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ - webarchive
- https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/ - webarchive
- https://malgamy.github.io/malware-analysis/Nokoyawa/ - webarchive
- https://www.zscaler.com/blogs/security-research/nevada-ransomware-yet-another-nokayawa-variant - webarchive
- https://www.trendmicro.com/en_us/research/22/c/nokoyawa-ransomware-possibly-related-to-hive-.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NominatusToxicBattery
A wiper that overwrites target files with itself, thus spreading in virus-fashion.
Internal MISP references
UUID 2fef9561-e16f-47a9-90c6-a68a1b20cc95 which can be used as unique global reference for NominatusToxicBattery in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nopyfy
Ransomware
Internal MISP references
UUID 62fe621a-04aa-4b5d-95d7-c1c3e4bcd17c which can be used as unique global reference for Nopyfy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NorthStar
An open source C2 framework intended for pentest and red teaming activities.
Internal MISP references
UUID b783b185-e05c-481b-8c04-d0ba1b745713 which can be used as unique global reference for NorthStar in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nosu
According to PCrisk, Nosu is the name of a malicious program classified as a stealer. This malware is designed to steal information from infected machines. The Nosu stealer can extract a wide variety of data from devices and installed applications. The most active campaigns associated with Nosu were noted in North and South America, as well as Southeast Asia.
Internal MISP references
UUID a67b25dd-527f-40fa-b7e0-c93e856c0a4c which can be used as unique global reference for Nosu in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nova Stealer
Nova Stealer is a new information stealer that is offered as Malware-as-a-Service by a new actor called "Sordeal". Its capabilities include password stealing, browser injections, crypto wallet stealing, discord injections, and screen recordings. Parts of its source code have been made available on GitHub, with certain "Premium" features missing.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Nova Stealer.
| Known Synonyms |
|---|
Malicord |
Internal MISP references
UUID fd09577f-18f4-4635-83d8-b64b9e3253f1 which can be used as unique global reference for Nova Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NoxPlayer
Internal MISP references
UUID a077c784-6bc5-488d-b844-978d8d081390 which can be used as unique global reference for NoxPlayer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.noxplayer - webarchive
- https://www.welivesecurity.com/2021/02/01/operation-nightscout-supply-chain-attack-online-gaming-asia/ - webarchive
- https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nozelesn (Decryptor)
Internal MISP references
UUID 6207668d-af17-44a6-97a2-e1b448264529 which can be used as unique global reference for Nozelesn (Decryptor) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
nRansom
Internal MISP references
UUID b9c767c7-a1e8-476a-8032-9686d51df7de which can be used as unique global reference for nRansom in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nransom - webarchive
- https://www.kaspersky.com/blog/nransom-nude-ransomware/18597/ - webarchive
- https://twitter.com/malwrhunterteam/status/910952333084971008 - webarchive
- https://motherboard.vice.com/en_us/article/yw3w47/this-ransomware-demands-nudes-instead-of-bitcoin - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NuggetPhantom
NSFOCUS describes PhantomNugget as a modularized malware toolkit, that was spread using EternalBlue. Payloads included a RAT and a XMRig miner.
Internal MISP references
UUID 25a5ded7-6167-4f9a-b55d-9cfc9a9a9f22 which can be used as unique global reference for NuggetPhantom in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nullmixer
Nullmixer is a dropper/loader for additional malware. It is known to drop a vast amount of different malware, such as info stealers, rats and additional loaders. Samples observed contained up to 8 additional payloads.
Internal MISP references
UUID 430c92f4-95b4-4b1c-813a-46d3e53a0d1e which can be used as unique global reference for Nullmixer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nullmixer - webarchive
- https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/ - webarchive
- https://www.youtube.com/watch?v=92jKJ_G_6ho - webarchive
- https://www.youtube.com/watch?v=yLQfDk3dVmA - webarchive
- https://medium.com/@lcam/updates-from-the-maas-new-threats-delivered-through-nullmixer-d45defc260d1 - webarchive
- https://www.youtube.com/watch?v=v_K_zoPGpdk - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Numando
According to PCrisk, Numando is a banking trojan written in the Delphi programming language. As the malicious program's classification implies, it is designed to steal banking information. Numando primarily targets Brazil, with seldom campaigns occurring in Mexico and Spain.
Internal MISP references
UUID 69d63487-6200-4f71-845e-df3997402b00 which can be used as unique global reference for Numando in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
NVISOSPIT
Internal MISP references
UUID 83cfa206-b485-47fd-b298-1b008ab86507 which can be used as unique global reference for NVISOSPIT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nvisospit - webarchive
- https://twitter.com/Bank_Security/status/1134850646413385728 - webarchive
- http://www.isg.rhul.ac.uk/dl/weekendconference2014/slides/Erik_VanBuggenhout.pdf - webarchive
- https://twitter.com/r3c0nst/status/1135606944427905025 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
N-W0rm
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular N-W0rm.
| Known Synonyms |
|---|
NWorm |
nw0rm |
Internal MISP references
UUID bdc00b3a-2ceb-4818-83fa-96fb11c8540f which can be used as unique global reference for N-W0rm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nymaim
Nymaim is a trojan downloader. It downloads (and runs) other malware on affected systems and was one of the primary malware families hosted on Avalanche. Nymaim is different in that it displays a localized lockscreen while it downloads additional malware. Nymaim is usually delivered by exploit kits and malvertising.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Nymaim.
| Known Synonyms |
|---|
nymain |
Internal MISP references
UUID 9b5255c6-44e5-4ec3-bc03-7e00e220c937 which can be used as unique global reference for Nymaim in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim - webarchive
- https://www.proofpoint.com/us/what-old-new-again-nymaim-moves-past-its-ransomware-roots-0 - webarchive
- https://www.virusbulletin.com/conference/vb2017/abstracts/linking-xpaj-and-nymaim - webarchive
- https://www.lawfareblog.com/what-point-these-nation-state-indictments - webarchive
- https://blog.talosintelligence.com/goznym/ - webarchive
- https://public.gdatasoftware.com/Web/Landingpages/DE/GI-Spring2014/slides/004_plohmann.pdf - webarchive
- https://bitbucket.org/daniel_plohmann/idapatchwork - webarchive
- https://securityintelligence.com/meet-goznym-the-banking-malware-offspring-of-gozi-isfb-and-nymaim/ - webarchive
- https://www.cert.pl/en/news/single/nymaim-revisited/ - webarchive
- https://www.justice.gov/opa/pr/goznym-cyber-criminal-network-operating-out-europe-targeting-american-entities-dismantled - webarchive
- https://www.proofpoint.com/us/threat-insight/post/nymaim-config-decoded - webarchive
- https://securityintelligence.com/posts/goznym-closure-comes-in-the-shape-of-a-europol-and-doj-arrest-operation/ - webarchive
- https://www.sentinelone.com/blog/goznym-banking-malware-gang-busted/ - webarchive
- https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ - webarchive
- https://www.shadowserver.org/news/goznym-indictments-action-following-on-from-successful-avalanche-operations/ - webarchive
- https://www2.deloitte.com/content/dam/Deloitte/us/Documents/risk/us-aers-the-evolution-of-the-nymaim-criminal-enterprise.pdf - webarchive
- https://github.com/coldshell/Malware-Scripts/tree/master/Nymaim - webarchive
- https://arielkoren.com/blog/2016/11/02/nymaim-deep-technical-dive-adventures-in-evasive-malware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Nymaim2
Internal MISP references
UUID c8e8392f-883e-412e-9b0b-02137d0875da which can be used as unique global reference for Nymaim2 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Oblique RAT
Internal MISP references
UUID 33c138a0-85d3-4497-90e9-ada1d501a100 which can be used as unique global reference for Oblique RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.oblique_rat - webarchive
- https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html - webarchive
- https://blog.talosintelligence.com/2020/02/obliquerat-hits-victims-via-maldocs.html - webarchive
- https://umbrella.cisco.com/blog/cybersecurity-threat-spotlight-backdoors-rats-loaders-evasion-techniques - webarchive
- https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/investigating-apt36-or-earth-karkaddan-attack-chain-and-malware-arsenal/IoCs_Investigating%20APT36%20or%20Earth%20Karkaddan%20Attack%20Chain%20and%20Malware%20Arsenal.rtf - webarchive
- https://www.bleepingcomputer.com/news/security/hackers-use-modified-mfa-tool-against-indian-govt-employees/ - webarchive
- https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html - webarchive
- https://www.secrss.com/articles/24995 - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/investigating-apt36-or-earth-karkaddan-attack-chain-and-malware-arsenal/Earth%20Karkaddan%20APT-%20Adversary%20Intelligence%20and%20Monitoring%20Report.pdf - webarchive
- https://www.trendmicro.com/en_us/research/22/a/investigating-apt36-or-earth-karkaddans-attack-chain-and-malware.html - webarchive
- https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://securelist.com/transparent-tribe-part-2/98233/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Obscene
Internal MISP references
UUID 8f623a37-80a4-4240-9586-6ea7a2a97e30 which can be used as unique global reference for Obscene in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ObserverStealer
Internal MISP references
UUID 9ddbf63f-c9a2-4bd6-8449-189f2d2ce5e4 which can be used as unique global reference for ObserverStealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Oceansalt
Internal MISP references
UUID 01cef4e7-a8a8-4b42-b509-f91c5d415354 which can be used as unique global reference for Oceansalt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Octopus (Windows)
Internal MISP references
UUID 777b76f9-5390-4899-b201-ebaa8a329c96 which can be used as unique global reference for Octopus (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.octopus - webarchive
- https://isc.sans.edu/diary/26918 - webarchive
- https://www.prodaft.com/m/reports/PAPERBUG_TLPWHITE-1.pdf - webarchive
- https://mp.weixin.qq.com/s/v1gi0bW79Ta644Dqer4qkw - webarchive
- https://securelist.com/octopus-infested-seas-of-central-asia/88200/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OddJob
Internal MISP references
UUID d8305201-9fec-4e6b-9eec-7ebb756364e2 which can be used as unique global reference for OddJob in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Oderoor
Spam bot that was active around 2007 and after, one of the first malware families to use a domain generation algorithm.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Oderoor.
| Known Synonyms |
|---|
Bobax |
Kraken |
Internal MISP references
UUID fb5c1af2-9028-47c7-937b-ab0ba0078485 which can be used as unique global reference for Oderoor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.oderoor - webarchive
- https://web.archive.org/web/20160324035554/https://www.johannesbader.ch/2015/12/krakens-two-domain-generation-algorithms// - webarchive
- https://web.archive.org/web/20160616170611/https://media.blackhat.com/bh-eu-10/presentations/Carrera_Silberman/BlackHat-EU-2010-Carrera-Silberman-State-of-Malware-slides.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Odinaff
Internal MISP references
UUID 045df65f-77fe-4880-af34-62ca33936c6e which can be used as unique global reference for Odinaff in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.odinaff - webarchive
- https://web.archive.org/web/20161223002016/https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks - webarchive
- https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Okrum
a new, previously unknown backdoor that we named Okrum. The malicious actors behind the Okrum malware were focused on the same targets in Slovakia that were previously targeted by Ketrican 2015 backdoors.
Internal MISP references
UUID af2e4e0d-e8ae-48a9-aac4-2a49242c68d2 which can be used as unique global reference for Okrum in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.okrum - webarchive
- https://www.ptsecurity.com/ww-en/analytics/antisandbox-techniques/ - webarchive
- https://www.intezer.com/blog/research/the-evolution-of-apt15s-codebase-2020/ - webarchive
- https://www.welivesecurity.com/2019/07/18/okrum-ke3chang-targets-diplomatic-missions/ - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OLDBAIT
According to FireEye, OLDBAIT is a credential stealer that has been observed to be used by APT28. It targets Internet Explorer, Mozilla Firefox, Eudora, The Bat! (an email client by a Moldovan company), and Becky! (an email client made by a Japanese company). It can use both HTTP or SMTP to exfiltrate data. In some places it is mistakenly named "Sasfis", which however seems to be a completely different and unrelated malware family.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular OLDBAIT.
| Known Synonyms |
|---|
Sasfis |
Internal MISP references
UUID b79a6b61-f122-4823-a4ab-bbab89fcaf75 which can be used as unique global reference for OLDBAIT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Olympic Destroyer
Malware which seems to have no function other than to disrupt computer systems related to the 2018 Winter Olympic event.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Olympic Destroyer.
| Known Synonyms |
|---|
SOURGRAPE |
Internal MISP references
UUID f3ba8a50-0105-4aa9-90b2-01df15f50b28 which can be used as unique global reference for Olympic Destroyer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.olympic_destroyer - webarchive
- https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat - webarchive
- https://securelist.com/olympic-destroyer-is-still-alive/86169/ - webarchive
- https://www.endgame.com/blog/technical-blog/stopping-olympic-destroyer-new-process-injection-insights - webarchive
- https://cyber.wtf/2018/03/28/dissecting-olympic-destroyer-a-walk-through/ - webarchive
- http://blog.talosintelligence.com/2018/02/who-wasnt-responsible-for-olympic.html - webarchive
- https://attack.mitre.org/groups/G0034 - webarchive
- https://www.virusbulletin.com/virusbulletin/2018/10/vb2018-paper-who-wasnt-responsible-olympic-destroyer/ - webarchive
- https://www.youtube.com/watch?v=1jgdMY12mI8 - webarchive
- https://www.wired.com/story/us-indicts-sandworm-hackers-russia-cyberwar-unit/ - webarchive
- https://www.lastline.com/labsblog/olympic-destroyer-south-korea/ - webarchive
- http://blog.talosintelligence.com/2018/02/olympic-destroyer.html - webarchive
- https://www.lastline.com/labsblog/attribution-from-russia-with-code/ - webarchive
- https://www.riskint.blog/post/revisited-fancy-bear-s-new-faces-and-sandworms-too - webarchive
- https://www.youtube.com/watch?v=rjA0Vf75cYk - webarchive
- https://www.wired.com/story/untold-story-2018-olympics-destroyer-cyberattack/ - webarchive
- https://www.youtube.com/watch?v=a4BZ3SZN-CI - webarchive
- https://www.mbsd.jp/blog/20180215.html - webarchive
- https://securelist.com/the-devils-in-the-rich-header/84348/ - webarchive
- https://enterprise.verizon.com/resources/reports/2019-data-breach-investigations-report.pdf - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/ - webarchive
- https://www.youtube.com/watch?v=wCv9SiSA7Sw - webarchive
- https://securelist.com/apt-trends-report-q2-2019/91897/ - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://securelist.com/olympicdestroyer-is-here-to-trick-the-industry/84295/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ONHAT
Internal MISP references
UUID 82733125-da67-44ff-b2ac-b16226088211 which can be used as unique global reference for ONHAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Oni
Ransomware.
Internal MISP references
UUID c182f370-4721-4968-a3b1-a7e96ab876df which can be used as unique global reference for Oni in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OnionDuke
OnionDuke is a new sophisticated piece of malware distributed by threat actors through a malicious exit node on the Tor anonymity network appears to be related to the notorious MiniDuke, researchers at F-Secure discovered. According to experts, since at least February 2014, the threat actors have also distributed the threat through malicious versions of pirated software hosted on torrent websites.
Internal MISP references
UUID abd10caa-7d4c-4c22-8dae-8d32f13232d7 which can be used as unique global reference for OnionDuke in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.onionduke - webarchive
- https://www.carbonblack.com/2020/03/26/the-dukes-of-moscow/ - webarchive
- https://www.f-secure.com/weblog/archives/00002764.html - webarchive
- https://blog.f-secure.com/podcast-dukes-apt29/ - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-hemlock - webarchive
- http://contagiodump.blogspot.com/2014/11/onionduke-samples.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OnlinerSpambot
A spambot that has been observed being used for spreading Ursnif, Zeus Panda, Andromeda or Netflix phishing against Italy and Canada.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular OnlinerSpambot.
| Known Synonyms |
|---|
Onliner |
SBot |
Internal MISP references
UUID 6cf05dad-86c8-4f46-b5b8-0a004360563f which can be used as unique global reference for OnlinerSpambot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.onliner - webarchive
- https://www.blueliv.com/blog/research/analysis-spam-distribution-botnet-onliner-spambot/ - webarchive
- https://benkowlab.blogspot.com/2017/08/from-onliner-spambot-to-millions-of.html - webarchive
- https://benkowlab.blogspot.fr/2017/02/spambot-safari-2-online-mail-system.html - webarchive
- https://outpost24.com/blog/an-analysis-of-a-spam-distribution-botnet - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OopsIE
Internal MISP references
UUID d07c3def-91af-4d9b-bdf7-62c9e0b44968 which can be used as unique global reference for OopsIE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.oopsie - webarchive
- https://docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc/edit#heading=h.hcd1wvpsrgfr - webarchive
- https://www.ptsecurity.com/ww-en/analytics/antisandbox-techniques/ - webarchive
- https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/ - webarchive
- https://cyware.com/blog/apt34-the-helix-kitten-cybercriminal-group-loves-to-meow-middle-eastern-and-international-organizations-48ae - webarchive
- https://unit42.paloaltonetworks.com/atoms/evasive-serpens/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Opachki
Internal MISP references
UUID f50de0a8-35a7-406e-9f53-8f7d5448e1e7 which can be used as unique global reference for Opachki in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.opachki - webarchive
- http://contagiodump.blogspot.com/2009/11/win32opachkia-trojan-that-removes-zeus.html - webarchive
- https://forum.malekal.com/viewtopic.php?t=21806 - webarchive
- https://isc.sans.edu/diary/Opachki%2C+from+%28and+to%29+Russia+with+love/7519 - webarchive
- http://contagiodump.blogspot.com/2010/03/march-2010-opachki-trojan-update-and.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OpcJacker
Internal MISP references
UUID 22f732f4-efcf-4eb5-8c51-8338dfd33297 which can be used as unique global reference for OpcJacker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OpenSUpdater
Internal MISP references
UUID 03d44ec8-ebb4-4d90-9773-c11f4a7de074 which can be used as unique global reference for OpenSUpdater in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OpenCarrot
Internal MISP references
UUID 7fb5882e-1682-45d3-9dfb-204e6c1ca4c9 which can be used as unique global reference for OpenCarrot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OpGhoul
This entry serves as a placeholder of malware observed during Operation Ghoul. The samples will likely be assigned to their respective families. Some families involved and identified were Alina POS (Katrina variant) and TreasureHunter POS.
Internal MISP references
UUID 25a280b2-0260-4593-bf8c-7062dfdc6c38 which can be used as unique global reference for OpGhoul in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OpBlockBuster
Internal MISP references
UUID 25c962c5-5616-4fe3-ad44-68c4ac4c726d which can be used as unique global reference for OpBlockBuster in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ORANGEADE
FireEye details ORANGEADE as a dropper for the CREAMSICLE malware.
Internal MISP references
UUID 092262b0-c631-400d-9f38-017cd59a14fd which can be used as unique global reference for ORANGEADE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OrcaRAT
OrcaRAT is a Backdoor that targets the Windows platform. It has been reported that a variant of this malware has been used in a targeted attack. It contacts a remote server, sending system information. Moreover, it receives control commands to execute shell commands, and download/upload a file, among other actions.
Internal MISP references
UUID 08103f1c-f83d-4037-a1ae-109b06f79226 which can be used as unique global reference for OrcaRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Orchard
A malware generating DGA domains seeded by the Bitcoin Genesis Block. This family has strong code overlap with win.victorygate.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Orchard.
| Known Synonyms |
|---|
Antavmu |
Internal MISP references
UUID 094159e7-cc4f-4c47-b24e-b0a32ba23a58 which can be used as unique global reference for Orchard in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.orchard - webarchive
- https://bin.re/blog/a-dga-seeded-by-the-bitcoin-genesis-block/ - webarchive
- https://malverse.it/stack-string-decryptor-con-ghidra-emulator-orchard - webarchive
- https://blog.netlab.360.com/orchard-dga/ - webarchive
- https://blog.netlab.360.com/a-new-botnet-orchard-generates-dga-domains-with-bitcoin-transaction-information/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Orcus RAT
Orcus has been advertised as a Remote Administration Tool (RAT) since early 2016. It has all the features that would be expected from a RAT and probably more. The long list of the commands is documented on their website. But what separates Orcus from the others is its capability to load custom plugins developed by users, as well as plugins that are readily available from the Orcus repository. In addition to that, users can also execute C# and VB.net code on the remote machine in real-time.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Orcus RAT.
| Known Synonyms |
|---|
Schnorchel |
Internal MISP references
UUID c41e7fdd-f1b1-4b87-97d7-634202af8b61 which can be used as unique global reference for Orcus RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.orcus_rat - webarchive
- http://researchcenter.paloaltonetworks.com/2016/08/unit42-orcus-birth-of-an-unusual-plugin-builder-rat/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/log4j-vulnerabilities-attacks - webarchive
- https://assets.virustotal.com/reports/2021trends.pdf - webarchive
- https://krebsonsecurity.com/2019/04/canadian-police-raid-orcus-rat-author/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://any.run/cybersecurity-blog/orcus-rat-malware-analysis/ - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://krebsonsecurity.com/2016/07/canadian-man-is-author-of-popular-orcus-rat/ - webarchive
- https://blog.talosintelligence.com/2019/08/rat-ratatouille-revrat-orcus.html - webarchive
- https://asec.ahnlab.com/en/45462/ - webarchive
- https://www.canada.ca/en/radio-television-telecommunications/news/2019/03/crtc-and-rcmp-national-division-execute-warrants-in-malware-investigation.html - webarchive
- https://blog.fortinet.com/2017/12/07/a-peculiar-case-of-orcus-rat-targeting-bitcoin-investors - webarchive
- https://blog.checkpoint.com/2019/02/27/protecting-against-winrar-vulnerabilities/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ordinypt
This malware claims to be a ransomware, but it's actually a wiper. After execution, this malware terminates a number of processes such as database processes, likely to allow access to any files that these programs may have held open. Ordinypt will avoid wiping certain files and folders in order to prevent the infected machine from becoming unusable. Affected files are overwritten with null character and receive a random 5 character file extension. Finally, shadow copies are removed and Windows startup repair is disabled to complicate recovery of data from the affected system. The desktop background is changed and a ransom note is dropped for the victim. A C2 check-in occurs to keep track of the file extension used on that specific machine, as well as which BitCoin address was randomly provided for payment to the victim (drawn from a long list stored in the ransomware configuration).
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ordinypt.
| Known Synonyms |
|---|
GermanWiper |
HSDFSDCrypt |
Internal MISP references
UUID 7fd96553-4c78-43de-824f-82645ed4fac5 which can be used as unique global reference for Ordinypt in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ordinypt - webarchive
- https://www.carbonblack.com/2019/09/05/cb-threat-analysis-unit-technical-breakdown-germanwiper-ransomware/ - webarchive
- https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/ - webarchive
- https://dissectingmalwa.re/tfw-ransomware-is-only-your-side-hustle.html - webarchive
- https://www.gdata.de/blog/2017/11/30151-ordinypt - webarchive
- https://www.bleepingcomputer.com/news/security/ordinypt-ransomware-intentionally-destroys-files-currently-targeting-germany/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OriginBot
OriginBot is a modular information stealer which can also download and execute other malicious payloads.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular OriginBot.
| Known Synonyms |
|---|
OriginBotnet |
OriginLoader |
Internal MISP references
UUID 1a2ae63f-323f-4ff7-b465-484f1e87fca4 which can be used as unique global reference for OriginBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OriginLogger
Internal MISP references
UUID c1680c8e-c2e2-4975-82ad-8829b3918d70 which can be used as unique global reference for OriginLogger in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ORPCBackdoor
Internal MISP references
UUID 27c09b74-6e1e-4567-ae10-75eee3395c36 which can be used as unique global reference for ORPCBackdoor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Oski Stealer
Oski is a stealer written in C++ that appeared around November 2019 and is being sold for between 70$ to 100$ on Russian-speaking forums. It collects different types of data (cryptocurrency wallets, saved passwords, files matching an attacker-defined pattern etc) and it exfiltrates it in a zip file uploaded to the attacker's panel.
Internal MISP references
UUID 414d8e68-77e7-4157-936a-d70d80e5efc0 which can be used as unique global reference for Oski Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.oski - webarchive
- https://3xp0rt.com/posts/mars-stealer - webarchive
- https://isc.sans.edu/diary/Arkei+Variants%3A+From+Vidar+to+Mars+Stealer/28468 - webarchive
- https://blog.minerva-labs.com/underminer-exploit-kit-the-more-you-check-the-more-evasive-you-become - webarchive
- https://drive.google.com/file/d/1c72YIF6JYcEvbFZCrkZO26D9hC3gnyMP/view - webarchive
- https://www.cyberark.com/resources/threat-research-blog/meet-oski-stealer-an-in-depth-analysis-of-the-popular-credential-stealer - webarchive
- https://yoroi.company/research/the-wayback-campaign-a-large-scale-operation-hiding-in-plain-sight/ - webarchive
- https://labs.bitdefender.com/2020/03/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/ - webarchive
- https://twitter.com/albertzsigovits/status/1160874557454131200 - webarchive
- https://cyberint.com/blog/research/mars-stealer/ - webarchive
- https://medium.com/shallvhack/oski-stealer-a-credential-theft-malware-b9bba5164601 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Osno
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Osno.
| Known Synonyms |
|---|
Babax |
Internal MISP references
UUID e2be4da9-0a8f-45a5-a69b-7f16acb39398 which can be used as unique global reference for Osno in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ousaban
Internal MISP references
UUID 6620c7ce-63a2-48db-a584-4c5c516bda13 which can be used as unique global reference for Ousaban in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ousaban - webarchive
- https://www.welivesecurity.com/2021/05/05/ousaban-private-photo-collection-hidden-cabinet/ - webarchive
- https://www.netskope.com/blog/ousaban-latam-banking-malware-abusing-cloud-services - webarchive
- https://www.atomicmatryoshka.com/post/ousaban-msi-installer-analysis - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OutCrypt
Ransomware.
Internal MISP references
UUID 90e5a21a-c058-47a0-aa4d-bffde7ba698e which can be used as unique global reference for OutCrypt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Outlook Backdoor
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Outlook Backdoor.
| Known Synonyms |
|---|
FACADE |
Internal MISP references
UUID 10a521e4-b3b9-4feb-afce-081531063e7b which can be used as unique global reference for Outlook Backdoor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.outlook_backdoor - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://twitter.com/VK_Intel/status/1085820673811992576 - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OutSteel
According to MITRE, OutSteel is a file uploader and document stealer developed with the scripting language AutoIT that has been used by Ember Bear since at least March 2021.
Internal MISP references
UUID d2aab7c9-b83a-4889-9fae-c495ec4d324d which can be used as unique global reference for OutSteel in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Overlay RAT
Internal MISP references
UUID 842687f5-91bc-4719-ac3f-4166ae02e0cd which can be used as unique global reference for Overlay RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OvidiyStealer
Internal MISP references
UUID 30d49b12-0dca-4652-9f7a-4d0cf7555375 which can be used as unique global reference for OvidiyStealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
owaauth
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular owaauth.
| Known Synonyms |
|---|
luckyowa |
Internal MISP references
UUID 37f66fcc-e093-4d97-902d-c96602a7d234 which can be used as unique global reference for owaauth in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Owlproxy
Internal MISP references
UUID 7a6d97a2-821f-4083-9180-3f70a851ad5e which can be used as unique global reference for Owlproxy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.owlproxy - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf - webarchive
- https://securelist.com/the-sessionmanager-iis-backdoor/106868/ - webarchive
- https://medium.com/cycraft/taiwan-government-targeted-by-multiple-cyberattacks-in-april-2020-3b20cea1dc20 - webarchive
- https://lab52.io/blog/chimera-apt-updates-on-its-owlproxy-malware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Owowa
Kaspersky describes this as a OWA add-on that has credential stealing capabilities.
Internal MISP references
UUID aa985bc5-92e4-43c6-a01b-1de02818cfc9 which can be used as unique global reference for Owowa in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OxtaRAT
Internal MISP references
UUID a5b379c0-7934-4a50-9a34-7ad1524b1fb0 which can be used as unique global reference for OxtaRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
OZH RAT
Internal MISP references
UUID c9eefa23-4881-490f-abff-c78fe0c165ff which can be used as unique global reference for OZH RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ozone RAT
Internal MISP references
UUID 4e319700-9350-4656-91f5-0b495af4e8ad which can be used as unique global reference for Ozone RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ozone - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/reservations-requested-ta558-targets-hospitality-and-travel - webarchive
- https://www.fortinet.com/blog/threat-research/german-speakers-targeted-by-spam-leading-to-ozone-rat.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PadCrypt
Internal MISP references
UUID c21335f5-b145-4029-b1bc-161362c7ce80 which can be used as unique global reference for PadCrypt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
paladin
Paladin RAT is a variant of Gh0st RAT used by PittyPanda active since at least 2011.
Internal MISP references
UUID c6728a76-f4d9-4c49-a3aa-be895df13a35 which can be used as unique global reference for paladin in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PandaBanker
According to Arbor, Forcepoint and Proofpoint, Panda is a variant of the well-known Zeus banking trojan(*). Fox IT discovered it in February 2016.
This banking trojan uses the infamous ATS (Automatic Transfer System/Scripts) to automate online bank portal actions.
The baseconfig (c2, crypto material, botnet name, version) is embedded in the malware itself. It then obtains a dynamic config from the c2, with further information about how to grab the webinjects and additional modules, such as vnc, backsocks and grabber.
Panda does have some DGA implemented, but according to Arbor, a bug prevents it from using it.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PandaBanker.
| Known Synonyms |
|---|
ZeusPanda |
Internal MISP references
UUID 31ebe294-f125-4cf3-95cc-f4150ab23303 which can be used as unique global reference for PandaBanker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pandabanker - webarchive
- https://www.youtube.com/watch?v=J7VOfAJvxEY - webarchive
- https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree - webarchive
- https://www.proofpoint.com/us/threat-insight/post/holiday-lull-not-so-much - webarchive
- https://www.proofpoint.com/us/threat-insight/post/zeus-panda-banking-trojan-targets-online-holiday-shoppers - webarchive
- https://www.spamhaus.org/news/article/771/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://www.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revealing-threat-in-the-shadow-by-chi-en-shen-ashley-oleg-bondarenko - webarchive
- https://www.vkremez.com/2018/08/lets-learn-dissecting-panda-banker.html - webarchive
- https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf - webarchive
- http://blog.talosintelligence.com/2017/11/zeus-panda-campaign.html - webarchive
- https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta544-targets-geographies-italy-japan-range-malware - webarchive
- https://cyber.wtf/2017/03/13/zeus-panda-webinjects-dont-trust-your-eyes/ - webarchive
- http://www.vkremez.com/2018/01/lets-learn-dissect-panda-banking.html - webarchive
- https://medium.com/@crovax/panda-banker-analysis-part-1-d08b3a855847 - webarchive
- https://www.arbornetworks.com/blog/asert/panda-banker-zeros-in-on-japanese-targets/ - webarchive
- https://f5.com/labs/articles/threat-intelligence/malware/panda-malware-broadens-targets-to-cryptocurrency-exchanges-and-social-media - webarchive
- https://cyber.wtf/2017/02/03/zeus-panda-webinjects-a-case-study/ - webarchive
- https://github.com/JR0driguezB/malware_configs/tree/master/PandaBanker - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Panda Stealer
According to PCrisk, Panda is the name of a malicious program, which is classified as a stealer. It is a new variant of CollectorStealer.
The aim of this malware is to extract and exfiltrate sensitive and personal information from infected devices. Panda primarily targets data relating to cryptocurrency wallets.
This piece of malicious software has been observed being actively distributed via spam campaigns - large-scale operations during which thousands of scam emails are sent. The spam mail proliferating Panda stealer heavily targeted users from the United States, Germany, Japan, and Australia.
The deceptive email letters concerned business-related topics (e.g., fake product quote requests, etc.). Panda stealer is a dangerous program, and as such - its infections must be removed immediately upon detection.
Internal MISP references
UUID 7fa924a9-4d7a-406c-b298-bf3b01557ac8 which can be used as unique global reference for Panda Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Pandora
Pandora ransomware was obtained by vx-underground at 2022-03-14.
Internal MISP references
UUID e43b67bc-3c16-4a69-b63d-f6bf3d732e1b which can be used as unique global reference for Pandora in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pandora - webarchive
- https://dissectingmalwa.re/blog/pandora/ - webarchive
- https://www.fortinet.com/blog/threat-research/looking-inside-pandoras-box - webarchive
- https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader - webarchive
- https://kienmanowar.wordpress.com/2022/03/21/quicknote-analysis-of-pandora-ransomware/ - webarchive
- https://cloudsek.com/technical-analysis-of-emerging-sophisticated-pandora-ransomware-group/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://blog.cyble.com/2022/03/15/deep-dive-analysis-pandora-ransomware/ - webarchive
- https://www.fortinet.com/blog/threat-research/Using-emulation-against-anti-reverse-engineering-techniques - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Pandora RAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pandora RAT.
| Known Synonyms |
|---|
Pandora hVNC RAT |
Internal MISP references
UUID db259f3d-b8a1-44d4-8c4d-15bfea2a0c59 which can be used as unique global reference for Pandora RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pandora_rat - webarchive
- https://cip.gov.ua/en/news/khto-stoyit-za-kiberatakami-na-ukrayinsku-kritichnu-informaciinu-infrastrukturu-statistika-15-22-bereznya - webarchive
- https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware - webarchive
- https://github.com/AZMagic/Pandora-Hvnc-Hidden-Browser-Real-Vnc-Working-Chromium-Edge-Opera-Gx - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Paradies Clipper
Internal MISP references
UUID dd1bb757-6084-408a-8090-4e2bf0834c09 which can be used as unique global reference for Paradies Clipper in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Paradise
Ransomware.
Internal MISP references
UUID 4f7e7602-79f8-4eea-8239-fb2d4ceadb9f which can be used as unique global reference for Paradise in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.paradise - webarchive
- https://cocomelonc.github.io/book/2023/12/13/malwild-book.html - webarchive
- https://marcoramilli.com/2021/08/23/paradise-ransomware-the-builder/ - webarchive
- https://mssplab.github.io/threat-hunting/2023/06/23/src-paradise.html - webarchive
- https://therecord.media/source-code-for-paradise-ransomware-leaked-on-hacking-forums/ - webarchive
- https://www.trendmicro.com/en_us/research/23/d/rapture-a-ransomware-family-with-similarities-to-paradise.html - webarchive
- https://www.acronis.com/en-us/blog/posts/paradise-ransomware-strikes-again - webarchive
- https://www.lastline.com/labsblog/iqy-files-and-paradise-ransomware/ - webarchive
- https://labs.bitdefender.com/2020/01/paradise-ransomware-decryption-tool - webarchive
- https://asec.ahnlab.com/en/47590/ - webarchive
- https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Parallax RAT
Parallax is a Remote Access Trojan used by attackers to gain access to a victim's machine. It was involved in one of the many infamous "coronamalware" campaigns. Basically, the attackers abused the COVID-19 pandemic news to lure victims into opening themed emails spreading parallax.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Parallax RAT.
| Known Synonyms |
|---|
ParallaxRAT |
Internal MISP references
UUID 39f74f33-467e-47a4-bd2f-e0a191dee9ca which can be used as unique global reference for Parallax RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.parallax - webarchive
- https://twitter.com/malwrhunterteam/status/1227196799997431809 - webarchive
- https://threatpost.com/ta2541-apt-rats-aviation/178422/ - webarchive
- https://www.uptycs.com/blog/cryptocurrency-entities-at-risk-threat-actor-uses-parallax-rat-for-infiltration - webarchive
- https://blog.morphisec.com/parallax-rat-active-status - webarchive
- https://www.bleepingcomputer.com/news/security/unskilled-hacker-linked-to-years-of-attacks-on-aviation-transport-sectors/ - webarchive
- https://www.bleepingcomputer.com/news/security/parallax-rat-common-malware-payload-after-hacker-forums-promotion/ - webarchive
- https://blog.talosintelligence.com/2020/02/coronavirus-themed-malware.html - webarchive
- https://www.vkremez.com/2020/02/lets-learn-inside-parallax-rat-malware.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
parasite_http
Internal MISP references
UUID c5eee19f-0877-4709-86ea-328e346af1bf which can be used as unique global reference for parasite_http in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PartyTicket
PartyTicket is a Go-written ransomware, which was described as a poorly designed one by Zscaler. According to Brett Stone-Gross this malware is likely intended to be a diversion from the Hermetic wiper (aka. KillDisk.NCV, DriveSlayer) attack.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PartyTicket.
| Known Synonyms |
|---|
Elections GoRansom |
HermeticRansom |
SonicVote |
Internal MISP references
UUID 697d905a-5353-43ed-97e0-15f7d2763b69 which can be used as unique global reference for PartyTicket in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.partyticket - webarchive
- https://securelist.com/webinar-on-cyberattacks-in-ukraine-summary-and-qa/106075/ - webarchive
- https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine - webarchive
- https://www.crowdstrike.com/blog/how-to-decrypt-the-partyticket-ransomware-targeting-ukraine/ - webarchive
- https://services.google.com/fh/files/blogs/google_fog_of_war_research_report.pdf - webarchive
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-hermeticwiper-partyticket - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict/IOC%20Resource%20for%20Russia-Ukraine%20Conflict-Related%20Cyberattacks-03032022.pdf - webarchive
- https://threatpost.com/free-hermeticransom-ransomware-decryptor-released/178762/ - webarchive
- https://www.mandiant.com/resources/information-operations-surrounding-ukraine - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ - webarchive
- https://www.kaspersky.com/blog/hermeticransom-hermeticwiper-attacks-2022/43825/ - webarchive
- https://www.techtarget.com/searchsecurity/news/252514091/CrowdStrike-cracks-PartyTicket-ransomware-targeting-Ukraine - webarchive
- https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/ - webarchive
- https://www.brighttalk.com/webcast/15591/534324 - webarchive
- https://inquest.net/blog/2022/04/07/ukraine-cyberwar-overview - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4Vwwd - webarchive
- https://securelist.com/new-ransomware-trends-in-2022/106457/ - webarchive
- https://www.mandiant.com/resources/russia-invasion-ukraine-retaliation - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war - webarchive
- https://www.zscaler.com/blogs/security-research/technical-analysis-partyticket-ransomware - webarchive
- https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/ - webarchive
- https://www.microsoft.com/en-us/security/business/security-insider/wp-content/uploads/2023/03/A-year-of-Russian-hybrid-warfare-in-Ukraine_MS-Threat-Intelligence-1.pdf - webarchive
- https://go.recordedfuture.com/hubfs/reports/mtp-2022-0302.pdf - webarchive
- https://securelist.com/elections-goransom-and-hermeticwiper-attack/105960/ - webarchive
- https://decoded.avast.io/threatresearch/help-for-ukraine-free-decryptor-for-hermeticransom-ransomware/ - webarchive
- https://www.youtube.com/watch?v=mrTdSdMMgnk - webarchive
- https://www.bleepingcomputer.com/news/security/free-decryptor-released-for-hermeticransom-victims-in-ukraine/ - webarchive
- https://www.splunk.com/en_us/blog/security/detecting-hermeticwiper.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Passlock
Ransomware.
Internal MISP references
UUID 1e78c732-c2f0-4178-a1f5-ccdab0e2d4b8 which can be used as unique global reference for Passlock in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Pay2Key
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pay2Key.
| Known Synonyms |
|---|
Cobalt |
Internal MISP references
UUID 46dc64c6-e927-44fc-b4a4-efd1677ae030 which can be used as unique global reference for Pay2Key in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pay2key - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://research.checkpoint.com/2020/ransomware-alert-pay2key/ - webarchive
- https://twitter.com/TrendMicroRSRCH/status/1389422784808378370 - webarchive
- https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/intels-habana-labs-hacked-by-pay2key-ransomware-data-stolen/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PayloadBIN
Internal MISP references
UUID 313c81ab-fba2-4577-8de6-863515a65c45 which can be used as unique global reference for PayloadBIN in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PcShare
PcShare is a open-source backdoor which has been seen modified and used by Chinese threat actors, mainly attacking countries in South East Asia.
Internal MISP references
UUID 42100d7e-39c7-47c0-bc9e-3c590ed0d837 which can be used as unique global reference for PcShare in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pcshare - webarchive
- https://web.archive.org/web/20191115210757/https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0616.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PEBBLEDASH
Internal MISP references
UUID d6da9699-778c-4c97-82f4-1e9113283bd4 which can be used as unique global reference for PEBBLEDASH in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pebbledash - webarchive
- https://blog.reversinglabs.com/blog/hidden-cobra - webarchive
- https://download.ahnlab.com/global/brochure/Analysis%20Report%20of%20Kimsuky%20Group.pdf - webarchive
- https://www.us-cert.gov/ncas/analysis-reports/ar20-133c - webarchive
- https://asec.ahnlab.com/en/30022/ - webarchive
- https://asec.ahnlab.com/wp-content/uploads/2021/11/Kimsuky-%EA%B7%B8%EB%A3%B9%EC%9D%98-APT-%EA%B3%B5%EA%B2%A9-%EB%B6%84%EC%84%9D-%EB%B3%B4%EA%B3%A0%EC%84%9C-AppleSeed-PebbleDash.pdf - webarchive
- https://asec.ahnlab.com/en/30532/ - webarchive
- https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/ - webarchive
- https://malwarenailed.blogspot.com/2020/06/peebledash-lazarus-hiddencobra-rat.html?m=1 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PeddleCheap
PeddleCheap is a module of the DanderSpritz framework which surface with the "Lost in Translation" release of TheShadowBrokers leaks. In May 2020, ESET mentioned that they found mysterious samples of PeddleCheap packed with a custom packer so far exclusively attributed to Winnti.
Internal MISP references
UUID ee450087-00e4-4b59-9ea7-6650d5551ea9 which can be used as unique global reference for PeddleCheap in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.peddlecheap - webarchive
- https://twitter.com/ESETresearch/status/1258353960781598721 - webarchive
- https://research.checkpoint.com/2021/a-deep-dive-into-doublefeature-equation-groups-post-exploitation-dashboard/ - webarchive
- https://www.forcepoint.com/fr/blog/security-labs/new-whitepaper-danderspritzpeddlecheap-traffic-analysis-part-1-2# - webarchive
- https://obscuritylabs.com/blog/2017/11/13/match-made-in-the-shadows-part-3/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Pekraut
Internal MISP references
UUID 88f636b9-9c2e-4faf-ab83-b91009bf47fc which can be used as unique global reference for Pekraut in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Penco
Internal MISP references
UUID a2fd9b8a-826d-4df5-9a29-d61a8456d086 which can be used as unique global reference for Penco in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PennyWise Stealer
Internal MISP references
UUID c222def2-0f1f-4c74-9e37-757e964ff3c6 which can be used as unique global reference for PennyWise Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Peppy RAT
Peppy is a Python-based RAT with the majority of its appearances having similarities or definite overlap with MSIL/Crimson appearances. Peppy communicates to its C&C over HTTP and utilizes SQLite for much of its internal functionality and tracking of exfiltrated files. The primary purpose of Peppy may be the automated exfiltration of potentially interesting files and keylogs. Once Peppy successfully communicates to its C&C, the keylogging and exfiltration of files using configurable search parameters begins. Files are exfiltrated using HTTP POST requests.
Internal MISP references
UUID 49321579-9dfe-45c6-80df-79467e4af65d which can be used as unique global reference for Peppy RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PetrWrap
The PetrWrap Trojan is written in C and compiled in MS Visual Studio. It carries a sample of the Petya ransomware v3 inside its data section and uses Petya to infect the victim’s machine. What’s more, PetrWrap implements its own cryptographic routines and modifies the code of Petya in runtime to control its execution. This allows the criminals behind PetrWrap to hide the fact that they are using Petya during infection.
Internal MISP references
UUID 82ed8fae-552e-407b-b3fc-f617b7a8f996 which can be used as unique global reference for PetrWrap in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.petrwrap - webarchive
- https://blog.malwarebytes.com/cybercrime/2017/07/keeping-up-with-the-petyas-demystifying-the-malware-family/ - webarchive
- https://securelist.com/blog/research/77762/petrwrap-the-new-petya-based-ransomware-used-in-targeted-attacks/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Petya
Internal MISP references
UUID 34c9dbaa-97ac-4e1e-9eca-b7c492d67efc which can be used as unique global reference for Petya in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.petya - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/05/petya-and-mischa-ransomware-duet-p1/ - webarchive
- https://blogs.blackberry.com/en/2016/07/petya-and-mischa-for-all-part-ii-theyre-here - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/04/petya-ransomware/ - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/ - webarchive
- https://securelist.com/petya-the-two-in-one-trojan/74609/ - webarchive
- https://blog.avast.com/inside-petya-and-mischa-ransomware - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/ - webarchive
- https://www.malwarebytes.com/blog/news/2016/06/petya-and-mischa-ransomware-duet-p2 - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/07/third-time-unlucky-improved-petya-is-out/ - webarchive
- https://blog.malwarebytes.com/cybercrime/2017/07/keeping-up-with-the-petyas-demystifying-the-malware-family/ - webarchive
- https://blog.malwarebytes.com/malwarebytes-news/2017/07/bye-bye-petya-decryptor-old-versions-released/ - webarchive
- https://www.trendmicro.com/en_us/research/20/l/the-impact-of-modern-ransomware-on-manufacturing-networks.html - webarchive
- https://blogs.blackberry.com/en/2016/05/petya-and-mischa-for-all-the-raas-boom-expands-to-include-the-petya-mischa-combo - webarchive
- https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
pgift
Information gathering and downloading tool used to deliver second stage malware to the infected system
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular pgift.
| Known Synonyms |
|---|
ReRol |
Internal MISP references
UUID add29684-94b7-4c75-a43b-d039c4b76158 which can be used as unique global reference for pgift in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PhanDoor
Internal MISP references
UUID 3a77d0d4-6fb1-4092-9fe3-bf1f51a6677c which can be used as unique global reference for PhanDoor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.phandoor - webarchive
- https://global.ahnlab.com/global/upload/download/techreport/[AhnLab]Andariel_a_Subgroup_of_Lazarus%20(3).pdf
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
phemedrone_stealer
Internal MISP references
UUID 13c5f597-d7e4-41c7-8143-060a024a9cac which can be used as unique global reference for phemedrone_stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Philadephia Ransom
Internal MISP references
UUID f2a10bec-4783-4cfc-8e93-acd3c12a517d which can be used as unique global reference for Philadephia Ransom in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.philadelphia_ransom - webarchive
- https://www.bleepingcomputer.com/news/security/the-philadelphia-ransomware-offers-a-mercy-button-for-compassionate-criminals/ - webarchive
- https://krebsonsecurity.com/2017/03/ransomware-for-dummies-anyone-can-do-it/ - webarchive
- https://www.cylance.com/en_us/blog/threat-spotlight-philadelphia-ransomware.html - webarchive
- https://www.proofpoint.com/us/threat-insight/post/philadelphia-ransomware-customization-commodity-malware - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Phobos
MalwareBytes states that Phobos is one of the ransomware families that are distributed via hacked Remote Desktop (RDP) connections. This isn't surprising, as hacked RDP servers are a cheap commodity on the underground market, and can make for an attractive and cost efficient dissemination vector for threat groups.
Internal MISP references
UUID d061daca-4415-4b3e-9034-231e37857eed which can be used as unique global reference for Phobos in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos - webarchive
- https://www.coveware.com/blog/phobos-ransomware-distributed-dharma-crew - webarchive
- https://www.advanced-intel.com/post/inside-phobos-ransomware-dharma-past-underground - webarchive
- https://www.fortinet.com/blog/threat-research/deep-analysis-the-eking-variant-of-phobos-ransomware - webarchive
- https://securelist.com/cis-ransomware/104452/ - webarchive
- https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound - webarchive
- https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/ - webarchive
- https://www.logpoint.com/en/blog/emerging-threat/defending-against-8base/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/ - webarchive
- https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/ - webarchive
- https://www.crowdstrike.com/blog/ransomware-preparedness-a-call-to-action/ - webarchive
- https://blog.morphisec.com/the-fair-upgrade-variant-of-phobos-ransomware - webarchive
- https://blog.malwarebytes.com/threat-analysis/2019/07/a-deep-dive-into-phobos-ransomware/ - webarchive
- https://blogs.vmware.com/security/2023/06/8base-ransomware-a-heavy-hitting-player.html - webarchive
- https://blog.malwarebytes.com/threat-spotlight/2020/01/threat-spotlight-phobos-ransomware-lives-up-to-its-name/ - webarchive
- https://mal-eats.net/2021/05/10/campo_new_attack_campaign_targeting_japan/ - webarchive
- https://paraflare.com/luci-spools-the-fun-with-phobos-ransomware/ - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/wp-spark-state-of-ransomware.pdf - webarchive
- https://www.sri.ro/articole/atac-cibernetic-cu-aplicatia-ransomware-phobos - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.youtube.com/watch?v=LUxOcpIRxmg - webarchive
- https://blogs.blackberry.com/en/2021/11/zebra2104 - webarchive
- https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://blog.talosintelligence.com/deep-dive-into-phobos-ransomware/ - webarchive
- https://cert.pl/en/posts/2023/02/breaking-phobos/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://twitter.com/rivitna2/status/1674718854549831681 - webarchive
- https://www.acronis.com/en-sg/cyber-protection-center/posts/8base-ransomware-stays-unseen-for-a-year/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Phoenix Keylogger
Keylogger, information stealer.
Internal MISP references
UUID 601ea680-68ec-43c9-ba20-88eaaefe8818 which can be used as unique global reference for Phoenix Keylogger in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.phoenix_keylogger - webarchive
- https://news.sophos.com/en-us/2022/08/18/cookie-stealing-the-new-perimeter-bypass - webarchive
- https://threatresearch.ext.hp.com/the-many-skins-of-snake-keylogger/ - webarchive
- https://www.cybereason.com/blog/phoenix-the-tale-of-the-resurrected-alpha-keylogger - webarchive
- https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Phoenix Locker
Internal MISP references
UUID 58aff639-0eda-4a80-9fe8-22e0498af728 which can be used as unique global reference for Phoenix Locker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.phoenix_locker - webarchive
- https://killingthebear.jorgetesta.tech/actors/evil-corp - webarchive
- https://assets.sentinelone.com/sentinellabs/sentinellabs_EvilCorp - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://www.sentinelone.com/wp-content/uploads/2022/02/S1_-SentinelLabs_SanctionsBeDamned_final_02.pdf - webarchive
- https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Phonk
Internal MISP references
UUID e0aa3f91-59d6-4344-bcc5-d602aaab21f9 which can be used as unique global reference for Phonk in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PHOREAL
Phoreal is a very simple backdoor that is capable of creating a reverse shell, performing simple file I/O and top-level window enumeration. It communicates to a list of four preconfigured C2 servers via ICMP on port 53
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PHOREAL.
| Known Synonyms |
|---|
Rizzo |
Internal MISP references
UUID 3aa6fd62-9b91-4136-af0e-08af7962ba4b which can be used as unique global reference for PHOREAL in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.phoreal - webarchive
- https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/SpyRATsofOceanLotusMalwareWhitePaper.pdf - webarchive
- https://elastic.github.io/security-research/intelligence/2022/03/02.phoreal-targets-southeast-asia-financial-sector/article/ - webarchive
- https://www.secureworks.com/research/threat-profiles/tin-woodlawn - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Phorpiex
Proofpoint describes Phorpiex/Trik as a SDBot fork (thus IRC-based) that has been used to distribute GandCrab, Pushdo, Pony, and coinminers. The name Trik is derived from PDB strings.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Phorpiex.
| Known Synonyms |
|---|
Trik |
phorphiex |
Internal MISP references
UUID 9759f99b-6d6c-4633-aa70-cb1d2bacc540 which can be used as unique global reference for Phorpiex in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.phorpiex - webarchive
- https://www.proofpoint.com/us/threat-insight/post/phorpiex-decade-spamming-shadows - webarchive
- https://twitter.com/CPResearch/status/1447852018794643457 - webarchive
- https://www.bleepingcomputer.com/news/security/trik-spam-botnet-leaks-43-million-email-addresses/ - webarchive
- https://www.crowdstrike.com/blog/pinchy-spider-adopts-big-game-hunting/ - webarchive
- https://www.lastline.com/labsblog/nemty-ransomware-scaling-up-apac-mailboxes-swarmed-dual-downloaders/ - webarchive
- https://blogs.vmware.com/security/2021/11/telemetry-peak-analyzer-an-automatic-malware-campaign-detector.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/shylock-not-the-lone-threat-targeting-skype/ - webarchive
- https://www.johannesbader.ch/2016/02/phorpiex/ - webarchive
- https://therecord.media/phorpiex-botnet-shuts-down-source-code-goes-up-for-sale/ - webarchive
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nemty-ransomware-trik-botnet - webarchive
- https://research.checkpoint.com/2019/phorpiex-breakdown/ - webarchive
- https://research.checkpoint.com/2020/phorpiex-arsenal-part-i/ - webarchive
- https://bin.re/blog/phorpiex/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/ - webarchive
- https://www.zdnet.com/article/someone-is-uninstalling-the-phorpiex-malware-from-infected-pcs-and-telling-users-to-install-an-antivirus/ - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://www.microsoft.com/security/blog/2021/05/20/phorpiex-morphs-how-a-longstanding-botnet-persists-and-thrives-in-the-current-threat-environment/ - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://research.checkpoint.com/2021/phorpiex-botnet-is-back-with-a-new-twizt-hijacking-hundreds-of-crypto-transactions/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PHOTOFORK
PHOTOFORK is a downloader which is a modified version of GZIPLOADER. It was first detected in February 2023 and was distributed by TA581 along with an unattributed threat activity cluster that facilitated initial access. In this version, the configuration file is no longer encrypted using a simple XOR algorithm with a 64-byte key. Instead, it uses a custom algorithm previously used by the Standard core loader. This algorithm decrypts DLL strings that are needed to resolve handles to the necessary DLLs later on. The strings are decrypted using an algorithm that splits the data into DWORDs and XORs it against a random key. The main objective of PHOTOFORK remains the same as GZIPLOADER, i.e. to deliver an encrypted bot and core DLL loader (forked) that loads the Forked ICEDID bot into memory using a custom PE format.
Internal MISP references
UUID 10d3dd4b-8858-4131-bcf0-60982f36e43d which can be used as unique global reference for PHOTOFORK in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PHOTOLITE
PHOTOLITE is the lite version of the GZIPLOADER with limited capabilities i.e. for example it does not have any functionality to exfiltrate the host information. This new variant is observed as a follow-on payload in a TA542 Emotet campaign back in November'22. contains a static URL to download a "Bot Pack" file with a static name (botpack.dat) which results in the IcedID Lite DLL Loader, and then delivers the Forked version of IcedID Bot, leaving out the webinjects and backconnect functionality that would typically be used for banking fraud.
Internal MISP references
UUID e4609860-99f9-47c9-9e36-350611466f3c which can be used as unique global reference for PHOTOLITE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.photolite - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/fork-ice-new-era-icedid - webarchive
- https://www.intrinsec.com/emotet-returns-and-deploys-loaders/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/comprehensive-look-emotets-fall-2022-return - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PhotoLoader
A loader used to deliver IcedID, fetching a fake image from which payloads are extracted.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PhotoLoader.
| Known Synonyms |
|---|
GZIPLOADER |
Internal MISP references
UUID 3418ca80-73d9-49ab-836a-98230a83c67d which can be used as unique global reference for PhotoLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.photoloader - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/fork-ice-new-era-icedid - webarchive
- https://www.team-cymru.com/post/a-visualizza-into-recent-icedid-campaigns - webarchive
- https://unit42.paloaltonetworks.com/polyglot-file-icedid-payload/ - webarchive
- https://www.fortinet.com/blog/threat-research/notable-droppers-emerge-in-recent-threat-campaigns - webarchive
- https://isc.sans.edu/diary/29740 - webarchive
- https://awakesecurity.com/blog/detecting-icedid-and-cobalt-strike-beacon-with-network-detection-and-response/ - webarchive
- https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary - webarchive
- https://blog.unpac.me/2023/05/03/unpacme-weekly-new-version-of-icedid-loader - webarchive
- https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive
- https://blog.talosintelligence.com/following-the-lnk-metadata-trail - webarchive
- https://isc.sans.edu/diary/28636 - webarchive
- https://www.youtube.com/watch?v=4j8t9kFLFIY - webarchive
- https://www.deepinstinct.com/blog/pindos-new-javascript-dropper-delivering-bumblebee-and-icedid - webarchive
- https://www.silentpush.com/blog/icedid-command-and-control-infrastructure - webarchive
- https://unit42.paloaltonetworks.com/wireshark-quiz-icedid-answers/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html - webarchive
- https://leandrofroes.github.io/posts/Reversing-a-recent-IcedID-Crypter/ - webarchive
- https://unit42.paloaltonetworks.com/teasing-secrets-malware-configuration-parsing - webarchive
- https://securityintelligence.com/posts/trickbot-conti-crypters-where-are-they-now/ - webarchive
- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ - webarchive
- https://www.silentpush.com/blog/malicious-infrastructure-as-a-service - webarchive
- https://twitter.com/felixw3000/status/1521816045769662468 - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker - webarchive
- https://www.spreaker.com/user/16860719/proofpoint-e29-mix-v1 - webarchive
- https://www.intezer.com/blog/research/conversation-hijacking-campaign-delivering-icedid/ - webarchive
- https://www.first.org/resources/papers/amsterdam23/IcedID-FIRST-AMS-2023.pdf - webarchive
- https://www.elastic.co/security-labs/unpacking-icedid - webarchive
- https://www.team-cymru.com/post/from-chile-with-malware - webarchive
- https://research.openanalysis.net/icedid/bokbot/photoloader/config/2023/04/06/photoloader.html - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://sysopfb.github.io/malware,/icedid/2020/04/28/IcedIDs-updated-photoloader.html - webarchive
- https://www.esentire.com/blog/icedid-to-cobalt-strike-in-under-20-minutes - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PICKPOCKET
PICKPOCKET is a credential theft tool that dumps the user's website login credentials from Chrome, Firefox, and Internet Explorer to a file. This tool was previously observed solely utilized by APT34.
Internal MISP references
UUID 2eb298de-e14b-46c1-a45f-26ae0d2c4003 which can be used as unique global reference for PICKPOCKET in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pickpocket - webarchive
- https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html - webarchive
- https://cyware.com/blog/apt34-the-helix-kitten-cybercriminal-group-loves-to-meow-middle-eastern-and-international-organizations-48ae - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PIEHOP
According to Mandiant, PIEHOP is a disruption tool written in Python and packaged with PyInstaller version 2.1+ that has the capability to connect to a user supplied remote MSSQL server for uploading files and issuing remote commands to a RTU. PIEHOP expects its main function to be called via another Python file, supplying either the argument control=True or upload=True. At a minimum, it requires the following arguments: oik, user, and pwd, and if called with control=True, it must also be supplied with iec104.
Internal MISP references
UUID 2b025b03-9241-4fe4-b691-46c7bace87e4 which can be used as unique global reference for PIEHOP in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Pierogi
Internal MISP references
UUID 2bda00e8-e6a7-448d-8dfa-4f2276230e8b which can be used as unique global reference for Pierogi in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pierogi - webarchive
- https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf - webarchive
- https://www.cybereason.com/blog/new-cyber-espionage-campaigns-targeting-palestinians-part-2-the-discovery-of-the-new-mysterious-pierogi-backdoor - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Pikabot
Introducing Pikabot, an emerging malware family that comprises a downloader/installer, a loader, and a core backdoor component. Despite being in the early stages of development, it already demonstrates advanced techniques in evasion, injection, and anti-analysis. Notably, the loader component incorporates an array of sophisticated anti-debugging and anti-VM measures inspired by the open-source Al-Khaser project, while leveraging steganography to conceal its payload. Additionally, Pikabot utilizes a proprietary C2 framework and supports a diverse range of commands, encompassing host enumeration and advanced secondary payload injection options.
Internal MISP references
UUID 992151e9-2d4d-4621-9a2e-f2219f97e55b which can be used as unique global reference for Pikabot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pikabot - webarchive
- https://research.openanalysis.net/pikabot/yara/config/loader/2023/02/26/pikabot.html - webarchive
- https://www.malwarebytes.com/blog/threat-intelligence/2023/12/pikabot-distributed-via-malicious-ads - webarchive
- https://d01a.github.io/pikabot/ - webarchive
- https://blog.securityonion.net/2023/09/quick-malware-analysis-pikabot.html - webarchive
- https://www.malware-traffic-analysis.net/2023/10/03/index.html - webarchive
- https://research.openanalysis.net/pikabot/debugging/string%20decryption/emulation/memulator/2023/11/19/new-pikabot-strings.html - webarchive
- https://kienmanowar.wordpress.com/2024/01/06/quicknote-technical-analysis-of-recent-pikabot-core-module/ - webarchive
- https://www.hivepro.com/wp-content/uploads/2023/05/Pikabot-A-Stealthy-Backdoor-with-Ingenious-Evasion-Tactics_TA2023246.pdf - webarchive
- https://medium.com/@DCSO_CyTec/shortandmalicious-pikabot-and-the-matanbuchus-connection-5e302644398 - webarchive
- https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot - webarchive
- https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/ - webarchive
- https://research.openanalysis.net/pikabot/debugging/string%20decryption/2023/11/12/new-pikabot.html - webarchive
- https://news.sophos.com/en-us/2023/06/12/deep-dive-into-the-pikabot-cyber-threat/ - webarchive
- https://github.com/VenzoV/MalwareAnalysisReports/blob/main/Pikabot/Pikabot%20Loader.md - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PILLOWMINT
According to FireEye, PILLOWMINT is a Point-of-Sale malware tool used to scrape track 1 and track 2 payment card data from memory. Scraped payment card data is encrypted and stored in the registry and as plaintext in a file (T1074: Data Staged) Contains additional backdoor capabilities including: Running processes Downloading and executing files (T1105: Remote File Copy) Downloading and injecting DLLs (T1055: Process Injection) Communicates with a command and control (C2) server over HTTP using AES encrypted messages (T1071: Standard Application Layer Protocol) (T1032: Standard Cryptographic Protocol)
Internal MISP references
UUID dec78ec5-f02d-461f-a8cc-cd4e80099e38 which can be used as unique global reference for PILLOWMINT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pillowmint - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/ - webarchive
- https://cocomelonc.github.io/malware/2023/05/22/malware-tricks-29.html - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PinchDuke
According to F-Secure, the PinchDuke information stealer gathers system configuration information, steals user credentials, and collects user files from the compromised host transferring these via HTTP(S) to a C&C server. F-Secure believes that PinchDuke’s credential stealing functionality is based on the source code of the Pinch credential stealing malware (also known as LdPinch) that was developed in the early 2000s and has later been openly distributed on underground forums.
Internal MISP references
UUID d837fc8e-1298-4911-9cfd-eb434a25bf3a which can be used as unique global reference for PinchDuke in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PingBack
Internal MISP references
UUID a05b1eba-8e89-4d05-97ef-cacc5a083913 which can be used as unique global reference for PingBack in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
pipcreat
Internal MISP references
UUID ea1c71fe-ad42-4c5a-8114-9ab9ecaa66f5 which can be used as unique global reference for pipcreat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PipeMon
Internal MISP references
UUID 34c0b51a-7139-44ab-b09a-cef646e66ba0 which can be used as unique global reference for PipeMon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pipemon - webarchive
- https://cocomelonc.github.io/malware/2023/05/22/malware-tricks-29.html - webarchive
- https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/ - webarchive
- https://twitter.com/ESETresearch/status/1506904404225630210 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PipeSnoop
Cisco Talos states that PipeSnoop can accept arbitrary shellcode from a named pipe and execute it on the infected endpoint.
Internal MISP references
UUID 29e75560-d16f-4434-a6a5-0258a916103d which can be used as unique global reference for PipeSnoop in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PirateStealer
Infostealer
Internal MISP references
UUID 19748031-0d8d-4e76-bf8e-0838f8a3d07c which can be used as unique global reference for PirateStealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
pirpi
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular pirpi.
| Known Synonyms |
|---|
CookieCutter |
SHOTPUT |
Internal MISP references
UUID e2325481-006f-4ad4-86d9-1a2ae6fea154 which can be used as unique global reference for pirpi in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pirpi - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-mayfair - webarchive
- https://researchcenter.paloaltonetworks.com/2015/07/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/ - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html - webarchive
- https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Pitou
Internal MISP references
UUID f371c85c-56f6-4ddf-8502-81866da4965b which can be used as unique global reference for Pitou in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pitou - webarchive
- https://isc.sans.edu/diary/rss/25068 - webarchive
- https://johannesbader.ch/2019/07/the-dga-of-pitou/ - webarchive
- https://www.tgsoft.it/english/news_archivio_eng.asp?id=884 - webarchive
- https://www.f-secure.com/documents/996508/1030745/pitou_whitepaper.pdf - webarchive
- http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.565.9211&rep=rep1&type=pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PittyTiger RAT
Internal MISP references
UUID 7ac902e0-4a7d-4451-b0fd-cdf98fbe5018 which can be used as unique global reference for PittyTiger RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pittytiger_rat - webarchive
- https://securingtomorrow.mcafee.com/mcafee-labs/targeted-attacks-on-french-company-exploit-multiple-word-vulnerabilities/ - webarchive
- https://bitbucket.org/cybertools/whitepapers/downloads/Pitty%20Tiger%20Final%20Report.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Pkybot
Pkybot is a trojan, which has its roots as a downloader dubbed Bublik in 2013 and was seen distributing GameoverZeus in 2014 (ref: fortinet). In the beginning of 2015, webinject capability was added according to /Kleissner/Kafeine/iSight using the infamous ATS.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pkybot.
| Known Synonyms |
|---|
Bublik |
Pykbot |
TBag |
Internal MISP references
UUID 19d71f38-422c-48f4-9f90-867eb4d4182e which can be used as unique global reference for Pkybot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PLAINTEE
Internal MISP references
UUID 66087a9c-b5ac-4d6d-b79e-c0294728c876 which can be used as unique global reference for PLAINTEE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.plaintee - webarchive
- https://unit42.paloaltonetworks.com/atoms/rancortaurus/ - webarchive
- https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-overbrook - webarchive
- https://nao-sec.org/2020/01/an-overhead-view-of-the-royal-road.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PLAY
According to PCrisk, PLAY is the name of a ransomware-type program. Malware categorized as such operates by encrypting data and demanding ransoms for the decryption.
After we executed a sample of this ransomware on our test machine, it encrypted files and appended their filenames with a ".PLAY" extension. For example, a file titled "1.jpg" appeared as "1.jpg.PLAY", "2.png" as "2.png.PLAY", etc. Once the encryption process was completed, PLAY created a text file named "ReadMe.txt" on the desktop.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PLAY.
| Known Synonyms |
|---|
PlayCrypt |
Internal MISP references
UUID 52cf16fb-aab7-4d93-a624-e12c18064720 which can be used as unique global reference for PLAY in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.play - webarchive
- https://adlumin.com/post/playcrypt-ransomware-as-a-service-expands-threat-from-script-kiddies-and-sophisticated-attackers/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-007.pdf - webarchive
- https://www.avertium.com/resources/threat-reports/an-in-depth-look-at-play-ransomware - webarchive
- https://www.fortinet.com/blog/threat-research/ransomware-roundup-play-ransomware - webarchive
- https://chuongdong.com/reverse%20engineering/2022/09/03/PLAYRansomware/ - webarchive
- https://medium.com/walmartglobaltech/from-royal-with-love-88fa05ff7f65 - webarchive
- https://www.sentinelone.com/labs/crimeware-trends-ransomware-developers-turn-to-intermittent-encryption-to-evade-detection/ - webarchive
- https://www.trendmicro.com/en_us/research/22/i/play-ransomware-s-attack-playbook-unmasks-it-as-another-hive-aff.html - webarchive
- https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf - webarchive
- https://www.bleepingcomputer.com/news/security/rackspace-confirms-play-ransomware-was-behind-recent-cyberattack/ - webarchive
- https://www.orangecyberdefense.com/global/blog/playing-the-game - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play - webarchive
- https://www.bleepingcomputer.com/news/security/march-2023-broke-ransomware-attack-records-with-459-incidents/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/play-ransomware-volume-shadow-copy - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
playwork
Internal MISP references
UUID 5e1f467b-f81e-487c-a911-ab63ae7e9b86 which can be used as unique global reference for playwork in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PLEAD (Windows)
PLEAD is a RAT used by the actor BlackTech. FireEye uses the synonyms GOODTIMES for the RAT module and DRAWDOWN for the respective downloader.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PLEAD (Windows).
| Known Synonyms |
|---|
DRAWDOWN |
GOODTIMES |
Linopid |
Internal MISP references
UUID 43a56ed7-8092-4b36-998c-349b02b3bd0d which can be used as unique global reference for PLEAD (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.plead - webarchive
- https://www.macnica.net/file/mpressioncss_ta_report_2019_2_nopw.pdf - webarchive
- https://blogs.jpcert.or.jp/en/2019/05/tscookie3.html - webarchive
- http://blog.jpcert.or.jp/2018/03/malware-tscooki-7aa0.html - webarchive
- https://www.welivesecurity.com/2019/05/14/plead-malware-mitm-asus-webstorage/ - webarchive
- https://blogs.jpcert.or.jp/en/2019/09/tscookie-loader.html - webarchive
- https://blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html - webarchive
- http://www.freebuf.com/column/159865.html - webarchive
- https://www.ironnet.com/blog/china-cyber-attacks-the-current-threat-landscape - webarchive
- https://www.cyberandramen.net/home/blacktech-doesnt-miss-a-step-a-quick-analysis-of-a-busy-2020 - webarchive
- https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1574947724.pdf - webarchive
- https://www.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revealing-threat-in-the-shadow-by-chi-en-shen-ashley-oleg-bondarenko - webarchive
- https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html - webarchive
- https://www.welivesecurity.com/2018/07/09/certificates-stolen-taiwanese-tech-companies-plead-malware-campaign/ - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_2_ycy-aragorn_en.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt - webarchive
- https://blogs.jpcert.or.jp/en/2018/11/tscookie2.html - webarchive
- https://www.fireeye.com/blog/threat-research/2016/04/ghosts_in_the_endpoi.html - webarchive
- https://documents.trendmicro.com/assets/appendix-following-the-trail-of-blacktechs-cyber-espionage-campaigns.pdf - webarchive
- https://www.macnica.net/file/mpressioncss_ta_report_2019.pdf - webarchive
- https://web.archive.org/web/20200229012206/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1574947724.pdf - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/kivars-with-venom-targeted-attacks-upgrade-with-64-bit-support/ - webarchive
- https://securelist.com/apt-trends-report-q2-2019/91897/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ploutus ATM
Internal MISP references
UUID d91c4184-608e-47b1-b746-0e98587e2455 which can be used as unique global reference for Ploutus ATM in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ploutus_atm - webarchive
- https://documents.trendmicro.com/assets/white_papers/wp-cashing-in-on-atm-malware.pdf - webarchive
- https://www.crowdstrike.com/blog/ploutus-atm-malware-deobfuscation-case-study - webarchive
- https://www.fireeye.com/blog/threat-research/2017/01/new_ploutus_variant.html - webarchive
- https://www.metabaseq.com/recursos/ploutus-is-back-targeting-itautec-atms-in-latin-america - webarchive
- https://www.advintel.io/post/economic-growth-digital-inclusion-specialized-crime-financial-cyber-fraud-in-latam - webarchive
- https://blog.talosintelligence.com/2019/05/10-years-of-virtual-dynamite.html - webarchive
- http://antonioparata.blogspot.co.uk/2018/02/analyzing-nasty-net-protection-of.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ployx
Internal MISP references
UUID 7bad2f44-93b0-406d-a619-28f14c4bd344 which can be used as unique global reference for ployx in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PlugX
RSA describes PlugX as a RAT (Remote Access Trojan) malware family that is around since 2008 and is used as a backdoor to control the victim's machine fully. Once the device is infected, an attacker can remotely execute several kinds of commands on the affected system.
Notable features of this malware family are the ability to execute commands on the affected machine to retrieve: machine information capture the screen send keyboard and mouse events keylogging reboot the system manage processes (create, kill and enumerate) manage services (create, start, stop, etc.); and manage Windows registry entries, open a shell, etc.
The malware also logs its events in a text log file.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PlugX.
| Known Synonyms |
|---|
Destroy RAT |
Kaba |
Korplug |
RedDelta |
Sogu |
TIGERPLUG |
Internal MISP references
UUID 036bd099-fe80-46c2-9c4c-e5c6df8dcdee which can be used as unique global reference for PlugX in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.plugx - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2020-0915.pdf - webarchive
- https://www.anomali.com/blog/covid-19-themes-are-being-utilized-by-threat-actors-of-varying-sophistication - webarchive
- https://www.us-cert.gov/ncas/alerts/TA17-117A - webarchive
- https://www.darkreading.com/threat-intelligence/chinese-apt-bronze-president-spy-campaign-russian-military - webarchive
- https://secjoes-reports.s3.eu-central-1.amazonaws.com/Dissecting+PlugX+to+Extract+Its+Crown+Jewels.pdf - webarchive
- https://www.rsa.com/content/dam/pdfs/2-2017/kingslayer-a-supply-chain-attack.pdf - webarchive
- https://pylos.co/wp-content/uploads/2020/02/Threat-Intelligence-and-the-Limits-of-Malware-Analysis.pdf - webarchive
- https://lab52.io/blog/the-energy-reserves-in-the-eastern-mediterranean-sea-and-a-malicious-campaign-of-apt10-against-turkey/ - webarchive
- https://threatrecon.nshc.net/2019/03/19/sectorm04-targeting-singapore-custom-malware-analysis/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/witchetty-steganography-espionage - webarchive
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-annex-download.pdf - webarchive
- https://raw.githubusercontent.com/yt0ng/cracking_softcell/main/Cracking_SOFTCLL_TLP_WHITE.pdf - webarchive
- https://maxkersten.nl/binary-analysis-course/analysis-scripts/ghidra-script-to-handle-stack-strings/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0330.pdf - webarchive
- https://www.contextis.com/de/blog/avivore - webarchive
- https://www.macnica.net/file/security_report_20160613.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-express - webarchive
- https://blog.polyswarm.io/carderbee-targets-hong-kong-in-supply-chain-attack - webarchive
- https://www.ironnet.com/blog/china-cyber-attacks-the-current-threat-landscape - webarchive
- https://attack.mitre.org/groups/G0001/ - webarchive
- https://www.computerweekly.com/news/252471769/New-threat-group-behind-Airbus-cyber-attacks-claim-researchers - webarchive
- https://www.youtube.com/watch?v=E2_DTQJjDYc - webarchive
- http://blog.jpcert.or.jp/2015/01/analysis-of-a-r-ff05.html - webarchive
- https://research.checkpoint.com/2023/chinese-threat-actors-targeting-europe-in-smugx-campaign/ - webarchive
- https://blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat/ - webarchive
- https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ - webarchive
- https://speakerdeck.com/ashley920/into-the-fog-the-return-of-icefog-apt - webarchive
- https://unit42.paloaltonetworks.com/pkplug_chinese_cyber_espionage_group_attacking_asia/ - webarchive
- https://researchcenter.paloaltonetworks.com/2017/06/unit42-paranoid-plugx/ - webarchive
- https://www.nortonlifelock.com/sites/default/files/2021-10/OPERATION%20EXORCIST%20White%20Paper.pdf - webarchive
- https://kienmanowar.wordpress.com/2022/12/27/diving-into-a-plugx-sample-of-mustang-panda-group/ - webarchive
- https://st.drweb.com/static/new-www/news/2020/october/Study_of_the_ShadowPad_APT_backdoor_and_its_relation_to_PlugX_en.pdf - webarchive
- https://or10nlabs.tech/reverse-engineering-the-mustang-panda-plugx-loader - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/apt41-indictments-china-espionage - webarchive
- https://blog.xorhex.com/blog/mustangpandaplugx-2/ - webarchive
- https://www.trendmicro.com/en_us/research/20/k/weaponizing-open-source-software-for-targeted-attacks.html - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/05/vb2019-paper-apt-cases-exploiting-vulnerabilities-regionspecific-software/ - webarchive
- https://www.youtube.com/watch?v=6SDdUVejR2w - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-overbrook - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-olive - webarchive
- https://app.box.com/s/z1uanuv1vn3vw5iket1r6bqrmlra0gpn - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/carderbee-software-supply-chain-certificate-abuse - webarchive
- https://blog.xorhex.com/blog/reddeltaplugxchangeup/ - webarchive
- https://securelist.com/cycldek-bridging-the-air-gap/97157/ - webarchive
- https://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-plugx-rat-loader-evolution - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/operation-harvest-a-deep-dive-into-a-long-term-campaign/ - webarchive
- https://www.splunk.com/en_us/blog/security/unmasking-the-enigma-a-historical-dive-into-the-world-of-plugx-malware.html - webarchive
- https://blog.ensilo.com/uncovering-new-activity-by-apt10 - webarchive
- https://www.secureworks.com/research/bronze-president-targets-ngos - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-riverside - webarchive
- https://attack.mitre.org/groups/G0096 - webarchive
- https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/ - webarchive
- https://www.contextis.com/en/blog/avivore - webarchive
- http://blog.airbuscybersecurity.com/post/2014/01/plugx-some-uncovered-points.html - webarchive
- https://www.recordedfuture.com/china-linked-ta428-threat-group - webarchive
- https://blog.vincss.net/2020/03/re012-phan-tich-ma-doc-loi-dung-dich-COVID-19-de-phat-tan-gia-mao-chi-thi-cua-thu-tuong-Nguyen-Xuan-Phuc-phan2.html - webarchive
- https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-40-LunghiHorejsi.pdf - webarchive
- https://cyberandramen.net/2022/01/06/a-gulp-of-plugx/ - webarchive
- https://engineers.ffri.jp/entry/2022/11/30/141346 - webarchive
- https://www.zdnet.com/article/chinese-state-hackers-target-hong-kong-catholic-church/ - webarchive
- https://unit42.paloaltonetworks.com/thor-plugx-variant/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/plugx-a-talisman-to-behold.html - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-pulling-pkplug-adversary-playbook-long-standing-espionage-activity-chinese-nation-state-adversary/ - webarchive
- http://blog.jpcert.or.jp/.s/2017/04/redleaves---malware-based-on-open-source-rat.html - webarchive
- https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/ - webarchive
- https://www.nttsecurity.com/docs/librariesprovider3/default-document-library/craftypanda-analysis-report - webarchive
- https://st.drweb.com/static/new-www/news/2020/july/Study_of_the_APT_attacks_on_state_institutions_in_Kazakhstan_and_Kyrgyzstan_en.pdf - webarchive
- https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx - webarchive
- https://conference.hitb.org/hitbsecconf2021sin/materials/D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf - webarchive
- https://unit42.paloaltonetworks.com/unsigned-dlls/ - webarchive
- https://redalert.nshc.net/2022/04/14/hacking-activity-of-sectorb-group-in-2021/ - webarchive
- https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/ - webarchive
- https://asec.ahnlab.com/en/49097/ - webarchive
- https://or10nlabs.tech/reverse-engineering-the-mustang-panda-plugx-rat-extracting-the-config/ - webarchive
- https://jsac.jpcert.or.jp/archive/2023/pdf/JSAC2023_2_LT4.pdf - webarchive
- https://www.fortinet.com/blog/threat-research/uncovering-new-activity-by-apt- - webarchive
- https://securelist.com/time-of-death-connected-medicine/84315/ - webarchive
- https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://blogs.jpcert.or.jp/en/2017/04/redleaves---malware-based-on-open-source-rat.html - webarchive
- https://community.rsa.com/thread/185439 - webarchive
- https://www.welivesecurity.com/2020/12/10/luckymouse-ta428-compromise-able-desktop/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-keystone - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-woodland - webarchive
- https://www.bleepingcomputer.com/news/security/new-mustang-panda-hacking-campaign-targets-diplomats-isps/ - webarchive
- https://threatconnect.com/blog/research-roundup-activity-on-previously-identified-apt33-domains/ - webarchive
- https://raw.githubusercontent.com/m4now4r/Presentations/main/MustangPanda%20-%20Enemy%20at%20the%20gate_final.pdf - webarchive
- https://web.archive.org/web/20200424035112/https://go.contextis.com/rs/140-OCV-459/images/White%20Paper_PlugX%20-%20Payload%20Extraction.pdf - webarchive
- https://twitter.com/stvemillertime/status/1261263000960450562 - webarchive
- https://www.fireeye.com/blog/threat-research/2014/06/clandestine-fox-part-deux.html - webarchive
- https://www.secureworks.com/blog/bronze-president-targets-government-officials - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments - webarchive
- https://web.archive.org/web/20191214125833/https://contextis.com/media/downloads/AVIVORE_An_overview.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-president - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf - webarchive
- https://news.sophos.com/en-us/2023/03/09/border-hopping-plugx-usb-worm/ - webarchive
- https://www.youtube.com/watch?v=IRh6R8o1Q7U - webarchive
- https://countuponsecurity.com/2018/02/04/malware-analysis-plugx/ - webarchive
- https://ics-cert.kaspersky.com/publications/reports/2022/06/27/attacks-on-industrial-control-systems-using-shadowpad/ - webarchive
- https://documents.trendmicro.com/assets/white_papers/wp-operation-earth-berberoka.pdf - webarchive
- https://blog.vincss.net/2020/03/re012-phan-tich-ma-doc-loi-dung-dich-COVID-19-de-phat-tan-gia-mao-chi-thi-cua-thu-tuong-Nguyen-Xuan-Phuc.html - webarchive
- https://www.cyber.gov.au/sites/default/files/2019-03/msp_investigation_report.pdf - webarchive
- https://countuponsecurity.com/2018/05/09/malware-analysis-plugx-part-2/ - webarchive
- http://blog.jpcert.or.jp/2017/02/plugx-poison-iv-919a.html - webarchive
- https://i.blackhat.com/asia-21/Friday-Handouts/as-21-Tseng-Mem2Img-Memory-Resident-Malware-Detection-via-Convolution-Neural-Network.pdf - webarchive
- https://blogs.blackberry.com/en/2022/10/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0808.pdf - webarchive
- https://www.uscc.gov/sites/default/files/2022-02/Adam_Kozy_Testimony.pdf - webarchive
- https://www.recordedfuture.com/redecho-targeting-indian-power-sector/ - webarchive
- https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt - webarchive
- https://go.contextis.com/rs/140-OCV-459/images/White%20Paper_PlugX%20-%20Payload%20Extraction.pdf - webarchive
- https://www.youtube.com/watch?v=qEwBGGgWgOM - webarchive
- https://blog.viettelcybersecurity.com/p1-chien-dich-cua-nhom-apt-trung-quoc-goblin-panda-tan-cong-vao-viet-nam-loi-dung-dai-dich-covid-19/ - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://www.trendmicro.com/en_us/research/21/a/xdr-investigation-uncovers-plugx-unique-technique-in-apt-attack.html - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://blog.vincss.net/2022/05/re027-china-based-apt-mustang-panda-might-have-still-continued-their-attack-activities-against-organizations-in-Vietnam.html - webarchive
- https://tracker.h3x.eu/info/290 - webarchive
- https://twitter.com/xorhex/status/1399906601562165249?s=20 - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-union - webarchive
- https://news.sophos.com/en-us/2020/11/04/a-new-apt-uses-dll-side-loads-to-killlsomeone/ - webarchive
- https://www.mandiant.com/resources/blog/infected-usb-steal-secrets - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf - webarchive
- https://or10nlabs.tech/reverse-engineering-the-new-mustang-panda-plugx-downloader/ - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://www.trendmicro.com/en_us/research/23/b/investigating-the-plugx-trojan-disguised-as-a-legitimate-windows.html - webarchive
- https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/08/unpacking-the-spyware-disguised-as-antivirus/ - webarchive
- https://silascutler.blogspot.com/2019/11/fresh-plugx-october-2019.html - webarchive
- https://www.recordedfuture.com/chinese-apt-groups-target-afghan-telecommunications-firm/ - webarchive
- https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf - webarchive
- https://www.welivesecurity.com/fr/2022/03/25/mustang-pandas-hodur-nouveau-korplug/ - webarchive
- https://therecord.media/redecho-group-parks-domains-after-public-exposure/ - webarchive
- https://lab52.io/blog/mustang-panda-recent-activity-dll-sideloading-trojans-with-temporal-c2-servers/ - webarchive
- https://umbrella.cisco.com/blog/cybersecurity-threat-spotlight-blackmatter-lockbit-thor - webarchive
- https://www.contextis.com/en/blog/dll-search-order-hijacking - webarchive
- https://www.recordedfuture.com/chinese-group-calypso-exploiting-microsoft-exchange/ - webarchive
- https://insights.oem.avira.com/new-wave-of-plugx-targets-hong-kong/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/chinas-apt-hackers-move-to-ransomware-attacks/ - webarchive
- https://kienmanowar.wordpress.com/2023/01/09/quicknote-another-nice-plugx-sample/ - webarchive
- https://web.archive.org/web/20210925164035/https://blog.trendmicro.com/trendlabs-security-intelligence/bkdr_rarstone-new-rat-to-watch-out-for/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-atlas - webarchive
- https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader - webarchive
- https://www.lac.co.jp/lacwatch/people/20171218_001445.html - webarchive
- https://therecord.media/indonesian-intelligence-agency-compromised-in-suspected-chinese-hack/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-drbcontrol-uncovering-a-cyberespionage-campaign-targeting-gambling-companies-in-southeast-asia - webarchive
- https://www.sentinelone.com/labs/moshen-dragons-triad-and-error-approach-abusing-security-software-to-sideload-plugx-and-shadowpad/ - webarchive
- https://www.welivesecurity.com/2020/12/10/luckymouse-ta428-compromise-able-desktop - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf - webarchive
- https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia - webarchive
- https://risky.biz/whatiswinnti/ - webarchive
- https://www.youtube.com/watch?v=C_TmANnbS2k - webarchive
- https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/ - webarchive
- https://medium.com/@Sebdraven/malicious-document-targets-vietnamese-officials-acb3b9d8b80a - webarchive
- https://threatpost.com/chinese-apt-combines-fresh-hodur-rat-with-complex-anti-detection/179084/ - webarchive
- https://www.youtube.com/watch?v=r1zAVX_HnJg - webarchive
- http://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/ - webarchive
- https://www.sophos.com/en-us/medialibrary/pdfs/technical%20papers/plugx-thenextgeneration.pdf - webarchive
- https://www.ptsecurity.com/ww-en/analytics/calypso-apt-2019/ - webarchive
- https://www.trendmicro.com/en_us/research/22/d/new-apt-group-earth-berberoka-targets-gambling-websites-with-old.html - webarchive
- https://blog.talosintelligence.com/2022/05/mustang-panda-targets-europe.html - webarchive
- https://blog.xorhex.com/blog/mustangpandaplugx-1/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-firestone - webarchive
- https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ - webarchive
- https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited - webarchive
- https://blogs.jpcert.or.jp/ja/2022/05/HUILoader.html - webarchive
- https://unit42.paloaltonetworks.com/atoms/shallowtaurus/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0616.pdf - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european - webarchive
- https://marcoramilli.com/2020/03/19/is-apt27-abusing-covid-19-to-attack-people/ - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lancefly-merdoor-zxshell-custom-backdoor - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Plurox
Internal MISP references
UUID 6c8b94fc-f2d4-4347-aa49-4e6daac74314 which can be used as unique global reference for Plurox in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
pngdowner
Internal MISP references
UUID fb4313ea-1fb6-4766-8b5c-b41fd347e4c5 which can be used as unique global reference for pngdowner in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PNGLoad
According to ESET Research, PNGLoad is a second-stage payload deployed by Worok on compromised systems and loaded either by CLRLoad or PowHeartBeat. PNGLoad has capabilities to download and execute additional payloads from a C&C server, which is likely how the attackers have deployed PNGLoad on systems compromised with PowHeartBeat. PNGLoad is a loader that uses bytes from PNG files to create a payload to execute. It is a 64-bit .NET executable - obfuscated with .NET Reactor - that masquerades as legitimate software.
Internal MISP references
UUID f99b030e-7ad5-4983-b28a-43c14efd27c9 which can be used as unique global reference for PNGLoad in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PocoDown
uses POCO C++ cross-platform library, Xor-based string obfuscation, SSL library code and string overlap with Xtunnel, infrastructure overlap with X-Agent, probably in use since mid-2018
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PocoDown.
| Known Synonyms |
|---|
Blitz |
PocoDownloader |
Internal MISP references
UUID 25804d6d-447f-4933-9ba0-876f9d054b68 which can be used as unique global reference for PocoDown in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pocodown - webarchive
- https://threatvector.cylance.com/en_us/home/inside-the-apt28-dll-backdoor-blitz.html - webarchive
- https://threatvector.cylance.com/en_us/home/flirting-with-ida-and-apt28.html - webarchive
- https://twitter.com/cyb3rops/status/1129653190444703744 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
poisonplug
According to FireEye, POISONPLUG is a highly obfuscated modular backdoor with plug-in capabilities. The malware is capable of registry or service persistence, self-removal, plug-in execution, and network connection forwarding. POISONPLUG has been observed using social platforms to host encoded C&C commands.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular poisonplug.
| Known Synonyms |
|---|
Barlaiy |
Internal MISP references
UUID 3b1c7856-5158-418c-90ad-afda67a66963 which can be used as unique global reference for poisonplug in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.poisonplug - webarchive
- https://www.fireeye.com/blog/threat-research/2019/10/lowkey-hunting-for-the-missing-volume-serial-id.html - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf - webarchive
- https://www.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revealing-threat-in-the-shadow-by-chi-en-shen-ashley-oleg-bondarenko - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/apt41-indictments-china-espionage - webarchive
- https://content.fireeye.com/apt-41/rpt-apt41/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Poison Ivy
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Poison Ivy.
| Known Synonyms |
|---|
SPIVY |
pivy |
poisonivy |
Internal MISP references
UUID 7789fc1b-3cbc-4a1c-8ef0-8b06760f93e7 which can be used as unique global reference for Poison Ivy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.poison_ivy - webarchive
- http://blogs.360.cn/post/APT_C_01_en.html - webarchive
- https://vb2020.vblocalhost.com/uploads/VB2020-20.pdf - webarchive
- https://unit42.paloaltonetworks.com/atoms/crawling-taurus/ - webarchive
- https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/blob/master/2016/2016.04.26.New_Poison_Ivy_Activity_Targeting_Myanmar_Asian_Countries/New%20Poison%20Ivy%20Activity%20Targeting%20Myanmar%2C%20Asian%20Countries.pdf - webarchive
- https://www.fortinet.com/blog/threat-research/pivnoxy-and-chinoxy-puppeteer-analysis - webarchive
- https://vb2020.vblocalhost.com/uploads/VB2020-Ozawa-etal.pdf - webarchive
- https://nao-sec.org/2020/01/an-overhead-view-of-the-royal-road.html - webarchive
- https://web.archive.org/web/20160616170611/https://media.blackhat.com/bh-eu-10/presentations/Carrera_Silberman/BlackHat-EU-2010-Carrera-Silberman-State-of-Malware-slides.pdf - webarchive
- https://www.recordedfuture.com/china-linked-ta428-threat-group - webarchive
- https://engineers.ffri.jp/entry/2022/11/30/141346 - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-pulling-pkplug-adversary-playbook-long-standing-espionage-activity-chinese-nation-state-adversary/ - webarchive
- http://blog.fortinet.com/2017/08/23/deep-analysis-of-new-poison-ivy-variant - webarchive
- http://csecybsec.com/download/zlab/20180713_CSE_APT28_X-Agent_Op-Roman%20Holiday-Report_v6_1.pdf - webarchive
- https://raw.githubusercontent.com/yt0ng/cracking_softcell/main/Cracking_SOFTCLL_TLP_WHITE.pdf - webarchive
- https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/ - webarchive
- https://research.checkpoint.com/2020/vicious-panda-the-covid-campaign/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference_slides/2019/VB2019-GuPan.pdf - webarchive
- https://vblocalhost.com/uploads/VB2020-20.pdf - webarchive
- https://researchcenter.paloaltonetworks.com/2016/04/unit42-new-poison-ivy-rat-variant-targets-hong-kong-pro-democracy-activists/ - webarchive
- https://blog.bushidotoken.net/2022/07/space-invaders-cyber-threats-that-are.html - webarchive
- https://www.secureworks.com/research/threat-profiles/aluminum-saratoga - webarchive
- https://blog.fortinet.com/2017/09/15/deep-analysis-of-new-poison-ivy-plugx-variant-part-ii - webarchive
- https://community.riskiq.com/article/56fa1b2f - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf - webarchive
- https://vblocalhost.com/uploads/VB2020-Ozawa-etal.pdf - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/august/analysing-a-recent-poison-ivy-sample/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-275a - webarchive
- https://www.slideshare.net/StefanoMaccaglia/bsides-ir-in-heterogeneous-environment - webarchive
- https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers - webarchive
- https://attack.mitre.org/groups/G0011 - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-union - webarchive
- https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/ - webarchive
- https://www.fireeye.com/blog/threat-research/2013/08/operation-molerats-middle-east-cyber-attacks-using-poison-ivy.html - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-firestone - webarchive
- https://www.proofpoint.com/us/threat-insight/post/chinese-apt-operation-lagtime-it-targets-government-information-technology - webarchive
- https://blogs.jpcert.or.jp/ja/2022/05/HUILoader.html - webarchive
- https://unit42.paloaltonetworks.com/atoms/shallowtaurus/ - webarchive
- https://www.welivesecurity.com/2021/02/01/operation-nightscout-supply-chain-attack-online-gaming-asia/ - webarchive
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2011/the_nitro_attacks.pdf - webarchive
- https://www.fireeye.com/blog/threat-research/2013/10/know-your-enemy-tracking-a-rapidly-evolving-apt-actor.html - webarchive
- https://researchcenter.paloaltonetworks.com/2014/09/recent-watering-hole-attacks-attributed-apt-group-th3bug-using-poison-ivy/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-keystone - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0616.pdf - webarchive
- https://lab52.io/blog/icefog-apt-group-abusing-recent-conflict-between-iran-and-eeuu/ - webarchive
- https://www.youtube.com/watch?v=1WfPlgtfWnQ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-riverside - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Poison RAT
Internal MISP references
UUID 69605d66-d77e-4e7b-8c64-381e2cd97c14 which can be used as unique global reference for Poison RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Poldat
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Poldat.
| Known Synonyms |
|---|
KABOB |
Zlib |
Internal MISP references
UUID d30d5a0c-cbfb-49c3-99e7-1d6d1888fc2d which can be used as unique global reference for Poldat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PolPo
Internal MISP references
UUID 40a4c426-5a50-4252-89ce-c857788568cc which can be used as unique global reference for PolPo in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PolyglotDuke
Internal MISP references
UUID 53371de9-291a-4d33-9fd2-058b43dddd5d which can be used as unique global reference for PolyglotDuke in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.polyglotduke - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.carbonblack.com/2020/03/26/the-dukes-of-moscow/ - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-hemlock - webarchive
- https://www.welivesecurity.com/2019/10/17/operation-ghost-dukes-never-left/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Polyglot
Internal MISP references
UUID 5ee77368-5e09-4016-ae73-82b99e830832 which can be used as unique global reference for Polyglot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PolyVice
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PolyVice.
| Known Synonyms |
|---|
Chily |
Internal MISP references
UUID 31017b7c-c023-4247-b37d-f15f2df5d25a which can be used as unique global reference for PolyVice in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Pony
According to KnowBe4, Pony Stealer is a password stealer that can decrypt or unlock passwords for over 110 different applications including VPN, FTP, email, instant messaging, web browsers and much more. Pony Stealer is very dangerous and once it infects a PC it will turn the device into a botnet, allowing it to use the PCs it infects to infect other PCs.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pony.
| Known Synonyms |
|---|
Fareit |
Siplog |
Internal MISP references
UUID cd201689-4bf1-4c5b-ac4d-21c4dcc39e7d which can be used as unique global reference for Pony in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pony - webarchive
- https://github.com/nyx0/Pony - webarchive
- https://i.blackhat.com/asia-21/Thursday-Handouts/as21-Taniguchi-How-Did-The-Adversaries-Abusing-The-Bitcoin-Blockchain-Evade-Our-Takeover.pdf - webarchive
- https://www.youtube.com/watch?v=EyDiIAt__dI - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-essex - webarchive
- https://www.knowbe4.com/pony-stealer - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/ - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-essex - webarchive
- https://www.youtube.com/watch?v=y8Z9KnL8s8s - webarchive
- https://www.uperesia.com/analysis-of-a-packed-pony-downloader - webarchive
- https://research.checkpoint.com/2019/select-code_execution-from-using-sqlite/ - webarchive
- https://www.youtube.com/watch?v=42yldTQ-fWA - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-galleon - webarchive
- https://www.mcafee.com/us/resources/reports/rp-quarterly-threats-jun-2017.pdf - webarchive
- https://int0xcc.svbtle.com/practical-threat-hunting-and-incidence-response-a-case-of-a-pony-malware-infection - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-evergreen - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-galleon - webarchive
- https://www.secureworks.com/research/gold-galleon-how-a-nigerian-cyber-crew-plunders-the-shipping-industry - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-evergreen - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PoohMilk Loader
Internal MISP references
UUID 54327cbd-d30c-4684-9a66-18ae36b28399 which can be used as unique global reference for PoohMilk Loader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
POORTRY
According to Mandiant, POORTRY is a malware written as a driver, signed with a Microsoft Windows Hardware Compatibility Authenticode signature. This malware has been observed being used by UNC3944.
Internal MISP references
UUID 17b87423-66e5-451e-8a84-5f4fd8bb2b01 which can be used as unique global reference for POORTRY in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.poortry - webarchive
- https://acsense.com/blog/a-guide-to-scattered-spider-data-breaches/ - webarchive
- https://www.trellix.com/about/newsroom/stories/research/scattered-spider-the-modus-operandi/ - webarchive
- https://blog.bushidotoken.net/2023/08/tracking-adversaries-scattered-spider.html - webarchive
- https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware - webarchive
- http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa - webarchive
- https://www.quorumcyber.com/threat-actors/scattered-spider-threat-actor-profile/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PoorWeb
Internal MISP references
UUID e166950b-2d0d-41e1-aee6-ccf0895ce9a5 which can be used as unique global reference for PoorWeb in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.poorweb - webarchive
- https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/ - webarchive
- https://fortiguard.com/resources/threat-brief/2019/05/10/fortiguard-threat-intelligence-brief-may-10-2019 - webarchive
- https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf - webarchive
- https://securelist.com/apt-trends-report-q2-2018/86487/ - webarchive
- https://asec.ahnlab.com/ko/18796/ - webarchive
- https://blog.reversinglabs.com/blog/poorweb-exploiting-document-formats - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Popcorn Time
Internal MISP references
UUID 4ceebc38-f50b-4817-930f-c954d203ff7b which can be used as unique global reference for Popcorn Time in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PortDoor
Internal MISP references
UUID 7d3b71ff-6dbc-43bb-ae74-9aacdf80783c which can be used as unique global reference for PortDoor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.portdoor - webarchive
- https://medium.com/@Ilandu/portdoor-malware-afc9d0796cba - webarchive
- https://www.cybereason.com/blog/research/portdoor-new-chinese-apt-backdoor-attack-targets-russian-defense-sector - webarchive
- https://www.socinvestigation.com/chinese-new-backdoor-deployed-for-cyberespionage/ - webarchive
- https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-Targeted-attack-on-industrial-enterprises-and-public-institutions-En.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
portless
Internal MISP references
UUID b813cb80-28ff-4713-abdc-e9a22d397bb4 which can be used as unique global reference for portless in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
poscardstealer
Internal MISP references
UUID 5fa166d1-128b-4057-87e3-6676b7d9a7d7 which can be used as unique global reference for poscardstealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PoshC2
PoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movement.
PoshC2 is primarily written in Python3 and follows a modular format to enable users to add their own modules and tools, allowing an extendible and flexible C2 framework. Out-of-the-box PoshC2 comes PowerShell/C# and Python3 implants with payloads written in PowerShell v2 and v4, C++ and C# source code, a variety of executables, DLLs and raw shellcode in addition to a Python3 payload. These enable C2 functionality on a wide range of devices and operating systems, including Windows, *nix and OSX.
Internal MISP references
UUID 0215eae2-0ab7-4567-8ac6-1be36a7893a6 which can be used as unique global reference for PoshC2 in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.poshc2 - webarchive
- https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html - webarchive
- https://michaelkoczwara.medium.com/hunting-c2-with-shodan-223ca250d06f - webarchive
- https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/ - webarchive
- https://labs.nettitude.com/blog/detecting-poshc2-indicators-of-compromise/ - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-trinity - webarchive
- https://redcanary.com/blog/getsystem-offsec/ - webarchive
- https://www.fireeye.com/blog/threat-research/2020/07/scandalous-external-detection-using-network-scan-data-and-automation.html - webarchive
- https://paper.seebug.org/1301/ - webarchive
- https://5851803.fs1.hubspotusercontent-na1.net/hubfs/5851803/Russian%20Ransomware%20C2%20Network%20Discovered%20in%20Censys%20Data.pdf - webarchive
- http://www.rewterz.com/rewterz-news/rewterz-threat-alert-iranian-apt-uses-job-scams-to-lure-targets - webarchive
- https://ti.dbappsecurity.com.cn/blog/articles/2021/09/06/operation-maskface/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0107.pdf - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_0_JPCERT_en.pdf - webarchive
- https://github.com/jeFF0Falltrades/IoCs/blob/master/APT/poshc2_apt_33.md - webarchive
- https://github.com/nettitude/PoshC2_Python/ - webarchive
- https://censys.com/russian-ransomware-c2-network-discovered-in-censys-data/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PoSlurp
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PoSlurp.
| Known Synonyms |
|---|
PUNCHTRACK |
Internal MISP references
UUID 15305d8b-55ff-47b2-b1c7-550a8a36ce36 which can be used as unique global reference for PoSlurp in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.poslurp - webarchive
- https://atr-blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling/ - webarchive
- https://www.root9b.com/sites/default/files/whitepapers/PoS%20Malware%20ShellTea%20PoSlurp.pdf - webarchive
- https://norfolkinfosec.com/fuel-pumps-ii-poslurp-b/ - webarchive
- https://twitter.com/just_windex/status/1162118585805758464 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PostNapTea
PostNapTea aka SIGNBT is an HTTP(S) RAT that is written as a complex object-oriented project.
In 2022-2023, it was deployed against targets like a newspaper organization, agriculture-related entity or a software vendor. The initial access was usually achieved by exploiting vulnerabilities in widely-used software in South Korea.
It collects various information about the victim’s computer, such as computer name, product name, OS details, system uptime, CPU information, system locale, time zone, network status, and malware configuration.
PostNapTea uses AES for encryption and decryption ot network traffic. There is a constant prefix SIGNBT occuring in its HTTP POST requests. The prefix is concatenated with 2 characters that identify the communication stage: • LG: logging into the C&C server • KE: acknowledging the succesful login to the C&C • FI: sending the status of a failed operation • SR: sending the status of a successful operation • GC: getting the next command
There are five classes that represent command groups: • CCButton: for file manipulation and screen capturing • CCBitmap: for network commands, implementing functionality of Windows commands often abused by attackers, like sc, reg, arp, net, ver, wmic, ping, whoami, netstat, tracert, lookup, ipconfig, systeminfo, and netsh advfirewall. • CCComboBox: for file system management • CCList: for process management • CCBrush: for control of the malware itself
It stores its configuration in JSON format. It resolves the Windows APIs it requires during runtime, via the Fowler–Noll–Vo (FNV) hash function.
Its internal name in the version-information resource is usually ppcsnap.dll or pconsnap.dll, which loosely inspired its code name.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PostNapTea.
| Known Synonyms |
|---|
SIGNBT |
Internal MISP references
UUID a31717c0-f25e-4da4-b1a8-84b6fdca2ea1 which can be used as unique global reference for PostNapTea in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Poulight Stealer
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Poulight Stealer.
| Known Synonyms |
|---|
Poullight |
Internal MISP references
UUID e4bcb3e4-17f6-4786-a19b-255c48a07f9a which can be used as unique global reference for Poulight Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.poulight_stealer - webarchive
- https://www.carbonblack.com/blog/tau-threat-discovery-cryptocurrency-clipper-malware-evolves/ - webarchive
- https://blog.360totalsecurity.com/en/a-txt-file-can-steal-all-your-secrets/?web_view=true - webarchive
- https://www.youtube.com/watch?v=MaPXDCq-Gf4 - webarchive
- https://twitter.com/MBThreatIntel/status/1240389621638402049?s=20 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Povlsomware
According to Trend Micro, Povlsomware (Ransom.MSIL.POVLSOM.THBAOBA) is a proof-of-concept (POC) ransomware first released in November 2020 which, according to their Github page, is used to “securely” test the ransomware protection capabilities of security vendor products.
Internal MISP references
UUID 632001f4-a313-4753-b876-f85df00bc387 which can be used as unique global reference for Povlsomware in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Poweliks
Internal MISP references
UUID 782bee33-9f8d-41df-a608-c014bd6a7de1 which can be used as unique global reference for Poweliks in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.poweliks - webarchive
- https://www.zscaler.com/blogs/research/malvertising-targeting-european-transit-users - webarchive
- https://thisissecurity.stormshield.com/2014/08/20/poweliks-command-line-confusion/ - webarchive
- https://www.gdatasoftware.com/blog/2014/07/23947-poweliks-the-persistent-malware-without-a-file - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
POWERBAND
.NET variant of ps1.powerton.
Internal MISP references
UUID ab603f29-9c10-4fb0-9fa3-e123fad11a31 which can be used as unique global reference for POWERBAND in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PowerCat
Internal MISP references
UUID f19e4583-e14d-41b7-9b7a-2bd7eeffd4b1 which can be used as unique global reference for PowerCat in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.powercat - webarchive
- https://twitter.com/VK_Intel/status/1141540229951709184 - webarchive
- https://www.cyborgsecurity.com/blog/you-dont-know-the-hafnium-of-it/ - webarchive
- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PowerDuke
Internal MISP references
UUID c79f5876-e3b9-417a-8eaf-8f1b01a0fecd which can be used as unique global reference for PowerDuke in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.powerduke - webarchive
- https://www.carbonblack.com/2020/03/26/the-dukes-of-moscow/ - webarchive
- https://cocomelonc.github.io/malware/2023/07/26/malware-tricks-35.html - webarchive
- https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
powerkatz
Internal MISP references
UUID 9e3aaf82-268b-47d1-b953-3799c5e1f475 which can be used as unique global reference for powerkatz in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PowerLoader
Internal MISP references
UUID de96ba83-27ec-434c-b77f-7a06820b6e78 which can be used as unique global reference for PowerLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PowerPool
Internal MISP references
UUID 02e5196e-f7ac-490a-9a92-d4865740016b which can be used as unique global reference for PowerPool in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PowerShellRunner
Internal MISP references
UUID 1e2dfce6-1e38-4cff-a78e-b43a442ae8e6 which can be used as unique global reference for PowerShellRunner in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Powersniff
A malware of the gozi group, developed on the base of isfb. It uses Office Macros and PowerShell in documents distributed in e-mail messages.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Powersniff.
| Known Synonyms |
|---|
PUNCHBUGGY |
Internal MISP references
UUID 519d07f5-bea3-4360-8aa5-f9fcdb79cb52 which can be used as unique global reference for Powersniff in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.powersniff - webarchive
- https://atr-blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling/ - webarchive
- https://lokalhost.pl/gozi_tree.txt - webarchive
- https://afyonluoglu.org/PublicWebFiles/Reports-TR/2017%20FireEye%20M-Trends%20Report.pdf - webarchive
- https://content.fireeye.com/m-trends/rpt-m-trends-2017 - webarchive
- https://unit42.paloaltonetworks.com/powersniff-malware-used-in-macro-based-attacks/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PowerRatankba
QUICKRIDE.POWER is a PowerShell variant of the QUICKRIDE backdoor. Its payloads are often saved to C:\windows\temp\
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PowerRatankba.
| Known Synonyms |
|---|
QUICKRIDE.POWER |
Internal MISP references
UUID 606f778a-8b99-4880-8da8-b923651d627b which can be used as unique global reference for PowerRatankba in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.power_ratankba - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.flashpoint-intel.com/blog/disclosure-chilean-redbanc-intrusion-lazarus-ties/ - webarchive
- https://www.riskiq.com/blog/labs/lazarus-group-cryptocurrency/ - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-campaign-targeting-cryptocurrencies-reveals-remote-controller-tool-evolved-ratankba/ - webarchive
- https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug.pdf - webarchive
- https://content.fireeye.com/apt/rpt-apt38 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
prb_backdoor
Internal MISP references
UUID 2c9c42bc-8f26-4122-9454-a7eed8cd8886 which can be used as unique global reference for prb_backdoor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Predator The Thief
Predator is a feature-rich information stealer. It is sold on hacking forums as a bundle which includes: Payload builder and Command and Control web panel. It is able to grab passwords from browsers, replace cryptocurrency wallets, and take photos from the web-camera. It is developed by using a modular approach so that criminals may add more sophisticated tools on top of the it.
Internal MISP references
UUID 54041c03-5714-4247-9226-3c801f59bc07 which can be used as unique global reference for Predator The Thief in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.predator - webarchive
- https://fumik0.com/2019/12/25/lets-play-again-with-predator-the-thief/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-galleon - webarchive
- https://securelist.com/a-predatory-tale/89779 - webarchive
- https://www.bleepingcomputer.com/news/security/fake-microsoft-teams-updates-lead-to-cobalt-strike-deployment/ - webarchive
- https://fumik0.com/2018/10/15/predator-the-thief-in-depth-analysis-v2-3-5/ - webarchive
- https://www.cybereason.com/blog/the-hole-in-the-bucket-attackers-abuse-bitbucket-to-deliver-an-arsenal-of-malware - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.fortinet.com/blog/threat-research/predator-the-thief-new-routes-delivery.html - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/ - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_4_ogawa-niseki_en.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Prestige
According to PCrisk, Prestige is ransomware - malware that prevents victims from accessing (opening) their files by encrypting them. Additionally, Prestige appends the ".enc" extension to filenames and drops the "README" file containing a ransom note. An example of how this ransomware modifies filenames: it renames "1.jpg" to "1.jpg.enc", "2.png" to "2.png.enc", and so forth.
Internal MISP references
UUID 156b617e-2ae4-47a8-9498-6343b24cc6fe which can be used as unique global reference for Prestige in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.prestige - webarchive
- https://blogs.microsoft.com/on-the-issues/2022/12/03/preparing-russian-cyber-offensive-ukraine/ - webarchive
- https://www.microsoft.com/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Prikormka
Internal MISP references
UUID 00764634-4a21-4c5c-8b1f-fb294c9bdd3f which can be used as unique global reference for Prikormka in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Prilex
Internal MISP references
UUID a0899fec-161d-4ba8-9594-8b5620c21705 which can be used as unique global reference for Prilex in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PrincessLocker
Internal MISP references
UUID 0714a7ad-45cb-44ec-92f9-2e839fd8a6b8 which can be used as unique global reference for PrincessLocker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.princess_locker - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/11/princess-ransomware/ - webarchive
- https://www.bleepingcomputer.com/news/security/introducing-her-royal-highness-the-princess-locker-ransomware/ - webarchive
- https://hshrzd.wordpress.com/2016/11/17/princess-locker-decryptor/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PrivateLoader
According to sekoia, PrivateLoader is a modular malware whose main capability is to download and execute one or several payloads. The loader implements anti-analysis techniques, fingerprints the compromised host and reports statistics to its C2 server.
Internal MISP references
UUID dc62452c-a563-4a98-a4cd-174a7125e566 which can be used as unique global reference for PrivateLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.privateloader - webarchive
- https://www.youtube.com/watch?v=Ldp7eESQotM - webarchive
- https://www.bitsight.com/blog/zero-50k-infections-pseudomanuscrypt-sinkholing-part-1 - webarchive
- https://www.bitsight.com/blog/tracking-privateloader-malware-distribution-service - webarchive
- https://www.bitsight.com/blog/unpacking-colibri-loader-russian-apt-linked-campaign - webarchive
- https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/ - webarchive
- https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service/ - webarchive
- https://embee-research.ghost.io/identifying-privateloader-servers-with-censys/ - webarchive
- https://www.bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey - webarchive
- https://www.trendmicro.com/en_us/research/22/e/netdooka-framework-distributed-via-privateloader-ppi.html - webarchive
- https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem - webarchive
- https://intel471.com/blog/privateloader-malware - webarchive
- https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ - webarchive
- https://any.run/cybersecurity-blog/privateloader-analyzing-the-encryption-and-decryption-of-a-modern-loader/ - webarchive
- https://medium.com/walmartglobaltech/icedid-leverages-privateloader-7744771bf87f - webarchive
- https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey - webarchive
- https://medium.com/walmartglobaltech/privateloader-to-anubis-loader-55d066a2653e - webarchive
- https://www.zscaler.com/blogs/security-research/peeking-privateloader - webarchive
- https://de.darktrace.com/blog/privateloader-network-based-indicators-of-compromise - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PRIVATELOG
Malware that abuses the Common Log File System (CLFS) to store/hide a second stage payload via registry transaction files.
Internal MISP references
UUID 41bd3db9-a6f2-49b4-966a-3c710827fa82 which can be used as unique global reference for PRIVATELOG in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.privatelog - webarchive
- https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques - webarchive
- https://twitter.com/ESETresearch/status/1433819369784610828 - webarchive
- https://www.cybereason.com/blog/operation-cuckoobees-a-winnti-malware-arsenal-deep-dive - webarchive
- https://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Project Hook POS
Internal MISP references
UUID d0c7815d-6039-436f-96ef-0767aabbdb36 which can be used as unique global reference for Project Hook POS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Prometei (Windows)
According to Lior Rochberger, Cybereason, prometei is a modular and multi-stage cryptocurrency botnet. It was discovered in July 2020, Cybereason Nocturnus team found evidence that this Prometei has been evolved since 2016. There are Linux and Windows versions of this malware.
Internal MISP references
UUID eddb73d8-a33b-4cc6-b1d5-4697f2f4d0ee which can be used as unique global reference for Prometei (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.prometei - webarchive
- https://twitter.com/honeymoon_ioc/status/1494016518694309896 - webarchive
- https://www.trendmicro.com/en_us/research/21/e/proxylogon-a-coinminer--a-ransomware--and-a-botnet-join-the-part.html - webarchive
- https://blog.talosintelligence.com/prometei-botnet-improves/ - webarchive
- https://twitter.com/honeymoon_ioc/status/1494311182550904840 - webarchive
- https://www.cybereason.com/blog/prometei-botnet-exploiting-microsoft-exchange-vulnerabilities - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Prometheus
Ransomware written in .NET, apparently derived from the codebase of win.hakbit (Thanos) ransomware.
Internal MISP references
UUID 5b5f10bf-2bbe-4019-810c-69eba58ebc81 which can be used as unique global reference for Prometheus in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.prometheus - webarchive
- https://medium.com/cycraft/prometheus-decryptor-6933e7bac1ea - webarchive
- https://www.cybereason.com/blog/cybereason-vs.-prometheus-ransomware - webarchive
- https://therecord.media/decryptor-released-for-prometheus-ransomware-victims/ - webarchive
- https://twitter.com/inversecos/status/1441252744258461699?s=20 - webarchive
- https://www.sentinelone.com/labs/spook-ransomware-prometheus-derivative-names-those-that-pay-shames-those-that-dont/ - webarchive
- https://id-ransomware.blogspot.com/2021/05/prometheus-ransomware.html - webarchive
- https://securityintelligence.com/posts/ransomware-encryption-goes-wrong/ - webarchive
- https://medium.com/cycraft/the-road-to-ransomware-resilience-c1ca37036efd - webarchive
- https://medium.com/s2wlab/prometheus-x-spook-prometheus-ransomware-rebranded-spook-ransomware-6f93bd8ab5dd - webarchive
- https://unit42.paloaltonetworks.com/prometheus-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
proteus
Internal MISP references
UUID 6d5724c6-646f-498a-b810-a6cee20f2b3c which can be used as unique global reference for proteus in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Proto8RAT
Internal MISP references
UUID 2f5797e7-fe30-4d23-9fbe-4092d53b1660 which can be used as unique global reference for Proto8RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ProtonBot
Internal MISP references
UUID 03f30d04-4568-4c4c-88d6-b62efc72f33a which can be used as unique global reference for ProtonBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Prynt Stealer
Internal MISP references
UUID 09a1c6e8-c99f-4648-8210-08c25183f537 which can be used as unique global reference for Prynt Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.prynt_stealer - webarchive
- https://www.zscaler.com/blogs/security-research/no-honor-among-thieves-prynt-stealers-backdoor-exposed - webarchive
- https://twitter.com/vxunderground/status/1519632014361640960 - webarchive
- https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PseudoManuscrypt
According to PCrisk, PseudoManuscrypt is the name of the malware that spies on victims. It is similar to another malware called Manuscrypt. We have discovered PseudoManuscrypt while checking installers for pirated software (one of the examples is a fake pirated installer for SolarWinds - a network monitoring software).
Internal MISP references
UUID bae89d64-30ce-4bfd-937b-0ec4ac846f60 which can be used as unique global reference for PseudoManuscrypt in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pseudo_manuscrypt - webarchive
- https://www.youtube.com/watch?v=uakw2HMGZ-I - webarchive
- https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/ - webarchive
- https://asec.ahnlab.com/en/31683/ - webarchive
- https://medium.com/@lcam/updates-from-the-maas-new-threats-delivered-through-nullmixer-d45defc260d1 - webarchive
- https://www.bitsight.com/blog/zero-50k-infections-pseudomanuscrypt-sinkholing-part-1 - webarchive
- https://ics-cert.kaspersky.com/reports/2021/12/16/pseudomanuscrypt-a-mass-scale-spyware-attack-campaign/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PsiX
According to Matthew Mesa, this is a modular bot. The name stems from the string PsiXMainModule in binaries until mid of September 2018.
In binaries, apart from BotModule and MainModule, references to the following Modules have be observed: BrowserModule BTCModule ComplexModule KeyLoggerModule OutlookModule ProcessModule RansomwareModule SkypeModule
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PsiX.
| Known Synonyms |
|---|
PsiXBot |
Internal MISP references
UUID 416ae41e-17b2-46f6-847b-2831a0b3f8e9 which can be used as unique global reference for PsiX in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.psix - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://www.proofpoint.com/us/threat-insight/post/psixbot-continues-evolve-updated-dns-infrastructure - webarchive
- https://www.proofpoint.com/us/threat-insight/post/psixbot-now-using-google-dns-over-https-and-possible-new-sexploitation-module - webarchive
- https://blog.comodo.com/comodo-news/versions-of-psixbot/ - webarchive
- https://blog.fox-it.com/2019/03/27/psixbot-the-evolution-of-a-modular-net-bot/ - webarchive
- https://twitter.com/seckle_ch/status/1169558035649433600 - webarchive
- https://twitter.com/mesa_matt/status/1035211747957923840 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PSLogger
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PSLogger.
| Known Synonyms |
|---|
ECCENTRICBANDWAGON |
Internal MISP references
UUID 1b1d3548-08db-4dff-878f-77d2f0b69777 which can be used as unique global reference for PSLogger in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PC Surveillance System
Citizenlab notes that PC Surveillance System (PSS) is a commercial spyware product offered by Cyberbit and marketed to intelligence and law enforcement agencies.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PC Surveillance System.
| Known Synonyms |
|---|
PSS |
Internal MISP references
UUID e437f01c-8040-4098-a3fa-20154b58c928 which can be used as unique global reference for PC Surveillance System in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Pteranodon
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pteranodon.
| Known Synonyms |
|---|
Pterodo |
Internal MISP references
UUID d5138738-846e-4466-830c-cd2bb6ad09cf which can be used as unique global reference for Pteranodon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pteranodon - webarchive
- https://blogs.cisco.com/security/network-footprints-of-gamaredon-group - webarchive
- https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021 - webarchive
- https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/Gamaredon_activity.pdf - webarchive
- https://blog.threatstop.com/russian-apt-gamaredon-group - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-intense-campaign-ukraine - webarchive
- https://labs.sentinelone.com/pro-russian-cyberspy-gamaredon-intensifies-ukrainian-security-targeting/ - webarchive
- https://www.threatstop.com/blog/gamaredon-group-understanding-the-russian-apt - webarchive
- https://cert.gov.ua/news/42 - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine - webarchive
- https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution - webarchive
- https://www.bleepingcomputer.com/news/security/russian-gamaredon-hackers-use-8-new-malware-payloads-in-attacks/ - webarchive
- https://blog.yoroi.company/research/cyberwarfare-a-deep-dive-into-the-latest-gamaredon-espionage-campaign/ - webarchive
- https://www.vkremez.com/2019/01/lets-learn-deeper-dive-into-gamaredon.html - webarchive
- https://www.elastic.co/blog/playing-defense-against-gamaredon-group - webarchive
- https://ssu.gov.ua/uploads/files/DKIB/Technical%20report%20Armagedon.pdf - webarchive
- https://blogs.blackberry.com/en/2022/11/gamaredon-leverages-microsoft-office-docs-to-target-ukraine-government - webarchive
- https://cert.gov.ua/article/10702 - webarchive
- https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/ - webarchive
- https://cert.gov.ua/news/46 - webarchive
- https://cert.gov.ua/article/2807 - webarchive
- https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations - webarchive
- https://threatrecon.nshc.net/2019/06/11/sectorc08-multi-layered-sfx-recent-campaigns-target-ukraine/ - webarchive
- https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/ - webarchive
- https://attack.mitre.org/groups/G0047 - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-russia-ukraine-military - webarchive
- https://threatmon.io/cybergun-technical-analysis-of-the-armageddons-infostealer/ - webarchive
- https://threatmon.io/beyond-bullets-and-bombs-an-examination-of-armageddon-groups-cyber-warfare-against-ukraine/ - webarchive
- https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/ - webarchive
- https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PubNubRAT
Internal MISP references
UUID bcc8e3ef-fc5e-4d44-9011-4d429bac0f26 which can be used as unique global reference for PubNubRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Punkey POS
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Punkey POS.
| Known Synonyms |
|---|
poscardstealer |
pospunk |
punkeypos |
Internal MISP references
UUID 57a6dbce-2d8a-44ae-a561-282d02935698 which can be used as unique global reference for Punkey POS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
pupy (Windows)
Pupy is an open-source, cross-platform RAT and post-exploitation framework mainly written in python. Pupy can be loaded from various loaders, including PE EXE, reflective DLL, Linux ELF, pure python, powershell and APK. Most of the loaders bundle an embedded python runtime, python library modules in source/compiled/native forms as well as a flexible configuration. They bootstrap a python runtime environment mostly in-memory for the later stages of pupy to run in. Pupy can communicate using various transports, migrate into processes, load remote python code, python packages and python C-extensions from memory.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular pupy (Windows).
| Known Synonyms |
|---|
Patpoopy |
Internal MISP references
UUID 8a789016-5f8d-4cd9-ba96-ba253db42fd8 which can be used as unique global reference for pupy (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pupy - webarchive
- https://github.com/n1nj4sec/pupy - webarchive
- https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html - webarchive
- https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/elfin-apt33-espionage - webarchive
- https://documents.trendmicro.com/assets/txt/earth-berberoka-linux-iocs-2.txt - webarchive
- https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage - webarchive
- https://www.infinitumit.com.tr/apt-35/ - webarchive
- https://documents.trendmicro.com/assets/white_papers/wp-operation-earth-berberoka.pdf - webarchive
- https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/ - webarchive
- https://securityaffairs.co/wordpress/56348/intelligence/magic-hound-campaign.html - webarchive
- https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/ - webarchive
- https://blog.cyber4sight.com/2017/02/malicious-powershell-script-analysis-indicates-shamoon-actors-used-pupy-rat/ - webarchive
- https://labs.k7computing.com/index.php/pupy-rat-hiding-under-werfaults-cover/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2020-0123.pdf - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0330.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PureCrypter
According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021 The malware has been observed distributing a variety of remote access trojans and information stealers The loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software products PureCrypter features provide persistence, injection and defense mechanisms that are configurable in Google’s Protocol Buffer message format
Internal MISP references
UUID 554993dc-2a30-43d9-ac96-fc9b9cca29f6 which can be used as unique global reference for PureCrypter in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter - webarchive
- https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf - webarchive
- https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter - webarchive
- https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PureLocker
ransomware
Internal MISP references
UUID 7a0f3f15-6920-4bc0-baa1-17dd8263948e which can be used as unique global reference for PureLocker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.purelocker - webarchive
- https://www.intezer.com/blog-purelocker-ransomware-being-used-in-targeted-attacks-against-servers/ - webarchive
- https://github.com/albertzsigovits/malware-notes/blob/master/PureLocker.md - webarchive
- https://exchange.xforce.ibmcloud.com/collection/99c7156cff70e1d8e1687ab7dadc8c0e - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PureLogs Stealer
Internal MISP references
UUID 02cd0480-5de3-4a61-9df8-376a4202b66b which can be used as unique global reference for PureLogs Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PurpleFox
Purple Fox uses msi.dll function, 'MsiInstallProductA', to download and execute its payload. The payload is a .msi file that contains encrypted shellcode including 32-bit and 64-bit versions. once executed the system will be restarted and uses the 'PendingFileRenameOperations' registry to rename it's components.
Upon restart the rootkit capability of Purple Fox is invoked. It creates a suspended svchost process and injects a DLL that will create a driver with the rootkit capability.
The latest version of Purple Fox abuses open-source code to enable it's rootkit components, which includes hiding and protecting its files and registry entries. It also abuses a file utility software to hide its DLL component, which deters reverse engineering.
Internal MISP references
UUID 31638e2b-1c6b-47b9-bbb9-7316f206b354 which can be used as unique global reference for PurpleFox in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.purplefox - webarchive
- https://blog.malwarebytes.com/trojans/2021/03/perkiler-malware-turns-to-smb-brute-force-to-spread/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal/IOCs-Purple-Fox.txt - webarchive
- https://blog.minerva-labs.com/malicious-telegram-installer-drops-purple-fox-rootkit - webarchive
- https://www.guardicore.com/labs/purple-fox-rootkit-now-propagates-as-a-worm/ - webarchive
- https://www.trendmicro.com/en_us/research/21/l/a-look-into-purple-fox-server-infrastructure.html - webarchive
- https://labs.sentinelone.com/purple-fox-ek-new-cves-steganography-and-virtualization-added-to-attack-flow/ - webarchive
- https://threatresearch.ext.hp.com/purple-fox-exploit-kit-now-exploits-cve-2021-26411/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape - webarchive
- https://www.thecybersecuritytimes.com/purple-fox-malware-is-actively-distributed-via-telegram-installers/ - webarchive
- https://blogs.blackberry.com/en/2022/01/threat-thursday-purple-fox-rootkit - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal/Technical%20Brief%20-%20A%20Look%20Into%20Purple%20Fox%E2%80%99s%20New%20Arrival%20Vector.pdf - webarchive
- https://www.trendmicro.com/en_in/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell/ - webarchive
- https://www.trendmicro.com/en_us/research/21/j/purplefox-adds-new-backdoor-that-uses-websockets.html - webarchive
- https://nao-sec.org/2021/04/exploit-kit-still-sharpens-a-sword.html - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/security-101-the-impact-of-cryptocurrency-mining-malware - webarchive
- https://www.trendmicro.com/en_us/research/21/g/purplefox-using-wpad-to-targent-indonesian-users.html - webarchive
- https://twitter.com/C0rk1_H/status/1412801973628272641?s=20 - webarchive
- https://s.tencent.com/research/report/1322.html - webarchive
- https://www.trendmicro.com/en_us/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal.html - webarchive
- https://thehackernews.com/2022/03/purple-fox-hackers-spotted-using-new.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PurpleWave
ZScaler reported on a new Infostealer called PurpleWave, which is written in C++ and silently installs itself onto a user’s system. It connects to a command and control (C&C) server to send system information and installs new malware onto the infected system.
The author of this malware is advertising and selling PurpleWave stealer on Russian cybercrime forums for 5,000 RUB (US$68) with lifetime updates and 4,000 RUB (US$54) with only two updates.
Internal MISP references
UUID 0b63109b-0b4d-4f5d-a475-c91af4eed857 which can be used as unique global reference for PurpleWave in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Pushdo
Pushdo is usually classified as a "downloader" trojan - meaning its true purpose is to download and install additional malicious software. There are dozens of downloader trojan families out there, but Pushdo is actually more sophisticated than most, but that sophistication lies in the Pushdo control server rather than the trojan.
Internal MISP references
UUID b39ffc73-db5f-4a8a-acd2-bee958d69155 which can be used as unique global reference for Pushdo in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pushdo - webarchive
- https://www.trendmicro.de/cloud-content/us/pdfs/business/white-papers/wp_study-of-pushdo-cutwail-botnet.pdf - webarchive
- https://www.blueliv.com/research/tracking-the-footproints-of-pushdo-trojan/ - webarchive
- https://www.shadowserver.org/news/has-the-sun-set-on-the-necurs-botnet/ - webarchive
- http://malware-traffic-analysis.net/2017/04/03/index2.html - webarchive
- https://www.secureworks.com/research/pushdo - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-essex - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-essex - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Putabmow
Internal MISP references
UUID b0cb81bc-5d97-454a-8eee-4e81328c7228 which can be used as unique global reference for Putabmow in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
puzzlemaker
The dropper module is used to install two executables that pretend to be legitimate files belonging to Microsoft Windows OS. One of these files (%SYSTEM%\WmiPrvMon.exe) is registered as a service and is used as a launcher for the second executable. This second executable (%SYSTEM%\wmimon.dll) has the functionality of a remote shell and can be considered the main payload of the attack.
Internal MISP references
UUID 2c835470-1bd2-4bd6-a83b-e9c3e12fa0ad which can be used as unique global reference for puzzlemaker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PvzOut
Internal MISP references
UUID 52932caa-2fac-4eeb-88de-b3e143db010e which can be used as unique global reference for PvzOut in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PwndLocker
PwndLocker is a ransomware that was observed in late 2019 and is reported to have been used to target businesses and local governments/cities. According to one source, ransom amounts demanded as part of PwndLocker activity range from $175k USD to $650k USD depending on the size of the network. PwndLocker attempts to disable a variety of Windows services so that their data can be encrypted. Various processes will also be targeted, such as web browsers and software related to security, backups, and databases. Shadow copies are cleared by the ransomware, and encryption of files occurs once the system has been prepared in this way. Executable files and those that are likely to be important for the system to continue to function appear to be skipped by the ransomware, and a large number of folders mostly related to Microsoft Windows system files are also ignored. As of March 2020, encrypted files have been observed with the added extensions of .key and .pwnd. Ransom notes are dropped in folders where encrypted files are found and also on the user's desktop.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PwndLocker.
| Known Synonyms |
|---|
ProLock |
Internal MISP references
UUID fe0cf4ab-f151-4549-8127-f669c319d546 which can be used as unique global reference for PwndLocker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pwndlocker - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.group-ib.com/blog/prolock - webarchive
- https://www.it-klinika.rs/blog/paznja-novi-opasni-ransomware-pwndlocker-i-u-srbiji - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.zdnet.com/article/fbi-prolock-ransomware-gains-access-to-victim-networks-via-qakbot-infections/ - webarchive
- https://www.bleepingcomputer.com/news/security/pwndlocker-ransomware-gets-pwned-decryption-now-available/ - webarchive
- https://raw.githubusercontent.com/fboldewin/When-ransomware-hits-an-ATM-giant---The-Diebold-Nixdorf-case-dissected/main/When%20ransomware%20hits%20an%20ATM%20giant%20-%20The%20Diebold%20Nixdorf%20case%20dissected%20-%20Group-IB%20CyberCrimeCon2020.pdf - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/ - webarchive
- https://www.hornetsecurity.com/en/security-information/qakbot-malspam-leading-to-prolock/ - webarchive
- https://www.hornetsecurity.com/en/threat-research/qakbot-reducing-its-on-disk-artifacts/ - webarchive
- https://www.cert-pa.it/notizie/pwndlocker-si-rinnova-in-prolock-ransomware/ - webarchive
- https://www.group-ib.com/blog/prolock_evolution - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-009.pdf - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://www.bleepingcomputer.com/news/security/new-pwndlocker-ransomware-targeting-us-cities-enterprises/ - webarchive
- https://id-ransomware.blogspot.com/2019/10/pwndlocker-ransomware.html - webarchive
- https://soolidsnake.github.io/2020/05/11/Prolock_ransomware.html - webarchive
- https://norfolkinfosec.com/tinypos-and-prolocker-an-odd-relationship/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://news.sophos.com/en-us/2020/07/27/prolock-ransomware-gives-you-the-first-8-kilobytes-of-decryption-for-free/ - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-009/ - webarchive
- https://medium.com/s2wlab/operation-synctrek-e5013df8d167 - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://www.intrinsec.com/egregor-prolock/ - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
pwnpos
Internal MISP references
UUID c903627c-90f6-44ee-9750-4bb44bdbceab which can be used as unique global reference for pwnpos in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pwnpos - webarchive
- https://www.brimorlabsblog.com/2015/03/and-you-get-pos-malware-nameand-you-get.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/pwnpos-old-undetected-pos-malware-still-causing-havoc/ - webarchive
- https://usa.visa.com/dam/VCOM/global/support-legal/documents/new-pos-malware-samples.pdf - webarchive
- https://twitter.com/physicaldrive0/status/573109512145649664 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PXRECVOWEIWOEI
Information stealer, based on strings it seems to target crypto currencies, instant messengers, and browser data.
Internal MISP references
UUID ac22ee6f-0d15-4edb-8ea5-1675df57597c which can be used as unique global reference for PXRECVOWEIWOEI in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
win.pyfiledel
Py2exe built worm propagating via USB drives, having wiper features embedded in the logic (based on today's date being later than 2016-04-03 and existence of a file C:\txt.txt)
Internal MISP references
UUID ea8f44b0-6940-42e0-a93f-77a6b572b140 which can be used as unique global reference for win.pyfiledel in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Pykspa
Internal MISP references
UUID 3f0e7db1-5944-4137-89d1-d36940f596d2 which can be used as unique global reference for Pykspa in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pykspa - webarchive
- https://www.youtube.com/watch?v=HfSQlC76_s4 - webarchive
- https://www.johannesbader.ch/2015/07/pykspas-inferior-dga-version/ - webarchive
- https://www.johannesbader.ch/2015/03/the-dga-of-pykspa/ - webarchive
- https://bin.re/blog/the-dga-of-pykspa/ - webarchive
- https://blogs.akamai.com/sitr/2019/07/pykspa-v2-dga-updated-to-become-selective.html - webarchive
- https://bin.re/blog/pykspas-inferior-dga-version/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PyLocky
PyLocky is a ransomware that tries to pass off as Locky in its ransom note. It is written in Python and packaged with PyInstaller.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PyLocky.
| Known Synonyms |
|---|
Locky Locker |
Internal MISP references
UUID 3a5775d3-7d4a-4795-b1b1-7a340030d490 which can be used as unique global reference for PyLocky in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pylocky - webarchive
- https://www.bleepingcomputer.com/news/security/pylocky-decryptor-released-by-french-authorities/ - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/python-malware-on-the-rise/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/a-closer-look-at-the-locky-poser-pylocky-ransomware/ - webarchive
- https://research.checkpoint.com/2020/graphology-of-an-exploit-playbit/ - webarchive
- https://blog.talosintelligence.com/2019/01/pylocky-unlocked-cisco-talos-releases.html - webarchive
- https://sensorstechforum.com/lockymap-files-virus-pylocky-ransomware-remove-restore-data/ - webarchive
- https://www.cert.ssi.gouv.fr/alerte/CERTFR-2018-ALE-008/ - webarchive
- https://www.cybermalveillance.gouv.fr/nos-articles/outil-dechiffrement-rancongiciel-ransomware-pylocky-v1-2/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
PyXie
Full-featured Python RAT compiled into an executable.
PyXie RAT functionality includes: * Man-in-the-middle (MITM) Interception * Web-injects * Keylogging * Credential harvesting * Network Scanning * Cookie theft * Clearing logs * Recording video * Running arbitrary payloads * Monitoring USB drives and exfiltrating data * WebDav server * Socks5 proxy * Virtual Network Connection (VNC) * Certificate theft * Inventorying software * Enumerating the domain with Sharphound
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PyXie.
| Known Synonyms |
|---|
PyXie RAT |
Internal MISP references
UUID 41217f01-2b03-41c1-88fc-cda1eee65f75 which can be used as unique global reference for PyXie in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.pyxie - webarchive
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-dupont - webarchive
- https://cluster25.io/2022/05/03/a-strange-link-between-a-destructive-malware-and-the-loader-of-a-ransomware-group-isaacwiper-vs-vatet/ - webarchive
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/4 - webarchive
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3 - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-ransomexx - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://threatvector.cylance.com/en_us/home/meet-pyxie-a-nefarious-new-python-rat.html - webarchive
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/2/ - webarchive
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/5/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.ic3.gov/Media/News/2021/211101.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Qaccel
Internal MISP references
UUID f4980a75-f72c-4925-8ff5-118b32dd5eaa which can be used as unique global reference for Qaccel in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Qadars
Internal MISP references
UUID 080b2071-2d69-4b76-962e-3d0142074bcb which can be used as unique global reference for Qadars in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.qadars - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://www.welivesecurity.com/2013/12/18/qadars-a-banking-trojan-with-the-netherlands-in-its-sights/ - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
- https://securityintelligence.com/an-analysis-of-the-qadars-trojan/ - webarchive
- https://info.phishlabs.com/blog/dissecting-the-qadars-banking-trojan - webarchive
- https://www.johannesbader.ch/2016/04/the-dga-of-qadars/ - webarchive
- https://securityintelligence.com/meanwhile-britain-qadars-v3-hardens-evasion-targets-18-uk-banks/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QakBot
QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular QakBot.
| Known Synonyms |
|---|
Oakboat |
Pinkslipbot |
Qbot |
Quakbot |
Internal MISP references
UUID 2ccaccd0-8362-4224-8497-2012e7cc7549 which can be used as unique global reference for QakBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://team-cymru.com/blog/2021/11/03/webinject-panel-administration-a-vantage-point-into-multiple-threat-actor-campaigns/ - webarchive
- https://blog.vincss.net/2021/03/re021-qakbot-dangerous-malware-has-been-around-for-more-than-a-decade.html - webarchive
- https://isc.sans.edu/diary/rss/28728 - webarchive
- https://malwareandstuff.com/an-old-enemy-diving-into-qbot-part-1/ - webarchive
- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ - webarchive
- https://blog.cyble.com/2023/02/17/the-many-faces-of-qakbot-malware-a-look-at-its-diverse-distribution-methods/ - webarchive
- https://blog.minerva-labs.com/a-new-datoploader-delivers-qakbot-trojan - webarchive
- https://embee-research.ghost.io/advanced-threat-intel-queries-catching-83-qakbot-servers-with-regex-censys-and-tls-certificates/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://sublime.security/blog/detecting-qakbot-wsf-attachments-onenote-files-and-generic-attack-surface-reduction - webarchive
- https://www.netresec.com/?page=Blog&month=2023-03&post=QakBot-C2-Traffic - webarchive
- https://twitter.com/embee_research/status/1592067841154756610?s=20 - webarchive
- https://www.securityhomework.net/articles/qakbot_ccs_prioritization_and_new_record_types/qakbot_ccs_prioritization_and_new_record_types.php - webarchive
- https://documents.trendmicro.com/assets/rpt/rpt-navigating-new-frontiers-trend-micro-2021-annual-cybersecurity-report.pdf - webarchive
- https://drive.google.com/file/d/1mO2Zb-Q94t39DvdASd4KNTPBD8JdkyC3/view - webarchive
- https://therecord.media/meet-prometheus-the-secret-tds-behind-some-of-todays-malware-campaigns/ - webarchive
- https://www.cylance.com/en_us/blog/threat-spotlight-the-return-of-qakbot-malware.html - webarchive
- https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/ - webarchive
- https://www.truesec.com/hub/blog/proxyshell-qbot-and-conti-ransomware-combined-in-a-series-of-cyber-attacks - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.trendmicro.com/en_us/research/22/f/black-basta-ransomware-operators-expand-their-attack-arsenal-wit.html - webarchive
- https://www.elastic.co/de/security-labs/qbot-malware-analysis - webarchive
- https://twitter.com/embee_research/status/1592067841154756610?s=20&t=hEALPAWr1LIt9pXcVpxjRQ - webarchive
- https://twitter.com/Unit42_Intel/status/1461004489234829320 - webarchive
- https://perception-point.io/insights-into-an-excel-4-0-macro-attack-using-qakbot-malware - webarchive
- https://isc.sans.edu/diary/rss/28568 - webarchive
- https://www.hornetsecurity.com/en/security-information/qakbot-malspam-leading-to-prolock/ - webarchive
- https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://documents.trendmicro.com/assets/pdf/Technical-Brief---The-Prelude-to-Ransomware-A-Look-into-Current-QAKBOT-Capabilities-and-Activity.pdf - webarchive
- https://www.group-ib.com/blog/prolock_evolution - webarchive
- https://malwareandstuff.com/an-old-enemy-diving-into-qbot-part-3/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-009.pdf - webarchive
- https://www.elastic.co/security-labs/qbot-malware-analysis - webarchive
- https://www.splunk.com/en_us/blog/security/from-macros-to-no-macros-continuous-malware-improvements-by-qakbot.html - webarchive
- https://media.scmagazine.com/documents/225/bae_qbot_report_56053.pdf - webarchive
- https://www.reliaquest.com/blog/qbot-black-basta-ransomware/ - webarchive
- https://raw.githubusercontent.com/NtQuerySystemInformation/Malware-RE-papers/main/Qakbot%20report.pdf - webarchive
- https://assets.sentinelone.com/sentinellabs22/sentinellabs-blackbasta - webarchive
- https://blog.lumen.com/qakbot-retool-reinfect-recycle/ - webarchive
- https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/ - webarchive
- https://blog.group-ib.com/prometheus-tds - webarchive
- https://experience.mandiant.com/trending-evil-2/p/1 - webarchive
- https://blog.quosec.net/posts/grap_qakbot_strings/ - webarchive
- https://medium.com/walmartglobaltech/qbot-testing-malvertising-campaigns-3e2552cbc69a - webarchive
- https://news.sophos.com/en-us/2023/02/06/qakbot-onenote-attacks/ - webarchive
- https://sansorg.egnyte.com/dl/ALlvwK6fp0 - webarchive
- https://quosecgmbh.github.io/blog/grap_qakbot_strings.html - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-datoploader-exploits-proxyshell-to-deliver-qbot-and-cobalt-strike - webarchive
- https://www.intrinsec.com/egregor-prolock/ - webarchive
- https://n1ght-w0lf.github.io/malware%20analysis/qbot-banking-trojan/ - webarchive
- https://www.malwarology.com/2022/04/qakbot-series-string-obfuscation/ - webarchive
- https://www.um.edu.mt/library/oar/handle/123456789/76802 - webarchive
- https://www.youtube.com/watch?v=iB1psRMtlqg - webarchive
- https://socprime.com/blog/qbot-malware-detection-old-dog-new-tricks/ - webarchive
- https://www.socinvestigation.com/qbot-spreads-via-lnk-files-detection-response/ - webarchive
- https://github.com/0xThiebaut/PCAPeek/ - webarchive
- https://web.archive.org/web/20151026140427/https://www.symantec.com/security_response/writeup.jsp?docid=2009-050707-0639-99 - webarchive
- https://news.sophos.com/en-us/2022/03/10/qakbot-injects-itself-into-the-middle-of-your-conversations/ - webarchive
- https://web.archive.org/web/20110406012907/http://www.symantec.com/connect/blogs/qakbot-data-thief-unmasked-part-ii - webarchive
- https://www.trendmicro.com/en_us/research/21/k/Squirrelwaffle-Exploits-ProxyShell-and-ProxyLogon-to-Hijack-Email-Chains.html - webarchive
- https://www.bleepingcomputer.com/news/security/qbot-needs-only-30-minutes-to-steal-your-credentials-emails/ - webarchive
- https://www.youtube.com/watch?v=gk7fCC5RiAQ - webarchive
- http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_qakbot_in_detail.pdf - webarchive
- https://asec.ahnlab.com/en/44662/ - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-lagoon - webarchive
- https://blogs.vmware.com/security/2021/11/telemetry-peak-analyzer-an-automatic-malware-campaign-detector.html - webarchive
- https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern - webarchive
- https://content.fireeye.com/m-trends/rpt-m-trends-2020 - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://embee-research.ghost.io/shodan-censys-queries/ - webarchive
- https://www.botconf.eu/wp-content/uploads/2019/12/B2019-OReilly-Jarvis-End-to-end-Botnet-Monitoring.pdf - webarchive
- https://www.justice.gov/d9/2023-08/23mj4251_application_redacted.pdf - webarchive
- https://www.trendmicro.com/en_us/research/21/c/egregor-ransomware-cartel-members-arrested.html - webarchive
- https://www.group-ib.com/blog/egregor - webarchive
- https://securityintelligence.com/qakbot-banking-trojan-causes-massive-active-directory-lockouts/ - webarchive
- https://syrion.me/malware/qakbot-bb-extractor/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2020-1203.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/qbot-malware-switches-to-new-windows-installer-infection-vector/ - webarchive
- https://twitter.com/ChouchWard/status/1405168040254316547 - webarchive
- https://www.malwarology.com/posts/3-qakbot-process-injection/ - webarchive
- https://isc.sans.edu/forums/diary/XLSB+Files+Because+Binary+is+Stealthier+Than+XML/28476/ - webarchive
- https://twitter.com/kienbigmummy/status/1460537501676802051 - webarchive
- https://www.team-cymru.com/post/visualizing-qakbot-infrastructure - webarchive
- https://www.netskope.com/blog/squirrelwaffle-new-malware-loader-delivering-cobalt-strike-and-qakbot - webarchive
- https://www.johannesbader.ch/2016/02/the-dga-of-qakbot/ - webarchive
- https://isc.sans.edu/forums/diary/Qakbot+infection+with+Cobalt+Strike+and+VNC+activity/28448/ - webarchive
- https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/ - webarchive
- https://www.techtimes.com/articles/274190/20220412/qbot-botnet-deploys-malware-payloads-through-malicious-windows-installers.htm - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.linkedin.com/posts/zayedaljaberi_hunting-recent-qakbot-malware-activity-6903498764984606720-2Gl4 - webarchive
- https://thehackernews.com/2022/02/trickbot-gang-likely-shifting.html - webarchive
- https://www.deepinstinct.com/2021/05/26/deep-dive-packing-software-cryptone/ - webarchive
- https://www.cybereason.com/blog/cybereason-vs-egregor-ransomware - webarchive
- https://www.spamhaus.org/news/article/819/qakbot-the-takedown-and-the-remediation - webarchive
- https://www.kroll.com/en/insights/publications/cyber/black-basta-technical-analysis - webarchive
- https://seguranca-informatica.pt/a-taste-of-the-latest-release-of-qakbot - webarchive
- https://www.trendmicro.com/en_us/research/21/l/staging-a-quack-reverse-analyzing-fileless-qakbot-stager.html - webarchive
- https://www.youtube.com/watch?v=OCRyEUhiEyw - webarchive
- https://www.zscaler.com/blogs/security-research/ares-banking-trojan-learns-old-tricks-adds-defunct-qakbot-dga - webarchive
- http://contagiodump.blogspot.com/2010/11/template.html - webarchive
- https://securelist.com/qakbot-technical-analysis/103931/ - webarchive
- https://twitter.com/tylabs/status/1462195377277476871 - webarchive
- https://web.archive.org/web/20120206174705/http://blogs.rsa.com/rsafarl/businesses-beware-qakbot-spreads-like-a-worm-stings-like-a-trojan/ - webarchive
- https://www.malwarology.com/2022/04/qakbot-series-process-injection/ - webarchive
- https://www.trendmicro.com/en_us/research/21/k/qakbot-loader-returns-with-new-techniques-and-tools.html - webarchive
- https://www.circl.lu/pub/tr-64/ - webarchive
- https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://www.intezer.com/blog/malware-analysis/how-threat-actors-abuse-lnk-files/ - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html - webarchive
- https://www.bleepingcomputer.com/news/security/fujifilm-shuts-down-network-after-suspected-ransomware-attack/ - webarchive
- https://www.f5.com/labs/articles/threat-intelligence/qbot-banking-trojan-still-up-to-its-old-tricks - webarchive
- https://blog.quosec.net/posts/grap_qakbot_navigation/ - webarchive
- https://malwareandstuff.com/upnp-messing-up-security-since-years/ - webarchive
- https://krebsonsecurity.com/2023/08/u-s-hacks-qakbot-quietly-removes-botnet-infections/ - webarchive
- https://unit42.paloaltonetworks.com/tutorial-qakbot-infection/ - webarchive
- https://0xthreatintel.medium.com/reversing-qakbot-tlp-white-d1b8b37ad8e7 - webarchive
- https://embee-research.ghost.io/practical-queries-for-malware-infrastructure-part-3/ - webarchive
- https://twitter.com/TheDFIRReport/status/1361331598344478727 - webarchive
- https://blog.talosintelligence.com/2021/10/squirrelwaffle-emerges.html - webarchive
- https://securityintelligence.com/news/qbot-malware-using-windows-defender-antivirus-lure/ - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://web.archive.org/web/20130530033754/http://www.symantec.com/connect/blogs/qakbot-steals-2gb-confidential-data-week - webarchive
- https://download.microsoft.com/download/f/8/1/f816b8b6-bee3-41e5-b6cc-e925a5688f61/Microsoft_Digital_Defense_Report_2020_September.pdf - webarchive
- https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails - webarchive
- https://blog.reversinglabs.com/blog/spotting-malicious-excel4-macros - webarchive
- https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/ - webarchive
- https://hatching.io/blog/reversing-qakbot - webarchive
- https://redcanary.com/blog/intelligence-insights-december-2021 - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-010.pdf - webarchive
- https://blog.talosintelligence.com/2016/04/qbot-on-the-rise.html - webarchive
- https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-qakbot-zip-based-campaign/ - webarchive
- https://unit42.paloaltonetworks.com/wireshark-tutorial-emotet-infection/ - webarchive
- https://blog.talosintelligence.com/following-the-lnk-metadata-trail - webarchive
- https://micahbabinski.medium.com/html-smuggling-detection-5adefebb6841 - webarchive
- https://www.virusbulletin.com/uploads/pdf/magazine/2016/VB2016-Karve-etal.pdf - webarchive
- https://labs.k7computing.com/index.php/qakbot-returns/ - webarchive
- https://research.loginsoft.com/threat-research/blog-maximizing-threat-detections-of-qakbot-with-osquery/ - webarchive
- https://web.archive.org/web/20110909041410/http://www.symantec.com/connect/blogs/qakbot-data-thief-unmasked-part-i - webarchive
- https://raw.githubusercontent.com/fboldewin/When-ransomware-hits-an-ATM-giant---The-Diebold-Nixdorf-case-dissected/main/When%20ransomware%20hits%20an%20ATM%20giant%20-%20The%20Diebold%20Nixdorf%20case%20dissected%20-%20Group-IB%20CyberCrimeCon2020.pdf - webarchive
- https://madlabs.dsu.edu/madrid/blog/2021/04/30/qbot-analyzing-php-proxy-scripts-from-compromised-web-server/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0118.pdf - webarchive
- https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/ - webarchive
- https://web.archive.org/web/20201207094648/https://go.group-ib.com/rs/689-LRE-818/images/Group-IB_Egregor_Ransomware.pdf - webarchive
- https://www.hornetsecurity.com/en/threat-research/qakbot-reducing-its-on-disk-artifacts/ - webarchive
- https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ - webarchive
- https://www.team-cymru.com/post/visualizing-qakbot-infrastructure-part-ii-uncharted-territory - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://www.zscaler.com/blogs/security-research/rise-qakbot-attacks-traced-evolving-threat-techniques - webarchive
- https://lab52.io/blog/bypassing-qakbot-anti-analysis-tactics/ - webarchive
- https://threatresearch.ext.hp.com/detecting-ta551-domains/ - webarchive
- https://www.cybereason.com/blog/threat-alert-aggressive-qakbot-campaign-and-the-black-basta-ransomware-group-targeting-u.s.-companies - webarchive
- https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations-wp.pdf - webarchive
- https://ibm.ent.box.com/s/hs5pcayhbbhjvj8di5sqdpbbd88tsh89 - webarchive
- https://www.advanced-intel.com/post/from-qbot-with-revil-ransomware-initial-attack-exposure-of-jbs - webarchive
- https://www.silentpush.com/blog/malicious-infrastructure-as-a-service - webarchive
- https://blog.morphisec.com/qakbot-qbot-maldoc-two-new-techniques - webarchive
- https://www.youtube.com/watch?v=4I0LF8Vm7SI - webarchive
- https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf - webarchive
- https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-qakbot-countermeasures/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-1112.pdf - webarchive
- https://www.intel471.com/blog/Cobalt-strike-cybercriminals-trickbot-qbot-hancitor - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
- https://research.loginsoft.com/threat-research/from-innocence-to-malice-the-onenote-malware-campaign-uncovered/ - webarchive
- https://resource.redcanary.com/rs/003-YRU-314/images/2021-Threat-Detection-Report.pdf - webarchive
- https://www.atomicmatryoshka.com/post/malware-headliners-qakbot - webarchive
- https://www.malwarology.com/2022/04/qakbot-series-api-hashing/ - webarchive
- https://blog.morphisec.com/obfuscated-vbscript-drops-zloader-ursnif-qakbot-dridex - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://www.trendmicro.com/en_us/research/22/e/bruised-but-not-broken--the-resurgence-of-the-emotet-botnet-malw.html - webarchive
- http://blog.opensecurityresearch.com/2011/12/intro-to-reversing-w32pinkslipbot.html - webarchive
- https://www.justice.gov/d9/2023-08/23mj4244_application_redacted.pdf - webarchive
- https://intel471.com/blog/conti-emotet-ransomware-conti-leaks - webarchive
- https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf - webarchive
- https://www.rapid7.com/blog/post/2023/04/18/automating-qakbot-detection-at-scale-with/ - webarchive
- https://www.youtube.com/watch?v=M22c1JgpG-U - webarchive
- https://www.justice.gov/usao-cdca/pr/qakbot-malware-disrupted-international-cyber-takedown - webarchive
- https://www.malwarology.com/posts/2-qakbot-conf-extraction/ - webarchive
- https://www.cynet.com/attack-techniques-hands-on/quakbot-strikes-with-quaknightmare-exploitation/ - webarchive
- https://bin.re/blog/the-dga-of-qakbot/ - webarchive
- https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-analyzing-a-fowl-banking-trojan-part-1/ - webarchive
- https://research.nccgroup.com/2022/03/31/conti-nuation-methods-and-techniques-observed-in-operations-post-the-leaks/ - webarchive
- https://d01a.github.io/pikabot/ - webarchive
- https://redcanary.com/blog/intelligence-insights-november-2021/ - webarchive
- https://www.malwarology.com/2022/04/qakbot-series-configuration-extraction/ - webarchive
- https://www.fortinet.com/blog/threat-research/notable-droppers-emerge-in-recent-threat-campaigns - webarchive
- https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot - webarchive
- https://twitter.com/elisalem9/status/1381859965875462144 - webarchive
- https://blog.eclecticiq.com/qakbot-malware-used-unpatched-vulnerability-to-bypass-windows-os-security-feature - webarchive
- https://www.malwarology.com/posts/1-qakbot-strings-obfuscation/ - webarchive
- https://www.shadowserver.org/news/qakbot-botnet-disruption/ - webarchive
- https://www.trendmicro.com/de_de/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html - webarchive
- https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ - webarchive
- https://quosecgmbh.github.io/blog/grap_qakbot_navigation.html - webarchive
- https://www.elastic.co/security-labs/qbot-configuration-extractor - webarchive
- https://experience.mandiant.com/trending-evil/p/1 - webarchive
- https://isc.sans.edu/diary/rss/28448 - webarchive
- https://twitter.com/redcanary/status/1334224861628039169 - webarchive
- https://www.vkremez.com/2018/07/lets-learn-in-depth-reversing-of-qakbot.html - webarchive
- https://www.varonis.com/blog/varonis-discovers-global-cyber-campaign-qbot/ - webarchive
- https://securelist.com/malicious-spam-campaigns-delivering-banking-trojans/102917 - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://elis531989.medium.com/funtastic-packers-and-where-to-find-them-41429a7ef9a7 - webarchive
- https://github.com/binref/refinery/blob/master/tutorials/tbr-files.v0x06.Qakbot.Decoder.ipynb - webarchive
- https://intel471.com/blog/ettersilent-maldoc-builder-macro-trickbot-qbot/ - webarchive
- https://resecurity.com/blog/article/shortcut-based-lnk-attacks-delivering-malicious-code-on-the-rise - webarchive
- https://www.0ffset.net/reverse-engineering/malware-analysis/qakbot-browser-hooking-p1/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/decrypting-qakbots-encrypted-registry-keys/ - webarchive
- https://www.secureworks.com/blog/law-enforcement-takes-down-qakbot - webarchive
- https://www.securityartwork.es/2021/06/16/analisis-campana-emotet/ - webarchive
- https://twitter.com/alex_il/status/1384094623270727685 - webarchive
- https://docs.velociraptor.app/blog/2023/2023-04-05-qakbot/ - webarchive
- https://twitter.com/Corvid_Cyber/status/1455844008081641472 - webarchive
- https://www.dsih.fr/article/5020/comment-qbot-revient-en-force-avec-onenote.html - webarchive
- https://blog.talosintelligence.com/qakbot-affiliated-actors-distribute-ransom/ - webarchive
- https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-lagoon - webarchive
- https://securityintelligence.com/posts/sodinokibi-ransomware-incident-response-intelligence-together/ - webarchive
- https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/research/qakbot-evolves-to-onenote-malware-distribution.html - webarchive
- https://www.cynet.com/blog/orion-threat-alert-qakbot-ttps-arsenal-and-the-black-basta-ransomware/ - webarchive
- https://www.fbi.gov/news/stories/fbi-partners-dismantle-qakbot-infrastructure-in-multinational-cyber-takedown - webarchive
- https://www.bleepingcomputer.com/news/security/qbot-phishing-uses-windows-calculator-sideloading-to-infect-devices/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbasta - webarchive
- https://www.zscaler.com/blogs/security-research/hibernating-qakbot-comprehensive-study-and-depth-campaign-analysis - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware - webarchive
- https://www.bitsight.com/blog/emotet-botnet-rises-again - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/demystifying-qbot-malware.html - webarchive
- https://isc.sans.edu/diary/rss/26862 - webarchive
- https://www.malwarology.com/posts/4-qakbot-api-hashing/ - webarchive
- https://resources.malwarebytes.com/files/2020/02/2020_State-of-Malware-Report.pdf - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/rise-of-lnk-shortcut-files-malware/ - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://www.cybereason.com/blog/threat-analysis-msi-masquerading-as-software-installer - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-all-paths-lead-to-cobalt-strike-icedid-emotet-and-qbot - webarchive
- https://blog.talosintelligence.com/2019/05/qakbot-levels-up-with-new-obfuscation.html - webarchive
- https://www.tidalcyber.com/blog/identifying-and-defending-against-qakbots-evolving-ttps - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QHost
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular QHost.
| Known Synonyms |
|---|
Tolouge |
Internal MISP references
UUID 28f35535-dd40-4ee2-8064-5acbe76d8d4c which can be used as unique global reference for QHost in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QtBot
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular QtBot.
| Known Synonyms |
|---|
qtproject |
Internal MISP references
UUID e8240391-3e3d-4894-ba80-f8e8de8a8222 which can be used as unique global reference for QtBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QuantLoader
Internal MISP references
UUID e6005ce5-3e3d-4dfb-8de7-3da45e89e549 which can be used as unique global reference for QuantLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.quantloader - webarchive
- https://www.proofpoint.com/us/threat-insight/post/leaked-source-code-ammyy-admin-turned-flawedammyy-rat - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/necurs-evolves-to-evade-spam-detection-via-internet-shortcut-file/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf - webarchive
- https://twitter.com/Arkbird_SOLG/status/1458973883068043264 - webarchive
- https://malwarebreakdown.com/2017/10/10/malvertising-campaign-uses-rig-ek-to-drop-quant-loader-which-downloads-formbook/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2018/03/an-in-depth-malware-analysis-of-quantloader/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QUARTERRIG
A stager used by APT29 to download and run CobaltStrike. Here, MUSKYBEAT refers to the in-memory dropper component, while STATICNOISE is the final payload / downloader.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular QUARTERRIG.
| Known Synonyms |
|---|
MUSKYBEAT |
STATICNOISE |
Internal MISP references
UUID ef29604c-1fc8-4f3f-9342-dbb28bb1bd5b which can be used as unique global reference for QUARTERRIG in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.quarterrig - webarchive
- https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0727-1.pdf - webarchive
- https://www.gov.pl/attachment/6f51bb1a-3ad2-461c-a16d-408915a56f77 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Quasar RAT
Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Quasar RAT.
| Known Synonyms |
|---|
CinaRAT |
QuasarRAT |
Yggdrasil |
Internal MISP references
UUID 05252643-093b-4070-b62f-d5836683a9fa which can be used as unique global reference for Quasar RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat - webarchive
- https://blog.malwarelab.pl/posts/venom/ - webarchive
- https://therecord.media/chinese-hackers-linked-to-months-long-attack-on-taiwanese-financial-sector/ - webarchive
- https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf - webarchive
- https://medium.com/cycraft/china-implicated-in-prolonged-supply-chain-attack-targeting-taiwan-financial-sector-264b6a1c3525 - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://lab52.io/blog/the-energy-reserves-in-the-eastern-mediterranean-sea-and-a-malicious-campaign-of-apt10-against-turkey/ - webarchive
- https://blog.minerva-labs.com/trapping-quasar-rat - webarchive
- https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf - webarchive
- https://www.ironnet.com/blog/china-cyber-attacks-the-current-threat-landscape - webarchive
- https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/ - webarchive
- https://ti.360.net/blog/articles/analysis-of-apt-c-09-target-china/ - webarchive
- https://www.macnica.net/file/mpressioncss_ta_report_2019.pdf - webarchive
- https://www.qualys.com/docs/whitepapers/qualys-wp-stealthy-quasar-evolving-to-lead-the-rat-race-v220727.pdf - webarchive
- https://mp.weixin.qq.com/s/n6XQAGtNEXfPZXp1mlwDTQ - webarchive
- https://embee-research.ghost.io/hunting-quasar-rat-shodan - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-riverside - webarchive
- https://blog.ensilo.com/uncovering-new-activity-by-apt10 - webarchive
- https://www.cybereason.com/blog/new-malware-arsenal-abusing-cloud-platforms-in-middle-east-espionage-campaign - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage - webarchive
- https://blogs.jpcert.or.jp/en/2020/12/quasar-family.html - webarchive
- http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments - webarchive
- https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf?platform=hootsuite - webarchive
- https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-40-LunghiHorejsi.pdf - webarchive
- https://twitter.com/struppigel/status/1130455143504318466 - webarchive
- https://embee-research.ghost.io/shodan-censys-queries/ - webarchive
- https://www.zscaler.com/blogs/security-research/catching-rats-over-custom-protocols - webarchive
- https://www.secureworks.com/research/threat-profiles/aluminum-saratoga - webarchive
- https://blog.morphisec.com/syk-crypter-discord - webarchive
- https://securityintelligence.com/posts/roboski-global-recovery-automation/ - webarchive
- https://www.fortinet.com/blog/threat-research/uncovering-new-activity-by-apt- - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord? - webarchive
- https://medium.com/cycraft/supply-chain-attack-targeting-taiwan-financial-sector-bae2f0962934 - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/malware-now-using-nvidias-stolen-code-signing-certificates/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments - webarchive
- https://www.fortinet.com/blog/threat-research/threat-actors-prey-on-eager-travelers - webarchive
- https://www.zscaler.com/blogs/security-research/look-hydrojiin-campaign - webarchive
- http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa - webarchive
- https://www.trendmicro.com/en_us/research/21/i/Water-Basilisk-Uses-New-HCrypt-Variant-to-Flood-Victims-with-RAT-Payloads.html - webarchive
- https://blog.morphisec.com/cinarat-resurfaces-with-new-evasive-tactics-and-techniques - webarchive
- https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html - webarchive
- https://www.bleepingcomputer.com/news/security/trojanized-dnspy-app-drops-malware-cocktail-on-researchers-devs/ - webarchive
- https://www.trendmicro.com/en_us/research/21/l/collecting-in-the-dark-tropic-trooper-targets-transportation-and-government-organizations.html - webarchive
- https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt - webarchive
- https://asec.ahnlab.com/en/31089/ - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf - webarchive
- https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/ - webarchive
- https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 - webarchive
- https://securelist.com/apt-trends-report-q1-2021/101967/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
- https://research.loginsoft.com/threat-research/from-innocence-to-malice-the-onenote-malware-campaign-uncovered/ - webarchive
- https://blog.qualys.com/vulnerabilities-threat-research/2022/07/29/new-qualys-research-report-evolution-of-quasar-rat - webarchive
- https://blog.reversinglabs.com/blog/rats-in-the-library - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/elfin-apt33-espionage - webarchive
- https://www.macnica.net/file/mpressioncss_2018-1h-report_mnc_rev3_nopw.pdf - webarchive
- https://www.antiy.cn/research/notice&report/research_report/20201228.html - webarchive
- https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 - webarchive
- https://twitter.com/malwrhunterteam/status/789153556255342596 - webarchive
- https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage - webarchive
- https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf - webarchive
- https://lab52.io/blog/another-cyber-espionage-campaign-in-the-russia-ukrainian-ongoing-cyber-attacks/ - webarchive
- https://blog.rootshell.be/2022/02/11/sans-isc-cinarat-delivered-through-html-id-attributes/ - webarchive
- https://www.youtube.com/watch?v=yimh33nSOt8 - webarchive
- https://www.zscaler.com/blogs/research/shellreset-rat-spread-through-macro-based-documents-using-applocker-bypass - webarchive
- https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/ - webarchive
- https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html - webarchive
- https://www.ciphertechsolutions.com/roboski-global-recovery-automation/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader - webarchive
- https://research.openanalysis.net/quasar/chaos/rat/ransomware/2023/04/13/quasar-chaos.html - webarchive
- https://threatpost.com/apt-exploits-zerologon-targets-japanese-companies/161383/ - webarchive
- https://www.trendmicro.com/en_us/research/22/d/new-apt-group-earth-berberoka-targets-gambling-websites-with-old.html - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_0_JPCERT_en.pdf - webarchive
- https://www.zscaler.com/blogs/security-research/snip3-crypter-reveals-new-ttps-over-time - webarchive
- https://news.sophos.com/en-us/2022/08/18/cookie-stealing-the-new-perimeter-bypass - webarchive
- https://blogs.jpcert.or.jp/ja/2022/05/HUILoader.html - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://www.welivesecurity.com/2018/07/17/deep-dive-vermin-rathole/ - webarchive
- https://intel471.com/blog/privateloader-malware - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QuickHeal
Internal MISP references
UUID 8a4747a4-8165-40eb-abfe-fd674558ecb4 which can be used as unique global reference for QuickHeal in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QUICKMUTE
QuickMute is a malware developed using the C/C++ programming language. Functionally provides download, RC4 decryption, and in-memory launch of the payload (waiting for a PE file with the export function "HttpsVictimMain"). To communicate with the management server, a number of protocols are provided, in particular: TCP, UDP, HTTP, HTTPS.
Internal MISP references
UUID 56d5ee92-845e-4b71-814c-2b0f0ca88523 which can be used as unique global reference for QUICKMUTE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QUIETCANARY
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular QUIETCANARY.
| Known Synonyms |
|---|
Kapushka |
Tunnus |
Internal MISP references
UUID 2577fb8d-1511-49f7-9b62-7816137190c8 which can be used as unique global reference for QUIETCANARY in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.quietcanary - webarchive
- https://securelist.com/tomiris-called-they-want-their-turla-malware-back/109552/ - webarchive
- https://www.mandiant.com/resources/blog/turla-galaxy-opportunity - webarchive
- https://securelist.com/it-threat-evolution-q2-2023/110355/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QuietSieve
According to Microsoft, this is a heavily obfuscated .NET malware, primarily geared towards the exfiltration of data from the compromised host. But it can also receive and execute a remote payload from the operator.
Internal MISP references
UUID 49aa0a57-812c-4344-9315-cd8c3220198e which can be used as unique global reference for QuietSieve in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QuiteRAT
QuiteRAT is a simple remote access trojan written with the help of Qt libraries.
After sending preliminary system information to its C&C server, it expects a response containing either a supported command code or an actual Windows command (like systeminfo or ipconfig with parameters) to execute.
It was deployed in a campaign exploiting a ManageEngine ServiceDesk vulnerability (CVE-2022-47966).
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular QuiteRAT.
| Known Synonyms |
|---|
Acres |
Internal MISP references
UUID 03409fbe-c8ac-41f9-a89b-38dd9f7ef63d which can be used as unique global reference for QuiteRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.quiterat - webarchive
- https://blog.talosintelligence.com/lazarus-quiterat/ - webarchive
- https://businessinsights.bitdefender.com/tech-advisory-manageengine-cve-2022-47966 - webarchive
- https://asec.ahnlab.com/ko/56256/ - webarchive
- https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Qulab
Qulab is an AutoIT Malware focusing on stealing & clipping content from victim's machines.
Internal MISP references
UUID 728ce877-6f1d-4719-81df-387a8e395695 which can be used as unique global reference for Qulab in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
QvoidStealer
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular QvoidStealer.
| Known Synonyms |
|---|
Qvoid-Token-Grabber |
Internal MISP references
UUID 020950da-79e5-481b-9986-14ed1c97e04c which can be used as unique global reference for QvoidStealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
r77
According to the author, r77 is a ring 3 rootkit that hides everything: * Files, directories * Processes & CPU usage * Registry keys & values * Services * TCP & UDP connections * Junctions, named pipes, scheduled tasks
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular r77.
| Known Synonyms |
|---|
r77 Rootkit |
Internal MISP references
UUID f577050b-a4a3-4ebd-a9d9-77300f3435f5 which can be used as unique global reference for r77 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
r980
Internal MISP references
UUID 06f63e6b-d177-4e21-b432-e3a219bc0965 which can be used as unique global reference for r980 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Raccoon
Raccoon Stealer is a malware reportedly sold for $75 a week or $200 a month. It gathers personal information including passwords, browser cookies and autofill data, as well as cryptowallet details. Additionally, Raccoon Stealer records system information such as IP addresses and geo-location data.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Raccoon.
| Known Synonyms |
|---|
Mohazo |
RaccoonStealer |
Racealer |
Racoon |
Internal MISP references
UUID 027fb7d0-3e9b-4433-aee1-c266e165a5cc which can be used as unique global reference for Raccoon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.raccoon - webarchive
- https://decoded.avast.io/vladimirmartyanov/zloader-the-silent-night/ - webarchive
- https://www.group-ib.com/blog/fakesecurity_raccoon - webarchive
- https://medium.com/s2wlab/deep-analysis-of-raccoon-stealer-5da8cbbc4949 - webarchive
- https://news.sophos.com/en-us/2021/08/03/trash-panda-as-a-service-raccoon-stealer-steals-cookies-cryptocoins-and-more/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf - webarchive
- https://www.team-cymru.com/post/seychelles-seychelles-on-the-c-2-shore - webarchive
- https://d01a.github.io/raccoon-stealer/ - webarchive
- https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d - webarchive
- https://www.secureworks.com/research/the-growing-threat-from-infostealers - webarchive
- https://www.bleepingcomputer.com/news/security/new-meta-information-stealer-distributed-in-malspam-campaign/ - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/289/Bitdefender-WhitePaper-Fallout.pdf - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/ - webarchive
- https://ke-la.com/information-stealers-a-new-landscape/ - webarchive
- https://news.sophos.com/en-us/2021/09/01/fake-pirated-software-sites-serve-up-malware-droppers-as-a-service/ - webarchive
- https://blog.cyble.com/2021/10/21/raccoon-stealer-under-the-lens-a-deep-dive-analysis/ - webarchive
- https://www.bleepingcomputer.com/news/security/massive-campaign-uses-youtube-to-push-password-stealing-malware/ - webarchive
- https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/ - webarchive
- https://twitter.com/GroupIB_GIB/status/1570821174736850945 - webarchive
- https://blog.talosintelligence.com/2021/08/raccoon-and-amadey-install-servhelper.html - webarchive
- https://www.spamhaus.com/custom-content/uploads/2021/04/Botnet-update-Q1-2021.pdf - webarchive
- https://medium.com/csis-techblog/gcleaner-garbage-provider-since-2019-2708e7c87a8a - webarchive
- https://www.zerofox.com/blog/raccoon-stealer-pivots-towards-self-protection/ - webarchive
- https://blog.checkpoint.com/2022/05/10/a-german-car-attack-on-german-vehicle-businesses/ - webarchive
- https://blogs.blackberry.com/en/2021/09/threat-thursday-raccoon-infostealer - webarchive
- https://www.cybereason.com/blog/hunting-raccoon-stealer-the-new-masked-bandit-on-the-block - webarchive
- https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/ - webarchive
- https://lp.cyberark.com/rs/316-CZP-275/images/CyberArk-Labs-Racoon-Malware-wp.pdf - webarchive
- https://www.youtube.com/watch?v=5KHZSmBeMps - webarchive
- https://www.cisa.gov/sites/default/files/2023-11/aa23-320a_scattered_spider.pdf - webarchive
- https://therecord.media/malware-group-leaks-millions-of-stolen-authentication-cookies/ - webarchive
- https://www.bleepingcomputer.com/news/security/raccoon-stealer-malware-suspends-operations-due-to-war-in-ukraine/ - webarchive
- https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf - webarchive
- https://www.youtube.com/watch?v=1dbepxN2YD8 - webarchive
- https://webcache.googleusercontent.com/search?q=cache:AvJw47-V_WwJ:https://ultrahacks.org/shop/product/raccoon-stealer-onion-panel/+&cd=1&hl=en&ct=clnk&gl=ch&client=firefox-b-d - webarchive
- https://drive.google.com/file/d/13HEi9Px8V583sRkUG4Syawuw5qwU-W9Q/view - webarchive
- https://cloudsek.com/recordbreaker-the-resurgence-of-raccoon - webarchive
- https://www.youtube.com/watch?v=kfl_2_NBVGc - webarchive
- https://medium.com/@lcam/updates-from-the-maas-new-threats-delivered-through-nullmixer-d45defc260d1 - webarchive
- https://labs.k7computing.com/index.php/raccoon-back-with-new-claws/ - webarchive
- https://www.socinvestigation.com/raccoon-infostealer-malware-returns-with-new-ttps-detection-response/ - webarchive
- https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ - webarchive
- https://www.zerofox.com/blog/brief-raccoon-stealer-version-2-0/ - webarchive
- https://asec.ahnlab.com/ko/25837/ - webarchive
- https://www.riskiq.com/blog/labs/magecart-medialand/ - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://asec.ahnlab.com/en/35981/ - webarchive
- https://blog.malwarebytes.com/social-engineering/2020/09/malvertising-campaigns-come-back-in-full-swing/ - webarchive
- https://cyberint.com/blog/financial-services/raccoon-stealer/ - webarchive
- https://www.justice.gov/usao-wdtx/pr/newly-unsealed-indictment-charges-ukrainian-national-international-cybercrime-operation - webarchive
- https://team-cymru.com/blog/2022/03/23/raccoon-stealer-an-insight-into-victim-gates/ - webarchive
- https://infosecwriteups.com/raccoon-stealer-v2-malware-analysis-55cc33774ac8 - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://www.zscaler.com/blogs/security-research/raccoon-stealer-v2-latest-generation-raccoon-family - webarchive
- https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-recordbreaker-f6400c11d58b - webarchive
- https://any.run/cybersecurity-blog/raccoon-stealer-v2-malware-analysis/ - webarchive
- https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem - webarchive
- https://medium.com/s2wlab/w1-feb-en-story-of-the-week-stealers-on-the-darkweb-49945a31601d - webarchive
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a - webarchive
- https://www.secfreaks.gr/2019/12/in-depth-analysis-of-an-infostealer-raccoon.html - webarchive
- https://decoded.avast.io/vladimirmartyanov/raccoon-stealer-trash-panda-abuses-telegram - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Racket Downloader
Racket Downloader is an HTTP(S) downloader.
It uses a custom substitution cipher for decryption of its character strings, and RC5 with a 256-bit key for encryption and decryption of network traffic.
It sends an HTTP POST request containing a particular value that inspired its name, like "?product_field=racket" or "prd_fld=racket".
Racket Downloader was deployed against South Korean targets running the Initech INISAFE CrossWeb EX software in Q2 2021 and Q1 2022.
Internal MISP references
UUID 993db92e-0c84-4750-a58f-2b61d6cd6d67 which can be used as unique global reference for Racket Downloader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.racket - webarchive
- https://asec.ahnlab.com/en/33801/ - webarchive
- https://medium.com/s2wlab/analysis-of-lazarus-malware-abusing-non-activex-module-in-south-korea-7d52b9539c12 - webarchive
- https://asec.ahnlab.com/ko/40495/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-dream-job-chemical - webarchive
- https://securelist.com/the-lazarus-group-deathnote-campaign/109490/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rad
Internal MISP references
UUID f99e0c8b-a479-4902-9c7e-e16724323ef6 which can be used as unique global reference for Rad in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Radamant
Internal MISP references
UUID 98bcb2b9-bc3a-4ffb-859a-94bd03c1cc3c which can be used as unique global reference for Radamant in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RadRAT
Internal MISP references
UUID 271752e3-67ca-48bc-ade2-30eec11defca which can be used as unique global reference for RadRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RagnarLocker (Windows)
Internal MISP references
UUID 33f55172-873b-409e-a09b-97ac1301b036 which can be used as unique global reference for RagnarLocker (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnarlocker - webarchive
- https://resources.prodaft.com/wazawaka-report - webarchive
- https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/ - webarchive
- https://news.sophos.com/en-us/2021/02/03/mtr-casebook-uncovering-a-backdoor-implant-in-a-solarwinds-orion-server/ - webarchive
- https://www.capcom.co.jp/ir/english/news/pdf/e210413.pdf - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1 - webarchive
- https://ics-cert.kaspersky.com/media/KASPERSKY_H1_2020_ICS_REPORT_EN.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/fbi-ransomware-gang-breached-52-us-critical-infrastructure-orgs/ - webarchive
- https://seguranca-informatica.pt/ragnar-locker-malware-analysis/ - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/moving-left-ransomware-boom - webarchive
- http://reversing.fun/posts/2021/04/15/unpacking_ragnarlocker_via_emulation.html - webarchive
- https://intel471.com/blog/conti-ransomware-cooperation-maze-lockbit-ragnar-locker - webarchive
- http://reversing.fun/reversing/2021/04/15/unpacking_ragnarlocker_via_emulation.html - webarchive
- https://blog.reversing.xyz/reversing/2021/04/15/unpacking_ragnarlocker_via_emulation.html - webarchive
- https://www.bleepingcomputer.com/news/security/ragnarlocker-ransomware-hits-edp-energy-giant-asks-for-10m/ - webarchive
- https://www.theregister.com/2022/03/09/fbi_says_ragnar_locker_ransomware/ - webarchive
- https://krebsonsecurity.com/2020/11/ransomware-group-turns-to-facebook-ads/ - webarchive
- https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/ - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/evolving-danger-ransomware-extortion - webarchive
- https://blog.blazeinfosec.com/dissecting-ragnar-locker-the-case-of-edp/ - webarchive
- https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://cyware.com/news/ragnar-locker-breached-52-organizations-and-counting-fbi-warns-0588d220/ - webarchive
- https://www.bleepingcomputer.com/news/security/japanese-game-dev-capcom-hit-by-cyberattack-business-impacted/ - webarchive
- https://twitter.com/AltShiftPrtScn/status/1403707430765273095 - webarchive
- https://www.acronis.com/en-sg/articles/ragnar-locker/ - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/ - webarchive
- https://securelist.com/targeted-ransomware-encrypting-data/99255/ - webarchive
- https://blog.bushidotoken.net/2022/05/gamer-cheater-hacker-spy.html - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://securelist.com/modern-ransomware-groups-ttps/106824/ - webarchive
- https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ragnarlocker-ransomware-threatens-to-release-confidential-information - webarchive
- https://blog.cyble.com/2022/01/20/deep-dive-into-ragnar-locker-ransomware-gang/ - webarchive
- https://www.bleepingcomputer.com/news/security/capcom-hit-by-ragnar-locker-ransomware-1tb-allegedly-stolen/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/ - webarchive
- https://www.zdnet.com/article/capcom-quietly-discloses-cyberattack-impacting-email-file-servers/ - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/ - webarchive
- https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/ - webarchive
- https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf - webarchive
- https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel - webarchive
- https://blog.reversing.xyz/docs/posts/unpacking_ragnarlocker_via_emulation/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/analysis-and-protections-for-ragnarlocker-ransomware.html - webarchive
- https://id-ransomware.blogspot.com/2020/02/ragnarlocker-ransomware.html - webarchive
- https://www.waterisac.org/system/files/articles/FLASH-MU-000140-MW.pdf - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://www.ic3.gov/Media/News/2022/220307.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ragnarok
According to Bleeping Computer, the ransomware is used in targeted attacks against unpatched Citrix servers. It excludes Russian and Chinese targets using the system's Language ID for filtering. It also tries to disable Windows Defender and has a number of UNIX filepath references in its strings. Encryption method is AES using a dynamically generated key, then bundling this key up via RSA.
Internal MISP references
UUID ce9dffb7-2220-4e9c-9cb1-221195ba42ba which can be used as unique global reference for Ragnarok in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnarok - webarchive
- https://www.tarlogic.com/blog/ragnarok-malware-stopper-vaccine/ - webarchive
- https://www.bleepingcomputer.com/news/security/ragnarok-ransomware-releases-master-decryptor-after-shutdown/ - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf - webarchive
- https://news.sophos.com/en-us/2020/05/21/asnarok2/ - webarchive
- https://github.com/k-vitali/Malware-Misc-RE/blob/master/2020-01-26-ragnarok-cfg-vk.notes.raw - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://www.bleepingcomputer.com/news/security/ragnarok-ransomware-targets-citrix-adc-disables-windows-defender/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Raindrop
Raindrop is a loader for Cobalt Strike that was observed in the SolarWinds attack.
Internal MISP references
UUID 309f9be7-8824-4452-90b3-cef81fd10099 which can be used as unique global reference for Raindrop in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.raindrop - webarchive
- https://www.mandiant.com/resources/unc2452-merged-into-apt29 - webarchive
- https://www.sans.org/webcasts/contrarian-view-solarwinds-119515 - webarchive
- https://symantec.broadcom.com/hubfs/Attacks-Against-Government-Sector.pdf - webarchive
- https://blog.bushidotoken.net/2022/07/space-invaders-cyber-threats-that-are.html - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware - webarchive
- https://www.youtube.com/watch?v=GfbxHy6xnbA - webarchive
- https://file2.api.drift.com/download/drift-prod-file-uploads/417f%2F417f74ae8ddd24aa7c2b43a23093983f/Supply%20Chain%20Attacks_%20Cyber%20Criminals%20Target%20the%20Weakest%20Link.pdf - webarchive
- https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rakhni
Internal MISP references
UUID cf6887d9-3d68-4f89-9d61-e97dcc4d8c20 which can be used as unique global reference for Rakhni in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rambo
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Rambo.
| Known Synonyms |
|---|
brebsd |
Internal MISP references
UUID 805b99d1-233d-4f7f-b343-440e5d507494 which can be used as unique global reference for Rambo in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rambo - webarchive
- https://github.com/m0n0ph1/APT_CyberCriminal_Campagin_Collections-1/blob/master/2017/2017.02.15.deep-dive-dragonok-rambo-backdoor/Deep%20Dive%20on%20the%20DragonOK%20Rambo%20Backdoor%20_%20Morphick%20Cyber%20Security.pdf - webarchive
- https://securitykitten.github.io/2017/02/15/the-rambo-backdoor.html - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-overbrook - webarchive
- https://github.com/malware-kitten/securitykitten.github.io/blob/master/_posts/2017-02-15-the-rambo-backdoor.md - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ramdo
Internal MISP references
UUID 51f53823-d289-4176-af45-3fca7eda824b which can be used as unique global reference for Ramdo in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ramnit
According to Check Point, Ramnit is primarily a banking trojan, meaning that its purpose is to steal login credentials for online banking, which cybercriminals can sell or use in future attacks. For this reason, Ramnit primarily targets individuals rather than focusing on particular industries.
Ramnit campaigns have been observed to target organizations in particular industries. For example, a 2019 campaign targeted financial organizations in the United Kingdom, Italy, and Canada.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ramnit.
| Known Synonyms |
|---|
Nimnul |
Internal MISP references
UUID 542161c0-47a4-4297-baca-5ed98386d228 which can be used as unique global reference for Ramnit in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ramnit - webarchive
- https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree - webarchive
- https://www.researchgate.net/profile/Lorenzo-De-Carli/publication/320250366_Botnet_protocol_inference_in_the_presence_of_encrypted_traffic/links/5fa9608792851cc286a08592/Botnet-protocol-inference-in-the-presence-of-encrypted-traffic.pdf?origin=publication_detail - webarchive
- https://informationsecurity.report/Resources/Whitepapers/b201d876-c5df-486d-975e-2dc08eb85f02_W32.Ramnit%20analysis.pdf - webarchive
- https://blogs.akamai.com/2019/02/ramnit-in-the-uk.html - webarchive
- http://www.vkremez.com/2018/02/deeper-dive-into-ramnit-banker-vnc-ifsb.html - webarchive
- https://redcanary.com/resources/webinars/deep-dive-process-injection/ - webarchive
- https://www.youtube.com/watch?v=l6ZunH6YG0A - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://malwarebreakdown.com/2017/08/23/the-seamless-campaign-isnt-losing-any-steam/ - webarchive
- https://securelist.com/financial-cyberthreats-in-2020/101638/ - webarchive
- https://muha2xmad.github.io/unpacking/ramnit/ - webarchive
- https://gallery.mailchimp.com/c35aef82661dad887b8162a4f/files/e24e8206-a157-4796-a8cb-2b7262cc76e8/CSIS_Threat_Matrix_H1_2019.pdf - webarchive
- https://artik.blue/malware4 - webarchive
- https://www.mandiant.com/resources/pe-file-infecting-malware-ot - webarchive
- https://securityintelligence.com/posts/ramnit-banking-trojan-stealing-card-data/ - webarchive
- https://www.cert.pl/en/news/single/ramnit-in-depth-analysis/ - webarchive
- http://contagiodump.blogspot.com/2012/01/blackhole-ramnit-samples-and-analysis.html - webarchive
- https://ibm.ent.box.com/s/hs5pcayhbbhjvj8di5sqdpbbd88tsh89 - webarchive
- http://www.nao-sec.org/2018/01/analyzing-ramnit-used-in-seamless.html - webarchive
- https://research.checkpoint.com/2020/graphology-of-an-exploit-playbit/ - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-fairfax - webarchive
- https://www.youtube.com/watch?v=N4f2e8Mygag - webarchive
- https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/w32-ramnit-analysis-15-en.pdf - webarchive
- https://securityintelligence.com/posts/from-ramnit-to-bumblebee-via-neverquest - webarchive
- https://research.checkpoint.com/ramnits-network-proxy-servers/ - webarchive
- https://bin.re/blog/the-dga-of-ramnit/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ramsay
Internal MISP references
UUID 3b5bb37b-c5be-45b6-a4b1-83a03605a926 which can be used as unique global reference for Ramsay in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ramsay - webarchive
- https://www.antiy.cn/research/notice&report/research_report/20200522.html - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf - webarchive
- https://blog.bushidotoken.net/2020/06/deep-dive-darkhotel-apt.html - webarchive
- https://www.sentinelone.com/blog/why-on-device-detection-matters-new-ramsay-trojan-targets-air-gapped-networks/ - webarchive
- https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/ - webarchive
- https://www.youtube.com/watch?v=SKIu4LqMrns - webarchive
- https://cocomelonc.github.io/tutorial/2022/05/16/malware-pers-5.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ranbyus
Internal MISP references
UUID 5d9a27e7-3110-470a-ac0d-2bf00cac7846 which can be used as unique global reference for Ranbyus in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ranbyus - webarchive
- https://www.group-ib.ru/brochures/Group-IB-Corkow-Report-EN.pdf - webarchive
- https://www.welivesecurity.com/2012/06/05/smartcard-vulnerabilities-in-modern-banking-malware/ - webarchive
- https://www.welivesecurity.com/2012/12/19/win32spy-ranbyus-modifying-java-code-in-rbs/ - webarchive
- https://bin.re/blog/the-dga-of-ranbyus/ - webarchive
- http://www.xylibox.com/2013/01/trojanwin32spyranbyus.html - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
- https://www.johannesbader.ch/2015/05/the-dga-of-ranbyus/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ranion
Ransomware.
Internal MISP references
UUID 2ae8b99c-cebe-4758-8ae9-8f336a7bef0d which can be used as unique global reference for Ranion in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ranscam
Internal MISP references
UUID 50c92b0b-cae3-41e7-b7d8-dffc2c88ac4b which can be used as unique global reference for Ranscam in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ransoc
Internal MISP references
UUID 5310903e-0704-4ca4-ab1b-52d243dddb06 which can be used as unique global reference for Ransoc in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RansomEXX (Windows)
RansomExx is a ransomware family that targeted multiple companies starting in mid-2020. It shares commonalities with Defray777.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RansomEXX (Windows).
| Known Synonyms |
|---|
Defray777 |
Ransom X |
Internal MISP references
UUID ddb31693-2356-4345-9c0f-ab37724090a4 which can be used as unique global reference for RansomEXX (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ransomexx - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout - webarchive
- https://id-ransomware.blogspot.com/2020/06/ransomexx-ransomware.html - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.cybereason.com/blog/cybereason-vs.-ransomexx-ransomware - webarchive
- https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/ - webarchive
- https://github.com/Bleeping/Ransom.exx - webarchive
- https://medium.com/proferosec-osm/ransomexx-fixing-corrupted-ransom-8e379bcaf701 - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ - webarchive
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/5/ - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/ - webarchive
- https://www.bleepingcomputer.com/news/security/ransomware-attack-hits-italys-lazio-region-affects-covid-19-site/ - webarchive
- https://www.bleepingcomputer.com/news/security/ecuadors-state-run-cnt-telco-hit-by-ransomexx-ransomware/ - webarchive
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/4 - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://www.trendmicro.com/en_us/research/21/a/expanding-range-and-improving-speed-a-ransomexx-approach.html - webarchive
- https://www.youtube.com/watch?v=qxPXxWMI2i4 - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.ic3.gov/Media/News/2021/211101.pdf - webarchive
- https://blog.talosintelligence.com/2020/12/quarterly-ir-report-fall-2020-q4.html - webarchive
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/ - webarchive
- https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf - webarchive
- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3 - webarchive
- https://www.sentinelone.com/anthology/ransomexx/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-ransomexx - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://securelist.com/ransomexx-trojan-attacks-linux-systems/99279/ - webarchive
- https://www.bleepingcomputer.com/news/security/brazils-court-system-under-massive-ransomexx-ransomware-attack/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ransomlock
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ransomlock.
| Known Synonyms |
|---|
WinLock |
Internal MISP references
UUID 3e47c926-eea3-4fba-915a-1f3c5b92a94c which can be used as unique global reference for Ransomlock in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SNC
Ransomware SNC is a ransomware who encrypts files and asks for a variable amount of Bitcoin before releasing the decryption key to your files. The threat actor asks to be contacted for negotiating the right ransom fee.
Internal MISP references
UUID 0e9c2936-7167-48fb-9dee-a83f83d8e41e which can be used as unique global reference for SNC in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rapid Ransom
InfinityGroup notes that Rapid Ransomware, unlike regular Ransomware, stays active on the computer after initially encrypting the systems and also encrypts any new files that are created. It does this by creating auto-runs that are designed to launch the ransomware and display the ransom note every time the infected system is started.
Internal MISP references
UUID 06929ad3-2a00-4212-b171-9ecb5f956af5 which can be used as unique global reference for Rapid Ransom in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rapid_ransom - webarchive
- https://twitter.com/malwrhunterteam/status/977275481765613569 - webarchive
- https://twitter.com/malwrhunterteam/status/997748495888076800 - webarchive
- https://exchange.xforce.ibmcloud.com/collection/GuessWho-Ransomware-A-Variant-of-Rapid-Ransomware-ef226b9792fa4c1e34fa4c587db04145 - webarchive
- https://www.fsec.or.kr/common/proc/fsec/bbs/163/fileDownLoad/2297.do - webarchive
- https://www.youtube.com/watch?v=LUxOcpIRxmg - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RapidStealer
A spy trojan is a type of malware that has the capability to gather information from the infected system without consent from the user. This information is then sent to a remote attacker.
Internal MISP references
UUID bc1fc21d-80c0-4629-bb18-d5ae1df2a431 which can be used as unique global reference for RapidStealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rarog
Internal MISP references
UUID 184e5134-473c-4a01-9a8b-f4776f178fc9 which can be used as unique global reference for Rarog in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
rarstar
This ransomware encrypts all user’s data on the PC (photos, documents, excel tables, music, videos, etc), adds its specific extension to every file, and creates the HOW_TO_DECYPHER_FILES.txt files in every folder which contains encrypted files.
Internal MISP references
UUID e0a1407f-2595-4bd2-ba16-2c6d9be4e066 which can be used as unique global reference for rarstar in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Raspberry Robin
Worm spread by external drives that leverages Windows Installer to reach out to QNAP-associated domains and download a malicious DLL.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Raspberry Robin.
| Known Synonyms |
|---|
LINK_MSIEXEC |
QNAP-Worm |
RaspberryRobin |
Internal MISP references
UUID 34b3a45b-e522-4342-91c8-b6aad9817f99 which can be used as unique global reference for Raspberry Robin in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.raspberry_robin - webarchive
- https://thehackernews.com/2022/07/microsoft-links-raspberry-robin-usb.html?_m=3n%2e009a%2e2800%2ejp0ao0cjb8%2e1shm - webarchive
- https://www.huntress.com/blog/evolution-of-usb-borne-malware-raspberry-robin - webarchive
- https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive
- https://research.checkpoint.com/2023/raspberry-robin-anti-evasion-how-to-exploit-analysis/ - webarchive
- https://www.bleepingcomputer.com/news/security/microsoft-links-raspberry-robin-worm-to-clop-ransomware-attacks/ - webarchive
- https://www.securityjoes.com/post/raspberry-robin-detected-itw-targeting-insurance-financial-institutes-in-europe - webarchive
- https://blogs.cisco.com/security/raspberry-robin-highly-evasive-worm-spreads-over-external-disks - webarchive
- https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/ - webarchive
- https://research.checkpoint.com/2023/raspberry-robin-anti-evasion-how-to-exploit-analysis - webarchive
- http://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive
- https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/ - webarchive
- https://redcanary.com/blog/raspberry-robin/ - webarchive
- https://www.trendmicro.com/fr_fr/research/22/l/raspberry-robin-malware-targets-telecom-governments.html - webarchive
- https://securityintelligence.com/posts/raspberry-robin-worm-dridex-malware/ - webarchive
- https://unit42.paloaltonetworks.com/unsigned-dlls/ - webarchive
- https://www.cybereason.com/blog/threat-alert-raspberry-robin-worm-abuses-windows-installer-and-qnap-devices - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ratankba
This is a backdoor that establishes persistence using the Startup folder. It communicates to its C&C server using HTTPS and a static HTTP User-Agent string. QUICKRIDE is capable of gathering information about the system, downloading and loading executables, and uninstalling itself. It was leveraged against banks in Poland.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ratankba.
| Known Synonyms |
|---|
QUICKRIDE |
Internal MISP references
UUID eead20f5-6a30-4700-8d14-cfb2d42eaff0 which can be used as unique global reference for Ratankba in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ratankba - webarchive
- https://www.bleepingcomputer.com/news/security/polish-banks-infected-with-malware-hosted-on-their-own-governments-site/ - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug.pdf - webarchive
- https://www.symantec.com/connect/blogs/attackers-target-dozens-global-banks-new-malware-0 - webarchive
- http://baesystemsai.blogspot.de/2016/05/cyber-heist-attribution.html - webarchive
- https://www.secureworks.com/research/threat-profiles/nickel-gladstone - webarchive
- https://community.broadcom.com/symantecenterprise/viewdocument/attackers-target-dozens-of-global-b - webarchive
- https://baesystemsai.blogspot.com/2017/02/lazarus-watering-hole-attacks.html - webarchive
- https://raw.githubusercontent.com/eric-erki/APT_CyberCriminal_Campagin_Collections/master/2017/2017.05.30.Lazarus_Arisen/Group-IB_Lazarus.pdf - webarchive
- https://content.fireeye.com/apt/rpt-apt38 - webarchive
- https://www.symantec.com/connect/blogs/attackers-target-dozens-global-banks-new-malware - webarchive
- https://twitter.com/PhysicalDrive0/status/828915536268492800 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RatankbaPOS
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RatankbaPOS.
| Known Synonyms |
|---|
RATANKBAPOS |
Internal MISP references
UUID 15b85bac-c58b-41fd-8332-cfac7c445e0d which can be used as unique global reference for RatankbaPOS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RATel
Internal MISP references
UUID 56ac6980-4db4-4bac-8f8a-cebf5ead6308 which can be used as unique global reference for RATel in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ratel - webarchive
- https://businessinsights.bitdefender.com/tech-advisory-manageengine-cve-2022-47966 - webarchive
- https://securelist.com/tomiris-called-they-want-their-turla-malware-back/109552/ - webarchive
- https://github.com/FrenchCisco/RATel - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RatSnif
Internal MISP references
UUID 2f700b52-4379-4b53-894b-1823e34ae71d which can be used as unique global reference for RatSnif in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RawPOS
Internal MISP references
UUID 80f87001-ff40-4e33-bd12-12ed1a92d1d7 which can be used as unique global reference for RawPOS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rawpos - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/rawpos-new-behavior-risks-identity-theft/?platform=hootsuite - webarchive
- https://www.youtube.com/watch?v=fevGZs0EQu8 - webarchive
- https://threatvector.cylance.com/en_us/home/rawpos-malware.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Razy
Razy is a malware family which uses a malicious browser extension in order to steal cryptocurrency.
Internal MISP references
UUID 6293085e-55c7-4026-8c98-1fa489692d4e which can be used as unique global reference for Razy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RC2FM
A family identified by ESET Research in the InvisiMole campaign.
Internal MISP references
UUID 165f385f-8507-4cd3-9afd-911a016b2d29 which can be used as unique global reference for RC2FM in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RCS
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RCS.
| Known Synonyms |
|---|
Crisis |
Remote Control System |
Internal MISP references
UUID c359c74e-4155-4e66-a344-b56947f75119 which can be used as unique global reference for RCS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rcs - webarchive
- https://www.virusbulletin.com/virusbulletin/2019/01/vb2018-paper-hacking-team-hacked-team/ - webarchive
- https://www.symantec.com/connect/blogs/crisis-windows-sneaks-virtual-machines - webarchive
- https://www.f-secure.com/documents/996508/1030745/callisto-group - webarchive
- https://www.welivesecurity.com/2018/03/09/new-traces-hacking-team-wild/ - webarchive
- https://www.f-secure.com/content/dam/f-secure/en/labs/whitepapers/Callisto_Group.pdf - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07170728/Guerrero-Saade-Raiu-VB2017.pdf - webarchive
- http://contagiodump.blogspot.com/2012/12/aug-2012-w32crisis-and-osxcrisis-jar.html - webarchive
- https://www.intego.com/mac-security-blog/new-apple-mac-trojan-called-osxcrisis-discovered-by-intego-virus-team/? - webarchive
- https://www.vice.com/en_us/article/jgxvdx/jan-marsalek-wirecard-bizarre-attempt-to-buy-hacking-team-spyware - webarchive
- http://blogs.360.cn/post/APT-C-34_Golden_Falcon.html - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/01/vb2019-paper-rich-headers-leveraging-mysterious-artifact-pe-format/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RCtrl
Internal MISP references
UUID 40eff712-4812-4b8a-872d-7c9f4b7a8d72 which can be used as unique global reference for RCtrl in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
rdasrv
Internal MISP references
UUID 1bf3469a-b9c8-497a-bcbb-b1095386706a which can be used as unique global reference for rdasrv in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RDAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RDAT.
| Known Synonyms |
|---|
GREYSTUFF |
Internal MISP references
UUID 69798a1e-1caf-4bc8-b4af-6508d8a26717 which can be used as unique global reference for RDAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rdat - webarchive
- https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020OverWatchNowheretoHide.pdf - webarchive
- https://unit42.paloaltonetworks.com/atoms/evasive-serpens/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ReactorBot
Please note: ReactorBot in its naming is often mistakenly labeled as Rovnix. ReactorBot is a full blown bot with modules, whereas Rovnix is just a bootkit / driver component (originating from Carberp), occasionally delivered alongside ReactorBot.
Internal MISP references
UUID 9d58d94f-6885-4a38-b086-b9978ac62c1f which can be used as unique global reference for ReactorBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.reactorbot - webarchive
- http://www.malwaredigger.com/2015/05/rovnix-dropper-analysis.html - webarchive
- https://www.symantec.com/connect/blogs/new-carberp-variant-heads-down-under - webarchive
- http://www.malwaredigger.com/2015/06/rovnix-payload-and-plugin-analysis.html - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/rovnix-infects-systems-with-password-protected-macros/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Reaver
Reaver is a type of malware discovered by researchers at Palo Alto Networks in November 2017, but its activity dates back to at least late 2016. Researchers identified only ten unique samples of the malware, indicating limited use, and three different variants, noted as versions 1, 2, and 3. The malware is unique as its final payload masquerades as a control panel link (CPL) file. The intended targets of this activity are unknown as of this writing; however, it was used concurrently with the SunOrcal malware and the same C2 infrastructure used by threat actors who primarily target based on the "Five Poisons" - five perceived threats deemed dangerous to, and working against the interests of, the Chinese government.
Internal MISP references
UUID 826c31ca-2617-47e4-b236-205da3881182 which can be used as unique global reference for Reaver in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.reaver - webarchive
- https://threatvector.cylance.com/en_us/home/reaver-mapping-connections-between-disparate-chinese-apt-groups.html - webarchive
- https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RecordBreaker
This malware is a successor to Raccoon Stealer (also referred to as Raccoon Stealer 2.0), which is however a full rewrite in C/C++.
Internal MISP references
UUID 812fbee2-6f12-4dca-a205-d317fb9065bb which can be used as unique global reference for RecordBreaker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.recordbreaker - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://malwarebookreports.com/the-trash-panda-reemerges-from-the-dumpster-raccoon-stealer-v2/ - webarchive
- https://www.zscaler.com/blogs/security-research/raccoon-stealer-v2-latest-generation-raccoon-family - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
- https://infosecwriteups.com/raccoon-stealer-v2-malware-analysis-55cc33774ac8 - webarchive
- https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf - webarchive
- https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-recordbreaker-f6400c11d58b - webarchive
- https://cloudsek.com/recordbreaker-the-resurgence-of-raccoon - webarchive
- https://any.run/cybersecurity-blog/raccoon-stealer-v2-malware-analysis/ - webarchive
- https://blog.cyble.com/2022/11/08/massive-youtube-campaign-targeting-over-100-applications-to-deliver-info-stealer/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://socprime.com/blog/raccoon-stealer-detection-a-novel-malware-version-2-0-named-recordbreaker-offers-hackers-advanced-password-stealing-capabilities/ - webarchive
- https://d01a.github.io/raccoon-stealer/ - webarchive
- https://www.socinvestigation.com/raccoon-infostealer-malware-returns-with-new-ttps-detection-response/ - webarchive
- https://www.youtube.com/watch?v=NI_Yw2t9zoo - webarchive
- https://asec.ahnlab.com/en/52072/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RedAlpha
Internal MISP references
UUID 6be9eee4-ee99-4ad6-bee3-2365d7b37a88 which can be used as unique global reference for RedAlpha in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RedCap
According to Trend Micro, this backdoor receives valid domain credentials as an argument and uses it to log on to the Exchange Server and use it for data exfiltration purposes. The main function of this stage is to take the stolen password from the argument and send it to the attackers as an attachment in an email. We also observed that the threat actors relay these emails via government Exchange Servers using vaild accounts with stolen passwords.
Internal MISP references
UUID c1ba2ad1-70d9-4833-ac15-18fb8d0a2408 which can be used as unique global reference for RedCap in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RedCurl
Internal MISP references
UUID 913d3007-9c2b-4c1c-b3a6-2ecb736bc338 which can be used as unique global reference for RedCurl in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RedEnergy Stealer
According to Zscaler ThreatLabz, RedEnergy stealer uses a fake update campaign to target multiple industry verticals and possesses the ability to steal information from various browsers, enabling the exfiltration of sensitive data, while also incorporating different modules for carrying out ransomware activities.The name of the malware was kept due to the common method names observed during the analysis.
Internal MISP references
UUID b5cbe5c8-8cda-43af-bd67-99dcbd9e0dbf which can be used as unique global reference for RedEnergy Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RedLeaves
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RedLeaves.
| Known Synonyms |
|---|
BUGJUICE |
Internal MISP references
UUID a70e93a7-3578-47e1-9926-0818979ed866 which can be used as unique global reference for RedLeaves in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.redleaves - webarchive
- https://blogs.jpcert.or.jp/en/2017/04/redleaves---malware-based-on-open-source-rat.html - webarchive
- https://www.us-cert.gov/ncas/alerts/TA17-117A - webarchive
- https://www.macnica.net/file/mpressioncss_ta_report_2019.pdf - webarchive
- https://www.macnica.net/file/mpressioncss_2018-1h-report_mnc_rev3_nopw.pdf - webarchive
- https://www.jpcert.or.jp/magazine/acreport-redleaves.html - webarchive
- https://community.rsa.com/community/products/netwitness/blog/2017/05/03/hunting-pack-use-case-redleaves-malware - webarchive
- http://blog.jpcert.or.jp/.s/2017/04/redleaves---malware-based-on-open-source-rat.html - webarchive
- http://blog.macnica.net/blog/2017/12/post-8c22.html - webarchive
- https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf - webarchive
- https://www.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf - webarchive
- https://www.cyber.gov.au/sites/default/files/2019-03/msp_investigation_report.pdf - webarchive
- https://www.carbonblack.com/2017/05/09/carbon-black-threat-research-dissects-red-leaves-malware-leverages-dll-side-loading/ - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-riverside - webarchive
- https://github.com/nccgroup/Cyber-Defence/tree/master/Technical%20Notes/Red%20Leaves - webarchive
- http://go.recordedfuture.com/hubfs/reports/cta-2019-0206.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RedLine Stealer
RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RedLine Stealer.
| Known Synonyms |
|---|
RECORDSTEALER |
Internal MISP references
UUID ff18a858-7778-485c-949b-d28d867d1ffb which can be used as unique global reference for RedLine Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer - webarchive
- https://www.secureworks.com/research/darktortilla-malware-analysis - webarchive
- https://www.proofpoint.com/us/threat-insight/post/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign - webarchive
- https://blogs.juniper.net/en-us/threat-research/new-pastebin-like-service-used-in-multiple-malware-campaigns - webarchive
- https://bartblaze.blogspot.com/2021/06/digital-artists-targeted-in-redline.html - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://www.youtube.com/watch?v=NI_Yw2t9zoo - webarchive
- https://www.microsoft.com/security/blog/2022/05/17/in-hot-pursuit-of-cryware-defending-hot-wallets-from-attacks/ - webarchive
- https://blog.chainalysis.com/reports/2022-crypto-crime-report-preview-malware/ - webarchive
- https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Additional%20Analysis/UnknownTA/2020-09-07/Analysis.md - webarchive
- https://blog.morphisec.com/google-ppc-ads-deliver-redline-taurus-and-mini-redline-infostealers - webarchive
- https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/ - webarchive
- https://www.fortinet.com/blog/threat-research/excel-document-delivers-malware-by-exploiting-cve-2017-11882 - webarchive
- https://dr4k0nia.github.io/posts/Unpacking-RedLine-Stealer/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://asec.ahnlab.com/en/30445/ - webarchive
- https://www.zscaler.com/blogs/security-research/cybergate-rat-and-redline-stealer-delivered-ongoing-autoit-malware-campaigns - webarchive
- https://unit42.paloaltonetworks.com/lapsus-group/ - webarchive
- https://blog.minerva-labs.com/become-a-vip-victim-with-new-discord-distributed-malware - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ - webarchive
- https://securityscorecard.com/research/detailed-analysis-redline-stealer - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ipfs-a-new-data-frontier-or-a-new-cybercriminal-hideout - webarchive
- https://research.openanalysis.net/dotnet/xorstringsnet/agenttesla/2023/04/16/xorstringsnet.html - webarchive
- https://www.bleepingcomputer.com/news/security/fake-windows-11-upgrade-installers-infect-you-with-redline-malware/ - webarchive
- https://medium.com/csis-techblog/gcleaner-garbage-provider-since-2019-2708e7c87a8a - webarchive
- https://blog.netlab.360.com/purecrypter - webarchive
- https://www.bitsight.com/blog/tracking-privateloader-malware-distribution-service - webarchive
- https://blog.minerva-labs.com/underminer-exploit-kit-the-more-you-check-the-more-evasive-you-become - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf - webarchive
- https://www.secureworks.com/research/the-growing-threat-from-infostealers - webarchive
- https://www.esentire.com/blog/redline-stealer-masquerades-as-photo-editing-software - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://embee-research.ghost.io/redline-stealer-basic-static-analysis-and-c2-extraction/ - webarchive
- https://blog.eclecticiq.com/redline-stealer-variants-demonstrate-a-low-barrier-to-entry-threat - webarchive
- https://blog.morphisec.com/syk-crypter-discord - webarchive
- https://securityaffairs.co/wordpress/129391/hacking/lapsus-gang-compromised-microsoft-employees-account.html - webarchive
- https://securityintelligence.com/posts/roboski-global-recovery-automation/ - webarchive
- https://www.atomicmatryoshka.com/post/cracking-open-the-malware-pi%C3%B1ata-series-intro-to-dynamic-analysis-with-redlinestealer - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/trellix-global-defenders-invaders-of-the-information-snatchers.html - webarchive
- https://blog.minerva-labs.com/redline-stealer-masquerades-as-telegram-installer - webarchive
- https://securelist.com/malvertising-through-search-engines/108996/ - webarchive
- https://www.trendmicro.com/en_us/research/21/i/fake-installers-drop-malware-and-open-doors-for-opportunistic-attackers.html - webarchive
- https://www.bleepingcomputer.com/news/security/redline-info-stealing-malware-spread-by-folding-home-phishing/ - webarchive
- https://www.qualys.com/docs/whitepapers/qualys-wp-fake-cracked-software-caught-peddling-redline-stealers-v220606.pdf - webarchive
- https://therecord.media/scattered-spider-ransomware-attacks-hospitality-retail - webarchive
- https://www.proofpoint.com/us/threat-insight/post/ta505-and-others-launch-new-coronavirus-campaigns-now-largest-collection-attack - webarchive
- https://unit42.paloaltonetworks.com/bluesky-ransomware/ - webarchive
- https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem - webarchive
- https://medium.com/@the_abjuri5t/advice-for-catching-a-redline-stealer-dca126867193 - webarchive
- https://medium.com/@idan_malihi/redline-stealer-malware-analysis-76506ef723ab - webarchive
- https://embee-research.ghost.io/practical-queries-for-malware-infrastructure-part-3/ - webarchive
- https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 - webarchive
- https://securityscorecard.pathfactory.com/all/a-detailed-analysis - webarchive
- https://thehackernews.com/2022/03/microsoft-and-okta-confirm-breach-by.html - webarchive
- https://team-cymru.com/blog/2022/05/25/bablosoft-lowering-the-barrier-of-entry-for-malicious-actors/ - webarchive
- https://blog.rootshell.be/2022/01/20/sans-isc-redline-stealer-delivered-through-ftp/ - webarchive
- https://n1ght-w0lf.github.io/tutorials/yara-for-config-extraction/ - webarchive
- https://ke-la.com/information-stealers-a-new-landscape/ - webarchive
- https://securelist.com/self-spreading-stealer-attacks-gamers-via-youtube/107407/ - webarchive
- https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html - webarchive
- https://blog.talosintelligence.com/2022/04/haskers-gang-zingostealer.html - webarchive
- https://isc.sans.edu/forums/diary/RedLine+Stealer+Delivered+Through+FTP/28258/ - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/415/Bitdefender-PR-Whitepaper-RedLine-creat6109-en-EN.pdf - webarchive
- https://medium.com/@lcam/updates-from-the-maas-new-threats-delivered-through-nullmixer-d45defc260d1 - webarchive
- https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ - webarchive
- https://asec.ahnlab.com/ko/25837/ - webarchive
- https://embee-research.ghost.io/yara-rule-development-il-instructions-in-redline-malware/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
- https://research.loginsoft.com/threat-research/from-innocence-to-malice-the-onenote-malware-campaign-uncovered/ - webarchive
- https://asec.ahnlab.com/en/35981/ - webarchive
- https://web.archive.org/web/20230606224056/https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 - webarchive
- https://www.youtube.com/watch?v=05-1Olqf6qw - webarchive
- https://medium.com/s2wblog/deep-analysis-of-redline-stealer-leaked-credential-with-wcf-7b31901da904 - webarchive
- https://insight-jp.nttsecurity.com/post/102i7af/steelclovergoogle - webarchive
- https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/ - webarchive
- https://www.trendmicro.com/en_us/research/21/k/campaign-abusing-rats-uses-fake-websites.html - webarchive
- https://cyber-anubis.github.io/malware%20analysis/redline/ - webarchive
- https://www.team-cymru.com/post/seychelles-seychelles-on-the-c-2-shore - webarchive
- https://blog.talosintelligence.com/2021/12/magnat-campaigns-use-malvertising-to.html - webarchive
- https://www.netskope.com/blog/redline-stealer-campaign-using-binance-mystery-box-videos-to-spread-github-hosted-payload - webarchive
- https://threatresearch.ext.hp.com/redline-stealer-disguised-as-a-windows-11-upgrade/ - webarchive
- https://blogs.blackberry.com/en/2021/07/threat-thursday-redline-infostealer - webarchive
- https://embee-research.ghost.io/identifying-risepro-panels-using-censys/ - webarchive
- https://russianpanda.com/2023/11/20/MetaStealer-Redline's-Doppelganger/ - webarchive
- https://www.ciphertechsolutions.com/roboski-global-recovery-automation/ - webarchive
- https://www.bitdefender.com/blog/labs/redline-stealer-resurfaces-in-fresh-rig-exploit-kit-campaign/ - webarchive
- https://www.fortinet.com/blog/threat-research/excel-document-delivers-multiple-malware-exploiting-cve-2017-11882-part-two - webarchive
- https://www.bleepingcomputer.com/news/security/massive-campaign-uses-youtube-to-push-password-stealing-malware/ - webarchive
- https://muha2xmad.github.io/malware-analysis/fullredline/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution - webarchive
- https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf - webarchive
- https://www.zscaler.com/blogs/security-research/making-victims-pay-infostealer-malwares-mimick-pirated-software-download - webarchive
- https://krebsonsecurity.com/2022/03/a-closer-look-at-the-lapsus-data-extortion-group/ - webarchive
- https://www.bleepingcomputer.com/news/microsoft/microsoft-confirms-they-were-hacked-by-lapsus-extortion-group/ - webarchive
- https://www.fortinet.com/blog/threat-research/omicron-variant-lure-used-to-distribute-redline-stealer - webarchive
- https://blog.avast.com/adobe-acrobat-sign-malware - webarchive
- https://www.bleepingcomputer.com/news/security/fake-valorant-cheats-on-youtube-infect-you-with-redline-stealer/ - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://go.recordedfuture.com/hubfs/reports/mtp-2021-1014.pdf - webarchive
- https://embee-research.ghost.io/combining-pivot-points-to-identify-malware-infrastructure-redline-smokeloader-and-cobalt-strike/ - webarchive
- https://intel471.com/blog/privateloader-malware - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Redosdru
Internal MISP references
UUID eb7a5417-ebbe-42c9-834b-2412a7e338f1 which can be used as unique global reference for Redosdru in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
REDPEPPER
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular REDPEPPER.
| Known Synonyms |
|---|
Adupib |
Internal MISP references
UUID 42fc1cf4-23ee-47a6-bdd3-7dc824948ba7 which can be used as unique global reference for REDPEPPER in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RedRum
Ransomware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RedRum.
| Known Synonyms |
|---|
Grinch |
Thanos |
Tycoon |
Internal MISP references
UUID cbb4cfd8-3642-4b04-a199-8e9b4b80fb62 which can be used as unique global reference for RedRum in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
REDSALT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular REDSALT.
| Known Synonyms |
|---|
Dipsind |
Internal MISP references
UUID da2210c7-c953-4367-9f4b-778e77af7ce7 which can be used as unique global reference for REDSALT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.redsalt - webarchive
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/twoforonefinal.pdf - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s01-hunting-for-platinum.pdf - webarchive
- https://twitter.com/ItsReallyNick/status/1136502701301346305 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
REDSHAWL
REDSHAWL is a session hijacking utility that starts a new process as another user currently logged on to the same system via command-line.
Internal MISP references
UUID 799cce43-6ba0-4e21-9a63-f8b7f9bb7cc4 which can be used as unique global reference for REDSHAWL in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.redshawl - webarchive
- https://securelist.com/lazarus-under-the-hood/77908/ - webarchive
- https://content.fireeye.com/apt/rpt-apt38 - webarchive
- https://www.virusbulletin.com/uploads/pdf/magazine/2018/VB2018-Kalnai-Poslusny.pdf - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180244/Lazarus_Under_The_Hood_PDF_final.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Redyms
Internal MISP references
UUID 36893c2a-28ad-4dd3-a66b-906f1dd15b92 which can be used as unique global reference for Redyms in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Red Alert
Internal MISP references
UUID cd5f5165-7bd3-4430-b0bc-2c8fa518f618 which can be used as unique global reference for Red Alert in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Red Gambler
Internal MISP references
UUID ca8ed7c0-f40b-4c0e-9dc4-52d6e0da41a7 which can be used as unique global reference for Red Gambler in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
reGeorg
Internal MISP references
UUID 9ee0eb87-7648-4581-b301-7472a48946ad which can be used as unique global reference for reGeorg in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.regeorg - webarchive
- https://sensepost.com/discover/tools/reGeorg/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-009.pdf - webarchive
- https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF - webarchive
- https://www.secureworks.com/blog/ransomware-deployed-by-adversary - webarchive
- https://www.welivesecurity.com/2022/09/06/worok-big-picture/ - webarchive
- https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/ - webarchive
- https://github.com/sensepost/reGeorg - webarchive
- https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/ - webarchive
- https://www.secureworks.com/research/samsam-ransomware-campaigns - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Regin
Regin is a sophisticated malware and hacking toolkit attributed to United States' National Security Agency (NSA) for government spying operations. It was first publicly revealed by Kaspersky Lab, Symantec, and The Intercept in November 2014. Regin malware targeted victims in a range of industries, telecom, government, and financial institutions. It was engineered to be modular and over time dozens of modules have been found and attributed to this family. Symantec observed around 100 infections in 10 different countries across a variety of organisations including private companies, government entities, and research institutes.
Internal MISP references
UUID 4cbe9373-6b5e-42d0-9750-e0b7fc0d58bb which can be used as unique global reference for Regin in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.regin - webarchive
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=ce2df4da-afe9-4a24-b28c-0fb3ba671d95&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments - webarchive
- https://www.kaspersky.com/blog/regin-apt-most-sophisticated/6852/ - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070305/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf - webarchive
- https://securelist.com/big-threats-using-code-similarity-part-1/97239/ - webarchive
- https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/regin-top-tier-espionage-tool-15-en.pdf - webarchive
- https://www.epicturla.com/previous-works/hitb2020-voltron-sta - webarchive
- https://www.youtube.com/watch?v=jeLd-gw2bWo - webarchive
- https://securelist.com/regin-nation-state-ownage-of-gsm-networks/67741/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RegretLocker
According to PCrisk, RegretLocker is malicious software classified as ransomware. Systems infected with this malware have their data encrypted and users receive ransom demands for decryption. During the encryption process, all affected files are appended with the ".mouse" extension.
Internal MISP references
UUID f89df0d5-2d01-49a2-a2d0-71cdc6a9d64e which can be used as unique global reference for RegretLocker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.regretlocker - webarchive
- https://www.bleepingcomputer.com/news/security/new-regretlocker-ransomware-targets-windows-virtual-machines/ - webarchive
- https://twitter.com/malwrhunterteam/status/1321375502179905536 - webarchive
- http://chuongdong.com/reverse%20engineering/2020/11/17/RegretLocker/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RekenSom
Ransomware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RekenSom.
| Known Synonyms |
|---|
GHack Ransomware |
Internal MISP references
UUID b59a97df-04c5-4e54-a7aa-92452baa7240 which can be used as unique global reference for RekenSom in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
win.rekoobe
A Trojan for Winows with the same code structure and functionalities of elf.rekoobe, for Linux environment instead.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular win.rekoobe.
| Known Synonyms |
|---|
tinyshell.win |
tshd.win |
Internal MISP references
UUID e928d9ca-237f-48ab-ab4c-65c04baeb863 which can be used as unique global reference for win.rekoobe in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rekt Loader
Internal MISP references
UUID 431808a0-3671-4072-a9af-9947a54b4b9d which can be used as unique global reference for Rekt Loader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rektware
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Rektware.
| Known Synonyms |
|---|
PRZT Ransomware |
Internal MISP references
UUID b40a66c6-c8fa-43c3-8084-87e90f00a8f1 which can be used as unique global reference for Rektware in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RelicRace
Internal MISP references
UUID 9bc81527-97fe-4dd6-87e6-d8ae75e58818 which can be used as unique global reference for RelicRace in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RemCom
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RemCom.
| Known Synonyms |
|---|
RemoteCommandExecution |
Internal MISP references
UUID 135ce3db-a242-4f81-844a-cf03eb72c291 which can be used as unique global reference for RemCom in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Remcos
Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.
Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns. Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user. Remcos is developed by the cybersecurity company BreakingSecurity.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Remcos.
| Known Synonyms |
|---|
RemcosRAT |
Remvio |
Socmer |
Internal MISP references
UUID 2894aee2-e0ec-417a-811e-74a68ab967b2 which can be used as unique global reference for Remcos in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://www.telsy.com/download/4832/ - webarchive
- https://cert.gov.ua/article/3804703 - webarchive
- https://krabsonsecurity.com/2018/03/02/analysing-remcos-rats-executable/ - webarchive
- https://perception-point.io/behind-the-attack-remcos-rat/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/research/cyberattacks-targeting-ukraine-increase.html - webarchive
- https://www.bleepingcomputer.com/news/security/russia-ukraine-war-exploited-as-lure-for-malware-distribution/ - webarchive
- https://www.uptycs.com/blog/remcos-rat-uac-0500-pipe-method - webarchive
- https://www.esentire.com/blog/remcos-rat - webarchive
- https://www.zscaler.com/blogs/security-research/latest-version-amadey-introduces-screen-capturing-and-pushes-remcos-rat - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://news.sophos.com/en-us/2022/07/20/ooda-x-ops-takes-on-burgeoning-sql-server-attacks/ - webarchive
- https://www.splunk.com/en_us/blog/security/fin7-tools-resurface-in-the-field-splinter-or-copycat.html - webarchive
- https://www.malwarebytes.com/blog/threat-intelligence/2022/20221121-threat-intel-report-final.pdf - webarchive
- https://blog.morphisec.com/remcos-trojan-analyzing-attack-chain - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://gi7w0rm.medium.com/cloudeye-from-lnk-to-shellcode-4b5f1d6d877 - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ipfs-a-new-data-frontier-or-a-new-cybercriminal-hideout - webarchive
- https://www.cybereason.com/blog/cybereason-exposes-malware-targeting-us-taxpayers - webarchive
- https://www.ptsecurity.com/ww-en/analytics/antisandbox-techniques/ - webarchive
- https://www.socinvestigation.com/remcos-rat-new-ttps-detection-response/ - webarchive
- https://blog.morphisec.com/hubfs/Journey%20of%20a%20Crypto%20Scammer%20-%20NFT-001%20%7C%20Morphisec%20%7C%20Threat%20Report.pdf - webarchive
- https://socprime.com/blog/remcos-rat-detection-uac-0050-hackers-launch-phishing-attacks-impersonating-the-security-service-of-ukraine/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-american-entities-with-commodity-rats/BlindEagleIOCList.txt - webarchive
- https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/ - webarchive
- https://blog.talosintelligence.com/2020/06/tor2mine-is-up-to-their-old-tricks-and_11.html - webarchive
- https://isc.sans.edu/forums/diary/Remcos+RAT+Delivered+Through+Double+Compressed+Archive/28354/ - webarchive
- https://github.com/1d8/analyses/blob/master/RemcosDocDropper.MD - webarchive
- https://dissectingmalwa.re/malicious-ratatouille.html - webarchive
- https://secrary.com/ReversingMalware/RemcosRAT/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/new-whiteshadow-downloader-uses-microsoft-sql-retrieve-malware - webarchive
- https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities - webarchive
- https://cert.gov.ua/article/3931296 - webarchive
- https://asec.ahnlab.com/en/32376/ - webarchive
- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing - webarchive
- https://www.zscaler.com/blogs/security-research/catching-rats-over-custom-protocols - webarchive
- http://malware-traffic-analysis.net/2017/12/22/index.html - webarchive
- https://threatresearch.ext.hp.com/wp-content/uploads/2021/10/HP-Wolf-Security-Threat-Insights-Report-Q3-2021.pdf - webarchive
- https://www.zscaler.com/blogs/security-research/dbatloader-actively-distributing-malwares-targeting-european-businesses - webarchive
- https://securityintelligence.com/posts/roboski-global-recovery-automation/ - webarchive
- https://www.gdatasoftware.com/blog/global-pandemic-remcos-tesla-netwire - webarchive
- https://blog.morphisec.com/nft-malware-new-evasion-abilities - webarchive
- https://www.connectwise.com/resources/formbook-remcos-rat - webarchive
- https://blog.morphisec.com/tracking-hcrypt-an-active-crypter-as-a-service - webarchive
- https://www.microsoft.com/en-us/security/blog/2023/04/13/threat-actors-strive-to-cause-tax-day-headaches/ - webarchive
- https://blog.talosintelligence.com/2018/08/picking-apart-remcos.html - webarchive
- https://blog.talosintelligence.com/2020/04/azorult-brings-friends-to-party.html - webarchive
- https://medium.com/@amgedwageh/analysis-of-an-autoit-script-that-wraps-a-remcos-rat-6b5b66075b87 - webarchive
- https://embee-research.ghost.io/decoding-a-remcos-loader-script-visual-basic-deobfuscation/ - webarchive
- https://embee-research.ghost.io/practical-queries-for-malware-infrastructure-part-3/ - webarchive
- https://blog.360totalsecurity.com/en/vendetta-new-threat-actor-from-europe/ - webarchive
- https://myonlinesecurity.co.uk/fake-order-spoofed-from-finchers-ltd-sankyo-rubber-delivers-remcos-rat-via-ace-attachments/ - webarchive
- https://cert.gov.ua/article/6276652 - webarchive
- https://research.checkpoint.com/2023/unveiling-the-shadows-the-dark-alliance-between-guloader-and-remcos/ - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/390/Bitdefender-PR-Whitepaper-Remcos-creat5080-en-EN-GenericUse.pdf - webarchive
- https://www.youtube.com/watch?v=DIH4SvKuktM - webarchive
- https://www.anomali.com/blog/threat-actors-use-msbuild-to-deliver-rats-filelessly - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/new-threat-actor-spoofs-philippine-government-covid-19-health-data-widespread - webarchive
- https://labs.bitdefender.com/2020/03/5-times-more-coronavirus-themed-malware-reports-during-march/?utm_campaign=twitter&utm_medium=twitter&utm_source=twitter - webarchive
- https://muha2xmad.github.io/unpacking/remcos/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/coronavirus-threat-landscape-update - webarchive
- https://www.splunk.com/en_us/blog/security/detecting-malware-script-loaders-using-remcos-threat-research-release-december-2021.html - webarchive
- https://threatresearch.ext.hp.com/javascript-malware-dispensing-rats-into-the-wild/ - webarchive
- https://www.vmray.com/cyber-security-blog/smart-memory-dumping/ - webarchive
- https://www.bitdefender.com/blog/hotforsecurity/bitdefender-labs-sees-increased-malicious-and-scam-activity-exploiting-the-war-in-ukraine - webarchive
- https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ - webarchive
- https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/ - webarchive
- https://threatresearch.ext.hp.com/malware-campaigns-targeting-african-banking-sector/ - webarchive
- https://asec.ahnlab.com/ko/25837/ - webarchive
- https://blog.checkpoint.com/2019/06/19/sandblast-agent-phishing-germany-campaign-security-hack-ransomware/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/elfin-apt33-espionage - webarchive
- https://www.welivesecurity.com/2021/10/06/moon-hack-fake-safemoon-cryptocurrency-app-drops-malware-spy/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2021/07/remcos-rat-delivered-via-visual-basic/ - webarchive
- https://www.riskiq.com/blog/labs/spear-phishing-turkish-defense-contractors/ - webarchive
- https://asec.ahnlab.com/ko/32101/ - webarchive
- https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/commodity-net-packers-use-embedded-images-hide-payloads - webarchive
- https://www.trendmicro.com/en_us/research/21/k/campaign-abusing-rats-uses-fake-websites.html - webarchive
- https://research.checkpoint.com/2023/following-the-scent-of-trickgate-6-year-old-packer-used-to-deploy-the-most-wanted-malware/ - webarchive
- https://www.jaiminton.com/reverse-engineering/remcos# - webarchive
- https://socprime.com/blog/new-phishing-attack-detection-attributed-to-the-uac-0050-and-uac-0096-groups-spreading-remcos-spyware/ - webarchive
- https://www.ciphertechsolutions.com/roboski-global-recovery-automation/ - webarchive
- https://www.fortinet.com/blog/threat-research/new-variant-of-remcos-rat-observed-in-the-wild.html - webarchive
- https://www.trendmicro.com/en_ca/research/19/h/analysis-new-remcos-rat-arrives-via-phishing-email.html - webarchive
- https://www.trendmicro.com/en_us/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-ameri.html - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://blog.fortinet.com/2017/02/14/remcos-a-new-rat-in-the-wild-2 - webarchive
- https://news.sophos.com/en-us/2020/05/14/raticate/ - webarchive
- https://github.com/itaymigdal/malware-analysis-writeups/blob/main/Remcos/Remcos.md - webarchive
- https://muha2xmad.github.io/mal-document/remcosdoc/ - webarchive
- https://intel471.com/blog/privateloader-malware - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-old-dogs-new-tricks.pdf - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cyber-attackers-leverage-russia-ukraine-conflict-in-multiple-spam-campaigns - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Remexi
Remexi is a highly advanced and stealthy malware discovered in recent times. It employs sophisticated evasion techniques to infiltrate target systems and networks undetected. This malware utilizes various propagation vectors, including exploit kits, social engineering tactics, and compromised websites. Once inside a system, Remexi establishes persistence through rootkit capabilities and leverages coAmmand-and-control infrastructure to receive and execute malicious commands. It possesses keylogging and data exfiltration capabilities, enabling it to steal sensitive information such as login credentials and financial data. Additionally, Remexi can download and execute additional payloads, making it adaptable and capable of evolving its malicious activities over time.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Remexi.
| Known Synonyms |
|---|
CACHEMONEY |
Internal MISP references
UUID d39486af-c056-4bbf-aa1d-86fb5ef90ada which can be used as unique global reference for Remexi in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.remexi - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions - webarchive
- https://twitter.com/QW5kcmV3/status/1095833216605401088 - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-hickman - webarchive
- https://web.archive.org/web/20191221064439/https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets - webarchive
- https://securelist.com/chafer-used-remexi-malware/89538/ - webarchive
- http://www.symantec.com/content/en/us/enterprise/media/security_response/docs/CadelSpy-Remexi-IOC.pdf - webarchive
- https://bitdefender.com/files/News/CaseStudies/study/332/Bitdefender-Whitepaper-Chafer-creat4491-en-EN-interactive.pdf - webarchive
- https://www.symantec.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RemoteAdmin
Internal MISP references
UUID 6730a859-f2b9-48f9-8d2b-22944a79c072 which can be used as unique global reference for RemoteAdmin in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RemoteControl
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RemoteControl.
| Known Synonyms |
|---|
remotecontrolclient |
Internal MISP references
UUID 44aae79d-c2f5-47f6-99c1-540c0c5420db which can be used as unique global reference for RemoteControl in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Remsec
Internal MISP references
UUID 6a3c3fbc-97ec-4938-b64e-2679e4b73db9 which can be used as unique global reference for Remsec in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.remsec_strider - webarchive
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=ce2df4da-afe9-4a24-b28c-0fb3ba671d95&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments - webarchive
- https://artemonsecurity.blogspot.com/2016/10/remsec-driver-analysis.html - webarchive
- https://artemonsecurity.blogspot.com/2016/10/remsec-driver-analysis-part-2.html - webarchive
- http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Symantec_Remsec_IOCs.pdf - webarchive
- https://artemonsecurity.blogspot.com/2016/10/remsec-driver-analysis-part-3.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Remy
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Remy.
| Known Synonyms |
|---|
WINDSHIELD |
Internal MISP references
UUID b2b93651-cf64-47f5-a54f-799b919c592c which can be used as unique global reference for Remy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rerdom
Internal MISP references
UUID a1f137d4-298f-4761-935d-bd39ab898479 which can be used as unique global reference for Rerdom in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Retadup
Internal MISP references
UUID 42fa55e3-e708-4c11-b807-f31573639941 which can be used as unique global reference for Retadup in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.retadup - webarchive
- https://decoded.avast.io/janvojtesek/putting-an-end-to-retadup-a-malicious-worm-that-infected-hundreds-of-thousands/ - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Retefe (Windows)
Retefe is a Windows Banking Trojan that can also download and install additional malware onto the system using Windows PowerShell. It's primary functionality is to assist the attacker with stealing credentials for online banking websites. It is typically targeted against Swiss banks. The malware binary itself is primarily a dropper component for a Javascript file which builds a VBA file which in turn loads multiple tools onto the host including: 7zip and TOR. The VBA installs a new root certificate and then forwards all traffic via TOR to the attacker controlled host in order to effectively MITM TLS traffic.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Retefe (Windows).
| Known Synonyms |
|---|
Tsukuba |
Werdlod |
Internal MISP references
UUID 96bf1b6d-28e1-4dd9-aabe-23050138bc39 which can be used as unique global reference for Retefe (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.retefe - webarchive
- https://github.com/Tomasuh/retefe-unpacker - webarchive
- https://vulnerability.ch/2019/05/analysing-retefe-with-sysmon-and-splunk/ - webarchive
- https://www.govcert.admin.ch/blog/35/reversing-retefe - webarchive
- https://www.proofpoint.com/us/threat-insight/post/2019-return-retefe - webarchive
- https://github.com/cocaman/retefe - webarchive
- https://threatpost.com/eternalblue-exploit-used-in-retefe-banking-trojan-campaign/128103/ - webarchive
- https://researchcenter.paloaltonetworks.com/2015/08/retefe-banking-trojan-targets-sweden-switzerland-and-japan/ - webarchive
- https://www.govcert.admin.ch/blog/33/the-retefe-saga - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Retro
Internal MISP references
UUID a4dc538e-09b7-4dba-99b0-e8b8b70dd42a which can be used as unique global reference for Retro in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.retro - webarchive
- https://blog.360totalsecurity.com/en/analysis-cve-2018-8174-vbscript-0day-apt-actor-related-office-targeted-attack/ - webarchive
- https://blog.bushidotoken.net/2020/06/deep-dive-darkhotel-apt.html - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf - webarchive
- https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Revenant
According to its author, Revenant is a 3rd party agent for Havoc written in C, and based on Talon. This implant is meant to expand on the Talon implant by implementing covert methods of execution, robust capabilities, and more customization.
Internal MISP references
UUID c95db5a7-8405-4931-868f-1a33ea7e8f6b which can be used as unique global reference for Revenant in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Revenge RAT
According to Cofense, Revenge RAT is a simple and freely available Remote Access Trojan that automatically gathers system information before allowing threat actors to remotely access system components such as webcams, microphones, and various other utilities.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Revenge RAT.
| Known Synonyms |
|---|
Revetrat |
Internal MISP references
UUID 75b1e86f-fcc1-49a7-9b4e-7cd93e91b23f which can be used as unique global reference for Revenge RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.revenge_rat - webarchive
- https://embee-research.ghost.io/introduction-to-dotnet-configuration-extraction-revengerat/ - webarchive
- https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/ - webarchive
- https://blogs.360.cn/post/APT-C-44.html - webarchive
- https://yoroi.company/research/the-evolution-of-aggah-from-roma225-to-the-rg-campaign/ - webarchive
- https://blog.talosintelligence.com/2021/04/a-year-of-fajan-evolution-and-bloomberg.html - webarchive
- https://blog.morphisec.com/ahk-rat-loader-leveraged-in-unique-delivery-campaigns - webarchive
- https://threatrecon.nshc.net/2019/09/19/sectorh01-continues-abusing-web-services/ - webarchive
- https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader - webarchive
- https://www.uptycs.com/blog/revenge-rat-targeting-users-in-south-america - webarchive
- https://www.binarydefense.com/revenge-is-a-dish-best-served-obfuscated - webarchive
- https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/ - webarchive
- https://blog.talosintelligence.com/2019/08/rat-ratatouille-revrat-orcus.html - webarchive
- https://blog.yoroi.company/research/aggah-how-to-run-a-botnet-without-renting-a-server-for-more-than-a-year/ - webarchive
- https://perception-point.io/revenge-rat-back-from-microsoft-excel-macros/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/reservations-requested-ta558-targets-hospitality-and-travel - webarchive
- https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries - webarchive
- https://blog.reversinglabs.com/blog/dotnet-loaders - webarchive
- https://blog.reversinglabs.com/blog/rats-in-the-library - webarchive
- https://github.com/itaymigdal/malware-analysis-writeups/blob/main/RevengeRAT/RevengeRAT.md - webarchive
- https://mp.weixin.qq.com/s/gWOIRNPLVqX761LW8x-S5g - webarchive
- https://securelist.com/revengehotels/95229/ - webarchive
- https://isc.sans.edu/diary/rss/22590 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ReverseRAT
Internal MISP references
UUID c3b6a9f9-afef-4249-ab59-afc5b2efc0b3 which can be used as unique global reference for ReverseRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.reverse_rat - webarchive
- https://blog.lumen.com/suspected-pakistani-actor-compromises-indian-power-company-with-new-reverserat/ - webarchive
- https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/591/original/062521_SideCopy_%281%29.pdf?1625657388 - webarchive
- https://www.seqrite.com/documents/en/white-papers/Whitepaper-OperationSideCopy.pdf - webarchive
- https://blog.lumen.com/reverserat-reemerges-with-a-nightfury-new-campaign-and-new-developments-same-familiar-side-actor/ - webarchive
- https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf - webarchive
- https://threatmon.io/apt-sidecopy-targeting-indian-government-entities/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Reveton
Ransomware.
Internal MISP references
UUID 48c10822-9af8-4324-9516-b33ecf975590 which can be used as unique global reference for Reveton in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
REvil (Windows)
REvil Beta MD5: bed6fc04aeb785815744706239a1f243 SHA1: 3d0649b5f76dbbff9f86b926afbd18ae028946bf SHA256: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45 * Privilege escalation via CVE-2018-8453 (64-bit only) * Rerun with RunAs to elevate privileges * Implements a requirement that if "exp" is set, privilege escalation must be successful for full execution to occur * Implements target whitelisting using GetKetboardLayoutList * Contains debug console logging functionality * Defines the REvil registry root key as SOFTWARE!test * Includes two variable placeholders in the ransom note: UID & KEY * Terminates processes specified in the "prc" configuration key prior to encryption * Deletes shadow copies and disables recovery * Wipes contents of folders specified in the "wfld" configuration key prior to encryption * Encrypts all non-whitelisted files on fixed drives * Encrypts all non-whitelisted files on network mapped drives if it is running with System-level privileges or can impersonate the security context of explorer.exe * Partially implements a background image setting to display a basic "Image text" message * Sends encrypted system data to a C2 domain via an HTTPS POST request (URI path building is not implemented.)
REvil 1.00 MD5: 65aa793c000762174b2f86077bdafaea SHA1: 95a21e764ad0c98ea3d034d293aee5511e7c8457 SHA256: f0c60f62ef9ffc044d0b4aeb8cc26b971236f24a2611cb1be09ff4845c3841bc * Adds 32-bit implementation of CVE-2018-8453 exploit * Removes console debug logging * Changes the REvil registry root key to SOFTWARE\recfg * Removes the System/Impersonation success requirement for encrypting network mapped drives * Adds a "wipe" key to the configuration for optional folder wiping * Fully implements the background image setting and leverages values defined in the "img" configuration key * Adds an EXT variable placeholder to the ransom note to support UID, KEY, and EXT * Implements URI path building so encrypted system data is sent to a C2 pseudo-random URL * Fixes the function that returns the victim's username so the correct value is placed in the stats JSON data
REvil 1.01 MD5: 2abff29b4d87f30f011874b6e98959e9 SHA1: 9d1b61b1cba411ee6d4664ba2561fa59cdb0732c SHA256: a88e2857a2f3922b44247316642f08ba8665185297e3cd958bbd22a83f380feb * Removes the exp/privilege escalation requirement for full execution and encrypts data regardless of privilege level * Makes encryption of network mapped drives optional by adding the "-nolan" argument
REvil 1.02 MD5: 4af953b20f3a1f165e7cf31d6156c035 SHA1: b859de5ffcb90e4ca8e304d81a4f81e8785bb299 SHA256: 89d80016ff4c6600e8dd8cfad1fa6912af4d21c5457b4e9866d1796939b48dc4 * Enhances whitelisting validation by adding inspection of GetUserDefaultUILanguage and GetSystemDefaultUILanguage * Partially implements "lock file" logic by generating a lock filename based on the first four bytes of the Base64-decoded pk key, appending a .lock file extension, and adding the filename to the list of whitelisted files in the REvil configuration (It does not appear that this value is referenced after it is created and stored in memory. There is no evidence that a lock file is dropped to disk.) * Enhances folder whitelisting logic that take special considerations if the folder is associated with "program files" directories * Hard-codes whitelisting of all direct content within the Program Files or Program Files x86 directories * Hard-codes whitelisting of "sql" subfolders within program files * Encrypts program files sub-folders that does not contain "sql" in the path * Compares other folders to the list of whitelisted folders specified in the REvil configuration to determine if they are whitelisted * Encodes stored strings used for URI building within the binary and decodes them in memory right before use * Introduces a REvil registry root key "sub_key" registry value containing the attacker's public key
REvil 1.03 MD5: 3cae02306a95564b1fff4ea45a7dfc00 SHA1: 0ce2cae5287a64138d273007b34933362901783d SHA256: 78fa32f179224c46ae81252c841e75ee4e80b57e6b026d0a05bb07d34ec37bbf * Removes lock file logic that was partially implemented in 1.02 * Leverages WMI to continuously monitor for and kill newly launched processes whose names are listed in the prc configuration key (Previous versions performed this action once.) * Encodes stored shellcode * Adds the -path argument: * Does not wipe folders (even if wipe == true) * Does not set desktop background * Does not contact the C2 server (even if net == true) * Encrypts files in the specified folder and drops the ransom note * Changes the REvil registry root key to SOFTWARE\QtProject\OrganizationDefaults * Changes registry key values from --> to: * sub_key --> pvg * pk_key --> sxsP * sk_key --> BDDC8 * 0_key --> f7gVD7 * rnd_ext --> Xu7Nnkd * stat --> sMMnxpgk
REvil 1.04 MD5: 6e3efb83299d800edf1624ecbc0665e7 SHA1: 0bd22f204c5373f1a22d9a02c59f69f354a2cc0d SHA256: 2ca64feaaf5ab6cf96677fbc2bc0e1995b3bc93472d7af884139aa757240e3f6 * Leverages PowerShell and WMI to delete shadow copies if the victim's operating system is newer than Windows XP (For Windows XP or older, it uses the original command that was executed in all previous REvil versions.) * Removes the folder wipe capability * Changes the REvil registry root key to SOFTWARE\GitForWindows * Changes registry key values from --> to: * pvg --> QPM * sxsP --> cMtS * BDDC8 --> WGg7j * f7gVD7 --> zbhs8h * Xu7Nnkd --> H85TP10 * sMMnxpgk --> GCZg2PXD
REvil v1.05 MD5: cfefcc2edc5c54c74b76e7d1d29e69b2 SHA1: 7423c57db390def08154b77e2b5e043d92d320c7 SHA256: e430479d1ca03a1bc5414e28f6cdbb301939c4c95547492cdbe27b0a123344ea * Add new 'arn' configuration key that contains a boolean true/false value that controls whether or not to implement persistence. * Implements persistence functionality via registry Run key. Data for value is set to the full path and filename of the currently running executable. The executable is never moved into any 'working directory' such as %AppData% or %TEMP% as part of the persistence setup. The Reg Value used is the hardcoded value of 'lNOWZyAWVv' : * SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lNOWZyAWVv * Before exiting, REvil sets up its malicious executable to be deleted upon reboot by issuing a call to MoveFileExW and setting the destination to NULL and the flags to 4 (MOVEFILE_DELAY_UNTIL_REBOOT). This breaks persistence however as the target executable specified in the Run key will no longer exist once this is done. * Changes registry key values from --> to: * QPM --> tgE * cMtS --> 8K09 * WGg7j --> xMtNc * zbhs8h --> CTgE4a * H85TP10 --> oE5bZg0 * GCZg2PXD --> DC408Qp4
REvil v1.06 MD5: 65ff37973426c09b9ff95f354e62959e SHA1: b53bc09cfbd292af7b3609734a99d101bd24d77e SHA256: 0e37d9d0a7441a98119eb1361a0605042c4db0e8369b54ba26e6ba08d9b62f1e * Updated string decoding function to break existing yara rules. Likely the result of the blog posted by us. * Modified handling of network file encryption. Now explicitly passes every possible "Scope" constant to the WNetOpenEnum function when looking for files to encrypt. It also changed the 'Resource Type" from RESOURCETYPE_DISK to RESOURCETYPE_ANY which will now include things like mapped printers. * Persistence registry value changed from 'lNOWZyAWVv' to 'sNpEShi30R' * Changes registry key values from --> to: * tgE --> 73g * 8K09 --> vTGj * xMtNc --> Q7PZe * CTgE4a --> BuCrIp * oE5bZg0 --> lcZd7OY * DC408Qp4 --> sLF86MWC
REvil v1.07 MD5: ea4cae3d6d8150215a4d90593a4c30f2 SHA1: 8dcbcbefaedf5675b170af3fd44db93ad864894e SHA256: 6a2bd52a5d68a7250d1de481dcce91a32f54824c1c540f0a040d05f757220cd3 TBD
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular REvil (Windows).
| Known Synonyms |
|---|
Sodin |
Sodinokibi |
Internal MISP references
UUID e7698597-e0a9-4f4b-9920-09f5db225bd4 which can be used as unique global reference for REvil (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.revil - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/ - webarchive
- https://twitter.com/Jacob_Pimental/status/1391055792774729728 - webarchive
- https://f.hubspotusercontent10.net/hubfs/5943619/Whitepaper-Downloads/Ransomware_in_ICS_Environments_Whitepaper_10_12_20.pdf - webarchive
- https://www.advanced-intel.com/post/adversarial-perspective-advintel-breach-avoidance-through-monitoring-initial-vulnerabilities - webarchive
- https://home.treasury.gov/news/press-releases/jy0471 - webarchive
- https://www.splunk.com/en_us/blog/security/revil-ransomware-threat-research-update-and-detections.html - webarchive
- https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/ - webarchive
- https://redcanary.com/blog/uncompromised-kaseya/ - webarchive
- https://twitter.com/VK_Intel/status/1374571480370061312?s=20 - webarchive
- https://blog.amossys.fr/sodinokibi-malware-analysis.html - webarchive
- https://www.crowdstrike.com/blog/how-falcon-complete-thwarted-a-revil-ransomware-attack/ - webarchive
- https://krebsonsecurity.com/2021/11/revil-ransom-arrest-6m-seizure-and-10m-reward/ - webarchive
- https://f.hubspotusercontent10.net/hubfs/7095517/FLINT-Kaseya-Another%20Massive%20Heist%20by%20REvil.pdf - webarchive
- https://www.justice.gov/opa/pr/ukrainian-arrested-and-charged-ransomware-attack-kaseya - webarchive
- https://documents.trendmicro.com/assets/rpt/rpt-navigating-new-frontiers-trend-micro-2021-annual-cybersecurity-report.pdf - webarchive
- https://www.flashpoint-intel.com/blog/possible-universal-revil-master-key-posted-to-xss/ - webarchive
- https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/ - webarchive
- https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/ - webarchive
- https://teamt5.org/en/posts/introducing-the-most-profitable-ransomware-revil/ - webarchive
- https://gist.githubusercontent.com/fwosar/a63e1249bfccb8395b961d3d780c0354/raw/312b2bbc566cbee2dac7b143dc143c1913ddb729/revil.json - webarchive
- https://www.washingtonpost.com/national-security/ransomware-fbi-revil-decryption-key/2021/09/21/4a9417d0-f15f-11eb-a452-4da5fe48582d_story.html - webarchive
- https://therecord.media/us-arrests-and-charges-ukrainian-man-for-kaseya-ransomware-attack/ - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.huntress.com/blog/security-researchers-hunt-to-discover-origins-of-the-kaseya-vsa-mass-ransomware-incident - webarchive
- https://news.sophos.com/en-us/2021/06/30/mtr-in-real-time-hand-to-hand-combat-with-revil-ransomware-chasing-a-2-5-million-pay-day/ - webarchive
- https://www.goggleheadedhacker.com/blog/post/sodinokibi-ransomware-analysis - webarchive
- https://www.darkowl.com/blog-content/page-not-found-revil-darknet-services-offline-after-attack-last-weekend - webarchive
- https://twitter.com/SophosLabs/status/1413616952313004040?s=20 - webarchive
- https://therecord.media/revil-ransomware-executes-supply-chain-attack-via-malicious-kaseya-update/ - webarchive
- https://twitter.com/SophosLabs/status/1412056467201462276 - webarchive
- https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-hits-new-york-airport-systems/ - webarchive
- https://blog.morphisec.com/real-time-prevention-of-the-kaseya-vsa-supply-chain-revil-ransomware-attack - webarchive
- https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf - webarchive
- https://therecord.media/i-scrounged-through-the-trash-heaps-now-im-a-millionaire-an-interview-with-revils-unknown/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-009.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/revil-ransomware-gang-claims-over-100-million-profit-in-a-year/ - webarchive
- https://twitter.com/fwosar/status/1420119812815138824 - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-revil - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://blog.intel471.com/2020/03/31/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/ - webarchive
- https://www.fbi.gov/wanted/cyber/yevgyeniy-igoryevich-polyanin - webarchive
- https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-threatens-to-publish-data-of-automotive-group/ - webarchive
- https://research.checkpoint.com/2020/graphology-of-an-exploit-playbit/ - webarchive
- https://twitter.com/SyscallE/status/1411074271875670022 - webarchive
- https://cocomelonc.github.io/malware/2023/02/02/malware-analysis-7.html - webarchive
- https://blog.truesec.com/2021/07/04/kaseya-supply-chain-attack-targeting-msps-to-deliver-revil-ransomware/ - webarchive
- https://blag.nullteilerfrei.de/2020/02/02/defeating-sodinokibi-revil-string-obfuscation-in-ghidra/ - webarchive
- https://cti-league.com/wp-content/uploads/2021/02/CTI-League-Darknet-Report-2021.pdf - webarchive
- https://twitter.com/AdamTheAnalyst/status/1409499591452639242?s=20 - webarchive
- https://www.bleepingcomputer.com/news/security/darkside-ransomware-made-90-million-in-just-nine-months/ - webarchive
- https://www.bleepingcomputer.com/news/security/kaseyas-universal-revil-decryption-key-leaked-on-a-hacking-forum/ - webarchive
- https://twitter.com/fwosar/status/1411281334870368260 - webarchive
- https://www.br.de/nachrichten/deutschland-welt/mutmasslicher-ransomware-millionaer-identifiziert,Sn3iHgJ - webarchive
- https://diicot.ro/mass-media/3341-comunicat-de-presa-2-08-11-2021 - webarchive
- https://us-cert.cisa.gov/ncas/current-activity/2021/07/04/cisa-fbi-guidance-msps-and-their-customers-affected-kaseya-vsa - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/diving-deeper-into-the-kaseya-vsa-attack-revil-returns-and-other-hackers-are-riding-their-coattails/ - webarchive
- https://www.certego.net/en/news/malware-tales-sodinokibi/ - webarchive
- https://asec.ahnlab.com/ko/19860/ - webarchive
- https://therecord.media/ransomwhere-project-wants-to-create-a-database-of-past-ransomware-payments/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sodinokibi-ransomware-cobalt-strike-pos - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://www.kaseya.com/potential-attack-on-kaseya-vsa/ - webarchive
- https://www.digitalshadows.com/blog-and-research/competitions-on-russian-language-cybercriminal-forums-sharing-expertise-or-threat-actor-showboating/ - webarchive
- https://www.documentcloud.org/documents/21505031-hgsac-staff-report-americas-data-held-hostage-032422 - webarchive
- https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html - webarchive
- https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-publishes-stolen-data-for-the-first-time/ - webarchive
- https://news.sophos.com/en-us/2021/06/11/relentless-revil-revealed/ - webarchive
- https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b - webarchive
- http://www.fsb.ru/fsb/press/message/single.htm%21id%3D10439388%40fsbMessage.html - webarchive
- https://cybersecurity.att.com/blogs/labs-research/revils-new-linux-version - webarchive
- https://unit42.paloaltonetworks.com/revil-threat-actors/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-as-a-service-enabler-of-widespread-attacks - webarchive
- https://www.bleepingcomputer.com/news/security/revil-ransomware-shuts-down-again-after-tor-sites-were-hijacked/ - webarchive
- https://unit42.paloaltonetworks.com/prometheus-ransomware/ - webarchive
- https://www.flashpoint-intel.com/blog/revils-cryptobackdoor-con-ransomware-groups-tactics-roil-affiliates-sparking-a-fallout/ - webarchive
- https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-gang-rises-from-the-ashes-of-darkside-revil/ - webarchive
- https://storage.courtlistener.com/recap/gov.uscourts.txnd.351760/gov.uscourts.txnd.351760.1.0_3.pdf - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://www.splunk.com/en_us/blog/security/kaseya-sera-what-revil-shall-encrypt-shall-encrypt.html - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v - webarchive
- https://hatching.io/blog/ransomware-part2 - webarchive
- https://public.intel471.com/blog/revil-ransomware-interview-russian-osint-100-million/ - webarchive
- https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-to-stop-taking-bitcoin-to-hide-money-trail/ - webarchive
- https://www.pandasecurity.com/emailhtml/2007-CAM-RANSOMWARE-AD360-WG/2006-Report-Sodinokibi-EN.pdf - webarchive
- https://kaseya.app.box.com/s/0ysvgss7w48nxh8k1xt7fqhbcjxhas40 - webarchive
- https://teamt5.org/tw/posts/revil-dll-sideloading-technique-used-by-other-hackers/ - webarchive
- https://www.connectwise.com/resources/revil-profile - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-2/ - webarchive
- https://www.youtube.com/watch?v=tZVFMVm5GAk - webarchive
- https://www.nytimes.com/2019/08/22/us/ransomware-attacks-hacking.html - webarchive
- https://www.kpn.com/security-blogs/Tracking-REvil.htm - webarchive
- https://www.flashpoint-intel.com/blog/darkside-ransomware-links-to-revil-difficult-to-dismiss/ - webarchive
- https://twitter.com/LloydLabs/status/1411098844209819648 - webarchive
- https://analyst1.com/file-assets/History-of-REvil.pdf - webarchive
- https://blog.sensecy.com/2020/08/20/global-ransomware-attacks-in-2020-the-top-4-vulnerabilities/ - webarchive
- https://www.elliptic.co/blog/revil-revealed-tracking-ransomware-negotiation-and-payment - webarchive
- https://www.youtube.com/watch?v=LUxOcpIRxmg - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://twitter.com/Jacob_Pimental/status/1398356030489251842?s=20 - webarchive
- https://threatpost.com/ransomware-revil-sites-disappears/167745/ - webarchive
- https://www.cybereason.com/blog/cybereason-vs-revil-ransomware-the-kaseya-chronicles - webarchive
- https://asec.ahnlab.com/ko/19640/ - webarchive
- https://therecord.media/an-interview-with-blackmatter-a-new-ransomware-group-thats-learning-from-the-mistakes-of-darkside-and-revil/ - webarchive
- https://www.domaintools.com/resources/blog/revealing-revil-ransomware-with-domaintools-and-maltego - webarchive
- https://www.trendmicro.com/en_in/research/21/k/global-operations-lead-to-arrests-of-alleged-members-of-gandcrab.html - webarchive
- https://www.trendmicro.com/en_us/research/21/h/supply-chain-attacks-from-a-managed-detection-and-response-persp.html - webarchive
- https://www.bbc.com/news/technology-59297187 - webarchive
- https://blogs.blackberry.com/en/2021/11/revil-under-the-microscope - webarchive
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/ - webarchive
- https://www.ironnet.com/blog/ransomware-graphic-blog - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-double-extortion-and-beyond-revil-clop-and-conti - webarchive
- https://www.trendmicro.com/en_us/research/22/g/gootkit-loaders-updated-tactics-and-fileless-delivery-of-cobalt-strike.html - webarchive
- https://www.acronis.com/en-sg/articles/sodinokibi-ransomware/ - webarchive
- https://www.bleepingcomputer.com/news/security/kaseya-obtains-universal-decryptor-for-revil-ransomware-victims/ - webarchive
- https://www.zscaler.com/blogs/security-research/kaseya-supply-chain-ransomware-attack-technical-analysis-revil-payload - webarchive
- https://www.elastic.co/blog/elastic-security-prevents-100-percent-of-revil-ransomware-samples?utm_content=&utm_medium=social&utm_source=twitter - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html - webarchive
- https://raw.githubusercontent.com/k-vitali/Malware-Misc-RE/master/2022-05-01-revil-reborn-ransom.vk.cfg.txt - webarchive
- https://www.bleepingcomputer.com/news/security/revil-ransomwares-servers-mysteriously-come-back-online/ - webarchive
- https://www.cyjax.com/2021/07/09/revilevolution/ - webarchive
- https://www.bleepingcomputer.com/news/security/another-ransomware-will-now-publish-victims-data-if-not-paid/ - webarchive
- https://www.crowdstrike.com/blog/the-evolution-of-revil-ransomware-and-pinchy-spider/ - webarchive
- https://www.europol.europa.eu/newsroom/news/five-affiliates-to-sodinokibi/revil-unplugged - webarchive
- https://ics-cert.kaspersky.com/media/KASPERSKY_H1_2020_ICS_REPORT_EN.pdf - webarchive
- https://threatintel.blog/OPBlueRaven-Part1/ - webarchive
- https://www.bleepingcomputer.com/news/security/revil-ransomware-devs-added-a-backdoor-to-cheat-affiliates/ - webarchive
- https://www.goggleheadedhacker.com/blog/post/reversing-crypto-functions - webarchive
- https://ke-la.com/to-attack-or-not-to-attack-targeting-the-healthcare-sector-in-the-underground-ecosystem/ - webarchive
- https://www.bleepingcomputer.com/news/security/revil-ransomware-returns-new-malware-sample-confirms-gang-is-back/ - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://ke-la.com/zooming-into-darknet-threats-targeting-jp-orgs-kela/ - webarchive
- https://securityscorecard.com/research/a-detailed-analysis-of-the-last-version-of-revil-ransomware - webarchive
- https://www.netskope.com/blog/netskope-threat-coverage-revil - webarchive
- https://download.microsoft.com/download/f/8/1/f816b8b6-bee3-41e5-b6cc-e925a5688f61/Microsoft_Digital_Defense_Report_2020_September.pdf - webarchive
- https://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/ - webarchive
- https://securelist.com/sodin-ransomware/91473/ - webarchive
- https://www.cnbc.com/2021/04/23/axis-of-revil-inside-the-hacker-collective-taunting-apple.html - webarchive
- https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html - webarchive
- https://twitter.com/alex_il/status/1412403420217159694 - webarchive
- https://www.secureworks.com/blog/revil-development-adds-confidence-about-gold-southfield-reemergence?linkId=164334801 - webarchive
- https://www.bleepingcomputer.com/news/security/ransomware-threatens-to-reveal-companys-dirty-secrets/ - webarchive
- https://www.digitalshadows.com/blog-and-research/revil-analysis-of-competing-hypotheses/ - webarchive
- https://www.recordedfuture.com/blackmatter-ransomware-successor-darkside-revil/ - webarchive
- https://www.darktrace.com/en/blog/staying-ahead-of-r-evils-ransomware-as-a-service-business-model/ - webarchive
- https://krebsonsecurity.com/2019/07/is-revil-the-new-gandcrab-ransomware/ - webarchive
- https://storage.courtlistener.com/recap/gov.uscourts.txnd.352371/gov.uscourts.txnd.352371.1.0_1.pdf - webarchive
- https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/ - webarchive
- https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling - webarchive
- https://medium.com/s2wlab/deep-analysis-of-revil-ransomware-written-in-korean-d1899c0e9317 - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/kaseya-ransomware-supply-chain - webarchive
- https://awakesecurity.com/blog/threat-hunting-for-revil-ransomware/ - webarchive
- https://blog.group-ib.com/REvil_RaaS - webarchive
- https://www.advanced-intel.com/post/inside-revil-extortionist-machine-predictive-insights - webarchive
- https://www.appgate.com/blog/electric-company-ransomware-attack-calls-for-14-million-in-ransom - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/wp-spark-state-of-ransomware.pdf - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses - webarchive
- https://ke-la.com/ransomware-gangs-are-starting-to-look-like-oceans-11/ - webarchive
- https://blog.truesec.com/2021/07/06/kaseya-vsa-zero-day-exploit - webarchive
- https://blog.talosintelligence.com/2021/03/ctir-trends-winter-2020-21.html - webarchive
- https://searchsecurity.techtarget.com/feature/Ransomware-negotiations-An-inside-look-at-the-process - webarchive
- https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations-wp.pdf - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-345a - webarchive
- https://twitter.com/VK_Intel/status/1411066870350942213 - webarchive
- https://www.bankinfosecurity.com/interviews/ransomware-files-episode-6-kaseya-revil-i-5045 - webarchive
- https://ibm.ent.box.com/s/hs5pcayhbbhjvj8di5sqdpbbd88tsh89 - webarchive
- https://www.advanced-intel.com/post/from-qbot-with-revil-ransomware-initial-attack-exposure-of-jbs - webarchive
- https://medium.com/s2wlab/w4-may-en-story-of-the-week-ransomware-on-the-darkweb-5f5b8d4c3b6f - webarchive
- https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-may-tip-nasdaq-on-attacks-to-hurt-stock-prices/ - webarchive
- https://www.flashpoint-intel.com/blog/cl0p-and-revil-escalate-their-ransomware-tactics/ - webarchive
- https://www.advintel.io/post/storm-in-safe-haven-takeaways-from-russian-authorities-takedown-of-revil - webarchive
- https://www.secureworks.com/blog/revil-the-gandcrab-connection - webarchive
- https://isc.sans.edu/diary/27012 - webarchive
- https://securityaffairs.co/wordpress/98694/malware/sodinokibi-kenneth-cole-data-breach.html - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.crowdstrike.com/blog/how-to-defend-against-conti-darkside-revil-and-other-ransomware/ - webarchive
- https://www.domaintools.com/resources/blog/the-most-prolific-ransomware-families-a-defenders-guide - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://www.zdnet.com/article/revil-ransomware-gang-launches-auction-site-to-sell-stolen-data/ - webarchive
- https://blog.gigamon.com/2021/07/08/observations-and-recommendations-from-the-ongoing-revil-kaseya-incident/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2020/11/german-users-targeted-with-gootkit-banker-or-revil-ransomware/ - webarchive
- https://www.youtube.com/watch?v=l2P5CMH9TE0 - webarchive
- https://tehtris.com/fr/peut-on-neutraliser-un-ransomware-lance-en-tant-que-system-sur-des-milliers-de-machines-en-meme-temps/ - webarchive
- https://blag.nullteilerfrei.de/2019/11/09/api-hashing-why-and-how/ - webarchive
- https://securelist.com/revil-ransomware-attack-on-msp-companies/103075/ - webarchive
- https://twitter.com/svch0st/status/1411537562380816384 - webarchive
- https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-009/ - webarchive
- https://www.trendmicro.com/en_us/research/21/a/sodinokibi-ransomware.html - webarchive
- https://blogs.blackberry.com/en/2021/05/threat-thursday-dr-revil-ransomware-strikes-again-employs-double-extortion-tactics - webarchive
- https://intel471.com/blog/changes-in-revil-ransomware-version-2-2 - webarchive
- https://www.bleepingcomputer.com/news/security/a-look-inside-the-highly-profitable-sodinokibi-ransomware-business/ - webarchive
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-crescendo/ - webarchive
- https://ke-la.com/darknet-threat-actors-are-not-playing-games-with-the-gaming-industry/ - webarchive
- https://www.youtube.com/watch?v=P8o6GItci5w - webarchive
- https://www.bleepingcomputer.com/news/security/popular-russian-hacking-forum-xss-bans-all-ransomware-topics/ - webarchive
- https://twitter.com/R3MRUM/status/1412064882623713283 - webarchive
- https://dissectingmalwa.re/germanwipers-big-brother-gandgrabs-kid-sodinokibi.html - webarchive
- https://medium.com/@underthebreach/tracking-down-revils-lalartu-by-utilizing-multiple-osint-methods-2bf3a6c65a80 - webarchive
- https://drive.google.com/file/d/1ph1E0onZ7TiNyG87k4WjofCKNuCafMLk/view - webarchive
- https://securelist.com/ransomware-world-in-2021/102169/ - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/moving-left-ransomware-boom - webarchive
- https://research.checkpoint.com/2023/following-the-scent-of-trickgate-6-year-old-packer-used-to-deploy-the-most-wanted-malware/ - webarchive
- https://therecord.media/darkside-ransomware-gang-says-it-lost-control-of-its-servers-money-a-day-after-biden-threat/ - webarchive
- https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout - webarchive
- https://www.flashpoint-intel.com/blog/chatter-indicates-blackmatter-as-revil-successor/ - webarchive
- https://vimeo.com/449849549 - webarchive
- https://www.digitalshadows.com/blog-and-research/ransomware-as-a-service-rogue-affiliates-and-whats-next/ - webarchive
- https://ke-la.com/easy-way-in-5-ransomware-victims-had-their-pulse-secure-vpn-credentials-leaked/ - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/evolving-danger-ransomware-extortion - webarchive
- https://www.crowdstrike.com/blog/how-crowdstrike-stops-revil-ransomware-from-kaseya-attack/ - webarchive
- https://www.secureworks.com/research/lv-ransomware - webarchive
- https://www.reuters.com/technology/exclusive-governments-turn-tables-ransomware-gang-revil-by-pushing-it-offline-2021-10-21/ - webarchive
- https://www.advanced-intel.com/post/the-dark-web-of-intrigue-how-revil-used-the-underground-ecosystem-to-form-an-extortion-cartel - webarchive
- https://www.bleepingcomputer.com/news/security/revil-gang-tries-to-extort-apple-threatens-to-sell-stolen-blueprints/ - webarchive
- https://securityintelligence.com/posts/sodinokibi-revil-ransomware-disrupt-trade-secrets/ - webarchive
- https://www.hsgac.senate.gov/media/minority-media/new-portman-report-demonstrates-threat-ransomware-presents-to-the-united-states - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/revil-ransomware-hits-managedcom-hosting-provider-500k-ransom/ - webarchive
- https://www.secureworks.com/blog/revil-ransomware-reemerges-after-shutdown-universal-decryptor-released - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/undressing-the-revil/ - webarchive
- https://www.boll.ch/datasheets/WG_Threat_Report_EN.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-says-travelex-will-pay-one-way-or-another/ - webarchive
- https://www.zdnet.com/article/revil-ransomware-gang-acquires-kpot-malware/ - webarchive
- https://blog.redteam.pl/2020/05/sodinokibi-revil-ransomware.html - webarchive
- https://areteir.com/wp-content/uploads/2020/07/Arete_Insight_Sodino-Ransomware_June-2020.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-hits-travelex-demands-3-million/ - webarchive
- https://www.bleepingcomputer.com/news/security/revil-ransomware-has-a-new-windows-safe-mode-encryption-mode/ - webarchive
- https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus - webarchive
- https://www.bleepingcomputer.com/news/security/revils-tor-sites-come-alive-to-redirect-to-new-ransomware-operation/ - webarchive
- https://www.reddit.com/r/msp/comments/ocggbv/crticial_ransomware_incident_in_progress/ - webarchive
- https://cybleinc.com/2021/07/03/uncensored-interview-with-revil-sodinokibi-ransomware-operators/ - webarchive
- https://securityintelligence.com/posts/sodinokibi-ransomware-incident-response-intelligence-together/ - webarchive
- https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/ - webarchive
- https://www.fincen.gov/sites/default/files/advisory/2021-11-08/FinCEN%20Ransomware%20Advisory_FINAL_508_.pdf - webarchive
- https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/ - webarchive
- https://news.sophos.com/en-us/2021/06/30/what-to-expect-when-youve-been-hit-with-revil-ransomware/ - webarchive
- https://www.grahamcluley.com/travelex-paid-ransom/ - webarchive
- https://www.secureworks.com/research/revil-sodinokibi-ransomware - webarchive
- https://unit42.paloaltonetworks.com/threat-brief-kaseya-vsa-ransomware-attacks/ - webarchive
- https://www.justice.gov/opa/pr/sodinokibirevil-ransomware-defendant-extradited-united-states-and-arraigned-texas - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf - webarchive
- https://russian.rt.com/russia/article/926347-barnaulec-rozysk-fbr-kibermoshennichestvo - webarchive
- https://velzart.nl/blog/ransomeware/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware - webarchive
- https://community.riskiq.com/article/3315064b - webarchive
- https://www.bleepingcomputer.com/news/security/fbi-revil-cybergang-behind-the-jbs-ransomware-attack/ - webarchive
- https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2020.pdf?__blob=publicationFile&v=2 - webarchive
- https://twitter.com/resecurity_com/status/1412662343796813827 - webarchive
- https://www.databreaches.net/a-former-darkside-listing-shows-up-on-revils-leak-site/ - webarchive
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ - webarchive
- https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/ - webarchive
- https://www.advanced-intel.com/post/revil-vanishes-from-underground-infrastructure-down-support-staff-adverts-silent - webarchive
- https://www.flashpoint-intel.com/blog/revil-disappears-again/ - webarchive
- https://www.bleepingcomputer.com/news/security/revil-ransomware-gangs-web-sites-mysteriously-shut-down/ - webarchive
- https://www.flashpoint-intel.com/blog/interview-with-revil-affiliated-ransomware-contractor/ - webarchive
- https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox - webarchive
- https://sites.temple.edu/care/ci-rw-attacks/ - webarchive
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/ - webarchive
- https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf - webarchive
- https://www.youtube.com/watch?v=QYQQUUpU04s - webarchive
- https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/ - webarchive
- https://www.elastic.co/blog/ransomware-interrupted-sodinokibi-and-the-supply-chain - webarchive
- https://ke-la.com/will-the-revils-story-finally-be-over/ - webarchive
- https://resources.malwarebytes.com/files/2020/02/2020_State-of-Malware-Report.pdf - webarchive
- https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf - webarchive
- https://thehackernews.com/2022/03/ukrainian-hacker-linked-to-revil.html - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://www.bleepingcomputer.com/news/security/revil-ransomware-hits-1-000-plus-companies-in-msp-supply-chain-attack/ - webarchive
- https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/ - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-southfield - webarchive
- https://www.bleepingcomputer.com/news/security/new-jersey-synagogue-suffers-sodinokibi-ransomware-attack/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-southfield - webarchive
- https://www.trendmicro.com/en_us/research/20/l/the-impact-of-modern-ransomware-on-manufacturing-networks.html - webarchive
- https://www.tgsoft.it/english/news_archivio_eng.asp?id=1004 - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RGDoor
Internal MISP references
UUID daddd1dc-c415-4970-89ee-526ee8de2ec1 which can be used as unique global reference for RGDoor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rgdoor - webarchive
- https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Anatomy-Of-Native-Iis-Malware-wp.pdf - webarchive
- https://researchcenter.paloaltonetworks.com/2017/09/unit42-striking-oil-closer-look-adversary-infrastructure/ - webarchive
- https://drive.google.com/file/d/1oA4YSwXLxEF-EXJcrM76Bc4_7ZfBGYE4/view - webarchive
- https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/ - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-gypsy - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-lyceum - webarchive
- https://www.secureworks.com/blog/ongoing-campaign-leveraging-exchange-vulnerability-potentially-linked-to-iran - webarchive
- https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Anatomy-Of-Native-Iis-Malware.pdf - webarchive
- https://cyware.com/blog/apt34-the-helix-kitten-cybercriminal-group-loves-to-meow-middle-eastern-and-international-organizations-48ae - webarchive
- https://www.welivesecurity.com/2021/08/06/anatomy-native-iis-malware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rhadamanthys
According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.
At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.
Internal MISP references
UUID 50d322d7-c7e0-4d9b-9996-e5767caa8f1c which can be used as unique global reference for Rhadamanthys in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys - webarchive
- https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://outpost24.com/blog/rhadamanthys-malware-analysis/ - webarchive
- https://www.accenture.com/us-en/blogs/security/information-stealer-malware-on-dark-web - webarchive
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-resident-campaign - webarchive
- https://research.checkpoint.com/2023/rhadamanthys-the-everything-bagel-infostealer/ - webarchive
- https://www.malware-traffic-analysis.net/2023/01/03/index.html - webarchive
- https://www.zscaler.com/blogs/security-research/technical-analysis-rhadamanthys-obfuscation-techniques - webarchive
- https://threatmon.io/rhadamanthys-stealer-analysis-threatmon/ - webarchive
- https://research.checkpoint.com/2023/from-hidden-bee-to-rhadamanthys-the-evolution-of-custom-executable-formats/ - webarchive
- https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88 - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 - webarchive
- https://www.secureworks.com/research/the-growing-threat-from-infostealers - webarchive
- https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks - webarchive
- https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rhino
Ransomware.
Internal MISP references
UUID cff6ec82-9d14-4307-9b5b-c0bd17e62f2a which can be used as unique global reference for Rhino in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RHttpCtrl
Internal MISP references
UUID 5f1bac43-6506-43f0-b5d6-709a39abd671 which can be used as unique global reference for RHttpCtrl in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rhysida (Windows)
Internal MISP references
UUID a7d77891-afc2-4be6-b831-a3b2253fb195 which can be used as unique global reference for Rhysida (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rhysida - webarchive
- https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/ - webarchive
- https://www.shadowstackre.com/analysis/rhysida - webarchive
- https://blog.talosintelligence.com/rhysida-ransomware/ - webarchive
- https://www.fortinet.com/blog/threat-research/investigating-the-new-rhysida-ransomware - webarchive
- https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-rhysida-ransomware.html - webarchive
- https://www.secplicity.org/2023/05/23/scratching-the-surface-of-rhysida-ransomware/ - webarchive
- https://decoded.avast.io/threatresearch/rhysida-ransomware-technical-analysis/ - webarchive
- https://fourcore.io/blogs/rhysida-ransomware-history-ttp-adversary-emulation - webarchive
- https://www.linkedin.com/posts/prodaft_organic-relationship-between-rhysida-vice-activity-7091777236663427072-NQEs - webarchive
- https://www.bleepingcomputer.com/news/security/rhysida-ransomware-behind-recent-attacks-on-healthcare/ - webarchive
- https://www.sentinelone.com/blog/rhysida-ransomware-raas-crawls-out-of-crimeware-undergrowth-to-attack-chilean-army/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rietspoof
Rietspoof is malware that mainly acts as a dropper and downloader, however, it also sports bot capabilities and appears to be in active development.
Internal MISP references
UUID ec67123a-c3bc-4f46-b9f3-569c19e224ca which can be used as unique global reference for Rietspoof in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rietspoof - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/01/vb2019-paper-spoofing-reeds-rietspoof/ - webarchive
- https://blog.avast.com/rietspoof-malware-increases-activity - webarchive
- https://decoded.avast.io/threatintel/spoofing-in-the-reeds-with-rietspoof/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rifdoor
Internal MISP references
UUID 2639b71e-1bf1-4cd2-8fa2-9498e893ef3f which can be used as unique global reference for Rifdoor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rifdoor - webarchive
- https://global.ahnlab.com/global/upload/download/techreport/[AhnLab]Andariel_a_Subgroup_of_Lazarus%20(3).pdf
- https://mega.nz/file/lkh1gY5C#93FUlwTwl0y27cfM0jtm4SYnWbtk06d0qoDg1e4eQ6s - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/ - webarchive
- http://www.issuemakerslab.com/research3/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rikamanu
Internal MISP references
UUID 6703e8ce-2c5e-4a9d-96b4-49e90074b043 which can be used as unique global reference for Rikamanu in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rincux
Internal MISP references
UUID 383021b9-fcf9-4c21-a0e2-d75fb8c0727a which can be used as unique global reference for Rincux in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ripper ATM
Internal MISP references
UUID a85b0619-ed8e-4324-8603-af211d682dac which can be used as unique global reference for Ripper ATM in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RisePro
RisePro is a stealer that is spread through downloaders like win.privateloader. Once executed on a system, the malware can steal credit card information, passwords, and personal data.
Internal MISP references
UUID 20ba0ede-454c-461d-a0e1-c053a838faa2 which can be used as unique global reference for RisePro in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.risepro - webarchive
- https://any.run/cybersecurity-blog/risepro-malware-communication-analysis/ - webarchive
- https://embee-research.ghost.io/identifying-risepro-panels-using-censys/ - webarchive
- https://blog.sekoia.io/new-risepro-stealer-distributed-by-the-prominent-privateloader/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rising Sun
Internal MISP references
UUID 148a7078-3a38-4974-8990-9d5881f8267b which can be used as unique global reference for Rising Sun in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rising_sun - webarchive
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/operation-sharpshooter-targets-global-defense-critical-infrastructure/ - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf - webarchive
- https://blog.apnic.net/2022/03/31/how-to-detect-and-prevent-common-data-exfiltration-attacks/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RM3
Created from the codebase of Gozi/ISFB.
Internal MISP references
UUID dec5b601-16b5-439a-8b2a-4ebc7ec31de5 which can be used as unique global reference for RM3 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RMS
CyberInt states that Remote Manipulator System (RMS) is a legitimate tool developed by Russian organization TektonIT and has been observed in campaigns conducted by TA505 as well as numerous smaller campaigns likely attributable to other, disparate, threat actors. In addition to the availability of commercial licenses, the tool is free for non-commercial use and supports the remote administration of both Microsoft Windows and Android devices.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RMS.
| Known Synonyms |
|---|
Gussdoor |
Remote Manipulator System |
RuRAT |
Internal MISP references
UUID 94339b04-9332-4691-b820-5021368f1d3a which can be used as unique global reference for RMS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rms - webarchive
- https://web.archive.org/web/20161223002016/https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks - webarchive
- https://blog.malwarebytes.com/threat-analysis/2017/09/cve-2017-0199-used-to-deliver-modified-rms-agent-rat/ - webarchive
- https://awakesecurity.com/blog/catching-the-white-stork-in-flight/ - webarchive
- https://e.cyberint.com/hubfs/Report%20Legit%20Remote%20Access%20Tools%20Turn%20Into%20Threat%20Actors%20Tools/CyberInt_Legit%20Remote%20Access%20Tools%20Turn%20Into%20Threat%20Actors'%20Tools_Report.pdf - webarchive
- https://ssu.gov.ua/uploads/files/DKIB/Technical%20report%20Armagedon.pdf - webarchive
- https://ics-cert.kaspersky.com/media/Kaspersky-Attacks-on-industrial-enterprises-using-RMS-and-TeamViewer-EN.pdf - webarchive
- https://blog.yoroi.company/research/ta505-is-expanding-its-operations/ - webarchive
- https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RoarBAT
According to SOCRadar, this is a batch script that uses WinRAR to delete files with target file extensions from a disk.
Internal MISP references
UUID 7ef66505-9b5b-4a80-af64-b51dc7a006ba which can be used as unique global reference for RoarBAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RobinHood
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RobinHood.
| Known Synonyms |
|---|
RobbinHood |
Internal MISP references
UUID 6f3469f6-7a56-4ba3-a340-f10746390226 which can be used as unique global reference for RobinHood in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.robinhood - webarchive
- https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/ - webarchive
- https://www.bleepingcomputer.com/news/security/a-closer-look-at-the-robbinhood-ransomware/ - webarchive
- https://download.microsoft.com/download/f/8/1/f816b8b6-bee3-41e5-b6cc-e925a5688f61/Microsoft_Digital_Defense_Report_2020_September.pdf - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf - webarchive
- https://blogs.quickheal.com/a-new-ransomware-goodwill-hacks-the-victims-for-charity-read-more-to-know-more-about-this-ransomware-and-how-it-affects-its-victims/ - webarchive
- https://www.boll.ch/datasheets/WG_Threat_Report_EN.pdf - webarchive
- https://arstechnica.com/information-technology/2019/05/baltimore-city-government-hit-by-robbinhood-ransomware/ - webarchive
- https://www.bleepingcomputer.com/news/security/ransomware-exploits-gigabyte-driver-to-kill-av-processes/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/ - webarchive
- https://news.sophos.com/en-us/2020/02/06/living-off-another-land-ransomware-borrows-vulnerable-driver-to-remove-security-software/ - webarchive
- https://statescoop.com/baltimore-ransomware-crowdstrike-extortion/ - webarchive
- https://twitter.com/VK_Intel/status/1121440931759128576 - webarchive
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/ - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/ - webarchive
- https://www.sentinelone.com/blog/robinhood-ransomware-coolmaker-function-not-cool/ - webarchive
- https://krebsonsecurity.com/2019/06/report-no-eternal-blue-exploit-found-in-baltimore-city-ransomware/ - webarchive
- https://goggleheadedhacker.com/blog/post/12 - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
rock
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular rock.
| Known Synonyms |
|---|
yellowalbatross |
Internal MISP references
UUID 95a26977-295f-4843-ad11-a3d9dcb6c192 which can be used as unique global reference for rock in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rockloader
Internal MISP references
UUID 1482ffff-47a8-46da-8f47-d363c9d86c0e which can be used as unique global reference for Rockloader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rockloader - webarchive
- https://www.proofpoint.com/us/threat-insight/post/Locky-Ransomware-Cybercriminals-Introduce-New-RockLoader-Malware - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rofin
Internal MISP references
UUID bd7b1628-2aeb-44c5-91e7-f02c011034cf which can be used as unique global reference for Rofin in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RogueRobinNET
A .NET variant of ps1.roguerobin
Internal MISP references
UUID 25b08d2e-f803-4520-9518-4d95ce9f6ed4 which can be used as unique global reference for RogueRobinNET in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.roguerobin - webarchive
- https://kindredsec.com/2019/08/12/an-overview-of-public-platform-c2s/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/antisandbox-techniques/ - webarchive
- https://unit42.paloaltonetworks.com/darkhydrus-delivers-new-trojan-that-can-use-google-drive-for-c2-communications/ - webarchive
- https://ti.360.net/blog/articles/latest-target-attack-of-darkhydruns-group-against-middle-east-en/ - webarchive
- https://kindredsec.wordpress.com/2019/08/12/an-overview-of-public-platform-c2s/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rokku
Internal MISP references
UUID 38f57823-ccc2-424b-8140-8ba30325af9c which can be used as unique global reference for Rokku in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RokRAT
It is a backdoor commonly distributed as an encoded binary file downloaded and decrypted by shellcode following the exploitation of weaponized documents. DOGCALL is capable of capturing screenshots, logging keystrokes, evading analysis with anti-virtual machine detections, and leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RokRAT.
| Known Synonyms |
|---|
DOGCALL |
Internal MISP references
UUID 16dcc67b-4415-4620-818d-7ca24a5ccaf5 which can be used as unique global reference for RokRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rokrat - webarchive
- https://kindredsec.com/2019/08/12/an-overview-of-public-platform-c2s/ - webarchive
- http://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html - webarchive
- https://github.com/ssp4rk/slides/blob/master/2019SAS_Behind_of_the_Mask_of_ScarCruft.pdf - webarchive
- https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48 - webarchive
- http://v3lo.tistory.com/24 - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://threatmon.io/reverse-engineering-rokrat-a-closer-look-at-apt37s-onedrive-based-attack-vector/ - webarchive
- https://www.ibm.com/downloads/cas/Z81AVOY7 - webarchive
- https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/ - webarchive
- https://www.picussecurity.com/blog/picus-10-critical-mitre-attck-techniques-t1055-process-injection - webarchive
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-annex-download.pdf - webarchive
- https://research.checkpoint.com/2023/chain-reaction-rokrats-missing-link/ - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/ - webarchive
- https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf - webarchive
- https://asec.ahnlab.com/en/51751/ - webarchive
- http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html - webarchive
- https://twitter.com/ESETresearch/status/1575103839115804672 - webarchive
- https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/ - webarchive
- https://www.intezer.com/apt37-final1stspy-reaping-the-freemilk/ - webarchive
- https://medium.com/s2wblog/scarcruft-bolsters-arsenal-for-targeting-individual-android-devices-97d2bcef4ab - webarchive
- https://securityintelligence.com/posts/itg10-targeting-south-korean-entities/ - webarchive
- https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html - webarchive
- http://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/002/191/original/Talos_RokRatWhitePaper.pdf - webarchive
- https://www.ptsecurity.com/ww-en/analytics/antisandbox-techniques/ - webarchive
- http://blog.talosintelligence.com/2017/04/introducing-rokrat.html - webarchive
- https://unit42.paloaltonetworks.com/atoms/moldypisces/ - webarchive
- https://www.youtube.com/watch?v=uoBQE5s2ba4 - webarchive
- https://www.carbonblack.com/2018/02/27/threat-analysis-rokrat-malware/ - webarchive
- https://securelist.com/apt-trends-report-q2-2019/91897/ - webarchive
- https://kindredsec.wordpress.com/2019/08/12/an-overview-of-public-platform-c2s/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ROLLCOAST
ROLLCOAST is a ransomware program that encrypts files on logical drives attached to a system. ROLLCOAST is a Dynamic Linked Library (DLL) with no named exports. When observed by Mandiant it uniquely had only one ordinal export 0x01. This suggested the sample was designed to avoid detection and be invoked within memory, possibly through BEACON provided to affiliates. Incident responders working on similar intrusions should capture memory for analysis.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ROLLCOAST.
| Known Synonyms |
|---|
Arcane |
S4bb47h |
Sabbath |
Internal MISP references
UUID a3178bd5-719b-4065-9a55-d13bb34e5c14 which can be used as unique global reference for ROLLCOAST in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RollSling
Internal MISP references
UUID 40a0d770-21bd-4561-aba0-bfe000bc18b0 which can be used as unique global reference for RollSling in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rombertik
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Rombertik.
| Known Synonyms |
|---|
CarbonGrabber |
Internal MISP references
UUID ab5066b4-d5ff-4f83-9a05-6e74c043a6e1 which can be used as unique global reference for Rombertik in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ROMCOM RAT
Unit 42 observed threat actor Tropical Scorpius using this RAT in operations where also Cuba ransomware was deployed.
Internal MISP references
UUID 5f1c11d3-c6ac-4368-a801-cced88a9d93b which can be used as unique global reference for ROMCOM RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.romcom_rat - webarchive
- https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/ - webarchive
- https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit - webarchive
- https://unit42.paloaltonetworks.com/cuba-ransomware-tropical-scorpius/ - webarchive
- https://labs.k7computing.com/index.php/romcom-rat-not-your-typical-love-story/ - webarchive
- https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/ - webarchive
- https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries - webarchive
- https://blogs.blackberry.com/en/2022/11/romcom-spoofing-solarwinds-keepass - webarchive
- https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html - webarchive
- https://cert.gov.ua/article/3349703 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Romeo(Alfa,Bravo, ...)
Internal MISP references
UUID 87a45a07-30d7-4223-ae61-6b1e6dde0f5a which can be used as unique global reference for Romeo(Alfa,Bravo, ...) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rook
According to PCrisk, Rook is ransomware (an updated variant of Babuk) that prevents victims from accessing/opening files by encrypting them. It also modifies filenames and creates a text file/ransom note ("HowToRestoreYourFiles.txt"). Rook renames files by appending the ".Rook" extension. For example, it renames "1.jpg" to "1.jpg.Rook", "2.jpg" to "2.jpg.Rook".
Internal MISP references
UUID 5df87e9b-4fd1-4f48-92d7-416b7d83313f which can be used as unique global reference for Rook in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rook - webarchive
- https://seguranca-informatica.pt/rook-ransomware-analysis/ - webarchive
- https://github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/NightSky_Ransomware%E2%80%93just_a_Rook_RW_fork_in_VMProtect_suit/NightSky_Ransomware%E2%80%93just_a_Rook_RW_fork_in_VMProtect_suit.md - webarchive
- https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader - webarchive
- https://chuongdong.com/reverse%20engineering/2022/01/06/RookRansomware/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ - webarchive
- https://www.sentinelone.com/labs/new-rook-ransomware-feeds-off-the-code-of-babuk/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://blog.cyble.com/2022/03/15/deep-dive-analysis-pandora-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Roopirs
Internal MISP references
UUID b4a3d0ef-2d7b-4da5-8f90-8213f8f318d9 which can be used as unique global reference for Roopirs in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Roopy
Internal MISP references
UUID 68050d50-eece-43ba-8668-0825eab940f0 which can be used as unique global reference for Roopy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rorschach Ransomware
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Rorschach Ransomware.
| Known Synonyms |
|---|
BabLock |
Internal MISP references
UUID 86c3434c-ca86-4109-b0fc-61d14d59505c which can be used as unique global reference for Rorschach Ransomware in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rorschach - webarchive
- https://medium.com/@simone.kraus/rorschach-ransomware-analysis-with-attack-flow-7fa5ff613a75 - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/d/an-analysis-of-the-bablock-ransomware-/iocs-an-analysis-of-the-babLock-ransomware.txt - webarchive
- https://www.group-ib.com/blog/bablock-ransomware/ - webarchive
- https://www.trendmicro.com/en_us/research/23/d/an-analysis-of-the-bablock-ransomware.html - webarchive
- https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Roseam
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Roseam.
| Known Synonyms |
|---|
PisLoader |
Internal MISP references
UUID 8a4eb0ca-7175-4e69-b8d2-fd7a724de67b which can be used as unique global reference for Roseam in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Roshtyak
A DLL backdoor distributed by Raspberry Robin. According to Avast Decoded, Roshtyak belongs to one of the best-protected malware strains they have ever seen.
Internal MISP references
UUID 398316b7-3ccd-445e-ab10-4428f165649f which can be used as unique global reference for Roshtyak in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.roshtyak - webarchive
- https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive
- http://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive
- https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/ - webarchive
- https://www.trendmicro.com/fr_fr/research/22/l/raspberry-robin-malware-targets-telecom-governments.html - webarchive
- https://unit42.paloaltonetworks.com/unsigned-dlls/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RotorCrypt
Ransomware that was discovered over the last months of 2016 and likely based on Gomasom, another ransomware family.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RotorCrypt.
| Known Synonyms |
|---|
RotoCrypt |
Rotor |
Internal MISP references
UUID f20ef9a8-6ffc-4ef2-98ba-44f6b2eab966 which can be used as unique global reference for RotorCrypt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rover
Internal MISP references
UUID 53e94bc9-c8d2-4fb6-9c02-00841e454050 which can be used as unique global reference for Rover in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rovnix
Rovnix is a bootkit and consists of a driver loader (in the VBR) and the drivers (32bit, 64bit) themselves. It is part of the Carberp source code leak (https://github.com/nyx0/Rovnix). Rovnix has been used to protect Gozi ISFB, ReactorBot and Rerdom (at least).
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Rovnix.
| Known Synonyms |
|---|
BkLoader |
Cidox |
Mayachok |
Internal MISP references
UUID 8d984309-b7fa-4ccf-a6b7-da17283aae2f which can be used as unique global reference for Rovnix in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rovnix - webarchive
- http://www.malwaretech.com/2014/05/rovnix-new-evolution.html - webarchive
- https://securelist.com/oh-what-a-boot-iful-mornin/97365 - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/ - webarchive
- https://blogs.technet.microsoft.com/mmpc/2014/05/04/the-evolution-of-rovnix-new-virtual-file-system-vfs/ - webarchive
- https://0xc0decafe.com/malware-analysts-guide-to-aplib-decompression/ - webarchive
- http://www.malwaredigger.com/2015/05/rovnix-dropper-analysis.html - webarchive
- https://news.drweb.ru/?i=1772&c=23&lng=ru&p=0 - webarchive
- https://www.welivesecurity.com/2012/07/13/rovnix-bootkit-framework-updated/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-RodionovMatrosov.pdf - webarchive
- https://securelist.com/cybercriminals-switch-from-mbr-to-ntfs-2/29117/ - webarchive
- http://www.kernelmode.info/forum/viewtopic.php?f=16&t=981 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RoyalCli
RoyalCli is a backdoor which appears to be an evolution of BS2005 and uses familiar encryption and encoding routines. The name RoyalCli was chosen by us due to a debugging path left in the binary. RoyalCli and BS2005 both communicate with the attacker's command and control (C2) through Internet Explorer (IE) by using the COM interface IWebBrowser2.
Internal MISP references
UUID 92d87656-5e5b-410c-bdb6-bf028324dc72 which can be used as unique global reference for RoyalCli in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.royalcli - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-palace - webarchive
- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/ - webarchive
- https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/ - webarchive
- https://github.com/nccgroup/Royal_APT - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Royal DNS
RoyalDNS is a DNS based backdoor used by APT15 that persistences on a system through a service called 'Nwsapagent'.
Internal MISP references
UUID 8611f656-b0d8-4d16-93f0-c699f2af9b7a which can be used as unique global reference for Royal DNS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.royal_dns - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-palace - webarchive
- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/ - webarchive
- https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/ - webarchive
- https://github.com/nccgroup/Royal_APT - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Royal Ransom (Windows)
Ransomware
Internal MISP references
UUID df1baad8-e4b6-4507-964c-6e9a8dd5252c which can be used as unique global reference for Royal Ransom (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.royal_ransom - webarchive
- https://www.coalitioninc.com/blog/active-exploitation-firewalls - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/research/a-royal-analysis-of-royal-ransom.html - webarchive
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a - webarchive
- https://www.bleepingcomputer.com/news/security/march-2023-broke-ransomware-attack-records-with-459-incidents/ - webarchive
- https://www.avertium.com/resources/threat-reports/everything-you-need-to-know-about-royal-ransomware - webarchive
- https://medium.com/walmartglobaltech/from-royal-with-love-88fa05ff7f65 - webarchive
- https://securityscorecard.pathfactory.com/research/the-royal-ransomware - webarchive
- https://www.cyber.gov.au/acsc/view-all-content/advisories/2023-01-acsc-ransomware-profile-royal - webarchive
- https://arcticwolf.com/resources/blog/follow-on-extortion-campaign-targeting-victims-of-akira-and-royal-ransomware/ - webarchive
- https://www.fortinet.com/blog/threat-research/ransomware-roundup-royal-ransomware - webarchive
- https://www.kroll.com/en/insights/publications/cyber/royal-ransomware-deep-dive - webarchive
- https://socradar.io/dark-web-profile-royal-ransomware/ - webarchive
- https://unit42.paloaltonetworks.com/royal-ransomware/ - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-007.pdf - webarchive
- https://yoroi.company/research/reconstructing-the-last-activities-of-royal-ransomware/ - webarchive
- https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/ - webarchive
- https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf - webarchive
- https://securityintelligence.com/posts/trickbot-conti-crypters-where-are-they-now/ - webarchive
- https://www.cybereason.com/blog/royal-ransomware-analysis - webarchive
- https://www.microsoft.com/en-us/security/blog/2022/11/17/dev-0569-finds-new-ways-to-deliver-royal-ransomware-various-payloads/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-royal-ransomware-emerges-in-multi-million-dollar-attacks/ - webarchive
- https://www.cyber.gov.au/about-us/advisories/2023-01-acsc-ransomware-profile-royal - webarchive
- https://www.trendmicro.com/en_us/research/23/b/royal-ransomware-expands-attacks-by-targeting-linux-esxi-servers.html - webarchive
- https://www.trendmicro.com/en_us/research/22/l/conti-team-one-splinter-group-resurfaces-as-royal-ransomware-wit.html - webarchive
- https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf - webarchive
- https://www.bridewell.com/insights/news/detail/hunting-for-ursnif - webarchive
- https://www.logpoint.com/en/blog/exploring-the-exploit-of-royal-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rozena
Internal MISP references
UUID cf74b7a5-72c0-4c2a-96c1-b3c49fc8f766 which can be used as unique global reference for Rozena in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rozena - webarchive
- https://www.fortinet.com/blog/threat-research/follina-rozena-leveraging-discord-to-distribute-a-backdoor - webarchive
- https://www.gdatasoftware.com/blog/2018/06/30862-fileless-malware-rozena - webarchive
- https://www.gdatasoftware.com/blog/2019/07/35061-server-side-polymorphism-powershell-backdoors - webarchive
- https://www.socinvestigation.com/threat-actors-delivers-new-rozena-backdoor-with-follina-bug-detection-response/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RTM
RTM Banker also known as Redaman was first blogged about in February 2017 by ESET. The malware is written in Delphi and shows some similarities (like process list) with Buhtrap. It uses a slightly modified version of RC4 to encrypt its strings, network data, configuration and modules, according to ESET.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RTM.
| Known Synonyms |
|---|
Redaman |
Internal MISP references
UUID e6952b4d-e96d-4641-a88f-60074776d553 which can be used as unique global reference for RTM in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rtm - webarchive
- https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/ - webarchive
- http://www.peppermalware.com/2019/11/brief-analysis-of-redaman-banking.html - webarchive
- https://securelist.com/financial-cyberthreats-in-2020/101638/ - webarchive
- https://www.welivesecurity.com/2019/04/30/buhtrap-backdoor-ransomware-advertising-platform/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf - webarchive
- https://jonahacks.medium.com/malware-analysis-manual-unpacking-of-redaman-ec1782352cfb - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/ - webarchive
- https://www.youtube.com/watch?v=YXnNO3TipvM - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RTM Locker
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RTM Locker.
| Known Synonyms |
|---|
Read The Manual Locker |
Internal MISP references
UUID b299d033-7772-44a6-a8e0-6b8c5f8af5c6 which can be used as unique global reference for RTM Locker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rtm_locker - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/research/read-the-manual-locker-a-private-raas-provider.html - webarchive
- https://www.uptycs.com/blog/rtm-locker-ransomware-as-a-service-raas-linux - webarchive
- https://www.quorumcyber.com/threat-intelligence/rtm-locker-ransomware-targets-vmware-esxi-servers/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
rtpos
Internal MISP references
UUID 89ee2cb0-2c72-4a25-825b-bb56083fdd9b which can be used as unique global reference for rtpos in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ruckguv
Internal MISP references
UUID b88b50c0-3db9-4b8f-8564-4f56f991bee2 which can be used as unique global reference for Ruckguv in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rumish
Internal MISP references
UUID e1564cfe-ab82-4c14-8f92-65af0d760d70 which can be used as unique global reference for Rumish in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Running RAT
NJCCIC characterizes RunningRAT as a remote access trojan (RAT) that operates using two DLL files. When the trojan is loaded onto a system, it executes the first DLL. This is used to disable anti-malware solutions, unpack and execute the main RAT DLL, and gain persistence. The trojan installs a Windows batch file dx.bat that attempts to kill the daumcleaner.exe task, a Korean security program. The file then attempts to remove itself. Once the second DLL is loaded into memory, the first DLL overwrites the IP address for the control server to change the address the trojan communicates with. The second DLL gathers information about the victim's system, including its operating system and driver and processor information. The RAT can log user keystrokes, copy the clipboard, delete files, compress files, clear event logs, shut down the machine, and more. The second DLL also uses several anti-bugging techniques.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Running RAT.
| Known Synonyms |
|---|
running_rat |
Internal MISP references
UUID b746a645-5974-44db-a811-a024214b7fba which can be used as unique global reference for Running RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RURansom
RURansom shows characteristics of typical ransomware, but despite its name, TrendMicro's assumptions after analysis showed that this malware is more a wiper than ransomware, because the irreversible destruction of encrypted files.
Internal MISP references
UUID bdcfb449-e897-4c44-a429-7665cce194fe which can be used as unique global reference for RURansom in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ruransom - webarchive
- https://blog.cyble.com/2022/03/11/new-wiper-malware-attacking-russia-deep-dive-into-ruransom-malware/ - webarchive
- https://blogs.vmware.com/security/2022/04/ruransom-a-retaliatory-wiper.html - webarchive
- https://www.trendmicro.com/en_us/research/22/c/new-ruransom-wiper-targets-russia.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rurktar
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Rurktar.
| Known Synonyms |
|---|
RCSU |
Internal MISP references
UUID 512e0b13-a52b-45ef-9230-7172f5e976d4 which can be used as unique global reference for Rurktar in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
RustBucket (Windows)
Internal MISP references
UUID 832680ff-8b29-492e-8523-62510eb5d021 which can be used as unique global reference for RustBucket (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Rustock
Internal MISP references
UUID 76e98e04-0ab7-4000-80ee-7bcbcf9c110d which can be used as unique global reference for Rustock in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.rustock - webarchive
- https://www.secureworks.com/blog/research-21041 - webarchive
- http://blog.novirusthanks.org/2008/11/i-wormnuwarw-rustocke-variant-analysis/ - webarchive
- http://sunbeltsecurity.com/dl/Rootkit%20Installation%20and%20Obfuscation%20in%20Rustock.pdf - webarchive
- http://blog.threatexpert.com/2008/05/rustockc-unpacking-nested-doll.html - webarchive
- https://darknetdiaries.com/episode/110/ - webarchive
- https://web.archive.org/web/20160616170611/https://media.blackhat.com/bh-eu-10/presentations/Carrera_Silberman/BlackHat-EU-2010-Carrera-Silberman-State-of-Malware-slides.pdf - webarchive
- http://www.drweb.com/upload/6c5e138f917290cb99224a8f8226354f_1210062403_DDOCUMENTSArticales_PRDrWEB_RustockC_eng.pdf - webarchive
- https://www.usenix.org/legacy/event/hotbots07/tech/full_papers/chiang/chiang_html/index.html - webarchive
- https://krebsonsecurity.com/2011/03/microsoft-hunting-rustock-controllers/ - webarchive
- http://contagiodump.blogspot.com/2011/10/rustock-samples-and-analysis-links.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ryuk
Ryuk is a ransomware which encrypts its victim's files and asks for a ransom via bitcoin to release the original files. It is has been observed being used to attack companies or professional environments. Cybersecurity experts figured out that Ryuk and Hermes ransomware shares pieces of codes. Hermes is commodity ransomware that has been observed for sale on dark-net forums and used by multiple threat actors.
Internal MISP references
UUID 62c79940-184e-4b8d-9237-35434bb79678 which can be used as unique global reference for Ryuk in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.youtube.com/watch?v=Of_KjNG9DHc - webarchive
- https://news.sophos.com/en-us/2020/10/28/hacks-for-sale-inside-the-buer-loader-malware-as-a-service/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf - webarchive
- https://twitter.com/anthomsec/status/1321865315513520128 - webarchive
- https://intel471.com/blog/conti-ransomware-cooperation-maze-lockbit-ragnar-locker - webarchive
- https://www.cybereason.com/blog/cybereason-vs.-ryuk-ransomware - webarchive
- https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/ - webarchive
- https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/ - webarchive
- https://www.advanced-intel.com/post/anatomy-of-attack-inside-bazarbackdoor-to-ryuk-ransomware-one-group-via-cobalt-strike - webarchive
- https://www.trmlabs.com/post/analysis-corroborates-suspected-ties-between-conti-and-ryuk-ransomware-groups-and-wizard-spider - webarchive
- https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://www.reuters.com/article/usa-healthcare-cyber-idUSKBN27E0EP - webarchive
- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-deployed-two-weeks-after-trickbot-infection/ - webarchive
- https://www.hhs.gov/sites/default/files/bazarloader.pdf - webarchive
- https://blog.intel471.com/2020/04/14/understanding-the-relationship-between-emotet-ryuk-and-trickbot/ - webarchive
- https://gist.github.com/aaronst/6aa7f61246f53a8dd4befea86e832456 - webarchive
- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-stops-encrypting-linux-folders/ - webarchive
- https://blogs.vmware.com/networkvirtualization/2020/11/trick-or-threat-ryuk-ransomware-targets-the-health-care-industry.html/ - webarchive
- https://edition.cnn.com/2020/10/28/politics/hospitals-targeted-ransomware-attacks/index.html - webarchive
- https://blog.malwarebytes.com/threat-spotlight/2019/12/threat-spotlight-the-curious-case-of-ryuk-ransomware/ - webarchive
- https://twitter.com/SophosLabs/status/1321844306970251265 - webarchive
- https://kc.mcafee.com/resources/sites/MCAFEE/content/live/CORP_KNOWLEDGEBASE/91000/KB91844/en_US/McAfee%20Labs%20Threat%20Advisory%20-%20Ransom-Ryukv6.pdf - webarchive
- https://twitter.com/IntelAdvanced/status/1356114606780002308 - webarchive
- https://labs.sentinelone.com/an-inside-look-at-how-ryuk-evolved-its-encryption-and-evasion-techniques/ - webarchive
- https://cti-league.com/wp-content/uploads/2021/02/CTI-League-Darknet-Report-2021.pdf - webarchive
- https://threatconnect.com/blog/threatconnect-research-roundup-possible-ryuk-infrastructure/ - webarchive
- https://www.bleepingcomputer.com/news/security/darkside-ransomware-made-90-million-in-just-nine-months/ - webarchive
- https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html - webarchive
- https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/ - webarchive
- https://storage.pardot.com/652283/16118467480sqebwq7/MSP_Security_SummitJohnHammond_Huntress_Analyzing_Ryuk.pdf - webarchive
- https://blogs.microsoft.com/on-the-issues/2022/04/13/zloader-botnet-disrupted-malware-ukraine/ - webarchive
- https://fourcore.io/blogs/ryuk-ransomware-simulation-mitre-ttp - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2019-ACT-005.pdf - webarchive
- https://twitter.com/SecurityJoes/status/1402603695578157057 - webarchive
- https://www.youtube.com/watch?v=BhjQ6zsCVSc - webarchive
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/ryuk-ransomware-attack-rush-to-attribution-misses-the-point/ - webarchive
- https://blog.virustotal.com/2020/10/tracing-fresh-ryuk-campaigns-itw.html - webarchive
- https://blog.cyberint.com/ryuk-crypto-ransomware - webarchive
- https://community.riskiq.com/article/c88cf7e6 - webarchive
- https://www.microsoft.com/security/blog/2022/04/13/dismantling-zloader-how-malicious-ads-led-to-disabled-security-tools-and-ransomware/ - webarchive
- https://www.heise.de/security/artikel/Emotet-Trickbot-Ryuk-ein-explosiver-Malware-Cocktail-4573848.html - webarchive
- https://www.domaintools.com/resources/blog/analyzing-network-infrastructure-as-composite-objects - webarchive
- https://decrypt.co/15394/how-ransomware-exploded-in-the-age-of-btc - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-as-a-service-enabler-of-widespread-attacks - webarchive
- https://www.youtube.com/watch?v=CgDtm05qApE - webarchive
- https://medium.com/walmartglobaltech/inside-the-systembc-malware-as-a-service-9aa03afd09c6 - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://krebsonsecurity.com/2020/10/fbi-dhs-hhs-warn-of-imminent-credible-ransomware-threat-against-u-s-hospitals/ - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v - webarchive
- https://www.ccn-cert.cni.es/informes/informes-ccn-cert-publicos/4217-ccn-cert-id-26-19-ryuk-1/file.html - webarchive
- https://www.bleepingcomputer.com/news/security/hacking-group-is-targeting-us-hospitals-with-ryuk-ransomware/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html - webarchive
- https://www.govcert.admin.ch/blog/36/severe-ransomware-attacks-against-swiss-smes - webarchive
- https://www.advanced-intel.com/post/crime-laundering-primer-inside-ryuk-crime-crypto-ledger-risky-asian-crypto-traders - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/q4-2020-threat-report-quarterly-analysis-cybersecurity-trends-tactics-and-themes - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/trickbot-botnet-ransomware-disruption - webarchive
- https://twitter.com/IntelAdvanced/status/1353546534676258816 - webarchive
- https://blog.sensecy.com/2020/08/20/global-ransomware-attacks-in-2020-the-top-4-vulnerabilities/ - webarchive
- https://www.advanced-intel.com/post/adversary-dossier-ryuk-ransomware-anatomy-of-an-attack-in-2021 - webarchive
- https://www.youtube.com/watch?v=7xxRunBP5XA - webarchive
- https://twitter.com/Prosegur/status/1199732264386596864 - webarchive
- https://www.youtube.com/watch?v=LUxOcpIRxmg - webarchive
- https://github.com/scythe-io/community-threats/tree/master/Ryuk - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://news.sophos.com/en-us/2021/05/06/mtr-in-real-time-pirates-pave-way-for-ryuk-ransomware/ - webarchive
- https://www.bleepingcomputer.com/news/security/french-it-giant-sopra-steria-hit-by-ryuk-ransomware/ - webarchive
- https://blog.talosintelligence.com/2020/12/quarterly-ir-report-fall-2020-q4.html - webarchive
- https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/ - webarchive
- https://n1ght-w0lf.github.io/malware%20analysis/ryuk-ransomware/ - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://0xc0decafe.com/2020/12/28/never-upload-ransomware-samples-to-the-internet/ - webarchive
- https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://4rchib4ld.github.io/blog/NiceToMeetYouRyuk/ - webarchive
- https://www.eldiario.es/tecnologia/capos-cibercrimen-avisan-contratacaran-si-hackea-rusia_1_8795458.html - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html - webarchive
- https://0xchina.medium.com/malware-reverse-engineering-31039450af27 - webarchive
- https://www.ccn-cert.cni.es/informes/informes-ccn-cert-publicos/5768-ccn-cert-id-03-21-ryuk-ransomware/file.html - webarchive
- https://ics-cert.kaspersky.com/media/KASPERSKY_H1_2020_ICS_REPORT_EN.pdf - webarchive
- https://www.crowdstrike.com/blog/wizard-spider-adds-new-feature-to-ryuk-ransomware/ - webarchive
- https://ke-la.com/to-attack-or-not-to-attack-targeting-the-healthcare-sector-in-the-underground-ecosystem/ - webarchive
- https://arcticwolf.com/resources/blog/karakurt-web - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.carbonblack.com/blog/vmware-carbon-black-tau-ryuk-ransomware-technical-analysis/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference_slides/2019/VB2019-NicolaoMartins.pdf - webarchive
- https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/ - webarchive
- https://blogs.quickheal.com/deep-dive-wakeup-lan-wol-implementation-ryuk/ - webarchive
- https://medium.com/ax1al/reversing-ryuk-eef8ffd55f12 - webarchive
- https://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/ - webarchive
- https://www.cybereason.com/blog/triple-threat-emotet-deploys-trickbot-to-steal-data-spread-ryuk-ransomware - webarchive
- https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html - webarchive
- https://news.sophos.com/en-us/2020/10/14/inside-a-new-ryuk-ransomware-attack/ - webarchive
- https://blogs.microsoft.com/on-the-issues/2020/10/12/trickbot-ransomware-cyberthreat-us-elections/ - webarchive
- https://securityliterate.com/reversing-ryuk-a-technical-analysis-of-ryuk-ransomware/ - webarchive
- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-likely-behind-new-orleans-cyberattack/ - webarchive
- https://www.crowdstrike.com/blog/wizard-spider-adversary-update/ - webarchive
- https://unit42.paloaltonetworks.com/ryuk-ransomware/ - webarchive
- https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html - webarchive
- https://www.clearskysec.com/wp-content/uploads/2021/02/Conti-Ransomware.pdf - webarchive
- https://blog.talosintelligence.com/2020/06/CTIR-trends-q3-2020.html#more - webarchive
- https://thedfirreport.com/2021/01/31/bazar-no-ryuk/ - webarchive
- https://www.bleepingcomputer.com/news/security/steelcase-furniture-giant-hit-by-ryuk-ransomware-attack/ - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/ - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/wp-spark-state-of-ransomware.pdf - webarchive
- https://www.fireeye.com/blog/threat-research/2020/03/the-cycle-of-adversary-pursuit.html - webarchive
- https://areteir.com/wp-content/uploads/2020/08/Arete_Insight_Is-Conti-the-new-Ryuk_August2020.pdf - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-345a - webarchive
- https://github.com/ThreatConnect-Inc/research-team/blob/master/IOCs/WizardSpider-UNC1878-Ryuk.csv - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://blog.reversinglabs.com/blog/hunting-for-ransomware - webarchive
- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-attacked-epiq-global-via-trickbot-infection/ - webarchive
- https://www.advanced-intel.com/post/front-door-into-bazarbackdoor-stealthy-cybercrime-weapon - webarchive
- https://blog.emsisoft.com/en/35023/bug-in-latest-ryuk-decryptor-may-cause-data-loss/ - webarchive
- https://www.heise.de/ct/artikel/Was-Emotet-anrichtet-und-welche-Lehren-die-Opfer-daraus-ziehen-4665958.html - webarchive
- https://www.ironnet.com/blog/russian-cyber-attack-campaigns-and-actors - webarchive
- https://www.youtube.com/watch?v=HwfRxjV2wok - webarchive
- https://cofense.com/the-ryuk-threat-why-bazarbackdoor-matters-most/ - webarchive
- https://www.zdnet.com/article/dod-contractor-suffers-ransomware-infection/ - webarchive
- https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound - webarchive
- https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html - webarchive
- https://thedfirreport.com/2020/10/08/ryuks-return/ - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/evolving-danger-ransomware-extortion - webarchive
- https://www.mandiant.com/resources/fin12-ransomware-intrusion-actor-pursuing-healthcare-targets - webarchive
- https://www.advintel.io/post/advintel-s-state-of-emotet-aka-spmtools-displays-over-million-compromised-machines-through-2022 - webarchive
- https://us-cert.cisa.gov/sites/default/files/publications/AA20-302A_Ransomware%20_Activity_Targeting_the_Healthcare_and_Public_Health_Sector.pdf - webarchive
- https://www.scythe.io/library/threatthursday-ryuk - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-ulrick - webarchive
- https://blog.truesec.com/2020/12/22/collaboration-between-fin7-and-the-ryuk-group-a-truesec-investigation/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-ryuk-info-stealer-targets-government-and-military-secrets/ - webarchive
- https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/ - webarchive
- https://securelist.com/story-of-the-year-2019-cities-under-ransomware-siege/95456/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf - webarchive
- https://blog.bushidotoken.net/2022/04/lessons-from-conti-leaks.html - webarchive
- https://www.splunk.com/en_us/blog/security/ryuk-and-splunk-detections.html - webarchive
- https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus - webarchive
- https://blog.talosintelligence.com/2020/09/CTIR-quarterly-trends-Q4-2020.html - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-007.pdf - webarchive
- https://community.riskiq.com/article/0bcefe76 - webarchive
- https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/ - webarchive
- https://threatpost.com/apt-exploits-zerologon-targets-japanese-companies/161383/ - webarchive
- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/ - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware - webarchive
- https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2020.pdf?__blob=publicationFile&v=2 - webarchive
- https://www.wilbursecurity.com/2020/03/trickbot-to-ryuk-in-two-hours/ - webarchive
- https://ia.acs.org.au/article/2019/hospital-cyberattack-could-have-been-avoided.html - webarchive
- https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox - webarchive
- https://sites.temple.edu/care/ci-rw-attacks/ - webarchive
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/ - webarchive
- https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf - webarchive
- https://twitter.com/ffforward/status/1324281530026524672 - webarchive
- https://docs.microsoft.com/en-us/security/compass/human-operated-ransomware - webarchive
- https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-ii-the-office/ - webarchive
- https://resources.malwarebytes.com/files/2020/02/2020_State-of-Malware-Report.pdf - webarchive
- https://thehackernews.com/2022/05/malware-analysis-trickbot.html - webarchive
- https://www.mcafee.com/enterprise/en-us/assets/reports/rp-ryuk-ransomware-targeting-webservers.pdf - webarchive
- https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://threatconnect.com/blog/threatconnect-research-roundup-ryuk-and-domains-spoofing-eset-and-microsoft/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://www.latimes.com/local/lanow/la-me-ln-times-delivery-disruption-20181229-story.html - webarchive
- https://research.nccgroup.com/2021/03/04/deception-engineering-exploring-the-use-of-windows-service-canaries-against-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Ryuk Stealer
Information Stealer that searches for sensitive documents and uploads its results to an FTP server. Skips files with known Ryuk extensions.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ryuk Stealer.
| Known Synonyms |
|---|
Sidoh |
Internal MISP references
UUID 0f0e5355-1dbf-4af4-aebf-88b08e6272a4 which can be used as unique global reference for Ryuk Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk_stealer - webarchive
- https://analyst1.com/file-assets/Nationstate_ransomware_with_consecutive_endnotes.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/ryuk-related-malware-steals-confidential-military-financial-files/ - webarchive
- https://www.crowdstrike.com/blog/sidoh-wizard-spiders-mysterious-exfiltration-tool/ - webarchive
- https://twitter.com/VK_Intel/status/1171782155581689858 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sadogo
Ransomware.
Internal MISP references
UUID 188528f1-1292-4aaa-b1e6-3fe0ab78ff81 which can be used as unique global reference for Sadogo in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Saefko
Internal MISP references
UUID 60124475-1c52-4108-81cf-7b9fa0f0d3bb which can be used as unique global reference for Saefko in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SafeNet
Internal MISP references
UUID d16f9dc6-290d-4174-8b47-a972cc52dac7 which can be used as unique global reference for SafeNet in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sagerunex
According to Symantec, Sagerunex is a backdoor that is fairly resilient and implements multiple forms of communication with its command-and-control (C&C) server. Its logs are encrypted and the encryption algorithm used is AES256-CBC with 8192 rounds of SHA256 for key derivation based on a hardcoded key. It supports multiple modes methods for communicating via HTTP (proxy-aware).
Internal MISP references
UUID d8228309-ebf8-46fd-a968-bd9e24c498b4 which can be used as unique global reference for Sagerunex in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SAGE
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SAGE.
| Known Synonyms |
|---|
Saga |
Internal MISP references
UUID 56db8a46-a71b-4de1-a6b8-4312f78b8431 which can be used as unique global reference for SAGE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sage_ransom - webarchive
- http://malware-traffic-analysis.net/2017/10/13/index.html - webarchive
- https://blog.malwarebytes.com/threat-analysis/2017/03/explained-sage-ransomware/ - webarchive
- https://www.govcert.admin.ch/blog/27/saga-2.0-comes-with-ip-generation-algorithm-ipga - webarchive
- https://www.cert.pl/en/news/single/sage-2-0-analysis/ - webarchive
- https://isc.sans.edu/forums/diary/Sage+20+Ransomware/21959/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SaiGon
FireEye reports SaiGon as a variant of ISFB v3 (versions documented are tagged 3.50.132) that is more a generic backdoor than being focused on enabling banking fraud.
Internal MISP references
UUID 08817c1e-3a90-4c9b-b332-52ebe72669c5 which can be used as unique global reference for SaiGon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Saint Bot
Internal MISP references
UUID aa0afca8-551e-4fc7-a314-f541b80c6833 which can be used as unique global reference for Saint Bot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.saint_bot - webarchive
- https://inquest.net/blog/2022/04/07/ukraine-cyberwar-overview - webarchive
- https://cert.gov.ua/article/18419 - webarchive
- https://lifars.com/2022/03/a-closer-look-at-the-russian-actors-targeting-organizations-in-ukraine/ - webarchive
- https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/ - webarchive
- https://unit42.paloaltonetworks.com/atoms/nascentursa/ - webarchive
- https://www.cyberscoop.com/ukrainian-cyber-attacks-russia-conflict-q-and-a/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2021/04/a-deep-dive-into-saint-bot-downloader/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Saitama Backdoor
This in .Net witten backdoor abuses the DNS protocoll for its C2 communication. Also other techniques (e.g. long random sleeps, compression) are used to become more stealthy.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Saitama Backdoor.
| Known Synonyms |
|---|
AMATIAS |
Saitama |
Internal MISP references
UUID 435e482d-adfe-4b28-936e-d13fda800767 which can be used as unique global reference for Saitama Backdoor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.saitama - webarchive
- https://www.fortinet.com/blog/threat-research/please-confirm-you-received-our-apt - webarchive
- https://isc.sans.edu/diary/Translating+Saitama%27s+DNS+tunneling+messages/28738 - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2022/05/apt34-targets-jordan-government-using-new-saitama-backdoor/ - webarchive
- https://www.trendmicro.com/en_us/research/23/b/new-apt34-malware-targets-the-middle-east.html - webarchive
- https://x-junior.github.io/malware%20analysis/2022/06/24/Apt34.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sakula RAT
Sakula / Sakurel is a trojan horse that opens a back door and downloads potentially malicious files onto the compromised computer.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sakula RAT.
| Known Synonyms |
|---|
Sakurel |
Internal MISP references
UUID e88eb9b1-dc8b-4696-8dcf-0c29924d0f8b which can be used as unique global reference for Sakula RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sakula_rat - webarchive
- https://www.secureworks.com/research/sakula-malware-family - webarchive
- https://cyberthreatintelligenceblog.wordpress.com/2018/11/16/c0ld-case-from-aerospace-to-chinas-interests/ - webarchive
- https://docs.broadcom.com/doc/the-black-vine-cyberespionage-group - webarchive
- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2016/june/sakula-an-adventure-in-dll-planting/?page=1 - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://www.symantec.com/security_response/writeup.jsp?docid=2014-022401-3212-99 - webarchive
- https://github.com/nccgroup/Cyber-Defence/tree/master/Technical%20Notes/Sakula - webarchive
- https://web.archive.org/web/20151001235506/https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=654 - webarchive
- https://www-west.symantec.com/content/dam/symantec/docs/security-center/white-papers/black-vine-cyberespionage-group-15-en.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Salgorea
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Salgorea.
| Known Synonyms |
|---|
BadCake |
Internal MISP references
UUID 060ff141-bb68-47ca-8a9d-8722f1edaa6e which can be used as unique global reference for Salgorea in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.salgorea - webarchive
- https://research.checkpoint.com/deobfuscating-apt32-flow-graphs-with-cutter-and-radare2/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2018/03/ESET_OceanLotus.pdf - webarchive
- https://www.accenture.com/us-en/blogs/blogs-pond-loach-delivers-badcake-malware - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sality
F-Secure states that the Sality virus family has been circulating in the wild as early as 2003. Over the years, the malware has been developed and improved with the addition of new features, such as rootkit or backdoor functionality, and so on, keeping it an active and relevant threat despite the relative age of the malware.
Modern Sality variants also have the ability to communicate over a peer-to-peer (P2P) network, allowing an attacker to control a botnet of Sality-infected machines. The combined resources of the Sality botnet may also be used by its controller(s) to perform other malicious actions, such as attacking routers.
Infection Sality viruses typically infect executable files on local, shared and removable drives. In earlier variants, the Sality virus simply added its own malicious code to the end of the infected (or host) file, a technique known as prepending. The viral code that Sality inserts is polymorphic, a form of complex code that is intended to make analysis more difficult.
Earlier Sality variants were regarded as technically sophisticated in that they use an Entry Point Obscuration (EPO) technique to hide their presence on the system. This technique means that the virus inserts a command somewhere in the middle of an infected file's code, so that when the system is reading the file to execute it and comes to the command, it forces the system to 'jump' to the malware's code and execute that instead. This technique was used to make discovery and disinfection of the malicious code harder.
Payload Once installed on the computer system, Sality viruses usually also execute a malicious payload. The specific actions performed depend on the specific variant in question, but generally Sality viruses will attempt to terminate processes, particularly those related to security programs. The virus may also attempt to open connections to remote sites, download and run additional malicious files, and steal data from the infected machine.
Internal MISP references
UUID cf752563-ad8a-4286-b2b3-9acf24a0a09a which can be used as unique global reference for Sality in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sality - webarchive
- https://unit42.paloaltonetworks.com/c2-traffic/ - webarchive
- https://www.botconf.eu/wp-content/uploads/2015/12/OK-P18-Kleissner-Sality.pdf - webarchive
- https://www.researchgate.net/profile/Lorenzo-De-Carli/publication/320250366_Botnet_protocol_inference_in_the_presence_of_encrypted_traffic/links/5fa9608792851cc286a08592/Botnet-protocol-inference-in-the-presence-of-encrypted-traffic.pdf?origin=publication_detail - webarchive
- https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/sality_peer_to_peer_viral_network.pdf - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-110a - webarchive
- https://gist.githubusercontent.com/quangnh89/41deada8a936a1877a6c6c757ce73800/raw/41f27388a11a606e1d6a7596dcb6469578e79321/sality_extractor.py - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf - webarchive
- https://www.dragos.com/blog/the-trojan-horse-malware-password-cracking-ecosystem-targeting-industrial-operators/ - webarchive
- https://www.mandiant.com/resources/pe-file-infecting-malware-ot - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SamoRAT
According to PCrisk, SamoRAT is a Remote Access Trojan (RAT), a type of malware that allows the cyber criminals responsible to monitor and control the infected computer. In most cases, RATs are used to steal sensitive information and/or install other malware onto the infected computer.
Internal MISP references
UUID e2db8349-7535-4748-96ac-a18985cf66b8 which can be used as unique global reference for SamoRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SamSam
According to PCrisk, Samsam is high-risk ransomware designed to infect unpatched servers and encrypt files stored on computers networked to the infected server.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SamSam.
| Known Synonyms |
|---|
Samas |
Internal MISP references
UUID 696d78cb-1716-4ca0-b678-c03c7cfec19a which can be used as unique global reference for SamSam in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.samsam - webarchive
- https://nakedsecurity.sophos.com/2018/08/02/how-to-defend-yourself-against-samsam-ransomware/ - webarchive
- https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/ - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1 - webarchive
- https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/ - webarchive
- https://www.justice.gov/opa/press-release/file/1114746/download - webarchive
- https://www.secureworks.com/blog/ransomware-deployed-by-adversary - webarchive
- https://news.sophos.com/en-us/2018/11/29/how-a-samsam-like-attack-happens-and-what-you-can-do-about-it/ - webarchive
- https://www.sophos.com/en-us/medialibrary/pdfs/technical-papers/samsam-ransomware-chooses-its-targets-carefully-wpna.aspx - webarchive
- https://news.sophos.com/en-us/2018/07/31/sophoslabs-releases-samsam-ransomware-report/ - webarchive
- https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/ - webarchive
- https://www.justice.gov/opa/pr/two-iranian-men-indicted-deploying-ransomware-extort-hospitals-municipalities-and-public - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf - webarchive
- http://blog.talosintel.com/2016/03/samsam-ransomware.html - webarchive
- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf - webarchive
- http://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html - webarchive
- https://www.secureworks.com/research/samsam-ransomware-campaigns - webarchive
- https://www.youtube.com/watch?v=LUxOcpIRxmg - webarchive
- https://nakedsecurity.sophos.com/2018/09/11/the-rise-of-targeted-ransomware/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-lowell - webarchive
- https://enterprise.verizon.com/resources/reports/2019-data-breach-investigations-report.pdf - webarchive
- https://sites.temple.edu/care/ci-rw-attacks/ - webarchive
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/ - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/ - webarchive
- https://news.sophos.com/en-us/2018/07/31/samsam-guide-to-coverage/ - webarchive
- https://www.secureworks.com/blog/samsam-converting-opportunity-into-profit - webarchive
- https://www.secureworks.com/blog/samas-ransomware - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://nakedsecurity.sophos.com/2018/05/01/samsam-ransomware-a-mean-old-dog-with-a-nasty-new-trick-report/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sanny
Internal MISP references
UUID 34c6504b-e947-49d8-a963-62b7594b7ef9 which can be used as unique global reference for Sanny in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SapphireMiner
Internal MISP references
UUID 32e9c2ce-08a6-47ee-8636-ea83711930b1 which can be used as unique global reference for SapphireMiner in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SapphireStealer
Internal MISP references
UUID e1b2b792-033a-438d-a9c4-4d2adf1abb43 which can be used as unique global reference for SapphireStealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SappyCache
Internal MISP references
UUID 056eca1f-4195-48c3-81d8-ed554dd1de20 which can be used as unique global reference for SappyCache in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sappycache - webarchive
- https://blog.alyac.co.kr/2219 - webarchive
- https://blog.reversinglabs.com/blog/catching-lateral-movement-in-internal-emails - webarchive
- https://www.clearskysec.com/wp-content/uploads/2019/08/ClearSky-2019-H1-Cyber-Events-Summary-Report.pdf - webarchive
- https://blog.alyac.co.kr/m/2219 - webarchive
- https://www.fireeye.com/blog/threat-research/2019/03/winrar-zero-day-abused-in-multiple-campaigns.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sarhust
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sarhust.
| Known Synonyms |
|---|
ENDCMD |
Hussarini |
Internal MISP references
UUID 5aed5403-9c52-4de6-9c8d-d29e5197ef7e which can be used as unique global reference for Sarhust in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sarhust - webarchive
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/bkdr_sarhust.a - webarchive
- https://speakerdeck.com/ashley920/into-the-fog-the-return-of-icefog-apt - webarchive
- https://www.fortinet.com/blog/threat-research/hussarini---targeted-cyber-attack-in-the-philippines.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sasfis
Sasfis acts mostly as a downloader that has been observed to download Asprox and FakeAV. According to a VirusBulletin article from 2012, it is likely authored by the same group as SmokeLoader.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sasfis.
| Known Synonyms |
|---|
Oficla |
Internal MISP references
UUID 4c4ceb45-b326-45aa-8f1a-1229e90c78b4 which can be used as unique global reference for Sasfis in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sasfis - webarchive
- https://www.virusbulletin.com/virusbulletin/2012/11/tracking-2012-sasfis-campaign - webarchive
- https://www.symantec.com/security-center/writeup/2010-020210-5440-99 - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/sasfis-malware-uses-a-new-trick/ - webarchive
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/sasfis - webarchive
- https://isc.sans.edu/forums/diary/Sasfis+Propagation/8860/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/sasfis-fizzles-in-the-background/ - webarchive
- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sasfis-O/detailed-analysis.aspx - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Satacom
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Satacom.
| Known Synonyms |
|---|
LegionLoader |
Internal MISP references
UUID b08af3b5-2453-4d4b-972a-32e6602410f2 which can be used as unique global reference for Satacom in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Satan
Ransomware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Satan.
| Known Synonyms |
|---|
5ss5c |
DBGer |
Lucky Ransomware |
Internal MISP references
UUID 5639f7db-ab70-4b86-8a2f-9c4e3927ba91 which can be used as unique global reference for Satan in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.satan - webarchive
- https://www.sangfor.com/source/blog-network-security/1094.html - webarchive
- https://www.alienvault.com/blogs/labs-research/satan-ransomware-spawns-new-methods-to-spread - webarchive
- https://cyware.com/news/new-satan-ransomware-variant-lucky-exposes-10-server-side-vulnerabilities-070afbd2 - webarchive
- http://blog.nsfocusglobal.com/categories/trend-analysis/satan-variant-analysis-handling-guide/ - webarchive
- https://www.bleepingcomputer.com/news/security/dbger-ransomware-uses-eternalblue-and-mimikatz-to-spread-across-networks/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-satan-ransomware-available-through-a-ransomware-as-a-service-/ - webarchive
- https://bartblaze.blogspot.com/2018/04/satan-ransomware-adds-eternalblue.html - webarchive
- https://bartblaze.blogspot.com/2020/01/satan-ransomware-rebrands-as-5ss5c.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Satana
According to bitdefender, Satana is an aggressive ransomware for Windows that encrypts the computer’s master boot record (MBR) and prevents it from starting.
Internal MISP references
UUID 09b555be-8bac-44b2-8741-922ee0b87880 which can be used as unique global reference for Satana in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Satellite Turla
Internal MISP references
UUID 957f6c4a-c750-4ba3-820f-5a19d444a57a which can be used as unique global reference for Satellite Turla in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.satellite_turla - webarchive
- https://nsarchive.gwu.edu/sites/default/files/documents/3921357/Government-of-Canada-Hackers-are-Humans-Too.pdf - webarchive
- https://securelist.com/satellite-turla-apt-command-and-control-in-the-sky/72081/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sathurbot
Internal MISP references
UUID bdc7cc9c-c46d-4f77-b903-2335cc1a3369 which can be used as unique global reference for Sathurbot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sathurbot - webarchive
- https://www.virusbulletin.com/virusbulletin/2020/01/vb2019-paper-rich-headers-leveraging-mysterious-artifact-pe-format/ - webarchive
- https://www.welivesecurity.com/2017/04/06/sathurbot-distributed-wordpress-password-attack/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ScanPOS
Internal MISP references
UUID e3adbb0d-6d6e-4686-8108-ee76452339bf which can be used as unique global reference for ScanPOS in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.scanpos - webarchive
- https://github.com/malware-kitten/securitykitten.github.io/blob/master/_posts/2016-11-15-scanpos.md - webarchive
- https://securitykitten.github.io/2016/11/15/scanpos.html - webarchive
- https://www.proofpoint.com/us/threat-insight/post/kronos-banking-trojan-used-to-deliver-new-point-of-sale-malware - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Scarabey
Ransomware with ransomnote in Russian and encryption extension .scarab.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Scarabey.
| Known Synonyms |
|---|
MVP |
Scarab |
Scarab-Russian |
Internal MISP references
UUID 76d20f49-9367-4d36-95d2-7ef8ff55568d which can be used as unique global reference for Scarabey in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Scarab Ransomware
Internal MISP references
UUID c1ccba65-e2f0-4f29-8e04-6b119c7f8694 which can be used as unique global reference for Scarab Ransomware in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.scarab_ransom - webarchive
- https://securelist.com/story-of-the-year-2019-cities-under-ransomware-siege/95456/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf - webarchive
- http://malware-traffic-analysis.net/2017/11/23/index.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ScareCrow
Based on the leaked Conti source code.
Internal MISP references
UUID 7e8e41de-b3f8-4c2b-a9fe-e1aa6532e76b which can be used as unique global reference for ScareCrow in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Schneiken
Schneiken is a VBS 'Double-dropper'. It comes with two RATs embedded in the code (Dunihi and Ratty). Entire code is Base64 encoded.
Internal MISP references
UUID 92a65c89-acc3-4ee7-8db0-f0ea293ed12d which can be used as unique global reference for Schneiken in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Scieron
The Chinese threat actor has used a custom backdoor dubbed "Scieron" over years in several campaigns according to SentinelLABS.
Internal MISP references
UUID e343583b-8338-42ea-af60-311578146151 which can be used as unique global reference for Scieron in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.scieron - webarchive
- https://www.sentinelone.com/labs/chinese-threat-actor-scarab-targeting-ukraine/ - webarchive
- https://inquest.net/blog/2022/04/07/ukraine-cyberwar-overview - webarchive
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=8bfa7311-fdd9-4f8d-b813-1ab6c9d2c363 - webarchive
- https://www.sentinelone.com/labs/chinese-threat-actor-scarab-targeting-ukraine - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Scote
Internal MISP references
UUID 8c764bd6-2c6e-4cb2-93e3-f805cd99fe1e which can be used as unique global reference for Scote in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Scout
A downloader that uses Windows messages to control its execution flow.
Internal MISP references
UUID ca16e8fa-5a86-48be-82ca-40a666b8692b which can be used as unique global reference for Scout in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Scranos
Internal MISP references
UUID b5d90140-f307-402c-9d7f-9cdf21a7cb31 which can be used as unique global reference for Scranos in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.scranos - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/271/Bitdefender-Whitepaper-Scranos-2.pdf - webarchive
- https://labs.bitdefender.com/2019/04/inside-scranos-a-cross-platform-rootkit-enabled-spyware-operation/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ScreenCap
SentinelOne describes this malware as capable of doing screen capture and keylogging. It is uses by a threat cluster they named WIP19, targeting telecommunications and IT service providers in the Middle East and Asia.
Internal MISP references
UUID cba2db46-268c-4203-a982-3bf9985c91a4 which can be used as unique global reference for ScreenCap in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ScreenLocker
Internal MISP references
UUID 9803b201-28e5-40c5-b661-c1a191388072 which can be used as unique global reference for ScreenLocker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ScrubCrypt
ScrubCrypt is the rebranded "Jlaive" crypter, with a unique capability of .BAT packing
Internal MISP references
UUID 6f597339-7eac-4885-b888-bf8a81bca7b3 which can be used as unique global reference for ScrubCrypt in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.scrubcrypter - webarchive
- https://perception-point.io/blog/the-rebranded-crypter-scrubcrypt/ - webarchive
- https://0xtoxin.github.io/threat%20breakdown/ScrubCrypt-Rebirth-Of-Jlaive/ - webarchive
- https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/scrubcrypt-the-rebirth-of-jlaive - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SDBbot
Internal MISP references
UUID 48bbf0b7-d8c3-4ddb-8498-cf8e72b210d8 which can be used as unique global reference for SDBbot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sdbbot - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/ - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf - webarchive
- https://blog.fox-it.com/2020/11/16/ta505-a-brief-history-of-their-time/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-tahoe - webarchive
- https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader - webarchive
- https://www.fsec.or.kr/common/proc/fsec/bbs/163/fileDownLoad/2297.do - webarchive
- https://www.telekom.com/en/blog/group/article/cybersecurity-ta505-returns-with-a-new-bag-of-tricks-602104 - webarchive
- https://github.com/Tera0017/SDBbot-Unpacker - webarchive
- https://www.telekom.com/en/blog/group/article/eager-beaver-a-short-overview-of-the-restless-threat-actor-ta505-609546 - webarchive
- https://www.telekom.com/en/blog/group/article/cybersecurity-ta505-s-box-of-chocolate-597672 - webarchive
- https://vblocalhost.com/uploads/VB2020-Jung.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://www.cyber.gov.au/acsc/view-all-content/alerts/sdbbot-targeting-health-sector - webarchive
- https://www.telekom.com/en/blog/group/article/inside-of-cl0p-s-ransomware-operation-615824 - webarchive
- https://global.ahnlab.com/global/upload/download/asecreport/ASEC%20REPORT_vol.96_ENG.pdf - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SEADADDY
Backdoor written in Python 2, deployed with PyInstaller.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SEADADDY.
| Known Synonyms |
|---|
SeaDuke |
Seadask |
Internal MISP references
UUID 1d07212e-6292-40a4-a5e9-30aef83b6207 which can be used as unique global reference for SEADADDY in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.seadaddy - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/python-malware-on-the-rise/ - webarchive
- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ - webarchive
- https://unit42.paloaltonetworks.com/unit-42-technical-analysis-seaduke/ - webarchive
- https://contagiodump.blogspot.de/2017/02/russian-apt-apt28-collection-of-samples.html - webarchive
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=6ab66701-25d7-4685-ae9d-93d63708a11c&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SeaSalt
Internal MISP references
UUID d66f466a-e70e-4b62-9a04-d62eb41da15c which can be used as unique global reference for SeaSalt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SectopRAT
SectopRAT, aka ArechClient2, is a .NET RAT with numerous capabilities including multiple stealth functions. Arechclient2 can profile victim systems, steal information such as browser and crypto-wallet data, and launch a hidden secondary desktop to control browser sessions. Additionally, it has several anti-VM and anti-emulator capabilities.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SectopRAT.
| Known Synonyms |
|---|
1xxbot |
ArechClient |
Internal MISP references
UUID a7e3b468-399c-419c-87d5-4efcea8ec0cc which can be used as unique global reference for SectopRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sectop_rat - webarchive
- https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/ - webarchive
- https://cyberflorida.org/2022/11/arechclient2/ - webarchive
- https://cdn-production.blackpointcyber.com/wp-content/uploads/2022/11/01161208/Blackpoint-Cyber-Ratting-out-Arechclient2-Whitepaper.pdf - webarchive
- https://www.cisecurity.org/insights/blog/top-10-malware-march-2022 - webarchive
- https://vxhive.blogspot.com/2021/01/deep-dive-into-sectoprat.html - webarchive
- https://dr4k0nia.github.io/posts/Analysing-a-sample-of-ArechClient2/ - webarchive
- https://www.gdatasoftware.com/blog/2019/11/35548-new-sectoprat-remote-access-malware-utilizes-second-desktop-to-control-browsers - webarchive
- https://tampabay.tech/2022/11/30/arechclient2/ - webarchive
- https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks - webarchive
- https://medium.com/@gi7w0rm/a-long-way-to-sectoprat-eb2f0aad6ec8 - webarchive
- https://www.gdatasoftware.com/blog/2021/02/36633-new-version-adds-encrypted-communication - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SeDll
Internal MISP references
UUID 272268bb-2715-476b-a121-49142581c559 which can be used as unique global reference for SeDll in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sedll - webarchive
- https://www.recordedfuture.com/chinese-threat-actor-tempperiscope/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-mohawk - webarchive
- https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sedreco
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sedreco.
| Known Synonyms |
|---|
azzy |
eviltoss |
Internal MISP references
UUID 21ab9e14-602a-4a76-a308-dbf5d6a91d75 which can be used as unique global reference for Sedreco in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sedreco - webarchive
- http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf - webarchive
- https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf - webarchive
- http://www.malware-reversing.com/2012/12/3-disclosure-of-another-0day-malware_15.html - webarchive
- https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/ - webarchive
- https://contagiodump.blogspot.de/2017/02/russian-apt-apt28-collection-of-samples.html - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-twilight - webarchive
- https://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-pawn-storm.pdf - webarchive
- https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/ - webarchive
- http://www2.fireeye.com/rs/fireye/images/rpt-apt28.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Seduploader
simple tool to facilitate download and persistence of a next-stage tool; collects system information and metadata probably in an attempt to tell sandbox-environments apart from real targets on the server-side; uses domains of search engines like Google to check for Internet connectivity; XOR-based string obfuscation with a 16-byte key
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Seduploader.
| Known Synonyms |
|---|
GAMEFISH |
carberplike |
downrage |
jhuhugit |
jkeyskw |
Internal MISP references
UUID 6bd20349-1231-4aaa-ba2a-f4b09d3b344c which can be used as unique global reference for Seduploader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.seduploader - webarchive
- https://blog.yoroi.company/research/apt28-and-upcoming-elections-possible-interference-signals-part-ii/ - webarchive
- https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf - webarchive
- http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html - webarchive
- https://www.emanueledelucia.net/apt28-sofacy-seduploader-under-the-christmas-tree/ - webarchive
- https://www.welivesecurity.com/2017/05/09/sednit-adds-two-zero-day-exploits-using-trumps-attack-syria-decoy/ - webarchive
- https://researchcenter.paloaltonetworks.com/2016/06/unit42-new-sofacy-attacks-against-us-government-agency/ - webarchive
- https://symantec-blogs.broadcom.com/blogs/election-security/apt28-espionage-military-government - webarchive
- https://www.fireeye.com/blog/threat-research/2017/08/apt28-targets-hospitality-sector.html - webarchive
- http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf - webarchive
- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ - webarchive
- https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/ - webarchive
- https://blog.xpnsec.com/apt28-hospitality-malware-part-2/ - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/ - webarchive
- http://www.welivesecurity.com/2015/07/10/sednit-apt-group-meets-hacking-team/ - webarchive
- https://securelist.com/a-slice-of-2017-sofacy-activity/83930/ - webarchive
- https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/ - webarchive
- https://contagiodump.blogspot.de/2017/02/russian-apt-apt28-collection-of-samples.html - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-twilight - webarchive
- https://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-pawn-storm.pdf - webarchive
- https://www.proofpoint.com/us/threat-insight/post/apt28-racing-exploit-cve-2017-11292-flash-vulnerability-patches-are-deployed - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
seinup
Internal MISP references
UUID 9789dfe8-d156-4f19-8177-25718dd14f1f which can be used as unique global reference for seinup in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sekhmet
According to PCrisk, Sekhmet is ransomware. This malicious program operates by encrypting data and demanding ransom payments for decryption. During the encryption process, all affected files are appended with an extension, consisting of random characters (e.g. ".HrUSsw", ".WNgh", ".NdWfEr", etc.).
Internal MISP references
UUID b4b4e8c8-fc66-4618-ba35-75f21d7d6922 which can be used as unique global reference for Sekhmet in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sekhmet - webarchive
- https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/ - webarchive
- https://blog.minerva-labs.com/egregor-ransomware-an-in-depth-analysis - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/ - webarchive
- https://id-ransomware.blogspot.com/2020/03/sekhmet-ransomware.html - webarchive
- https://www.bleepingcomputer.com/news/security/ransomware-dev-releases-egregor-maze-master-decryption-keys/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/ - webarchive
- https://securityaffairs.co/wordpress/127826/malware/egregor-sekhmet-decryption-keys.html - webarchive
- https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-007/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SelfMake Loader
Internal MISP references
UUID 2ef98145-45b8-4acf-ba28-71f495581387 which can be used as unique global reference for SelfMake Loader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SendSafe
Internal MISP references
UUID 503ca41c-7788-477c-869b-ac530f20c490 which can be used as unique global reference for SendSafe in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SepSys
Ransomware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SepSys.
| Known Synonyms |
|---|
Silvertor Ransomware |
Internal MISP references
UUID 08f37434-4aba-439f-afae-fed61f411ac4 which can be used as unique global reference for SepSys in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sepulcher
Internal MISP references
UUID 6025475a-b89d-401d-882d-50fe1b03154f which can be used as unique global reference for Sepulcher in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sepulcher - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/chinese-apt-ta413-resumes-targeting-tibet-following-covid-19-themed-economic - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/ta413-leverages-new-friarfox-browser-extension-target-gmail-accounts-global - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SerialVlogger
This malware is protected using VMProtect and related to the loading of KEYPLUG.
Internal MISP references
UUID 0592daf4-5f68-4087-ad4e-efe773009ca6 which can be used as unique global reference for SerialVlogger in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Serpent Stealer
Internal MISP references
UUID 446f7e21-f4d0-4725-b1fb-254b090c3e4f which can be used as unique global reference for Serpent Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Serpico
Internal MISP references
UUID 0d4ca924-7e7e-4385-b14d-f504b4d206e5 which can be used as unique global reference for Serpico in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ServHelper
ServHelper is written in Delphi and according to ProofPoint best classified as a backdoor.
ProofPoint noticed two distinct variant - "tunnel" and "downloader" (citation): "The 'tunnel' variant has more features and focuses on setting up reverse SSH tunnels to allow the threat actor to access the infected host via Remote Desktop Protocol (RDP). Once ServHelper establishes remote desktop access, the malware contains functionality for the threat actor to 'hijack' legitimate user accounts or their web browser profiles and use them as they see fit. The 'downloader' variant is stripped of the tunneling and hijacking functionality and is used as a basic downloader."
Internal MISP references
UUID cebfa7af-8c31-4dda-8373-82893c7f43f4 which can be used as unique global reference for ServHelper in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.servhelper - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://ti.360.net/blog/articles/excel-4.0-macro-utilized-by-ta505-to-target-financial-institutions-recently-en/ - webarchive
- https://www.binarydefense.com/an-updated-servhelper-tunnel-variant/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf - webarchive
- https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/research/servhelper-evolution-and-new-ta505-campaigns/ - webarchive
- https://www.deepinstinct.com/2019/04/02/new-servhelper-variant-employs-excel-4-0-macro-to-drop-signed-payload/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505 - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/operation-ta505-part2/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-tahoe - webarchive
- https://blog.talosintelligence.com/2021/08/raccoon-and-amadey-install-servhelper.html - webarchive
- https://www.gdatasoftware.com/blog/2020/07/36122-hidden-miners - webarchive
- https://insights.oem.avira.com/ta505-apt-group-targets-americas/ - webarchive
- https://www.prodaft.com/m/reports/TeslaGun_TLPWHITE.pdf - webarchive
- https://prodaft.com/m/reports/TeslaGun_TLPWHITE.pdf - webarchive
- https://securitynews.sonicwall.com/xmlpost/servhelper-2-0-enriched-with-bot-capabilities-and-allow-remote-desktop-access/ - webarchive
- https://e.cyberint.com/hubfs/Report%20Legit%20Remote%20Access%20Tools%20Turn%20Into%20Threat%20Actors%20Tools/CyberInt_Legit%20Remote%20Access%20Tools%20Turn%20Into%20Threat%20Actors'%20Tools_Report.pdf - webarchive
- https://medium.com/walmartglobaltech/ta505-adds-golang-crypter-for-delivering-miners-and-servhelper-af70b26a6e56 - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware - webarchive
- https://threatrecon.nshc.net/2019/08/29/sectorj04-groups-increased-activity-in-2019/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/ta505-at-it-again-variety-is-the-spice-of-servhelper-and-flawedammyy/ - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SessionManager
A malicious IIS module that allows up/download of files, remote command execution, and using the compromised server as a hop into the network behind.
Internal MISP references
UUID 2ed6f7dc-32ba-4799-87b6-8867e8182cec which can be used as unique global reference for SessionManager in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sfile
Ransomware
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sfile.
| Known Synonyms |
|---|
Escal |
Morseop |
Internal MISP references
UUID 6899dd08-a94b-4e76-813e-1b8437d23aa4 which can be used as unique global reference for Sfile in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sfile - webarchive
- https://id-ransomware.blogspot.com/2020/02/sfile2-ransomware.html - webarchive
- https://www.sentinelone.com/blog/from-the-front-lines-another-rebrand-mindware-and-sfile-ransomware-technical-breakdown/ - webarchive
- https://twitter.com/GrujaRS/status/1296856836944076802?s=20 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
shadowhammer
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular shadowhammer.
| Known Synonyms |
|---|
DAYJOB |
Internal MISP references
UUID 51728278-a95c-45a5-9ae0-9897d41d0efb which can be used as unique global reference for shadowhammer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.shadowhammer - webarchive
- https://mauronz.github.io/shadowhammer-backdoor - webarchive
- https://norfolkinfosec.com/the-first-stage-of-shadowhammer/ - webarchive
- https://blog.reversinglabs.com/blog/forging-the-shadowhammer - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://www.trendmicro.com/en_us/research/19/d/analyzing-c-c-runtime-library-code-tampering-in-software-supply-chain-attacks.html - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Winnti.pdf - webarchive
- https://www.vkremez.com/2019/03/lets-learn-dissecting-operation.html - webarchive
- https://countercept.com/blog/analysis-shadowhammer-asus-attack-first-stage-payload/ - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://skylightcyber.com/2019/03/28/unleash-the-hash-shadowhammer-mac-list/ - webarchive
- https://norfolkinfosec.com/possible-shadowhammer-targeting-low-confidence/ - webarchive
- https://www.youtube.com/watch?v=T5wPwvLrBYU - webarchive
- https://blog.f-secure.com/a-hammer-lurking-in-the-shadows/ - webarchive
- https://securelist.com/operation-shadowhammer/89992/ - webarchive
- https://securelist.com/operation-shadowhammer-a-high-profile-supply-chain-attack/90380/ - webarchive
- https://labsblog.f-secure.com/2019/03/29/a-hammer-lurking-in-the-shadows - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ShadowPad
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ShadowPad.
| Known Synonyms |
|---|
POISONPLUG.SHADOW |
XShellGhost |
Internal MISP references
UUID e089e945-a523-4d11-a135-396f9b6c1dc7 which can be used as unique global reference for ShadowPad in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.shadowpad - webarchive
- https://medium.com/insomniacs/its-a-bee-it-s-a-no-it-s-shadowpad-aff6a970a1c2 - webarchive
- https://therecord.media/redecho-group-parks-domains-after-public-exposure/ - webarchive
- https://www.youtube.com/watch?v=IRh6R8o1Q7U - webarchive
- https://attack.mitre.org/groups/G0096 - webarchive
- https://speakerdeck.com/aragorntseng/winnti-is-coming-evolution-after-prosecution-at-hitcon2021 - webarchive
- https://www.youtube.com/watch?v=55kaaMGBARM - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/critical-infrastructure-attacks - webarchive
- https://www.crowdstrike.com/blog/adversaries-targeting-the-manufacturing-industry/ - webarchive
- https://www.welivesecurity.com/2020/01/31/winnti-group-targeting-universities-hong-kong/ - webarchive
- https://ics-cert.kaspersky.com/publications/reports/2022/06/27/attacks-on-industrial-control-systems-using-shadowpad/ - webarchive
- https://www.theregister.com/2022/04/08/china_sponsored_attacks_india_ukraine/ - webarchive
- https://research.nccgroup.com/2022/09/30/a-glimpse-into-the-shadowy-realm-of-a-chinese-apt-detailed-analysis-of-a-shadowpad-intrusion/ - webarchive
- https://www.trendmicro.com/en_us/research/23/g/supply-chain-attack-targeting-pakistani-government-delivers-shad.html - webarchive
- https://thehackernews.com/2022/02/researchers-link-shadowpad-malware.html - webarchive
- https://www.elastic.co/security-labs/update-to-the-REF2924-intrusion-set-and-related-campaigns - webarchive
- https://community.riskiq.com/article/d8b749f2 - webarchive
- https://labs.sentinelone.com/shadowpad-a-masterpiece-of-privately-sold-malware-in-chinese-espionage/ - webarchive
- https://www.ic3.gov/Media/News/2021/211220.pdf - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/research/chasing-shadows.html - webarchive
- https://www.recordedfuture.com/continued-targeting-of-indian-power-grid-assets/ - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Winnti.pdf - webarchive
- https://securelist.com/shadowpad-in-corporate-networks/81432/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0808.pdf - webarchive
- https://www.sentinelone.com/labs/moshen-dragons-triad-and-error-approach-abusing-security-software-to-sideload-plugx-and-shadowpad/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf - webarchive
- https://conference.hitb.org/hitbsecconf2021sin/materials/D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf - webarchive
- https://www.recordedfuture.com/redecho-targeting-indian-power-sector/ - webarchive
- https://hub.dragos.com/hubfs/333%20Year%20in%20Review/2021/2021%20ICS%20OT%20Cybersecurity%20Year%20In%20Review%20-%20Dragos%202021.pdf - webarchive
- https://securelist.com/operation-shadowhammer-a-high-profile-supply-chain-attack/90380/ - webarchive
- https://www.youtube.com/watch?v=r1zAVX_HnJg - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2022/slides/VB2022-Tracking-the-entire-iceberg.pdf - webarchive
- https://go.recordedfuture.com/hubfs/reports/ta-2022-0406.pdf - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ - webarchive
- https://www.trendmicro.com/en_us/research/19/d/analyzing-c-c-runtime-library-code-tampering-in-software-supply-chain-attacks.html - webarchive
- https://www.welivesecurity.com/2022/09/06/worok-big-picture/ - webarchive
- https://www.sentinelone.com/wp-content/uploads/2021/08/SentinelOne_-SentinelLabs_ShadowPad_WP_V2.pdf - webarchive
- https://www.ptsecurity.com/upload/corporate/ww-en/pt-esc/winnti-2020-eng.pdf - webarchive
- https://st.drweb.com/static/new-www/news/2020/october/Study_of_the_ShadowPad_APT_backdoor_and_its_relation_to_PlugX_en.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/apt41-indictments-china-espionage - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2022/papers/VB2022-Tracking-the-entire-iceberg-long-term-APT-malware-C2-protocol-emulation-and-scanning.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf - webarchive
- https://hello.global.ntt/-/media/ntt/global/insights/white-papers/the-operations-of-winnti-group.pdf - webarchive
- https://www.youtube.com/watch?v=_fstHQSK-kk - webarchive
- https://www.welivesecurity.com/2020/12/10/luckymouse-ta428-compromise-able-desktop/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/ - webarchive
- https://cdn.securelist.com/files/2017/08/ShadowPad_technical_description_PDF.pdf - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://www.recordedfuture.com/chinese-group-tag-22-targets-nepal-philippines-taiwan/ - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lancefly-merdoor-zxshell-custom-backdoor - webarchive
- https://www.ptsecurity.com/upload/corporate/ru-ru/pt-esc/winnti-2020-rus.pdf - webarchive
- https://www.secureworks.com/research/shadowpad-malware-analysis - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments - webarchive
- https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf - webarchive
- https://www.ptsecurity.com/upload/corporate/ru-ru/webinars/ics/winnti-shadowpad.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Shakti
Internal MISP references
UUID f64683c8-50ab-42c0-8b90-881598906528 which can be used as unique global reference for Shakti in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SHAPESHIFT
Internal MISP references
UUID 15dd8386-f11a-485a-b719-440c0a47dee6 which can be used as unique global reference for SHAPESHIFT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
shareip
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular shareip.
| Known Synonyms |
|---|
remotecmd |
Internal MISP references
UUID 6f9ed0b0-63c8-4f51-8425-17cfc2b3c12e which can be used as unique global reference for shareip in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Shark
Internal MISP references
UUID d00c8f94-d6b5-40b7-b167-fc546c5dec38 which can be used as unique global reference for Shark in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SharpBeacon
.NET reimplementation of Cobalt Strike beacon/stager
Internal MISP references
UUID 12c0e80c-c439-4eaf-9272-f78b16010313 which can be used as unique global reference for SharpBeacon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SHARPKNOT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SHARPKNOT.
| Known Synonyms |
|---|
Bitrep |
Internal MISP references
UUID d31f1c73-d14b-41e2-bb16-81ee1d886e43 which can be used as unique global reference for SHARPKNOT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SharpMapExec
This tool is made to simplify penetration testing of networks and to create a Swiss-army knife that is made for running on Windows which is often a requirement during insider threat simulation engagements.
Internal MISP references
UUID e9940cca-6e3a-45e2-88b7-8fa9ae19c647 which can be used as unique global reference for SharpMapExec in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SharpStage
The SharpStage backdoor is a .NET malware with backdoor capabilities. Its name is a derivative of the main activity class called “Stage_One”. SharpStage can take screenshots, run arbitrary commands and downloads additional payloads. It exfiltrates data from the infected machine to a dropbox account by implementing a dropbox client in its code. SharpStage was seen used by the Molerats group in targeted attacks in the middle east.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SharpStage.
| Known Synonyms |
|---|
LastConn |
Internal MISP references
UUID 11788d9b-485b-4049-ba5e-1b06d526361e which can be used as unique global reference for SharpStage in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sharpstage - webarchive
- https://www.0ffset.net/reverse-engineering/malware-analysis/molerats-string-decryption/ - webarchive
- https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf - webarchive
- https://www.cybereason.com/blog/new-malware-arsenal-abusing-cloud-platforms-in-middle-east-espionage-campaign - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SHARPSTATS
Internal MISP references
UUID 819fd946-ed0e-4cec-ad45-66b88e39b732 which can be used as unique global reference for SHARPSTATS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ShellClient RAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ShellClient RAT.
| Known Synonyms |
|---|
GhostShell |
Internal MISP references
UUID f91adcf2-10ce-4ea3-bfae-ea6e270d56f0 which can be used as unique global reference for ShellClient RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.shellclient - webarchive
- https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms - webarchive
- https://www.microsoft.com/security/blog/2021/11/18/iranian-targeting-of-it-sector-on-the-rise/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ShellLocker
PCRIsk states that ShellLocker is a ransomware-type virus developed using .NET framework. It was first discovered by Jakub Kroustek and is virtually identical to another ransomware virus called Exotic.
Following infiltration, this virus encrypts stored data (video, audio, etc.) and renames encrypted files using the "[random_characters].L0cked" pattern (e.g., "sample.jpg" might be renamed to "gd&=AA0fgoi.L0cked"). Following successful encryption, ShellLocker opens a pop-up window containing ransom-demand message.
Internal MISP references
UUID af35e295-7087-4f6c-9f70-a431bf223822 which can be used as unique global reference for ShellLocker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Shifu
Shifu was originally discovered by Trusteer security researchers (Ilya Kolmanovich, Denis Laskov) in the middle of 2015. It is a banking trojan mostly focusing on Japanese banks and has rich features for remote data extraction and control.
Internal MISP references
UUID 6e668c0c-7085-4951-87d4-0334b6a5cdb3 which can be used as unique global reference for Shifu in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.shifu - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://www.virusbulletin.com/virusbulletin/2015/11/shifu-rise-self-destructive-banking-trojan - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- http://researchcenter.paloaltonetworks.com/2017/01/unit42-2016-updates-shifu-banking-trojan/ - webarchive
- https://securityintelligence.com/shifu-masterful-new-banking-trojan-is-attacking-14-japanese-banks/ - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Shim RAT
Internal MISP references
UUID 67fc358f-da6a-4f01-be23-44bc97319127 which can be used as unique global reference for Shim RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SHIPSHAPE
SHIPSHAPE is malware developed by APT30 that allows propagation and exfiltration of data over removable devices. APT30 may use this capability to exfiltrate data across air-gaps.
Internal MISP references
UUID 07470989-faac-44fb-b505-1d5568b3c716 which can be used as unique global reference for SHIPSHAPE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Shujin
Internal MISP references
UUID 77c20bd9-5403-4f99-bae5-c54f3f38a6b6 which can be used as unique global reference for Shujin in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Shurl0ckr
Internal MISP references
UUID f544ee0e-26f4-48e7-aaee-056f4d1ced82 which can be used as unique global reference for Shurl0ckr in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Shylock
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Shylock.
| Known Synonyms |
|---|
Caphaw |
Internal MISP references
UUID 515ee69a-298a-4fcf-bdb0-c5fc6d41872f which can be used as unique global reference for Shylock in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.shylock - webarchive
- https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree - webarchive
- https://www.zscaler.com/blogs/security-research/new-wave-win32caphaw-attacks-threatlabz-analysis - webarchive
- https://web.archive.org/web/20141016080249/http://www.symantec.com/connect/blogs/security-vendors-take-action-against-hidden-lynx-malware - webarchive
- https://securityintelligence.com/merchant-of-fraud-returns-shylock-polymorphic-financial-malware-infections-on-the-rise/ - webarchive
- https://www.europol.europa.eu/newsroom/news/global-action-targeting-shylock-malware - webarchive
- https://www.virusbulletin.com/virusbulletin/2015/02/paper-pluginer-caphaw - webarchive
- https://malwarereversing.wordpress.com/2011/09/27/debugging-injected-code-with-ida-pro/ - webarchive
- https://www.welivesecurity.com/2013/02/25/caphaw-attacking-major-european-banks-with-webinject-plugin/ - webarchive
- https://securityintelligence.com/shylocks-new-trick-evading-malware-researchers/ - webarchive
- http://contagiodump.blogspot.com/2011/09/sept-21-greedy-shylock-financial.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SideTwist
Internal MISP references
UUID 3275503c-1f0a-4f6c-b13b-ec4ca2b29786 which can be used as unique global reference for SideTwist in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SideWalk (Windows)
Shellcode-based malware family that according to ESET Research was likely written by the same authors as win.crosswalk.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SideWalk (Windows).
| Known Synonyms |
|---|
ScrambleCross |
Internal MISP references
UUID 497d1e0f-dd0c-4462-b3e2-fb4a22f8333f which can be used as unique global reference for SideWalk (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sidewalk - webarchive
- https://www.welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/grayfly-china-sidewalk-malware - webarchive
- https://documents.trendmicro.com/assets/white_papers/wp-earth-baku-an-apt-group-targeting-indo-pacific-countries.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SideWinder (Windows)
Internal MISP references
UUID 3c43bd4c-8c40-47b5-ae97-3dd0f0c0e8d8 which can be used as unique global reference for SideWinder (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sidewinder - webarchive
- https://s.tencent.com/research/report/479.html - webarchive
- https://medium.com/@Sebdraven/apt-sidewinder-tricks-powershell-anti-forensics-and-execution-side-loading-5bc1a7e7c84c - webarchive
- https://www.trendmicro.com/en_us/research/20/l/sidewinder-leverages-south-asian-territorial-issues-for-spear-ph.html - webarchive
- https://otx.alienvault.com/pulse/5fd10760f9afb730d37c4742/ - webarchive
- https://s.tencent.com/research/report/659.html - webarchive
- https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf - webarchive
- https://medium.com/@DCSO_CyTec/404-file-still-found-d52c3834084c - webarchive
- https://ti.qianxin.com/blog/articles/the-recent-rattlesnake-apt-organized-attacks-on-neighboring-countries-and-regions/ - webarchive
- https://www.secrss.com/articles/26507 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SiennaBlue
Ransomware used by threat actor group DEV-0530, attributed by MSTIC to North Korean origin.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SiennaBlue.
| Known Synonyms |
|---|
H0lyGh0st |
HolyLocker |
Internal MISP references
UUID 607ba366-85fa-406f-adef-6ea7b437b39c which can be used as unique global reference for SiennaBlue in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sienna_blue - webarchive
- https://media.defense.gov/2023/Feb/09/2003159161/-1/-1/0/CSA_RANSOMWARE_ATTACKS_ON_CI_FUND_DPRK_ACTIVITIES.PDF - webarchive
- https://blogs.blackberry.com/en/2022/08/h0lygh0st-ransomware - webarchive
- https://www.microsoft.com/security/blog/2022/07/14/north-korean-threat-actor-targets-small-and-midsize-businesses-with-h0lygh0st-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SiennaPurple
Ransomware used by threat actor group DEV-0530, attributed by MSTIC to North Korean origin.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SiennaPurple.
| Known Synonyms |
|---|
H0lyGh0st |
HolyLocker |
Internal MISP references
UUID 5ae172d0-5742-4c4b-8847-2efaf9dfb121 which can be used as unique global reference for SiennaPurple in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sienna_purple - webarchive
- https://media.defense.gov/2023/Feb/09/2003159161/-1/-1/0/CSA_RANSOMWARE_ATTACKS_ON_CI_FUND_DPRK_ACTIVITIES.PDF - webarchive
- https://blogs.blackberry.com/en/2022/08/h0lygh0st-ransomware - webarchive
- https://www.microsoft.com/security/blog/2022/07/14/north-korean-threat-actor-targets-small-and-midsize-businesses-with-h0lygh0st-ransomware/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sierra(Alfa,Bravo, ...)
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sierra(Alfa,Bravo, ...).
| Known Synonyms |
|---|
Destover |
Internal MISP references
UUID da92c927-9b31-48aa-854a-8ed49a29565b which can be used as unique global reference for Sierra(Alfa,Bravo, ...) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sierras - webarchive
- https://web.archive.org/web/20160527050022/https://www.symantec.com/connect/blogs/swift-attackers-malware-linked-more-financial-attacks - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/ - webarchive
- https://www.us-cert.gov/ncas/alerts/TA14-353A - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/ - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://www.symantec.com/connect/blogs/wannacry-ransomware-attacks-show-strong-links-lazarus-group - webarchive
- https://app.box.com/s/xyyord0b806e6or2nh92coxw2areyyx4 - webarchive
- http://baesystemsai.blogspot.de/2016/05/cyber-heist-attribution.html - webarchive
- https://www.symantec.com/connect/blogs/attackers-target-dozens-global-banks-new-malware - webarchive
- https://www.secureworks.com/research/threat-profiles/nickel-academy - webarchive
- https://www.anomali.com/blog/evidence-of-stronger-ties-between-north-korea-and-swift-banking-attacks - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SiestaGraph
Internal MISP references
UUID a4f4464a-a8d6-4244-af0a-4a8163ab9f47 which can be used as unique global reference for SiestaGraph in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.siesta_graph - webarchive
- https://www.elastic.co/security-labs/update-to-the-REF2924-intrusion-set-and-related-campaigns - webarchive
- https://www.elastic.co/de/security-labs/naplistener-more-bad-dreams-from-the-developers-of-siestagraph - webarchive
- https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry - webarchive
- https://www.elastic.co/security-labs/ref2924-howto-maintain-persistence-as-an-advanced-threat - webarchive
- https://x.com/threatintel/status/1701259256199090217 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Siggen6
Internal MISP references
UUID c12b3e30-32bf-4b7e-98f6-6a00e95553f8 which can be used as unique global reference for Siggen6 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SigLoader
Internal MISP references
UUID 48bf4991-4743-404a-aac1-72855b30e225 which can be used as unique global reference for SigLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
sihost
Internal MISP references
UUID c1b6e597-17e6-4485-819e-5aa03904bc61 which can be used as unique global reference for sihost in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Silence
According to PCrisk, Truebot, also known as Silence.Downloader, is a malicious program that has botnet and loader/injector capabilities. This malware can add victims' devices to a botnet and cause chain system infections (i.e., download/install additional malicious programs/components).
There is significant variation in Truebot's infection chains and distribution. It is likely that the attackers using this malicious software will continue to make such changes.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Silence.
| Known Synonyms |
|---|
TrueBot |
Internal MISP references
UUID 0df52c23-690b-4703-83f7-5befc38ab376 which can be used as unique global reference for Silence in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.silence - webarchive
- https://malware.love/malware_analysis/reverse_engineering/2023/03/31/analyzing-truebot-capabilities.html - webarchive
- https://github.com/Tera0017/TAFOF-Unpacker - webarchive
- https://www.youtube.com/watch?v=FttiysUZmDw - webarchive
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/ - webarchive
- http://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive
- https://www.huntress.com/blog/investigating-intrusions-from-intriguing-exploits - webarchive
- http://www.intezer.com/silenceofthemoles/ - webarchive
- https://blogs.vmware.com/security/2023/06/carbon-blacks-truebot-detection.html - webarchive
- https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/using-qiling-framework-to-unpack-ta505-packed-samples/ - webarchive
- https://outpost24.com/blog/using-qiling-framework-to-unpack-ta505-packed-samples/ - webarchive
- https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf - webarchive
- https://www.telekom.com/en/blog/group/article/cybersecurity-ta505-s-box-of-chocolate-597672 - webarchive
- https://malware.love/malware_analysis/reverse_engineering/config_extraction/2023/07/13/truebot-config-extractor.html - webarchive
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-187a - webarchive
- https://norfolkinfosec.com/some-notes-on-the-silence-proxy/ - webarchive
- https://securityintelligence.com/posts/x-force-prevents-zero-day-from-going-anywhere - webarchive
- https://malware.love/malware_analysis/reverse_engineering/2023/02/12/analyzing-truebot-packer.html - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://www.group-ib.com/resources/threat-research/silence.html - webarchive
- https://securelist.com/the-silence/83009/ - webarchive
- https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/ - webarchive
- https://norfolkinfosec.com/how-the-silence-downloader-has-evolved-over-time/ - webarchive
- https://malware.love/malware_analysis/reverse_engineering/2023/02/18/analyzing-truebot-static-unpacking.html - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-004.pdf - webarchive
- https://reaqta.com/2019/01/silence-group-targeting-russian-banks/ - webarchive
- https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf - webarchive
- https://research.loginsoft.com/threat-research/taming-the-storm-understanding-and-mitigating-the-consequences-of-cve-2023-27350/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SILENTUPLOADER
According to Mandiant, SILENTUPLOADER is an uploader written in MSIL that is dropped by DOSTEALER and is designed to work specifically in tandem with it. It checks for files in a specified folder every 30 seconds and uploads them to a remote server.
Internal MISP references
UUID 3ed237f1-35b9-4e74-a37e-966bf023d136 which can be used as unique global reference for SILENTUPLOADER in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Silon
Internal MISP references
UUID b602edb3-81c2-4772-b5f8-73deb85cb40a which can be used as unique global reference for Silon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Siluhdur
Internal MISP references
UUID 774fcb67-1eeb-4bda-9b36-b624b632417a which can be used as unique global reference for Siluhdur in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Simda
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Simda.
| Known Synonyms |
|---|
iBank |
Internal MISP references
UUID 467ee29c-317f-481a-a77c-69961eb88c4d which can be used as unique global reference for Simda in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.simda - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/ - webarchive
- https://secrary.com/ReversingMalware/iBank/ - webarchive
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/ - webarchive
- https://www.youtube.com/watch?v=u2HEGDzd8KM - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/simda-a-botnet-takedown/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SimpleFileMover
Internal MISP references
UUID b56173a1-84e3-4551-ac4a-9e71e65dc9e5 which can be used as unique global reference for SimpleFileMover in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sinowal
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sinowal.
| Known Synonyms |
|---|
Anserin |
Mebroot |
Quarian |
Theola |
Torpig |
Internal MISP references
UUID ad5bcaef-1a86-4cc7-8f2e-32306b995018 which can be used as unique global reference for Sinowal in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sinowal - webarchive
- https://www.virusbulletin.com/virusbulletin/2014/06/sinowal-banking-trojan - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://www.welivesecurity.com/2013/03/13/how-theola-malware-uses-a-chrome-plugin-for-banking-fraud/ - webarchive
- https://www.symantec.com/security_response/writeup.jsp?docid=2008-010718-3448-99&tabid=2 - webarchive
- https://web.archive.org/web/20160616170611/https://media.blackhat.com/bh-eu-10/presentations/Carrera_Silberman/BlackHat-EU-2010-Carrera-Silberman-State-of-Malware-slides.pdf - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://www.recordedfuture.com/turla-apt-infrastructure/ - webarchive
- https://en.wikipedia.org/wiki/Torpig - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/10/20114955/Bartholomew-GuerreroSaade-VB2016.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sisfader
Internal MISP references
UUID 0fba78fc-47a1-45e1-b5df-71bcabd23b5d which can be used as unique global reference for Sisfader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sisfader - webarchive
- https://medium.com/@Sebdraven/gobelin-panda-against-the-bears-1f462d00e3a4 - webarchive
- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/june/cve-2017-8750-rtf-and-the-sisfader-rat/ - webarchive
- https://nao-sec.org/2020/01/an-overhead-view-of-the-royal-road.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Skimer
Internal MISP references
UUID 6d5e558a-e640-49c3-87b9-2c102c334b1b which can be used as unique global reference for Skimer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.skimer - webarchive
- https://documents.trendmicro.com/assets/white_papers/wp-cashing-in-on-atm-malware.pdf - webarchive
- https://blog.talosintelligence.com/2019/05/10-years-of-virtual-dynamite.html - webarchive
- http://atm.cybercrime-tracker.net/index.php - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SkinnyBoy
Internal MISP references
UUID fce8d9c9-7d83-4221-b726-5c49ea271109 which can be used as unique global reference for SkinnyBoy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
skip-2.0
A Microsoft SQL Server backdoor
Internal MISP references
UUID 6a59a639-8070-4c5f-86be-8a2a081cf487 which can be used as unique global reference for skip-2.0 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Skipper
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Skipper.
| Known Synonyms |
|---|
Kotel |
Internal MISP references
UUID fac6313b-8068-429c-93ae-21e8072cf667 which can be used as unique global reference for Skipper in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.skipper - webarchive
- https://blog.telsy.com/following-the-turlas-skipper-over-the-ocean-of-cyber-operations/ - webarchive
- https://www.welivesecurity.com/2020/03/12/tracking-turla-new-backdoor-armenian-watering-holes/ - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-hunter - webarchive
- https://www.welivesecurity.com/2017/06/06/turlas-watering-hole-campaign-updated-firefox-extension-abusing-instagram/ - webarchive
- https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender-Whitepaper-PAC-A4-en_EN1.pdf - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://securelist.com/shedding-skin-turlas-fresh-faces/88069/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://pdfhost.io/v/F0@QElMu2_MacProStorage_2017FinalBitdefenderWhitepaperNetrepserA4en_ENBitdefenderWhitepaperNetrepserA4en_ENindd.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Skyplex
Internal MISP references
UUID 39002a0d-99aa-4568-b110-48f6df1759cd which can be used as unique global reference for Skyplex in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Slam
Ransomware.
Internal MISP references
UUID 400e437d-13b3-44d9-8f75-34f5e82d6c88 which can be used as unique global reference for Slam in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Slave
Internal MISP references
UUID 1f4d8d42-8f31-47f8-b2b7-2d43196de532 which can be used as unique global reference for Slave in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SLICKSHOES
Internal MISP references
UUID a82f80fc-71e8-4dee-8a64-e5cbb4100321 which can be used as unique global reference for SLICKSHOES in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Slingshot
- 2012 first sighted
- Attack vector via compromised Mikrotik routers where victims get infection when they connect to Mikrotik router admin software - Winbox
- 2018 when discovered by Kaspersky Team
Infection Vector - Infected Mikrotik Router > Malicious DLL (IP4.dll) in Router > User connect via winbox > Malicious DLL downloaded on computer
Internal MISP references
UUID d6178858-1244-41cf-aeed-8c6afc1d6846 which can be used as unique global reference for Slingshot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.slingshot - webarchive
- https://s3-eu-west-1.amazonaws.com/khub-media/wp-content/uploads/sites/43/2018/03/09133534/The-Slingshot-APT_report_ENG_final.pdf - webarchive
- https://www.cyberscoop.com/kaspersky-slingshot-isis-operation-socom-five-eyes/ - webarchive
- https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/ - webarchive
- https://securelist.com/apt-slingshot/84312/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sliver
According to VK9 Seecurity, Sliver is a Command and Control (C2) system made for penetration testers, red teams, and advanced persistent threats. It generates implants (slivers) that can run on virtually every architecture out there, and securely manage these connections through a central server. Sliver supports multiple callback protocols including DNS, TCP, and HTTP(S) to make egress simple, even when those pesky blue teams block your domains. You can even have multiple operators (players) simultaneously commanding your sliver army.
Internal MISP references
UUID 654c478e-3c9a-4fd9-a9b7-dd6839f51147 which can be used as unique global reference for Sliver in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sliver - webarchive
- https://intel471.com/blog/malware-before-ransomware-trojan-information-stealer-cobalt-strike - webarchive
- https://team-cymru.com/blog/2022/04/29/sliver-case-study-assessing-common-offensive-security-tools/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://www.telsy.com/download/5900/?uid=b797afdcfb - webarchive
- https://www.first.org/resources/papers/conf2023/FIRSTCON23-TLPCLEAR-Staubmann-Busy-Bees.pptx - webarchive
- https://www.ncsc.gov.uk/files/Advisory%20Further%20TTPs%20associated%20with%20SVR%20cyber%20actors.pdf - webarchive
- https://embee-research.ghost.io/shodan-censys-queries/ - webarchive
- https://github.com/chronicle/GCTI - webarchive
- https://www.team-cymru.com/post/sliver-case-study-assessing-common-offensive-security-tools - webarchive
- https://asec.ahnlab.com/en/56941/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://michaelkoczwara.medium.com/hunting-c2-with-shodan-223ca250d06f - webarchive
- https://research.checkpoint.com/2022/bumblebee-increasing-its-capacity-and-evolving-its-ttps/ - webarchive
- https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks - webarchive
- https://asec.ahnlab.com/en/47088/ - webarchive
- https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
- https://www.immersivelabs.com/blog/detecting-and-decrypting-sliver-c2-a-threat-hunters-guide/ - webarchive
- https://github.com/BishopFox/sliver - webarchive
- https://asec.ahnlab.com/en/55652/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
slnrat
Internal MISP references
UUID 68bb36d3-d078-483d-b559-e0d8da5f45fe which can be used as unique global reference for slnrat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SlothfulMedia
According to MITRE, SLOTHFULMEDIA is a remote access Trojan written in C++ that has been used by an unidentified "sophisticated cyber actor" since at least January 2017. It has been used to target government organizations, defense contractors, universities, and energy companies in Russia, India, Kazakhstan, Kyrgyzstan, Malaysia, Ukraine, and Eastern Europe.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SlothfulMedia.
| Known Synonyms |
|---|
QueenOfClubs |
Internal MISP references
UUID f23d70bc-7de6-49bd-bb69-82518b4d7fca which can be used as unique global reference for SlothfulMedia in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SLUB
Internal MISP references
UUID 1bc01fca-9a1e-4669-bd9d-8dd29416f9c1 which can be used as unique global reference for SLUB in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.slub - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/new-slub-backdoor-uses-github-communicates-via-slack/ - webarchive
- https://documents.trendmicro.com/assets/white_papers/wp-operation-earth-kitsune.pdf - webarchive
- https://www.trendmicro.com/en_us/research/20/j/operation-earth-kitsune-a-dance-of-two-new-backdoors.html - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference_slides/2019/VB2019-LunghiHorejsi.pdf - webarchive
- https://www.trendmicro.com/en_us/research/20/l/who-is-the-threat-actor-behind-operation-earth-kitsune-.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
smac
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular smac.
| Known Synonyms |
|---|
speccom |
Internal MISP references
UUID a8561caf-eb9f-4a02-8277-a898a0a259ae which can be used as unique global reference for smac in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.smac - webarchive
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/Aug.10.The_Italian_Connection_An_analysis_of_exploit_supply_chains_and_digital_quartermasters/HTExploitTelemetry.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-express - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Smackdown
Internal MISP references
UUID 427dcec9-e2b9-44ad-bf58-281b7ba971bb which can be used as unique global reference for Smackdown in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SManager
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SManager.
| Known Synonyms |
|---|
PhantomNet |
Internal MISP references
UUID 1a6a6e4c-3e0e-422b-9840-9c6286dc7b17 which can be used as unique global reference for SManager in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.smanager - webarchive
- https://blog.vincss.net/2021/02/re020-elephantrat-kunming-version-our-latest-discovered-RAT-of-Panda.html - webarchive
- https://0xthreatintel.medium.com/how-to-unpack-smanager-apt-tool-cb5909819214 - webarchive
- https://0xthreatintel.medium.com/reversing-apt-tool-smanager-unpacked-d413a04961c4 - webarchive
- https://blog.vincss.net/2020/12/re018-2-analyzing-new-malware-of-china-panda-hacker-group-used-to-attack-supply-chain-against-vietnam-government-certification-authority.html?m=1 - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://blog.group-ib.com/task - webarchive
- https://blog.vincss.net/2020/12/re017-2-phan-tich-ky-thuat-dong-ma-doc-moi-co-nhieu-dau-hieu-lien-quan-toi-nhom-tin-tac-Panda.html - webarchive
- https://blog.vincss.net/2020/12/re018-1-analyzing-new-malware-of-china-panda-hacker-group-used-to-attack-supply-chain-against-vietnam-government-certification-authority.html - webarchive
- https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/ - webarchive
- https://blog.vincss.net/2020/12/phan-tich-ky-thuat-dong-ma-doc-moi-co-nhieu-dau-hieu-lien-quan-toi-nhom-tin-tac-Panda.html - webarchive
- https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set - webarchive
- https://insight-jp.nttsecurity.com/post/102glv5/pandas-new-arsenal-part-3-smanager - webarchive
- https://www.welivesecurity.com/2020/12/17/operation-signsight-supply-chain-attack-southeast-asia/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SmartEyes
Internal MISP references
UUID 67723f6e-822b-475a-938b-c9114b9aefea which can be used as unique global reference for SmartEyes in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SMAUG
According to PCrisk, Smaug ransomware is available for download on the dark web: it is for sale as Ransomware as a Service (RaaS). Therefore, cyber criminals who purchase it can perform ransomware attacks without having to develop malware of this type. Smaug is designed to encrypt files, rename them and create a ransom message.
Internal MISP references
UUID b81cbf03-8909-4833-badf-4df32c9bf6cb which can be used as unique global reference for SMAUG in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.smaug - webarchive
- https://labs.sentinelone.com/multi-platform-smaug-raas-aims-to-see-off-competitors/ - webarchive
- https://www.anomali.com/blog/anomali-threat-research-releases-first-public-analysis-of-smaug-ransomware-as-a-service - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SMOKEDHAM
According to Mandiant, SMOKEDHAM is dropped through a powershell script that contains the (C#) source code for this backdoor, which is stored in an encrypted variable. The dropper dynamically defines a cmdlet and .NET class for the backdoor, meaning the compiled code is only found in memory.
Internal MISP references
UUID 7547af7d-e4fe-4ee1-8a3d-55981740b78c which can be used as unique global reference for SMOKEDHAM in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.smokedham - webarchive
- https://www.mandiant.com/resources/burrowing-your-way-into-vpns - webarchive
- https://www.mandiant.com/resources/darkside-affiliate-supply-chain-software-compromise - webarchive
- https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SmokeLoader
The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SmokeLoader.
| Known Synonyms |
|---|
Dofoil |
Sharik |
Smoke |
Smoke Loader |
Internal MISP references
UUID ba91d713-c36e-4d98-9fb7-e16496a69eec which can be used as unique global reference for SmokeLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader - webarchive
- https://www.telekom.com/en/blog/group/article/a-new-way-to-encrypt-cc-server-urls-614886 - webarchive
- https://www.bleepingcomputer.com/news/security/new-golang-botnet-empties-windows-users-cryptocurrency-wallets/ - webarchive
- https://www.logpoint.com/en/blog/emerging-threat/defending-against-8base/ - webarchive
- https://www.sentinelone.com/blog/going-deep-a-guide-to-reversing-smoke-loader-malware/ - webarchive
- https://de.darktrace.com/blog/privateloader-network-based-indicators-of-compromise - webarchive
- https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities - webarchive
- http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html - webarchive
- https://m.alvar.es/2020/06/unpacking-smokeloader-and.html - webarchive
- https://securitynews.sonicwall.com/xmlpost/html-application-hta-files-are-being-used-to-distribute-smoke-loader-malware/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/08/smoke-loader-downloader-with-a-smokescreen-still-alive/ - webarchive
- https://www.spamhaus.org/news/article/774/smoke-loader-improves-encryption-after-microsoft-spoils-its-campaign - webarchive
- https://x0r19x91.in/malware-analysis/smokeloader/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/2019-return-retefe - webarchive
- https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries - webarchive
- https://blog.malwarebytes.com/social-engineering/2020/09/malvertising-campaigns-come-back-in-full-swing/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/antisandbox-techniques/ - webarchive
- https://m.alvar.es/2019/10/dynamic-imports-and-working-around.html - webarchive
- https://drive.google.com/file/d/13BsHZn-KVLhwrtgS2yKJAM2_U_XZlwoD/view - webarchive
- https://malwareandstuff.com/examining-smokeloaders-anti-hooking-technique/ - webarchive
- https://medium.com/csis-techblog/gcleaner-garbage-provider-since-2019-2708e7c87a8a - webarchive
- https://malwarebreakdown.com/2017/04/03/shadow-server-domains-leads-to-rig-exploit-kit-dropping-smoke-loader-which-downloads-neutrino-bot-aka-kasidet/ - webarchive
- https://blog.talosintelligence.com/2020/09/salfram-robbing-place-without-removing.html - webarchive
- https://research.checkpoint.com/2019-resurgence-of-smokeloader/ - webarchive
- https://www.bitsight.com/blog/tracking-privateloader-malware-distribution-service - webarchive
- https://www.microsoft.com/security/blog/2021/02/01/what-tracking-an-attacker-email-infrastructure-tells-us-about-persistent-cybercriminal-operations/ - webarchive
- https://blogs.blackberry.com/en/2022/02/threat-thursday-arkei-infostealer - webarchive
- https://blogs.blackberry.com/en/2022/07/smokeloader-malware-used-to-augment-amadey-infostealer - webarchive
- https://m.alvar.es/2020/06/comparative-analysis-between-bindiff.html - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf - webarchive
- https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://github.com/vc0RExor/Quick-Analysis/blob/main/SmokeLoader/SmokeLoader.md - webarchive
- https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/october/The%20Surge%20in%20Smokeloader%20Attacks%20on%20Ukrainian%20Institutions%20UA.pdf - webarchive
- https://www.cert.pl/en/news/single/dissecting-smoke-loader/ - webarchive
- https://n1ght-w0lf.github.io/malware%20analysis/smokeloader/ - webarchive
- http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html - webarchive
- https://youtu.be/QOypldw6hnY?t=3237 - webarchive
- https://cloudblogs.microsoft.com/microsoftsecure/2018/04/04/hunting-down-dofoil-with-windows-defender-atp/ - webarchive
- https://suvaditya.one/malware-analysis/smokeloader/ - webarchive
- https://hatching.io/blog/tt-2020-08-27/ - webarchive
- https://info.phishlabs.com/blog/smoke-loader-adds-additional-obfuscation-methods-to-mitigate-analysis - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://embee-research.ghost.io/smokeloader-analysis-with-procmon/ - webarchive
- https://www.deepinstinct.com/2021/05/26/deep-dive-packing-software-cryptone/ - webarchive
- https://danusminimus.github.io/Analyzing-Modern-Malware-Techniques-Part-4/ - webarchive
- https://malwarology.substack.com/p/malicious-packer-pkr_ce1a?r=1lslzd - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://blog.malwarebytes.com/cybercrime/2018/01/fake-spectre-and-meltdown-patch-pushes-smoke-loader/ - webarchive
- https://www.silentpush.com/blog/privacy-tools-not-for-you - webarchive
- https://asec.ahnlab.com/en/36634/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/10/new-looking-sundown-ek-drops-smoke-loader-kronos-banker/ - webarchive
- http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html - webarchive
- https://blogs.vmware.com/security/2023/06/8base-ransomware-a-heavy-hitting-player.html - webarchive
- https://research.openanalysis.net/smoke/smokeloader/loader/config/yara/triage/2022/08/25/smokeloader.html - webarchive
- https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html - webarchive
- https://inside.harfanglab.io/blog/articles/cyber-threat-intelligence/loader-galore-taskloader-at-the-start-of-a-pay-per-install-infection-chain/ - webarchive
- https://int0xcc.svbtle.com/a-taste-of-our-own-medicine-how-smokeloader-is-deceiving-dynamic-configuration-extraction-by-using-binary-code-as-bait - webarchive
- https://www.intel471.com/blog/Cobalt-strike-cybercriminals-trickbot-qbot-hancitor - webarchive
- https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://blog.badtrace.com/post/anti-hooking-checks-of-smokeloader-2018/ - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/now-you-see-it-now-you-dont-copperstealer-performs-widespread-theft - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/operation-ta505-part3/ - webarchive
- https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/ - webarchive
- https://www.team-cymru.com/post/seychelles-seychelles-on-the-c-2-shore - webarchive
- https://eternal-todo.com/blog/smokeloader-analysis-yulia-photo - webarchive
- https://global.ahnlab.com/global/upload/download/asecreport/ASEC%20REPORT_vol.101_ENG.pdf - webarchive
- https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf - webarchive
- https://asec.ahnlab.com/en/33600/ - webarchive
- https://embee-research.ghost.io/combining-pivot-points-to-identify-malware-infrastructure-redline-smokeloader-and-cobalt-strike/ - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-110a - webarchive
- https://blog.cluster25.duskrise.com/2023/10/12/cve-2023-38831-russian-attack - webarchive
- http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html - webarchive
- https://bartblaze.blogspot.com/2017/08/crystal-finance-millennium-used-to.html - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://unit42.paloaltonetworks.com/analysis-of-smoke-loader-in-new-tsunami-campaign/ - webarchive
- https://intel471.com/blog/privateloader-malware - webarchive
- https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US - webarchive
- https://www.acronis.com/en-sg/cyber-protection-center/posts/8base-ransomware-stays-unseen-for-a-year/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Smominru
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Smominru.
| Known Synonyms |
|---|
Ismo |
Internal MISP references
UUID 26b91007-a8ae-4e32-bd99-292e44735c3d which can be used as unique global reference for Smominru in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Smrss32
Ransomware.
Internal MISP references
UUID 1fe0b2fe-5f9b-4359-b362-be611537442a which can be used as unique global reference for Smrss32 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sn0wsLogger
Internal MISP references
UUID 17c6c227-5c9b-40eb-886b-19e2b137c5e8 which can be used as unique global reference for Sn0wsLogger in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Snake
Snake Ransomware is a Golang ransomware reportedly containing obfuscation not typically seen in Golang ransomware. This malware will remove shadow copies and kill processes related to SCADA/ICS devices, virtual machines, remote management tools, network management software, and others. After this, encryption of files on the device commences, while skipping Windows system folders and various system files. A random 5 character string is appended to encrypted files. According to Bleeping Computer, this ransomware takes an especially long time to encrypt files on a targeted machine. This ransomware is reported to target an entire network, rather than individual workstations.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Snake.
| Known Synonyms |
|---|
EKANS |
SNAKEHOSE |
Internal MISP references
UUID 547deef9-67c3-483e-933d-171ee8b6b918 which can be used as unique global reference for Snake in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.snake - webarchive
- https://www.fireeye.com/blog/threat-research/2020/07/financially-motivated-actors-are-expanding-access-into-ot.html - webarchive
- https://ics-cert.kaspersky.com/alerts/2020/06/17/targeted-attacks-on-industrial-companies-using-snake-ransomware/ - webarchive
- https://www.0ffset.net/reverse-engineering/analysing-snake-ransomware/ - webarchive
- https://ics-cert.kaspersky.com/media/KASPERSKY_H1_2020_ICS_REPORT_EN.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/snake-ransomware-is-the-next-threat-targeting-business-networks/ - webarchive
- https://www.dragos.com/blog/industry-news/ekans-ransomware-misconceptions-and-misunderstandings/ - webarchive
- https://www.crowdstrike.com/blog/adversaries-targeting-the-manufacturing-industry/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2020/06/honda-and-enel-impacted-by-cyber-attack-suspected-to-be-ransomware/ - webarchive
- https://ke-la.com/zooming-into-darknet-threats-targeting-jp-orgs-kela/ - webarchive
- https://dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/ - webarchive
- https://www.ccn-cert.cni.es/pdf/5045-ccn-cert-id-15-20-snake-locker-english-1/file.html - webarchive
- https://github.com/albertzsigovits/malware-notes/blob/master/Snake.md - webarchive
- https://twitter.com/bad_packets/status/1270957214300135426 - webarchive
- https://twitter.com/milkr3am/status/1270019326976786432 - webarchive
- https://labs.sentinelone.com/new-snake-ransomware-adds-itself-to-the-increasing-collection-of-golang-crimeware/ - webarchive
- https://krebsonsecurity.com/2020/05/europes-largest-private-hospital-operator-fresenius-hit-by-ransomware - webarchive
- https://www.goggleheadedhacker.com/blog/post/22 - webarchive
- https://www.fortinet.com/blog/threat-research/ekans-ransomware-targeting-ot-ics-systems - webarchive
- https://www.mandiant.com/resources/financially-motivated-actors-are-expanding-access-into-ot - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/honda-investigates-possible-ransomware-attack-networks-impacted/ - webarchive
- https://hub.dragos.com/hubfs/Whitepaper-Downloads/Dragos_Manufacturing%20Threat%20Perspective_1120.pdf - webarchive
- https://medium.com/@nishanmaharjan17/malware-analysis-snake-ransomware-a0e66f487017 - webarchive
- https://insights.sei.cmu.edu/cert/2020/03/snake-ransomware-analysis-updates.html - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-old-dogs-new-tricks.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Snatch
Snatch is a ransomware which infects victims by rebooting the PC into Safe Mode. Most of the existing security protections do not run in Safe Mode so that it the malware can act without expected countermeasures and it can encrypt as many files as it finds. It uses common packers such as UPX to hide its payload.
Internal MISP references
UUID 98139439-6863-439c-b4d0-c6893f1afb23 which can be used as unique global reference for Snatch in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.snatch - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
- https://thedfirreport.com/2020/06/21/snatch-ransomware/ - webarchive
- https://twitter.com/VK_Intel/status/1191414501297528832 - webarchive
- https://www.bleepingcomputer.com/news/security/snatch-ransomware-reboots-to-windows-safe-mode-to-bypass-av-tools/ - webarchive
- https://www.crowdstrike.com/blog/financial-motivation-drives-golang-malware-adoption/ - webarchive
- https://www.secureworks.com/blog/ransomware-groups-use-tor-based-backdoor-for-persistent-access - webarchive
- https://github.com/albertzsigovits/malware-notes/blob/master/Snatch.md - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/ - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SnatchCrypto
Malware observed in the SnatchCrypto campaign, attributed by Kaspersky Labs to BlueNoroff with high confidence.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SnatchCrypto.
| Known Synonyms |
|---|
BackbitingTea |
Internal MISP references
UUID b7affd90-6551-4266-b864-a0b9f6d5b309 which can be used as unique global reference for SnatchCrypto in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.snatchcrypto - webarchive
- https://threatbook.cn/ppt/The%2520Nightmare%2520of%2520Global%2520Cryptocurrency%2520Companies%2520-%2520Demystifying%2520the%2520%25E2%2580%259CDangerousPassword%25E2%2580%259D%2520of%2520the%2520APT%2520Organization.pdf - webarchive
- https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/ - webarchive
- https://blog.sekoia.io/the-dprk-delicate-sound-of-cyber/ - webarchive
- https://vb2020.vblocalhost.com/conference/presentations/unveiling-the-cryptomimic/ - webarchive
- https://blogs.jpcert.or.jp/ja/2023/05/dangerouspassword.html - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Lazarus-campaigns-and-backdoors-in-2022-2023.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SnatchLoader
A downloader trojan with some infostealer capabilities focused on the browser. Previously observed as part of RigEK campaigns.
Internal MISP references
UUID 467c726e-6e19-4d15-88b6-362cbe0b3d20 which can be used as unique global reference for SnatchLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.snatch_loader - webarchive
- https://www.youtube.com/watch?v=k3sM88o_maM - webarchive
- https://twitter.com/VK_Intel/status/898549340121288704 - webarchive
- https://zerophagemalware.com/2017/12/11/malware-snatch-loader-reloaded/ - webarchive
- https://myonlinesecurity.co.uk/your-order-no-8194788-has-been-processed-malspam-delivers-malware/ - webarchive
- https://www.arbornetworks.com/blog/asert/snatchloader-reloaded/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SNEEPY
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SNEEPY.
| Known Synonyms |
|---|
ByeByeShell |
Internal MISP references
UUID 212d1ed7-0519-412b-a1ce-56046ca93372 which can be used as unique global reference for SNEEPY in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Snifula
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Snifula.
| Known Synonyms |
|---|
Ursnif |
Internal MISP references
UUID 4f3ad937-bf2f-40cb-9695-a2bedfd41bfa which can be used as unique global reference for Snifula in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.snifula - webarchive
- https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/ - webarchive
- https://kostas-ts.medium.com/ursnif-vs-italy-il-pdf-del-destino-5c83d6281072 - webarchive
- https://www.darktrace.com/en/blog/the-resurgence-of-the-ursnif-banking-trojan/ - webarchive
- https://www.circl.lu/assets/files/tr-13/tr-13-snifula-analysis-report-v1.3.pdf - webarchive
- https://www.zdnet.com/article/ursnif-trojan-has-targeted-over-100-italian-banks/ - webarchive
- https://malware.love/malware_analysis/reverse_engineering/2020/11/27/analyzing-a-vbs-dropper.html - webarchive
- https://medium.com/csis-techblog/chapter-1-from-gozi-to-isfb-the-history-of-a-mythical-malware-family-82e592577fef - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Snojan
Internal MISP references
UUID 0646a6eb-1c13-4d87-878e-9431314597bf which can be used as unique global reference for Snojan in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SnowFlake Stealer
Information stealer, written in Rust.
Internal MISP references
UUID 7ddfdf14-ec97-48ea-88a6-055147583dc3 which can be used as unique global reference for SnowFlake Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SNS Locker
Internal MISP references
UUID 99a10948-d7ba-4ad0-b73c-c7762143a193 which can be used as unique global reference for SNS Locker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sobaken
According to ESET, this RAT was derived from (the open-source) Quasar RAT.
Internal MISP references
UUID 81e4fc8f-7b05-42bf-8ff9-568362d4f964 which can be used as unique global reference for Sobaken in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sobig
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sobig.
| Known Synonyms |
|---|
Palyh |
Internal MISP references
UUID 4e9f85e7-0575-40e5-8799-288ec28237ca which can be used as unique global reference for Sobig in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Socelars
Socelars is an infostealer with main focus on: * Facebook Stealer (ads/manager) * Cookie Stealer | AdsCreditCard {Amazon}
Internal MISP references
UUID 4366ea63-b784-428c-bb00-89ee99eaf8c3 which can be used as unique global reference for Socelars in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.socelars - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/facebook-ads-manager-targeted-by-new-info-stealing-trojan/ - webarchive
- https://twitter.com/VK_Intel/status/1201584107928653824 - webarchive
- https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ - webarchive
- https://www.trendmicro.com/en_us/research/21/i/fake-installers-drop-malware-and-open-doors-for-opportunistic-attackers.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sockbot
Sockbot is a customized and in Go written fork of the Ligolo reverse tunneling open-source tool. Several modification were performed by the threat actors who rewrote that code, e.g. execution checks, hardcoded values. Ligolo: https://github.com/sysdream/ligolo
Internal MISP references
UUID b477dcfb-281c-4bef-9a23-f004ebe5a465 which can be used as unique global reference for Sockbot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sockbot - webarchive
- https://www.bleepingcomputer.com/news/security/hackers-fork-open-source-reverse-tunneling-tool-for-persistence/ - webarchive
- https://blog.talosintelligence.com/2022/03/iranian-supergroup-muddywater.html - webarchive
- https://secjoes-reports.s3.eu-central-1.amazonaws.com/Sockbot%2Bin%2BGoLand.pdf - webarchive
- https://www.youtube.com/watch?v=CAMnuhg-Qos - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Socks5 Systemz
Internal MISP references
UUID 38734f44-ebc4-4250-a20e-5dac0fb5c0ed which can be used as unique global reference for Socks5 Systemz in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.socks5_systemz - webarchive
- https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey - webarchive
- https://www.bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SocksBot
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SocksBot.
| Known Synonyms |
|---|
BIRDDOG |
Nadrac |
Internal MISP references
UUID da34bf80-6dc6-4b07-8094-8bed2c1176ec which can be used as unique global reference for SocksBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.socksbot - webarchive
- https://www.accenture.com/t00010101T000000Z__w__/gb-en/_acnmedia/PDF-83/Accenture-Goldfin-Security-Alert.pdf - webarchive
- https://threatminer.org/report.php?q=Accenture-Goldfin-Security-Alert.pdf&y=2018 - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf - webarchive
- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - webarchive
- https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf - webarchive
- https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf - webarchive
- https://assets.sentinelone.com/sentinellabs22/sentinellabs-blackbasta - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SodaMaster
This is a RAT that is usually loaded with one or more shellcode and/or reflective DLL injection techniques. The RAT uses RC4 or a hardcoded RSA key for traffic encryption/decryption. Its communication can either happen via a raw TCP socket or a HTTP POST request. Depending on the version, the RAT may remotely execute DLLs or shellcode.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SodaMaster.
| Known Synonyms |
|---|
DelfsCake |
HEAVYPOT |
dfls |
Internal MISP references
UUID 016ea180-ec16-48ce-88ea-c78d8db369d5 which can be used as unique global reference for SodaMaster in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sodamaster - webarchive
- https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-china-ngo-government-attacks - webarchive
- https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_9_yanagishita-tamada-nakatsuru-ishimaru_en.pdf - webarchive
- https://securelist.com/apt-trends-report-q1-2021/101967/ - webarchive
- https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_202_niwa-yanagishita_en.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/chinese-hackers-abuse-vlc-media-player-to-launch-malware-loader/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Solar
Internal MISP references
UUID 1a11c0a9-8ab8-4e98-a7e6-e575eba33c93 which can be used as unique global reference for Solar in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Solarbot
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Solarbot.
| Known Synonyms |
|---|
Napolar |
Internal MISP references
UUID d61a1656-9413-46de-bd19-c7fe5eda3371 which can be used as unique global reference for Solarbot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.solarbot - webarchive
- https://blog.avast.com/2013/09/25/win3264napolar-new-trojan-shines-on-the-cyber-crime-scene/ - webarchive
- https://www.welivesecurity.com/2013/09/25/win32napolar-a-new-bot-on-the-block/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2013/09/new-solarbot-malware-debuts-creator-publicly-advertising/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
solarmarker
Unit 42 notes that they identified a new version of SolarMarker, a malware family known for its infostealing and backdoor capabilities, mainly delivered through search engine optimization (SEO) manipulation to convince users to download malicious documents.
Some of SolarMarker’s capabilities include the exfiltration of auto-fill data, saved passwords and saved credit card information from victims’ web browsers. Besides capabilities typical for infostealers, SolarMarker has additional capabilities such as file transfer and execution of commands received from a C2 server.
The malware invests significant effort into defense evasion, which consists of techniques like signed files, huge files, impersonation of legitimate software installations and obfuscated PowerShell scripts.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular solarmarker.
| Known Synonyms |
|---|
Jupyter |
Polazert |
Yellow Cockatoo |
Internal MISP references
UUID 4e08d816-9fe3-42ae-b7e4-f7182445f304 which can be used as unique global reference for solarmarker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.solarmarker - webarchive
- https://unit42.paloaltonetworks.com/solarmarker-malware/ - webarchive
- https://security5magics.blogspot.com/2020/12/tracking-jupyter-malware.html - webarchive
- https://twitter.com/MsftSecIntel/status/1403461397283950597 - webarchive
- https://news.sophos.com/en-us/2022/02/01/solarmarker-campaign-used-novel-registry-changes-to-establish-persistence/ - webarchive
- https://blog.talosintelligence.com/2021/07/threat-spotlight-solarmarker.html#more - webarchive
- https://embee-research.ghost.io/shodan-censys-queries/ - webarchive
- https://blogs.vmware.com/security/2023/11/jupyter-rising-an-update-on-jupyter-infostealer.html - webarchive
- https://blog.morphisec.com/jupyter-infostealer-backdoor-introduction - webarchive
- https://www.prodaft.com/m/reports/Solarmarker_TLPWHITEv2.pdf - webarchive
- https://www.binarydefense.com/mars-deimos-solarmarker-jupyter-infostealer-part-1/ - webarchive
- https://blog.morphisec.com/new-jupyter-evasive-delivery-through-msi-installer - webarchive
- https://squiblydoo.blog/2021/06/20/mars-deimos-from-jupiter-to-mars-and-back-again-part-two/ - webarchive
- https://www.binarydefense.com/mars-deimos-from-jupiter-to-mars-and-back-again-part-two/ - webarchive
- https://www.cisecurity.org/insights/blog/top-10-malware-march-2022 - webarchive
- https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise - webarchive
- https://squiblydoo.blog/2022/09/27/solarmarker-the-old-is-new/ - webarchive
- https://www.crowdstrike.com/blog/solarmarker-backdoor-technical-analysis/ - webarchive
- https://www.esentire.com/security-advisories/hackers-flood-the-web-with-100-000-malicious-pages-promising-professionals-free-business-forms-but-are-delivering-malware-reports-esentire - webarchive
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-solarmarker - webarchive
- https://blog.minerva-labs.com/new-iocs-of-jupyter-stealer - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SolidBit
Ransomware, written in .NET.
Internal MISP references
UUID 94b4f63b-48c9-4f43-b145-c967f173d87d which can be used as unique global reference for SolidBit in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SombRAT
Internal MISP references
UUID 2b2cffc5-bf6e-4636-a906-829c32115655 which can be used as unique global reference for SombRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sombrat - webarchive
- https://www.rewterz.com/rewterz-news/rewterz-threat-alert-financially-motivated-aggressive-group-carrying-out-ransomware-campaigns-active-iocs - webarchive
- https://blogs.blackberry.com/en/2021/05/threat-thursday-sombrat-always-leave-yourself-a-backdoor - webarchive
- https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Somnia
Internal MISP references
UUID 907ed2ce-5407-4e4d-9b1a-596d5489b008 which can be used as unique global reference for Somnia in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sorano
Internal MISP references
UUID 897985dc-6b3e-4d92-bbe4-c4902194cdcc which can be used as unique global reference for Sorano in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
soraya
Internal MISP references
UUID 26aa3c43-5049-4a2e-bec1-9709b31a1a26 which can be used as unique global reference for soraya in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SoreFang
Internal MISP references
UUID 0068e2fe-0d13-4073-be73-90118b1d285a which can be used as unique global reference for SoreFang in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sorefang - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a - webarchive
- https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development.pdf - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sorgu
Internal MISP references
UUID bc135ba5-637b-46c9-94fc-2eef5e018bb5 which can be used as unique global reference for Sorgu in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Soul
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Soul.
| Known Synonyms |
|---|
SoulSearcher |
Internal MISP references
UUID f7e3b124-ad70-4456-9aff-3ec501e8c42d which can be used as unique global reference for Soul in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.soul - webarchive
- https://research.checkpoint.com/2023/pandas-with-a-soul-chinese-espionage-attacks-against-southeast-asian-government-entities/ - webarchive
- https://www.fortinet.com/blog/threat-research/unraveling-the-evolution-of-the-soul-searcher-malware - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SOUNDBITE
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SOUNDBITE.
| Known Synonyms |
|---|
denis |
Internal MISP references
UUID f4cac204-3d3f-4bb6-84bd-fc27b2f5158c which can be used as unique global reference for SOUNDBITE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.soundbite - webarchive
- https://www.picussecurity.com/blog/picus-10-critical-mitre-attck-techniques-t1055-process-injection - webarchive
- https://ruxcon.org.au/assets/2017/slides/bart-RuxCon-Presentation.pptx - webarchive
- https://mp.weixin.qq.com/s/xPsEXp2J5IE7wNSMEVC24A - webarchive
- https://securelist.com/use-of-dns-tunneling-for-cc-communications/78203/ - webarchive
- https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2020-1110.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/tin-woodlawn - webarchive
- https://attack.mitre.org/wiki/Software/S0157 - webarchive
- https://blog.viettelcybersecurity.com/apt32-deobfuscation-arsenal-deobfuscating-mot-vai-loai-obfucation-toolkit-cua-apt32-phan-1/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SPACESHIP
SPACESHIP searches for files with a specified set of file extensions and copies them to a removable drive. FireEye believes that SHIPSHAPE is used to copy SPACESHIP to a removable drive, which could be used to infect another victim computer, including an air-gapped computer. SPACESHIP is then used to steal documents from the air-gapped system, copying them to a removable drive inserted into the SPACESHIP-infected system
Internal MISP references
UUID 813e2761-6d68-493f-846b-2fc86d2e8079 which can be used as unique global reference for SPACESHIP in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Spark
Internal MISP references
UUID 3c676c22-8041-4cf6-8291-1bb9372e2d45 which can be used as unique global reference for Spark in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.spark - webarchive
- https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/ - webarchive
- https://www.cybereason.com/blog/new-cyber-espionage-campaigns-targeting-palestinians-part-one - webarchive
- https://www.zscaler.com/blogs/security-research/new-espionage-attack-molerats-apt-targeting-users-middle-east - webarchive
- https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf - webarchive
- https://www.cybereason.com/blog/new-malware-arsenal-abusing-cloud-platforms-in-middle-east-espionage-campaign - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sparkle
Internal MISP references
UUID 339c60f6-8758-4d32-aa33-b0d722e924bb which can be used as unique global reference for Sparkle in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sparksrv
Internal MISP references
UUID 1937c3e0-569d-4eb4-b769-ae5d9cc27755 which can be used as unique global reference for Sparksrv in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SparkRAT
Internal MISP references
UUID 55c6dce3-650b-4f67-8b47-5f6cd0acb72c which can be used as unique global reference for SparkRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.spark_rat - webarchive
- https://github.com/XZB-1248/Spark - webarchive
- https://www.sentinelone.com/labs/dragonspark-attacks-evade-detection-with-sparkrat-and-golang-source-code-interpretation/ - webarchive
- https://asec.ahnlab.com/ko/56715/ - webarchive
- https://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/ - webarchive
- https://asec.ahnlab.com/en/52899/ - webarchive
- https://blog.exatrack.com/melofee/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SparrowDoor
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SparrowDoor.
| Known Synonyms |
|---|
FamousSparrow |
Internal MISP references
UUID 412a1b1b-77b1-4149-b7bd-14a43aa40dda which can be used as unique global reference for SparrowDoor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Spartacus
Spartacus is ransomware written in .NET and emerged in the first half of 2018.
Internal MISP references
UUID e4dce19f-bb8e-4ea1-b771-58b162946f29 which can be used as unique global reference for Spartacus in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SPECTRALVIPER
Internal MISP references
UUID 4f9ee4dc-725e-4a8e-8c10-a013f6949b2d which can be used as unique global reference for SPECTRALVIPER in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Spectre Rat
Mixed RAT and Botnet malware sold in underground forums. In march 2021 it was advertised with the Spectre 2.0, it reached version 3 in June 2021 and then quickly version 4. This crimeware tool was being abused in malicious campaigns targeting European users in September 2021.
Internal MISP references
UUID 0d0935cc-d98f-4a0e-8e13-f36358e974b4 which can be used as unique global reference for Spectre Rat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Spedear
Internal MISP references
UUID bd29030e-d440-4842-bc2a-c173ed938da4 which can be used as unique global reference for Spedear in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SPHijacker
According to Trend Micro, this is a tool designed to disable security products, adopting two approaches to achieve this purpose. One approach terminates the security product process by using a vulnerable driver, zamguard64.sys, published by Zemana (vulnerability designated as CVE-2018-5713). Meanwhile, another approach disables process launching by using a new technique that they named stack rumbling.
Internal MISP references
UUID 24541e4c-27b3-4a80-9dca-972f9825d36b which can be used as unique global reference for SPHijacker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Spicy Hot Pot
Internal MISP references
UUID dfbe088e-dd6d-4bad-8e2b-7a4162034da4 which can be used as unique global reference for Spicy Hot Pot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SPIDERPIG RAT
Internal MISP references
UUID 70d271b7-2dcc-4b4f-94a5-9ea4b2165510 which can be used as unique global reference for SPIDERPIG RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.spider_rat - webarchive
- https://jp.security.ntt/resources/EN-BlackTech_2021.pdf - webarchive
- https://twitter.com/nahamike01/status/1471496800582664193?s=20 - webarchive
- https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_8_hara_en.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Spora
Internal MISP references
UUID 7eeafa7c-0282-4667-bb1a-5ebc3a845d6d which can be used as unique global reference for Spora in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.spora_ransom - webarchive
- https://www.linkedin.com/pulse/spora-ransomware-understanding-hta-infection-vector-kevin-douglas - webarchive
- http://malware-traffic-analysis.net/2017/01/17/index2.html - webarchive
- https://nakedsecurity.sophos.com/2017/06/26/how-spora-ransomware-tries-to-fool-antivirus/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2017/03/spora-ransomware/ - webarchive
- https://github.com/MinervaLabsResearch/SporaVaccination - webarchive
- https://www.gdatasoftware.com/blog/2017/01/29442-spora-worm-and-ransomware - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SpyBot
Internal MISP references
UUID 34e9d701-22a1-4315-891d-443edd077abf which can be used as unique global reference for SpyBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Spyder
Internal MISP references
UUID bcee00e4-5316-45ad-8811-33c50b9394f8 which can be used as unique global reference for Spyder in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.spyder - webarchive
- https://hello.global.ntt/-/media/ntt/global/insights/white-papers/the-operations-of-winnti-group.pdf - webarchive
- https://vms.drweb.com/virus/?i=23648386 - webarchive
- https://speakerdeck.com/aragorntseng/winnti-is-coming-evolution-after-prosecution-at-hitcon2021 - webarchive
- https://st.drweb.com/static/new-www/news/2021/march/BackDoor.Spyder.1_en.pdf - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0808.pdf - webarchive
- https://www.cybereason.com/blog/operation-cuckoobees-a-winnti-malware-arsenal-deep-dive - webarchive
- https://www.recordedfuture.com/chinese-group-tag-22-targets-nepal-philippines-taiwan/ - webarchive
- https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques - webarchive
- https://securitynews.sonicwall.com/xmlpost/chinas-winnti-spyder-module/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SpyEye
SpyEye is a malware targeting both Microsoft Windows browsers and Apple iOS Safari. Originated in Russia, it was available in dark forums for $500+ claiming to be the "The Next Zeus Malware". It performed many functionalities typical from bankers trojan such as keyloggers, auto-fill credit card modules, email backups, config files (encrypted), http access, Pop3 grabbers and FTP grabbers. SpyEye allowed hackers to steal money from online bank accounts and initiate transactions even while valid users are logged into their bank account.
Internal MISP references
UUID 814fa0b7-0468-4ed0-b910-2b3caec96d44 which can be used as unique global reference for SpyEye in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.spyeye - webarchive
- https://krebsonsecurity.com/2010/04/spyeye-vs-zeus-rivalry/ - webarchive
- https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree - webarchive
- https://www.sans.org/reading-room/whitepapers/malicious/clash-titans-zeus-spyeye-33393 - webarchive
- https://krebsonsecurity.com/2010/09/spyeye-botnets-bogus-billing-feature/ - webarchive
- https://www.symantec.com/connect/blogs/spyeye-bot-versus-zeus-bot - webarchive
- https://securelist.com/financial-cyberthreats-in-2020/101638/ - webarchive
- https://www.pcworld.com/article/247252/spyeye_malware_borrows_zeus_trick_to_mask_fraud.html - webarchive
- http://malwareint.blogspot.com/2010/02/spyeye-bot-part-two-conversations-with.html - webarchive
- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan%3AWin32%2FSpyeye - webarchive
- https://krebsonsecurity.com/2011/04/spyeye-targets-opera-google-chrome-users/ - webarchive
- https://www.computerworld.com/article/2509482/spyeye-trojan-defeating-online-banking-defenses.html - webarchive
- https://www.justice.gov/opa/pr/four-individuals-plead-guilty-rico-conspiracy-involving-bulletproof-hosting-cybercriminals - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Squirrelwaffle
According to Sophos, Squirrelwaffle is a malware loader that is distributed as a malicious Office document in spam campaigns. It provides attackers with an initial foothold in a victim’s environment and a channel to deliver and infect systems with other malware. When a recipient opens a Squirrelwaffle-infected document and enables macros, a visual basic script typically downloads and executes malicious files and scripts, giving further control of the computer to an attacker. Squirrelwaffle operators also use DocuSign to try and trick the user into enabling macros in Office documents.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Squirrelwaffle.
| Known Synonyms |
|---|
DatopLoader |
Internal MISP references
UUID cdbfd973-fa96-4e64-b2a3-9d51460fd7af which can be used as unique global reference for Squirrelwaffle in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.squirrelwaffle - webarchive
- https://redcanary.com/blog/intelligence-insights-november-2021/ - webarchive
- https://blog.talosintelligence.com/2021/10/squirrelwaffle-emerges.html - webarchive
- https://blog.minerva-labs.com/a-new-datoploader-delivers-qakbot-trojan - webarchive
- https://github.com/0xjxd/SquirrelWaffle-From-Maldoc-to-Cobalt-Strike/raw/main/2021-10-02%20-%20SquirrelWaffle%20-%20From%20Maldoc%20to%20Cobalt%20Strike.pdf - webarchive
- https://www.malware-traffic-analysis.net/2021/09/17/index.html - webarchive
- https://www.trendmicro.com/en_us/research/21/k/Squirrelwaffle-Exploits-ProxyShell-and-ProxyLogon-to-Hijack-Email-Chains.html - webarchive
- https://redcanary.com/blog/intelligence-insights-december-2021 - webarchive
- https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/the-newest-malicious-actor-squirrelwaffle-malicious-doc/ - webarchive
- https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf - webarchive
- https://twitter.com/Max_Mal_/status/1442496131410190339 - webarchive
- https://www.netskope.com/blog/squirrelwaffle-new-malware-loader-delivering-cobalt-strike-and-qakbot - webarchive
- https://www.cynet.com/understanding-squirrelwaffle/ - webarchive
- https://blogs.blackberry.com/en/2021/11/threat-thursday-squirrelwaffle-loader - webarchive
- https://www.0ffset.net/reverse-engineering/malware-analysis/squirrelwaffle-main-loader/ - webarchive
- https://security-soup.net/squirrelwaffle-maldoc-analysis/ - webarchive
- https://news.sophos.com/en-us/2022/02/15/vulnerable-exchange-server-hit-by-squirrelwaffle-and-financial-fraud/ - webarchive
- https://www.youtube.com/watch?v=9X2P7aFKSw0 - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-datoploader-exploits-proxyshell-to-deliver-qbot-and-cobalt-strike - webarchive
- https://twitter.com/jhencinski/status/1464268732096815105 - webarchive
- https://www.0ffset.net/reverse-engineering/malware-analysis/squirrelwaffle-custom-packer/ - webarchive
- https://certitude.consulting/blog/en/unpatched-exchange-servers-distribute-phishing-links-squirrelwaffle/ - webarchive
- https://elis531989.medium.com/the-squirrel-strikes-back-analysis-of-the-newly-emerged-cobalt-strike-loader-squirrelwaffle-937b73dbd9f9 - webarchive
- https://www.sentinelone.com/blog/is-squirrelwaffle-the-new-emotet-how-to-detect-the-latest-malspam-loader/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SquirtDanger
According to PaloAlto, SquirtDanger is a commodity botnet malware family that comes equipped with a number of characteristics and capabilities. The malware is written in C# (C Sharp) and has multiple layers of embedded code. Once run on the system, it will persist via a scheduled task that is set to run every minute. SquirtDanger uses raw TCP connections to a remote command and control (C2) server for network communications.
Internal MISP references
UUID 858a2cdb-9c89-436a-b8d4-60c725c7ac63 which can be used as unique global reference for SquirtDanger in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
sRDI
sRDI allows for the conversion of DLL files to position independent shellcode. It attempts to be a fully functional PE loader supporting proper section permissions, TLS callbacks, and sanity checks. It can be thought of as a shellcode PE loader strapped to a packed DLL.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular sRDI.
| Known Synonyms |
|---|
DAVESHELL |
Internal MISP references
UUID 90ee25aa-89a8-4d70-a4d8-aee44561a146 which can be used as unique global reference for sRDI in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.srdi - webarchive
- https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing - webarchive
- https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing - webarchive
- https://github.com/monoxgas/sRDI - webarchive
- https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SSHNET
Internal MISP references
UUID 7e0667e8-67fd-4b5f-a3e4-3ced4dcaac1e which can be used as unique global reference for SSHNET in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sshnet - webarchive
- https://www.crowdstrike.com/blog/who-is-pioneer-kitten/ - webarchive
- https://www.zdnet.com/article/fbi-says-an-iranian-hacking-group-is-attacking-f5-networking-devices - webarchive
- https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SslMM
Internal MISP references
UUID 009db412-762d-4256-8df9-eb213be01ffd which can be used as unique global reference for SslMM in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sslmm - webarchive
- https://securelist.com/analysis/publications/69953/the-naikon-apt/ - webarchive
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/TheNaikonAPT-MsnMM1.pdf - webarchive
- https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Stabuniq
Internal MISP references
UUID faa2196f-df4c-454c-995e-ded7864d5fa8 which can be used as unique global reference for Stabuniq in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
StalinLocker
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular StalinLocker.
| Known Synonyms |
|---|
StalinScreamer |
Internal MISP references
UUID 8c38460b-fcfd-434e-b258-875854c6aff6 which can be used as unique global reference for StalinLocker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Stampedo
Internal MISP references
UUID b1efbadf-26e5-4e35-8fd2-61642c30ecbf which can be used as unique global reference for Stampedo in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
StarCruft
Internal MISP references
UUID acd8fc63-c22a-4c11-907e-33e358fdd293 which can be used as unique global reference for StarCruft in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
StarLoader
Internal MISP references
UUID f1decba9-6b3b-4636-a2b6-2208e178591a which can be used as unique global reference for StarLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
StarsyPound
Internal MISP references
UUID 6df9bbd4-ab32-4d09-afdb-97eed274520a which can be used as unique global reference for StarsyPound in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
StartPage
Potentially unwanted program that changes the startpage of browsers to induce ad impressions.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular StartPage.
| Known Synonyms |
|---|
Easy Television Access Now |
Internal MISP references
UUID 033dbef5-eb51-4f7b-87e6-6dc4bef72841 which can be used as unique global reference for StartPage in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
STASHLOG
Malware that abuses the Common Log File System (CLFS) to store/hide a second stage payload via registry transaction files.
Internal MISP references
UUID 4a844c8c-996c-4562-bed4-0496d7838157 which can be used as unique global reference for STASHLOG in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.stashlog - webarchive
- https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques - webarchive
- https://twitter.com/ESETresearch/status/1433819369784610828 - webarchive
- https://www.cybereason.com/blog/operation-cuckoobees-a-winnti-malware-arsenal-deep-dive - webarchive
- https://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
StealBit
This is a stealer used by LockBit 2.0.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular StealBit.
| Known Synonyms |
|---|
Corrempa |
Internal MISP references
UUID b98c86d4-1eee-490e-a6f9-e9559322fec8 which can be used as unique global reference for StealBit in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.stealbit - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool - webarchive
- https://securelist.com/new-ransomware-trends-in-2022/106457/ - webarchive
- https://yoroi.company/research/hunting-the-lockbit-gangs-exfiltration-infrastructures/ - webarchive
- https://www.accenture.com/us-en/blogs/security/stealbit-exmatter-exfiltration-tool-analysis - webarchive
- https://twitter.com/r3c0nst/status/1425875923606310913 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Stealc
Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.
Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.
Internal MISP references
UUID 58a2c661-470e-438d-bea3-bff1ed987ed2 which can be used as unique global reference for Stealc in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc - webarchive
- https://cocomelonc.github.io/book/2023/12/13/malwild-book.html - webarchive
- https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ - webarchive
- https://github.com/muha2xmad/Python/blob/bdc7a711d5a775f8ae47b591f20fdd2e1360b77b/Stealc/stealc_config_extractor.ipynb - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://github.com/muha2xmad/Python/blob/bdc7a711d5a775f8ae47b591f20fdd2e1360b77b/Stealc/stealc_string_decryption.py - webarchive
- https://glyc3rius.github.io/2023/10/stealc/ - webarchive
- https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ - webarchive
- https://www.esentire.com/blog/stealc-delivered-via-deceptive-google-sheets - webarchive
- https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Stealerium
According to SecurityScorecard, Stealerium is an open-source stealer available on GitHub. The malware steals information from browsers, cryptocurrency wallets, and applications such as Discord, Pidgin, Outlook, Telegram, Skype, Element, Signal, Tox, Steam, Minecraft, and VPN clients. The binary also gathers data about the infected host, such as the running processes, Desktop and webcam screenshots, Wi-Fi networks, the Windows product key, and the public and private IP address. The stealer employs multiple anti-analysis techniques, such as detecting virtual machines, sandboxes, and malware analysis tools and checking if the process is being debugged. The malware also embedded a keylogger module and a clipper module that replaces cryptocurrency wallet addresses with the threat actor’s addresses if the victim makes a transaction. The stolen information is sent to a Discord channel using a Discord Webhook.
Internal MISP references
UUID bf71f246-7382-486d-996d-c2b7aa8cf89b which can be used as unique global reference for Stealerium in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Stealer0x3401
According to PTSecurity, this stealer harvests system information which is then RC4 encrypted and Base64 encoded before sending it to the C2 server.
Internal MISP references
UUID b30b8058-45d9-45aa-8a1f-c6abc78edef8 which can be used as unique global reference for Stealer0x3401 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
StealthWorker Go
According to Fortinet, StealthWorker is a brute-force malware that has been linked to a compromised e-commerce website with an embedded skimmer that steals personal information and payment details. Before hackers can embed a skimmer, however, the first requirement is for hackers to gain access to their target’s backend. Hacker’s commonly take advantage of vulnerabilities in the Content Management System (CMS) or its plugins to gain entry into the target’s system. Another, simpler option is to use brute force attacks. Though quite slow, this method is still effective against administrators using weak or commonly used passwords.
Internal MISP references
UUID d1c5a299-c072-44b5-be31-d03853bca5ea which can be used as unique global reference for StealthWorker Go in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.stealthworker - webarchive
- https://www.bleepingcomputer.com/news/security/synology-warns-of-malware-infecting-nas-devices-with-ransomware/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2019/02/new-golang-brute-forcer-discovered-amid-rise-e-commerce-attacks/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Stealth Soldier
Check Point Research observed a wave of highly-targeted espionage attacks in Libya that utilize a new custom modular backdoor. Stealth Soldier malware is an undocumented backdoor that primarily operates surveillance functions such as file exfiltration, screen and microphone recording, keystroke logging and stealing browser information.
Internal MISP references
UUID 07a24653-0f0b-49cf-944d-b4686b7e48d0 which can be used as unique global reference for Stealth Soldier in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SteamHide
Malware written in .NET that hides in Steam profile pictures. Tries to evade virtualization through detection if it is executed within VMWare or VirtualBox.
Internal MISP references
UUID 4729fb59-44a8-4d2f-9914-cd93fc528888 which can be used as unique global reference for SteamHide in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
StegoLoader
Internal MISP references
UUID aea21616-061d-4177-9512-8887853394ed which can be used as unique global reference for StegoLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Stinger
Internal MISP references
UUID 82ab5235-a71e-4692-a08c-8db337d8b53a which can be used as unique global reference for Stinger in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
STONEBOAT
According to Mandiant, STONEBOAT is an installer for DICELOADER. It is written in .NET and drops its payload in-memory.
Internal MISP references
UUID c4286ab0-748a-4473-b4a6-ac4426f73393 which can be used as unique global reference for STONEBOAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
StoneDrill
Internal MISP references
UUID 0c5bc5c8-5136-413a-bc5a-e13333271f49 which can be used as unique global reference for StoneDrill in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.stonedrill - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/ - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/elfin-apt33-espionage - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/ - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/shamoon-destructive-threat-re-emerges-new-sting-its-tail - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
STOP
STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular STOP.
| Known Synonyms |
|---|
Djvu |
KeyPass |
Internal MISP references
UUID 447e5d7d-dd23-43b3-8cbc-b835498a49dd which can be used as unique global reference for STOP in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.stop - webarchive
- https://www.cybereason.com/blog/the-hole-in-the-bucket-attackers-abuse-bitbucket-to-deliver-an-arsenal-of-malware - webarchive
- https://angle.ankura.com/post/102het9/the-stop-ransomware-variant - webarchive
- https://www.team-cymru.com/post/seychelles-seychelles-on-the-c-2-shore - webarchive
- https://www.gdatasoftware.com/blog/2022/01/malware-vaccines - webarchive
- https://www.bleepingcomputer.com/news/security/djvu-ransomware-spreading-new-tro-variant-through-cracks-and-adware-bundles/ - webarchive
- https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/ - webarchive
- https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-april-1st-2022-i-can-fight-with-a-keyboard/ - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://www.gdata.de/blog/1970/01/-35391-finger-weg-von-illegalen-software-downloads - webarchive
- https://drive.google.com/file/d/1L8mkylrCJyd-817-45RA6gIFCCX4oaOv/view - webarchive
- https://securelist.com/story-of-the-year-2019-cities-under-ransomware-siege/95456/ - webarchive
- https://securelist.com/keypass-ransomware/87412/ - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/wp-spark-state-of-ransomware.pdf - webarchive
- https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ - webarchive
- https://malienist.medium.com/defendagainst-ransomware-stop-c8cf4116645b - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ - webarchive
- https://intel471.com/blog/privateloader-malware - webarchive
- https://medium.com/csis-techblog/gcleaner-garbage-provider-since-2019-2708e7c87a8a - webarchive
- https://github.com/vithakur/detections/blob/main/STOP-ransomware-djvu/IOC-list - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Stormwind
Internal MISP references
UUID 98d5a891-f4dd-4c87-a019-1f1e7ab59301 which can be used as unique global reference for Stormwind in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
STOWAWAY
According to Mandiant, STOWAWAY is a publicly available backdoor and proxy. The project supports several types of communication like SSH, socks5. Backdoor component supports upload and download of files, remote shell and basic information gathering.
Internal MISP references
UUID cd187108-c557-42f8-8e48-1993abb37720 which can be used as unique global reference for STOWAWAY in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Stration
Internal MISP references
UUID 0439c5ec-306e-4473-84f7-50bdb5539fc2 which can be used as unique global reference for Stration in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
STRATOFEAR
Internal MISP references
UUID a968a42e-4162-46db-a96e-2a45927d1cd7 which can be used as unique global reference for STRATOFEAR in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
StrelaStealer
According to PCRisk, StrelaStealer seeks to extract email account log-in credentials. At the time of writing, this program targets Microsoft Outlook and Mozilla Thunderbird email clients.
Following successful infiltration, StrelaStealer searches for "logins.json" (account/password) and "key4.db" (password database) within the "%APPDATA%\Thunderbird\Profiles\" directory - by doing so, it can acquire the credentials for Thunderbird.
Alternatively, if Outlook credentials are targeted - StrelaStealer seeks out the Windows Registry from where it can retrieve the program's key and "IMAP User", "IMAP Server", as well as the "IMAP Password" values. Since the latter is kept in an encrypted form, the malicious program employs the Windows CryptUnprotectData feature to decrypt it prior to exfiltration.
Internal MISP references
UUID 17f84079-56b8-4be5-bc59-75c8526b0ce0 which can be used as unique global reference for StrelaStealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.strelastealer - webarchive
- https://medium.com/@DCSO_CyTec/shortandmalicious-strelastealer-aims-for-mail-credentials-a4c3e78c8abc - webarchive
- https://cert-agid.gov.it/news/analisi-tecnica-e-considerazioni-sul-malware-strela/ - webarchive
- https://research.openanalysis.net/strelastealer/stealer/2023/05/07/streala.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Stresspaint
Internal MISP references
UUID 00dedcea-4f87-4b6d-b12d-7749281b1366 which can be used as unique global reference for Stresspaint in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.stresspaint - webarchive
- https://www.bleepingcomputer.com/news/security/stresspaint-malware-steals-facebook-credentials-and-session-cookies/ - webarchive
- https://blog.radware.com/security/2018/04/stresspaint-malware-campaign-targeting-facebook-credentials/ - webarchive
- https://arstechnica.com/information-technology/2018/04/tens-of-thousands-of-facebook-accounts-compromised-in-days-by-malware/ - webarchive
- https://security.radware.com/malware/stresspaint-malware-targeting-facebook-credentials/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
StrifeWater RAT
Internal MISP references
UUID 5627aff2-7e1d-4b11-81f5-33cd7febdd76 which can be used as unique global reference for StrifeWater RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.strifewater_rat - webarchive
- https://www.secureworks.com/blog/abrahams-ax-likely-linked-to-moses-staff - webarchive
- https://www.fortinet.com/blog/threat-research/guard-your-drive-from-driveguard - webarchive
- https://securelist.com/a-hack-in-hand-is-worth-two-in-the-bush/110794/ - webarchive
- https://www.cybereason.com/blog/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
StrikeSuit Gift
Internal MISP references
UUID ec2a5a29-a142-447c-85b9-ec47e78f9cb2 which can be used as unique global reference for StrikeSuit Gift in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.strikesuit_gift - webarchive
- https://assets.stairwell.com/hubfs/Marketing-Assets/Stairwell-threat-report-The-origin-of-APT32-macros.pdf - webarchive
- https://ti.qianxin.com/blog/articles/english-version-of-new-approaches-utilized-by-oceanLotus-to-target-vietnamese-environmentalist/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
StrongPity
According to Mitre, StrongPity is an information stealing malware used by PROMETHIUM.
Internal MISP references
UUID da2969f2-01e9-4ca8-b2f3-5fc9a9891d57 which can be used as unique global reference for StrongPity in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.strongpity - webarchive
- https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html - webarchive
- https://anchorednarratives.substack.com/p/tracking-strongpity-with-yara - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf - webarchive
- https://0xthreatintel.medium.com/uncovering-apt-c-41-strongpity-backdoor-e7f9a7a076f4 - webarchive
- https://blogs.blackberry.com/en/2021/11/zebra2104 - webarchive
- https://mp.weixin.qq.com/s/nQVUkIwkiQTj2pLaNYHeOA - webarchive
- https://securelist.com/blog/research/76147/on-the-strongpity-waterhole-attacks-targeting-italian-and-belgian-encryption-users/ - webarchive
- https://www.welivesecurity.com/2017/12/08/strongpity-like-spyware-replaces-finfisher/ - webarchive
- https://twitter.com/physicaldrive0/status/786293008278970368 - webarchive
- https://blog.minerva-labs.com/a-new-strongpity-variant-hides-behind-notepad-installation - webarchive
- https://ti.qianxin.com/blog/articles/promethium-attack-activity-analysis-disguised-as-Winrar.exe/ - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://citizenlab.ca/2018/03/bad-traffic-sandvines-packetlogic-devices-deploy-government-spyware-turkey-syria/ - webarchive
- https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html - webarchive
- https://mp.weixin.qq.com/s/5No0TR4ECVPp_Xv4joXEBg - webarchive
- https://anchorednarratives.substack.com/p/recover-your-files-with-strongpity - webarchive
- https://cybleinc.com/2020/12/31/strongpity-apt-extends-global-reach-with-new-infrastructure/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Stuxnet
Internal MISP references
UUID 6ad84f52-0025-4a9d-861a-65c870f47988 which can be used as unique global reference for Stuxnet in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.stuxnet - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.atlanticcouncil.org/wp-content/uploads/2020/07/Breaking-trust-Shades-of-crisis-across-an-insecure-software-supply-chain.pdf - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf - webarchive
- https://medium.com/s2wlab/w3-may-en-story-of-the-week-code-signing-certificate-on-the-darkweb-94c7ec437001 - webarchive
- https://www.domaintools.com/resources/blog/visibility-monitoring-and-critical-infrastructure-security - webarchive
- https://www.codeproject.com/articles/246545/stuxnet-malware-analysis-paper - webarchive
- https://fmmresearch.files.wordpress.com/2020/09/theemeraldconnectionreport_fmmr-2.pdf - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://storage.googleapis.com/chronicle-research/STUXSHOP%20Stuxnet%20Dials%20In%20.pdf - webarchive
- https://www.spiegel.de/netzwelt/web/die-erste-cyberwaffe-und-ihre-folgen-a-a0ed08c9-5080-4ac2-8518-ed69347dc147 - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/10/20114955/Bartholomew-GuerreroSaade-VB2016.pdf - webarchive
- http://artemonsecurity.blogspot.de/2017/04/stuxnet-drivers-detailed-analysis.html - webarchive
- https://web.archive.org/web/20230416140914if_/http://www.chinaview.cn/20230411/4e0fa0f4fd1d408aaddeef8be63a4757/202304114e0fa0f4fd1d408aaddeef8be63a4757_20230411161526_0531.pdf - webarchive
- https://media.ccc.de/v/27c3-4245-en-adventures_in_analyzing_stuxnet - webarchive
- https://www.welivesecurity.com/media_files/white-papers/Stuxnet_Under_the_Microscope.pdf - webarchive
- https://fmmresearch.wordpress.com/2020/09/28/the-emerald-connection-equationgroup-collaboration-with-stuxnet/ - webarchive
- https://www.crysys.hu/publications/files/tedi/ukatemicrysys_territorialdispute.pdf - webarchive
- https://symantec.broadcom.com/hubfs/Attacks-Against-Critical_Infrastructrure.pdf - webarchive
- https://news.yahoo.com/revealed-how-a-secret-dutch-mole-aided-the-us-israeli-stuxnet-cyber-attack-on-iran-160026018.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Subzero
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Subzero.
| Known Synonyms |
|---|
Corelump |
Jumplump |
Internal MISP references
UUID 72fb9dd2-33bf-4620-bf03-92630d7da101 which can be used as unique global reference for Subzero in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.subzero - webarchive
- https://www.focus.de/politik/vorab-aus-dem-focus-volle-kontrolle-ueber-zielcomputer-das-raetsel-um-die-spionage-app-fuehrt-ueber-wirecard-zu-putin_id_24442733.html - webarchive
- https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/ - webarchive
- https://cdn.netzpolitik.org/wp-upload/2021/12/2018-08-28_DSIRF_Company-Profile-Gov.redacted.pdf - webarchive
- https://netzpolitik.org/2021/dsirf-wir-enthuellen-den-staatstrojaner-subzero-aus-oesterreich/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SUCEFUL
Internal MISP references
UUID efe586da-a272-4898-9ebb-587f8f5a23ca which can be used as unique global reference for SUCEFUL in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sugar
Ransomware, written in Delphi.
Internal MISP references
UUID ea7d0457-3625-4224-aed4-739a360b10d3 which can be used as unique global reference for Sugar in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sugar - webarchive
- https://medium.com/walmartglobaltech/sugar-ransomware-a-new-raas-a5d94d58d9fb - webarchive
- https://cyware.com/news/newly-found-sugar-ransomware-is-now-being-offered-as-raas-641cfa69 - webarchive
- https://medium.com/s2wblog/tracking-sugarlocker-ransomware-3a3492353c49 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SUGARDUMP
According to Mandiant, SUGARDUMP is a credential harvesting utility, capable of password collection from Chromium-based browsers. There are also versions to exfiltrate data via SMTP and HTTP.
Internal MISP references
UUID 655c3dbb-8d2c-4613-8722-ec12b24d5956 which can be used as unique global reference for SUGARDUMP in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SUGARRUSH
According to Mandiant, SUGARUSH is a backdoor written to establish a connection with an embedded C2 and to execute CMD commands.
Internal MISP references
UUID 129163aa-8539-40ee-a627-0ac6775697b5 which can be used as unique global reference for SUGARRUSH in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SUNBURST
FireEye describes SUNBURST as a trojanized SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. After an initial dormant period of up to two weeks, it uses a DGA to generate specific subdomains for a set C&C domain. The backdoor retrieves and executes commands, that include the ability to transfer files, execute files, profile the system, reboot the machine, and disable system services. The C2 traffic to the malicious domains is designed to mimic normal SolarWinds API communications: Orion Improvement Program (OIP) protocol. The backdoor uses multiple obfuscated blocklists to identify forensic and anti-virus tools running as processes, services, and drivers. Multiple trojanzied updates were digitally signed from March - May 2020 and posted to the SolarWinds updates website.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SUNBURST.
| Known Synonyms |
|---|
Solorigate |
Internal MISP references
UUID 34e50688-6955-4c28-8e18-50252e5ea711 which can be used as unique global reference for SUNBURST in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sunburst - webarchive
- https://twitter.com/cybercdh/status/1338885244246765569 - webarchive
- https://twitter.com/KimZetter/status/1338305089597964290 - webarchive
- https://www.cadosecurity.com/post/responding-to-solarigate - webarchive
- https://github.com/fireeye/Mandiant-Azure-AD-Investigator - webarchive
- https://blog.reversinglabs.com/blog/sunburst-the-next-level-of-stealth - webarchive
- https://unit42.paloaltonetworks.com/strategically-aged-domain-detection/ - webarchive
- https://www.trustedsec.com/blog/solarwinds-backdoor-sunburst-incident-response-playbook/?hss_channel=tw-403811306 - webarchive
- https://blog.talosintelligence.com/2020/12/solarwinds-supplychain-coverage.html#more - webarchive
- https://www.domaintools.com/resources/blog/unraveling-network-infrastructure-linked-to-the-solarwinds-hack - webarchive
- https://mp.weixin.qq.com/s/UqXC1vovKUu97569LkYm2Q - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-039a - webarchive
- https://news.sophos.com/en-us/2020/12/14/solarwinds-playbook/ - webarchive
- https://twitter.com/0xrb/status/1339199268146442241 - webarchive
- https://www.consilium.europa.eu/en/press/press-releases/2021/04/15/declaration-by-the-high-representative-on-behalf-of-the-european-union-expressing-solidarity-with-the-united-states-on-the-impact-of-the-solarwinds-cyber-operation - webarchive
- https://www.cyberark.com/resources/threat-research-blog/golden-saml-revisited-the-solorigate-connection - webarchive
- https://www.mimecast.com/blog/important-security-update/ - webarchive
- https://www.picussecurity.com/resource/blog/ttps-used-in-the-solarwinds-breach - webarchive
- https://cert.pl/posts/2023/04/kampania-szpiegowska-apt29/ - webarchive
- https://ics-cert.kaspersky.com/reports/2021/01/26/sunburst-industrial-victims/ - webarchive
- https://www.bleepingcomputer.com/news/security/the-solarwinds-cyberattack-the-hack-the-victims-and-what-we-know/ - webarchive
- https://prevasio.com/static/web/viewer.html?file=/static/Anatomy_Of_SolarWinds_Supply_Chain_Attack.pdf - webarchive
- https://therecord.media/solarwinds-says-fewer-than-100-customers-were-impacted-by-supply-chain-attack - webarchive
- https://pastebin.com/6EDgCKxd - webarchive
- https://labs.sentinelone.com/solarwinds-sunburst-backdoor-inside-the-stealthy-apt-campaign/ - webarchive
- https://www.splunk.com/en_us/blog/security/smoothing-the-bumps-of-onboarding-threat-indicators-into-splunk-enterprise-security.html - webarchive
- https://medium.com/mitre-attack/identifying-unc2452-related-techniques-9f7b6c7f3714 - webarchive
- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:MSIL/Solorigate.B!dha - webarchive
- https://www.fireeye.com/blog/threat-research/2020/12/sunburst-additional-technical-details.html - webarchive
- https://fidelissecurity.com/threatgeek/data-protection/ongoing-analysis-solarwinds-impact/ - webarchive
- https://www.prevasio.io/blog/sunburst-backdoor-a-deeper-look-into-the-solarwinds-supply-chain-malware - webarchive
- https://www.fireeye.com/blog/products-and-services/2021/02/light-in-the-dark-hunting-for-sunburst.html - webarchive
- https://msrc-blog.microsoft.com/2020/12/31/microsoft-internal-solorigate-investigation-update/ - webarchive
- https://www.domaintools.com/content/conceptualizing-a-continuum-of-cyber-threat-attribution.pdf - webarchive
- https://www.solarwinds.com/securityadvisory/faq - webarchive
- https://thenewstack.io/behind-the-scenes-of-the-sunburst-attack/ - webarchive
- https://netresec.com/?b=211f30f - webarchive
- https://us-cert.cisa.gov/sites/default/files/publications/SolarWinds_and_AD-M365_Compromise-Detecting_APT_Activity_from_Known_TTPs.pdf - webarchive
- https://blog.apiiro.com/detect-and-prevent-the-solarwinds-build-time-code-injection-attack - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-352a - webarchive
- https://www.youtube.com/watch?v=GfbxHy6xnbA - webarchive
- https://corelight.blog/2020/12/15/finding-sunburst-backdoor-with-zeek-logs-and-corelight/ - webarchive
- https://netresec.com/?b=211cd21 - webarchive
- https://www.youtube.com/watch?v=LA-XE5Jy2kU - webarchive
- https://unit42.paloaltonetworks.com/solarstorm-supply-chain-attack-timeline - webarchive
- https://www.justice.gov/opa/pr/department-justice-statement-solarwinds-update - webarchive
- https://www.youtube.com/watch?v=mbGN1xqy1jY - webarchive
- https://www.mfa.gov.lv/en/news/latest-news/67813-latvia-s-statement-following-the-announcement-by-the-united-states-of-actions-to-respond-to-the-russian-federation-s-destabilizing-activities - webarchive
- https://www.microsoft.com/en-us/security/business/threat-protection/solorigate-detection-guidance - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/threat-hunt-deep-dives-solarwinds-supply-chain-compromise-solorigate-sunburst-backdoor/ - webarchive
- https://netresec.com/?b=212a6ad - webarchive
- https://www.netresec.com/?page=Blog&month=2020-12&post=Reassembling-Victim-Domain-Fragments-from-SUNBURST-DNS - webarchive
- https://github.com/RedDrip7/SunBurst_DGA_Decode - webarchive
- https://vxug.fakedoma.in/samples/Exotic/UNC2452/SolarWinds%20Breach/ - webarchive
- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ - webarchive
- https://github.com/SentineLabs/SolarWinds_Countermeasures - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-unique-dga - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-attacks-stealthy-attackers-attempted-evade-detection - webarchive
- https://github.com/github/codeql/tree/main/csharp/ql/src/experimental/Security%20Features/campaign - webarchive
- https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/ - webarchive
- https://github.com/fireeye/sunburst_countermeasures - webarchive
- https://twitter.com/lordx64/status/1338526166051934213 - webarchive
- https://www.bleepingcomputer.com/news/security/autodesk-reveals-it-was-targeted-by-russian-solarwinds-hackers/ - webarchive
- https://blog.gigamon.com/2021/07/27/ghosts-on-the-wire-expanding-conceptions-of-network-anomalies/ - webarchive
- https://techcommunity.microsoft.com/t5/azure-active-directory-identity/azure-ad-workbook-to-help-you-assess-solorigate-risk/ba-p/2010718 - webarchive
- https://blog.truesec.com/2021/01/07/avoiding-supply-chain-attacks-similar-to-solarwinds-orions-sunburst - webarchive
- https://notes.netbytesec.com/2021/01/solarwinds-attack-sunbursts-dll.html - webarchive
- https://mp.weixin.qq.com/s/v-ekPFtVNZG1W7vWjcuVug - webarchive
- https://us-cert.cisa.gov/remediating-apt-compromised-networks - webarchive
- https://cocomelonc.github.io/malware/2022/09/10/malware-pers-10.html - webarchive
- https://orangematter.solarwinds.com/2021/01/11/new-findings-from-our-investigation-of-sunburst/ - webarchive
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ - webarchive
- https://www.sans.org/webcasts/contrarian-view-solarwinds-119515 - webarchive
- https://www.microsoft.com/security/blog/2021/01/14/increasing-resilience-against-solorigate-and-other-sophisticated-attacks-with-microsoft-defender/ - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://twitter.com/cybercdh/status/1338975171093336067 - webarchive
- https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/ - webarchive
- https://github.com/cisagov/CHIRP - webarchive
- https://www.ironnet.com/blog/a-closer-look-at-the-solarwinds/sunburst-malware-dga-or-dns-tunneling - webarchive
- https://www.nato.int/cps/en/natolive/official_texts_183168.htm?selectedLocale=en - webarchive
- https://netresec.com/?b=2113a6a - webarchive
- https://unit42.paloaltonetworks.com/atoms/solarphoenix/ - webarchive
- https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f - webarchive
- https://blog.truesec.com/2020/12/17/the-solarwinds-orion-sunburst-supply-chain-attack/ - webarchive
- https://www.cyborgsecurity.com/blog/sunburst-solarwinds-supply-chain-attack/ - webarchive
- https://www.brighttalk.com/webcast/7451/469525 - webarchive
- https://www.bleepingcomputer.com/news/security/nasa-and-the-faa-were-also-breached-by-the-solarwinds-hackers/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sunburst-supply-chain-attack-solarwinds - webarchive
- https://www.gov.pl/web/diplomacy/statement-on-solar-winds-orion-cyberattacks - webarchive
- https://file2.api.drift.com/download/drift-prod-file-uploads/417f%2F417f74ae8ddd24aa7c2b43a23093983f/Supply%20Chain%20Attacks_%20Cyber%20Criminals%20Target%20the%20Weakest%20Link.pdf - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa21-077a - webarchive
- https://blog.cloudflare.com/solarwinds-orion-compromise-trend-data/ - webarchive
- https://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal/ - webarchive
- https://www.mandiant.com/resources/unc2452-merged-into-apt29 - webarchive
- https://www.youtube.com/watch?v=-Vsgmw2G4Wo - webarchive
- https://zengo.com/ungilded-secrets-a-new-paradigm-for-key-security/ - webarchive
- https://www.domaintools.com/resources/blog/change-in-perspective-on-the-utility-of-sunburst-related-network-indicators# - webarchive
- https://github.com/sophos-cybersecurity/solarwinds-threathunt - webarchive
- https://www.youtube.com/watch?v=cMauHTV-lJg - webarchive
- https://twitter.com/cybercdh/status/1339241246024404994 - webarchive
- https://www.splunk.com/en_us/blog/security/sunburst-backdoor-detections-in-splunk.html - webarchive
- https://securelist.com/sunburst-connecting-the-dots-in-the-dns-requests/99862/ - webarchive
- https://blog.bushidotoken.net/2022/07/space-invaders-cyber-threats-that-are.html - webarchive
- https://blog.cloudflare.com/a-quirk-in-the-sunburst-dga-algorithm/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a - webarchive
- https://youtu.be/Ta_vatZ24Cs?t=59 - webarchive
- https://www.netresec.com/?page=Blog&month=2020-12&post=Extracting-Security-Products-from-SUNBURST-DNS-Beacons - webarchive
- https://www.wired.com/story/hacker-lexicon-what-is-a-supply-chain-attack/ - webarchive
- https://blog.prevasio.com/2020/12/sunburst-backdoor-part-ii-dga-list-of.html - webarchive
- https://go.recordedfuture.com/hubfs/reports/pov-2020-1230.pdf - webarchive
- https://mitre-attack.github.io/attack-navigator/#layerURL=https://raw.githubusercontent.com/center-for-threat-informed-defense/public-resources/master/solorigate/UNC2452.json
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware - webarchive
- https://threatconnect.com/blog/tracking-sunburst-related-activity-with-threatconnect-dashboards - webarchive
- https://www.a12d404.net/ranting/2021/01/17/msbuild-backdoor.html - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-sunburst-command-control - webarchive
- https://www.bleepingcomputer.com/news/security/fireeye-microsoft-create-kill-switch-for-solarwinds-backdoor/ - webarchive
- https://blogs.microsoft.com/on-the-issues/2020/12/17/cyberattacks-cybersecurity-solarwinds-fireeye/ - webarchive
- https://www.youtube.com/watch?v=dV2QTLSecpc - webarchive
- https://www.aon.com/cyber-solutions/aon_cyber_labs/cloudy-with-a-chance-of-persistent-email-access/ - webarchive
- https://vrieshd.medium.com/finding-sunburst-victims-and-targets-by-using-passivedns-osint-68f5704a3cdc - webarchive
- https://www.brighttalk.com/webcast/7451/462719 - webarchive
- https://www.zscaler.com/blogs/security-research/hitchhikers-guide-solarwinds-incident-response - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-134a - webarchive
- https://twitter.com/FireEye/status/1339295983583244302 - webarchive
- https://community.ibm.com/community/user/security/blogs/gladys-koskas1/2020/12/18/sunburst-indicator-detection-in-qradar - webarchive
- https://www.bleepingcomputer.com/news/security/mimecast-links-security-breach-to-solarwinds-hackers/ - webarchive
- https://medium.com/insomniacs/a-look-into-sunbursts-dga-ba4029193947 - webarchive
- https://drive.google.com/file/d/1R79Q1oC18GmKK8FYBoYEt0vYF7SpsvQI/view - webarchive
- https://www.cisa.gov/news/2021/01/05/joint-statement-federal-bureau-investigation-fbi-cybersecurity-and-infrastructure - webarchive
- https://techcommunity.microsoft.com/t5/azure-active-directory-identity/understanding-quot-solorigate-quot-s-identity-iocs-for-identity/ba-p/2007610 - webarchive
- https://research.checkpoint.com/2021/deep-into-the-sunburst-attack/ - webarchive
- https://www.comae.com/posts/sunburst-memory-analysis/ - webarchive
- https://www.domaintools.com/resources/blog/continuous-eruption-further-analysis-of-the-solarwinds-supply-incident - webarchive
- https://twitter.com/Intel471Inc/status/1339233255741120513 - webarchive
- https://www.trustedsec.com/blog/solarwinds-orion-and-unc2452-summary-and-recommendations/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/how-a-device-to-cloud-architecture-defends-against-the-solarwinds-supply-chain-compromise/ - webarchive
- https://www.cisa.gov/supply-chain-compromise - webarchive
- https://blog.prevasio.com/2020/12/sunburst-backdoor-part-iii-dga-security.html - webarchive
- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - webarchive
- https://www.4hou.com/posts/KzZR - webarchive
- https://twitter.com/ItsReallyNick/status/1338382939835478016 - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/threat-intel-takeaways-solarigate - webarchive
- https://blog.prevasio.com/2020/12/sunburst-backdoor-deeper-look-into.html - webarchive
- https://www.mimecast.com/incident-report/ - webarchive
- https://www.fireeye.com/current-threats/sunburst-malware.html - webarchive
- https://www.fortinet.com/blog/threat-research/what-we-have-learned-so-far-about-the-sunburst-solarwinds-hack - webarchive
- https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware - webarchive
- https://www.mandiant.com/media/10916/download - webarchive
- https://www.solarwinds.com/securityadvisory - webarchive
- https://news.sophos.com/en-us/2020/12/21/how-sunburst-malware-does-defense-evasion/ - webarchive
- https://twitter.com/megabeets_/status/1339308801112027138 - webarchive
- https://www.domaintools.com/resources/blog/the-devils-in-the-details-sunburst-attribution - webarchive
- https://mp.weixin.qq.com/s/lh7y_KHUxag_-pcFBC7d0Q - webarchive
- https://www.elastic.co/blog/supervised-and-unsupervised-machine-learning-for-dga-detection - webarchive
- https://www.youtube.com/watch?v=JoMwrkijTZ8 - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-sunburst-sending-data - webarchive
- https://www.microsoft.com/security/blog/2020/12/28/using-microsoft-365-defender-to-coordinate-protection-against-solorigate/ - webarchive
- https://community.riskiq.com/article/9a515637 - webarchive
- https://www.crowdstrike.com/blog/crowdstrike-launches-free-tool-to-identify-and-help-mitigate-risks-in-azure-active-directory/ - webarchive
- https://r136a1.info/2022/06/18/using-dotnetfile-to-get-a-sunburst-timeline-for-intelligence-gathering/ - webarchive
- https://www.microsoft.com/security/blog/2021/02/25/microsoft-open-sources-codeql-queries-used-to-hunt-for-solorigate-activity/ - webarchive
- https://docs.google.com/spreadsheets/d/1u0_Df5OMsdzZcTkBDiaAtObbIOkMa5xbeXdKk_k0vWs - webarchive
- https://www.sec.gov/ix?doc=/Archives/edgar/data/1739942/000173994221000076/swi-20210507.htm - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/additional-analysis-into-the-sunburst-backdoor/ - webarchive
- https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/ - webarchive
- https://us-cert.cisa.gov/ncas/current-activity/2020/12/13/active-exploitation-solarwinds-software - webarchive
- https://msrc-blog.microsoft.com/2020/12/21/december-21st-2020-solorigate-resource-center/ - webarchive
- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - webarchive
- https://securelist.com/sunburst-backdoor-kazuar/99981/ - webarchive
- https://www.securonix.com/web/wp-content/uploads/2020/12/threat_research_solarwinds_sunburst_eclipser_supply_chain.pdf - webarchive
- https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ - webarchive
- https://www.prevasio.io/blog/sunburst-backdoor-part-ii-dga-the-list-of-victims - webarchive
- https://www.ironnet.com/blog/solarwinds/sunburst-behavioral-analytics-and-collective-defense-in-action - webarchive
- https://youtu.be/SW8kVkwDOrc?t=24706 - webarchive
- https://techcommunity.microsoft.com/t5/azure-sentinel/solarwinds-post-compromise-hunting-with-azure-sentinel/ba-p/1995095 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SunCrypt
According to PCrisk, Suncrypt ransomware prevents victims from accessing files by encryption. It also renames all encrypted files and creates a ransom message. It renames encrypted files by appending a string of random characters as the new extension.
Internal MISP references
UUID 018fb88b-a3cd-46b7-adea-a5b85302715b which can be used as unique global reference for SunCrypt in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.suncrypt - webarchive
- https://ke-la.com/to-attack-or-not-to-attack-targeting-the-healthcare-sector-in-the-underground-ecosystem/ - webarchive
- https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound - webarchive
- https://blog.minerva-labs.com/suncrypt-ransomware-gains-new-abilities-in-2022 - webarchive
- https://pcsxcetrasupport3.wordpress.com/2021/03/28/suncrypt-powershell-obfuscation-shellcode-and-more-yara/ - webarchive
- https://www.intezer.com/blog/malware-analysis/when-viruses-mutate-did-suncrypt-ransomware-evolve-from-qnapcrypt - webarchive
- https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/ - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/evolving-danger-ransomware-extortion - webarchive
- https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-april-1st-2022-i-can-fight-with-a-keyboard/ - webarchive
- https://medium.com/s2wlab/w4-july-en-story-of-the-week-ransomware-on-the-darkweb-c61965d0386a - webarchive
- https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf - webarchive
- https://medium.com/@sapphirex00/diving-into-the-sun-suncrypt-a-new-neighbour-in-the-ransomware-mafia-d89010c9df83 - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/ - webarchive
- https://medium.com/s2wlab/case-analysis-of-suncrypt-ransomware-negotiation-and-bitcoin-transaction-43a2194ac0bc - webarchive
- https://www.bleepingcomputer.com/news/security/suncrypt-ransomware-is-still-alive-and-kicking-in-2022/ - webarchive
- https://blog.chainalysis.com/reports/ransomware-connections-maze-egregor-suncrypt-doppelpaymer - webarchive
- https://cdn.pathfactory.com/assets/10555/contents/394789/0dd521f8-aa64-4517-834e-bc852e9ab95d.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.tesorion.nl/en/posts/shining-a-light-on-suncrypts-curious-file-encryption-mechanism/ - webarchive
- https://www.bleepingcomputer.com/news/security/suncrypt-ransomware-sheds-light-on-the-maze-ransomware-cartel/ - webarchive
- https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel - webarchive
- https://www.trendmicro.com/en_us/research/22/g/gootkit-loaders-updated-tactics-and-fileless-delivery-of-cobalt-strike.html - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SunOrcal
Internal MISP references
UUID a51b82ba-7e32-4a8e-b5d0-8d0441bdcce4 which can be used as unique global reference for SunOrcal in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SunSeed
According to Proofpoint, this is a Lua-based malware likely used by a nation-state sponsored attacker used to target European government personnel involved in managing the logistics of refugees fleeing Ukraine.
Internal MISP references
UUID a89f7e01-b049-4d09-aca3-ce19d91c4544 which can be used as unique global reference for SunSeed in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sunseed - webarchive
- https://blogs.blackberry.com/en/2022/03/threat-thursday-sunseed-malware - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SuperBear RAT
Internal MISP references
UUID a6ca0a04-359d-4f7a-b556-46b33ec75473 which can be used as unique global reference for SuperBear RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SUPERNOVA
According to CISA, SUPERNOVA is a malicious webshell backdoor that allows a remote operator to dynamically inject C# source code into a web portal to subsequently inject code. APT actors use SUPERNOVA to perform reconnaissance, conduct domain mapping, and steal sensitive information and credentials.
Internal MISP references
UUID 62674a18-54c6-4c57-84cc-ea6a3bb2d6d6 which can be used as unique global reference for SUPERNOVA in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.supernova - webarchive
- https://unit42.paloaltonetworks.com/solarstorm-supernova - webarchive
- https://twitter.com/MalwareRE/status/1342888881373503488 - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a - webarchive
- https://www.splunk.com/en_us/blog/security/detecting-supernova-malware-solarwinds-continued.html - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-027a - webarchive
- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - webarchive
- https://github.com/fireeye/sunburst_countermeasures/pull/5 - webarchive
- https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/ - webarchive
- https://unit42.paloaltonetworks.com/solarstorm-supernova/ - webarchive
- https://www.solarwinds.com/securityadvisory - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa21-008a - webarchive
- https://www.sentinelone.com/labs/solarwinds-understanding-detecting-the-supernova-webshell-trojan - webarchive
- https://github.com/fireeye/sunburst_countermeasures - webarchive
- https://www.guidepointsecurity.com/blog/supernova-solarwinds-net-webshell-analysis - webarchive
- https://www.youtube.com/watch?v=7WX5fCEzTlA - webarchive
- https://labs.sentinelone.com/solarwinds-understanding-detecting-the-supernova-webshell-trojan/ - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/ - webarchive
- https://www.anquanke.com/post/id/226029 - webarchive
- https://www.solarwinds.com/securityadvisory/faq - webarchive
- https://www.secureworks.com/blog/supernova-web-shell-deployment-linked-to-spiral-threat-group - webarchive
- https://www.cisa.gov/news-events/analysis-reports/ar21-112a - webarchive
- https://www.splunk.com/en_us/blog/security/supernova-redux-with-a-generous-portion-of-masquerading.html - webarchive
- https://www.trendmicro.com/en_us/research/20/l/overview-of-recent-sunburst-targeted-attacks.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SuppoBox
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SuppoBox.
| Known Synonyms |
|---|
Bayrob |
Nivdort |
Internal MISP references
UUID dd9939a4-df45-4c7c-8a8d-83b40766aacd which can be used as unique global reference for SuppoBox in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.suppobox - webarchive
- https://paper.bobylive.com/Meeting_Papers/BlackHat/USA-2013/US-13-Geffner-End-To-End-Analysis-of-a-Domain-Generating-Algorithm-Malware-Family-WP.pdf - webarchive
- https://blog.avast.com/2013/06/18/your-facebook-connection-is-now-secured/ - webarchive
- https://www.symantec.com/connect/blogs/bayrob-three-suspects-extradited-face-charges-us - webarchive
- https://media.blackhat.com/us-13/US-13-Geffner-End-To-End-Analysis-of-a-Domain-Generating-Algorithm-Malware-Family-WP.pdf - webarchive
- https://www.symantec.com/connect/blogs/trojanbayrob-strikes-again-1 - webarchive
- https://www.justice.gov/opa/pr/two-romanian-cybercriminals-convicted-all-21-counts-relating-infecting-over-400000-victim - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
surtr
According to PCrisk, Surtr is ransomware. Malware of this type encrypts files (and renames them) and generates a ransom note. Surtr appends the decryptmydata@mailfence.com email address and the ".SURT" extension to filenames.
Internal MISP references
UUID 8666afcc-8cc2-4856-83de-b7e8b4309367 which can be used as unique global reference for surtr in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SVCReady
According to PCrisk, SVCReady collects information about the infected system such as username, computer name, time zone, computer manufacturer, BIOS, and firmware. Also, it gathers lists of running processes and installed software. SVCReady sends collected data to the C2 server. Additionally, SVCReady attempts to maintain its foothold on the system by creating a scheduled task.
Internal MISP references
UUID 20157c10-2a5f-49d9-baf5-d350fb65c06e which can be used as unique global reference for SVCReady in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
swen
Internal MISP references
UUID 63657a3b-1f8f-422d-80de-fe4644f5d7ba which can be used as unique global reference for swen in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SwiftSlicer
According to ESET, this is a wiper written in Go, that was deployed against an Ukrainian organization on January 25th 2023 through Group Policy, which suggests that the attackers had taken control of the victim’s Active Directory environment.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SwiftSlicer.
| Known Synonyms |
|---|
JaguarBlade |
Internal MISP references
UUID dba43d45-053f-4225-b813-ff7727b2b7d2 which can be used as unique global reference for SwiftSlicer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.swiftslicer - webarchive
- https://twitter.com/ESETresearch/status/1618960022150729728 - webarchive
- https://www.microsoft.com/en-us/security/business/security-insider/wp-content/uploads/2023/03/A-year-of-Russian-hybrid-warfare-in-Ukraine_MS-Threat-Intelligence-1.pdf - webarchive
- https://www.welivesecurity.com/2023/01/27/swiftslicer-new-destructive-wiper-malware-ukraine/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sword
Internal MISP references
UUID 2112870f-06f1-44a9-9c43-6cc4fb90e295 which can be used as unique global reference for Sword in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
sykipot
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular sykipot.
| Known Synonyms |
|---|
Wkysol |
getkys |
Internal MISP references
UUID 99ffeb75-8d21-43a2-b5f7-f58bcbac2228 which can be used as unique global reference for sykipot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sykipot - webarchive
- https://www.symantec.com/connect/blogs/sykipot-attacks - webarchive
- https://community.rsa.com/thread/185437 - webarchive
- https://documents.trendmicro.com/assets/wp/wp-detecting-apt-activity-with-network-traffic-analysis.pdf - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/sykipot-now-targeting-us-civil-aviation-sector-information/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-edison - webarchive
- https://www.alienvault.com/blogs/labs-research/sykipot-is-back - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SynAck
Internal MISP references
UUID a396a0bb-6dc5-424a-bdbd-f8ba808ca2c2 which can be used as unique global reference for SynAck in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SyncCrypt
Internal MISP references
UUID e717a26d-17aa-4cd7-88de-dc75aa365232 which can be used as unique global reference for SyncCrypt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SynFlooder
Internal MISP references
UUID d327b4d9-e1c8-4c71-b9fe-775d1607e7d4 which can be used as unique global reference for SynFlooder in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Synth Loader
Internal MISP references
UUID ffd74637-b518-4622-939b-c0669a81f3a9 which can be used as unique global reference for Synth Loader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sys10
Internal MISP references
UUID 2ae57534-6aac-4025-8d93-888dab112b45 which can be used as unique global reference for Sys10 in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sys10 - webarchive
- https://securelist.com/analysis/publications/69953/the-naikon-apt/ - webarchive
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/TheNaikonAPT-MsnMM1.pdf - webarchive
- https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Syscon
SYSCON is a Remote Access Trojan used in a targeted champing against US government agencies. It has been recently observed in conjunction with CARROTBAT and CARROTBALL downloaders and it uses the File Transfer Protocol as Command and Control channel. Use of the family is attributed by Unit 42 to the Konni Group.
Internal MISP references
UUID 4f079a71-bb1b-47b6-a6d0-26a37cd8a3a6 which can be used as unique global reference for Syscon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.syscon - webarchive
- https://securingtomorrow.mcafee.com/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/ - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/syscon-backdoor-uses-ftp-as-a-cc-channel/ - webarchive
- https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SysGet
Internal MISP references
UUID a4b9c526-42d0-4de9-ab8e-e78f99655d11 which can be used as unique global reference for SysGet in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sysget - webarchive
- http://researchcenter.paloaltonetworks.com/2017/01/unit42-dragonok-updates-toolset-targets-multiple-geographic-regions/ - webarchive
- http://csecybsec.com/download/zlab/20180713_CSE_APT28_X-Agent_Op-Roman%20Holiday-Report_v6_1.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SysJoker (Windows)
Sysjoker is a backdoor malware that was first discovered in December 2021 by Intezer. It is sophisticated and written from scratch in C++. Sysjoker is a cross-platform malware that has Linux, Windows, and macOS variants. Possible attack vectors for Sysjoker are email attachments, malicious advertisements, and trojanized software.
Internal MISP references
UUID 16387289-9064-4ae9-8493-0a3623cdfd9a which can be used as unique global reference for SysJoker (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.sysjoker - webarchive
- https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/ - webarchive
- https://www.bleepingcomputer.com/news/security/new-sysjoker-backdoor-targets-windows-macos-and-linux/ - webarchive
- https://blogs.vmware.com/security/2022/03/%e2%80%afsysjoker-an-analysis-of-a-multi-os-rat.html - webarchive
- https://research.checkpoint.com/2023/israel-hamas-war-spotlight-shaking-the-rust-off-sysjoker/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SysKit
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SysKit.
| Known Synonyms |
|---|
IvizTech |
MANGOPUNCH |
Internal MISP references
UUID 4922f27b-a97c-4d6b-9425-1705f4716ee0 which can be used as unique global reference for SysKit in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.syskit - webarchive
- https://www.symantec.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain - webarchive
- https://twitter.com/QW5kcmV3/status/1176861114535165952 - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/i-knew-you-were-trouble-ta456-targets-defense-contractor-alluring-social-media - webarchive
- https://www.darkreading.com/threat-intelligence/iranian-government-hackers-target-us-veterans/d/d-id/1335897 - webarchive
- https://about.fb.com/news/2021/07/taking-action-against-hackers-in-iran/ - webarchive
- https://blog.talosintelligence.com/2019/09/tortoiseshell-fake-veterans.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sysraw Stealer
Sysraw stealer got its name because at some point, it was started as "ZSysRaw\sysraw.exe". PDB strings suggest the name "Clipsa" though. First stage connects to /WPCoreLog/, the second one to /WPSecurity/. Its behavior suggest that it is an info stealer. It creates a rather large amount of files in a subdirectory (e.g. data) named "1?[-+].dat" and POSTs them.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sysraw Stealer.
| Known Synonyms |
|---|
Clipsa |
Internal MISP references
UUID f90e9fb9-d60d-415e-9f7f-786ee45f6947 which can be used as unique global reference for Sysraw Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Sysrv-hello (Windows)
Sysrv is a Golang written Cryptojacking malware. There are Windows and Linux variants.
Internal MISP references
UUID cabc5944-195e-4939-a00f-a3cd6758f308 which can be used as unique global reference for Sysrv-hello (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SysScan
Internal MISP references
UUID 7007b268-f6f4-4a01-9184-fc2334461c38 which can be used as unique global reference for SysScan in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
SystemBC
SystemBC is a proxy malware leveraging SOCKS5. Based on screenshots used in ads on a underground marketplace, Proofpoint decided to call it SystemBC.
SystemBC has been observed occasionally, but more pronounced since June 2019. First samples goes back to October 2018.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SystemBC.
| Known Synonyms |
|---|
Coroxy |
DroxiDat |
Internal MISP references
UUID cd0ad49d-7f79-45e0-91ba-c5eecdabe3aa which can be used as unique global reference for SystemBC in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc - webarchive
- https://cyber.wtf/2023/02/09/defeating-vmprotects-latest-tricks/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ - webarchive
- https://medium.com/walmartglobaltech/systembc-powershell-version-68c9aad0f85c - webarchive
- https://www.logpoint.com/en/blog/emerging-threat/defending-against-8base/ - webarchive
- https://www.intrinsec.com/proxynotshell-owassrf-merry-xchange/ - webarchive
- https://medium.com/walmartglobaltech/inside-the-systembc-malware-as-a-service-9aa03afd09c6 - webarchive
- https://www.bitsight.com/blog/systembc-multipurpose-proxy-bot-still-breathes - webarchive
- https://news.sophos.com/en-us/2020/10/14/inside-a-new-ryuk-ransomware-attack/ - webarchive
- https://labs.f-secure.com/blog/prelude-to-ransomware-systembc/ - webarchive
- https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis - webarchive
- https://www.proofpoint.com/us/threat-insight/post/systembc-christmas-july-socks5-malware-and-exploit-kits - webarchive
- https://community.riskiq.com/article/47766fbd - webarchive
- https://blogs.vmware.com/security/2023/06/8base-ransomware-a-heavy-hitting-player.html - webarchive
- https://securelist.com/focus-on-droxidat-systembc/110302/ - webarchive
- https://www.crowdstrike.com/blog/hypervisor-jackpotting-lack-of-antivirus-support-opens-the-door-to-adversaries/ - webarchive
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-batloader - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/play-ransomware-volume-shadow-copy - webarchive
- https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://isc.sans.edu/forums/diary/Excel+spreadsheets+push+SystemBC+malware/27060/ - webarchive
- https://news.sophos.com/en-us/2020/12/16/systembc/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-007.pdf - webarchive
- https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html - webarchive
- https://blog.reversinglabs.com/blog/code-reuse-across-packers-and-dll-loaders - webarchive
- https://securityintelligence.com/posts/trickbot-conti-crypters-where-are-they-now/ - webarchive
- https://www.intel471.com/blog/Cobalt-strike-cybercriminals-trickbot-qbot-hancitor - webarchive
- https://web.archive.org/web/20230209123148/https://www.cybereason.com/hubfs/THREAT%20ALERT%20GootLoader%20-%20Large%20payload%20leading%20to%20compromise%20(BLOG).pdf - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-249a - webarchive
- https://www.bitsight.com/blog/emotet-botnet-rises-again - webarchive
- https://asec.ahnlab.com/en/33600/ - webarchive
- https://docs.velociraptor.app/exchange/artifacts/pages/systembc/ - webarchive
- https://github.com/vc0RExor/Malware-Threat-Reports/blob/main/The%20Swiss%20Knife%20-%20SystemBC%20%7C%20Coroxy/The%20Swiss%20Knife-SystemBC_EN.pdf - webarchive
- https://www.kroll.com/en/insights/publications/cyber/black-basta-technical-analysis - webarchive
- https://www.mandiant.com/resources/chasing-avaddon-ransomware - webarchive
- https://www.reliaquest.com/blog/gootloader-infection-credential-access/ - webarchive
- https://news.sophos.com/en-us/2021/04/21/nearly-half-of-malware-now-use-tls-to-conceal-communications/ - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Szribi
Internal MISP references
UUID 66b1094f-7779-43ad-a32b-a9414babcc76 which can be used as unique global reference for Szribi in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.szribi - webarchive
- https://www.virusbulletin.com/virusbulletin/2007/11/spam-kernel - webarchive
- https://www.fireeye.com/blog/threat-research/2008/11/technical-details-of-srizbis-domain-generation-algorithm.html - webarchive
- https://web.archive.org/web/20160616170611/https://media.blackhat.com/bh-eu-10/presentations/Carrera_Silberman/BlackHat-EU-2010-Carrera-Silberman-State-of-Malware-slides.pdf - webarchive
- https://www.secureworks.com/research/srizbi - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TabMsgSQL
Internal MISP references
UUID 48aa9c41-f420-418b-975c-1fb6e2a91145 which can be used as unique global reference for TabMsgSQL in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
taidoor
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular taidoor.
| Known Synonyms |
|---|
simbot |
Internal MISP references
UUID 94323b32-9566-450b-8480-5f9f53b57948 which can be used as unique global reference for taidoor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.taidoor - webarchive
- https://www.macnica.net/file/mpressioncss_ta_report_2019.pdf - webarchive
- https://www.macnica.net/file/mpressioncss_2018-1h-report_mnc_rev3_nopw.pdf - webarchive
- https://www.nttsecurity.com/docs/librariesprovider3/resources/taidoor%E3%82%92%E7%94%A8%E3%81%84%E3%81%9F%E6%A8%99%E7%9A%84%E5%9E%8B%E6%94%BB%E6%92%83%E8%A7%A3%E6%9E%90%E3%83%AC%E3%83%9D%E3%83%BC%E3%83%88_v1 - webarchive
- https://www.fireeye.com/blog/threat-research/2013/09/evasive-tactics-taidoor-3.html - webarchive
- https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf - webarchive
- https://documents.trendmicro.com/assets/wp/wp-detecting-apt-activity-with-network-traffic-analysis.pdf - webarchive
- https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf - webarchive
- http://contagiodump.blogspot.com/2011/10/sep-28-cve-2010-3333-manuscript-with.html - webarchive
- https://blog.reversinglabs.com/blog/taidoor-a-truly-persistent-threat - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TAINTEDSCRIBE
Internal MISP references
UUID 014940fb-6e31-408a-962f-71914d0eb2f5 which can be used as unique global reference for TAINTEDSCRIBE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Taleret
Internal MISP references
UUID b0467c03-824f-4071-8668-f056110d2a50 which can be used as unique global reference for Taleret in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Tandfuy
Internal MISP references
UUID 88ff523e-206b-4918-8c93-e2829427eef2 which can be used as unique global reference for Tandfuy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Tapaoux
Internal MISP references
UUID 71e77349-98f5-49c6-bff7-6ed3b3d79410 which can be used as unique global reference for Tapaoux in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TargetCompany
This ransomware uses a combination of different crypto algorithms (ChaCha20, AES-128, Curve25519). The activity of this malware is dated to mid-June 2021. The extension of the encrypted files are set to the compromised company: .
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TargetCompany.
| Known Synonyms |
|---|
Fargo |
Mallox |
Tohnichi |
Internal MISP references
UUID 77af876d-84c5-4da3-a2b0-2fe5c77f758c which can be used as unique global reference for TargetCompany in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.targetcompany - webarchive
- https://news.sophos.com/en-us/2022/07/20/ooda-x-ops-takes-on-burgeoning-sql-server-attacks/ - webarchive
- https://unit42.paloaltonetworks.com/mallox-ransomware/ - webarchive
- https://id-ransomware.blogspot.com/2021/06/tohnichi-ransomware.html - webarchive
- https://asec.ahnlab.com/en/39152/ - webarchive
- https://decoded.avast.io/threatresearch/decrypted-targetcompany-ransomware/ - webarchive
- https://www.bleepingcomputer.com/news/security/free-decryptor-released-for-targetcompany-ransomware-victims/ - webarchive
- https://www.sangfor.com/blog/cybersecurity/new-threat-mallox-ransomware - webarchive
- https://www.trendmicro.com/en_us/research/23/f/xollam-the-latest-face-of-targetcompany.html - webarchive
- https://securityaffairs.co/wordpress/127761/malware/targetcompany-ransomware-decryptor.html - webarchive
- https://blog.cyble.com/2022/12/08/mallox-ransomware-showing-signs-of-increased-activity/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Tarsip
Internal MISP references
UUID ea6a62b2-db33-4d60-9823-5117c20b6457 which can be used as unique global reference for Tarsip in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Taurus Stealer
According to Zscaler, Taurus is a stealer that surfaced in June 2020. It is being developed by the author(s) that previously created Predator the Thief. The name overlaps partly with the StealerOne / Terra* family (also aliased Taurus Loader) but appears to be a completely disjunct project.
Internal MISP references
UUID 68b89458-f78e-41b3-b0ee-c193aaa948f9 which can be used as unique global reference for Taurus Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.taurus_stealer - webarchive
- https://www.zscaler.com/blogs/research/taurus-new-stealer-town - webarchive
- https://blog.minerva-labs.com/taurus-stealers-evolution - webarchive
- https://blog.morphisec.com/google-ppc-ads-deliver-redline-taurus-and-mini-redline-infostealers - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf - webarchive
- https://www.secureworks.com/research/the-growing-threat-from-infostealers - webarchive
- https://www.aon.com/cyber-solutions/aon_cyber_labs/agentvx-and-taurus/ - webarchive
- https://outpost24.com/blog/an-in-depth-analysis-of-the-new-taurus-stealer/ - webarchive
- https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/an-in-depth-analysis-of-the-new-taurus-stealer/ - webarchive
- https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Additional%20Analysis/UnknownTA/2020-09-07/Analysis.md - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TClient
Steve Miller pointed out that it is proxy-aware (Tencent) for C&C communication and uses wolfSSL, which makes it stick out.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TClient.
| Known Synonyms |
|---|
FIRESHADOW |
Internal MISP references
UUID fc551237-8db7-4cfd-a915-9e8410abb313 which can be used as unique global reference for TClient in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
tDiscoverer
F-Secure described tDiscoverer (also known as HammerDuke) as interesting because it is written in .NET, and even more so because of its occasional use of Twitter as a C&C communication channel. Some HammerDuke variants only contain a hardcoded C&C server address from which they will retrieve commands, but other HammerDuke variants will first use a custom algorithm to generate a Twitter account name based on the current date. If the account exists, HammerDuke will then search for tweets from that account with links to image files that contain embedded commands for the toolset to execute.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular tDiscoverer.
| Known Synonyms |
|---|
HAMMERTOSS |
HammerDuke |
Internal MISP references
UUID bbbf4786-1aba-40ac-8ad7-c9d8c66197a8 which can be used as unique global reference for tDiscoverer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tdiscoverer - webarchive
- https://www2.fireeye.com/rs/848-DID-242/images/rpt-apt29-hammertoss.pdf - webarchive
- https://securityintelligence.com/hammertoss-what-me-worry/ - webarchive
- https://mrtiepolo.medium.com/sophisticated-apt29-campaign-abuses-notion-api-to-target-the-european-commission-200188059f58 - webarchive
- https://www.youtube.com/watch?v=UE9suwyuic8 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TDTESS
Internal MISP references
UUID 99d83ee8-6870-4af2-a3c8-cf86baff7cb3 which can be used as unique global reference for TDTESS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TeamSpy
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TeamSpy.
| Known Synonyms |
|---|
TVRAT |
TVSPY |
TeamViewerENT |
Internal MISP references
UUID 9a82b6f6-2fdf-47bc-af05-cf7ce225fc96 which can be used as unique global reference for TeamSpy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.teamspy - webarchive
- https://thedfirreport.com/2020/04/24/ursnif-via-lolbins/ - webarchive
- https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/spy-agent - webarchive
- https://www.deepinstinct.com/blog/the-russian-spyagent-a-decade-later-and-rat-tools-remain-at-risk - webarchive
- https://blog.avast.com/a-deeper-look-into-malware-abusing-teamviewer - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/unsupported-teamviewer-versions-exploited-backdoors-keylogging - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TEARDROP
TEARDROP is a memory only dropper that runs as a service, spawns a thread and reads from the file “gracious_truth.jpg”, which likely has a fake JPG header. Next it checks that HKU\SOFTWARE\Microsoft\CTF exists, decodes an embedded payload using a custom rolling XOR algorithm and manually loads into memory an embedded payload using a custom PE-like file format. TEARDROP does not have code overlap with any previously seen malware. FireEye believe that this was used to execute a customized Cobalt Strike BEACON.
Internal MISP references
UUID efa01fef-7faf-4bb2-8630-b3a237df882a which can be used as unique global reference for TEARDROP in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.teardrop - webarchive
- https://unit42.paloaltonetworks.com/atoms/solarphoenix/ - webarchive
- https://www.youtube.com/watch?v=LA-XE5Jy2kU - webarchive
- https://unit42.paloaltonetworks.com/solarstorm-supply-chain-attack-timeline - webarchive
- https://symantec.broadcom.com/hubfs/Attacks-Against-Government-Sector.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sunburst-supply-chain-attack-solarwinds - webarchive
- https://blog.talosintelligence.com/2020/12/solarwinds-supplychain-coverage.html#more - webarchive
- https://file2.api.drift.com/download/drift-prod-file-uploads/417f%2F417f74ae8ddd24aa7c2b43a23093983f/Supply%20Chain%20Attacks_%20Cyber%20Criminals%20Target%20the%20Weakest%20Link.pdf - webarchive
- https://www.mandiant.com/resources/unc2452-merged-into-apt29 - webarchive
- https://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal/ - webarchive
- https://twitter.com/TheEnergyStory/status/1342041055563313152 - webarchive
- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/threat-intel-takeaways-solarigate - webarchive
- https://www.fortinet.com/blog/threat-research/what-we-have-learned-so-far-about-the-sunburst-solarwinds-hack - webarchive
- https://blog.bushidotoken.net/2022/07/space-invaders-cyber-threats-that-are.html - webarchive
- https://blog.securehat.co.uk/malware-analysis/extracting-the-cobalt-strike-config-from-a-teardrop-loader - webarchive
- https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware - webarchive
- https://twitter.com/TheEnergyStory/status/1346096298311741440 - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-039b - webarchive
- https://github.com/fireeye/sunburst_countermeasures - webarchive
- https://www.microsoft.com/security/blog/2020/12/28/using-microsoft-365-defender-to-coordinate-protection-against-solorigate/ - webarchive
- https://medium.com/mitre-attack/identifying-unc2452-related-techniques-9f7b6c7f3714 - webarchive
- https://orangematter.solarwinds.com/2021/01/11/new-findings-from-our-investigation-of-sunburst/ - webarchive
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware - webarchive
- https://www.sans.org/webcasts/contrarian-view-solarwinds-119515 - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/ - webarchive
- https://msrc-blog.microsoft.com/2020/12/21/december-21st-2020-solorigate-resource-center/ - webarchive
- https://twitter.com/craiu/status/1339954817247158272 - webarchive
- https://www.brighttalk.com/webcast/7451/462719 - webarchive
- https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ - webarchive
- https://www.youtube.com/watch?v=GfbxHy6xnbA - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TefoSteal
Internal MISP references
UUID aaa05037-aee1-4353-ace1-43ae0f558091 which can be used as unique global reference for TefoSteal in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TelAndExt
According to Check Point, this is a Telegram-focused infostealer (FTP / Delphi) used to target Iranian expats and dissidents.
Internal MISP references
UUID b2b5a816-2268-4cb8-9958-491356c452ec which can be used as unique global reference for TelAndExt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TelB
According to Check Point, this is a Telegram-focused infostealer (SOAP / Delphi) used to target Iranian expats and dissidents.
Internal MISP references
UUID daf2f70b-205e-4b39-89a6-d382ded4c33c which can be used as unique global reference for TelB in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TeleBot
Internal MISP references
UUID 06e0d676-8160-4b65-b6ea-d7634c962809 which can be used as unique global reference for TeleBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.telebot - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-viking - webarchive
- https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine - webarchive
- http://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/ - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-old-dogs-new-tricks.pdf - webarchive
- http://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TeleDoor
Internal MISP references
UUID b71f1656-975a-4daa-8109-00c30fd20410 which can be used as unique global reference for TeleDoor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.teledoor - webarchive
- https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/ - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-viking - webarchive
- http://blog.talosintelligence.com/2017/07/the-medoc-connection.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TelegramGrabber
Internal MISP references
UUID 48352761-a92f-43b4-931d-249ac9eae8b2 which can be used as unique global reference for TelegramGrabber in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Telemiris
Internal MISP references
UUID f39400a3-3b27-4dc6-bccd-aa277ca99f28 which can be used as unique global reference for Telemiris in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Teleport
Cisco Talos reports that this is a data exfiltration tool used by TA505.
Internal MISP references
UUID b6a2a1ea-6cdb-4cbd-a9a6-539c7db1c6de which can be used as unique global reference for Teleport in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TellYouThePass
According to PCrisk, Tellyouthepass is one of many ransomware-type programs used to block access to files by encryption and keep them in this state unless a ransom is paid.
The program renames all encrypted files by adding the ".locked" extension and creates a ransom message in a text file called "README.html". For example, "1.jpg" is renamed by Tellyouthepass to "1.jpg.locked".
According to cyber criminals, this ransomware encrypts data using RSA-1024 and AES-256 cryptography algorithms.
Internal MISP references
UUID fa1dbbef-c2b0-44a2-8457-764dfc99be17 which can be used as unique global reference for TellYouThePass in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tellyouthepass - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/log4j-vulnerabilities-attacks - webarchive
- https://www.crowdstrike.com/blog/tellyouthepass-ransomware-analysis-reveals-modern-reinterpretation-using-golang/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Tempedreve
Internal MISP references
UUID 26b2c2c0-036e-4e3a-a465-71a391046b74 which can be used as unique global reference for Tempedreve in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TempStealer
According to Cyble, this is a stealer targeting several crypto currency wallets along browser data.
Internal MISP references
UUID a27b7e55-6036-4c4a-96b2-0a99df878fe0 which can be used as unique global reference for TempStealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Terminator RAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Terminator RAT.
| Known Synonyms |
|---|
Fakem RAT |
Internal MISP references
UUID b127028b-ecb1-434b-abea-e4df3ca458b9 which can be used as unique global reference for Terminator RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.terminator_rat - webarchive
- http://contagiodump.blogspot.com/2012/06/rat-samples-from-syrian-targeted.html - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2014/01/Advanced-Persistent-Threats.pdf - webarchive
- https://malware.lu/assets/files/articles/RAP002_APT1_Technical_backstage.1.0.pdf - webarchive
- https://documents.trendmicro.com/assets/wp/wp-fakem-rat.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Termite
Internal MISP references
UUID c0801a29-ecc4-449b-9a1b-9d2dbde1995d which can be used as unique global reference for Termite in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.termite - webarchive
- https://www.mandiant.com/resources/evolution-of-fin7 - webarchive
- https://www.alienvault.com/blogs/labs-research/internet-of-termites - webarchive
- https://threatrecon.nshc.net/2019/03/19/sectorm04-targeting-singapore-custom-malware-analysis/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TerraPreter
Internal MISP references
UUID 8036e023-c765-4bd6-828f-1c8d20987843 which can be used as unique global reference for TerraPreter in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.terrapreter - webarchive
- https://www.esentire.com/security-advisories/hackers-spearphish-professionals-on-linkedin-with-fake-job-offers-infecting-them-with-malware-warns-esentire - webarchive
- https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/ - webarchive
- https://www.esentire.com/web-native-pages/unmasking-venom-spider - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TerraLoader
Internal MISP references
UUID ddfda5dc-a416-4cf3-b734-6aa083aa9e04 which can be used as unique global reference for TerraLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.terra_loader - webarchive
- https://medium.com/walmartglobaltech/a-re-look-at-the-terraloader-dropper-dll-e5947ad6e244 - webarchive
- https://www.esentire.com/web-native-pages/unmasking-venom-spider - webarchive
- https://www.esentire.com/blog/hackers-spearphish-corporate-hiring-managers-with-poisoned-resumes-infecting-them-with-the-more-eggs-malware - webarchive
- https://quointelligence.eu/2020/07/golden-chickens-evolution-of-the-maas/ - webarchive
- https://www.esentire.com/security-advisories/hackers-spearphish-professionals-on-linkedin-with-fake-job-offers-infecting-them-with-malware-warns-esentire - webarchive
- https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Additional%20Analysis/Terraloader/2021-03-25/Analysis.md#terraloader--congrats-you-have-a-new-fake-job- - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TerraRecon
According to QuoINT TerraRecon is a reconnaissance tool, looking for a specific piece of hardware and software targeting retail and payment services sectors. Attributed to Golden Chickens.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TerraRecon.
| Known Synonyms |
|---|
Taurus Loader Reconnaissance Module |
Internal MISP references
UUID d8efa615-87bf-4477-8261-316215c0b637 which can be used as unique global reference for TerraRecon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.terra_recon - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TerraStealer
According to QuoINT, TerraStealer (also known as SONE or StealerOne) is a generic reconnaissance tool, targeting for example email clients, web browsers, and file transfer utilities. Attributed to Golden Chickens.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TerraStealer.
| Known Synonyms |
|---|
SONE |
StealerOne |
Taurus Loader Stealer Module |
Internal MISP references
UUID d5c9a697-c7bf-4e13-8c2e-c74465e77208 which can be used as unique global reference for TerraStealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.terra_stealer - webarchive
- https://twitter.com/3xp0rtblog/status/1275746149719252992 - webarchive
- https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9 - webarchive
- https://quointelligence.eu/2020/07/golden-chickens-evolution-of-the-maas/ - webarchive
- https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/ - webarchive
- https://github.com/eset/malware-ioc/tree/master/evilnum - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TerraTV
TerraTV is a custom DLL designed to hijack legit TeamViewer applications. It was discovered and documented by QuoINT. It has been attributed to Golden Chickens malware as a service group.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TerraTV.
| Known Synonyms |
|---|
Taurus Loader TeamViewer Module |
Internal MISP references
UUID 0597af12-88d2-4289-a154-191774e3f48d which can be used as unique global reference for TerraTV in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.terra_tv - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/ - webarchive
- https://blog.minerva-labs.com/taurus-user-guided-infection - webarchive
- https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TeslaCrypt
According to Kaspersky, detected in February 2015, the new ransomware Trojan gained immediate notoriety as a menace to computer gamers. Amongst other types of target files, it tries to infect typical gaming files: game saves, user profiles, recoded replays etc. That said, TeslaCrypt does not encrypt files that are larger than 268 MB. Recently,
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TeslaCrypt.
| Known Synonyms |
|---|
cryptesla |
Internal MISP references
UUID bd79d5be-5c2f-45c1-ac99-0e755a61abad which can be used as unique global reference for TeslaCrypt in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.teslacrypt - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/03/teslacrypt-spam-campaign-unpaid-issue/ - webarchive
- https://blogs.cisco.com/security/talos/teslacrypt - webarchive
- https://www.endgame.com/blog/technical-blog/your-package-has-been-successfully-encrypted-teslacrypt-41a-and-malware-attack - webarchive
- https://success.trendmicro.com/solution/1113900-emerging-threat-on-ransom-cryptesla - webarchive
- https://securelist.com/teslacrypt-2-0-disguised-as-cryptowall/71371/ - webarchive
- https://researchcenter.paloaltonetworks.com/2015/10/latest-teslacrypt-ransomware-borrows-code-from-carberp-trojan/ - webarchive
- https://community.riskiq.com/article/30f22a00 - webarchive
- https://blog.checkpoint.com/wp-content/uploads/2016/05/Tesla-crypt-whitepaper_V3.pdf - webarchive
- https://www.welivesecurity.com/2015/12/16/nemucod-malware-spreads-ransomware-teslacrypt-around-world/ - webarchive
- https://blog.christophetd.fr/malware-analysis-lab-with-virtualbox-inetsim-and-burp/ - webarchive
- https://www.trendmicro.com/en_us/research/21/b/new-in-ransomware.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TFlower
TFlower is a new ransomware targeting mostly corporate networks discovered in August, 2019. It is reportedly installed on networks by attackers after they gain access via RDP. TFlower displays a console showing activity being performed by the ransomware when it encrypts a machine, further indicating that this ransomware is triggered by the attacker post compromise, similar to Samsam/Samas in terms of TTP. Once encryption is started, the ransomware will conduct a status report to an apparently hard-coded C2. Shadow copies are deleted and the Windows 10 repair environment is disabled by this ransomware. This malware also will terminate any running Outlook.exe process so that the mail files can be encrypted. This ransomware does not add an extention to encrypted files, but prepends the marker "*tflower" and what may be the encrypted encryption key for the file to each affected file. Once encryption is completed, another status report is sent to the C2 server.
Internal MISP references
UUID bd5d0ff1-7bd1-4f8d-bf66-4d02f8e68dd2 which can be used as unique global reference for TFlower in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tflower - webarchive
- https://www.bleepingcomputer.com/news/security/tflower-ransomware-the-latest-attack-targeting-businesses/ - webarchive
- https://www.sygnia.co/mata-framework - webarchive
- https://cyber.gc.ca/en/alerts/tflower-ransomware-campaign - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Thanatos
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Thanatos.
| Known Synonyms |
|---|
Alphabot |
Internal MISP references
UUID 24fabbe0-27a2-4c93-a6a6-c14767efaa25 which can be used as unique global reference for Thanatos in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Thanatos Ransomware
Internal MISP references
UUID 0884cf65-564e-4ee2-b4e5-b73f8bbd6a34 which can be used as unique global reference for Thanatos Ransomware in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.thanatos_ransom - webarchive
- https://www.bleepingcomputer.com/news/security/thanatos-ransomware-is-first-to-use-bitcoin-cash-messes-up-encryption/ - webarchive
- https://blog.talosintelligence.com/2018/06/ThanatosDecryptor.html - webarchive
- https://www.bleepingcomputer.com/news/security/thanatos-ransomware-decryptor-released-by-the-cisco-talos-group/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ThinMon
Internal MISP references
UUID a416e88b-8fc0-41a9-bb2e-13cbcc5f22b0 which can be used as unique global reference for ThinMon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ThreeByte
Internal MISP references
UUID d1752bcb-d9cb-4b4b-81f0-0658d76b4ce4 which can be used as unique global reference for ThreeByte in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ThumbThief
Internal MISP references
UUID 1df3b58a-e5d2-4d2a-869c-8d4532cc9f52 which can be used as unique global reference for ThumbThief in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ThunderX
Ransomware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ThunderX.
| Known Synonyms |
|---|
Ranzy Locker |
Internal MISP references
UUID e4be8d83-748e-46df-8dd7-0ce1b2255f36 which can be used as unique global reference for ThunderX in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.thunderx - webarchive
- https://www.bleepingcomputer.com/news/security/thunderx-ransomware-rebrands-as-ranzy-locker-adds-data-leak-site/ - webarchive
- https://www.mandiant.com/resources/chasing-avaddon-ransomware - webarchive
- https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3 - webarchive
- https://www.ic3.gov/Media/News/2021/211026.pdf - webarchive
- https://id-ransomware.blogspot.com/2020/08/thunderx-ransomware.html - webarchive
- https://www.picussecurity.com/resource/blog/a-detailed-walkthrough-of-ranzy-locker-ransomware-ttps - webarchive
- https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/ - webarchive
- https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/ - webarchive
- https://labs.sentinelone.com/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Thunker
Internal MISP references
UUID e55dcdec-0365-4ee0-96f8-7021183845a3 which can be used as unique global reference for Thunker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Tidepool
Internal MISP references
UUID 8e7cdcc2-37e1-4927-9c2d-eeb3050c4fca which can be used as unique global reference for Tidepool in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tidepool - webarchive
- https://unit42.paloaltonetworks.com/atoms/shallowtaurus/ - webarchive
- http://researchcenter.paloaltonetworks.com/2016/05/operation-ke3chang-resurfaces-with-new-tidepool-malware/ - webarchive
- https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs - webarchive
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TigerLite
TigerLite is a TCP downloader.
It creates mutexes like "qtrgads32" or "Microsoft32".
It uses RC4 with the key "MicrosoftCorporationValidation@#$%^&*()!US" for decryption of its character strings, and a custom algorithm for encryption and decryption of network traffic.
It supports from 5 up to 8 commands with the following identifiers: 1111, 1234, 2099/3333, 4444, 8877, 8888, 9876, 9999. The commands mostly perform various types of execution - either of code received from the server, or native Windows commands, with their output collected and sent back to the server.
TigerLite is an intermediate step of a multi-stage attack, in which Tiger RAT is usually the next step. This malware was observed in attacks against South Korean entities in H1 2021.
Internal MISP references
UUID 1fcd1afe-31ed-40c2-9262-6a6afe2a43e9 which can be used as unique global reference for TigerLite in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tigerlite - webarchive
- https://www.malwarebytes.com/blog/threat-intelligence/2021/04/lazarus-apt-conceals-malicious-code-within-bmp-file-to-drop-its-rat - webarchive
- https://threatray.com/wp-content/uploads/2021/12/threatray-establishing-the-tigerrat-and-tigerdownloader-malware-families.pdf - webarchive
- https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/ - webarchive
- https://ti.qianxin.com/blog/articles/Analysis-of-attacks-by-Lazarus-using-Daewoo-shipyard-as-bait/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Tiger RAT
This is third stage backdoor mentioned in the Kaspersky blog, "Andariel evolves to target South Korea with ransomware". The third stage payload was created via the second stage payload, is interactively executed in the operation and exists in both x64 and x86 versions. Most of them use Internet Explorer or Google Chrome icons and corresponding file names to disguise themselves as legitimate internet browsers. The malware decrypts the embedded payload at runtime. It uses an embedded 16-byte XOR key to decrypt the base64 encoded payload. The decrypted payload is another portable executable file that runs in memory. Before getting decrypted with a hardcoded XOR key, the backdoor also checks for sandbox environment. The backdoor has some code overlap with a know malware family PEBBLEDASH, attributed to Lazarus/LABYRINTH CHOLLIMA.
Internal MISP references
UUID 57c0d7b4-f46b-44bf-9430-75ac7d3cf2df which can be used as unique global reference for Tiger RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tiger_rat - webarchive
- https://media.defense.gov/2023/Feb/09/2003159161/-1/-1/0/CSA_RANSOMWARE_ATTACKS_ON_CI_FUND_DPRK_ACTIVITIES.PDF - webarchive
- https://asec.ahnlab.com/en/56405/ - webarchive
- https://www.brighttalk.com/webcast/18282/493986 - webarchive
- https://blogs.vmware.com/security/2021/12/tigerrat-advanced-adversaries-on-the-prowl.html - webarchive
- https://www.attackiq.com/2023/01/05/emulating-the-highly-sophisticated-north-korean-adversary-lazarus-group/ - webarchive
- https://blog.talosintelligence.com/2022/09/lazarus-magicrat.html - webarchive
- https://www.krcert.or.kr/filedownload.do?attach_file_seq=3277&attach_file_id=EpF3277.pdf - webarchive
- https://asec.ahnlab.com/ko/56256/ - webarchive
- https://threatray.com/wp-content/uploads/2021/12/threatray-establishing-the-tigerrat-and-tigerdownloader-malware-families.pdf - webarchive
- https://asec.ahnlab.com/ko/58215/ - webarchive
- https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/ - webarchive
- https://asec.ahnlab.com/wp-content/uploads/2021/11/Lazarus-%EA%B7%B8%EB%A3%B9%EC%9D%98-NukeSped-%EC%95%85%EC%84%B1%EC%BD%94%EB%93%9C-%EB%B6%84%EC%84%9D-%EB%B3%B4%EA%B3%A0%EC%84%9C.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
tildeb
Standalone implant. Potentially tied to a framework called PATROLWAGON.
Internal MISP references
UUID 8e846ea0-a46d-47c9-96e9-1cdefd49a846 which can be used as unique global reference for tildeb in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Tinba
F-Secure notes that TinyBanker or short Tinba is usually distributed through malvertising (advertising content that leads the user to sites hosting malicious threats), exploit kits and spam email campaigns. According to news reports, Tinba has been found targeting bank customers in the United States and Europe.
If Tinba successfully infects a device, it can steal banking and personal information through webinjects. To do this, the malware monitors the user's browser activity and if specific banking portals are visited, Tinba injects code to present the victim with fake web forms designed to mimic the legitimate web site. The malware then tricks them into entering their personal information, log-in credentials, etc in the legitimate-looking page.
Tinba may also display socially-engineered messages to lure or pressure the user into entering their information on the fake page; for example, a message may be shown which attempts to convince the victim that funds were accidentally deposited to his account and must be refunded immediately.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Tinba.
| Known Synonyms |
|---|
Illi |
TinyBanker |
Zusy |
Internal MISP references
UUID 5eee35b6-bd21-4b67-b198-e9320fcf2c88 which can be used as unique global reference for Tinba in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tinba - webarchive
- http://stopmalvertising.com/malware-reports/mini-analysis-of-the-tinybanker-tinba.html - webarchive
- http://garage4hackers.com/entry.php?b=3086 - webarchive
- https://blogs.blackberry.com/en/2019/03/blackberry-cylance-vs-tinba-banking-trojan - webarchive
- https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree - webarchive
- http://securityintelligence.com/tinba-malware-reloaded-and-attacking-banks-around-the-world/ - webarchive
- https://adalogics.com/blog/the-state-of-advanced-code-injections - webarchive
- https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html - webarchive
- https://securityblog.switch.ch/2015/06/18/so-long-and-thanks-for-all-the-domains/ - webarchive
- https://securityintelligence.com/tinba-trojan-sets-its-sights-on-romania/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://www.zscaler.com/blogs/research/look-recent-tinba-banking-trojan-variant - webarchive
- http://www.theregister.co.uk/2012/06/04/small_banking_trojan/ - webarchive
- http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_w32-tinba-tinybanker.pdf - webarchive
- http://contagiodump.blogspot.com/2012/06/amazon.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TinyFluff
TinyFluff is a dropper developed by the OldGremlin group. In one of their March '22 campaigns, TinyFluff included a JavaScript RAT with a time-independent DGA.
Internal MISP references
UUID e044c397-8491-466b-adb7-2deead4d9eb6 which can be used as unique global reference for TinyFluff in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TinyLoader
Internal MISP references
UUID f7c26ca7-0a7b-41b8-ad55-06625be10144 which can be used as unique global reference for TinyLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tinyloader - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.proofpoint.com/us/threat-insight/post/abaddonpos-now-targeting-specific-pos-software - webarchive
- https://www.proofpoint.com/us/threat-insight/post/AbaddonPOS-A-New-Point-Of-Sale-Threat-Linked-To-Vawtrak - webarchive
- https://www.forcepoint.com/sites/default/files/resources/files/report-tinypos-analysis-en.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TinyMet
TinyMet is a meterpreter stager.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TinyMet.
| Known Synonyms |
|---|
TiniMet |
Internal MISP references
UUID 075c6fa0-e670-4fe1-be8b-b8b13714cb58 which can be used as unique global reference for TinyMet in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tinymet - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.crowdstrike.com/blog/how-falcon-complete-stopped-a-big-game-hunting-ransomware-attack/ - webarchive
- https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/using-qiling-framework-to-unpack-ta505-packed-samples/ - webarchive
- https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/ - webarchive
- https://github.com/SherifEldeeb/TinyMet - webarchive
- https://www.crowdstrike.com/blog/how-falcon-complete-stopped-a-solarwinds-serv-u-exploit-campaign/ - webarchive
- https://outpost24.com/blog/using-qiling-framework-to-unpack-ta505-packed-samples/ - webarchive
- https://www.telekom.com/en/blog/group/article/cybersecurity-ta505-s-box-of-chocolate-597672 - webarchive
- https://www.flashpoint-intel.com/blog/fin7-revisited:-inside-astra-panel-and-sqlrat-malware/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-niagara - webarchive
- https://www.fsec.or.kr/common/proc/fsec/bbs/163/fileDownLoad/2297.do - webarchive
- https://twitter.com/VK_Intel/status/1273292957429510150 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TinyNuke
TinyNuke (aka Nuclear Bot) is a fully-fledged banking trojan including HiddenDesktop/VNC server and a reverse socks4 server. It was for sale on underground marketplaces for $2500 in 2016. The program's author claimed the malware was written from scratch, but that it functioned similarly to the ZeuS banking trojan in that it could steal passwords and inject arbitrary content when victims visited banking Web sites. However, he then proceeded to destroy his own reputation on hacker forums by promoting his development too aggressively. As a displacement activity, he published his source code on Github. XBot is an off-spring of TinyNuke, but very similar to its ancestor.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TinyNuke.
| Known Synonyms |
|---|
MicroBankingTrojan |
Nuclear Bot |
NukeBot |
Xbot |
Internal MISP references
UUID 5a78ec38-8b93-4dde-a99e-0c9b77674838 which can be used as unique global reference for TinyNuke in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tinynuke - webarchive
- https://krebsonsecurity.com/2019/12/nuclear-bot-author-arrested-in-sextortion-case/ - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://securityintelligence.com/the-nukebot-trojan-a-bruised-ego-and-a-surprising-source-code-leak/ - webarchive
- https://krebsonsecurity.com/tag/nuclear-bot/ - webarchive
- https://www.bitsighttech.com/blog/break-out-of-the-tinynuke-botnet - webarchive
- https://securelist.com/the-nukebot-banking-trojan-from-rough-drafts-to-real-threats/78957/ - webarchive
- https://www.arbornetworks.com/blog/asert/dismantling-nuclear-bot/ - webarchive
- https://benkowlab.blogspot.de/2017/08/quick-look-at-another-alina-fork-xbot.html - webarchive
- https://asec.ahnlab.com/en/27346/ - webarchive
- https://asec.ahnlab.com/en/32781/ - webarchive
- https://forums.juniper.net/t5/Threat-Research/Nukebot-Banking-Trojan-targeting-people-in-France/ba-p/326702 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TinyTyphon
Internal MISP references
UUID d2414f4a-1eda-4d80-84d3-ed130ca14e3c which can be used as unique global reference for TinyTyphon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TinyZbot
Internal MISP references
UUID b933634f-81d0-41ef-bf2f-ea646fc9e59c which can be used as unique global reference for TinyZbot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tinyzbot - webarchive
- https://www.secureworks.com/research/threat-profiles/cobalt-gypsy - webarchive
- https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf - webarchive
- https://know.netenrich.com/threatintel/threat_actor/Cutting%20Kitten - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TinyTurla
Talos describes this as a malware family with very scoped functionality and thus a small code footprint, likely used as a second chance backdoor.
Internal MISP references
UUID e1fa6d45-4ac9-4ace-98a9-e21947f0e497 which can be used as unique global reference for TinyTurla in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tiny_turla - webarchive
- https://cybergeeks.tech/a-step-by-step-analysis-of-the-russian-apt-turla-backdoor-called-tinyturla/ - webarchive
- https://infosec.exchange/@SophosXOps/111109357153515214 - webarchive
- https://blog.talosintelligence.com/2021/09/tinyturla.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Tiop
Internal MISP references
UUID c34091df-0df2-4ef6-bf69-c67eb711f6d8 which can be used as unique global reference for Tiop in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TitanStealer
The stealer is written in Go and capable of stealing a variety of information from infected Windows machines, including credential data from browsers and crypto wallets, FTP client details, screenshots, system information, and grabbed files.
Internal MISP references
UUID 0a98f387-885e-4ad4-b5ab-686f4c06dcf1 which can be used as unique global reference for TitanStealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.titan_stealer - webarchive
- https://denshiyurei.medium.com/silent-echoes-the-hidden-dialogue-among-malware-entities-spotlight-on-amos-infostealer-6d7cd70e3219 - webarchive
- https://blog.bushidotoken.net/2022/11/detecting-and-fingerprinting.html - webarchive
- https://www.uptycs.com/blog/titan-stealer-telegram-malware-campaign - webarchive
- https://github.com/D4NTESCODE/TitanStealerSource - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Tmanger
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Tmanger.
| Known Synonyms |
|---|
LuckyBack |
Internal MISP references
UUID 8d7108fe-65be-4853-945d-1d5376dbaa34 which can be used as unique global reference for Tmanger in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tmanger - webarchive
- https://insight-jp.nttsecurity.com/post/102gi9b/pandas-new-arsenal-part-1-tmanger - webarchive
- https://www.welivesecurity.com/2020/12/10/luckymouse-ta428-compromise-able-desktop/ - webarchive
- https://vblocalhost.com/uploads/VB2020-Ozawa-etal.pdf - webarchive
- https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/ - webarchive
- https://vblocalhost.com/uploads/VB2020-20.pdf - webarchive
- https://www.sentinelone.com/labs/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op - webarchive
- https://www.youtube.com/watch?v=1WfPlgtfWnQ - webarchive
- https://insight-jp.nttsecurity.com/post/102glv5/pandas-new-arsenal-part-3-smanager - webarchive
- https://www.welivesecurity.com/2020/12/10/luckymouse-ta428-compromise-able-desktop - webarchive
- https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia - webarchive
- https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Tofsee
According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.
Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Tofsee.
| Known Synonyms |
|---|
Gheg |
Internal MISP references
UUID 53e617fc-d71e-437b-a1a1-68b815d1ff49 which can be used as unique global reference for Tofsee in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee - webarchive
- https://www.cert.pl/en/news/single/tofsee-en/ - webarchive
- https://www.spamhaus.com/resource-center/neutralizing-tofsee-spambot-part-2-inmemoryconfig-store-vaccine/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://www.dragos.com/blog/investigating-the-watering-hole-linked-to-the-oldsmar-water-treatment-facility-breach/ - webarchive
- https://www.govcert.ch/blog/tofsee-spambot-features-.ch-dga-reversal-and-countermesaures/ - webarchive
- https://lokalhost.pl/txt/peering.into.spam.botnets.VirusBulletin2017.pdf - webarchive
- https://web.archive.org/web/20090428005953/http://www.marshal8e6.com/trace/i/Gheg,spambot.897~.asp - webarchive
- https://www.spamhaus.com/resource-center/neutralizing-tofsee-spambot-part-1-binary-file-vaccine/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://www.spamhaus.com/resource-center/neutralizing-tofsee-spambot-part-3-network-based-kill-switch/ - webarchive
- https://blog.talosintelligence.com/tofsee-spam/ - webarchive
- https://www.cert.pl/en/news/single/a-deeper-look-at-tofsee-modules/ - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf - webarchive
- https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 - webarchive
- https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html - webarchive
- https://intel471.com/blog/privateloader-malware - webarchive
- https://www.virusbulletin.com/virusbulletin/2014/04/tofsee-botnet - webarchive
- https://zerophagemalware.com/2017/03/24/terror-ek-delivers-tofsee-spambot/ - webarchive
- https://www.bitsight.com/blog/tofsee-botnet-proxying-and-mining - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TokyoX
Internal MISP references
UUID ad23afb8-cfce-4e43-b73f-58ca20fa0afe which can be used as unique global reference for TokyoX in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
tomiris
Internal MISP references
UUID a5449893-ab06-419b-bb31-4ce16503dcd9 which can be used as unique global reference for tomiris in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tomiris - webarchive
- https://securelist.com/tomiris-called-they-want-their-turla-malware-back/109552/ - webarchive
- https://securelist.com/darkhalo-after-solarwinds-the-tomiris-connection/104311/ - webarchive
- https://securelist.com/it-threat-evolution-q2-2023/110355/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TONEDEAF
TONEDEAF is a backdoor that communicates with Command and Control servers using HTTP or DNS. Supported commands include system information collection, file upload, file download, and arbitrary shell command execution. When executed, this variant of TONEDEAF wrote encrypted data to two temporary files – temp.txt and temp2.txt – within the same directory of its execution.
Internal MISP references
UUID 77e29e3a-d4a3-4692-b1f8-38ad6dc1af1d which can be used as unique global reference for TONEDEAF in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tonedeaf - webarchive
- https://intezer.com/blog-new-iranian-campaign-tailored-to-us-companies-uses-updated-toolset/ - webarchive
- https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html - webarchive
- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TONESHELL
Internal MISP references
UUID 83bfa615-a1d4-4b61-bda0-beb560d24a97 which can be used as unique global reference for TONESHELL in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Tonnerre
Internal MISP references
UUID a7590aa5-d9fb-449f-8a5e-5233077b736e which can be used as unique global reference for Tonnerre in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tonnerre - webarchive
- https://research.checkpoint.com/2021/after-lightning-comes-thunder/ - webarchive
- https://download.bitdefender.com/resources/files/News/CaseStudies/study/393/Bitdefender-Whitepaper-Iranian-APT-Makes-a-Comeback-with-Thunder-and-Lightning-Backdoor-and-Espionage-Combo.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Topinambour
Internal MISP references
UUID fcc49738-f801-47ff-977b-9e368bc85273 which can be used as unique global reference for Topinambour in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Torisma
Torisma is a complex HTTP(S) downloader, that can serve as an orchestrator handling the execution of additional payloads from the C&C server.
It uses VEST-32 for encryption and decryption of network traffic between the client and the server.
Typically, it uses these parameter names for its HTTP POST requests: ACTION, CODE, CACHE, REQUEST, RES. It sends the victim's MAC address in the initial request.
The response of the server informing the client about a successful authentication is "Your request has been accepted. ClientID: {f9102bc8a7d81ef01ba}". The client then requests additional data from the server, that decrypts to shellcode and its data parameters, and is executed. The client also creates a named pipe, \.\pipe\fb4d1181bb09b484d058768598b, that allows inter-process communication with the executed shellcode.
Torisma was usually downloaded by NedDnLoader, and deployed in the Operation DreamJob campaigns starting around Q4 2019.
Internal MISP references
UUID 69860c07-2acb-4674-8e68-41a1d8fe958a which can be used as unique global reference for Torisma in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.torisma - webarchive
- http://blog.nsfocus.net/stumbzarus-apt-lazarus/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/ - webarchive
- https://global.ahnlab.com/global/upload/download/asecreport/ASEC%20REPORT_vol.102_ENG%20(4).pdf - webarchive
- https://blogs.jpcert.or.jp/en/2021/01/Lazarus_malware2.html - webarchive
- https://www.telsy.com/lazarus-gate/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TorrentLocker
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TorrentLocker.
| Known Synonyms |
|---|
Teerac |
Internal MISP references
UUID 7f6cd579-b021-4896-80da-fcc07c35c8b2 which can be used as unique global reference for TorrentLocker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.torrentlocker - webarchive
- http://www.bleepingcomputer.com/forums/t/547708/torrentlocker-ransomware-cracked-and-decrypter-has-been-made/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TorLoader
Downloader, delivered via a lure with fake exploits published on Github.
Internal MISP references
UUID b6c84477-198f-42ea-808b-e20b23271cd0 which can be used as unique global reference for TorLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TOUCHMOVE
Internal MISP references
UUID 39ecb19e-790b-475b-85db-ef4c7f9c9dce which can be used as unique global reference for TOUCHMOVE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TOUCHSHIFT
Internal MISP references
UUID accbbc7e-43f1-4232-90be-6c1fe90cbccf which can be used as unique global reference for TOUCHSHIFT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ToxicEye
ToxicEye is a ransomware that spreads through phishing emails. The malware encrypts system files with AES-256 and demands a ransom in Bitcoin.
Internal MISP references
UUID 0d445373-d520-4b67-9066-72f23452c774 which can be used as unique global reference for ToxicEye in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.toxiceye - webarchive
- https://www.bollyinside.com/articles/how-rat-malware-is-using-telegram-to-evade-detection/ - webarchive
- https://blog.checkpoint.com/2021/04/22/turning-telegram-toxic-new-toxiceye-rat-is-the-latest-to-use-telegram-for-command-control/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TransBox
According to Trend Micro, this is a backdoor abusing the Dropbox API, used by threat actor Earth Yako.
Internal MISP references
UUID e4d4af34-835a-4e39-b9e2-eb2456e5fce3 which can be used as unique global reference for TransBox in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
tRat
tRat is a modular RAT written in Delphi and has appeared in campaigns in September and October of 2018.
Internal MISP references
UUID b9e6e4bd-57e8-44e7-853c-8dcb83c26079 which can be used as unique global reference for tRat in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.trat - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.proofpoint.com/us/threat-insight/post/trat-new-modular-rat-appears-multiple-email-campaigns - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://www.gdatasoftware.com/blog/trat-control-via-smartphone - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TreasureHunter
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TreasureHunter.
| Known Synonyms |
|---|
huntpos |
Internal MISP references
UUID f9d85edd-caa9-4134-9396-4575e70b10f2 which can be used as unique global reference for TreasureHunter in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.treasurehunter - webarchive
- https://www.fireeye.com/blog/threat-research/2016/03/treasurehunt_a_cust.html - webarchive
- https://www.flashpoint-intel.com/blog/treasurehunter-source-code-leaked/ - webarchive
- http://adelmas.com/blog/treasurehunter.php - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TrickBot
A financial Trojan believed to be a derivative of Dyre: the bot uses very similar code, web injects, and operational tactics. Has multiple modules including VNC and Socks5 Proxy. Uses SSL for C2 communication.
- Q4 2016 - Detected in wild Oct 2016 - 1st Report 2017 - Trickbot primarily uses Necurs as vehicle for installs. Jan 2018 - Use XMRIG (Monero) miner Feb 2018 - Theft Bitcoin Mar 2018 - Unfinished ransomware module Q3/4 2018 - Trickbot starts being spread through Emotet.
Infection Vector 1. Phish > Link MS Office > Macro Enabled > Downloader > Trickbot 2. Phish > Attached MS Office > Macro Enabled > Downloader > Trickbot 3. Phish > Attached MS Office > Macro enabled > Trickbot installed
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TrickBot.
| Known Synonyms |
|---|
TheTrick |
TrickLoader |
Trickster |
Internal MISP references
UUID c824813c-9c79-4917-829a-af72529e8329 which can be used as unique global reference for TrickBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.trickbot - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- http://www.vkremez.com/2017/11/lets-learn-trickbot-socks5-backconnect.html - webarchive
- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf - webarchive
- https://www.cyberscoop.com/trickbot-shutdown-conti-emotet/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-shows-off-new-trick-password-grabber-module - webarchive
- https://technical.nttsecurity.com/post/102fnog/targeted-trickbot-activity-drops-powerbrace-backdoor - webarchive
- https://cyber.wtf/2020/08/31/trickbot-rdpscandll-password-transof/ - webarchive
- https://twitter.com/anthomsec/status/1321865315513520128 - webarchive
- https://f5.com/labs/articles/threat-intelligence/malware/trickbot-expands-global-targets-beyond-banks-and-payment-processors-to-crms - webarchive
- https://www.wired.co.uk/article/trickbot-malware-group-internal-messages - webarchive
- https://therecord.media/russian-trickbot-malware-developer-pleads-guilty - webarchive
- https://www.youtube.com/watch?v=EyDiIAt__dI - webarchive
- https://www.cybereason.com/blog/cybereason-vs.-ryuk-ransomware - webarchive
- http://www.vkremez.com/2017/12/lets-learn-introducing-new-trickbot.html - webarchive
- https://www.netscout.com/blog/asert/dropping-anchor - webarchive
- https://blog.vincss.net/2021/10/re025-trickbot-many-tricks.html - webarchive
- https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/ - webarchive
- https://www.npu.gov.ua/news/kiberzlochini/kiberpolicziya-vikrila-transnaczionalne-zlochinne-ugrupovannya-u-nanesenni-inozemnim-kompaniyam-120-miljoniv-dolariv-zbitkiv/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/evolving-trickbot-adds-detection-evasion-and-screen-locking-features - webarchive
- https://redcanary.com/resources/webinars/deep-dive-process-injection/ - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-adds-remote-application-credential-grabbing-capabilities-to-its-repertoire/ - webarchive
- https://www.zscaler.com/blogs/security-research/new-trickbot-and-bazarloader-campaigns-use-multiple-delivery-vectors - webarchive
- https://www.hhs.gov/sites/default/files/bazarloader.pdf - webarchive
- https://twitter.com/VK_Intel/status/1328578336021483522 - webarchive
- https://na.eventscloud.com/file_uploads/6568237bca6dc156e5c5557c5989e97c_CrowdStrikeFal.Con2019_ThroughEyesOfAdversary_J.Ayers.pdf - webarchive
- https://blog.intel471.com/2020/04/14/understanding-the-relationship-between-emotet-ryuk-and-trickbot/ - webarchive
- https://hello.global.ntt/en-us/insights/blog/trickbot-variant-communicating-over-dns - webarchive
- https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/ - webarchive
- https://umbrella.cisco.com/blog/navigating-cybersecurity-during-a-pandemic-latest-malware-and-threat-actors - webarchive
- https://mal-eats.net/2021/05/10/campo_new_attack_campaign_targeting_japan/ - webarchive
- https://therecord.media/trickbot-new-attacks-see-the-botnet-deploy-new-banking-module-new-ransomware/ - webarchive
- https://public.intel471.com/blog/partners-in-crime-north-koreans-and-elite-russian-speaking-cybercriminals/ - webarchive
- https://www.cyberark.com/resources/threat-research-blog/conti-group-leaked - webarchive
- https://www.infosecurity-magazine.com/blogs/trickbot-mikrotik-connection/ - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2021/11/trickbot-helps-emotet-come-back-from-the-dead/ - webarchive
- https://www.sentinelone.com/blog/detecting-a-rogue-domain-controller-dcshadow-attack/ - webarchive
- https://malware.love/trickbot/malware_analysis/reverse_engineering/2020/11/17/trickbots-latest-trick.html - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/02/ESET_Threat_Report_Q42020.pdf - webarchive
- https://blogs.vmware.com/networkvirtualization/2020/11/trick-or-threat-ryuk-ransomware-targets-the-health-care-industry.html/ - webarchive
- https://www.microsoft.com/security/blog/2022/03/16/uncovering-trickbots-use-of-iot-devices-in-command-and-control-infrastructure/ - webarchive
- https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/ - webarchive
- https://www.kryptoslogic.com/blog/2021/02/trickbot-masrv-module/ - webarchive
- https://www.bleepingcomputer.com/news/security/conti-ransomware-gang-takes-over-trickbot-malware-operation/ - webarchive
- https://securityintelligence.com/posts/trickbot-conti-crypters-where-are-they-now/ - webarchive
- https://www.justice.gov/opa/pr/officials-announce-international-operation-targeting-transnational-criminal-organization - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/399/Bitdefender-PR-Whitepaper-Trickbot-creat5515-en-EN.pdf - webarchive
- https://www.youtube.com/watch?v=KMcSAlS9zGE - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf - webarchive
- https://www.bankinfosecurity.com/cybercrime-moves-conti-ransomware-absorbs-trickbot-malware-a-18573 - webarchive
- https://public.intel471.com/blog/trickbot-online-emotet-microsoft-cyber-command-disruption-attempts/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2017/08/trickbot-comes-with-new-tricks-attacking-outlook-and-browsing-data/ - webarchive
- https://www.sneakymonkey.net/2019/10/29/trickbot-analysis-part-ii/ - webarchive
- https://unit42.paloaltonetworks.com/banking-trojan-techniques/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-ransomexx - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/316/Bitdefender-Whitepaper-TrickBot-en-EN-interactive.pdf - webarchive
- https://www.washingtonpost.com/national-security/cyber-command-trickbot-disrupt/2020/10/09/19587aae-0a32-11eb-a166-dc429b380d10_story.html - webarchive
- https://www.cyberbit.com/latest-trickbot-variant-has-new-tricks-up-its-sleeve/ - webarchive
- https://www.flashpoint-intel.com/blog/trickbot-account-checking-hybrid-attack-model/ - webarchive
- https://www.nisos.com/research/trickbot-trickleaks-data-analysis/ - webarchive
- https://www.youtube.com/watch?v=lTywPmZEU1A - webarchive
- https://research.checkpoint.com/2022/a-modern-ninja-evasive-trickbot-attacks-customers-of-60-high-profile-companies/ - webarchive
- https://blog.cyberint.com/ryuk-crypto-ransomware - webarchive
- https://labs.sentinelone.com/enter-the-maze-demystifying-an-affiliate-involved-in-maze-snow/ - webarchive
- https://thedfirreport.com/2021/05/02/trickbot-brief-creds-and-beacons/ - webarchive
- https://www.heise.de/security/artikel/Emotet-Trickbot-Ryuk-ein-explosiver-Malware-Cocktail-4573848.html - webarchive
- https://www.bleepingcomputer.com/news/security/malware-tries-to-trump-security-software-with-potus-impeachment/ - webarchive
- https://www.microsoft.com/security/blog/2021/02/01/what-tracking-an-attacker-email-infrastructure-tells-us-about-persistent-cybercriminal-operations/ - webarchive
- https://blogs.keysight.com/blogs/tech/nwvs.entry.html/2020/12/21/trickbot_a_closerl-TpQ0.html - webarchive
- https://securityintelligence.com/posts/trickbot-survival-instinct-trickboot-version/ - webarchive
- https://unit42.paloaltonetworks.com/goodbye-mworm-hello-nworm-trickbot-updates-propagation-module/ - webarchive
- https://www.fortinet.com/blog/threat-research/global-malicious-spam-campaign-using-black-lives-matter-as-a-lure - webarchive
- https://www.bleepingcomputer.com/news/security/lightbot-trickbot-s-new-reconnaissance-malware-for-high-value-targets/ - webarchive
- https://www.kryptoslogic.com/blog/2022/01/deep-dive-into-trickbots-web-injection/ - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ - webarchive
- https://www.justice.gov/opa/pr/russian-national-extradited-united-states-face-charges-alleged-role-cybercriminal - webarchive
- https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/ - webarchive
- https://blog.reversinglabs.com/blog/conversinglabs-ep-2-conti-pivots-as-ransomware-as-a-service-struggles - webarchive
- https://medium.com/walmartglobaltech/inside-the-systembc-malware-as-a-service-9aa03afd09c6 - webarchive
- https://unit42.paloaltonetworks.com/trickbot-campaign-uses-fake-payroll-emails-to-conduct-phishing-attacks/ - webarchive
- https://www.bleepingcomputer.com/news/security/emotet-trickbot-malware-duo-is-back-infecting-windows-machines/ - webarchive
- https://blog.lumen.com/a-look-inside-the-trickbot-botnet/ - webarchive
- https://www.fidelissecurity.com/threatgeek/2016/10/trickbot-we-missed-you-dyre - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://content.fireeye.com/m-trends/rpt-m-trends-2020 - webarchive
- https://securelist.com/financial-cyberthreats-in-2020/101638/ - webarchive
- https://labs.vipre.com/trickbots-tricks/ - webarchive
- https://therecord.media/trickbot-gang-shuts-down-botnet-after-months-of-inactivity/ - webarchive
- https://therecord.media/us-arrests-latvian-woman-who-worked-on-trickbot-malware-source-code/ - webarchive
- https://cofenselabs.com/all-you-need-is-text-second-wave/ - webarchive
- https://threatresearch.ext.hp.com/wp-content/uploads/2021/10/HP-Wolf-Security-Threat-Insights-Report-Q3-2021.pdf - webarchive
- https://threatresearch.ext.hp.com/detecting-a-stealthy-trickbot-campaign/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/trickbot-botnet-ransomware-disruption - webarchive
- https://www.breachquest.com/conti-leaks-insight-into-a-ransomware-unicorn/ - webarchive
- https://www.cyberbit.com/blog/endpoint-security/latest-trickbot-variant-has-new-tricks-up-its-sleeve/ - webarchive
- https://securityintelligence.com/trickbots-cryptocurrency-hunger-tricking-the-bitcoin-out-of-wallets/ - webarchive
- https://www.govcert.admin.ch/blog/36/severe-ransomware-attacks-against-swiss-smes - webarchive
- https://threatpost.com/trickbot-amazon-paypal-top-brands/178483/ - webarchive
- https://www.ic3.gov/Media/News/2022/220120.pdf - webarchive
- https://eclypsium.com/2022/06/02/conti-targets-critical-firmware/ - webarchive
- https://www.botconf.eu/wp-content/uploads/2016/11/2016-LT09-TrickBot-Adams.pdf - webarchive
- https://krebsonsecurity.com/2020/10/attacks-aimed-at-disrupting-the-trickbot-botnet/ - webarchive
- https://www.microsoft.com/security/blog/2020/10/12/trickbot-disrupted/ - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-blackburn - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_5_sajo-takeda-niwa_en.pdf - webarchive
- https://noticeofpleadings.com/trickbot/files/Complaint%20and%20Summons/2020-10-06%20Trickbot%201%20Complaint%20with%20exs.pdf - webarchive
- https://threatpost.com/conti-ransomware-v-3-including-decryptor-leaked/179006/ - webarchive
- https://www.deepinstinct.com/2019/07/12/trickbooster-trickbots-email-based-infection-module/ - webarchive
- https://public.intel471.com/blog/trickbot-update-november-2020-bazar-loader-microsoft/ - webarchive
- https://sysopfb.github.io/malware/2018/04/16/trickbot-uacme.html - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://f5.com/labs/articles/threat-intelligence/malware/little-trickbot-growing-up-new-campaign-24412 - webarchive
- https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/ - webarchive
- https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/ - webarchive
- https://thehackernews.com/2022/02/trickbot-gang-likely-shifting.html - webarchive
- https://www.secureworks.com/blog/gold-ulrick-leaks-reveal-organizational-structure-and-relationships - webarchive
- https://www.bleepingcomputer.com/news/security/trickbot-gang-developer-arrested-when-trying-to-leave-korea/ - webarchive
- https://intezer.com/blog/intezer-analyze/fantastic-payloads-and-where-we-find-them - webarchive
- https://securityintelligence.com/posts/trickbot-gang-template-based-metaprogramming-bazar-malware/ - webarchive
- https://www.youtube.com/watch?v=Brx4cygfmg8 - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://securityintelligence.com/posts/from-ramnit-to-bumblebee-via-neverquest - webarchive
- https://www.blueliv.com/research/trickbot-banking-trojan-using-eflags-as-an-anti-hook-technique/ - webarchive
- https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf - webarchive
- https://securityintelligence.com/posts/itg08-aka-fin6-partners-with-trickbot-gang-uses-anchor-framework/ - webarchive
- https://www.joesecurity.org/blog/498839998833561473 - webarchive
- http://www.malware-traffic-analysis.net/2018/02/01/ - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html - webarchive
- https://www.bleepingcomputer.com/news/security/trickbot-uses-a-new-windows-10-uac-bypass-to-launch-quietly/ - webarchive
- https://www.fortinet.com/blog/threat-research/deep-analysis-of-trickbot-new-module-pwgrab.html - webarchive
- https://www.slideshare.net/proidea_conferences/inside-cybercrime-groups-harvesting-active-directory-for-fun-and-profit-vitali-kremez - webarchive
- https://www.intrinsec.com/deobfuscating-hunting-ostap/ - webarchive
- https://intel471.com/blog/a-brief-history-of-ta505 - webarchive
- https://duo.com/decipher/trickbot-up-to-its-old-tricks - webarchive
- https://www.ringzerolabs.com/2017/07/trickbot-banking-trojan-doc00039217doc.html - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree - webarchive
- https://labs.sentinelone.com/how-trickbot-hooking-engine-targets-windows-10-browsers/ - webarchive
- https://labs.bitdefender.com/2020/11/trickbot-is-dead-long-live-trickbot/ - webarchive
- https://thehackernews.com/2022/02/notorious-trickbot-malware-gang-shuts.html - webarchive
- https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html - webarchive
- https://www.flashpoint-intel.com/blog/new-version-trickbot-adds-worm-propagation-module/ - webarchive
- https://www.sophos.com/en-us/medialibrary/pdfs/technical-papers/sophos-2021-threat-report.pdf - webarchive
- https://labs.sentinelone.com/inside-a-trickbot-cobaltstrike-attack-server/ - webarchive
- https://arcticwolf.com/resources/blog/karakurt-web - webarchive
- https://decoded.avast.io/martinhron/meris-and-trickbot-standing-on-the-shoulders-of-giants/ - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.advanced-intel.com/post/trickbot-group-launches-test-module-alerting-on-fraud-activity - webarchive
- https://www.arbornetworks.com/blog/asert/trickbot-banker-insights/ - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-swathmore - webarchive
- https://download.microsoft.com/download/f/8/1/f816b8b6-bee3-41e5-b6cc-e925a5688f61/Microsoft_Digital_Defense_Report_2020_September.pdf - webarchive
- https://www.cybereason.com/blog/triple-threat-emotet-deploys-trickbot-to-steal-data-spread-ryuk-ransomware - webarchive
- https://www.prodaft.com/m/uploads/SilverFish_TLPWHITE.pdf - webarchive
- https://blogs.microsoft.com/on-the-issues/2020/10/12/trickbot-ransomware-cyberthreat-us-elections/ - webarchive
- https://hurricanelabs.com/splunk-tutorials/splunking-with-sysmon-part-4-detecting-trickbot/ - webarchive
- https://unit42.paloaltonetworks.com/wireshark-tutorial-emotet-infection/ - webarchive
- https://home.treasury.gov/news/press-releases/jy1256 - webarchive
- https://labs.sentinelone.com/deep-dive-into-trickbot-executor-module-mexec-hidden-anchor-bot-nexus-operations/ - webarchive
- https://www.justice.gov/opa/pr/multiple-foreign-nationals-charged-connection-trickbot-malware-and-conti-ransomware - webarchive
- https://www.crowdstrike.com/blog/wizard-spider-adversary-update/ - webarchive
- https://unit42.paloaltonetworks.com/ryuk-ransomware/ - webarchive
- https://www.youtube.com/watch?v=EdchPEHnohw - webarchive
- https://www.bleepingcomputer.com/news/security/trickbot-malware-mistakenly-warns-victims-that-they-are-infected/ - webarchive
- https://github.com/JR0driguezB/malware_configs/tree/master/TrickBot - webarchive
- https://news.sophos.com/en-us/2020/02/18/nearly-a-quarter-of-malware-now-communicates-using-tls/ - webarchive
- https://securityintelligence.com/trickbot-takes-to-latin-america-continues-to-expand-its-global-reach/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html - webarchive
- https://eclypsium.com/2020/12/03/trickbot-now-offers-trickboot-persist-brick-profit/ - webarchive
- https://www.reuters.com/technology/details-another-big-ransomware-group-trickbot-leak-online-experts-say-2022-03-04/ - webarchive
- https://www.wired.com/story/trickbot-malware-group-internal-messages/ - webarchive
- https://labs.sentinelone.com/top-tier-russian-organized-cybercrime-group-unveils-fileless-stealthy-powertrick-backdoor-for-high-value-targets/ - webarchive
- https://www.crowdstrike.com/blog/sin-ful-spiders-wizard-spider-and-lunar-spider-sharing-the-same-web/ - webarchive
- https://medium.com/@vishal_29486/trickbot-a-concise-treatise-d7e4cc97f737 - webarchive
- https://www.gosecure.net/blog/2021/12/03/trickbot-leverages-zoom-work-from-home-interview-malspam-heavens-gate-and-spamhaus/ - webarchive
- https://community.riskiq.com/article/111d6005/description - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0118.pdf - webarchive
- https://securityaffairs.co/wordpress/128190/cyber-crime/conti-ransomware-takes-over-trickbot.html - webarchive
- https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/ - webarchive
- https://threatpost.com/conti-ransomware-decryptor-trickbot-source-code-leaked/178727/ - webarchive
- https://www.fireeye.com/blog/threat-research/2020/03/the-cycle-of-adversary-pursuit.html - webarchive
- https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html - webarchive
- https://inquest.net/blog/2019/08/26/TrickBot-Memory-Analysis - webarchive
- https://malware.love/trickbot/malware_analysis/reverse_engineering/2020/11/22/trickbot-fake-ips-part2.html - webarchive
- https://osint.fans/service-nsw-russia-association - webarchive
- https://www.bleepingcomputer.com/news/security/trickbot-now-steals-windows-active-directory-credentials/ - webarchive
- https://ibm.ent.box.com/s/hs5pcayhbbhjvj8di5sqdpbbd88tsh89 - webarchive
- https://www.bleepingcomputer.com/news/security/karakurt-revealed-as-data-extortion-arm-of-conti-cybercrime-syndicate/ - webarchive
- https://www.bleepingcomputer.com/news/security/cisa-updates-conti-ransomware-alert-with-nearly-100-domain-names/ - webarchive
- https://intel471.com/blog/conti-leaks-ransomware-development - webarchive
- https://securityintelligence.com/tricks-of-the-trade-a-deeper-look-into-trickbots-machinations/ - webarchive
- https://www.secureworks.com/blog/trickbot-modifications-target-us-mobile-users - webarchive
- https://www.intel471.com/blog/Cobalt-strike-cybercriminals-trickbot-qbot-hancitor - webarchive
- https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-1112.pdf - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker - webarchive
- https://labs.sentinelone.com/revealing-the-trick-a-deep-dive-into-trickloader-obfuscation/ - webarchive
- https://medium.com/walmartglobaltech/anchor-and-lazarus-together-again-24744e516607 - webarchive
- https://www.fortinet.com/blog/threat-research/new-variant-of-trickbot-being-spread-by-word-document.html - webarchive
- https://resource.redcanary.com/rs/003-YRU-314/images/2021-Threat-Detection-Report.pdf - webarchive
- https://blog.talosintelligence.com/2020/03/trickbot-primer.html - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://www.splunk.com/en_us/blog/security/detecting-trickbots.html - webarchive
- https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/ - webarchive
- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-attacked-epiq-global-via-trickbot-infection/ - webarchive
- https://medium.com/walmartglobaltech/trickbot-crews-new-cobaltstrike-loader-32c72b78e81c - webarchive
- https://intel471.com/blog/conti-emotet-ransomware-conti-leaks - webarchive
- http://www.peppermalware.com/2019/03/quick-analysis-of-trickbot-sample-with.html - webarchive
- https://unit42.paloaltonetworks.com/sandbox-evasion-memory-detection/ - webarchive
- https://www.justice.gov/opa/press-release/file/1445241/download - webarchive
- https://community.riskiq.com/article/04ec92f4 - webarchive
- https://www.proofpoint.com/us/blog/security-briefs/threat-actors-pair-tax-themed-lures-covid-19-healthcare-themes - webarchive
- https://www.mandiant.com/media/12596/download - webarchive
- https://securityintelligence.com/posts/trickbot-bolsters-layered-defenses-prevent-injection/ - webarchive
- https://www.secdata.com/the-trickbot-and-mikrotik/ - webarchive
- https://labs.sentinelone.com/deep-dive-into-trickbot-executor-module-mexec-reversing-the-dropper-variant/ - webarchive
- https://community.riskiq.com/article/298c9fc9 - webarchive
- https://www.vkremez.com/2018/11/lets-learn-introducing-latest-trickbot.html - webarchive
- http://www.pwc.co.uk/issues/cyber-security-data-privacy/research/trickbots-bag-of-tricks.html - webarchive
- https://content.secureworks.com/-/media/Files/US/Reports/Monthly%20Threat%20Intelligence/Secureworks_ECO1_ThreatIntelligenceExecutiveReport2022Vol2.ashx - webarchive
- https://unit42.paloaltonetworks.com/trickbot-updates-password-grabber-module/ - webarchive
- https://www.lastline.com/labsblog/evolution-of-excel-4-0-macro-weaponization/ - webarchive
- https://www.sneakymonkey.net/2019/05/22/trickbot-analysis/ - webarchive
- https://research.checkpoint.com/2023/following-the-scent-of-trickgate-6-year-old-packer-used-to-deploy-the-most-wanted-malware/ - webarchive
- https://attackiq.com/2022/06/15/attack-graph-emulating-the-conti-ransomware-teams-behaviors/ - webarchive
- https://blogs.microsoft.com/on-the-issues/2020/10/20/trickbot-ransomware-disruption-update/ - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-blackburn - webarchive
- https://public.intel471.com/blog/global-trickbot-disruption-operation-shows-promise/ - webarchive
- https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/latest-trickbot-campaign-delivered-via-highly-obfuscated-js-file/ - webarchive
- https://blog.morphisec.com/trickbot-delivery-method-gets-a-new-upgrade-focusing-on-windows - webarchive
- https://share.vx-underground.org/Conti/ - webarchive
- https://www.advintel.io/post/advintel-s-state-of-emotet-aka-spmtools-displays-over-million-compromised-machines-through-2022 - webarchive
- https://securityintelligence.com/posts/trickbot-gang-doubles-down-enterprise-infection/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa21-076a - webarchive
- http://blog.fortinet.com/2016/12/06/deep-analysis-of-the-online-banking-botnet-trickbot - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-ulrick - webarchive
- https://www.berlin.de/sen/justva/presse/pressemitteilungen/2020/pm-11-2020-t-systems-forensik_bericht_public_v1.pdf - webarchive
- https://intel471.com/blog/ettersilent-maldoc-builder-macro-trickbot-qbot/ - webarchive
- https://www.bleepingcomputer.com/news/security/trickbot-now-uses-a-windows-10-uac-bypass-to-evade-detection/ - webarchive
- https://www.domaintools.com/resources/blog/tracking-a-trickbot-related-ransomware-incident - webarchive
- https://www.europol.europa.eu/newsroom/news/12-targeted-for-involvement-in-ransomware-attacks-against-critical-infrastructure - webarchive
- https://cybersecurity.att.com/blogs/labs-research/trickbot-bazarloader-in-depth - webarchive
- https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a - webarchive
- https://www.hornetsecurity.com/en/security-information/trickbot-malspam-leveraging-black-lives-matter-as-lure/ - webarchive
- https://gallery.mailchimp.com/c35aef82661dad887b8162a4f/files/e24e8206-a157-4796-a8cb-2b7262cc76e8/CSIS_Threat_Matrix_H1_2019.pdf - webarchive
- https://blog.fraudwatchinternational.com/malware/trickbot-malware-works - webarchive
- https://blog.bushidotoken.net/2022/04/lessons-from-conti-leaks.html - webarchive
- https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/ - webarchive
- https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056 - webarchive
- https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-trickbot-infections/ - webarchive
- https://www.justice.gov/opa/pr/latvian-national-charged-alleged-role-transnational-cybercrime-organization - webarchive
- https://www.advintel.io/post/the-trickbot-saga-s-finale-has-aired-but-a-spinoff-is-already-in-the-works - webarchive
- https://www.kryptoslogic.com/blog/2021/07/trickbot-and-zeus/ - webarchive
- https://www.zscaler.com/blogs/research/trickbot-emerges-few-new-tricks - webarchive
- http://www.vkremez.com/2018/04/lets-learn-trickbot-implements-network.html - webarchive
- https://www.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revealing-threat-in-the-shadow-by-chi-en-shen-ashley-oleg-bondarenko - webarchive
- https://www.cert.pl/en/news/single/detricking-trickbot-loader/ - webarchive
- https://labs.sentinelone.com/building-a-custom-malware-analysis-lab-environment/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/malware-threat-analysis/2018/11/whats-new-trickbot-deobfuscating-elements/ - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware - webarchive
- https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2020.pdf?__blob=publicationFile&v=2 - webarchive
- https://www.wilbursecurity.com/2020/03/trickbot-to-ryuk-in-two-hours/ - webarchive
- https://qmemcpy.io/post/reverse-engineering-malware-trickbot-part-2-loader - webarchive
- https://securelist.com/trickbot-module-descriptions/104603/ - webarchive
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/ - webarchive
- https://www.welivesecurity.com/2020/10/12/eset-takes-part-global-operation-disrupt-trickbot/ - webarchive
- https://thehackernews.com/2022/05/malware-analysis-trickbot.html - webarchive
- https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-ii-the-office/ - webarchive
- https://resources.malwarebytes.com/files/2020/02/2020_State-of-Malware-Report.pdf - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-110a - webarchive
- https://www.govcert.ch/blog/37/trickbot-an-analysis-of-data-collected-from-the-botnet - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
- https://intel471.com/blog/privateloader-malware - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://escinsecurity.blogspot.de/2018/01/weekly-trickbot-analysis-end-of-wc-22.html - webarchive
- https://www.securityartwork.es/wp-content/uploads/2017/06/Informe_Evoluci%C3%B3n_Trickbot.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Trigona
According to PCrisk, Trigona is ransomware that encrypts files and appends the "._locked" extension to filenames. Also, it drops the "how_to_decrypt.hta" file that opens a ransom note. An example of how Trigona renames files: it renames "1.jpg" to "1.jpg._locked", "2.png" to "2.png._locked", and so forth.
It embeds the encrypted decryption key, the campaign ID, and the victim ID in the encrypted files.
Internal MISP references
UUID d5e900b0-5a6d-4e29-ab64-fa72863198a1 which can be used as unique global reference for Trigona in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.trigona - webarchive
- https://resources.prodaft.com/wazawaka-report - webarchive
- https://www.trendmicro.com/en_us/research/23/f/an-overview-of-the-trigona-ransomware.html - webarchive
- https://asec.ahnlab.com/en/51343/ - webarchive
- https://www.fortinet.com/blog/threat-research/ransomware-roundup-trigona-ransomware - webarchive
- https://unit42.paloaltonetworks.com/trigona-ransomware-update/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Triton
Malware attacking commonly used in Industrial Control Systems (ICS) Triconex Safety Instrumented System (SIS) controllers.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Triton.
| Known Synonyms |
|---|
HatMan |
Trisis |
Internal MISP references
UUID 79606b2b-72f0-41e3-8116-1093c1f94b15 which can be used as unique global reference for Triton in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.triton - webarchive
- https://www.ironnet.com/blog/russian-cyber-attack-campaigns-and-actors - webarchive
- https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf - webarchive
- https://www.nozominetworks.com//downloads/US/Nozomi-Networks-TRITON-The-First-SIS-Cyberattack.pdf - webarchive
- https://www.domaintools.com/resources/blog/visibility-monitoring-and-critical-infrastructure-security - webarchive
- https://www.mandiant.com/resources/mandiant-red-team-emulates-fin11-tactics - webarchive
- https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware - webarchive
- https://github.com/ICSrepo/TRISIS-TRITON-HATMAN - webarchive
- https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%E2%80%94Safety%20System%20Targeted%20Malware_S508C.pdf - webarchive
- https://dragos.com/blog/trisis/TRISIS-01.pdf - webarchive
- https://us-cert.cisa.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20A%29_S508C.PDF - webarchive
- https://home.treasury.gov/news/press-releases/sm1162 - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-083a - webarchive
- https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1538425180.pdf - webarchive
- https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-110a - webarchive
- https://securelist.com/apt-trends-report-q2-2019/91897/ - webarchive
- https://www.eenews.net/stories/1060123327/ - webarchive
- https://www.ic3.gov/Media/News/2022/220325.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Trochilus RAT
Trochilus is a C++ written RAT, which is available on GitHub. GitHub Repo: - https://github.com/m0n0ph1/malware-1/tree/master/Trochilus - https://github.com/5loyd/trochilus
Internal MISP references
UUID 1c3ee140-8c47-4aa7-9723-334ccd886c4e which can be used as unique global reference for Trochilus RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.trochilus_rat - webarchive
- https://blogs.jpcert.or.jp/en/2017/04/redleaves---malware-based-on-open-source-rat.html - webarchive
- https://app.box.com/s/z1uanuv1vn3vw5iket1r6bqrmlra0gpn - webarchive
- https://www.sstic.org/media/SSTIC2020/SSTIC-actes/pivoter_tel_bernard_ou_comment_monitorer_des_attaq/SSTIC2020-Slides-pivoter_tel_bernard_ou_comment_monitorer_des_attaquants_ngligents-lunghi.pdf - webarchive
- https://raw.githubusercontent.com/yt0ng/cracking_softcell/main/Cracking_SOFTCLL_TLP_WHITE.pdf - webarchive
- https://www.secureworks.com/research/bronze-vinewood-targets-supply-chains - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-vinewood - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-drbcontrol-uncovering-a-cyberespionage-campaign-targeting-gambling-companies-in-southeast-asia - webarchive
- https://github.com/m0n0ph1/malware-1/tree/master/Trochilus - webarchive
- https://github.com/5loyd/trochilus/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2019-0206.pdf - webarchive
- https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-40-LunghiHorejsi.pdf - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/webworm-espionage-rats - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Troldesh
According to Malwarebyte, Ransomware is a type of malware that prevents users from accessing their system or personal files and demands ransom payment in order to regain access. Ransom.Troldesh is spread by malspam, typically in the form of attached .zip files. This ransomware sometimes uses a CMS on a compromised site to host downloads.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Troldesh.
| Known Synonyms |
|---|
Shade |
Internal MISP references
UUID 41acd50d-e602-41a9-85e7-c091fb4bc126 which can be used as unique global reference for Troldesh in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.troldesh - webarchive
- https://www.welivesecurity.com/2019/01/28/russia-hit-new-wave-ransomware-spam/ - webarchive
- https://blog.avast.com/ransomware-strain-troldesh-spikes - webarchive
- https://unit42.paloaltonetworks.com/shade-ransomware-hits-high-tech-wholesale-education-sectors-in-u-s-japan-india-thailand-canada/ - webarchive
- https://isc.sans.edu/forums/diary/More+Russian+language+malspam+pushing+Shade+Troldesh+ransomware/24668/ - webarchive
- https://www.zdnet.com/article/shade-troldesh-ransomware-shuts-down-and-releases-all-decryption-keys/ - webarchive
- https://github.com/shade-team/keys - webarchive
- https://labs.bitdefender.com/2020/05/shade-troldesh-ransomware-decryption-tool/ - webarchive
- https://support.kaspersky.com/13059 - webarchive
- https://securelist.com/the-shade-encryptor-a-double-threat/72087/ - webarchive
- https://blog.checkpoint.com/2015/06/01/troldesh-new-ransomware-from-russia/ - webarchive
- https://blogs.technet.microsoft.com/mmpc/2016/07/13/troldesh-ransomware-influenced-by-the-da-vinci-code/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TroubleGrabber
Internal MISP references
UUID 183fa14a-f42a-4508-b146-8550ba1acf2a which can be used as unique global reference for TroubleGrabber in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
troystealer
Internal MISP references
UUID 36d7dea1-6abf-41ea-bcd8-079f24dc0972 which can be used as unique global reference for troystealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Trump Ransom
Internal MISP references
UUID 48deadcc-1a67-442d-b181-fdaaa337c4bb which can be used as unique global reference for Trump Ransom in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Tsifiri
Internal MISP references
UUID 3da6f62c-9e06-4e7b-8852-7c7689f65833 which can be used as unique global reference for Tsifiri in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TUNNELFISH
Internal MISP references
UUID 561910ea-d165-48ea-9144-1c2d0cab3caa which can be used as unique global reference for TUNNELFISH in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
turian
According to Mitre, Turian is a backdoor that has been used by BackdoorDiplomacy to target Ministries of Foreign Affairs, telecommunication companies, and charities in Africa, Europe, the Middle East, and Asia. First reported in 2021, Turian is likely related to Quarian, an older backdoor that was last observed being used in 2013 against diplomatic targets in Syria and the United States.
Internal MISP references
UUID 69585b58-ec98-4a70-b61d-288d5a7ca7c3 which can be used as unique global reference for turian in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.turian - webarchive
- https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/ - webarchive
- https://unit42.paloaltonetworks.com/playful-taurus/ - webarchive
- https://www.fortinet.com/blog/threat-research/analysis-of-follina-zero-day - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Turkojan
Internal MISP references
UUID 17f9e595-c7c2-448a-a48a-6079e4c5791a which can be used as unique global reference for Turkojan in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TurlaRPC
Internal MISP references
UUID 8c6248d2-2b3a-4fe8-99cd-552077e3f84f which can be used as unique global reference for TurlaRPC in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.turla_rpc - webarchive
- https://unit42.paloaltonetworks.com/ironnetinjector/ - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity - webarchive
- https://cocomelonc.github.io/tutorial/2022/05/02/malware-pers-3.html - webarchive
- https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/ - webarchive
- https://cocomelonc.github.io/malware/2022/09/20/malware-pers-11.html - webarchive
- https://cocomelonc.github.io/tutorial/2022/06/12/malware-pers-7.html - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Turla SilentMoon
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Turla SilentMoon.
| Known Synonyms |
|---|
BigBoss |
Cacao |
GoldenSky |
HyperStack |
Internal MISP references
UUID ddee7f00-66e0-4d89-bd51-4b0df516a248 which can be used as unique global reference for Turla SilentMoon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.turla_silentmoon - webarchive
- https://www.emanueledelucia.net/the-bigboss-rules-something-about-one-of-the-uroburos-rpc-based-backdoors/ - webarchive
- https://twitter.com/Arkbird_SOLG/status/1304187749373800455 - webarchive
- https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity - webarchive
- https://cocomelonc.github.io/tutorial/2022/06/12/malware-pers-7.html - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TURNEDUP
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TURNEDUP.
| Known Synonyms |
|---|
Notestuk |
Internal MISP references
UUID fab34d66-5668-460a-bc0f-250b9417cdbf which can be used as unique global reference for TURNEDUP in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.turnedup - webarchive
- https://symantec-blogs.broadcom.com/blogs/threat-intelligence/elfin-apt33-espionage - webarchive
- https://www.cyberbit.com/blog/endpoint-security/new-early-bird-code-injection-technique-discovered/ - webarchive
- https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html - webarchive
- https://www.cyberbit.com/new-early-bird-code-injection-technique-discovered/ - webarchive
- https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TYPEFRAME
TYPEFRAME is a RAT.
It supports ~25 commands that include operations on the victim’s filesystem, manipulation with its configuration, modification of the system's firewall, the download and execution of additional tools from the attacker’s C&C and the uninstall via a self-delete batch. The commands are indexed by 16-bit integers, starting with the value 0x8000.
The RAT uses RC4 for decryption of its binary configuration. It has a statically linked OpenSSL 0.9.8k library used for SSL communication.
Internal MISP references
UUID bcc18617-5310-47f0-be30-e2fef6252359 which can be used as unique global reference for TYPEFRAME in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
TypeHash
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TypeHash.
| Known Synonyms |
|---|
SkinnyD |
Internal MISP references
UUID d7b0ccc8-051c-4ab1-908e-3bd1811d9e2e which can be used as unique global reference for TypeHash in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Typhon Stealer
According to PCrisk, Typhon is a stealer-type malware written in the C# programming language. Newer versions of this program are called Typhon Reborn (TyphonReborn). Malware within this classification is designed to extract data from infected systems. The older variants of Typhon have a broader range of functionalities, while Typhon Reborn versions are streamlined stealers.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Typhon Stealer.
| Known Synonyms |
|---|
Typhon Reborn V2 |
Internal MISP references
UUID fb5e364c-0f91-4b35-89cc-52eb4fc2a338 which can be used as unique global reference for Typhon Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Tyupkin
Internal MISP references
UUID c28e9055-b656-4b7a-aa91-fe478a83fe4c which can be used as unique global reference for Tyupkin in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.tyupkin - webarchive
- https://documents.trendmicro.com/assets/white_papers/wp-cashing-in-on-atm-malware.pdf - webarchive
- https://www.lastline.com/labsblog/tyupkin-atm-malware/ - webarchive
- https://blog.talosintelligence.com/2019/05/10-years-of-virtual-dynamite.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
T-Cmd
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular T-Cmd.
| Known Synonyms |
|---|
t_cmd |
Internal MISP references
UUID 892aa73e-7cb5-4eb5-bcb7-e9864bd03af2 which can be used as unique global reference for T-Cmd in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
T-RAT 2.0
Internal MISP references
UUID fb9e9ade-b154-43ba-a0ea-550322454acf which can be used as unique global reference for T-RAT 2.0 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
UACMe
A toolkit maintained by hfiref0x which incorporates numerous UAC bypass techniques for Windows 7 - Windows 10. Typically, components of this tool are stripped out and reused by malicious actors.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular UACMe.
| Known Synonyms |
|---|
Akagi |
Internal MISP references
UUID ccde5b0d-fe13-48e6-a6f4-4e434ce29371 which can be used as unique global reference for UACMe in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
UDPoS
Internal MISP references
UUID 5d05d81d-a0f8-496d-9a80-9b04fe3019fc which can be used as unique global reference for UDPoS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
UFR Stealer
Information stealer.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular UFR Stealer.
| Known Synonyms |
|---|
Usteal |
Internal MISP references
UUID a24bf6d9-e177-44f2-9e61-8cf3566e45eb which can be used as unique global reference for UFR Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Uiwix
Internal MISP references
UUID 5e362cd1-bc5c-4225-b820-00ec7ebebadd which can be used as unique global reference for Uiwix in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Umbral
Umbral is a data-stealing Trojan that targets Windows systems. It spreads through phishing emails and malicious attachments. Once installed, Umbral can steal a variety of data, including usernames, passwords, online banking credentials, and confidential files. It can also change computer settings and execute harmful commands. Umbral is a serious security threat and should be removed immediately if found.
Internal MISP references
UUID 449a8708-d0ec-40c8-af7c-ea6960d11659 which can be used as unique global reference for Umbral in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
UnderminerEK
Internal MISP references
UUID 788b5c01-6609-4a3e-8922-5734fb6897b4 which can be used as unique global reference for UnderminerEK in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 001
Internal MISP references
UUID 72961adc-ace1-4593-99f1-266119ddeccb which can be used as unique global reference for Unidentified 001 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 003
Internal MISP references
UUID 0e435b5d-37df-47cc-a1c4-1afb82df83d1 which can be used as unique global reference for Unidentified 003 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 006
Internal MISP references
UUID c0a40d42-33bb-4eca-8121-f636aeec14c6 which can be used as unique global reference for Unidentified 006 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 013 (Korean)
Internal MISP references
UUID b1cc4c79-30a5-485d-bd7f-8625c1cb5956 which can be used as unique global reference for Unidentified 013 (Korean) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 020 (Vault7)
Internal MISP references
UUID 40c66571-164c-4050-9c84-f37c9cd84055 which can be used as unique global reference for Unidentified 020 (Vault7) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 022 (Ransom)
Internal MISP references
UUID 5424d89e-1b7a-4632-987b-67fd27621d6f which can be used as unique global reference for Unidentified 022 (Ransom) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 023
Internal MISP references
UUID a936a595-f03d-4d8c-848e-2a3525c0415b which can be used as unique global reference for Unidentified 023 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 024 (Ransomware)
Internal MISP references
UUID acf6c476-847c-477a-b640-18a5c99e3c2b which can be used as unique global reference for Unidentified 024 (Ransomware) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 025 (Clickfraud)
Internal MISP references
UUID f43a0e38-2394-4538-a123-4a0457096058 which can be used as unique global reference for Unidentified 025 (Clickfraud) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 028
Internal MISP references
UUID 22a686d8-dd35-4a29-9437-b0ce7b5c204b which can be used as unique global reference for Unidentified 028 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 029
Internal MISP references
UUID aff47054-7130-48ca-aa2c-247bdf44f180 which can be used as unique global reference for Unidentified 029 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 030 (Ransomware)
Unnamed ransomware that camouflages as a program performing system cleanup called "System Analyzer Pro".
Internal MISP references
UUID 7287a0b0-b943-4007-952f-07b9475ec184 which can be used as unique global reference for Unidentified 030 (Ransomware) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 031
Internal MISP references
UUID 122c1c9c-3131-4014-856c-7e8a0da57a6e which can be used as unique global reference for Unidentified 031 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 037
Internal MISP references
UUID d073f9e5-8aa8-4e66-ba47-f332759199a2 which can be used as unique global reference for Unidentified 037 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 038
Internal MISP references
UUID d53e96c5-abfa-4be4-bb33-0a898c5aff58 which can be used as unique global reference for Unidentified 038 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 039
Internal MISP references
UUID 97c1524a-c052-49d1-8770-14b513d8a830 which can be used as unique global reference for Unidentified 039 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 041
Internal MISP references
UUID 88d70171-fc89-44d1-8931-035c0b095247 which can be used as unique global reference for Unidentified 041 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 042
Internal MISP references
UUID 168bf2a1-45a5-41ac-b364-5740e7ce9757 which can be used as unique global reference for Unidentified 042 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 044
Internal MISP references
UUID df9c8440-b4da-4226-b982-e510d06cf246 which can be used as unique global reference for Unidentified 044 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 045
Internal MISP references
UUID 4cb8235a-7e70-4fad-9244-69215750d559 which can be used as unique global reference for Unidentified 045 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 047
RAT written in Delphi used by Patchwork APT.
Internal MISP references
UUID 18da6a0e-abe9-4f65-91a3-2bf5a5ad29c2 which can be used as unique global reference for Unidentified 047 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 052
Internal MISP references
UUID 80c12fcd-e5ef-4549-860d-7928363022f9 which can be used as unique global reference for Unidentified 052 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 053 (Wonknu?)
Internal MISP references
UUID b60e32bd-158a-42b9-ac21-288bca4c8233 which can be used as unique global reference for Unidentified 053 (Wonknu?) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 057
Unnamed portscanner as used in the Australian Parliament Hack (Feb 2019).
Internal MISP references
UUID 1b8e86ab-57b2-4cd9-a768-a7118b4eb4be which can be used as unique global reference for Unidentified 057 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 058
Internal MISP references
UUID bab52335-be9e-4fad-b68e-f124b0d69bbc which can be used as unique global reference for Unidentified 058 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 066
This .net executable can receive commands from c2 sever, upload and download files according to the returned content, perform an uninstall, or modify the registry to achieve persistence across reboots. At the end, it downloads a Python-based RAT, called PeppyRAT.
Internal MISP references
UUID e78c402f-998b-43ff-8102-f54838afcb8b which can be used as unique global reference for Unidentified 066 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 067
Internal MISP references
UUID 224066ee-4266-44a3-8ea2-b5d7b9b4969a which can be used as unique global reference for Unidentified 067 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 068
Internal MISP references
UUID 26bfad72-59d8-456e-a200-eb18e614e5cb which can be used as unique global reference for Unidentified 068 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 069 (Zeus Unnamed2)
Zeus derivate, no known public references.
Internal MISP references
UUID cc66d112-2ff5-462c-b029-15458d51f8a7 which can be used as unique global reference for Unidentified 069 (Zeus Unnamed2) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 070 (Downloader)
Unidentified downloader, possibly related to KONNI.
Internal MISP references
UUID 0bdef005-fd36-4ce0-a215-d49bf05b8fb8 which can be used as unique global reference for Unidentified 070 (Downloader) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 071 (Zeus Unnamed1)
Internal MISP references
UUID cc7de9da-dc33-4cf8-9388-986b001fad63 which can be used as unique global reference for Unidentified 071 (Zeus Unnamed1) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 072 (Metamorfo Loader)
MSI-based loader that has been observed as a stager for win.metamorfo.
Internal MISP references
UUID f2979fee-603d-496e-a526-d622e9cba84f which can be used as unique global reference for Unidentified 072 (Metamorfo Loader) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 074 (Downloader)
Internal MISP references
UUID 4b60bda2-c587-4069-ace1-6283891d5faf which can be used as unique global reference for Unidentified 074 (Downloader) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 075
Unpacked http_dll.dat from the blog post.
Internal MISP references
UUID 66f26a60-ab6a-4b7c-bd85-afdc44dbcfdd which can be used as unique global reference for Unidentified 075 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 076 (Higaisa LNK to Shellcode)
Internal MISP references
UUID 4d5d0798-9cb3-4f26-8c98-db8d7190d187 which can be used as unique global reference for Unidentified 076 (Higaisa LNK to Shellcode) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 077 (Lazarus Downloader)
Internal MISP references
UUID ca8a1900-ea9a-4d83-8873-6c48ac12da9a which can be used as unique global reference for Unidentified 077 (Lazarus Downloader) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_077 - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-north-korea-indictment - webarchive
- https://twitter.com/ccxsaber/status/1277064824434745345 - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048f - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 078 (Zebrocy Nim Loader?)
Suspected Zebrocy loader written in Nim.
Internal MISP references
UUID 99099489-eeb9-415a-a3b8-6133e774bed0 which can be used as unique global reference for Unidentified 078 (Zebrocy Nim Loader?) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 080
This Trojan is a full-featured RAT capable of executing common tasks such as command execution and downloading/uploading files. This is implemented through a couple dozen C++ classes such as CMFile, CMFile, CMProcess, TFileDownload, TDrive, TProcessInfo, TSock, etc. The first stage custom installer utilizes the same classes. The Trojan uses HTTP Server API to filter HTTPS packets at port 443 and parse commands. It is also used by attackers to gather a target’s data, make lateral movements and create SOCKS tunnels to their C2 using the Earthworm tunneler.Given that the Trojan is an HTTPS server itself, the SOCKS tunnel is used for targets without an external IP, so the C2 is able to send commands.
Internal MISP references
UUID f12b3029-87a1-4632-855f-4fef784210bd which can be used as unique global reference for Unidentified 080 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 081 (Andariel Ransomware)
Kaspersky Labs observed Andariel to drop this ransomware in one case within a series of attacks carried out against targets in South Korea in April 2021.
Internal MISP references
UUID 2eb8ca65-186b-44ae-bd91-189b3eb5ed54 which can be used as unique global reference for Unidentified 081 (Andariel Ransomware) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 083 (AutoIT Stealer)
Internal MISP references
UUID 438ab9a3-3e2b-4241-8bcb-e61c2d118772 which can be used as unique global reference for Unidentified 083 (AutoIT Stealer) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 085
A RAT written in .NET, potentially used by Transparent Tribe.
Internal MISP references
UUID f80e8948-8e1e-4ecf-8d5e-08148e4dd2b0 which can be used as unique global reference for Unidentified 085 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 087
Symantec describes this family as an unidentified tool set used to target a range of organizations in South East Asia. The campaign was first noticed in September 2020.
Internal MISP references
UUID a4c9861e-93c6-4b2b-aa2d-71c1405375b4 which can be used as unique global reference for Unidentified 087 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 088 (Nim Ransomware)
Ransomware written in Nim.
Internal MISP references
UUID d7f1e6cf-1880-426a-881a-619309f32c37 which can be used as unique global reference for Unidentified 088 (Nim Ransomware) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 091
Avast found this unidentified RAT, which abuses a code-signing certificate by the Philippine Navy. It is statically linked against OpenSSL 1.1.1g.
Internal MISP references
UUID 33c8e201-9cd1-4a44-9380-3e3d3d6894c3 which can be used as unique global reference for Unidentified 091 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 092 (Confucius Backdoor)
According to Antiy CERT, this is a C++ backdoor that was first discovered in an attack by Confucius in September 2020. Its main functions include creating scheduled tasks, retrieving process information, retrieving network adapter information, retrieving disk drive information, uploading files, downloading files, executing files, and providing shell access.
Internal MISP references
UUID 22ed4f2a-2ed4-4235-97c3-69913bc80a00 which can be used as unique global reference for Unidentified 092 (Confucius Backdoor) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 093 (Sidewinder)
Check Point Research observed this malware being used by Sidewinder.
Internal MISP references
UUID 9b7dfe8f-c06e-4803-9792-48ca369e80b3 which can be used as unique global reference for Unidentified 093 (Sidewinder) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 094
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Unidentified 094.
| Known Synonyms |
|---|
ClaimLoader |
PUBLOAD |
Internal MISP references
UUID db8f94e9-768d-4ad1-befb-55b4b820174f which can be used as unique global reference for Unidentified 094 in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_094 - webarchive
- https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html - webarchive
- https://twitter.com/katechondic/status/1556940169483264000 - webarchive
- https://blog.talosintelligence.com/2022/05/mustang-panda-targets-europe.html - webarchive
- https://www.lac.co.jp/lacwatch/report/20221117_003189.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 095 (Iranian Wiper)
Wiper, using EldoS RawDisk for low level access to disks.
Internal MISP references
UUID 925f7a39-9674-4209-a31a-e09c27117328 which can be used as unique global reference for Unidentified 095 (Iranian Wiper) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_095 - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-264a - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/aa22-264a-iranian-cyber-actors-conduct-cyber-operations-against-the-government-of-albania.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 096 (Keylogger)
Keylogger.
Internal MISP references
UUID 0c87cf0d-fa54-4962-817d-eac4c817b21a which can be used as unique global reference for Unidentified 096 (Keylogger) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 097 (Polonium Keylogger)
Internal MISP references
UUID 32fe5b04-1af6-4696-a329-604a9f637c85 which can be used as unique global reference for Unidentified 097 (Polonium Keylogger) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 098 (APT29 Slack Downloader)
Internal MISP references
UUID db87fd2d-08ff-431d-86b8-35e31c9fcc9b which can be used as unique global reference for Unidentified 098 (APT29 Slack Downloader) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_098 - webarchive
- https://www.freebuf.com/articles/paper/339618.html - webarchive
- https://r136a1.info/2022/07/19/a-look-into-apt29s-new-early-stage-google-drive-downloader/ - webarchive
- https://ti.qianxin.com/blog/articles/analysis-of-apt29%27s-attack-activities-against-italy/ - webarchive
- https://cert-agid.gov.it/news/il-malware-envyscout-apt29-e-stato-veicolato-anche-in-italia/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 099 (APT29 Dropbox Loader)
This malware uses DropBox for C2 and was spread via spear-phishing attack at government organizations. It is different from win.boombox, which is another APT29 attributed malware using DropBox (written in .NET).
Internal MISP references
UUID 541a0a05-5c7f-4646-a96b-a4d26d5fa89d which can be used as unique global reference for Unidentified 099 (APT29 Dropbox Loader) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_099 - webarchive
- https://www.incibe-cert.es/sites/default/files/contenidos/estudios/doc/incibe-cert_estudio_analisis_nobelium_2022_v1.pdf - webarchive
- https://github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/APT29_C2-Client_Dropbox_Loader/APT29-DropboxLoader_analysis.md - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 100 (APT-Q-12)
Internal MISP references
UUID 0ee92ce5-e33d-4393-a466-6b5f6a1ca6a5 which can be used as unique global reference for Unidentified 100 (APT-Q-12) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 103 (FIN8)
A malware that uses .NET to load unmanaged (shell)code which has some resemblance to BADHATCH, the IP found in the sample was referred to in coverage on WHITERABBIT ransomware attacks.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Unidentified 103 (FIN8).
| Known Synonyms |
|---|
Sardonic |
Internal MISP references
UUID 07106811-cd07-4d05-906d-c05208758b00 which can be used as unique global reference for Unidentified 103 (FIN8) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 104
Internal MISP references
UUID ec530093-5ffc-45f1-b04d-accf3269b2d2 which can be used as unique global reference for Unidentified 104 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 105
Internal MISP references
UUID 07464f74-f587-4266-b828-448c67d2bd85 which can be used as unique global reference for Unidentified 105 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 106
This is possibly related to the MATA framework / Dacls.
Internal MISP references
UUID da2d8044-ed12-4951-bcd8-fd1e1335244a which can be used as unique global reference for Unidentified 106 in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_106 - webarchive
- https://www.virustotal.com/gui/file/3c1cfc2b8b7e5c2d713ec5f329aa58a6b56a08240199761ba6da91e719d30705/detection - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/18092216/Updated-MATA-attacks-Eastern-Europe_full-report_ENG.pdf - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/dark-river-you-can-t-see-them-but-they-re-there/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 107 (APT29)
Small shellcode downloader, likely used by APT29.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Unidentified 107 (APT29).
| Known Synonyms |
|---|
ICEBEAT |
Internal MISP references
UUID e83a3731-9c84-4e36-a2da-9e6c9c2461d7 which can be used as unique global reference for Unidentified 107 (APT29) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_107 - webarchive
- https://blog.eclecticiq.com/german-embassy-lure-likely-part-of-campaign-against-nato-aligned-ministries-of-foreign-affairs#a3 - webarchive
- https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing - webarchive
- https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA%3D%3D&mid=2247494783&idx=1&sn=612cf3cea1ef62e04bfb6bd0ce3b6b65&chksm=f9ed80c0ce9a09d6f5edc1424df5260cb9a9cf55fe92bd922407eef960650e91ec8cc46933ab&scene=178&cur_album_id=1375769135073951745 - webarchive
- https://lab52.io/blog/2344-2/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 108
Internal MISP references
UUID ee09eba1-e96e-476f-9372-e99218d8ab90 which can be used as unique global reference for Unidentified 108 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 109 (Lazarus?)
Internal MISP references
UUID ad37d6ad-e9b7-4652-8a2e-502b170932e7 which can be used as unique global reference for Unidentified 109 (Lazarus?) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 110 (RustyFlag)
According to Deep Instinct, this information stealer is written in Rust and was observed in Operation Rusty Flag.
Internal MISP references
UUID 00dac929-3038-4fc1-a1a5-0fd895126e92 which can be used as unique global reference for Unidentified 110 (RustyFlag) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 111 (IcedID Loader)
First discovered in October 2023, BLACKWIDOW is a backdoor written in C that communicates over HTTP using RC4 encrypted requests. The malware has the capability to execute discovery commands, query information about the victim's machine, update itself, as well as download and execute an EXE, DLL, or shellcode. The malware is believed to have been developed by LUNAR SPIDER, the creators of IcedID (aka BokBot) Malware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Unidentified 111 (IcedID Loader).
| Known Synonyms |
|---|
BLACKWIDOW |
Latrodectus |
Lotus |
Internal MISP references
UUID 841bb886-8c75-427f-9b57-537c546557e1 which can be used as unique global reference for Unidentified 111 (IcedID Loader) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_111 - webarchive
- https://twitter.com/Myrtus0x0/status/1732997981866209550 - webarchive
- https://www.esentire.com/blog/danabots-latest-move-deploying-icedid - webarchive
- https://medium.com/walmartglobaltech/icedid-gets-loaded-af073b7b6d39 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unidentified 112 (Rust-based Stealer)
A Rust-based stealer, observed by Seqrite, along TTPs overlapping with Pakistan-linked APT groups.
Internal MISP references
UUID 1f50fa09-9c0f-40f8-9431-bd122dd347ff which can be used as unique global reference for Unidentified 112 (Rust-based Stealer) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Unlock92
Internal MISP references
UUID 036e657f-a752-4a4c-bb30-f15c24d954e6 which can be used as unique global reference for Unlock92 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
UPAS
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular UPAS.
| Known Synonyms |
|---|
Rombrast |
Internal MISP references
UUID b64ea39b-3ec2-49e3-8992-02d71c21b1bd which can be used as unique global reference for UPAS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Upatre
Upatre is primarly a downloader. It has been discovered in 2013 and since that time it has been widely updated. Upatre is responsible for delivering further malware to the victims, in specific upatre was a prolific delivery mechanism for Gameover P2P in 2013-2014 and then for Dyre in 2015.
Internal MISP references
UUID 925390a6-f88d-46dc-96ae-4ebc9f0b50b0 which can be used as unique global reference for Upatre in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.upatre - webarchive
- https://researchcenter.paloaltonetworks.com/2018/07/unit42-upatre-continues-evolve-new-anti-analysis-techniques/ - webarchive
- https://secrary.com/ReversingMalware/Upatre/ - webarchive
- https://marcoramilli.com/2020/06/24/is-upatre-downloader-coming-back/ - webarchive
- https://unit42.paloaltonetworks.com/ticked-off-upatre-malwares-simple-anti-analysis-trick-to-defeat-sandboxes/ - webarchive
- https://johannesbader.ch/2015/06/Win32-Upatre-BI-Part-1-Unpacking/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Urausy
Internal MISP references
UUID 5af4838f-1b4d-4f0b-bd27-50ef532e84f7 which can be used as unique global reference for Urausy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
UrlZone
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular UrlZone.
| Known Synonyms |
|---|
Bebloh |
Shiotob |
Internal MISP references
UUID ed9f995b-1b41-4b83-a978-d956670fdfbe which can be used as unique global reference for UrlZone in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.urlzone - webarchive
- https://mp.weixin.qq.com/s/NRytT94ne5gKN31CSLq6GA - webarchive
- https://www.cybereason.com/blog/new-ursnif-variant-targets-japan-packed-with-new-features - webarchive
- https://www.proofpoint.com/us/threat-insight/post/holiday-lull-not-so-much - webarchive
- https://www.virusbulletin.com/virusbulletin/2012/09/urlzone-reloaded-new-evolution/ - webarchive
- https://krebsonsecurity.com/2011/07/trojan-tricks-victims-into-transfering-funds/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/Vawtrak-UrlZone-Banking-Trojans-Target-Japan - webarchive
- https://www.gdatasoftware.com/blog/2013/12/23978-bebloh-a-well-known-banking-trojan-with-noteworthy-innovations - webarchive
- http://blog.inquest.net/blog/2019/03/09/Analyzing-Sophisticated-PowerShell-Targeting-Japan/ - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_5_sajo-takeda-niwa_en.pdf - webarchive
- https://www.fireeye.com/blog/threat-research/2016/01/urlzone_zones_inon.html - webarchive
- https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta544-targets-geographies-italy-japan-range-malware - webarchive
- https://www.crowdstrike.com/blog/cutwail-spam-campaign-uses-steganography-to-distribute-urlzone/ - webarchive
- https://www.johannesbader.ch/2015/01/the-dga-of-shiotob/ - webarchive
- https://www.proofpoint.com/us/threat-insight/post/urlzone-top-malware-japan-while-emotet-and-line-phishing-round-out-landscape-0 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Uroburos (Windows)
Uroburos is a driver for Windows, including a bypass of PatchGuard. According to Andrzej Dereszowski and Matthieu Kaczmarek, "the techniques used demonstrate [their] excellent knowledge of Windows kernel internals."
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Uroburos (Windows).
| Known Synonyms |
|---|
Snake |
Internal MISP references
UUID d674ffd2-1f27-403b-8fe9-b4af6e303e5c which can be used as unique global reference for Uroburos (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.uroburos - webarchive
- https://exatrack.com/public/Tricephalic_Hellkeeper.pdf - webarchive
- https://securelist.com/analysis/publications/65545/the-epic-turla-operation/ - webarchive
- https://artemonsecurity.com/uroburos.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-hunter - webarchive
- https://www.carbonblack.com/2017/08/18/threat-analysis-carbon-black-threat-research-dissects-png-dropper/ - webarchive
- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/ - webarchive
- https://exatrack.com/public/Uroburos_EN.pdf - webarchive
- https://www.crysys.hu/publications/files/tedi/ukatemicrysys_territorialdispute.pdf - webarchive
- https://www.circl.lu/pub/tr-25/ - webarchive
- https://www.gdatasoftware.com/blog/2014/02/23968-uroburos-highly-complex-espionage-software-with-russian-roots - webarchive
- https://www.gdatasoftware.com/blog/2014/06/23953-analysis-of-uroburos-using-windbg - webarchive
- https://www.gdatasoftware.com/blog/2014/11/23937-the-uroburos-case-new-sophisticated-rat-identified - webarchive
- https://research.nccgroup.com/2018/11/22/turla-png-dropper-is-back/ - webarchive
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a - webarchive
- https://www.gdatasoftware.com/blog/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence - webarchive
- https://artemonsecurity.com/snake_whitepaper.pdf - webarchive
- https://www.gdatasoftware.com/blog/2014/05/23958-uroburos-rootkit-belgian-foreign-ministry-stricken - webarchive
- https://www.gdatasoftware.com/blog/2014/03/23966-uroburos-deeper-travel-into-kernel-protection-mitigation - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
USBCulprit
According to Kaspersky, USBCulprit is a malware that is capable of scanning various paths in victim machines, collecting documents with particular extensions and passing them on to USB drives when they are connected to the system. It can also selectively copy itself to a removable drive in the presence of a particular file, suggesting it can be spread laterally by having designated drives infected and the executable in them opened manually.
Internal MISP references
UUID 56af8251-4236-42e0-99bc-2c32377e97bb which can be used as unique global reference for USBCulprit in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.usbculprit - webarchive
- https://securelist.com/cycldek-bridging-the-air-gap/97157/ - webarchive
- https://drive.google.com/file/d/11otA_VmL061KcFC5MhDYuNdIKHYbpyrd/view - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
USBferry
Internal MISP references
UUID 6d0a92c0-cad8-4470-b780-3041774acad3 which can be used as unique global reference for USBferry in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.usbferry - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-troopers-back-usbferry-attack-targets-air-gapped-environments/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf - webarchive
- https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vadokrist
ESET reports that Vadokrist is a Latin American banking trojan that they have been tracking since 2018 and that is active almost exclusively in Brazil.
Internal MISP references
UUID d4ab5619-2347-4949-8102-78296b87a08c which can be used as unique global reference for Vadokrist in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vaggen
Internal MISP references
UUID 006621d1-a3bd-40f2-a55c-d79c84879a6b which can be used as unique global reference for Vaggen in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ValleyRAT
Internal MISP references
UUID fcf8f520-27a9-493e-a274-fbfd70b733b0 which can be used as unique global reference for ValleyRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
VALUEVAULT
Internal MISP references
UUID dd95eefd-2ef3-4bda-9065-18f4b03c2249 which can be used as unique global reference for VALUEVAULT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.valuevault - webarchive
- https://intezer.com/blog-new-iranian-campaign-tailored-to-us-companies-uses-updated-toolset/ - webarchive
- https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html - webarchive
- https://cyware.com/blog/apt34-the-helix-kitten-cybercriminal-group-loves-to-meow-middle-eastern-and-international-organizations-48ae - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
vanillarat
Description:
VanillaRat is an advanced remote administration tool coded in C#. VanillaRat uses the Telepathy TCP networking library, dnlib module reading and writing library, and Costura.Fody dll embedding library. Features:
Remote Desktop Viewer (With remote click)
File Browser (Including downloading, drag and drop uploading, and file opening)
Process Manager
Computer Information
Hardware Usage Information (CPU usage, disk usage, available ram)
Message Box Sender
Text To Speech
Screen Locker
Live Keylogger (Also shows current window)
Website Opener
Application Permission Raiser (Normal -> Admin)
Clipboard Text (Copied text)
Chat (Does not allow for client to close form)
Audio Recorder (Microphone)
Process Killer (Task manager, etc.)
Remote Shell
Startup
Security Blacklist (Drag client into list if you don't want connection. Press del. key on client to remove from list)
Internal MISP references
UUID 5bb80b4a-d304-460a-bb07-417dea64f213 which can be used as unique global reference for vanillarat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
VaporRage
According to Mandiant, VaporRage or BOOMMIC, is a shellcode downloader written in C that communicates over HTTPS. Shellcode Payloads are retrieved from a hardcoded C2 that uses an encoded host_id generated from the targets domain and account name. BOOMMIC XOR decodes the downloaded shellcode payload in memory and executes it.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular VaporRage.
| Known Synonyms |
|---|
BOOMMIC |
Internal MISP references
UUID 5a76d7a1-486e-4f4e-9e23-e544ee9f2ef9 which can be used as unique global reference for VaporRage in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.vapor_rage - webarchive
- https://www.incibe-cert.es/sites/default/files/contenidos/estudios/doc/incibe-cert_estudio_analisis_nobelium_2022_v1.pdf - webarchive
- https://mrtiepolo.medium.com/sophisticated-apt29-campaign-abuses-notion-api-to-target-the-european-commission-200188059f58 - webarchive
- https://www.mandiant.com/resources/blog/tracking-apt29-phishing-campaigns - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Varenyky
In May 2019, ESET researchers observed a spike in ESET telemetry data regarding malware targeting France. After further investigations, they identified malware that distributes various types of spam. One of them is leading to a survey that redirects to a dodgy smartphone promotion while the other is a sextortion campaign. The spam targets the users of Orange S.A., a French ISP.
Internal MISP references
UUID f0740430-248f-4dd9-a2f3-b2592090a8a6 which can be used as unique global reference for Varenyky in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vawtrak
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Vawtrak.
| Known Synonyms |
|---|
Catch |
NeverQuest |
grabnew |
Internal MISP references
UUID b662c253-5c87-4ae6-a30e-541db0845f67 which can be used as unique global reference for Vawtrak in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.vawtrak - webarchive
- https://info.phishlabs.com/blog/the-unrelenting-evolution-of-vawtrak - webarchive
- https://www.blueliv.com/downloads/network-insights-into-vawtrak-v2.pdf - webarchive
- https://medium.com/@Ilandu/vawtrak-malware-824818c1837 - webarchive
- https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- http://thehackernews.com/2017/01/neverquest-fbi-hacker.html - webarchive
- https://securityintelligence.com/posts/from-ramnit-to-bumblebee-via-neverquest - webarchive
- https://fidelissecurity.com/threatgeek/archive/me-and-mr-robot-tracking-actor-behind-man1-crypter/ - webarchive
- https://blog.fox-it.com/2018/08/09/bokbot-the-rebirth-of-a-banker/ - webarchive
- https://www.crowdstrike.com/blog/sin-ful-spiders-wizard-spider-and-lunar-spider-sharing-the-same-web/ - webarchive
- https://www.secureworks.com/research/dyre-banking-trojan - webarchive
- https://threatpost.com/pos-attacks-net-crooks-20-million-stolen-bank-cards/117595/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Veeam Dumper
Credential Stealer, written in .NET.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Veeam Dumper.
| Known Synonyms |
|---|
Eamfo |
Internal MISP references
UUID f85bbceb-dc51-4c11-93a6-21a72255dcaf which can be used as unique global reference for Veeam Dumper in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
VegaLocker
Delphi-based ransomware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular VegaLocker.
| Known Synonyms |
|---|
Buran |
Vega |
Internal MISP references
UUID 704bb00f-f558-4568-824c-847523700043 which can be used as unique global reference for VegaLocker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.vegalocker - webarchive
- https://medium.com/walmartglobaltech/man1-moskal-hancitor-and-a-side-of-ransomware-d77b4d991618 - webarchive
- https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/buran-ransomware-the-evolution-of-vegalocker/ - webarchive
- https://twitter.com/malwrhunterteam/status/1093136163836174339 - webarchive
- https://twitter.com/malwrhunterteam/status/1095024267459284992 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
VEILEDSIGNAL
Internal MISP references
UUID b75f0dfd-15df-439d-8ff0-8e8f87656565 which can be used as unique global reference for VEILEDSIGNAL in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Velso
Ransomware that appears to require manually installation (believed to be via RDP). Encrypts files with .velso extension.
Internal MISP references
UUID 5490d2c7-72db-42cf-a1a4-02be1b3ade5f which can be used as unique global reference for Velso in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vendetta
Ransomware, which appears to be a rebranding of win.cuba.
Internal MISP references
UUID bd774e26-f558-444b-abe6-c75868374d5e which can be used as unique global reference for Vendetta in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Venom RAT
Internal MISP references
UUID 2ce1f55e-ac43-4fcb-b647-ff5ae9c26b7c which can be used as unique global reference for Venom RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.venom - webarchive
- https://blogs.jpcert.or.jp/en/2020/12/quasar-family.html - webarchive
- https://www.cybeseclabs.com/2020/05/07/venom-remote-administration-tool-from-venom-software/ - webarchive
- https://blog.malwarelab.pl/posts/venom/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
VenomLNK
VenomLNK is the initial phase of the more_eggs malware-as-a-service. It is a poisoned .lnk file that depends on User Execution and points to LOLBINs (often cmd.exe) with additional obfuscated scripting options. This typically initiates WMI abuse and TerraLoader, which can load additional functionality through various plugins.
Internal MISP references
UUID dea1ff4f-bc6d-40c0-9d19-b60578ea1344 which can be used as unique global reference for VenomLNK in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.venom_lnk - webarchive
- https://www.esentire.com/web-native-pages/unmasking-venom-spider - webarchive
- https://www.esentire.com/blog/hackers-spearphish-corporate-hiring-managers-with-poisoned-resumes-infecting-them-with-the-more-eggs-malware - webarchive
- https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9 - webarchive
- https://quointelligence.eu/2020/07/golden-chickens-evolution-of-the-maas/ - webarchive
- https://www.esentire.com/security-advisories/hackers-spearphish-professionals-on-linkedin-with-fake-job-offers-infecting-them-with-malware-warns-esentire - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Venus Locker
Internal MISP references
UUID 7a0137ad-df7a-4fae-8365-eb36cc7e60cd which can be used as unique global reference for Venus Locker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vermilion Strike (Windows)
Internal MISP references
UUID f2db1f70-a284-42c1-9f5a-4b2f46dc8868 which can be used as unique global reference for Vermilion Strike (Windows) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vermin
Internal MISP references
UUID 2d07a1bf-1d8d-4f1e-a02f-1a8ff5b76cd1 which can be used as unique global reference for Vermin in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.vermin - webarchive
- https://www.welivesecurity.com/2018/07/17/deep-dive-vermin-rathole/ - webarchive
- https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/ - webarchive
- https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vetta Loader
Vetta Loader is a persistent Loader spreading with infected USB drives. It downloads other components leveraging legit hosting services. https://yoroi.company/wp-content/uploads/2023/12/202311-Vetta-Loader_Def-min.pdf
Internal MISP references
UUID f5dafd8f-1003-4002-ae05-ecbaa3ba6817 which can be used as unique global reference for Vetta Loader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vflooder
Vflooder floods VirusTotal by infinitely submitting a copy of itself. Some variants apparently also try to flood Twitter. The impact on these services are negligible, but for researchers it can be a nuisance. Most versions are protected by VMProtect.
Internal MISP references
UUID 044849d3-d0de-4f78-b67d-bfbe8dd3a255 which can be used as unique global reference for Vflooder in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
VHD Ransomware
Internal MISP references
UUID fb0ad46d-20b6-4e8c-b401-702197667272 which can be used as unique global reference for VHD Ransomware in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.vhd_ransomware - webarchive
- https://twitter.com/GrujaRS/status/1241657443282825217 - webarchive
- https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/ - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://seguranca-informatica.pt/secrets-behind-the-lazaruss-vhd-ransomware/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/the-sound-of-malware.html - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/the-hermit-kingdoms-ransomware-play.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
VictoryGate
VictoryGate was the name of a cryptomining botnet, which was disrupted by ESET researchers in April 2020. The used malware itself was also referred to as VictoryGate. It was spotted in May 2019 and targeted mainly Latin American users, specifically, Peru (Criptonizando states 90% of the botnet publication residing there). Both public and private sectors were targeted. This cryptojacking malware was specialized in Monero (XRM) cryptocurrency. VictoryGate shows very strong code overlap with win.orchard.
Internal MISP references
UUID 229cd7f6-2514-42b8-baa6-0c2a22cd5d9c which can be used as unique global reference for VictoryGate in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.victorygate - webarchive
- https://criptonizando.com/35-mil-computadores-foram-infectados-na-america-latina-por-malware-que-minerava-monero/ - webarchive
- https://www.welivesecurity.com/2020/04/23/eset-discovery-monero-mining-botnet-disrupted/ - webarchive
- https://www.advintel.io/post/economic-growth-digital-inclusion-specialized-crime-financial-cyber-fraud-in-latam - webarchive
- https://www.eset.com/int/about/newsroom/press-releases/research/eset-researchers-disrupt-cryptomining-botnet-victorygate/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vidar
Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.
Internal MISP references
UUID 1f44c08a-b427-4496-9d6d-909b6bf34b9b which can be used as unique global reference for Vidar in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar - webarchive
- https://www.esentire.com/blog/batloader-continues-to-abuse-google-search-ads-to-deliver-vidar-stealer-and-ursnif - webarchive
- https://medium.com/s2wlab/deep-analysis-of-vidar-stealer-ebfc3b557aed - webarchive
- https://community.emergingthreats.net/t/vidar-stealer-picks-up-steam/271 - webarchive
- https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/ - webarchive
- https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ - webarchive
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/vidar-malware-launcher-concealed-in-help-file/ - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf - webarchive
- https://www.cybereason.com/blog/the-hole-in-the-bucket-attackers-abuse-bitbucket-to-deliver-an-arsenal-of-malware - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://tccontre.blogspot.com/2019/03/infor-stealer-vidar-trojanspy-analysis.html - webarchive
- https://www.youtube.com/watch?v=NI_Yw2t9zoo - webarchive
- https://www.secureworks.com/research/the-growing-threat-from-infostealers - webarchive
- https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign - webarchive
- https://blog.malwarebytes.com/threat-analysis/2019/01/vidar-gandcrab-stealer-and-ransomware-combo-observed-in-the-wild/ - webarchive
- https://darktrace.com/blog/vidar-info-stealer-malware-distributed-via-malvertising-on-google - webarchive
- https://isc.sans.edu/diary/Arkei+Variants%3A+From+Vidar+to+Mars+Stealer/28468 - webarchive
- https://ke-la.com/information-stealers-a-new-landscape/ - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://www.bleepingcomputer.com/news/security/fake-pixelmon-nft-site-infects-you-with-password-stealing-malware/ - webarchive
- https://embee-research.ghost.io/ghidra-basics-identifying-and-decoding-encrypted-strings/ - webarchive
- https://twitter.com/sisoma2/status/1409816282065743872 - webarchive
- https://twitter.com/GroupIB_GIB/status/1570821174736850945 - webarchive
- https://blog.jaalma.io/vidar-infostealer-analysis/ - webarchive
- https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf - webarchive
- https://xer0xe9.github.io/A-Case-of-Vidar-Infostealer-Part-2/ - webarchive
- https://www.youtube.com/watch?v=lxdlNOaHJQA - webarchive
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-batloader - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf - webarchive
- https://cert.pl/en/posts/2021/10/vidar-campaign/ - webarchive
- https://research.checkpoint.com/2022/bumblebee-increasing-its-capacity-and-evolving-its-ttps/ - webarchive
- https://asec.ahnlab.com/en/30445/ - webarchive
- https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ - webarchive
- https://www.cisa.gov/sites/default/files/2023-11/aa23-320a_scattered_spider.pdf - webarchive
- https://www.zscaler.com/blogs/security-research/vidar-distributed-through-backdoored-windows-11-downloads-and-abusing - webarchive
- https://xer0xe9.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ - webarchive
- https://www.team-cymru.com/post/darth-vidar-the-aesir-strike-back - webarchive
- https://isc.sans.edu/diary/rss/28468 - webarchive
- https://censys.com/tracking-vidar-infrastructure/ - webarchive
- https://www.csoonline.com/article/3654849/microsoft-help-files-repurposed-to-contain-vidar-malware-in-new-campaign.html - webarchive
- https://eln0ty.github.io/malware%20analysis/vidar/ - webarchive
- https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ - webarchive
- https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ - webarchive
- https://docs.google.com/spreadsheets/d/1nx42rdMdkCrvlmACDi3CHseyG87iSV1Y6rGZYq_-oDk - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://www.trendmicro.com/en_us/research/21/i/fake-installers-drop-malware-and-open-doors-for-opportunistic-attackers.html - webarchive
- https://asec.ahnlab.com/ko/25837/ - webarchive
- https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-vidar-2c0a62a73087 - webarchive
- https://blog.minerva-labs.com/vidar-stealer-evasion-arsenal - webarchive
- https://asec.ahnlab.com/en/22932/ - webarchive
- https://socprime.com/blog/somnia-malware-detection-uac-0118-aka-frwl-launches-cyber-attacks-against-organizations-in-ukraine-using-enhanced-malware-strains/ - webarchive
- https://www.team-cymru.com/post/darth-vidar-the-dark-side-of-evolving-threat-infrastructure - webarchive
- https://www.fortinet.com/blog/threat-research/the-year-of-the-wiper - webarchive
- https://kienmanowar.wordpress.com/2022/12/17/quicknote-vidarstealer-analysis/ - webarchive
- https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/ - webarchive
- https://www.bleepingcomputer.com/news/security/gandcrab-operators-use-vidar-infostealer-as-a-forerunner/ - webarchive
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-vidar-stealer - webarchive
- https://blog.cyble.com/2022/11/08/massive-youtube-campaign-targeting-over-100-applications-to-deliver-info-stealer/ - webarchive
- https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem - webarchive
- https://fumik0.com/2018/12/24/lets-dig-into-vidar-an-arkei-copycat-forked-stealer-in-depth-analysis/ - webarchive
- https://malwarology.substack.com/p/malicious-packer-pkr_ce1a?r=1lslzd - webarchive
- https://medium.com/s2wlab/w1-feb-en-story-of-the-week-stealers-on-the-darkweb-49945a31601d - webarchive
- https://intel471.com/blog/privateloader-malware - webarchive
- https://threatpost.com/microsoft-help-files-vidar-malware/179078/ - webarchive
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a - webarchive
- https://www.kroll.com/en/insights/publications/cyber/threat-actors-google-ads-deploy-vidar-stealer - webarchive
- https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks - webarchive
- https://asec.ahnlab.com/en/30875/ - webarchive
- https://www.cynet.com/blog/cyops-lighthouse-vidar-stealer/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
VIGILANT CLEANER
Wiper malware discovered by Japanese security firm Mitsui Bussan Secure Directions (MBSD), which is assumed to target Japan, the host country of the 2021 Summer Olympics. In addition to targeting common file Office-related files, it specifically targets file types associated with the Japanese word processor Ichitaro.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular VIGILANT CLEANER.
| Known Synonyms |
|---|
VIGILANT CHECKER |
Internal MISP references
UUID 65711172-14f7-4e3d-9aca-7895b37b2e9a which can be used as unique global reference for VIGILANT CLEANER in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.vigilant_cleaner - webarchive
- https://therecord.media/wiper-malware-targeting-japanese-pcs-discovered-ahead-of-tokyo-olympics-opening/ - webarchive
- https://blog.trendmicro.co.jp/archives/28319 - webarchive
- https://blog.cyble.com/2021/08/02/a-deep-dive-analysis-of-a-new-wiper-malware-disguised-as-tokyo-olympics-document/ - webarchive
- https://www.mbsd.jp/research/20210721/blog/ - webarchive
- https://www.fortinet.com/blog/threat-research/wiper-malware-riding-tokyo-olympic-games - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
virdetdoor
Internal MISP references
UUID 30161733-993f-4a1c-bcc5-7b4f1cd7d9e4 which can be used as unique global reference for virdetdoor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
VirLock
Polymorphic parasitic file infecting virus which transforms files into copies of itself. Additionally it uses screen-locking as a ransomware technique.
Internal MISP references
UUID 86ea83f1-c06c-4ee3-9c4e-df302974f649 which can be used as unique global reference for VirLock in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.virlock - webarchive
- https://www.virusbulletin.com/virusbulletin/2016/12/vb2015-paper-its-file-infector-its-ransomware-its-virlock/ - webarchive
- https://www.welivesecurity.com/2014/12/22/win32virlock-first-self-reproducing-ransomware-also-shape-shifter/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-recap-january-14-29-2017 - webarchive
- https://blogs.blackberry.com/en/2019/07/threat-spotlight-virlock-polymorphic-ransomware - webarchive
- https://www.ciberseguridad.eus/sites/default/files/2022-04/bcsc-malware-virlock-tlpwhite_v1242.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
VIRTUALGATE
Internal MISP references
UUID 48d47a27-464a-4087-b691-574c3b494efb which can be used as unique global reference for VIRTUALGATE in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Virut
Internal MISP references
UUID 2e99f27c-6791-4695-b88b-de4d4cbda8d6 which can be used as unique global reference for Virut in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.virut - webarchive
- https://blog.malwarebytes.com/threat-analysis/2018/03/blast-from-the-past-stowaway-virut-delivered-with-chinese-ddos-bot/ - webarchive
- https://securelist.com/review-of-the-virus-win32-virut-ce-malware-sample/36305/ - webarchive
- https://www.theregister.co.uk/2018/01/10/taiwanese_police_malware/ - webarchive
- https://chrisdietri.ch/post/virut-resurrects/ - webarchive
- https://www.spamhaus.org/news/article/690/cooperative-efforts-to-shut-down-virut-botnet - webarchive
- https://krebsonsecurity.com/2013/01/polish-takedown-targets-virut-botnet/ - webarchive
- https://www.secureworks.com/research/virut-encryption-analysis - webarchive
- https://www.mandiant.com/resources/pe-file-infecting-malware-ot - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vizom
Internal MISP references
UUID a49d6db9-32a0-42a8-acb9-174146a7fafa which can be used as unique global reference for Vizom in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vjw0rm
VJW0rm (aka Vengeance Justice Worm) is a publicly available, modular JavaScript RAT. Vjw0rm was first released in November 2016 by its primary author, v_B01 (aka Sliemerez), within the prominent DevPoint Arabic-language malware development community. VJW0rm appears to be the JavaScript variant of a series of RATs with identical functionality released by the author throughout late 2016. Other variants include a Visual Basic Script (VBS) based worm titled vw0rm (Vengeance Worm), an AutoHotkey-based tool called vrw0rm (Vengeance Rise Worm), and a PowerShell-based variant called vdw0rm (Vengeance Depth Worm).
Internal MISP references
UUID 3a8186f1-ff2a-4431-be99-7e31c0096f15 which can be used as unique global reference for Vjw0rm in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.vjw0rm - webarchive
- https://appriver.com/resources/blog/november-2020/vjw0rm-back-new-tactics - webarchive
- https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf - webarchive
- https://threatresearch.ext.hp.com/wp-content/uploads/2022/05/HP-Wolf-Security-Threat-Insights-Report-Q1-2022.pdf - webarchive
- https://community.riskiq.com/article/24759ad2 - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/reservations-requested-ta558-targets-hospitality-and-travel - webarchive
- https://resources.securityscorecard.com/research/acasestudyofVjw0rm#page=1 - webarchive
- https://twitter.com/tccontre18/status/1461386178528264204 - webarchive
- https://www.deepinstinct.com/blog/understanding-the-windows-javascript-threat-landscape - webarchive
- https://threatresearch.ext.hp.com/wp-content/uploads/2021/10/HP-Wolf-Security-Threat-Insights-Report-Q3-2021.pdf - webarchive
- https://bazaar.abuse.ch/browse/signature/Vjw0rm/ - webarchive
- https://lifars.com/wp-content/uploads/2021/09/Vjw0rm-.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
VM Zeus
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular VM Zeus.
| Known Synonyms |
|---|
VMzeus |
Zberp |
ZeusVM |
Internal MISP references
UUID c32740a4-db2c-4d71-80bd-7377185f4a6f which can be used as unique global reference for VM Zeus in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vobfus
Malware of this family searches for computers on a network and creates copies of itself in folders with open access. For the program to be activated, the user must first run it on the computer. The code of this malware is written in the Visual Basic programming language and uses obfuscation, which is a distinguishing feature of this family. Code obfuscation complicates attempts by anti-virus software to analyze suspected malware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Vobfus.
| Known Synonyms |
|---|
Beebone |
Internal MISP references
UUID 60f7b1b9-c283-4395-909f-7b8b1731e840 which can be used as unique global reference for Vobfus in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.vobfus - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/whats-the-fuss-with-worm_vobfus/ - webarchive
- http://contagiodump.blogspot.com/2012/12/nov-2012-worm-vobfus-samples.html - webarchive
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/151/beebone-botnet-takedown-trend-micro-solutions - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vohuk
Internal MISP references
UUID f2c91bfb-1b22-4399-849a-f07304c2e81f which can be used as unique global reference for Vohuk in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Void
Ransomware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Void.
| Known Synonyms |
|---|
VoidCrypt |
Internal MISP references
UUID 55f66b60-5284-4db6-b26e-52b3aea17641 which can be used as unique global reference for Void in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Voidoor
Internal MISP references
UUID e9525c0d-0fba-4a0c-8b9d-31acc21194db which can be used as unique global reference for Voidoor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
VoidRAT
Internal MISP references
UUID d78756c3-912a-438e-b9d2-d41ae95f42c3 which can be used as unique global reference for VoidRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Volgmer
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Volgmer.
| Known Synonyms |
|---|
FALLCHILL |
Manuscrypt |
Internal MISP references
UUID bbfd4fb4-3e5a-43bf-b4bb-eaf5ef4fb25f which can be used as unique global reference for Volgmer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.volgmer - webarchive
- https://asec.ahnlab.com/en/56405/ - webarchive
- https://securelist.com/operation-applejeus/87553/ - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://asec.ahnlab.com/en/57685/ - webarchive
- https://drive.google.com/file/d/1XoGQFEJQ4nFAUXSGwcnTobviQ_ms35mG/view - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://securelist.com/lazarus-threatneedle/100803/ - webarchive
- https://drive.google.com/file/d/1lq0Sjw4FKBxf017Ss7W7uGMvs7CgFzcA/view - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://asec.ahnlab.com/ko/56256/ - webarchive
- https://securelist.com/the-lazarus-group-deathnote-campaign/109490/ - webarchive
- https://lifars.com/wp-content/uploads/2021/09/Lazarus.pdf - webarchive
- https://www.us-cert.gov/ncas/alerts/TA17-318B - webarchive
- https://www.secureworks.com/research/threat-profiles/nickel-academy - webarchive
- https://medium.com/s2wlab/analysis-of-threatneedle-c-c-communication-feat-google-tag-warning-to-researchers-782aa51cf74 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vovalex
Ransomware written in D.
Internal MISP references
UUID fe4ffa8d-74d2-472a-b0ca-83f9e7f95739 which can be used as unique global reference for Vovalex in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vreikstadi
Internal MISP references
UUID ab2a63f1-1afd-44e7-9cf4-c775dbee78f4 which can be used as unique global reference for Vreikstadi in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
VSingle
Internal MISP references
UUID a9afe6ba-732a-45fe-a925-2b61b05e5a76 which can be used as unique global reference for VSingle in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.vsingle - webarchive
- https://blogs.jpcert.or.jp/en/2021/03/Lazarus_malware3.html - webarchive
- https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - webarchive
- https://blogs.jpcert.or.jp/en/2022/07/vsingle.html - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/stonefly-north-korea-espionage - webarchive
- https://www.youtube.com/watch?v=nUjxH1gW53s - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
vSkimmer
Internal MISP references
UUID 3eae1764-7ea6-43e6-85a1-b1dd0b4856b8 which can be used as unique global reference for vSkimmer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.vskimmer - webarchive
- https://securingtomorrow.mcafee.com/mcafee-labs/vskimmer-botnet-targets-credit-card-payment-terminals/ - webarchive
- http://www.xylibox.com/2013/01/vskimmer.html - webarchive
- http://vkremez.weebly.com/cyber-security/-backdoor-win32hesetoxa-vskimmer-pos-malware-analysis - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vulturi
Information stealer.
Internal MISP references
UUID cfbd52a9-39d6-46f4-a539-76abcec92088 which can be used as unique global reference for Vulturi in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Vyveva RAT
Vyveva is a remote access trojan that uses the Tor library for communication with C&C. Its use of fake TLS for camouflaging the network traffic is one of the typical Lazarus traits.
It uses a simple XOR for encryption of its configuration and network traffic.
It sends detailed information about the victim's environment, like computer name, user name, IP, code page, Windows version, architecture, and time zone.
It supports more than 20 commands that include operations on the victim’s filesystem, basic process management, command line execution, file exfiltration, and the download and memory execution of an additional DLL from the C&C (by calling the expected export SamIPromote). As in many RATs from Lazarus arsenal, the commands are indexed by 32-bit integers. The lowest index is 0x3, followed by 0x10, which goes incrementally up to 0x26. Also, it can monitor newly connected drives and the number of logged-on users.
It has MPRD.dll as the internal DLL name, and a single export SamIInitialize.
Vyveva RAT was used in an attack against a freight logistics company in South Africa in June 2020.
Internal MISP references
UUID b7f0ba08-8e7c-43cd-9b26-8dfef763a404 which can be used as unique global reference for Vyveva RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
w32times
Internal MISP references
UUID 2479b6b9-c818-4f96-aba4-47ed7855e4a8 which can be used as unique global reference for w32times in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
win.wabot
Wabot is an IRC worm that is written in Delphi.
Internal MISP references
UUID cce35d3d-aea0-4e59-92cf-3289be4a4c21 which can be used as unique global reference for win.wabot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
wAgentTea
wAgentTea is an HTTP(S) downloader.
It was deployed mostly against South Korean targets like a pharmaceutical company (Q4 2020) or semiconductor industry (Q2 2023). In several cases, the initial access was obtained via exploitation of South Korean software like Initech's INISAFE CrossWeb EX or Dream Security’s MagicLine4NX.
It uses AES-128 for encryption and decryption of its network traffic, and for decryption of its binary configuration.
There is a hard-coded list of parameter names used in its HTTP POST request: identy;tname;blogdata;content;thesis;method;bbs;level;maincode;tab;idx;tb;isbn;entry;doc; category;articles;portal
It contains a specific RTTI symbol ".?AVCHttp_socket@@".
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular wAgentTea.
| Known Synonyms |
|---|
wAgent |
Internal MISP references
UUID 03bf5a8b-774c-498a-9fa2-b4027695fd00 which can be used as unique global reference for wAgentTea in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.wagenttea - webarchive
- https://asec.ahnlab.com/en/33801/ - webarchive
- https://asec.ahnlab.com/wp-content/uploads/2023/10/20231013_Lazarus_OP.Dream_Magic.pdf - webarchive
- https://securelist.com/lazarus-covets-covid-19-related-intelligence/99906/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Lazarus-campaigns-and-backdoors-in-2022-2023.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WallyShack
Internal MISP references
UUID 0bd92907-c858-4164-87d6-fec0f3595e69 which can be used as unique global reference for WallyShack in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WannaCryptor
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular WannaCryptor.
| Known Synonyms |
|---|
Wana Decrypt0r |
WannaCry |
WannaCrypt |
Wcry |
Internal MISP references
UUID ad67ff31-2a02-43f9-8b12-7df7e4fcccd6 which can be used as unique global reference for WannaCryptor in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor - webarchive
- https://blog.avast.com/ransomware-that-infected-telefonica-and-nhs-hospitals-is-spreading-aggressively-with-over-50000-attacks-so-far-today - webarchive
- https://krebsonsecurity.com/2017/05/u-k-hospitals-hit-in-widespread-ransomware-attack/ - webarchive
- https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf - webarchive
- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/WannaCry-Aftershock.pdf - webarchive
- http://blog.emsisoft.com/2017/05/12/wcry-ransomware-outbreak/ - webarchive
- https://www.microsoft.com/security/blog/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/ - webarchive
- https://metaswan.github.io/posts/Malware-Lazarus-group's-Brambul-worm-of-the-former-Wannacry-1 - webarchive
- https://www.il-pib.pl/czasopisma/JTIT/2019/1/113.pdf - webarchive
- https://baesystemsai.blogspot.de/2017/05/wanacrypt0r-ransomworm.html - webarchive
- https://blog.malwarebytes.com/cybercrime/2017/05/how-did-wannacry-ransomworm-spread/ - webarchive
- https://github.com/0xZuk0/rules-of-yaras/blob/main/reports/Wannacry%20Ransomware%20Report.pdf - webarchive
- https://www.youtube.com/watch?v=Q90uZS3taG0 - webarchive
- https://blog.comae.io/wannacry-the-largest-ransom-ware-infection-in-history-f37da8e30a58 - webarchive
- https://dissectingmalwa.re/third-times-the-charm-analysing-wannacry-samples.html - webarchive
- https://blog.comae.io/wannacry-decrypting-files-with-wanakiwi-demo-86bafb81112d - webarchive
- https://news.sophos.com/en-us/2021/03/15/dearcry-ransomware-attacks-exploit-exchange-server-vulnerabilities/ - webarchive
- https://www.flashpoint-intel.com/blog/linguistic-analysis-wannacry-ransomware/ - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
- https://blog.comae.io/wannacry-new-variants-detected-b8908fefea7e - webarchive
- https://i.blackhat.com/eu-20/Wednesday/eu-20-Rivera-From-Zero-To-Sixty-The-Story-Of-North-Koreas-Rapid-Ascent-To-Becoming-A-Global-Cyber-Superpower.pdf - webarchive
- https://gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168 - webarchive
- https://securelist.com/big-threats-using-code-similarity-part-1/97239/ - webarchive
- https://themoscowtimes.com/news/wcry-virus-reportedly-infects-russian-interior-ministrys-computer-network-57984 - webarchive
- http://www.independent.co.uk/news/uk/home-news/wannacry-malware-hack-nhs-report-cybercrime-north-korea-uk-ben-wallace-a8022491.html - webarchive
- https://sites.temple.edu/care/ci-rw-attacks/ - webarchive
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/magazine/2018/VB2018-Kalnai-Poslusny.pdf - webarchive
- https://docs.microsoft.com/en-us/security/compass/human-operated-ransomware - webarchive
- https://resources.malwarebytes.com/files/2020/02/2020_State-of-Malware-Report.pdf - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07170728/Guerrero-Saade-Raiu-VB2017.pdf - webarchive
- https://blog.gdatasoftware.com/2017/05/29751-wannacry-ransomware-campaign - webarchive
- https://storage.googleapis.com/pub-tools-public-publication-data/pdf/ce44cbda9fdc061050c1d2a5dec0270874a9dc85.pdf - webarchive
- https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html - webarchive
- https://www.symantec.com/connect/blogs/wannacry-ransomware-attacks-show-strong-links-lazarus-group - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf - webarchive
- https://swanleesec.github.io/posts/Malware-Lazarus-group's-Brambul-worm-of-the-former-Wannacry-1 - webarchive
- https://news.sophos.com/en-us/2019/09/18/the-wannacry-hangover/ - webarchive
- https://securelist.com/blog/incidents/78351/wannacry-ransomware-used-in-widespread-attacks-all-over-the-world/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WannaHusky
According to Mars, WannaHusky is a Nim-compiled ransomware malware sample, created for demonstration purposes and provided as part of the Practical Malware Analysis & Triage course provided by HuskyHacks.
Internal MISP references
UUID 10fc30fe-9f64-4765-a341-acde878f105c which can be used as unique global reference for WannaHusky in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WannaRen
Ransomware.
Internal MISP references
UUID 44f548e2-9a47-433a-bccf-fff412d2963b which can be used as unique global reference for WannaRen in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WastedLoader
This malware looks similar to WastedLocker, but the ransomware component is missing.
Internal MISP references
UUID c6b601f6-4cb6-4e7b-98fd-35af910ec0d8 which can be used as unique global reference for WastedLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WastedLocker
WastedLocker is a ransomware detected to be in use since May 2020 by EvilCorp. The ransomware name is derived from the filename that it creates which includes an abbreviation of the victim’s name and the string ‘wasted’. WastedLocker is protected with a custom crypter, referred to as CryptOne by Fox-IT InTELL. On examination, this crypter turned out to be very basic and was used also by other malware families such as: Netwalker, Gozi ISFB v3, ZLoader and Smokeloader. The crypter mainly contains junk code to increase entropy of the sample and hide the actual code.
Internal MISP references
UUID e72a0bde-ea5b-4450-bc90-b5d2dca697b4 which can be used as unique global reference for WastedLocker in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.wastedlocker - webarchive
- https://unit42.paloaltonetworks.com/atoms/wastedlocker-ransomware/ - webarchive
- https://blog.truesec.com/2021/05/05/are-the-notorious-cyber-criminals-evil-corp-actually-russian-spies/ - webarchive
- https://www.bleepingcomputer.com/news/security/garmin-outage-caused-by-confirmed-wastedlocker-ransomware-attack/ - webarchive
- https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/ - webarchive
- https://labs.sentinelone.com/wastedlocker-ransomware-abusing-ads-and-ntfs-file-attributes/ - webarchive
- https://www.securonix.com/web/wp-content/uploads/2020/08/Securonix_Threat_Research_WastedLocker_Ransomware.pdf - webarchive
- https://www.sentinelone.com/labs/sanctions-be-damned-from-dridex-to-macaw-the-evolution-of-evil-corp/ - webarchive
- https://www.bleepingcomputer.com/news/security/evil-corp-switches-to-hades-ransomware-to-evade-sanctions/ - webarchive
- https://www.bbc.com/news/world-us-canada-53195749 - webarchive
- https://unit42.paloaltonetworks.com/wastedlocker/ - webarchive
- https://www.sentinelone.com/wp-content/uploads/2022/02/S1_-SentinelLabs_SanctionsBeDamned_final_02.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us - webarchive
- https://areteir.com/wp-content/uploads/2020/07/Ransomware-WastedLocker-1.pdf - webarchive
- https://www.prodaft.com/m/uploads/SilverFish_TLPWHITE.pdf - webarchive
- https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html - webarchive
- https://ioc.hatenablog.com/entry/2020/08/16/132853 - webarchive
- https://www.bleepingcomputer.com/news/security/new-evil-corp-ransomware-mimics-payloadbin-gang-to-evade-us-sanctions/ - webarchive
- https://www.crowdstrike.com/blog/hades-ransomware-successor-to-indrik-spiders-wastedlocker/ - webarchive
- https://symantec.broadcom.com/hubfs/SED-Threats-Financial-Sector.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/insurance-giant-cna-hit-by-new-phoenix-cryptolocker-ransomware/ - webarchive
- https://blog.malwarebytes.com/threat-spotlight/2020/07/threat-spotlight-wastedlocker-customized-ransomware/ - webarchive
- https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf - webarchive
- https://blog.bushidotoken.net/2022/07/space-invaders-cyber-threats-that-are.html - webarchive
- https://blog.talosintelligence.com/2020/07/wastedlocker-emerges.html - webarchive
- https://seguranca-informatica.pt/wastedlocker-malware-analysis/#.YfAaIRUITTY.twitter - webarchive
- https://killingthebear.jorgetesta.tech/actors/evil-corp - webarchive
- https://assets.sentinelone.com/sentinellabs/sentinellabs_EvilCorp - webarchive
- https://news.sophos.com/en-us/2020/08/04/wastedlocker-techniques-point-to-a-familiar-heritage/ - webarchive
- https://blog.talosintelligence.com/2021/03/ctir-trends-winter-2020-21.html - webarchive
- https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf - webarchive
- https://kc.mcafee.com/corporate/index?page=content&id=KB93302&locale=en_US - webarchive
- https://medium.com/walmartglobaltech/wastedloader-or-dridexloader-4f47c9b3ae77 - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://medium.com/cycraft/the-road-to-ransomware-resilience-c1ca37036efd - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://www.deepinstinct.com/2021/05/26/deep-dive-packing-software-cryptone/ - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-drake - webarchive
- https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries - webarchive
- https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/ - webarchive
- https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf - webarchive
- https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions - webarchive
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself - webarchive
- https://securelist.com/wastedlocker-technical-analysis/97944/ - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html - webarchive
- https://www.bitdefender.com/files/News/CaseStudies/study/397/Bitdefender-PR-Whitepaper-RIG-creat5362-en-EN.pdf - webarchive
- https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Waterbear
Waterbear, also known as DbgPrint in its earlier export function, has been active since 2009. The malware is presumably developed by the BlackTech APT group and adopts advanced anti-analysis and forward-thinking design. These designs include a sophisticated shellcode stager, the ability to load plugins on-the-fly, and overall evasiveness should the C2 server fail to respond with a valid session key.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Waterbear.
| Known Synonyms |
|---|
DbgPrint |
EYEWELL |
Internal MISP references
UUID 042ddeed-78e4-4799-965a-3b6815145f28 which can be used as unique global reference for Waterbear in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.waterbear - webarchive
- https://i.blackhat.com/asia-21/Friday-Handouts/as-21-Tseng-Mem2Img-Memory-Resident-Malware-Detection-via-Convolution-Neural-Network.pdf - webarchive
- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_2_ycy-aragorn_en.pdf - webarchive
- https://www.zdnet.com/article/waterbear-malware-used-in-attack-wave-against-government-agencies/ - webarchive
- https://teamt5.org/tw/posts/mjib-holds-briefing-on-chinese-hackers-attacks-on-taiwanese-government-agencies/ - webarchive
- https://daydaynews.cc/zh-tw/technology/297265.html - webarchive
- https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html - webarchive
- https://www.youtube.com/watch?v=6SDdUVejR2w - webarchive
- https://www.mandiant.com/resources/blog/chinese-espionage-tactics - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WaterMiner
Internal MISP references
UUID d536931e-ad4f-485a-b93d-fe05f23a9367 which can be used as unique global reference for WaterMiner in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WaterSpout
Internal MISP references
UUID d238262a-4832-408f-9926-a7174e671b50 which can be used as unique global reference for WaterSpout in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WebbyTea
WebbyTea is an HTTP(S) downloader that uses AES for C&C trafic encryption.
It sends detailed information about the victim's environment, like proxy settings, system instalation date, Windows product name and version, manufacturer, product name, system boot time, time zone, computer name, user name, current time and a list of currently running processes. Data sent to the C&C server consists of the prefix "ci", a 16-characters long hexadecimal string representing the victim ID and an encrypted data about the victim's system. After the payload is acquired from the server and successfully injected in a newly created explorer.exe process, the malware responds back with the same victim ID having the prefix changed to "cs".
The internal DLL name of the native WebbyTea is usually pe64.dll or webT64.dll (from which its name is derived).
The usual payload associated with WebbyTea is SnatchCrypto.
Internal MISP references
UUID e8056d43-7dd7-49ae-8cd7-07be367fb6b4 which can be used as unique global reference for WebbyTea in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.webbytea - webarchive
- https://blog.sekoia.io/bluenoroffs-rustbucket-campaign/ - webarchive
- https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/ - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Lazarus-campaigns-and-backdoors-in-2022-2023.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WebC2-AdSpace
Internal MISP references
UUID e57c677f-0117-4e23-8c3f-a772ed809f4c which can be used as unique global reference for WebC2-AdSpace in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WebC2-Ausov
Internal MISP references
UUID 64f5ae85-1324-43de-ba3a-063785567be0 which can be used as unique global reference for WebC2-Ausov in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WebC2-Bolid
Internal MISP references
UUID 71292a08-9a7b-4df1-b1fd-7d80a8fcc18f which can be used as unique global reference for WebC2-Bolid in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WebC2-Cson
Internal MISP references
UUID 5371bc44-dc07-4992-a3d7-c21705c50ac4 which can be used as unique global reference for WebC2-Cson in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WebC2-DIV
Internal MISP references
UUID acdda3e5-e776-419b-b060-14f3406de061 which can be used as unique global reference for WebC2-DIV in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WebC2-GreenCat
Internal MISP references
UUID cfed10ed-6601-469e-a1df-2d561b031244 which can be used as unique global reference for WebC2-GreenCat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WebC2-Head
Internal MISP references
UUID f9f37707-36cf-4ad0-88e0-86f47cbe0ed6 which can be used as unique global reference for WebC2-Head in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WebC2-Kt3
Internal MISP references
UUID 15094548-7555-43ee-8c0d-4557d6d8a087 which can be used as unique global reference for WebC2-Kt3 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WebC2-Qbp
Internal MISP references
UUID 71d8ef43-3767-494b-afaa-f58aad70df65 which can be used as unique global reference for WebC2-Qbp in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WebC2-Rave
Internal MISP references
UUID 5350bf3a-26b0-49fb-a0b8-dd68933ea78c which can be used as unique global reference for WebC2-Rave in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WebC2-Table
Internal MISP references
UUID 1035ea6f-6743-4e69-861c-454c19ec96ae which can be used as unique global reference for WebC2-Table in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WebC2-UGX
Internal MISP references
UUID b459033c-2d19-49aa-a21f-44a01d1a4156 which can be used as unique global reference for WebC2-UGX in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WebC2-Yahoo
Internal MISP references
UUID 52c1518d-175c-4b39-bc7c-353d2ddf382e which can be used as unique global reference for WebC2-Yahoo in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WebMonitor RAT
On its website, Webmonitor RAT is described as 'a very powerful, user-friendly, easy-to-setup and state-of-the-art monitoring tool. Webmonitor is a fully native RAT, meaning it will run on all Windows versions and languages starting from Windows XP and up, and perfectly compatible with all crypters and protectors.' Unit42 notes in their analysis that it is offered as C2-as-a-service and raises the controversial aspect that the builder allows to create client binaries that will not show any popup or dialogue during installation or while running on a target system.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular WebMonitor RAT.
| Known Synonyms |
|---|
RevCode |
Internal MISP references
UUID fa3d196b-b757-49b7-a06d-77c77ac151c4 which can be used as unique global reference for WebMonitor RAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.webmonitor - webarchive
- https://researchcenter.paloaltonetworks.com/2018/04/unit42-say-cheese-webmonitor-rat-comes-c2-service-c2aas/ - webarchive
- https://revcode.se/product/webmonitor/ - webarchive
- https://krabsonsecurity.com/2020/09/04/bitrat-pt-2-hidden-browser-socks5-proxy-and-unknownproducts-unmasked/ - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/malicious-actors-target-comm-apps-such-as-zoom-slack-discord - webarchive
- https://krebsonsecurity.com/2019/04/whos-behind-the-revcode-webmonitor-rat/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WeControl
Internal MISP references
UUID 541720a8-a125-4277-b109-c04e475c4cc3 which can be used as unique global reference for WeControl in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WellMess
WellMess is A Remote Access Trojan written in GoLang and .NET. It has hard-coded User-Agents. Attackers deploy WellMess using separate tools which also allow lateral movement, for example "gost". Command and Control traffic is handled via HTTP using the Set-Cookie field and message body.
Internal MISP references
UUID d84ebd91-58f6-459f-96a1-d028a1719914 which can be used as unique global reference for WellMess in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.wellmess - webarchive
- https://blog.talosintelligence.com/2020/08/attribution-puzzle.html - webarchive
- https://community.riskiq.com/article/541a465f/description - webarchive
- https://www.ironnet.com/blog/russian-cyber-attack-campaigns-and-actors - webarchive
- https://us-cert.cisa.gov/sites/default/files/publications/AA21-116A_Russian_Foreign_Intelligence_Service_Cyber_Operations_508C.pdf - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b - webarchive
- https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf - webarchive
- https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development.pdf - webarchive
- https://www.botconf.eu/wp-content/uploads/2018/12/2018-Y-Ishikawa-S-Nagano-Lets-go-with-a-Go-RAT-_final.pdf - webarchive
- https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html - webarchive
- https://blog.jpcert.or.jp/2018/07/malware-wellmes-9b78.html - webarchive
- https://censys.com/advanced-persistent-infrastructure-tracking/ - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa21-116a - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-old-dogs-new-tricks.pdf - webarchive
- https://www.lac.co.jp/lacwatch/pdf/20180614_cecreport_vol3.pdf - webarchive
- https://blogs.jpcert.or.jp/en/2018/07/malware-wellmes-9b78.html - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WeSteal
Internal MISP references
UUID 8ec2d984-8c10-49f2-ad97-64af275a7afc which can be used as unique global reference for WeSteal in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WhiskerSpy
Internal MISP references
UUID 821b2c61-31b0-41f5-b604-e58678bf287b which can be used as unique global reference for WhiskerSpy in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WhisperGate
Destructive malware deployed against targets in Ukraine in January 2022.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular WhisperGate.
| Known Synonyms |
|---|
PAYWIPE |
Internal MISP references
UUID 6001ed9f-9108-4481-9980-dc6e5c1908a0 which can be used as unique global reference for WhisperGate in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.whispergate - webarchive
- https://securelist.com/webinar-on-cyberattacks-in-ukraine-summary-and-qa/106075/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/growling-bears-make-thunderous-noise.html - webarchive
- https://blog.gigamon.com/2022/01/28/focusing-on-left-of-boom/ - webarchive
- https://zetter.substack.com/p/dozens-of-computers-in-ukraine-wiped - webarchive
- https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat - webarchive
- https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html - webarchive
- https://go.recordedfuture.com/hubfs/reports/pov-2022-0127.pdf - webarchive
- https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine - webarchive
- https://www.recordedfuture.com/whispergate-malware-corrupts-computers-ukraine/ - webarchive
- https://github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/Debugging%20MBR%20-%20IDA%20+%20Bochs%20Emulator/Debugging%20MBR%20-%20IDA%20+%20Bochs%20Emulator.md - webarchive
- https://www.crowdstrike.com/blog/technical-analysis-of-whispergate-malware/ - webarchive
- https://blogs.blackberry.com/en/2022/02/threat-spotlight-whispergate-wiper-wreaks-havoc-in-ukraine - webarchive
- https://www.splunk.com/en_us/blog/security/threat-advisory-strt-ta02-destructive-software.html?splunk - webarchive
- https://www.netskope.com/blog/netskope-threat-coverage-whispergate - webarchive
- https://services.google.com/fh/files/blogs/google_fog_of_war_research_report.pdf - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-057A_Destructive_Malware_Targeting_Organizations_in_Ukraine.pdf - webarchive
- https://blogs.microsoft.com/on-the-issues/2022/01/15/mstic-malware-cyberattacks-ukraine-government/ - webarchive
- https://www.secureworks.com/blog/disruptive-attacks-in-ukraine-likely-linked-to-escalating-tensions - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict/IOC%20Resource%20for%20Russia-Ukraine%20Conflict-Related%20Cyberattacks-03032022.pdf - webarchive
- https://www.secureworks.com/blog/whispergate-not-notpetya - webarchive
- https://github.com/OALabs/Lab-Notes/blob/main/WhisperGate/WhisperGate.ipynb - webarchive
- https://zetter.substack.com/p/hackers-were-in-ukraine-systems-months - webarchive
- https://stairwell.com/news/whispers-in-the-noise-microsoft-ukraine-whispergate/ - webarchive
- https://blog.nviso.eu/2022/02/24/threat-update-ukraine-russia-tensions/ - webarchive
- https://unit42.paloaltonetworks.com/ukraine-cyber-conflict-cve-2021-32648-whispergate/ - webarchive
- https://inquest.net/blog/2022/02/10/380-glowspark - webarchive
- https://twitter.com/HuskyHacksMK/status/1482876242047258628 - webarchive
- https://lifars.com/2022/03/a-closer-look-at-the-russian-actors-targeting-organizations-in-ukraine/ - webarchive
- https://www.splunk.com/en_us/blog/security/threat-advisory-strt-ta02-destructive-software.html - webarchive
- https://csirt-mon.wp.mil.pl/pl/articles6-aktualnosci/analysis-cyberattack-ukrainian-government-resources/ - webarchive
- https://twitter.com/knight0x07/status/1483401072102502400 - webarchive
- https://www.crowdstrike.com/blog/how-crowdstrike-protects-against-data-wiping-malware/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/update-on-whispergate-destructive-malware-targeting-ukraine.html - webarchive
- https://therecord.media/second-data-wiper-attack-hits-ukraine-computer-networks/ - webarchive
- https://info.cyborgsecurity.com/hubfs/Emerging%20Threats/WhisperGate%20Malware%20Update%20-%20Emerging%20Threat.pdf - webarchive
- https://blogs.blackberry.com/en/2022/01/threat-thursday-whispergate-wiper - webarchive
- https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/ - webarchive
- https://twitter.com/nunohaien/status/1484088885575622657 - webarchive
- https://www.brighttalk.com/webcast/15591/534324 - webarchive
- https://www.tesorion.nl/en/resources/pdfstore/Report-OSINT-Russia-Ukraine-Conflict-Cyberaspect.pdf - webarchive
- https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3 - webarchive
- https://cert.gov.ua/article/18101 - webarchive
- https://inquest.net/blog/2022/04/07/ukraine-cyberwar-overview - webarchive
- https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 - webarchive
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4Vwwd - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/ - webarchive
- https://www.crowdstrike.com/blog/who-is-ember-bear/ - webarchive
- https://lifars.com/2022/01/a-detailed-analysis-of-whispergate-targeting-ukrainian-organizations/ - webarchive
- https://eclypsium.com/2022/06/02/conti-targets-critical-firmware/ - webarchive
- https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/return-of-pseudo-ransomware.html - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord? - webarchive
- https://www.mandiant.com/resources/russia-invasion-ukraine-retaliation - webarchive
- https://www.trendmicro.com/en_us/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict.html - webarchive
- https://www.bitdefender.com/blog/hotforsecurity/five-things-you-need-to-know-about-the-cyberwar-in-ukraine/ - webarchive
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - webarchive
- https://www.elastic.co/fr/security-labs/operation-bleeding-bear - webarchive
- https://thehackernews.com/2022/02/putin-warns-russian-critical.html - webarchive
- https://rxored.github.io/post/analysis/whispergate/whispergate/ - webarchive
- https://www.youtube.com/watch?v=Ek3URIaC5O8 - webarchive
- https://maxkersten.nl/binary-analysis-course/malware-analysis/dumping-whispergates-wiper-from-an-eazfuscator-obfuscated-loader/ - webarchive
- https://cyberpeaceinstitute.org/ukraine-timeline-of-cyberattacks - webarchive
- https://www.microsoft.com/en-us/security/business/security-insider/wp-content/uploads/2023/03/A-year-of-Russian-hybrid-warfare-in-Ukraine_MS-Threat-Intelligence-1.pdf - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/ - webarchive
- https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord - webarchive
- https://twitter.com/Libranalysis/status/1483128221956808704 - webarchive
- https://www.cadosecurity.com/resources-for-dfir-professionals-responding-to-whispergate-malware/ - webarchive
- https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/ - webarchive
- https://www.youtube.com/watch?v=mrTdSdMMgnk - webarchive
- https://intel471.com/blog/russia-ukraine-conflict-cybercrime-underground - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-057a - webarchive
- https://www.crowdstrike.com/blog/lessons-from-past-cyber-operations-against-ukraine/ - webarchive
- https://www.microsoft.com/security/blog/2022/01/26/evolved-phishing-device-registration-trick-adds-to-phishers-toolbox-for-victims-without-mfa/ - webarchive
- https://www.youtube.com/watch?v=2nd-f1dIfD4 - webarchive
- https://unit42.paloaltonetworks.com/atoms/ruinousursa/ - webarchive
- https://elastic.github.io/security-research/malware/2022/01/01.operation-bleeding-bear/article/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WhiteBird
According to Dr.Web, WhiteBird is a backdoor written in C++ and designed to operate in both 32-bit and 64-bit Microsoft Windows operating systems. The configuration is encrypted with a single byte XOR key. An interesting feature is that the malware can be restricted to operate only within certain "working_hours" with a granularity of one minute.
Internal MISP references
UUID 20286294-3813-4c17-a165-ef12aae64303 which can be used as unique global reference for WhiteBird in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.whitebird - webarchive
- https://st.drweb.com/static/new-www/news/2020/september/tek_rf_article_en.pdf - webarchive
- https://st.drweb.com/static/new-www/news/2020/july/Study_of_the_APT_attacks_on_state_institutions_in_Kazakhstan_and_Kyrgyzstan_en.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WhiteBlackCrypt
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular WhiteBlackCrypt.
| Known Synonyms |
|---|
WARYLOOK |
Internal MISP references
UUID f587a5a2-907e-456c-91e9-74fd997c03b5 which can be used as unique global reference for WhiteBlackCrypt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WhiteSnake Stealer
Internal MISP references
UUID 8f5bb3ec-a764-4ef4-a113-532a3d4b82c4 which can be used as unique global reference for WhiteSnake Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WikiLoader
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular WikiLoader.
| Known Synonyms |
|---|
WailingCrab |
Internal MISP references
UUID 8dd43a3f-320a-4bdd-8379-b592cd6efc1f which can be used as unique global reference for WikiLoader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.wikiloader - webarchive
- https://securityintelligence.com/x-force/wailingcrab-malware-misues-mqtt-messaging-protocol/ - webarchive
- https://twitter.com/JAMESWT_MHT/status/1712783250446328114?t=iLKXzsZuS1TTa0i9sZFkQA&s=19 - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/out-sandbox-wikiloader-digs-sophisticated-evasion - webarchive
- https://twitter.com/threatinsight/status/1679864625544978432 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WildFire
Internal MISP references
UUID 2f512a73-6847-4231-81c6-8b51af8b5be2 which can be used as unique global reference for WildFire in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WinDealer
Information stealer used by threat actor LuoYu.
Internal MISP references
UUID 3aa42316-9f3b-457b-9560-99ccf00a45c1 which can be used as unique global reference for WinDealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.windealer - webarchive
- https://cocomelonc.github.io/book/2023/12/13/malwild-book.html - webarchive
- https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_7_leon-niwa-ishimaru_en.pdf - webarchive
- https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_301_shui-leon_en.pdf - webarchive
- https://securelist.com/windealer-dealing-on-the-side/105946/ - webarchive
- https://securelist.com/windealer-dealing-on-the-side/105946 - webarchive
- https://blogs.blackberry.com/en/2022/06/threat-thursday-china-based-apt-plays-auto-updater-card-to-deliver-windealer-malware - webarchive
- https://mssplab.github.io/threat-hunting/2023/05/08/malware-analysis-windealer.html - webarchive
- https://blogs.jpcert.or.jp/en/2021/10/windealer.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WinInetLoader
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular WinInetLoader.
| Known Synonyms |
|---|
LIDSHOT |
Internal MISP references
UUID 5801591a-d6f1-45b1-8abd-718257dd2433 which can be used as unique global reference for WinInetLoader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
winlog
Internal MISP references
UUID 772099d0-b74a-4a73-9967-f1d40ab3ac92 which can be used as unique global reference for winlog in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WinMM
Internal MISP references
UUID 6a100902-7204-4f20-b838-545ed86d4428 which can be used as unique global reference for WinMM in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.winmm - webarchive
- https://securelist.com/analysis/publications/69953/the-naikon-apt/ - webarchive
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/TheNaikonAPT-MsnMM1.pdf - webarchive
- https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Winnti (Windows)
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Winnti (Windows).
| Known Synonyms |
|---|
BleDoor |
JUMPALL |
Pasteboy |
RbDoor |
Internal MISP references
UUID 7f8166e2-c7f4-4b48-a07b-681b61a8f2c1 which can be used as unique global reference for Winnti (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti - webarchive
- https://attack.mitre.org/groups/G0096 - webarchive
- https://github.com/TKCERT/winnti-nmap-script - webarchive
- https://www.tagesschau.de/investigativ/ndr/hackerangriff-chemieunternehmen-101.html - webarchive
- https://www.welivesecurity.com/2020/01/31/winnti-group-targeting-universities-hong-kong/ - webarchive
- https://content.fireeye.com/api/pdfproxy?id=86840 - webarchive
- https://www.lastline.com/labsblog/helo-winnti-attack-scan/ - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-atlas - webarchive
- https://securelist.com/games-are-over/70991/ - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://blogs.vmware.com/security/2021/11/monitoring-winnti-4-0-c2-servers-for-two-years.html - webarchive
- https://www.ironnet.com/blog/china-cyber-attacks-the-current-threat-landscape - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/pigs-malware-examining-possible-member-winnti-group/ - webarchive
- https://github.com/br-data/2019-winnti-analyse/ - webarchive
- https://www.wired.com/story/chinese-hackers-taiwan-semiconductor-industry-skeleton-key/ - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/winnti-abuses-github/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0921.pdf - webarchive
- https://content.fireeye.com/apt-41/rpt-apt41/ - webarchive
- https://blog.bushidotoken.net/2022/05/gamer-cheater-hacker-spy.html - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2022/slides/VB2022-Tracking-the-entire-iceberg.pdf - webarchive
- https://www.carbonblack.com/2020/02/20/threat-analysis-active-c2-discovery-using-protocol-emulation-part2-winnti-4-0/ - webarchive
- https://github.com/TKCERT/winnti-detector - webarchive
- https://www.trendmicro.com/en_us/research/19/d/analyzing-c-c-runtime-library-code-tampering-in-software-supply-chain-attacks.html - webarchive
- https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/ - webarchive
- https://www.carbonblack.com/2019/09/04/cb-tau-threat-intelligence-notification-winnti-malware-4-0/ - webarchive
- https://www.fireeye.com/blog/threat-research/2021/01/emulation-of-kernel-mode-rootkits-with-speakeasy.html - webarchive
- https://github.com/TKCERT/winnti-suricata-lua - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/apt41-indictments-china-espionage - webarchive
- https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference/vb2022/papers/VB2022-Tracking-the-entire-iceberg-long-term-APT-malware-C2-protocol-emulation-and-scanning.pdf - webarchive
- https://securitynews.sonicwall.com/xmlpost/chinas-winnti-spyder-module/ - webarchive
- https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf - webarchive
- https://www.malwarebytes.com/blog/threat-intelligence/2022/winnti-apt-group-docks-in-sri-lanka-for-new-campaign-final.pdf - webarchive
- https://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf - webarchive
- https://hello.global.ntt/-/media/ntt/global/insights/white-papers/the-operations-of-winnti-group.pdf - webarchive
- https://www.youtube.com/watch?v=_fstHQSK-kk - webarchive
- https://www.macnica.net/file/mpressioncss_2018-1h-report_mnc_rev3_nopw.pdf - webarchive
- https://i.blackhat.com/USA-20/Thursday/us-20-Chen-Operation-Chimera-APT-Operation-Targets-Semiconductor-Vendors.pdf - webarchive
- http://2015.ruxcon.org.au/assets/2015/slides/Ruxcon%202015%20-%20McCormack.pdf - webarchive
- https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf - webarchive
- http://web.br.de/interaktiv/winnti/english/ - webarchive
- https://www.cybereason.com/blog/operation-cuckoobees-a-winnti-malware-arsenal-deep-dive - webarchive
- https://docplayer.net/162112338-Don-t-miss-the-forest-for-the-trees-gleaning-hunting-value-from-too-much-intrusion-data.html - webarchive
- https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/operation-harvest-a-deep-dive-into-a-long-term-campaign/ - webarchive
- https://github.com/superkhung/winnti-sniff - webarchive
- https://securelist.com/apt-trends-report-q3-2020/99204/ - webarchive
- https://www.recordedfuture.com/chinese-apt-groups-target-afghan-telecommunications-firm/ - webarchive
- https://www.recordedfuture.com/chinese-group-tag-22-targets-nepal-philippines-taiwan/ - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20134508/winnti-more-than-just-a-game-130410.pdf - webarchive
- https://quointelligence.eu/2020/04/winnti-group-insights-from-the-past/ - webarchive
- https://www.ptsecurity.com/upload/corporate/ru-ru/webinars/ics/winnti-shadowpad.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WinorDLL64
According to ESET Research, this is a payload downloaded by win.wslink. They attribute it with low confidence to Lazarus.
Internal MISP references
UUID 64f7f940-db4c-4569-869b-d282dadf55ac which can be used as unique global reference for WinorDLL64 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WinPot
WinPot is created to make ATMs by a popular ATM vendor to automatically dispense all cash from their most valuable cassettes.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular WinPot.
| Known Synonyms |
|---|
ATMPot |
Internal MISP references
UUID 893a1da2-ae35-4877-8cde-3f532543af36 which can be used as unique global reference for WinPot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.winpot - webarchive
- https://securelist.com/atm-robber-winpot/89611/ - webarchive
- https://securelist.com/atm-pos-malware-landscape-2017-2019/96750/ - webarchive
- https://www.association-secure-transactions.eu/east-publishes-fraud-update-2-2018/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WinScreeny
Backdoor used in the EvilPlayout campaign against Iran's State Broadcaster.
Internal MISP references
UUID b45a1776-11a8-4ac9-9714-33cb17709166 which can be used as unique global reference for WinScreeny in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Winsloader
Internal MISP references
UUID db755407-4135-414c-90e3-97f5e48c6065 which can be used as unique global reference for Winsloader in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Wipbot
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Wipbot.
| Known Synonyms |
|---|
Epic |
Tavdig |
Internal MISP references
UUID 6b6cf608-cc2c-40d7-8500-afca3e35e7e4 which can be used as unique global reference for Wipbot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.wipbot - webarchive
- https://securelist.com/analysis/publications/65545/the-epic-turla-operation/ - webarchive
- https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf - webarchive
- https://docs.broadcom.com/doc/waterbug-attack-group - webarchive
- https://www-west.symantec.com/content/dam/symantec/docs/security-center/white-papers/waterbug-attack-group-16-en.pdf - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/10/20114955/Bartholomew-GuerreroSaade-VB2016.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WMI Ghost
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular WMI Ghost.
| Known Synonyms |
|---|
Syndicasec |
Wimmie |
Internal MISP references
UUID 892cb6c2-b96c-4f77-a9cf-4dd3d0c1cc40 which can be used as unique global reference for WMI Ghost in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WndTest
Internal MISP references
UUID d8bf4ea1-054c-4a88-aa09-48da0d89c322 which can be used as unique global reference for WndTest in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Wonknu
Internal MISP references
UUID bfa75eb1-1d8d-4127-932f-3b7090a242e9 which can be used as unique global reference for Wonknu in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
woody
Internal MISP references
UUID 42e23d17-8f1b-43c9-bc76-e3cf098b5c52 which can be used as unique global reference for woody in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Woody RAT
Internal MISP references
UUID 9828a0ad-bb48-4cb5-b4f4-9b4133fa044f which can be used as unique global reference for Woody RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Woolger
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Woolger.
| Known Synonyms |
|---|
WoolenLogger |
Internal MISP references
UUID 258751c7-1ddb-4df6-9a17-36b08c2cb267 which can be used as unique global reference for Woolger in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.woolger - webarchive
- https://documents.trendmicro.com/assets/wp/wp-operation-woolen-goldfish.pdf - webarchive
- https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf - webarchive
- http://www.trendmicro.it/media/wp/operation-woolen-goldfish-whitepaper-en.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WorldWind
Information Stealer.
Internal MISP references
UUID ebeca38e-0855-46e1-b46c-95405917231e which can be used as unique global reference for WorldWind in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.worldwind - webarchive
- https://www.zscaler.com/blogs/security-research/no-honor-among-thieves-prynt-stealers-backdoor-exposed - webarchive
- https://kienmanowar.wordpress.com/2023/04/08/quicknote-uncovering-suspected-malware-distributed-by-individuals-from-vietnam/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WORMHOLE
WORMHOLE is a TCP tunneler that is dynamically configurable from a C&C server and can communicate with an additional remote machine endpoint for a relay.
Internal MISP references
UUID c1bff74d-873d-41ad-9f76-b341e6fe5cb9 which can be used as unique global reference for WORMHOLE in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.wormhole - webarchive
- https://securelist.com/lazarus-under-the-hood/77908/ - webarchive
- https://content.fireeye.com/apt/rpt-apt38 - webarchive
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180244/Lazarus_Under_The_Hood_PDF_final.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WormLocker
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular WormLocker.
| Known Synonyms |
|---|
WormLckr |
Internal MISP references
UUID 4cc30b46-53c0-45c4-8847-e3b228bf8d7b which can be used as unique global reference for WormLocker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WpBruteBot
Internal MISP references
UUID 454e0737-98d6-499a-8562-1adf5c081d0d which can be used as unique global reference for WpBruteBot in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
WSCSPL
Internal MISP references
UUID 62fd2b30-55b6-474a-8d72-31e492357d11 which can be used as unique global reference for WSCSPL in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.wscspl - webarchive
- https://ti.qianxin.com/blog/articles/analysis-of-targeted-attack-against-pakistan-by-exploiting-inpage-vulnerability-and-related-apt-groups-english/ - webarchive
- https://ti.360.net/blog/articles/analysis-of-targeted-attack-against-pakistan-by-exploiting-inpage-vulnerability-and-related-apt-groups-english/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Wslink
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Wslink.
| Known Synonyms |
|---|
FinickyFrogfish |
Internal MISP references
UUID 63fc32b0-3017-418c-b00a-ae20205e9c90 which can be used as unique global reference for Wslink in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.wslink - webarchive
- https://www.welivesecurity.com/2021/10/27/wslink-unique-undocumented-malicious-loader-runs-server/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2022/03/eset_wsliknkvm.pdf - webarchive
- https://twitter.com/darienhuss/status/1453342652682981378 - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
x4
Internal MISP references
UUID 107341e7-e045-4798-9fab-16691e86bc58 which can be used as unique global reference for x4 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
X-Agent (Windows)
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular X-Agent (Windows).
| Known Synonyms |
|---|
chopstick |
splm |
Internal MISP references
UUID e8b38fbd-a7ce-4073-a660-44dfabc1b678 which can be used as unique global reference for X-Agent (Windows) in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.xagent - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf - webarchive
- https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf - webarchive
- http://csecybsec.com/download/zlab/20180713_CSE_APT28_X-Agent_Op-Roman%20Holiday-Report_v6_1.pdf - webarchive
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-quantum-entanglement.pdf - webarchive
- https://assets.documentcloud.org/documents/3461560/Google-Aquarium-Clean.pdf - webarchive
- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ - webarchive
- https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/ - webarchive
- https://www.thecssc.com/wp-content/uploads/2018/10/4OctoberIOC-APT28-malware-advisory.pdf - webarchive
- https://contagiodump.blogspot.de/2017/02/russian-apt-apt28-collection-of-samples.html - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-twilight - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- http://www2.fireeye.com/rs/fireye/images/rpt-apt28.pdf - webarchive
- https://symantec-blogs.broadcom.com/blogs/election-security/apt28-espionage-military-government - webarchive
- https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XBot POS
Internal MISP references
UUID c6467cc3-dafd-482e-881e-ef2e7e244436 which can be used as unique global reference for XBot POS in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XBTL
Internal MISP references
UUID fb3a8164-d8cb-495d-9b1c-57bed00c21ed which can be used as unique global reference for XBTL in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
xCaon
Checkpoint Research found this backdoor, attributed to IndigoZebra, used to target Afghan and other Central-Asia countries, including Kyrgyzstan and Uzbekistan, since at least 2014.
Internal MISP references
UUID 2c150ebc-8fdf-4324-96cd-d6b0c0087d55 which can be used as unique global reference for xCaon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XData
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular XData.
| Known Synonyms |
|---|
AESNI |
Internal MISP references
UUID 2fa666de-cab2-4c25-aa65-e5d162a979c9 which can be used as unique global reference for XData in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XDSpy
According to ESET Research, XDDown is a primary malware component and is strictly a downloader. It persists on the system using the traditional Run key. It downloads additional plugins from the hardcoded C&C server using the HTTP protocol. The HTTP replies contain PE binaries encrypted with a hardcoded two-byte XOR key. Plugins include a module for reconnaissance on the affected system, crawling drives, file exfiltration, SSID gathering, and grabbing saved passwords.
Internal MISP references
UUID 2cf836f5-b88a-417d-b3c6-ab2580fea6ad which can be used as unique global reference for XDSpy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.xdspy - webarchive
- https://www.welivesecurity.com/2020/10/02/xdspy-stealing-government-secrets-since-2011/ - webarchive
- https://www.welivesecurity.com/wp-content/uploads/2021/04/ESET_Industry_Report_Government.pdf - webarchive
- https://github.com/eset/malware-ioc/tree/master/xdspy/ - webarchive
- https://vblocalhost.com/uploads/VB2020-Faou-Labelle.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XenArmor
XenArmor is a suite of password recovery tools for various applications that have been observed to be abused in attacks alongside malware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular XenArmor.
| Known Synonyms |
|---|
XenArmor Suite |
Internal MISP references
UUID 79fd77ba-4b40-4354-820a-16662edba41d which can be used as unique global reference for XenArmor in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Xenon Stealer
Internal MISP references
UUID 09fd85b1-6fc9-45af-a37e-732b5fc6447b which can be used as unique global reference for Xenon Stealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
X-Files Stealer
Internal MISP references
UUID 4e980ff8-20f2-4b3f-bad8-763321932b99 which can be used as unique global reference for X-Files Stealer in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.xfilesstealer - webarchive
- https://cyberint.com/blog/research/xfiles-stealer-campaign-abusing-follina/ - webarchive
- https://twitter.com/3xp0rtblog/status/1473323635469438978 - webarchive
- https://www.zscaler.com/blogs/security-research/x-files-stealer-evolution-analysis-and-comparison-study - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XFSADM
Internal MISP references
UUID e78a2a31-8c20-4493-b854-c708e81b3f41 which can be used as unique global reference for XFSADM in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XFSCashNCR
Internal MISP references
UUID ba99edf0-1603-4f54-8fa9-18852417d0fc which can be used as unique global reference for XFSCashNCR in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Xiangoop
Internal MISP references
UUID b61903a1-51e6-493c-885f-6ffda99371ea which can be used as unique global reference for Xiangoop in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XiaoBa
Ransomware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular XiaoBa.
| Known Synonyms |
|---|
FlyStudio |
Internal MISP references
UUID e839ae61-616c-4234-8edb-36b48040e5af which can be used as unique global reference for XiaoBa in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
xmrig
According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".
In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.
Internal MISP references
UUID 88efd461-03dd-42eb-976c-5e9fe403fce6 which can be used as unique global reference for xmrig in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Xorist
According to PCrisk, Xorist is a family of ransomware-type malware. After stealth system infiltration, ransomware from this family encrypts various files stored on the computer. After encrypting the files, this ransomware creates a 'How to Decrypt Files.txt text file on the victim's desktop. The file contains a message stating that the files can only be restored by paying a ransom.
Internal MISP references
UUID 029369aa-9e88-4e98-8fda-ca29a873acc5 which can be used as unique global reference for Xorist in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XP10
Ransomware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular XP10.
| Known Synonyms |
|---|
FakeChrome Ransomware |
Internal MISP references
UUID 6aa7047f-7dfa-4a10-b515-853c3795db69 which can be used as unique global reference for XP10 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
xPack
Symantec describes this as a decryptor/loader used by Chinese threat actor Antlion in campaigns targeting Taiwan.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular xPack.
| Known Synonyms |
|---|
NERAPACK |
Internal MISP references
UUID f87a348e-fa1f-4c90-8b46-ef382868d043 which can be used as unique global reference for xPack in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.xpack - webarchive
- https://www.trendmicro.com/en_us/research/21/l/collecting-in-the-dark-tropic-trooper-targets-transportation-and-government-organizations.html - webarchive
- https://thehackernews.com/2022/02/chinese-hackers-target-taiwanese.html - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/china-apt-antlion-taiwan-financial-attacks - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Xpan
Internal MISP references
UUID 4da036c4-b76d-4f25-bc9e-3c5944ad0993 which can be used as unique global reference for Xpan in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XPCTRA
Incorporates code of Quasar RAT.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular XPCTRA.
| Known Synonyms |
|---|
Expectra |
Internal MISP references
UUID 5f9ba149-100a-46eb-a959-0645d872975b which can be used as unique global reference for XPCTRA in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.xpctra - webarchive
- https://blogs.jpcert.or.jp/en/2020/12/quasar-family.html - webarchive
- https://www.buguroo.com/en/blog/bank-malware-in-brazil-xpctra-rat-analysis - webarchive
- https://isc.sans.edu/forums/diary/XPCTRA+Malware+Steals+Banking+and+Digital+Wallet+Users+Credentials/22868/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XpertRAT
According to PCrisk, XpertRAT is a Remote Administration Trojan, a malicious program that allows cyber criminals to remotely access and control infected computers. Typically, users download and install this software inadvertently because they are tricked. By having computers infected with malware such as XpertRAT, users can experience serious problems.
Internal MISP references
UUID d03cb3af-2a01-4e46-859a-6b61f3ec3c68 which can be used as unique global reference for XpertRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.xpertrat - webarchive
- https://labs.k7computing.com/?p=15672 - webarchive
- https://blog.talosintelligence.com/2021/04/a-year-of-fajan-evolution-and-bloomberg.html - webarchive
- https://www.veronicavaleros.com/blog/2018/3/12/a-study-of-rats-third-timeline-iteration - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XP PrivEsc (CVE-2014-4076)
Internal MISP references
UUID 33f97c52-0bcd-43f4-88bb-99e7da9f49ae which can be used as unique global reference for XP PrivEsc (CVE-2014-4076) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XServer
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular XServer.
| Known Synonyms |
|---|
Filesnfer |
Internal MISP references
UUID b895ec07-19f7-4131-87c0-fc713fff2351 which can be used as unique global reference for XServer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
xsPlus
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular xsPlus.
| Known Synonyms |
|---|
nokian |
Internal MISP references
UUID b255fd2c-6ddb-452f-b660-c9f5d3a2ff63 which can be used as unique global reference for xsPlus in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.xsplus - webarchive
- https://securelist.com/analysis/publications/69953/the-naikon-apt/ - webarchive
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/TheNaikonAPT-MsnMM1.pdf - webarchive
- https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XTunnel
X-Tunnel is a network proxy tool that implements a custom network protocol encapsulated in the TLS protocol.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular XTunnel.
| Known Synonyms |
|---|
Shunnael |
X-Tunnel |
xaps |
Internal MISP references
UUID 53089817-6d65-4802-a7d2-5ccc3d919b74 which can be used as unique global reference for XTunnel in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.xtunnel - webarchive
- https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/ - webarchive
- http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf - webarchive
- https://www.root9b.com/sites/default/files/whitepapers/root9b_follow_up_report_apt28.pdf - webarchive
- https://www.symantec.com/blogs/election-security/apt28-espionage-military-government - webarchive
- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ - webarchive
- https://securelist.com/big-threats-using-code-similarity-part-1/97239/ - webarchive
- https://contagiodump.blogspot.de/2017/02/russian-apt-apt28-collection-of-samples.html - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-twilight - webarchive
- http://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf - webarchive
- https://securelist.com/apt-trends-report-q2-2020/97937/ - webarchive
- https://symantec-blogs.broadcom.com/blogs/election-security/apt28-espionage-military-government - webarchive
- https://www.root9b.com/sites/default/files/whitepapers/R9b_FSOFACY_0.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
X-Tunnel (.NET)
This is a rewrite of win.xtunnel using the .NET framework that surfaced late 2017.
Internal MISP references
UUID 000e25a4-4623-4afc-883d-ecc15be8f9d0 which can be used as unique global reference for X-Tunnel (.NET) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Xwo
In March 2019, AT&T Alien Labs identified a new malware family that is actively scanning for exposed web services and default passwords. Based on our findings we are calling it “Xwo” - taken from its primary module name. It is likely related to the previously reported malware families Xbash and MongoLock.
Internal MISP references
UUID 8a57cd75-4572-47c2-b5ef-55df978258de which can be used as unique global reference for Xwo in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
XWorm
Malware with wide range of capabilities ranging from RAT to ransomware.
Internal MISP references
UUID a5a05a52-5267-4baf-b4a3-366409b46721 which can be used as unique global reference for XWorm in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm - webarchive
- https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ - webarchive
- https://www.securonix.com/blog/securonix-threat-labs-security-meme4chan-advisory/ - webarchive
- https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla - webarchive
- https://cert.pl/en/posts/2023/10/deworming-the-xworm/ - webarchive
- https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ - webarchive
- https://x.com/embee_research/status/1694635899903152619 - webarchive
- https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ - webarchive
- https://unit42.paloaltonetworks.com/nodestealer-2-targets-facebook-business/ - webarchive
- https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 - webarchive
- https://research.loginsoft.com/threat-research/from-innocence-to-malice-the-onenote-malware-campaign-uncovered/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
xxmm
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular xxmm.
| Known Synonyms |
|---|
ShadowWalker |
Internal MISP references
UUID 1d451231-8b27-4250-b3db-55c5c8ea99cb which can be used as unique global reference for xxmm in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.xxmm - webarchive
- https://www.macnica.net/file/mpressioncss_2018-1h-report_mnc_rev3_nopw.pdf - webarchive
- https://www.macnica.net/mpressioncss/feature_05.html/ - webarchive
- https://www.cybereason.com/blog/labs-shadowwali-new-variant-of-the-xxmm-family-of-backdoors - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography/ - webarchive
- https://jsac.jpcert.or.jp/archive/2019/pdf/JSAC2019_8_nakatsuru_en.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-butler - webarchive
- https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Yahoyah
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Yahoyah.
| Known Synonyms |
|---|
KeyBoy |
Internal MISP references
UUID a673b4fb-a864-4a5b-94ab-3fc4f5606cc8 which can be used as unique global reference for Yahoyah in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Yakuza
Ransomware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Yakuza.
| Known Synonyms |
|---|
Teslarvng Ransomware |
Internal MISP references
UUID 0308eff9-1e8c-434e-b551-40f0ceb7dc0e which can be used as unique global reference for Yakuza in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
YamaBot
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular YamaBot.
| Known Synonyms |
|---|
Kaos |
Internal MISP references
UUID 56243aaa-449e-4c0d-bb51-3f0b6294ec7d which can be used as unique global reference for YamaBot in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.yamabot - webarchive
- https://media.defense.gov/2023/Feb/09/2003159161/-1/-1/0/CSA_RANSOMWARE_ATTACKS_ON_CI_FUND_DPRK_ACTIVITIES.PDF - webarchive
- https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - webarchive
- https://blogs.jpcert.or.jp/en/2022/07/yamabot.html - webarchive
- https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html?m=1 - webarchive
- https://www.youtube.com/watch?v=nUjxH1gW53s - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Yanluowang
According to PCrisk, Yanluowang is ransomware that encrypts (and renames) files, ends all running processes, stops services, and creates the "README.txt" file containing a ransom note. It appends the ".yanluowang" extension to filenames. Cybercriminals behind Yanluowang are targeting enterprise entities and organizations in the financial sector.
Files encrypted by Yanluowang can be decrypted with this tool (it is possible to decrypt all files if the original file is larger than 3GB. If the original file is smaller than 3GB, then only smaller files can be decrypted).
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Yanluowang.
| Known Synonyms |
|---|
Dryxiphia |
Internal MISP references
UUID 4bc19ce2-e169-4f9f-aabf-ec7fc6a75d12 which can be used as unique global reference for Yanluowang in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.yanluowang - webarchive
- https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf - webarchive
- https://twitter.com/CryptoInsane/status/1586967110504398853 - webarchive
- https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html - webarchive
- https://de.darktrace.com/blog/inside-the-yanluowang-leak-organization-members-and-tactics - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-targeted-ransomware - webarchive
- https://github.com/albertzsigovits/malware-notes/tree/master/Ransomware-Windows-Yanluowang - webarchive
- https://securelist.com/how-to-recover-files-encrypted-by-yanlouwang/106332/ - webarchive
- https://www.bleepingcomputer.com/news/security/free-decryptor-released-for-yanluowang-ransomware-victims/ - webarchive
- https://therecord.media/the-yanluowang-ransomware-group-in-their-own-words/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
YaRAT
According to PTSecurity, this RAT uses Yandex Disk as a C2.
Internal MISP references
UUID 62fd30bc-1af6-40cc-a363-bb6aa85433cb which can be used as unique global reference for YaRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Yarraq
Yarraq is a ransomware that encrypts files by using asymmetric keys and adding '.yarraq' as extension to the end of filenames. At the time of writing the attacker asks for $2000 ransom in order to provide a decryptor, to enable victims to restore their original files back. To communicate with the attacker the email: cyborgyarraq@protonmail.ch is provided.
Internal MISP references
UUID 3bba089d-cd27-465c-8c40-2ff9ff0316c6 which can be used as unique global reference for Yarraq in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Yasso
According to Palo Alto Networks, Yasso is an open source multi-platform intranet-assisted penetration toolset that brings together a number of features such as scanning, brute forcing, remote interactive shell, and running arbitrary commands. It is authored by a Mandarin-speaking pentester nicknamed Sairson.
Internal MISP references
UUID d58a18e8-e866-42df-a315-a1f72d2c26aa which can be used as unique global reference for Yasso in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Yatron
Internal MISP references
UUID 710a27e6-0f17-4fa7-bcb9-e130fcb1ee7f which can be used as unique global reference for Yatron in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
yayih
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular yayih.
| Known Synonyms |
|---|
aumlib |
bbsinfo |
Internal MISP references
UUID 81157066-c2f6-4625-8070-c0a793d57e18 which can be used as unique global reference for yayih in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Yellow Cockatoo RAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Yellow Cockatoo RAT.
| Known Synonyms |
|---|
Polazer |
Internal MISP references
UUID f1d49672-b857-4ad6-887f-f2bf2bc7c641 which can be used as unique global reference for Yellow Cockatoo RAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Yoddos
Internal MISP references
UUID 8d67586f-3390-474b-a81e-8be90833f25f which can be used as unique global reference for Yoddos in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
YoreKey
Internal MISP references
UUID cf9b5867-77db-423d-9bdf-cfc0d24d39c9 which can be used as unique global reference for YoreKey in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.yorekey - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/triple-threat-north-korea-aligned-ta406-scams-spies-and-steals - webarchive
- https://www.proofpoint.com/sites/default/files/threat-reports/pfpt-us-tr-threat-insight-paper-triple-threat-N-Korea-aligned-TA406-steals-scams-spies.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
YoungLotus
Simple malware with proxy/RDP and download capabilities. It often comes bundled with installers, in particular in the Chinese realm.
PE timestamps suggest that it came into existence in the second half of 2014.
Some versions perform checks of the status of the internet connection (InternetGetConnectedState: MODEM, LAN, PROXY), some versions perform simple AV process-checks (CreateToolhelp32Snapshot).
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular YoungLotus.
| Known Synonyms |
|---|
DarkShare |
Internal MISP references
UUID 1cc9d450-88cd-435c-bb74-8410d2d22571 which can be used as unique global reference for YoungLotus in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
YourCyanide
According to Trend Micro, this is a ransomware written as a Windows commandline script, with obfuscation applied.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular YourCyanide.
| Known Synonyms |
|---|
GonnaCope |
Kekpop |
Kekware |
Internal MISP references
UUID 4a9b8725-2d17-4601-adb4-67de607808d7 which can be used as unique global reference for YourCyanide in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
YTStealer
According to Intezer, YTStealer is a malware whose objective is to steal YouTube authentication cookies. As a stealer, it operates like many other stealers. The first thing it does when it’s executed is to perform some environment checks. This is to detect if the malware is being analyzed in a sandbox.
Internal MISP references
UUID 302854bd-0e03-422c-8b79-54200c7d02ea which can be used as unique global reference for YTStealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
yty
Internal MISP references
UUID c0e8b64c-bd2c-4a3e-addc-0ed6cc1ba200 which can be used as unique global reference for yty in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.yty - webarchive
- http://blog.ptsecurity.com/2019/11/studying-donot-team.html - webarchive
- https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/ - webarchive
- https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/ - webarchive
- https://www.secureworks.com/research/threat-profiles/zinc-emerson - webarchive
- https://www.amnesty.org/en/wp-content/uploads/2021/10/AFR5747562021ENGLISH.pdf - webarchive
- https://threatrecon.nshc.net/2019/08/02/sectore02-updates-yty-framework-in-new-targeted-campaign-against-pakistan-government/ - webarchive
- https://ti.360.net/blog/articles/latest-activity-of-apt-c-35/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Yunsip
W32/Yunsip!tr.pws is classified as a password stealing trojan. Password Stealing Trojan searches the infected system for passwords and send them to the hacker.
Internal MISP references
UUID 1f8755ac-3dcc-43bd-a07f-cf0fbf2cdb7d which can be used as unique global reference for Yunsip in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Z3
Ransomware.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Z3.
| Known Synonyms |
|---|
Z3enc Ransomware |
Internal MISP references
UUID 3eb96cd0-2d00-45a8-a0a4-54663cc70ab9 which can be used as unique global reference for Z3 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zacinlo
Bitdefender describes the primary features of the family as follows: Presence of a rootkit driver that protects itself as well as its other components, presence of man-in-the-browser capabilities that intercepts and decrypts SSL communications, and presence of an adware cleanup routine used to remove potential competition in the adware space. It also communicates with its C&C server, sending environment information such as installed AV and other applications. The malware also takes screenshots and does browser redirects, potentially manipulating the DOM tree. It also creates traffic in hidden windows, likely causing adfraud. The malware is generally very configurable and internally makes use of Lua scripts.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Zacinlo.
| Known Synonyms |
|---|
s5mark |
Internal MISP references
UUID 5041fed8-25a2-4da2-b2ab-db2364cc064f which can be used as unique global reference for Zacinlo in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zebrocy
According to brandefense, Zebrocy is malware that falls into the Trojan category, which the threat actor group APT28/Sofacy has used since 2015. Zebrocy malware consists of 3 main components; Backdoor, Downloader, and Dropper. The Downloader and Dropper take responsibility for discovery processes and downloading the main malware on the systems. At the same time, Backdoor undertakes the duties such as persistence in the system, espionage, and data extraction.
This malware, which is not considered new, has variants in many languages from the past to the present. These include programming languages such as Delphi, C#, Visual C++, VB.net, and Golang. Furthermore, we know advanced threat actors and groups revise their malicious software among their toolkits at certain time intervals using different languages and technologies.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Zebrocy.
| Known Synonyms |
|---|
Zekapab |
Internal MISP references
UUID 973124e2-0d84-4be5-9c8e-3ff16bb43b42 which can be used as unique global reference for Zebrocy in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.zebrocy - webarchive
- https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/russian-hackers-use-fake-nato-training-docs-to-breach-govt-networks/ - webarchive
- https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf - webarchive
- https://mp.weixin.qq.com/s/6R7bFs9lH1I3BNdkatCC9g - webarchive
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b - webarchive
- https://www.welivesecurity.com/2019/09/24/no-summer-vacations-zebrocy/ - webarchive
- https://unit42.paloaltonetworks.com/sofacy-creates-new-go-variant-of-zebrocy-tool/ - webarchive
- https://quointelligence.eu/2020/09/apt28-zebrocy-malware-campaign-nato-theme/ - webarchive
- https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html - webarchive
- https://symantec-blogs.broadcom.com/blogs/election-security/apt28-espionage-military-government - webarchive
- https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/ - webarchive
- https://meltx0r.github.io/tech/2019/10/24/apt28.html - webarchive
- https://www.accenture.com/us-en/blogs/blogs-snakemackerel-delivers-zekapab-malware - webarchive
- https://www.vkremez.com/2018/12/lets-learn-dissecting-apt28sofacy.html - webarchive
- https://securelist.com/zebrocys-multilanguage-malware-salad/90680/ - webarchive
- https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries - webarchive
- https://research.checkpoint.com/malware-against-the-c-monoculture/ - webarchive
- https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/ - webarchive
- https://www.macnica.net/file/mpressioncss_ta_report_2019.pdf - webarchive
- https://securelist.com/greyenergys-overlap-with-zebrocy/89506/ - webarchive
- https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/ - webarchive
- https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/ - webarchive
- https://brandefense.io/zebrocy-malware-technical-analysis-report/ - webarchive
- https://mp.weixin.qq.com/s/pE_6VRDk-2aTI996sff0og - webarchive
- https://securelist.com/a-zebrocy-go-downloader/89419/ - webarchive
- https://securelist.com/apt-trends-report-q2-2019/91897/ - webarchive
- https://www.secureworks.com/research/threat-profiles/iron-twilight - webarchive
- https://unit42.paloaltonetworks.com/sandbox-evasion-memory-detection/ - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-old-dogs-new-tricks.pdf - webarchive
- https://www.intezer.com/blog/research/russian-apt-uses-covid-19-lures-to-deliver-zebrocy/ - webarchive
- https://unit42.paloaltonetworks.com/atoms/fighting-ursa/ - webarchive
- https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf - webarchive
- https://www.vkremez.com/2018/12/lets-learn-reviewing-sofacys-zebrocy-c.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zebrocy (AutoIT)
Internal MISP references
UUID 4a5f2088-18cb-426a-92e2-1eb752c294c0 which can be used as unique global reference for Zebrocy (AutoIT) in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zedhou
Internal MISP references
UUID 2211eade-4980-4143-acd7-5ecda26d9dfa which can be used as unique global reference for Zedhou in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
zenar
Internal MISP references
UUID 7502f293-0b7f-417f-a13a-1c71dadc5ccc which can be used as unique global reference for zenar in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zeoticus
Internal MISP references
UUID 92e89ff1-eae9-4d71-9031-80cca544952e which can be used as unique global reference for Zeoticus in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zeppelin
Zeppelin is a ransomware written in Delphi and sold a as-a-service. The Cylance research team notes that it is a clear evolution of the known VegaLocker, but they assessed it as a new family becaue of additionally developed modules that makes Zeppelin much more configurable than Vegalocker. There are executable variants of type DLL and EXE.
Internal MISP references
UUID 5587d163-d5ec-43fc-8071-7e7cd1002ba7 which can be used as unique global reference for Zeppelin in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.zeppelin - webarchive
- https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/wp-spark-state-of-ransomware.pdf - webarchive
- https://medium.com/walmartglobaltech/man1-moskal-hancitor-and-a-side-of-ransomware-d77b4d991618 - webarchive
- https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf - webarchive
- https://community.riskiq.com/article/47766fbd - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-223A_Zeppelin_CSA.pdf - webarchive
- https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf - webarchive
- https://threatvector.cylance.com/en_us/home/zeppelin-russian-ransomware-targets-high-profile-users-in-the-us-and-europe.html - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-223a - webarchive
- https://blog.sekoia.io/vice-society-a-discreet-but-steady-double-extortion-ransomware-group/ - webarchive
- https://www.intrinsec.com/vice-society-spreads-its-own-ransomware/ - webarchive
- https://storage.pardot.com/272312/124918/Flashpoint_Hunt_Team___Zeppelin_Ransomware_Analysis.pdf - webarchive
- https://www.gdatasoftware.com/blog/2020/06/35946-burans-transformation-into-zeppelin - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-249a - webarchive
- https://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/ - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZeroAccess
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ZeroAccess.
| Known Synonyms |
|---|
Max++ |
Sirefef |
Smiscer |
Internal MISP references
UUID c7ff274f-2acc-4ee2-b74d-f1def12918d7 which can be used as unique global reference for ZeroAccess in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.zeroaccess - webarchive
- https://blog.malwarebytes.com/threat-analysis/2013/07/zeroaccess-anti-debug-uses-debugger/ - webarchive
- https://www.researchgate.net/profile/Lorenzo-De-Carli/publication/320250366_Botnet_protocol_inference_in_the_presence_of_encrypted_traffic/links/5fa9608792851cc286a08592/Botnet-protocol-inference-in-the-presence-of-encrypted-traffic.pdf?origin=publication_detail - webarchive
- http://resources.infosecinstitute.com/zeroaccess-malware-part-3-the-device-driver-process-injection-rootkit/ - webarchive
- http://contagiodump.blogspot.com/2010/11/zeroaccess-max-smiscer-crimeware.html - webarchive
- https://www.virusbulletin.com/virusbulletin/2016/01/paper-notes-click-fraud-american-story/ - webarchive
- http://resources.infosecinstitute.com/zeroaccess-malware-part-4-tracing-the-crimeware-origins-by-reversing-injected-code/ - webarchive
- http://resources.infosecinstitute.com/zeroaccess-malware-part-2-the-kernel-mode-device-driver-stealth-rootkit/ - webarchive
- http://contagiodump.blogspot.com/2012/12/zeroaccess-sirefef-rootkit-5-fresh.html - webarchive
- http://resources.infosecinstitute.com/step-by-step-tutorial-on-reverse-engineering-malware-the-zeroaccessmaxsmiscer-crimeware-rootkit/ - webarchive
- https://blog.malwarebytes.com/threat-analysis/2013/08/sophos-discovers-zeroaccess-using-rlo/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZeroCleare
ZeroCleare is a destructive malware. It has been developed in order to wipe the master boot record section in order to damage a disk's partitioning. Attackers use the EldoS RawDisk driver to perform the malicious action, which is not a signed driver and would therefore not runnable by default. The attackers managed to install it by using a vulnerable version of VBoxDrv driver, which the DSE accepts and runs. Used to attack middle-east energy and industrial sectors.
Internal MISP references
UUID a7e1429f-55bd-41ac-bf45-70c93465d113 which can be used as unique global reference for ZeroCleare in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.zerocleare - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/ - webarchive
- https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat - webarchive
- https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/ - webarchive
- https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf - webarchive
- https://www.ibm.com/downloads/cas/OAJ4VZNJ - webarchive
- https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government - webarchive
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZeroEvil
ZeroEvil is a malware that seems to be distributed by an ARSguarded VBS loader.
It first connects to a gate.php (version=). Upon success, an embedded VBS gets started connecting to logs_gate.php (plugin=, report=). So far, only one embedded VBS was observed: it creates and starts a PowerShell script to retrieve all password from the Windows.Security.Credentials.PasswordVault. Apart from that, a screenshot is taken and a list of running processes generated.
The ZeroEvil executable contains multiple DLLs, sqlite3.dll, ze_core.DLL (Mutex) and ze_autorun.DLL (Run-Key).
Internal MISP references
UUID 585f9f75-1239-4561-8815-c5ae033053a1 which can be used as unique global reference for ZeroEvil in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZeroLocker
Internal MISP references
UUID b226e6bb-b8bf-4c5d-b0b3-c7c04d12679a which can be used as unique global reference for ZeroLocker in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zeropadypt
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Zeropadypt.
| Known Synonyms |
|---|
Ouroboros |
Internal MISP references
UUID b8f99ed3-5669-4c71-b217-e92659a6e6bd which can be used as unique global reference for Zeropadypt in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZeroT
Internal MISP references
UUID 9b0aa458-dfa9-48af-87ea-c36d1501376c which can be used as unique global reference for ZeroT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zeus
According to CrowdStrike, The two primary goals of the Zeus trojan horse virus are stealing people's financial information and adding machines to a botnet. Unlike many types of malware, most Zeus variants try to avoid doing long-term damage to the devices they infect. Their aim is to avoid detection from antivirus software.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Zeus.
| Known Synonyms |
|---|
Zbot |
Internal MISP references
UUID 4e8c1ab7-2841-4823-a5d1-39284fb0969a which can be used as unique global reference for Zeus in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus - webarchive
- https://www.anomali.com/files/white-papers/russian-federation-country-profile.pdf - webarchive
- https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree - webarchive
- http://contagiodump.blogspot.com/2010/07/zeus-trojan-research-links.html - webarchive
- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf - webarchive
- https://web.archive.org/web/20160616170611/https://media.blackhat.com/bh-eu-10/presentations/Carrera_Silberman/BlackHat-EU-2010-Carrera-Silberman-State-of-Malware-slides.pdf - webarchive
- http://eternal-todo.com/blog/detecting-zeus - webarchive
- http://malwareint.blogspot.com/2010/03/new-phishing-campaign-against-facebook.html - webarchive
- https://nakedsecurity.sophos.com/2010/07/24/sample-run/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://www.symantec.com/connect/blogs/brief-look-zeuszbot-20 - webarchive
- https://www.mnin.org/write/ZeusMalware.pdf - webarchive
- https://securelist.com/financial-cyberthreats-in-2020/101638/ - webarchive
- https://www.secureworks.com/research/zeus?threat=zeus - webarchive
- https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/ - webarchive
- http://eternal-todo.com/blog/zeus-spreading-facebook - webarchive
- http://malwareint.blogspot.com/2010/02/facebook-phishing-campaign-proposed-by.html - webarchive
- http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/zeus_king_of_bots.pdf - webarchive
- https://www.kryptoslogic.com/blog/2021/07/trickbot-and-zeus/ - webarchive
- https://www.crowdstrike.com/cybersecurity-101/malware/trojan-zeus-malware - webarchive
- https://www.wired.com/2017/03/russian-hacker-spy-botnet/ - webarchive
- https://us-cert.cisa.gov/ncas/alerts/aa20-345a - webarchive
- https://www.s21sec.com/en/zeus-the-missing-link/ - webarchive
- https://www.symantec.com/connect/blogs/spyeye-s-kill-zeus-bark-worse-its-bite - webarchive
- https://go.recordedfuture.com/hubfs/reports/cta-2021-0909.pdf - webarchive
- https://www.justice.gov/opa/pr/four-individuals-plead-guilty-rico-conspiracy-involving-bulletproof-hosting-cybercriminals - webarchive
- https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group - webarchive
- https://www.youtube.com/watch?v=LUxOcpIRxmg - webarchive
- https://www.secureworks.com/research/threat-profiles/gold-evergreen - webarchive
- https://www.cisecurity.org/insights/blog/top-10-malware-march-2022 - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-woodland - webarchive
- https://blog.malwarebytes.com/101/2021/07/the-life-and-death-of-the-zeus-trojan/ - webarchive
- https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html - webarchive
- https://unit42.paloaltonetworks.com/banking-trojan-techniques/ - webarchive
- https://blog.trendmicro.com/trendlabs-security-intelligence/kivars-with-venom-targeted-attacks-upgrade-with-64-bit-support/ - webarchive
- http://malwareint.blogspot.com/2010/02/zeus-on-irs-scam-remains-actively.html - webarchive
- http://malwareint.blogspot.com/2010/01/leveraging-zeus-to-send-spam-through.html - webarchive
- http://eternal-todo.com/blog/new-zeus-binary - webarchive
- http://contagiodump.blogspot.com/2012/12/dec-2012-linuxchapro-trojan-apache.html - webarchive
- http://malwareint.blogspot.com/2009/07/special-zeus-botnet-for-dummies.html - webarchive
- http://www.secureworks.com/research/threat-profiles/gold-evergreen - webarchive
- http://contagiodump.blogspot.com/2010/07/zeus-version-scheme-by-trojan-author.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZeusAction
Internal MISP references
UUID 95057d7a-b95a-4173-bae7-9256ae002543 which can be used as unique global reference for ZeusAction in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zeus MailSniffer
Internal MISP references
UUID 768f1ae5-81a6-49f2-87c1-821c247b4bf3 which can be used as unique global reference for Zeus MailSniffer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zeus OpenSSL
This family describes the Zeus-variant that includes a version of OpenSSL and usually is downloaded by Zloader.
In June 2016, the version 1.5.4.0 (PE timestamp: 2016.05.11) appeared, downloaded by Zloader (known as DEloader at that time). OpenSSL 1.0.1p is statically linked to it, thus its size is roughly 1.2 MB. In subsequent months, that size increased up to 1.6 MB. In January 2017, with version 1.14.8.0, OpenSSL 1.0.2j was linked to it, increasing the size to 1.8 MB. Soon after also in January 2017, with version v1.15.0.0 the code was obfuscated, blowing up the size of the binary to 2.2 MB.
Please note that IBM X-Force decided to call win.zloader/win.zeus_openssl "Zeus Sphinx", after mentioning it as "a new version of Zeus Sphinx" in their initial post in August 2016. Malpedia thus lists the alias "Zeus XSphinx" for win.zeus_openssl - the X to refer to IBM X-Force.
Zeus Sphinx on the one hand has the following versioning ("slow increase") - 2015/09 v1.0.1.0 (Zeus Sphinx size: 1.5 MB) - 2016/02 v1.0.1.2 (Zeus Sphinx size: 1.5 MB) - 2016/04 v1.0.2.0 (Zeus Sphinx size: 1.5 MB)
Zeus OpenSSL on the other hand has the following versioning ("fast increase") - 2016/05 v1.5.4.0 (Zeus OpenSSL size: 1.2 MB) - 2017/01 v1.14.8.0 (Zeus OpenSSL size: 1.8 MB) - 2017/01 v1.15.0.0 (Zeus OpenSSL size: 2.2 MB)
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Zeus OpenSSL.
| Known Synonyms |
|---|
XSphinx |
Internal MISP references
UUID 74fc6a3a-cc51-4065-bdd9-fcef18c988a0 which can be used as unique global reference for Zeus OpenSSL in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_openssl - webarchive
- https://securityintelligence.com/posts/zeus-sphinx-trojan-awakens-amidst-coronavirus-spam-frenzy/ - webarchive
- https://blog.malwarebytes.com/cybercrime/2017/01/zbot-with-legitimate-applications-on-board/ - webarchive
- https://securityintelligence.com/brazil-cant-catch-a-break-after-panda-comes-the-sphinx/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zeus Sphinx
This family describes the vanilla Zeus-variant that includes TOR (and Polipo proxy). It has an almost 90% overlap with Zeus v2.0.8.9. Please note that IBM X-Force decided to call win.zloader/win.zeus_openssl "Zeus Sphinx", after mentioning it as "a new version of Zeus Sphinx" in their initial post in August 2016. Malpedia thus lists the alias "Zeus XSphinx" for win.zeus_openssl - the X to refer to IBM X-Force.
Zeus Sphinx on the one hand has the following versioning ("slow increase") - 2015/09 v1.0.1.0 (Zeus Sphinx size: 1.5 MB) - 2016/02 v1.0.1.2 (Zeus Sphinx size: 1.5 MB) - 2016/04 v1.0.2.0 (Zeus Sphinx size: 1.5 MB)
Zeus OpenSSL on the other hand has the following versioning ("fast increase") - 2016/05 v1.5.4.0 (Zeus OpenSSL size: 1.2 MB) - 2017/01 v1.14.8.0 (Zeus OpenSSL size: 1.8 MB) - 2017/01 v1.15.0.0 (Zeus OpenSSL size: 2.2 MB)
Internal MISP references
UUID 997c20b0-0992-498a-b69d-fc16ab2fd4e4 which can be used as unique global reference for Zeus Sphinx in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_sphinx - webarchive
- https://securityintelligence.com/posts/zeus-sphinx-back-in-business-some-core-modifications-arise/ - webarchive
- https://web.archive.org/web/20160130165709/http://darkmatters.norsecorp.com/2015/08/24/sphinx-new-zeus-variant-for-sale-on-the-black-market/ - webarchive
- https://securityaffairs.co/wordpress/39592/cyber-crime/sphinx-variant-zeus-trojan.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zezin
Internal MISP references
UUID 38de079b-cc4c-47b0-b47f-ad4c013d8a1f which can be used as unique global reference for Zezin in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
zgRAT
zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets. Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.
Internal MISP references
UUID 0c3ea882-72a7-4838-b79a-150be30b6a36 which can be used as unique global reference for zgRAT in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat - webarchive
- https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities - webarchive
- https://bazaar.abuse.ch/browse/signature/zgRAT/ - webarchive
- https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US - webarchive
- https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZhCat
Internal MISP references
UUID 3c74a04d-583e-40ec-b347-bdfeb534c614 which can be used as unique global reference for ZhCat in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZhMimikatz
Internal MISP references
UUID 989330e9-52da-4489-888b-686429db3a45 which can be used as unique global reference for ZhMimikatz in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZingoStealer
An information stealer written in .NET.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ZingoStealer.
| Known Synonyms |
|---|
Ginzo |
Internal MISP references
UUID 3984dfa1-45dc-4c19-92ca-3b90b89c8c62 which can be used as unique global reference for ZingoStealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZitMo
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ZitMo.
| Known Synonyms |
|---|
ZeuS-in-the-Mobile |
Internal MISP references
UUID 6f08bd79-d22a-471c-882b-f68a42eb4a23 which can be used as unique global reference for ZitMo in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZiyangRAT
Internal MISP references
UUID c23aac20-4987-4c15-af63-7043026c5f82 which can be used as unique global reference for ZiyangRAT in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zloader
This family describes the (initially small) loader, which downloads Zeus OpenSSL.
In June 2016, a new loader was dubbed DEloader by Fortinet. It has some functions borrowed from Zeus 2.0.8.9 (e.g. the versioning, nrv2b, binstorage-labels), but more importantly, it downloaded a Zeus-like banking trojan (-> Zeus OpenSSL). Furthermore, the loader shared its versioning with the Zeus OpenSSL it downloaded. The initial samples from May 2016 were small (17920 bytes). At some point, visualEncrypt/Decrypt was added, e.g. in v1.11.0.0 (September 2016) with size 27648 bytes. In January 2017 with v1.15.0.0, obfuscation was added, which blew the size up to roughly 80k, and the loader became known as Zloader aka Terdot. These changes may be related to the Moskalvzapoe Distribution Network, which started the distribution of it at the same time.
Please note that IBM X-Force decided to call win.zloader/win.zeus_openssl "Zeus Sphinx", after mentioning it as "a new version of Zeus Sphinx" in their initial post in August 2016. Malpedia thus lists the alias "Zeus XSphinx" for win.zeus_openssl - the X to refer to IBM X-Force.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Zloader.
| Known Synonyms |
|---|
DELoader |
Terdot |
Internal MISP references
UUID 13236f94-802b-4abc-aaa9-cb80cf4df9ed which can be used as unique global reference for Zloader in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.zloader - webarchive
- https://blag.nullteilerfrei.de/2020/05/24/zloader-string-obfuscation/ - webarchive
- https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://team-cymru.com/blog/2021/11/03/webinject-panel-administration-a-vantage-point-into-multiple-threat-actor-campaigns/ - webarchive
- https://news.sophos.com/en-us/2020/10/28/hacks-for-sale-inside-the-buer-loader-malware-as-a-service/ - webarchive
- https://research.checkpoint.com/2022/can-you-trust-a-files-digital-signature-new-zloader-campaign-exploits-microsofts-signature-verification-putting-users-at-risk/ - webarchive
- https://www.crowdstrike.com/blog/falcon-overwatch-uncovers-ongoing-night-spider-zloader-campaign/ - webarchive
- https://resources.malwarebytes.com/files/2020/05/The-Silent-Night-Zloader-Zbot_Final.pdf - webarchive
- https://securityintelligence.com/zeus-sphinx-pushes-empty-configuration-files-what-has-the-sphinx-got-cooking/ - webarchive
- https://johannesbader.ch/blog/the-dga-of-zloader/ - webarchive
- https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/ - webarchive
- https://mal-eats.net/2021/05/10/campo_new_attack_campaign_targeting_japan/ - webarchive
- https://aaqeel01.wordpress.com/2021/10/18/zloader-reversing/ - webarchive
- https://blog.vincss.net/2022/04/re026-a-deep-dive-into-zloader-the-silent-night.html - webarchive
- https://www.youtube.com/watch?v=mhX-UoaYnOM - webarchive
- https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries - webarchive
- https://unit42.paloaltonetworks.com/api-hammering-malware-families/ - webarchive
- https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf - webarchive
- https://blogs.microsoft.com/on-the-issues/2022/04/13/zloader-botnet-disrupted-malware-ukraine/ - webarchive
- https://www.lac.co.jp/lacwatch/people/20201106_002321.html - webarchive
- https://securityintelligence.com/around-the-world-with-zeus-sphinx-from-canada-to-australia-and-back/ - webarchive
- https://int0xcc.svbtle.com/dissecting-obfuscated-deloader-malware - webarchive
- https://blog.talosintelligence.com/2020/09/salfram-robbing-place-without-removing.html - webarchive
- https://www.microsoft.com/security/blog/2022/04/13/dismantling-zloader-how-malicious-ads-led-to-disabled-security-tools-and-ransomware/ - webarchive
- https://labs.sentinelone.com/enter-the-maze-demystifying-an-affiliate-involved-in-maze-snow/ - webarchive
- https://threatresearch.ext.hp.com/wp-content/uploads/2021/03/HP_Bromium_Threat_Insights_Report_Q4_2020.pdf - webarchive
- https://web.archive.org/web/20200929145931/https://www.comae.com/posts/2020-03-13_yet-another-active-email-campaign-with-malicious-excel-files-identified/ - webarchive
- https://www.cisa.gov/uscert/sites/default/files/publications/AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf - webarchive
- https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html - webarchive
- https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 - webarchive
- https://securityintelligence.com/posts/zeus-sphinx-trojan-awakens-amidst-coronavirus-spam-frenzy/ - webarchive
- https://malware.pizza/2020/06/19/further-evasion-in-the-forgotten-corners-of-ms-xls/ - webarchive
- https://medium.com/walmartglobaltech/signed-dll-campaigns-as-a-service-7760ac676489 - webarchive
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf - webarchive
- https://www.deepinstinct.com/2021/05/26/deep-dive-packing-software-cryptone/ - webarchive
- https://insight-jp.nttsecurity.com/post/102gsqj/pseudogatespelevo-exploit-kit - webarchive
- https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/ - webarchive
- https://www.comae.com/posts/2020-03-13_yet-another-active-email-campaign-with-malicious-excel-files-identified/ - webarchive
- https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ - webarchive
- https://decoded.avast.io/vladimirmartyanov/zloader-the-silent-night/ - webarchive
- https://umbrella.cisco.com/blog/cybersecurity-threat-spotlight-strrat-zloader-honeygain - webarchive
- https://www.sophos.com/en-us/medialibrary/pdfs/technical-papers/sophos-2021-threat-report.pdf - webarchive
- https://www.sentinelone.com/labs/hide-and-seek-new-zloader-infection-chain-comes-with-improved-stealth-and-evasion-mechanisms/ - webarchive
- https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf - webarchive
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/zloader-campaigns-at-a-glance - webarchive
- https://twitter.com/VK_Intel/status/1294320579311435776 - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/ - webarchive
- https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-qakbot-zip-based-campaign/ - webarchive
- https://clickallthethings.wordpress.com/2020/09/21/zloader-xlm-update-macro-code-and-behavior-change/ - webarchive
- https://noticeofpleadings.com/zloader/ - webarchive
- https://www.cybereason.com/blog/threat-analysis-report-socgholish-and-zloader-from-fake-updates-and-installers-to-owning-your-systems - webarchive
- https://labs.k7computing.com/?p=22458 - webarchive
- https://blog.morphisec.com/obfuscated-vbscript-drops-zloader-ursnif-qakbot-dridex - webarchive
- https://www.welivesecurity.com/2022/04/13/eset-takes-part-global-operation-disrupt-zloader-botnets/ - webarchive
- https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf - webarchive
- https://blag.nullteilerfrei.de/2020/06/11/api-hashing-in-the-zloader-malware/ - webarchive
- https://info.phishlabs.com/blog/surge-in-zloader-attacks-observed - webarchive
- https://cybleinc.com/2021/04/19/zloader-returns-through-spelevo-exploit-kit-phishing-campaign/ - webarchive
- https://securityliterate.com/chantays-resume-investigating-a-cv-themed-zloader-malware-campaign/ - webarchive
- https://www.guidepointsecurity.com/from-zloader-to-darkside-a-ransomware-story/ - webarchive
- https://www.lastline.com/labsblog/evolution-of-excel-4-0-macro-weaponization/ - webarchive
- https://blogs.quickheal.com/zloader-entailing-different-office-files/ - webarchive
- https://blog.malwarebytes.com/cybercrime/2017/01/zbot-with-legitimate-applications-on-board/ - webarchive
- https://info.phishlabs.com/blog/zloader-dominates-email-payloads-in-q1 - webarchive
- https://clickallthethings.wordpress.com/2020/06/19/zloader-vba-r1c1-references-and-other-tomfoolery/ - webarchive
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf - webarchive
- https://blog.malwarebytes.com/threat-analysis/2020/11/malsmoke-operators-abandon-exploit-kits-in-favor-of-social-engineering-scheme/ - webarchive
- https://www.forcepoint.com/blog/security-labs/zeus-delivered-deloader-defraud-customers-canadian-banks - webarchive
- https://www.fortinet.com/blog/threat-research/the-curious-case-of-an-unknown-trojan-targeting-german-speaking-users.html - webarchive
- https://www.proofpoint.com/us/blog/threat-insight/zloader-loads-again-new-zloader-variant-returns - webarchive
- https://www.forcepoint.com/blog/x-labs/invoicing-spam-campaigns-malware-zloader - webarchive
- https://www.hornetsecurity.com/en/threat-research/zloader-email-campaign-using-mhtml-to-download-and-decrypt-xls/ - webarchive
- https://www.bleepingcomputer.com/news/security/fake-microsoft-teams-updates-lead-to-cobalt-strike-deployment/ - webarchive
- https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf - webarchive
- https://www.bleepingcomputer.com/news/security/banking-malware-spreading-via-covid-19-relief-payment-phishing/ - webarchive
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/ - webarchive
- https://documents.trendmicro.com/assets/txt/IOCs-zloader-campaigns-at-a-glance.txt - webarchive
- https://www.youtube.com/watch?v=QBoj6GB79wM - webarchive
- https://twitter.com/ffforward/status/1324281530026524672 - webarchive
- https://malware.pizza/2020/05/12/evading-av-with-excel-macros-and-biff8-xls/ - webarchive
- https://www.cisa.gov/uscert/ncas/alerts/aa22-110a - webarchive
- https://blog.alyac.co.kr/3322 - webarchive
- https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zlob
Internal MISP references
UUID ddccba7e-89f3-4b51-803c-e473ca5623da which can be used as unique global reference for Zlob in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZStealer
Information Stealer used by Void Balaur.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ZStealer.
| Known Synonyms |
|---|
Z*Stealer |
Internal MISP references
UUID 750c4f21-36b0-45b7-80d5-e6c9fdf5134d which can be used as unique global reference for ZStealer in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zumanek
According to ESET, this malware family was active exclusively in Brazil until the middle of 2020. It s identified by its method for obfuscating strings. It creates a function for each character of the alphabet and then concatenates the result of calling the correct functions in sequence.
Internal MISP references
UUID 2fde6fa9-6e3f-491f-95f7-107b41efacd8 which can be used as unique global reference for Zumanek in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZUpdater
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ZUpdater.
| Known Synonyms |
|---|
Zpevdo |
Internal MISP references
UUID 36a54d23-39ea-446c-b690-6a899890773d which can be used as unique global reference for ZUpdater in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zupdax
Internal MISP references
UUID 0a0b04d4-afc7-4135-b71e-1148f965b566 which can be used as unique global reference for Zupdax in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.zupdax - webarchive
- https://www.nortonlifelock.com/sites/default/files/2021-10/OPERATION%20EXORCIST%20White%20Paper.pdf - webarchive
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZXShell
According to FireEye, ZXSHELL is a backdoor that can be downloaded from the internet, particularly Chinese hacker websites. The backdoor can launch port scans, run a keylogger, capture screenshots, set up an HTTP or SOCKS proxy, launch a reverse command shell, cause SYN floods, and transfer/delete/run files. The publicly available version of the tool provides a graphical user interface that malicious actors can use to interact with victim backdoors. Simplified Chinese is the language used for the bundled ZXSHELL documentation.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ZXShell.
| Known Synonyms |
|---|
Sensocode |
Internal MISP references
UUID 23920e3b-246a-4172-bf9b-5e9f90510a15 which can be used as unique global reference for ZXShell in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.zxshell - webarchive
- https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox - webarchive
- https://lab52.io/blog/apt27-rootkit-updates/ - webarchive
- https://content.fireeye.com/apt-41/rpt-apt41 - webarchive
- https://attack.mitre.org/groups/G0096 - webarchive
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-keystone - webarchive
- https://mp.weixin.qq.com/s/K1uBLGqD8kgsIp1yTyYBfw - webarchive
- https://www.virusbulletin.com/uploads/pdf/conference_slides/2019/VB2019-GuPan.pdf - webarchive
- https://www.secureworks.com/research/threat-profiles/bronze-union - webarchive
- https://blogs.cisco.com/security/talos/opening-zxshell - webarchive
- https://attack.mitre.org/groups/G0001/ - webarchive
- https://meltx0r.github.io/tech/2019/09/19/emissary-panda-apt.html - webarchive
- https://risky.biz/whatiswinnti/ - webarchive
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lancefly-merdoor-zxshell-custom-backdoor - webarchive
- https://github.com/smb01/zxshell - webarchive
- https://unit42.paloaltonetworks.com/atoms/iron-taurus/ - webarchive
- https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
ZxxZ
Cisco Talos attributes this backdoor with moderate confidence to the Bitter APT.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ZxxZ.
| Known Synonyms |
|---|
MuuyDownloader |
Internal MISP references
UUID 3782b76b-3fe8-41d9-b258-dac25f9699a2 which can be used as unique global reference for ZxxZ in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |
Zyklon
According to FireEye, Zyklon or Zyklon HTTP is a publicly available, full-featured backdoor capable of keylogging, password harvesting, downloading and executing additional plugins, conducting distributed denial-of-service (DDoS) attacks, and self-updating and self-removal. The malware may communicate with its command and control (C2) server over The Onion Router (Tor) network if configured to do so. The malware can download several plugins, some of which include features such as cryptocurrency mining and password recovery, from browsers and email software. Zyklon also provides a very efficient mechanism to monitor the spread and impact.
Internal MISP references
UUID 721e9af0-8a60-4b9e-9137-c23e86d75722 which can be used as unique global reference for Zyklon in MISP communities and other software using the MISP galaxy
External references
- https://malpedia.caad.fkie.fraunhofer.de/details/win.zyklon - webarchive
- https://www.fireeye.com/blog/threat-research/2018/01/microsoft-office-vulnerabilities-used-to-distribute-zyklon-malware.html - webarchive
- https://blog.talosintelligence.com/2017/05/modified-zyklon-and-plugins-from-india.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| type | [] |