Skip to content

Hide Navigation Hide TOC

Edit

Tool

threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.

Authors
Authors and/or Contributors
Alexandre Dulaunoy
Florian Roth
Timo Steffens
Christophe Vandeplas
Dennis Rand
raw-data

Tinba

Banking Malware

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Tinba.

Known Synonyms
Hunter
TinyBanker
Zusy
Internal MISP references

UUID 75f53ead-1aee-4f91-8cb9-b4170d747cfc which can be used as unique global reference for Tinba in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Banking']
Related clusters

To see the related clusters, click here.

PlugX

Malware

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PlugX.

Known Synonyms
Agent.dhwf
Backdoor.FSZO-5117
Korplug
Trojan.Heur.JP.juW@ayZZvMb
Trojan.Inject1.6386
Internal MISP references

UUID f4b159ea-97e5-483b-854b-c48a78d562aa which can be used as unique global reference for PlugX in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

MSUpdater

Trojan (RAT) linked to current targeted attacks and others dating back to at least early 2009

Internal MISP references

UUID f85d2d5a-6e3c-44e4-bd3b-6100c04b4ba9 which can be used as unique global reference for MSUpdater in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

Lazagne

A password sthealing tool regularly used by attackers

Internal MISP references

UUID d0394d50-5316-4405-aa77-1070bdf68b6a which can be used as unique global reference for Lazagne in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['HackTool']
Related clusters

To see the related clusters, click here.

Poison Ivy

Poison Ivy is a RAT which was freely available and first released in 2005.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Poison Ivy.

Known Synonyms
Backdoor.Win32.PoisonIvy
Gen:Trojan.Heur.PT
Internal MISP references

UUID 2abe89de-46dd-4dae-ae22-b49a593aff54 which can be used as unique global reference for Poison Ivy in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

SPIVY

In March 2016, Unit 42 observed this new Poison Ivy variant we’ve named SPIVY being deployed via weaponized documents leveraging CVE-2015-2545.

Internal MISP references

UUID a3d2e7fe-a8e4-48c7-8d47-b9430898af08 which can be used as unique global reference for SPIVY in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

Torn RAT

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Torn RAT.

Known Synonyms
Anchor Panda
Internal MISP references

UUID 32a67552-3b31-47bb-8098-078099bbc813 which can be used as unique global reference for Torn RAT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

OzoneRAT

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular OzoneRAT.

Known Synonyms
Ozone RAT
ozonercp
Internal MISP references

UUID e3010d81-94e2-43a9-98ed-61925b02be6e which can be used as unique global reference for OzoneRAT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

ZeGhost

ZeGhots is a RAT which was freely available and first released in 2014.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ZeGhost.

Known Synonyms
BackDoor-FBZT!52D84425CDF2
Trojan.Win32.Staser.ytq
Win32/Zegost.BW
Internal MISP references

UUID c7706d12-fb62-4db6-bbe3-fef2da0181e7 which can be used as unique global reference for ZeGhost in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

Elise Backdoor

Trojan (RAT) linked to current targeted attacks and others dating back to at least early 2009

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Elise Backdoor.

Known Synonyms
Elise
Internal MISP references

UUID d70fd29d-590e-4ed5-b72f-6ce0142019c6 which can be used as unique global reference for Elise Backdoor in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['dropper', 'PWS']
Related clusters

To see the related clusters, click here.

Trojan.Laziok

A new information stealer, Trojan.Laziok, acts as a reconnaissance tool allowing attackers to gather information and tailor their attack methods for each compromised computer.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Trojan.Laziok.

Known Synonyms
Laziok
Internal MISP references

UUID 7ccd3821-e825-4ff8-b4be-92c9732ce708 which can be used as unique global reference for Trojan.Laziok in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['PWS', 'reco']
Related clusters

To see the related clusters, click here.

Slempo

Android-based malware

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Slempo.

Known Synonyms
Acecard
Bankosy
GM-Bot
SlemBunk
Internal MISP references

UUID f8047de2-fefc-4ee0-825b-f1fae4b20c09 which can be used as unique global reference for Slempo in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Spyware', 'AndroidOS']
Related clusters

To see the related clusters, click here.

PWOBot

We have discovered a malware family named ‘PWOBot’ that is fairly unique because it is written entirely in Python, and compiled via PyInstaller to generate a Microsoft Windows executable. The malware has been witnessed affecting a number of Europe-based organizations, particularly in Poland. Additionally, the malware is delivered via a popular Polish file-sharing web service.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PWOBot.

Known Synonyms
PWOHTTPD
PWOKeyLogger
PWOLauncher
PWOMiner
PWOPyExec
PWOQuery
Internal MISP references

UUID 17de0952-3841-44d3-b03a-cc90e123d2b8 which can be used as unique global reference for PWOBot in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Dropper', 'Miner', 'Spyware']

Lost Door RAT

We recently came across a cyber attack that used a remote access Trojan (RAT) called Lost Door, a tool currently offered on social media sites. What also struck us the most about this RAT (detected as BKDR_LODORAT.A) is how it abuses the Port Forward feature in routers.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Lost Door RAT.

Known Synonyms
BKDR_LODORAT
LostDoor RAT
Internal MISP references

UUID 6d0b7543-a6e5-49fc-832e-bd594460187c which can be used as unique global reference for Lost Door RAT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

njRAT

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular njRAT.

Known Synonyms
Bladabindi
Jorik
Internal MISP references

UUID a860d257-4a39-47ec-9230-94cac67ebf7e which can be used as unique global reference for njRAT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

NanoCoreRAT

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular NanoCoreRAT.

Known Synonyms
Atros2.CKPN
Nancrat
NanoCore
Zurten
Internal MISP references

UUID a8111fb7-d4c4-4671-a6f9-f62fea8bad60 which can be used as unique global reference for NanoCoreRAT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

Sakula

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sakula.

Known Synonyms
Sakurel
Internal MISP references

UUID f6c137f0-979c-4ce2-a0e5-2a080a5a1746 which can be used as unique global reference for Sakula in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

Hi-ZOR

Internal MISP references

UUID e8fbb7b4-2f27-4028-975a-485d4c2dd977 which can be used as unique global reference for Hi-ZOR in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

Derusbi

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Derusbi.

Known Synonyms
TROJ_DLLSERV.BE
Internal MISP references

UUID eff68b97-f36e-4827-ab1a-90523c16774c which can be used as unique global reference for Derusbi in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

EvilGrab

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular EvilGrab.

Known Synonyms
BKDR_EVILOGE
BKDR_HGDER
BKDR_NVICM
Wmonder
Internal MISP references

UUID c9b4ec27-0a43-4671-a967-bcac5df0e056 which can be used as unique global reference for EvilGrab in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

Trojan.Naid

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Trojan.Naid.

Known Synonyms
AGENT.ABQMR
AGENT.AQUP.DROPPER
AGENT.BMZA
AGENT.GUNZ
MCRAT.A
Mdmbot.E
Naid
Internal MISP references

UUID 170db76b-93f7-4fd1-97fc-55937c079b66 which can be used as unique global reference for Trojan.Naid in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Dropper']
Related clusters

To see the related clusters, click here.

Moudoor

Backdoor.Moudoor, a customized version of Gh0st RAT

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Moudoor.

Known Synonyms
KillProc.14145
SCAR
Internal MISP references

UUID 46fd9884-208c-43c7-8ec3-b9fabce30b30 which can be used as unique global reference for Moudoor in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

NetTraveler

APT that infected hundreds of high profile victims in more than 40 countries. Known targets of NetTraveler include Tibetan/Uyghur activists, oil industry companies, scientific research centers and institutes, universities, private companies, governments and governmental institutions, embassies and military contractors.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular NetTraveler.

Known Synonyms
Netfile
TravNet
Internal MISP references

UUID 59b70721-6fed-4805-afa5-4ff2554bef81 which can be used as unique global reference for NetTraveler in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

Winnti

APT used As part of Operation SMN, Novetta analyzed recent versions of the Winnti malware. The samples, compiled from mid- to late 2014, exhibited minimal functional changes over the previous generations Kaspersky reported in 2013.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Winnti.

Known Synonyms
Agent.ALQHI
Etso
HIGHNOON
RbDoor
RibDoor
SUQ
Internal MISP references

UUID 9b3a4cff-1c5a-4fd6-b49c-27240b6d622c which can be used as unique global reference for Winnti in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

Mimikatz

Ease Credential stealh and replay, A little tool to play with Windows security.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mimikatz.

Known Synonyms
Mikatz
Internal MISP references

UUID 7f3a035d-d83a-45b8-8111-412aa8ade802 which can be used as unique global reference for Mimikatz in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['HackTool']
Related clusters

To see the related clusters, click here.

WEBC2

Backdoor attribued to APT1

Internal MISP references

UUID b5be84b7-bf2c-40d0-85a9-14c040881a98 which can be used as unique global reference for WEBC2 in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

Pirpi

Symantec has observed Buckeye activity dating back to 2009, involving attacks on various organizations in several regions. Buckeye used a remote access Trojan (Backdoor.Pirpi) in attacks against a US organization’s network in 2009. The group delivered Backdoor.Pirpi through malicious attachments or links in convincing spear-phishing emails.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pirpi.

Known Synonyms
Badey
EXL
Internal MISP references

UUID 4859330d-c6a5-4b9c-b45b-536ec983cd4a which can be used as unique global reference for Pirpi in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

RARSTONE

RARSTONE is a Remote Access Tool (RAT) discovered early 2013 by TrendMicro, it’s characterized by a great affinity with the other RAT know as Plug is and was used in April for phishing campaigns that followed the dramatic attack to the Boston Marathon.

Internal MISP references

UUID 5d2dd6ad-6bb2-45d3-b295-e125d3399c8d which can be used as unique global reference for RARSTONE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

Backspace

Backspace is a Backdoor that targets the Windows platform. This malware is reportedly associated with targeted attacks against Association of Southeast Asian Nations (ASEAN) members (APT30).

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Backspace.

Known Synonyms
Lecna
Internal MISP references

UUID cd6c5f27-cf7e-4529-ae9c-ab5b85102bde which can be used as unique global reference for Backspace in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

XSControl

Backdoor user by he Naikon APT group

Internal MISP references

UUID 2e3712e3-fd7b-43d1-8b4f-2ba7fc551bbb which can be used as unique global reference for XSControl in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

Neteagle

NETEAGLE is a backdoor developed by APT30 with compile dates as early as 2008. It has two main variants known as Scout and Norton.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Neteagle.

Known Synonyms
norton
scout
Internal MISP references

UUID 0ee08ab5-140c-44c3-9b0a-4a352500b14e which can be used as unique global reference for Neteagle in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

Agent.BTZ

In November 2014, the experts of the G DATA SecurityLabs published an article about ComRAT, the Agent.BTZ successor. We explained that this case is linked to the Uroburos rootkit.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Agent.BTZ.

Known Synonyms
ComRat
Internal MISP references

UUID da079741-05e6-458c-b434-011263dc691c which can be used as unique global reference for Agent.BTZ in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

Heseber BOT

RAT bundle with standard VNC (to avoid/limit A/V detection).

Internal MISP references

UUID b1b7e7d8-3778-4783-9cc7-9ec04b146031 which can be used as unique global reference for Heseber BOT in MISP communities and other software using the MISP galaxy

Agent.dne

Internal MISP references

UUID 93fe1644-a7a6-4e5a-bc3b-88984b251fde which can be used as unique global reference for Agent.dne in MISP communities and other software using the MISP galaxy

Wipbot

Waterbug is the name given to the actors who use the malware tools Trojan.Wipbot (also known as Tavdig and Epic Turla)

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Wipbot.

Known Synonyms
Epic Turla
TadjMakhal
Tavdig
WorldCupSec
Internal MISP references

UUID 36c0faf0-428e-4e7f-93c5-824bb0495ac9 which can be used as unique global reference for Wipbot in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

Turla

Family of related sophisticated backdoor software - Name comes from Microsoft detection signature – anagram of Ultra (Ultra3) was a name of the fake driver). A macOS version exists but appears incomplete and lacking features...for now!

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Turla.

Known Synonyms
Snake
Uroburos
Urouros
Internal MISP references

UUID 22332d52-c0c2-443c-9ffb-f08c0d23722c which can be used as unique global reference for Turla in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor', 'Rootkit']
Related clusters

To see the related clusters, click here.

Winexe

Internal MISP references

UUID 811bdec0-e236-48ae-b27c-1a8fe0bfc3a9 which can be used as unique global reference for Winexe in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Dark Comet

RAT initialy identified in 2011 and still actively used.

Internal MISP references

UUID 9ad11139-e928-45cf-a0b4-937290642e92 which can be used as unique global reference for Dark Comet in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Cadelspy

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cadelspy.

Known Synonyms
WinSpy
Internal MISP references

UUID 38d6a0a1-0388-40d4-b8f4-1d58eeb9a07d which can be used as unique global reference for Cadelspy in MISP communities and other software using the MISP galaxy

Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

CMStar

Internal MISP references

UUID e81b96a2-22e9-445e-88c7-65b67c2299ec which can be used as unique global reference for CMStar in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

DHS2015

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DHS2015.

Known Synonyms
iRAT
Internal MISP references

UUID d6420953-0e85-4330-abc2-3a8b9dda046b which can be used as unique global reference for DHS2015 in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Gh0st Rat

Gh0st Rat is a well-known Chinese remote access trojan which was originally made by C.Rufus Security Team several years ago. GH0ST is a backdoor written in C++ that communicates via a custom binary protocol over TCP or UDP. It typically features a packet signature at the start of each message that varies between samples. Availability: Public

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gh0st Rat.

Known Synonyms
Gh0stRat, GhostRat
Internal MISP references

UUID cb8c8253-4024-4cc9-8989-b4a5f95f6c2f which can be used as unique global reference for Gh0st Rat in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Fakem RAT

Fakem RAT makes their network traffic look like well-known protocols (e.g. Messenger traffic, HTML pages).

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Fakem RAT.

Known Synonyms
FAKEM
Internal MISP references

UUID eead5605-0d79-4942-a6c2-efa6853cdf6b which can be used as unique global reference for Fakem RAT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

MFC Huner

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MFC Huner.

Known Synonyms
BKDR_HUPIGON
Hupigon
Internal MISP references

UUID a5a48311-afbf-44c4-8045-46ffd51cd4d0 which can be used as unique global reference for MFC Huner in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Blackshades

Blackshades Remote Access Tool targets Microsoft Windows operating systems. Authors were arrested in 2012 and 2014.

Internal MISP references

UUID 8c3202d5-1671-46ec-9d42-cb50dbe2f667 which can be used as unique global reference for Blackshades in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

CHOPSTICK

backdoor used by apt28

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CHOPSTICK.

Known Synonyms
(.v2 fysbis)
SPLM
webhp
Internal MISP references

UUID 0a32ceea-fa66-47ab-8bde-150dbd6d2e40 which can be used as unique global reference for CHOPSTICK in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
possible_issues Report tells that is could be Xagent alias (Java Rat)
type ['Backdoor']
Related clusters

To see the related clusters, click here.

EVILTOSS

backdoor used by apt28

Sedreco serves as a spying backdoor; its functionalities can be extended with dynamically loaded plugins. It is made up of two distinct components: a dropper and the persistent payload installed by this dropper. We have not seen this component since April 2016.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular EVILTOSS.

Known Synonyms
ADVSTORESHELL
AZZY
NETUI
Sedreco
Internal MISP references

UUID 6374fc53-9a0d-41ba-b9cf-2a9765d69fbb which can be used as unique global reference for EVILTOSS in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
possible_issues Report tells that is could be Xagent alias (Java Rat)
type ['Backdoor']
Related clusters

To see the related clusters, click here.

GAMEFISH

backdoor

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GAMEFISH.

Known Synonyms
JHUHUGIT
Sednit
Seduploader
Sofacy
Internal MISP references

UUID 43cd8a09-9c80-48c8-9568-1992433af60a which can be used as unique global reference for GAMEFISH in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

SOURFACE

downloader - Older version of CORESHELL

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SOURFACE.

Known Synonyms
Sofacy
Internal MISP references

UUID 1de47f51-1f20-403b-a2e1-5eaabe275faa which can be used as unique global reference for SOURFACE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

OLDBAIT

credential harvester

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular OLDBAIT.

Known Synonyms
BackDoor-FDU
IEChecker
Sasfis
Internal MISP references

UUID 6d1e2736-d363-49aa-9054-9c9e4ac0c520 which can be used as unique global reference for OLDBAIT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['PWS']
Related clusters

To see the related clusters, click here.

CORESHELL

downloader - Newer version of SOURFACE

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CORESHELL.

Known Synonyms
Sofacy
Internal MISP references

UUID 3948ce95-468e-4ce1-82b1-57439c6d6afd which can be used as unique global reference for CORESHELL in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Havex RAT

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Havex RAT.

Known Synonyms
Havex
Internal MISP references

UUID d7183f66-59ec-4803-be20-237b442259fc which can be used as unique global reference for Havex RAT in MISP communities and other software using the MISP galaxy

Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

KjW0rm

RAT initially written in VB.

Internal MISP references

UUID b3f7a454-3b23-4149-99aa-0132323814d0 which can be used as unique global reference for KjW0rm in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

TinyTyphon

Internal MISP references

UUID 1b591586-e1ef-4a32-8dae-791aca5ddf41 which can be used as unique global reference for TinyTyphon in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Badnews

Internal MISP references

UUID 48ca79ff-ea36-4a47-8231-0f7f0db0e09e which can be used as unique global reference for Badnews in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

LURK

Internal MISP references

UUID fcece2f7-e0ef-44e0-aa9f-578c2a56f532 which can be used as unique global reference for LURK in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Oldrea

Internal MISP references

UUID f2e17736-9575-4a91-92ab-bb82bb0bf900 which can be used as unique global reference for Oldrea in MISP communities and other software using the MISP galaxy

AmmyAdmin

Internal MISP references

UUID d1006b04-3015-49ea-9414-a968a0f74106 which can be used as unique global reference for AmmyAdmin in MISP communities and other software using the MISP galaxy

Matryoshka

Internal MISP references

UUID cb6c49ab-b9ac-459f-b765-05cbe2e63b0d which can be used as unique global reference for Matryoshka in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

TinyZBot

Internal MISP references

UUID e2cc27a2-4146-4f08-8e80-114a99204cea which can be used as unique global reference for TinyZBot in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

GHOLE

Internal MISP references

UUID 43a0d8a7-558d-4104-8a24-55e6e7a503db which can be used as unique global reference for GHOLE in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

CWoolger

Internal MISP references

UUID 005b46a2-9498-473a-bee2-0db91e5fb327 which can be used as unique global reference for CWoolger in MISP communities and other software using the MISP galaxy

FireMalv

Internal MISP references

UUID 6ef11b6e-d81a-465b-9dce-fab5c6fe807b which can be used as unique global reference for FireMalv in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Regin

Regin (also known as Prax or WarriorPride) is a sophisticated malware toolkit revealed by Kaspersky Lab, Symantec, and The Intercept in November 2014. The malware targets specific users of Microsoft Windows-based computers and has been linked to the US intelligence gathering agency NSA and its British counterpart, the GCHQ. The Intercept provided samples of Regin for download including malware discovered at Belgian telecommunications provider, Belgacom. Kaspersky Lab says it first became aware of Regin in spring 2012, but that some of the earliest samples date from 2003. The name Regin is first found on the VirusTotal website on 9 March 2011.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Regin.

Known Synonyms
Prax
WarriorPride
Internal MISP references

UUID 0cf21558-1217-4d36-9536-2919cfd44825 which can be used as unique global reference for Regin in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Duqu

Internal MISP references

UUID 809b54c3-dd6a-4ec9-8c3a-a27b9baa6732 which can be used as unique global reference for Duqu in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Flame

Internal MISP references

UUID d7963066-62ed-4494-9b8c-4b8b691a7c82 which can be used as unique global reference for Flame in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Stuxnet

Internal MISP references

UUID 1b63293f-13f0-4c25-9bf6-6ebc023fc8ff which can be used as unique global reference for Stuxnet in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

EquationLaser

Internal MISP references

UUID 21f7a57b-7778-4b3e-9b50-5289ae3b445d which can be used as unique global reference for EquationLaser in MISP communities and other software using the MISP galaxy

EquationDrug

Internal MISP references

UUID 3e0c2d35-87cb-40f9-b341-a6c8dbec697e which can be used as unique global reference for EquationDrug in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

DoubleFantasy

Internal MISP references

UUID fb8828a4-76de-467d-9f52-528984aa9b8d which can be used as unique global reference for DoubleFantasy in MISP communities and other software using the MISP galaxy

TripleFantasy

Internal MISP references

UUID a4cebcc4-9e9b-415f-aa05-dd71c4e288fe which can be used as unique global reference for TripleFantasy in MISP communities and other software using the MISP galaxy

Fanny

Internal MISP references

UUID 1e25d254-3f03-4752-b8d6-023a23e7d4ae which can be used as unique global reference for Fanny in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

GrayFish

Internal MISP references

UUID 2407bd9a-a3a4-40c4-86de-be6965243c67 which can be used as unique global reference for GrayFish in MISP communities and other software using the MISP galaxy

Babar

Internal MISP references

UUID 57b221bc-7ed6-4080-bc66-813d17009485 which can be used as unique global reference for Babar in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Bunny

Internal MISP references

UUID 5589c428-792b-4439-b0db-07862765d96b which can be used as unique global reference for Bunny in MISP communities and other software using the MISP galaxy

Casper

Internal MISP references

UUID 63b3e6fb-9bb8-43dc-9cbf-7681b049b5d6 which can be used as unique global reference for Casper in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

NBot

Internal MISP references

UUID 97fa32d6-5d1d-43df-b765-4a0e31d7f179 which can be used as unique global reference for NBot in MISP communities and other software using the MISP galaxy

Tafacalou

Internal MISP references

UUID 835943ed-75d7-4225-9075-a8e2b2136fad which can be used as unique global reference for Tafacalou in MISP communities and other software using the MISP galaxy

Tdrop

Internal MISP references

UUID 4d81c146-56e1-45d2-b0e4-75d0acec8102 which can be used as unique global reference for Tdrop in MISP communities and other software using the MISP galaxy

Troy

Internal MISP references

UUID 9825aa1f-6414-4f26-8487-605dd6c718d1 which can be used as unique global reference for Troy in MISP communities and other software using the MISP galaxy

Tdrop2

Internal MISP references

UUID aff99aad-5231-4f14-8e68-67e87fb13b5c which can be used as unique global reference for Tdrop2 in MISP communities and other software using the MISP galaxy

ZXShell

ZxShell is a remote access trojan (RAT). It was developed in 2006 by the persona "LZX", who then publicly released the source code in 2007

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ZXShell.

Known Synonyms
Sensode
Internal MISP references

UUID 5b9dc67e-bae4-44f3-b58d-6d842a744104 which can be used as unique global reference for ZXShell in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

T9000

Internal MISP references

UUID 66575fb4-7f92-42d8-8c47-e68a26413081 which can be used as unique global reference for T9000 in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

T5000

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular T5000.

Known Synonyms
Plat1
Internal MISP references

UUID e957f773-f6d2-410f-8163-5f0c17a7bde2 which can be used as unique global reference for T5000 in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Taidoor

Internal MISP references

UUID cda7d605-23d0-4f93-a585-1276f094c04a which can be used as unique global reference for Taidoor in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Swisyn

Internal MISP references

UUID 1688dc7a-0ef9-49a9-a467-5231a5552b41 which can be used as unique global reference for Swisyn in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Rekaf

Internal MISP references

UUID cfe948c6-b8a6-437a-9d82-d81660e0287b which can be used as unique global reference for Rekaf in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Scieron

Internal MISP references

UUID 267bf78e-f430-47b6-8ba0-1ae31698c711 which can be used as unique global reference for Scieron in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

SkeletonKey

Internal MISP references

UUID 7709fedd-5083-4b54-bcd8-af3f76f6d171 which can be used as unique global reference for SkeletonKey in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Skyipot

Internal MISP references

UUID 72e2b7b5-2718-4942-9ca2-17fa6730261f which can be used as unique global reference for Skyipot in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Spindest

Internal MISP references

UUID 447735ac-82e4-4c97-b048-56b7e47203ef which can be used as unique global reference for Spindest in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Preshin

Internal MISP references

UUID d87326a3-fb94-448c-9615-8ec036c1df3a which can be used as unique global reference for Preshin in MISP communities and other software using the MISP galaxy

Oficla

Internal MISP references

UUID b3ea33fd-eaa0-4bab-9bd0-12534c9aa987 which can be used as unique global reference for Oficla in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

PCClient RAT

Internal MISP references

UUID f68d2200-cb9d-42de-9e5e-be2a8f674c5e which can be used as unique global reference for PCClient RAT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Plexor

Internal MISP references

UUID 8fb00a59-0dec-4d7f-bd53-9826b3929f39 which can be used as unique global reference for Plexor in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Mongall

Internal MISP references

UUID aa3aa21f-bc4e-4fb6-acd2-f4b6de482dfe which can be used as unique global reference for Mongall in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

NeD Worm

Internal MISP references

UUID eedcf785-d011-4e17-96c4-6ff39138ada0 which can be used as unique global reference for NeD Worm in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

NewCT

Internal MISP references

UUID c5e3766c-9527-47c3-94db-f10de2c56248 which can be used as unique global reference for NewCT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Nflog

Internal MISP references

UUID b2ec2dca-5d49-4efa-9a9e-75126346d1ed which can be used as unique global reference for Nflog in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Janicab

Internal MISP references

UUID c3c20c4b-e12a-42e5-960a-eea4644014f4 which can be used as unique global reference for Janicab in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Jripbot

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Jripbot.

Known Synonyms
Jiripbot
Internal MISP references

UUID 05e2ccec-7050-47cf-b925-50907f57c639 which can be used as unique global reference for Jripbot in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Jolob

Internal MISP references

UUID 4d4528ff-6260-4b5d-b2ea-6e11ca02c396 which can be used as unique global reference for Jolob in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

IsSpace

Internal MISP references

UUID b9707a57-d15f-4937-b022-52cc17f6783f which can be used as unique global reference for IsSpace in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Emotet

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Emotet.

Known Synonyms
Geodo
Internal MISP references

UUID 3f7616bd-f1de-46ee-87c2-43c0c2edaa28 which can be used as unique global reference for Emotet in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Hoardy

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Hoardy.

Known Synonyms
BS2005
Hoarde
Phindolp
Internal MISP references

UUID 25cd01bc-1346-4415-8f8d-d3656309ef6b which can be used as unique global reference for Hoardy in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Htran

HUC Packet Transmitter (HTran) is a proxy tool, used to intercept and redirect Transmission Control Protocol (TCP) connections from the local host to a remote host. This makes it possible to obfuscate an attacker's communications with victim networks. The tool has been freely available on the internet since at least 2009. HTran facilitates TCP connections between the victim and a hop point controlled by an attacker. Malicious cyber actors can use this technique to redirect their packets through multiple compromised hosts running HTran, to gain greater access to hosts in a network

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Htran.

Known Synonyms
HTran
HUC Packet Transmitter
Internal MISP references

UUID f3bfe513-2a65-49b5-9d64-a66541dce697 which can be used as unique global reference for Htran in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

HTTPBrowser

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HTTPBrowser.

Known Synonyms
TokenControl
Internal MISP references

UUID 08e2c9ef-aa62-429f-a6e5-e901ff6883cd which can be used as unique global reference for HTTPBrowser in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Disgufa

Internal MISP references

UUID 3a57bb24-b493-4698-bf46-6465c6cf5446 which can be used as unique global reference for Disgufa in MISP communities and other software using the MISP galaxy

Elirks

Internal MISP references

UUID c0ea7b89-d246-4eb7-8de4-b4e17e135051 which can be used as unique global reference for Elirks in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Snifula

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Snifula.

Known Synonyms
Ursnif
Internal MISP references

UUID 75b01a1e-3269-4f4c-bdba-37af4e9c3f54 which can be used as unique global reference for Snifula in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Aumlib

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Aumlib.

Known Synonyms
Graftor
Yayih
mswab
Internal MISP references

UUID f3ac3d86-0fa2-4049-bfbc-1970004b8d32 which can be used as unique global reference for Aumlib in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

CTRat

Internal MISP references

UUID f78cfa32-a629-421e-94f7-1e696bba2892 which can be used as unique global reference for CTRat in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Emdivi

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Emdivi.

Known Synonyms
Newsripper
Internal MISP references

UUID a8395aae-1496-417d-98ee-3ecbcd9a94a0 which can be used as unique global reference for Emdivi in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Etumbot

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Etumbot.

Known Synonyms
Exploz
RIPTIDE
Specfix
Internal MISP references

UUID 91583583-95c0-444e-8175-483cbebc640b which can be used as unique global reference for Etumbot in MISP communities and other software using the MISP galaxy

External references
  • www.arbornetworks.com/asert/wp-content/uploads/2014/06/ASERT-Threat-Intelligence-Brief-2014-07-Illuminating-Etumbot-APT.pdf
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Fexel

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Fexel.

Known Synonyms
Loneagent
Internal MISP references

UUID ba992105-373e-484a-ac81-2464deba93b7 which can be used as unique global reference for Fexel in MISP communities and other software using the MISP galaxy

Associated metadata
Metadata key Value

Fysbis

Internal MISP references

UUID bb929d1d-de95-4c3d-be79-55db3152dba1 which can be used as unique global reference for Fysbis in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Hikit

Internal MISP references

UUID 06953055-92ed-4936-8ffd-d9d72ab6bef6 which can be used as unique global reference for Hikit in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Hancitor

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Hancitor.

Known Synonyms
Chanitor
Pony
Tordal
Internal MISP references

UUID ff0404a1-465f-4dd5-8b66-ee773628ca64 which can be used as unique global reference for Hancitor in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Ruckguv

Internal MISP references

UUID d70bd6a8-5fd4-42e8-8e39-fb18daeccdb2 which can be used as unique global reference for Ruckguv in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

HerHer Trojan

Internal MISP references

UUID 0798f8d2-1099-4122-8735-5a116264d3db which can be used as unique global reference for HerHer Trojan in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Helminth backdoor

Internal MISP references

UUID 7bc1110b-fdc5-4501-a19b-e86304da4eb9 which can be used as unique global reference for Helminth backdoor in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

HDRoot

Internal MISP references

UUID d2c1a439-585a-48bc-8176-c0c46dfac270 which can be used as unique global reference for HDRoot in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

IRONGATE

Internal MISP references

UUID 5514e486-6158-40d8-b258-047938b8ee20 which can be used as unique global reference for IRONGATE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

ShimRAT

Internal MISP references

UUID 487f26a5-8531-4ec6-bfa4-691834b156b8 which can be used as unique global reference for ShimRAT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

X-Agent

APT28's second-stage persistent macOS backdoor. This backdoor component is known to have a modular structure featuring various espionage functionalities, such as key-logging, screen grabbing and file exfiltration. This component is available for Osx, Windows, Linux and iOS operating systems.

Xagent is a modular backdoor with spying functionalities such as keystroke logging and file exfiltration. Xagent is the group’s flagship backdoor and heavily used in their operations. Early versions for Linux and Windows were seen years ago, then in 2015 an iOS version came out. One year later, an Android version was discovered and finally, in the beginning of 2017, an Xagent sample for OS X was described.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular X-Agent.

Known Synonyms
XAgent
Internal MISP references

UUID 3e2c99f9-66cd-48be-86e9-d7c1c164d87c which can be used as unique global reference for X-Agent in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

X-Tunnel

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular X-Tunnel.

Known Synonyms
XTunnel
Internal MISP references

UUID 6d180bd7-3c77-4faf-b98b-dc2ab5f49101 which can be used as unique global reference for X-Tunnel in MISP communities and other software using the MISP galaxy

Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Foozer

Internal MISP references

UUID e4137f66-be82-4da7-96e6-e37ab33ea34f which can be used as unique global reference for Foozer in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

WinIDS

Internal MISP references

UUID 82875947-fafb-467a-82df-0d2e37111b97 which can be used as unique global reference for WinIDS in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

DownRange

Internal MISP references

UUID 56349213-b73e-4a30-8188-08de1a77b960 which can be used as unique global reference for DownRange in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Mad Max

Internal MISP references

UUID d3d56dd0-3409-470a-958b-a865fdd158f9 which can be used as unique global reference for Mad Max in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Crimson

Crimson is malware used as part of a campaign known as Operation Transparent Tribe that targeted Indian diplomatic and military victims

Internal MISP references

UUID 858edfb8-793a-430b-8acc-4310e7d2f0d3 which can be used as unique global reference for Crimson in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

Prikormka

Operation Groundbait based on our research into the Prikormka malware family. This includes detailed technical analysis of the Prikormka malware family and its spreading mechanisms, and a description of the most noteworthy attack campaigns.

Internal MISP references

UUID 67ade442-63f2-4319-bdcd-d2564b963ed6 which can be used as unique global reference for Prikormka in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

NanHaiShu

This whitepaper details a malicious program we identify as NanHaiShu. Based on our analysis, the threat actor behind this malware targets government and private-sector organizations.

Internal MISP references

UUID 7abd6950-7a07-4d9e-ade1-62414fa50619 which can be used as unique global reference for NanHaiShu in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Umbreon

Umbreon (sharing the same name as the Pokémon) targets Linux systems, including systems running both Intel and ARM processors, expanding the scope of this threat to include embedded devices as well.

Internal MISP references

UUID 2a18f5dd-40fc-444b-a7c6-85f94b3eee13 which can be used as unique global reference for Umbreon in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Odinaff

Odinaff is typically deployed in the first stage of an attack, to gain a foothold onto the network, providing a persistent presence and the ability to install additional tools onto the target network. These additional tools bear the hallmarks of a sophisticated attacker which has plagued the financial industry since at least 2013–Carbanak. This new wave of attacks has also used some infrastructure that has previously been used in Carbanak campaigns.

Internal MISP references

UUID e2fa7aea-fb33-4efc-b61b-ccae71b32e7d which can be used as unique global reference for Odinaff in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Hworm

Unit 42 has observed a new version of Hworm (or Houdini) being used within multiple attacks. This blog outlines technical details of this new Hworm version and documents an attack campaign making use of the backdoor. Of the samples used in this attack, the first we observed were June 2016, while as-of publication we were still seeing attacks as recently as mid-October, suggesting that this is likely an active, ongoing campaign.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Hworm.

Known Synonyms
Houdini
Internal MISP references

UUID e5f7bb36-c982-4f5a-9b29-ab73d2c5f70e which can be used as unique global reference for Hworm in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Backdoor.Dripion

Backdoor.Dripion was custom developed, deployed in a highly targeted fashion, and used command and control servers disguised as antivirus company websites.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Backdoor.Dripion.

Known Synonyms
Dripion
Internal MISP references

UUID 9dec36a3-b7df-477d-8f38-90aed47ca7cf which can be used as unique global reference for Backdoor.Dripion in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Adwind

Adwind is a backdoor written purely in Java that targets system supporting the Java runtime environment. Commands that can be used, among other things, to display messages on the system, open URLs, update the malware, download/execute files, and download/load plugins. A significant amount of additional functionality can be provided through downloadable plugins, including such things as remote control options and shell command execution.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Adwind.

Known Synonyms
AlienSpy
Backdoor:Java/Adwind
Frutas
JSocket
Sockrat
Unrecom
jRat
Internal MISP references

UUID ab4694d6-7043-41f2-b328-d93bec9c1b22 which can be used as unique global reference for Adwind in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Bedep

Internal MISP references

UUID 066f8ad3-0c99-43eb-990c-8fae2c232f62 which can be used as unique global reference for Bedep in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Cromptui

Internal MISP references

UUID c4d80484-9486-4d5f-95f3-f40cc2de45ea which can be used as unique global reference for Cromptui in MISP communities and other software using the MISP galaxy

Dridex

Dridex is a strain of banking malware that leverages macros in Microsoft Office to infect systems. Once a computer has been infected, Dridex attackers can steal banking credentials and other personal information on the system to gain access to the financial records of a user.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Dridex.

Known Synonyms
Cridex
Internal MISP references

UUID 276c2c2e-09da-44cf-a3f7-806b3feb41da which can be used as unique global reference for Dridex in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Fareit

Internal MISP references

UUID 652b5242-b790-4695-ad0e-b79bbf78f351 which can be used as unique global reference for Fareit in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Gafgyt

Internal MISP references

UUID 5fe338c6-723e-43ed-8165-43d95fa93689 which can be used as unique global reference for Gafgyt in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Gamarue

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gamarue.

Known Synonyms
Andromeda
Internal MISP references

UUID b9f00c61-6cd1-4112-a632-c8d3837a7ddd which can be used as unique global reference for Gamarue in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Necurs

The Necurs botnet is a distributor of many pieces of malware, most notably Locky.

Internal MISP references

UUID 97d34770-44cc-4ecb-bdce-ba11581c0e2a which can be used as unique global reference for Necurs in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Palevo

Internal MISP references

UUID af0ea2b8-97ae-4ec1-a2c5-8f5dd0c9537b which can be used as unique global reference for Palevo in MISP communities and other software using the MISP galaxy

Akbot

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Akbot.

Known Synonyms
PinkSlipBot
Qakbot
Qbot
Internal MISP references

UUID ac2ff27d-a7cb-46fe-ae32-cfe571dc614d which can be used as unique global reference for Akbot in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Upatre

Upatre is a Trojan downloader that is used to set up other threats on the victim's PC. Upatre has been used recently in several high profile Trojan attacks involving the Gameover Trojan.

Internal MISP references

UUID 99d9110d-85a4-4819-9f85-05e4b73aa5f3 which can be used as unique global reference for Upatre in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Vawtrak

Vawtrak is an information stealing malware family that is primarily used to gain unauthorised access to bank accounts through online banking websites.

Internal MISP references

UUID e95dd1ba-7485-4c02-bf2e-14beedbcf053 which can be used as unique global reference for Vawtrak in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Empire

Empire is a pure PowerShell post-exploitation agent built on cryptologically-secure communications and a flexible architecture. Empire implements the ability to run PowerShell agents without needing powershell.exe, rapidly deployable post-exploitation modules ranging from key loggers to Mimikatz, and adaptable communications to evade network detection, all wrapped up in a usability-focused framework

Internal MISP references

UUID 525ce93a-76a1-441a-9c45-0eac64d0ed12 which can be used as unique global reference for Empire in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Explosive

Beginning in late 2012, a carefully orchestrated attack campaign we call Volatile Cedar has been targeting individuals, companies and institutions worldwide. This campaign, led by a persistent attacker group, has successfully penetrated a large number of targets using various attack techniques, and specifically, a custom-made malware implant codenamed Explosive.

Internal MISP references

UUID 0155c3b1-8c7c-4176-aeda-68678dd99992 which can be used as unique global reference for Explosive in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

KeyBoy

The actors used a new version of “KeyBoy,” a custom backdoor first disclosed by researchers at Rapid7 in June 2013. Their work outlined the capabilities of the backdoor, and exposed the protocols and algorithms used to hide the network communication and configuration data

Internal MISP references

UUID 74167065-90b3-4c29-807a-79b6f098e45b which can be used as unique global reference for KeyBoy in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Yahoyah

The attacks in this case are associated with a campaign called Tropic Trooper, which has been active since at least 2011 and is known for heavily targeting Taiwan. One of the attacks used their known Yahoyah malware...

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Yahoyah.

Known Synonyms
W32/Seeav
Internal MISP references

UUID 2a16a1d4-a098-4f17-80f3-3cfc6c60b539 which can be used as unique global reference for Yahoyah in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Tartine

Delphi RAT used by Sofacy.

Internal MISP references

UUID 67f0b6cb-a484-4b8c-aacb-88a7238568b0 which can be used as unique global reference for Tartine in MISP communities and other software using the MISP galaxy

Mirai

Mirai (Japanese for "the future") is malware that turns computer systems running Linux into remotely controlled "bots", that can be used as part of a botnet in large-scale network attacks. It primarily targets online consumer devices such as remote cameras and home routers. The Mirai botnet has been used in some of the largest and most disruptive distributed denial of service (DDoS) attacks, including an attack on 20 September 2016 on computer security journalist Brian Krebs's web site, an attack on French web host OVH and the October 2016 Dyn cyberattack.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mirai.

Known Synonyms
Linux/Mirai
Internal MISP references

UUID dcbf1aaa-1fdd-4bfc-a35e-145ffdfb5ac5 which can be used as unique global reference for Mirai in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Masuta

IoT malware based on Mirai but slightly improved.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Masuta.

Known Synonyms
PureMasuta
Internal MISP references

UUID 1d4dec2c-915a-4fef-ba7a-633421bd0848 which can be used as unique global reference for Masuta in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

BASHLITE

Internal MISP references

UUID 55f8fb60-6339-4bc2-baa0-41e698e11f95 which can be used as unique global reference for BASHLITE in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

BlackEnergy

BlackEnergy is a trojan which has undergone significant functional changes since it was first publicly analysed by Arbor Networks in 2007. It has evolved from a relatively simple DDoS trojan into a relatively sophisticated piece of modern malware with a modular architecture, making it a suitable tool for sending spam and for online bank fraud, as well as for targeted attacks. BlackEnergy version 2, which featured rootkit techniques, was documented by SecureWorks in 2010. The targeted attacks recently discovered are proof that the trojan is still alive and kicking in 2014. We provide a technical analysis of the BlackEnergy family, focusing on novel functionality and the differences introduced by new lite variants. We describe the most notable aspects of the malware, including its techniques for bypassing UAC, defeating the signed driver requirement in Windows and a selection of BlackEnergy2 plug-ins used for parasitic file infections, network discovery and remote code execution and data collection.

Internal MISP references

UUID 5a22cad7-65fa-4b7a-a7aa-7915a6101efa which can be used as unique global reference for BlackEnergy in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Trojan.Seaduke

Trojan.Seaduke is a Trojan horse that opens a back door on the compromised computer. It may also download potentially malicious files.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Trojan.Seaduke.

Known Synonyms
Seaduke
Internal MISP references

UUID 3449215f-2650-48bb-a4fb-6549654cbccc which can be used as unique global reference for Trojan.Seaduke in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Backdoor.Tinybaron

Internal MISP references

UUID 2b6b35fb-2ed4-46ce-b603-62ca2b9b2812 which can be used as unique global reference for Backdoor.Tinybaron in MISP communities and other software using the MISP galaxy

Incognito RAT

Internal MISP references

UUID 307803df-6537-4e4d-a1c8-f219f278e564 which can be used as unique global reference for Incognito RAT in MISP communities and other software using the MISP galaxy

DownRage

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DownRage.

Known Synonyms
Carberplike
Internal MISP references

UUID ab5c4362-c369-4c78-985d-04ba1226ea32 which can be used as unique global reference for DownRage in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

GeminiDuke

GeminiDuke is malware that was used by APT29 from 2009 to 2012.

Internal MISP references

UUID 6a28a648-30c0-4d1d-bd67-81a8dc6486ba which can be used as unique global reference for GeminiDuke in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Zeus

Trojan.Zbot, also called Zeus, is a Trojan horse that attempts to steal confidential information from the compromised computer. It may also download configuration files and updates from the Internet. The Trojan is created using a Trojan-building toolkit.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Zeus.

Known Synonyms
Trojan.Zbot
Zbot
Internal MISP references

UUID 0ce448de-c2bb-4c6e-9ad7-c4030f02b4d7 which can be used as unique global reference for Zeus in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Shifu

Shifu is a Banking Trojan first discovered in 2015. Shifu is based on the Shiz source code which incorporated techniques used by Zeus. Attackers use Shifu to steal credentials for online banking websites around the world, starting in Russia but later including the UK, Italy, and others.

Internal MISP references

UUID 67d712c8-d254-4820-83fa-9a892b87923b which can be used as unique global reference for Shifu in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Shiz

The new variant of the Shiz Trojan malware targets mission-critical enterprise resource planning (ERP) applications — particularly SAP users.

Internal MISP references

UUID e6085ce0-af6d-41f7-8bcb-7f2eed246941 which can be used as unique global reference for Shiz in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

MM Core

Also known as “BaneChant”, MM Core is a file-less APT which is executed in memory by a downloader component. It was first reported in 2013 under the version number “2.0-LNK” where it used the tag “BaneChant” in its command-and-control (C2) network request. A second version “2.1-LNK” with the network tag “StrangeLove” was discovered shortly after.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MM Core.

Known Synonyms
BaneChant
BigBoss
MM Core backdoor
SillyGoose
StrangeLove
Internal MISP references

UUID 74bd8c09-73d5-4ad8-ab1f-e94a4853c936 which can be used as unique global reference for MM Core in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Shamoon

Shamoon,[a] also known as Disttrack, is a modular computer virus discovered by Seculert[1] in 2012, targeting recent NT kernel-based versions of Microsoft Windows. The virus has been used for cyber espionage in the energy sector.[2][3][4] Its discovery was announced on 16 August 2012 by Symantec,[3] Kaspersky Lab,[5] and Seculert.[6] Similarities have been highlighted by Kaspersky Lab and Seculert between Shamoon and the Flame malware.[5][6]

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Shamoon.

Known Synonyms
DistTrack
Internal MISP references

UUID 776b1849-8d5b-4762-8ba1-cbbaddb4ce3a which can be used as unique global reference for Shamoon in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

GhostAdmin

According to MalwareHunterTeam and other researchers that have looked at the malware's source code, GhostAdmin seems to be a reworked version of CrimeScene, another botnet malware family that was active around 3-4 years ago.

Internal MISP references

UUID a68f1b43-c742-4f90-974d-2e74ec703e44 which can be used as unique global reference for GhostAdmin in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

EyePyramid Malware

Two Italians referred to as the “Occhionero brothers” have been arrested and accused of using malware and a carefully-prepared spear-phishing scheme to spy on high-profile politicians and businessmen. This case has been called “EyePyramid”, which we first discussed last week. (Conspiracy theories aside, the name came from a domain name and directory path that was found during the research.)

Internal MISP references

UUID 52c2499f-c74f-4bab-bad2-c278e798654c which can be used as unique global reference for EyePyramid Malware in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
country IT

LuminosityLink is a malware family costing $40 that purports to be a system administration utility

Internal MISP references

UUID f586d3e4-39fc-489a-808b-03f590bfe092 which can be used as unique global reference for LuminosityLink in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Flokibot

Floki Bot, described recently by Dr. Peter Stephenson from SC Magazine, is yet another bot based on the leaked Zeus code. However, the author came up with various custom modifications that makes it more interesting.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Flokibot.

Known Synonyms
Floki
Floki Bot
Internal MISP references

UUID 8034978b-3a32-4662-b1bf-b525e59e469f which can be used as unique global reference for Flokibot in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

ZeroT

Most recently, we have observed the same group targeting military and aerospace interests in Russia and Belarus. Since the summer of 2016, this group began using a new downloader known as ZeroT to install the PlugX remote access Trojan (RAT) and added Microsoft Compiled HTML Help (.chm) as one of the initial droppers delivered in spear-phishing emails.

Internal MISP references

UUID ff00fa92-b32e-46b6-88ca-98357ebe3f54 which can be used as unique global reference for ZeroT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

StreamEx

Cylance dubbed this family of malware StreamEx, based upon a common exported function used across all samples ‘stream’, combined with the dropper functionality to append ‘ex’ to the DLL file name. The StreamEx family has the ability to access and modify the user’s file system, modify the registry, create system services, enumerate process and system information, enumerate network resources and drive types, scan for security tools such as firewall products and antivirus products, change browser security settings, and remotely execute commands. The malware documented in this post was predominantly 64-bit, however, there are 32-bit versions of the malware in the wild.

Internal MISP references

UUID 9991ace8-1a62-498c-a9ef-19d474deb505 which can be used as unique global reference for StreamEx in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

adzok

Remote Access Trojan

Internal MISP references

UUID d08201b8-9774-41a1-abdb-c7f3828139b0 which can be used as unique global reference for adzok in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

albertino

Remote Access Trojan

Internal MISP references

UUID 18c31de5-41b3-4a92-a6ee-23b74cc2797d which can be used as unique global reference for albertino in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

arcom

Remote Access Trojan

Internal MISP references

UUID 00dcba51-126f-4758-8273-9770ddf9031c which can be used as unique global reference for arcom in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

blacknix

Remote Access Trojan

Internal MISP references

UUID 0a5d5825-0ab9-48ff-a5d9-b6b131b65833 which can be used as unique global reference for blacknix in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

bluebanana

Remote Access Trojan

Internal MISP references

UUID df7deaa3-2a2c-4460-8674-20ec24e89fba which can be used as unique global reference for bluebanana in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

bozok

Remote Access Trojan

Internal MISP references

UUID cff2e174-52b8-4304-903a-012f97d70b7c which can be used as unique global reference for bozok in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

clientmesh

Remote Access Trojan

Internal MISP references

UUID 26785174-0b89-4cec-9ed0-5a72a0ff4c49 which can be used as unique global reference for clientmesh in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

cybergate

Remote Access Trojan

Internal MISP references

UUID f6e6540e-c21f-4202-ac46-185e735215db which can be used as unique global reference for cybergate in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

darkcomet

Remote Access Trojan

Internal MISP references

UUID 15949ecb-1f2b-4f59-9cf7-5751694e8fba which can be used as unique global reference for darkcomet in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

darkrat

Remote Access Trojan

Internal MISP references

UUID c9e6e42a-65c0-418e-ab77-09bcdb1214a3 which can be used as unique global reference for darkrat in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

gh0st

Remote Access Trojan

Internal MISP references

UUID 1b1ae63f-bcee-4aba-8994-6c60cee5e16f which can be used as unique global reference for gh0st in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

greame

Remote Access Trojan

Internal MISP references

UUID 43e400b3-918b-4a2c-9a69-7166c81a835b which can be used as unique global reference for greame in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

hawkeye

Remote Access Trojan

Internal MISP references

UUID 3edd9d1b-e15d-4411-a67f-01e04701e95d which can be used as unique global reference for hawkeye in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

javadropper

Remote Access Trojan

Internal MISP references

UUID 3a80cc5e-ae91-4aa4-aa2b-8f538861acbe which can be used as unique global reference for javadropper in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

lostdoor

Remote Access Trojan

Internal MISP references

UUID 3fcebce8-fb31-4edb-ae88-7fb0d90d440c which can be used as unique global reference for lostdoor in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

luxnet

Remote Access Trojan

Internal MISP references

UUID df6ccb07-a26c-427a-9d93-5fed2609a1d4 which can be used as unique global reference for luxnet in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

pandora

Remote Access Trojan

Internal MISP references

UUID 2c215062-5739-4859-bd82-9639ae1d1756 which can be used as unique global reference for pandora in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

poisonivy

Remote Access Trojan

Internal MISP references

UUID e336aeba-b61a-44e0-a0df-cd52a5839db5 which can be used as unique global reference for poisonivy in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

predatorpain

Remote Access Trojan

Internal MISP references

UUID 6762975d-ddbc-4871-ab14-4796c9f38307 which can be used as unique global reference for predatorpain in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

punisher

Remote Access Trojan

Internal MISP references

UUID 0d8d212a-d327-406e-8954-5b20158a9966 which can be used as unique global reference for punisher in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

qrat

Remote Access Trojan

Internal MISP references

UUID c3a784ee-cef7-4604-a5ba-ec7b193a5152 which can be used as unique global reference for qrat in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

shadowtech

Remote Access Trojan

Internal MISP references

UUID d5e53ee4-1114-4801-83c9-58c633049aff which can be used as unique global reference for shadowtech in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

smallnet

Remote Access Trojan

Internal MISP references

UUID 73ee15e9-ffb3-496d-ae65-fad50e675bdd which can be used as unique global reference for smallnet in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

spygate

Remote Access Trojan

Internal MISP references

UUID 408ff7f3-f30c-481f-a3e7-2c69b375f7d9 which can be used as unique global reference for spygate in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

template

Remote Access Trojan

Internal MISP references

UUID 244be9e7-4f68-4fd8-9abd-ee6ca591aa00 which can be used as unique global reference for template in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

tapaoux

Remote Access Trojan

Internal MISP references

UUID b7b4c682-090b-4da2-abc2-541fd3157579 which can be used as unique global reference for tapaoux in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

vantom

Remote Access Trojan

Internal MISP references

UUID aba90e76-ce56-4660-a498-90eeb1f0195b which can be used as unique global reference for vantom in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

virusrat

Remote Access Trojan

Internal MISP references

UUID aa054c62-3595-4c65-97ee-209029cc6004 which can be used as unique global reference for virusrat in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

xena

Remote Access Trojan

Internal MISP references

UUID 87596188-4c1f-494c-8713-21d5fa062580 which can be used as unique global reference for xena in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

xtreme

Remote Access Trojan

Internal MISP references

UUID 2d4e2910-4b25-4562-ad88-b35dd678a117 which can be used as unique global reference for xtreme in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

darkddoser

Remote Access Trojan

Internal MISP references

UUID 505629dc-6b81-424e-a452-164629a7a66f which can be used as unique global reference for darkddoser in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']

jspy

Remote Access Trojan

Internal MISP references

UUID 8abd10df-2c31-4895-8ec1-270603078f47 which can be used as unique global reference for jspy in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

xrat

Remote Access Trojan

Internal MISP references

UUID c76e2ee8-52d1-4a55-81df-5542d232ca32 which can be used as unique global reference for xrat in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['Backdoor']
Related clusters

To see the related clusters, click here.

PupyRAT

Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python.

Internal MISP references

UUID 4d6dec19-b0bc-4698-87ed-272823c45d95 which can be used as unique global reference for PupyRAT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

ELF_IMEIJ

Linux Arm malware spread via RFIs in cgi-bin scripts. This backdoor executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Internal MISP references

UUID acb6ae45-d4e2-48a1-ab72-86e72004c27a which can be used as unique global reference for ELF_IMEIJ in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

KHRAT

KHRAT is a small backdoor that has three exports (functions), namely, K1, K2, and K3. K1 checks if the current user is an administrator. If not, it uninstalls itself by calling the K2 function.

Internal MISP references

UUID 72b702d9-43c3-40b9-b004-8d0671225fb8 which can be used as unique global reference for KHRAT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Trochilus

The Trochilus RAT is a threatening RAT (Remote Access Trojan) that may evade many anti-virus programs. The Trochilus RAT is currently being used as part of an extended threat campaign in South East Asia. The first appearance of the Trochilus RAT in this campaign, which has been active since August of 2015, was first detected in the summer of 2015. The Trochilus RAT is currently being used against civil society organizations and government computers in the South East Asia region, particularly in attacks directed towards the government of Myanmar.

Internal MISP references

UUID 5e15e4ca-0e04-4af1-ab2a-779dbcad545d which can be used as unique global reference for Trochilus in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

MoonWind

The MoonWind sample used for this analysis was compiled with a Chinese compiler known as BlackMoon, the same compiler used for the BlackMoon banking Trojan. While a number of attributes match the BlackMoon banking Trojan, the malware is not the same. Both malware families were simply compiled using the same compiler, and it was the BlackMoon artifacts that resulted in the naming of the BlackMoon banking Trojan. But because this new sample is different from the BlackMoon banking Trojan,

Internal MISP references

UUID 76ec1827-68a1-488f-9899-2b788ea8db64 which can be used as unique global reference for MoonWind in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Chrysaor

Chrysaor is spyware believed to be created by NSO Group Technologies, specializing in the creation and sale of software and infrastructure for targeted attacks. Chrysaor is believed to be related to the Pegasus spyware that was first identified on iOS and analyzed by Citizen Lab and Lookout.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Chrysaor.

Known Synonyms
Pegasus
Pegasus spyware
Internal MISP references

UUID 9d7c772b-43f1-49cf-bc70-7a7cd2ed34c8 which can be used as unique global reference for Chrysaor in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Sathurbot

The trojan serves as a backdoor. It can be controlled remotely.

Internal MISP references

UUID 35849d8f-5bac-475b-82f8-7d555f37de12 which can be used as unique global reference for Sathurbot in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

AURIGA

The AURIGA malware family shares a large amount of functionality with the BANGAT backdoor. The malware family contains functionality for keystroke logging, creating and killing processes, performing file system and registry modifications, spawning interactive command shells, performing process injection, logging off the current user or shutting down the local machine. The AURIGA malware contains a driver component which is used to inject the malware DLL into other processes. This driver can also perform process and IP connection hiding. The malware family will create a copy of cmd.exe to perform its C2 activity, and replace the "Microsoft corp" strings in the cmd.exe binary with different values. The malware family typically maintains persistence through installing itself as a service.

Internal MISP references

UUID 316c87d4-4404-42ab-9887-f9e321aed93c which can be used as unique global reference for AURIGA in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

BANGAT

The BANGAT malware family shares a large amount of functionality with the AURIGA backdoor. The malware family contains functionality for keylogging, creating and killing processes, performing filesystem and registry modifications, spawning interactive command shells, performing process injection, logging off the current user or shutting down the local machine. In addition, the malware also implements a custom VNC like protocol which sends screenshots of the desktop to the C2 server and accepts keyboard and mouse input. The malware communicates to its C2 servers using SSL, with self signed SSL certificates. The malware family will create a copy of cmd.exe to perform its C2 activity, and replace the "Microsoft corp" strings in the cmd.exe binary with different values. The malware family typically maintains persistence through installing itself as a service.

Internal MISP references

UUID fa9b2176-1248-4d59-8da2-c31c7501a81d which can be used as unique global reference for BANGAT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

BISCUIT

BISCUIT provides attackers with full access to an infected host. BISCUIT capabilities include launching an interactive command shell, enumerating servers on a Windows network, enumerating and manipulating process, and transferring files. BISCUIT communicates using a custom protocol, which is then encrypted using SSL. Once installed BISCUIT will attempt to beacon to its command/control servers approximately every 10 or 30 minutes. It will beacon its primary server first, followed by a secondary server. All communication is encrypted with SSL (OpenSSL 0.9.8i).

Internal MISP references

UUID f1e05a12-ca50-41ab-a963-d7df5bcb141d which can be used as unique global reference for BISCUIT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

BOUNCER

BOUNCER will load an extracted DLL into memory, and then will call the DLL's dump export. The dump export is called with the parameters passed via the command line to the BOUNCER executable. It requires at least two arguments, the IP and port to send the password dump information. It can accept at most five arguments, including a proxy IP, port and an x.509 key for SSL authentication. The DLL backdoor has the capability to execute arbitrary commands, collect database and server information, brute force SQL login credentials, launch arbitrary programs, create processes and threads, delete files, and redirect network traffic.

Internal MISP references

UUID 52d9a474-fc37-48b5-8e39-4394194b9573 which can be used as unique global reference for BOUNCER in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

CALENDAR

This family of malware uses Google Calendar to retrieve commands and send results. It retrieves event feeds associated with Google Calendar, where each event contains commands from the attacker for the malware to perform. Results are posted back to the event feed. The malware authenticates with Google using the hard coded email address and passwords. The malware uses the deprecated ClientLogin authentication API from Google. The malware is registered as a service dll as a persistence mechanism. Artifacts of this may be found in the registry.

Internal MISP references

UUID e2c18713-0a95-4092-a0e9-76358512daad which can be used as unique global reference for CALENDAR in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

COMBOS

The COMBOS malware family is an HTTP based backdoor. The backdoor is capable of file upload, file download, spawning a interactive reverse shell, and terminating its own process. The backdoor may decrypt stored Internet Explorer credentials from the local system and transmit the credentials to the C2 server. The COMBOS malware family does not have any persistence mechanisms built into itself.

Internal MISP references

UUID fa38b79c-9774-45a0-831c-24c6c8d39a22 which can be used as unique global reference for COMBOS in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

COOKIEBAG

his family of malware is a backdoor capable of file upload and download as well as providing remote interactive shell access to the compromised machine. Communication with the Command & Control (C2) servers uses a combination of single-byte XOR and Base64 encoded data in the Cookie and Set-Cookie HTTP header fields. Communication with the C2 servers is over port 80. Some variants install a registry key as means of a persistence mechanism. The hardcoded strings cited include a string of a command in common with several other APT1 families.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular COOKIEBAG.

Known Synonyms
TROJAN.COOKIES
Internal MISP references

UUID 63be3d30-0c8d-4c0a-8eee-6c96880734cb which can be used as unique global reference for COOKIEBAG in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

DAIRY

Members of this malware family are backdoors that provide file downloading, process listing, process killing, and reverse shell capabilities. This malware may also add itself to the Authorized Applications list for the Windows Firewall.

Internal MISP references

UUID 2a56538f-7c21-44b3-b438-5baa025ed005 which can be used as unique global reference for DAIRY in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

GETMAIL

Members of this family of malware are utilities designed to extract email messages and attachments from Outlook PST files. One part of this utility set is an executable, one is a dll. The malware may create a registry artifact related to the executable.

Internal MISP references

UUID 5abd7dee-cca1-4bee-9b82-da3f9be2970b which can be used as unique global reference for GETMAIL in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

GDOCUPLOAD

This family of malware is a utility designed to upload files to Google Docs. Nearly all communications are with docs.google.com are SSL encrypted. The malware does not use Google's published API to interact with their services. The malware does not currently work with Google Docs. It does not detect HTTP 302 redirections and will get caught in an infinite loop attempting to parse results from Google that are not present.

Internal MISP references

UUID 4bb4320f-9379-43ba-ba8c-09dfece39000 which can be used as unique global reference for GDOCUPLOAD in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

GLOOXMAIL

GLOOXMAIL communicates with Google's Jabber/XMPP servers and authenticates with a hard-coded username and password. The malware can accept commands over XMPP that includes file upload and download, provide a remote shell, sending process listings, and terminating specified processes. The malware makes extensive use of the open source gloox library (http://camaya.net/gloox/, version 0.9.9.12) to communicate using the Jabber/XMPP protocol. All communications with the Google XMPP server are encrypted.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GLOOXMAIL.

Known Synonyms
TROJAN.GTALK
Internal MISP references

UUID a379f09b-5cec-4bdb-9735-125cef2de073 which can be used as unique global reference for GLOOXMAIL in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

GOGGLES

A family of downloader malware, that retrieves an encoded payload from a fixed location, usually in the form of a file with the .jpg extension. Some variants have just an .exe that acts as a downloader, others have an .exe launcher that runs as a service and then loads an associated .dll of the same name that acts as the downloader. This IOC is targeted at the downloaders only. After downloading the file, the malware decodes the downloaded payload into an .exe file and launches it. The malware usually stages the files it uses in the %TEMP% directory or the %WINDIR%\Temp directory.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GOGGLES.

Known Synonyms
TROJAN.FOXY
Internal MISP references

UUID 4bc55eb3-7c92-4668-a75a-d5e291387613 which can be used as unique global reference for GOGGLES in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

GREENCAT

Members of this family are full featured backdoors that communicates with a Web-based Command & Control (C2) server over SSL. Features include interactive shell, gathering system info, uploading and downloading files, and creating and killing processes, Malware in this family usually communicates with a hard-coded domain using SSL on port 443. Some members of this family rely on launchers to establish persistence mechanism for them. Others contains functionality that allows it to install itself, replacing an existing Windows service, and uninstall itself. Several variants use %SystemRoot%\Tasks or %WinDir%\Tasks as working directories, additional malware artifacts may be found there.

Internal MISP references

UUID 21a1d15c-acdd-49d1-aa8e-8d5b311024f0 which can be used as unique global reference for GREENCAT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

HACKFASE

This family of malware is a backdoor that provides reverse shell, process creation, system statistics collection, process enumeration, and process termination capabilities. This family is designed to be a service DLL and does not contain an installation mechanism. It usually communicates over port 443. Some variants use their own encryption, others use SSL.

Internal MISP references

UUID aef3e40b-d295-4663-a2d0-585512b3ae44 which can be used as unique global reference for HACKFASE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

HELAUTO

This family of malware is designed to operate as a service and provides remote command execution and file transfer capabilities to a fixed IP address or domain name. All communication with the C2 server happens over port 443 using SSL. This family can be installed as a service DLL. Some variants allow for uninstallation.

Internal MISP references

UUID 7c05c816-481f-499e-9545-d48b635dc2eb which can be used as unique global reference for HELAUTO in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

KURTON

This family of malware is a backdoor that tunnels its connection through a preconfigured proxy. The malware communicates with a remote command and control server over HTTPS via the proxy. The malware installs itself as a Windows service with a service name supplied by the attacker but defaults to IPRIP if no service name is provided during install.

Internal MISP references

UUID 616c7c32-110e-4bb3-8e99-4c2aeb8f8272 which can be used as unique global reference for KURTON in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

LIGHTBOLT

LIGHTBOLT is a utility with the ability to perform HTTP GET requests for a list of user-specified URLs. The responses of the HTTP requests are then saved as MHTML files, which are added to encrypted RAR files. LIGHTBOLT has the ability to use software certificates for authentication.

Internal MISP references

UUID 57e43779-0665-427c-abcb-997c1c0ced8d which can be used as unique global reference for LIGHTBOLT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

LIGHTDART

LIGHTDART is a tool used to access a pre-configured web page that hosts an interface to query a database or data set. The tool then downloads the results of a query against that web page to an encrypted RAR file. This RAR file (1.rar) is renamed and uploaded to an attacker controlled FTP server, or uploaded via an HTTP POST with a .jpg extension. The malware will execute this search once a day. The target webpage usually contains information useful to the attacker, which is updated on a regular basis. Examples of targeted information include weather information or ship coordinates.

Internal MISP references

UUID 986f6b0f-51f8-4f83-bb38-8354a83a7f32 which can be used as unique global reference for LIGHTDART in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

LONGRUN

LONGRUN is a backdoor designed to communicate with a hard-coded IP address and provide the attackers with a custom interactive shell. It supports file uploads and downloads, and executing arbitrary commands on the compromised machine. When LONGRUN executes, it first loads configuration data stored as an obfuscated string inside the PE resource section. The distinctive string thequickbrownfxjmpsvalzydg is used as part of the input to the decoding algorithm. When the configuration data string is decoded it is parsed and treated as an IP and port number. The malware then connects to the host and begins interacting with it over a custom protocol.

Internal MISP references

UUID 5a2fc164-f6cf-4528-b85f-f2319545c8ad which can be used as unique global reference for LONGRUN in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

MANITSME

This family of malware will beacon out at random intervals to the remote attacker. The attacker can run programs, execute arbitrary commands, and easily upload and download files. This IOC looks for both the dropper file and the backdoor.

Internal MISP references

UUID 25db921d-d753-4fb1-b51b-961d7fdae6f4 which can be used as unique global reference for MANITSME in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

MAPIGET

This malware utility is a set of two files that operate in conjunction to extract email messages and attachments from an Exchange server. In order to operate successfully, these programs require authentication credentials for a user on the Exchange server, and must be run from a machine joined to the domain that has Microsoft Outlook installed (or equivalent software that provides the Microsoft 'Messaging API' (MAPI) service).

Internal MISP references

UUID bf08965f-03a5-4cf6-83fb-8d3c9e9398ee which can be used as unique global reference for MAPIGET in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

MINIASP

This family of malware consists of backdoors that attempt to fetch encoded commands over HTTP. The malware is capable of downloading a file, downloading and executing a file, executing arbitrary shell commands, or sleeping a specified interval.

Internal MISP references

UUID ea9c7068-1c28-4826-a7d1-7ac04760e5c9 which can be used as unique global reference for MINIASP in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

NEWSREELS

The NEWSREELS malware family is an HTTP based backdoor. When first started, NEWSREELS decodes two strings from its resources section. These strings are both used as C2 channels, one URL is used as a beacon URL (transmitting) and the second URL is used to get commands (receiving). The NEWSREELS malware family is capable of performing file uploads, downloads, creating processes or creating an interactive reverse shell.

Internal MISP references

UUID 5abc6792-be17-48ee-a765-29cffa4242ee which can be used as unique global reference for NEWSREELS in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

SEASALT

The SEASALT malware family communicates via a custom binary protocol. It is capable of gathering some basic system information, file system manipulation, file upload and download, process creation and termination, and spawning an interactive reverse shell. The malware maintains persistence by installing itself as a service.

Internal MISP references

UUID 7429aaf8-85a8-4ae9-b583-c7eec0f5b0cb which can be used as unique global reference for SEASALT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

STARSYPOUND

STARSYPOUND provides an interactive remote shell over an obfuscated communications channel. When it is first run, it loads a string (from the executable PE resource section) containing the beacon IP address and port. The malware sends the beacon string "(SY)# " to the remote system, where is the hostname of the victim system. The remote host responds with a packet that also begins with the string "(SY)# cmd". This causes the malware to launch a new cmd.exe child process. Further communications are forwarded to the cmd.exe child process to execute. The commands sent to the shell and their responses are obfuscated when sent over the network.

Internal MISP references

UUID d0220108-48d7-4056-babc-189048f37a59 which can be used as unique global reference for STARSYPOUND in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

SWORD

This family of malware provides a backdoor over the network to the attackers. It is configured to connect to a single host and offers file download over HTTP, program execution, and arbitrary execution of commands through a cmd.exe instance.

Internal MISP references

UUID 96fb29fa-7c3a-4124-baf5-cc5f99b2a05f which can be used as unique global reference for SWORD in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

TABMSGSQL

This malware family is a full-featured backdoor capable of file uploading and downloading, arbitrary execution of programs, and providing a remote interactive command shell. All communications with the C2 server are sent over HTTP to a static URL, appending various URL parameters to the request. Some variants use a slightly different URL.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TABMSGSQL.

Known Synonyms
TROJAN LETSGO
Internal MISP references

UUID d5a4cbe7-81c9-4a52-80ee-07ca3f625844 which can be used as unique global reference for TABMSGSQL in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

TARSIP-ECLIPSE

The TARSIP malware family is a backdoor which communicates over encoded information in HTTPS headers. Typical TARSIP malware samples will only beacon out to their C2 servers if the C2 DNS address resolves to a specific address. The capability of TARSIP backdoors includes file uploading, file downloading, interactive command shells, process enumeration, process creation, process termination. The TARSIP-ECLIPSE family is distinguished by the presence of 'eclipse' in .pdb debug strings present in the malware samples. It does not provide a built in mechanism to maintain persistence.

Internal MISP references

UUID 049590f1-3f3a-4670-a341-d6d29fbb123f which can be used as unique global reference for TARSIP-ECLIPSE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

TARSIP-MOON

The TARSIP malware family is a backdoor which communicates over encoded information in HTTPS headers. Typical TARSIP malware samples will only beacon out to their C2 servers if the C2 DNS address resolves to a specific address. The capability of TARSIP backdoors includes file uploading, file downloading, interactive command shells, process enumeration, process creation, process termination. The TARSIP-MOON family is distinguished by the presence of 'moon' in .pdb debug strings present in the malware samples. It does not provide a built in mechanism to maintain persistence.

Internal MISP references

UUID dbce78ac-5729-4bd1-b7c0-6bc0344564bc which can be used as unique global reference for TARSIP-MOON in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

WARP

The WARP malware family is an HTTP based backdoor written in C++, and the majority of its code base is borrowed from source code available in the public domain. Network communications are implemented using the same WWW client library (w3c.cpp) available from www.dankrusi.com/file_69653F3336383837.html. The malware has system survey functionality (collects hostname, current user, system uptime, CPU speed, etc.) taken directly from the BO2K backdoor available from www.bo2k.com. It also contains the hard disk identification code found at www.winsim.com/diskid32/diskid32.cpp. When the WARP executing remote commands, the malware creates a copy of the ?%SYSTEMROOT%\system32\cmd.exe? file as '%USERPROFILE%\Temp\~ISUN32.EXE'. The version signature information of the duplicate executable is zeroed out. Some WARP variants maintain persistence through the use of DLL search order hijacking.

Internal MISP references

UUID 29917fb3-6c56-4659-a203-5885c4a8e70f which can be used as unique global reference for WARP in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

WEBC2-ADSPACE

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This family of malware is capable of downloading and executing a file. All variants represented here are the same file with different MD5 signatures. This malware attempts to contact its C2 once a week (Thursday at 10:00 AM). It looks for commands inside a set of HTML tags, part of which are in the File Strings indicator term below.

Internal MISP references

UUID 2d8043b4-48ef-4992-a04a-c342cbbb4f87 which can be used as unique global reference for WEBC2-ADSPACE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

WEBC2-AUSOV

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This malware family is a only a downloader which operates over the HTTP protocol with a hard-coded URL. If directed, it has the capability to download, decompress, and execute compressed binaries.

Internal MISP references

UUID e2a27431-28ea-42e3-a0cc-72f29828c292 which can be used as unique global reference for WEBC2-AUSOV in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

WEBC2-BOLID

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This family of malware is a backdoor capable of downloading files and updating its configuration. Communication with the command and control (C2) server uses a combination of single-byte XOR and Base64 encoded data wrapped in standard HTML tags. The malware family installs a registry key as a persistence mechanism.

Internal MISP references

UUID a601e1b0-c0bc-4665-9639-4dc5e588520c which can be used as unique global reference for WEBC2-BOLID in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

WEBC2-CLOVER

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The family of malware provides the attacker with an interactive command shell, the ability to upload and download files, execute commands on the system, list processes and DLLs, kill processes, and ping hosts on the local network. Responses to these commands are encrypted and compressed before being POSTed to the server. Some variants copy cmd.exe to Updatasched.exe in a temporary directory, and then may launch that in a process if an interactive shell is called. On initial invocation, the malware also attempts to delete previous copies of the Updatasched.exe file.

Internal MISP references

UUID d7fa0245-2cff-475f-9d8c-3728c83ac194 which can be used as unique global reference for WEBC2-CLOVER in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

WEBC2-CSON

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. Members of this family of malware act only as downloaders and droppers for other malware. They communicate with a hard-coded C2 server, reading commands embedded in HTML comment fields. Some variants are executables which act upon execution, others are DLLs which can be attached to services or loaded through search order hijacking.

Internal MISP references

UUID 950a8038-eeec-44a0-b3db-a557e5796416 which can be used as unique global reference for WEBC2-CSON in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

WEBC2-DIV

The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-DIV variant searches for the strings "div safe:" and " balance" to delimit encoded C2 information. If the decoded string begins with the letter "J" the malware will parse additional arguments in the decoded string to specify the sleep interval to use. WEBC2-DIV is capable of downloading a file, downloading and executing a file, or sleeping a specified interval.

Internal MISP references

UUID 54be66ea-fd26-4f25-b4af-d10d16fa919f which can be used as unique global reference for WEBC2-DIV in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

WEBC2-GREENCAT

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This malware is a variant on the GREENCAT family, using a fixed web C2. This family is a full featured backdoor which provides remote command execution, file transfer, process and service enumeration and manipulation. It installs itself persistently through the current user's registry Run key.

Internal MISP references

UUID bfe69071-17bf-466f-97fd-669b72053137 which can be used as unique global reference for WEBC2-GREENCAT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

WEBC2-HEAD

The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-HEAD variant communicates over HTTPS, using the system's SSL implementation to encrypt all communications with the C2 server. WEBC2-HEAD first issues an HTTP GET to the host, sending the Base64-encoded string containing the name of the compromised machine running the malware.

Internal MISP references

UUID 4ef97a7e-5686-44cb-ad91-7a393f32f39b which can be used as unique global reference for WEBC2-HEAD in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

WEBC2-KT3

The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-KT3 variant searches for commands in a specific comment tag. Network traffic starting with *!Kt3+v| may indicate WEBC2-KT3 activity.

Internal MISP references

UUID e2afc267-9674-4ca3-807f-47678fb40da4 which can be used as unique global reference for WEBC2-KT3 in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

WEBC2-QBP

The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-QBP variant will search for two strings in a HTML comment. The first will be "2010QBP " followed by " 2010QBP//--". Inside these tags will be a DES-encrypted string.

Internal MISP references

UUID 84f3bacf-abd5-445e-a98a-5b02f1eaac92 which can be used as unique global reference for WEBC2-QBP in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

WEBC2-RAVE

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This family of malware will set itself up as a service and connect out to a hardcoded web page and read a modified base64 string from this webpage. The later versions of this malware supports three commands (earlier ones are just downloaders or reverse shells). The first commands will sleep the malware for N number of hours. The second command will download a binary from the encoded HTML comment and execute it on the infected host. The third will spawn an encoded reverse shell to an attacker specified location and port.

Internal MISP references

UUID 9e36feee-e7d2-400a-960e-5f2bd6ac0c15 which can be used as unique global reference for WEBC2-RAVE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

WEBC2-TABLE

The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-TABLE variant looks for web pages containing 'background', 'align', and 'bgcolor' tags to be present in the requested Web page. If the data in these tags are formatted correctly, the malware will decode a second URL and a filename. This URL is then retrieved, written to the decoded filename and executed.

Internal MISP references

UUID 269fee27-f275-44e9-a0db-bebf14d2f83c which can be used as unique global reference for WEBC2-TABLE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

WEBC2-TOCK

The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-TABLE variant looks for web pages containing 'background', 'align', and 'bgcolor' tags to be present in the requested Web page. If the data in these tags are formatted correctly, the malware will decode a second URL and a filename. This URL is then retrieved, written to the decoded filename and executed.

Internal MISP references

UUID 3213c61f-100c-4174-b50b-c7e256ae5474 which can be used as unique global reference for WEBC2-TOCK in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

WEBC2-UGX

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. Members of this family of malware provide remote command shell and remote file download and execution capabilities. The malware downloads a web page containing a crafted HTML comment that subsequently contains an encoded command. The contents of this command tell the malware whether to download and execute a program, launch a reverse shell to a specific host and port number, or to sleep for a period of time.

Internal MISP references

UUID d155c213-02bd-4992-a410-a541a1c1eb40 which can be used as unique global reference for WEBC2-UGX in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

WEBC2-Y21K

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. Members of this family of backdoor malware talk to specific Web-based Command & Control (C2) servers. The backdoor has a limited command set, depending on version. It is primarily a downloader, but it classified as a backdoor because it can accept a limited command set, including changing local directories, downloading and executing additional files, sleeping, and connecting to a specific IP & port not initially included in the instruction set for the malware. Each version of the malware has at least one hardcoded URL to which it connects to receive its initial commands. This family of malware installs itself as a service, with the malware either being the executable run by the service, or the service DLL loaded by a legitimate service. The same core code is seen recompiled on different dates or with different names, but the same functionality. Key signatures include a specific set of functions (some of which can be used with the OS-provided rundll32.exe tool to install the malware as a service), and hardcoded strings used in communication with C2 servers to issue commands to the implant.

Internal MISP references

UUID 215f6352-324f-4735-9fda-ffec0daaa2d2 which can be used as unique global reference for WEBC2-Y21K in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

WEBC2-YAHOO

The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-YAHOO variant enters a loop where every ten minutes it attempts to download a web page that may contain an encoded URL. The encoded URL will be found in the pages returned inside an attribute named 'sb' or 'ex' within a tag named 'yahoo'. The embedded link can direct the malware to download and execute files.

Internal MISP references

UUID d49f372e-c4ee-47bd-bc98-e3877fabaf9e which can be used as unique global reference for WEBC2-YAHOO in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

HAYMAKER

HAYMAKER is a backdoor that can download and execute additional payloads in the form of modules. It also conducts basic victim profiling activity, collecting the computer name, running process IDs, %TEMP% directory path and version of Internet Explorer. It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string.

Internal MISP references

UUID d71604d2-a17e-4b4e-82be-19cb54f93161 which can be used as unique global reference for HAYMAKER in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

BUGJUICE

BUGJUICE is a backdoor that is executed by launching a benign file and then hijacking the search order to load a malicious dll into it. That malicious dll then loads encrypted shellcode from the binary, which is decrypted and runs the final BUGJUICE payload. BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2. It has the capability to find files, enumerate drives, exfiltrate data, take screenshots and provide a reverse shell.

Internal MISP references

UUID 90124cc8-1205-4e63-83ad-5c45a110b1e6 which can be used as unique global reference for BUGJUICE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

SNUGRIDE

SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests. Messages are encrypted using AES with a static key. The malware’s capabilities include taking a system survey, access to the filesystem, executing commands and a reverse shell. Persistence is maintained through a Run registry key.

Internal MISP references

UUID 6a42aa10-5b7e-43b0-8c58-414cdaeda453 which can be used as unique global reference for SNUGRIDE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

QUASARRAT

QUASARRAT is an open-source RAT available at https://github.com/quasar/QuasarRat . The versions used by APT10 (1.3.4.0, 2.0.0.0, and 2.0.0.1) are not available via the public GitHub page, indicating that APT10 has further customized the open source version. The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload. QUASARRAT is a fully functional .NET backdoor that has been used by multiple cyber espionage groups in the past. QUASARRAT is a publicly available Windows backdoor. It may visit a website, download, upload, and execute files. QUASARRAT may acquire system information, act as a remote desktop or shell, or remotely activate the webcam. The backdoor may also log keystrokes and steal passwords from commonly used browsers and FTP clients. QUASARRAT was originally named xRAT before it was renamed by the developers in August 2015. Availability: Public

Internal MISP references

UUID 4d58ad7d-b5ee-4efb-b6af-6c70aadb326a which can be used as unique global reference for QUASARRAT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

da Vinci RCS

Hacking Team’s "DaVinci" Remote Control System is able, the company says, to break encryption and allow law enforcement agencies to monitor encrypted files and emails (even ones encrypted with PGP), Skype and other Voice over IP or chat communication. It allows identification of the target’s location and relationships. It can also remotely activate microphones and cameras on a computer and works worldwide. Hacking Team claims that its software is able to monitor hundreds of thousands of computers at once, all over the country. Trojans are available for Windows, Mac, Linux, iOS, Android, Symbian and Blackberry.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular da Vinci RCS.

Known Synonyms
DaVinci
Morcut
Internal MISP references

UUID 37709067-e55e-473b-bb1c-312a27714d0c which can be used as unique global reference for da Vinci RCS in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

LATENTBOT

LATENTBOT, a new, highly obfuscated BOT that has been in the wild since mid-2013. It has managed to leave hardly any traces on the Internet, is capable of watching its victims without ever being noticed, and can even corrupt a hard disk, thus making a PC useless.

Internal MISP references

UUID 635d260f-39d9-4d3f-99ec-d2560cb5d694 which can be used as unique global reference for LATENTBOT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

FINSPY

Though we have not identified the targets, FINSPY is sold by Gamma Group to multiple nation-state clients, and we assess with moderate confidence that it was being used along with the zero-day to carry out cyber espionage.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FINSPY.

Known Synonyms
BlackOasis
Internal MISP references

UUID dd4358a4-7a43-42f7-8322-0f941ee61e57 which can be used as unique global reference for FINSPY in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

RCS Galileo

HackingTeam Remote Control System (RCS) Galileo hacking platform

Internal MISP references

UUID 8a15832a-2cb1-47cc-8916-c16a507f7154 which can be used as unique global reference for RCS Galileo in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

EARLYSHOVEL

RedHat 7.0 - 7.1 Sendmail 8.11.x exploit

Internal MISP references

UUID 80c7b1bf-c35f-4831-90ce-0699f6173f1b which can be used as unique global reference for EARLYSHOVEL in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

EBBISLAND (EBBSHAVE)

root RCE via RPC XDR overflow in Solaris 6, 7, 8, 9 & 10 (possibly newer) both SPARC and x86

Internal MISP references

UUID 370331a1-2178-4369-afb7-ce2da134a2ba which can be used as unique global reference for EBBISLAND (EBBSHAVE) in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

ECHOWRECKER

remote Samba 3.0.x Linux exploit

Internal MISP references

UUID 0381c40e-81c6-4a18-b5b6-48b7eef211c7 which can be used as unique global reference for ECHOWRECKER in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

EASYBEE

appears to be an MDaemon email server vulnerability

Internal MISP references

UUID 7f96b58d-0f41-46cd-8141-c53d2a03fb81 which can be used as unique global reference for EASYBEE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

EASYPI

an IBM Lotus Notes exploit that gets detected as Stuxnet

Internal MISP references

UUID 4f3df03f-336d-4a2b-a500-47e93a4259e6 which can be used as unique global reference for EASYPI in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

EWOKFRENZY

an exploit for IBM Lotus Domino 6.5.4 & 7.0.2

Internal MISP references

UUID c8fedb97-4f7e-48d1-8f2a-5e0562c1fba0 which can be used as unique global reference for EWOKFRENZY in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

EXPLODINGCAN

an IIS 6.0 exploit that creates a remote backdoor

Internal MISP references

UUID f843ef63-9e42-42d0-84a0-40d863985088 which can be used as unique global reference for EXPLODINGCAN in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

ETERNALROMANCE

a SMB1 exploit over TCP port 445 which targets XP, 2003, Vista, 7, Windows 8, 2008, 2008 R2, and gives SYSTEM privileges (MS17-010)

Internal MISP references

UUID b5c5174e-36a2-4b53-aed7-91b006514c8b which can be used as unique global reference for ETERNALROMANCE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

EDUCATEDSCHOLAR

a SMB exploit (MS09-050)

Internal MISP references

UUID 342a64db-f130-4ac2-96d2-a773fb2bf86d which can be used as unique global reference for EDUCATEDSCHOLAR in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

EMERALDTHREAD

a SMB exploit for Windows XP and Server 2003 (MS10-061)

Internal MISP references

UUID 32cd0bfb-9269-43ba-9c43-9fc484a30ad0 which can be used as unique global reference for EMERALDTHREAD in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

EMPHASISMINE

a remote IMAP exploit for IBM Lotus Domino 6.6.4 to 8.5.2

Internal MISP references

UUID 48393a71-3814-48ab-805b-a7914e006814 which can be used as unique global reference for EMPHASISMINE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

ENGLISHMANSDENTIST

Outlook Exchange WebAccess rules to trigger executable code on the client's side to send an email to other users

Internal MISP references

UUID ce484c02-b538-4351-ba7e-48c7d05c013f which can be used as unique global reference for ENGLISHMANSDENTIST in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

EPICHERO

0-day exploit (RCE) for Avaya Call Server

Internal MISP references

UUID 7120af74-6589-44a4-aee6-0f8fd3808d54 which can be used as unique global reference for EPICHERO in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

ERRATICGOPHER

SMBv1 exploit targeting Windows XP and Server 2003

Internal MISP references

UUID a82fa4a0-1904-4c03-9fc4-7cbcd255ce58 which can be used as unique global reference for ERRATICGOPHER in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

ETERNALSYNERGY

a SMBv3 remote code execution flaw for Windows 8 and Server 2012 SP0 (MS17-010)

Internal MISP references

UUID b4547fe9-25c9-40b6-9256-07f1ed7548c4 which can be used as unique global reference for ETERNALSYNERGY in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

ETERNALBLUE

SMBv2 exploit for Windows 7 SP1 (MS17-010)

Internal MISP references

UUID e5b14d3e-ae59-495e-bdcb-f9d876db3f87 which can be used as unique global reference for ETERNALBLUE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

ETERNALCHAMPION

a SMBv1 exploit

Internal MISP references

UUID 4aee9bfe-f01d-44ea-9edd-91ecad88413a which can be used as unique global reference for ETERNALCHAMPION in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

ESKIMOROLL

Kerberos exploit targeting 2000, 2003, 2008 and 2008 R2 domain controllers

Internal MISP references

UUID 4a8db2c4-04fb-49e0-b688-1bc5d8354072 which can be used as unique global reference for ESKIMOROLL in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

ESTEEMAUDIT

RDP exploit and backdoor for Windows Server 2003

Internal MISP references

UUID 5d9131be-c3bb-44ac-9c4d-19fcc97d2efd which can be used as unique global reference for ESTEEMAUDIT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

ECLIPSEDWING

RCE exploit for the Server service in Windows Server 2008 and later (MS08-067)

Internal MISP references

UUID 406ad0a9-b1fc-4edc-aa20-692a69f349a6 which can be used as unique global reference for ECLIPSEDWING in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

ETRE

exploit for IMail 8.10 to 8.22

Internal MISP references

UUID 3aaef939-132c-4cfb-9243-20918373ccfe which can be used as unique global reference for ETRE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

FUZZBUNCH

an exploit framework, similar to MetaSploit

Internal MISP references

UUID 3de1aa96-24cd-4790-babc-df0b2d657bdb which can be used as unique global reference for FUZZBUNCH in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

ODDJOB

implant builder and C&C server that can deliver exploits for Windows 2000 and later, also not detected by any AV vendors

Internal MISP references

UUID d20f9a41-db27-4d53-995e-547f86ff3d1e which can be used as unique global reference for ODDJOB in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

PASSFREELY

utility which Bypasses authentication for Oracle servers

Internal MISP references

UUID b68ac0c5-124a-4f22-9c99-0c1cd42bdee3 which can be used as unique global reference for PASSFREELY in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

SMBTOUCH

check if the target is vulnerable to samba exploits like ETERNALSYNERGY, ETERNALBLUE, ETERNALROMANCE

Internal MISP references

UUID 48cf4f29-41a2-4244-bb25-377362eaa3ae which can be used as unique global reference for SMBTOUCH in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

ERRATICGOPHERTOUCH

Check if the target is running some RPC

Internal MISP references

UUID a122b8e0-1249-4c77-8ef7-6b9caf48ab4f which can be used as unique global reference for ERRATICGOPHERTOUCH in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

IISTOUCH

check if the running IIS version is vulnerable

Internal MISP references

UUID 7b4bf6dd-d191-429b-a5ee-9305093aa1ec which can be used as unique global reference for IISTOUCH in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

RPCOUTCH

get info about windows via RPC

Internal MISP references

UUID 2c9e90ea-7421-4101-97a6-ebe095bd29ad which can be used as unique global reference for RPCOUTCH in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

DOPU

used to connect to machines exploited by ETERNALCHAMPIONS

Internal MISP references

UUID f1657aac-a6be-4383-8cd6-06b833acf07c which can be used as unique global reference for DOPU in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

FlexSpy

covert surveillance tools

Internal MISP references

UUID 71d6e949-69df-4d64-9637-136780226f49 which can be used as unique global reference for FlexSpy in MISP communities and other software using the MISP galaxy

feodo

Unfortunately, it is time to meet 'Feodo'. Since august of this year when FireEye's MPS devices detected this malware in the field, we have been monitoring this banking trojan very closely. In many ways, this malware looks similar to other famous banking trojans like Zbot and SpyEye. Although my analysis says that this malware is not a toolkit and is in the hands of a single criminal group.

Internal MISP references

UUID 372cdc12-d909-463c-877a-175f97f7abb5 which can be used as unique global reference for feodo in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Cardinal RAT

Palo Alto Networks has discovered a previously unknown remote access Trojan (RAT) that has been active for over two years. It has a very low volume in this two-year period, totaling roughly 27 total samples. The malware is delivered via an innovative and unique technique: a downloader we are calling Carp uses malicious macros in Microsoft Excel documents to compile embedded C# (C Sharp) Programming Language source code into an executable that in turn is run to deploy the Cardinal RAT malware family. These malicious Excel files use a number of different lures, providing evidence of what attackers are using to entice victims into executing them.

Internal MISP references

UUID 1d9fbf33-faea-40c1-b543-c7b39561f0ff which can be used as unique global reference for Cardinal RAT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

REDLEAVES

The REDLEAVES implant consists of three parts: an executable, a loader, and the implant shellcode. The REDLEAVES implant is a remote administration Trojan (RAT) that is built in Visual C++ and makes heavy use of thread generation during its execution. The implant contains a number of functions typical of RATs, including system enumeration and creating a remote shell back to the C2.

Internal MISP references

UUID 179f7228-6fcf-4664-a084-57bd296d0cde which can be used as unique global reference for REDLEAVES in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Kazuar

Kazuar is a fully featured backdoor written using the .NET Framework and obfuscated using the open source packer called ConfuserEx. Unit 42 researchers have uncovered a backdoor Trojan used in an espionage campaign. The developers refer to this tool by the name Kazuar, which is a Trojan written using the Microsoft .NET Framework that offers actors complete access to compromised systems targeted by its operator. Kazuar includes a highly functional command set, which includes the ability to remotely load additional plugins to increase the Trojan’s capabilities. During our analysis of this malware we uncovered interesting code paths and other artifacts that may indicate a Mac or Unix variant of this same tool also exists. Also, we discovered a unique feature within Kazuar: it exposes its capabilities through an Application Programming Interface (API) to a built-in webserver. We suspect the Kazuar tool may be linked to the Turla threat actor group (also known as Uroburos and Snake), who have been reported to have compromised embassies, defense contractors, educational institutions, and research organizations across the globe. A hallmark of Turla operations is iterations of their tools and code lineage in Kazuar can be traced back to at least 2005. If the hypothesis is correct and the Turla threat group is using Kazuar, we believe they may be using it as a replacement for Carbon and its derivatives. Of the myriad of tools observed in use by Turla Carbon and its variants were typically deployed as a second stage backdoor within targeted environments and we believe Kazuar may now hold a similar role for Turla operations.

Internal MISP references

UUID a5399473-859b-4c64-999b-a3b4070cd513 which can be used as unique global reference for Kazuar in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Trick Bot

Many links indicate, that this bot is another product of the people previously involved in Dyreza. It seems to be rewritten from scratch – however, it contains many similar features and solutions to those we encountered analyzing Dyreza (read more).

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Trick Bot.

Known Synonyms
TrickBot
TrickLoader
Internal MISP references

UUID a7dbd72f-8d53-48c6-a9db-d16e7648b2d4 which can be used as unique global reference for Trick Bot in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Hackshit

Netskope Threat Research Labs recently discovered a Phishing-as-a-Service (PhaaS) platform named Hackshit, that records the credentials of the phished bait victims. The phished bait pages are packaged with base64 encoding and served from secure (HTTPS) websites with “.moe” top level domain (TLD) to evade traditional scanners. “.moe” TLD is intended for the purpose of ‘The marketing of products or services deemed’. The victim’s credentials are sent to the Hackshit PhaaS platform via websockets. The Netskope Active Platform can proactively protect customers by creating custom applications and a policy to block all the activities related to Hackshit PhaaS.

Internal MISP references

UUID 02d2ed4a-ce3f-430b-a8da-5b9750c148ca which can be used as unique global reference for Hackshit in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Moneygram Adwind

Internal MISP references

UUID 6c6e717d-03c5-496d-83e9-13bdaa408348 which can be used as unique global reference for Moneygram Adwind in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Banload

Banload has been around since the last decade. This malware generally arrives on a victim’s system through a spam email containing an archived file or bundled software as an attachment. In a few cases, this malware may also be dropped by other malware or a drive-by download. When executed, Banload downloads other malware, often banking Trojans, on the victim’s system to carry out further infections.

Internal MISP references

UUID d279bc1c-baa6-49aa-ab1b-7d012ae8db4e which can be used as unique global reference for Banload in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Smoke Loader

This small application is used to download other malware. What makes the bot interesting are various tricks that it uses for deception and self protection.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Smoke Loader.

Known Synonyms
SmokeLoader
Internal MISP references

UUID 81f41bae-2ba9-4cec-9613-776be71645ca which can be used as unique global reference for Smoke Loader in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

LockPoS

The analyzed sample has a recent compilation date (2017-06-24) and is available on VirusTotal. It starts out by resolving several Windows functions using API hashing (CRC32 is used as the hashing function).

Internal MISP references

UUID c740c46b-1d95-42b5-ac3d-2bbab071b859 which can be used as unique global reference for LockPoS in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Fadok

Win.Worm.Fadok drops several files. %AppData%\RAC\mls.exe or %AppData%\RAC\svcsc.exe are instances of the malware which are auto-started when Windows starts. Further, the worm drops and opens a Word document. It connects to the domain wxanalytics[.]ru.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Fadok.

Known Synonyms
Win32/Fadok
Internal MISP references

UUID 6243b2d1-381b-4aa4-a59f-839afcdf03f2 which can be used as unique global reference for Fadok in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Loki Bot

Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets.

Internal MISP references

UUID 9085faf1-e5ec-4e51-83eb-92620afda7be which can be used as unique global reference for Loki Bot in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

KONNI

Talos has discovered an unknown Remote Administration Tool that we believe has been in use for over 3 years. During this time it has managed to avoid scrutiny by the security community. The current version of the malware allows the operator to steal files, keystrokes, perform screenshots, and execute arbitrary code on the infected host. Talos has named this malware KONNI. Throughout the multiple campaigns observed over the last 3 years, the actor has used an email attachment as the initial infection vector. They then use additional social engineering to prompt the target to open a .scr file, display a decoy document to the users, and finally execute the malware on the victim's machine. The malware infrastructure of the analysed samples was hosted by a free web hosting provider: 000webhost. The malware has evolved over time. In this article, we will analyse this evolution:

Internal MISP references

UUID 24ee55e3-697f-482f-8fa8-d05999df40cd which can be used as unique global reference for KONNI in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

NOKKI

Beginning in early 2018, Unit 42 observed a series of attacks using a previously unreported malware family, which we have named ‘NOKKI’. The malware in question has ties to a previously reported malware family named KONNI, however, after careful consideration, we believe enough differences are present to introduce a different malware family name. To reflect the close relationship with KONNI, we chose NOKKI, swapping KONNI’s Ns and Ks. Because of code overlap found within both malware families, as well as infrastructure overlap, we believe the threat actors responsible for KONNI are very likely also responsible for NOKKI. Previous reports stated it was likely KONNI had been in use for over three years in multiple campaigns with a heavy interest in the Korean peninsula and surrounding areas. As of this writing, it is not certain if the KONNI or NOKKI operators are related to known adversary groups operating in the regions of interest, although there is evidence of a tenuous relationship with a group known as Reaper.

Internal MISP references

UUID 9e4fd0d3-9736-421c-b1e1-96c1d3665c80 which can be used as unique global reference for NOKKI in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

SpyDealer

Recently, Palo Alto Networks researchers discovered an advanced Android malware we’ve named “SpyDealer” which exfiltrates private data from more than 40 apps and steals sensitive messages from communication apps by abusing the Android accessibility service feature. SpyDealer uses exploits from a commercial rooting app to gain root privilege, which enables the subsequent data theft.

Internal MISP references

UUID f86b4977-228d-4b31-854d-8bdc92db4653 which can be used as unique global reference for SpyDealer in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

CowerSnail

CowerSnail was compiled using Qt and linked with various libraries. This framework provides benefits such as cross-platform capability and transferability of the source code between different operating systems.

Internal MISP references

UUID 6da16d56-eaf9-475d-a7e0-4a11e0200c14 which can be used as unique global reference for CowerSnail in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Svpeng

In mid-July 2017, we found a new modification of the well-known mobile banking malware family Svpeng – Trojan-Banker.AndroidOS.Svpeng.ae. In this modification, the cybercriminals have added new functionality: it now also works as a keylogger, stealing entered text through the use of accessibility services.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Svpeng.

Known Synonyms
trojan-banker.androidos.svpeng.ae
Internal MISP references

UUID a33df440-f112-4a5e-a290-3c65dae6091d which can be used as unique global reference for Svpeng in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

TwoFace

While investigating a recent security incident, Unit 42 found a webshell that we believe was used by the threat actor to remotely access the network of a targeted Middle Eastern organization. The construction of the webshell was interesting by itself, as it was actually two separate webshells: an initial webshell that was responsible for saving and loading the second fully functional webshell. It is this second webshell that enabled the threat actor to run a variety of commands on the compromised server. Due to these two layers, we use the name TwoFace to track this webshell. During our analysis, we extracted the commands executed by the TwoFace webshell from the server logs on the compromised server. Our analysis shows that the commands issued by the threat actor date back to June 2016; this suggests that the actor had access to this shell for almost an entire year. The commands issued show the actor was interested in gathering credentials from the compromised server using the Mimikatz tool. We also saw the attacker using the TwoFace webshell to move laterally through the network by copying itself and other webshells to other servers.

Internal MISP references

UUID 9334c430-0d83-4893-8982-66a1dc1a2b11 which can be used as unique global reference for TwoFace in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['webshell']
Related clusters

To see the related clusters, click here.

IntrudingDivisor

Like TwoFace, the IntrudingDivisor webshell requires the threat actor to authenticate before issuing commands. To authenticate, the actor must provide two pieces of information, first an integer that is divisible by 5473 and a string whose MD5 hash is “9A26A0E7B88940DAA84FC4D5E6C61AD0”. Upon successful authentication, the webshell has a command handler that uses integers within the request to determine the command to execute - To complete

Internal MISP references

UUID bb2bd10b-b36d-4390-bf60-bd8d2d7cedec which can be used as unique global reference for IntrudingDivisor in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
type ['webshell']

JS_POWMET

Attacks that use completely fileless malware are a rare occurrence, so we thought it important to discuss a new trojan known as JS_POWMET (Detected by Trend Micro as JS_POWMET.DE), which arrives via an autostart registry procedure. By utilizing a completely fileless infection chain, the malware will be more difficult to analyze using a sandbox, making it more difficult for anti-malware engineers to examine.

Internal MISP references

UUID c602edae-b186-4c60-a4f6-8785d6aa0eb0 which can be used as unique global reference for JS_POWMET in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

EngineBox Malware

The main malware capabilities include a privilege escalation attempt using MS16–032 exploitation; a HTTP Proxy to intercept banking transactions; a backdoor to make it possible for the attacker to issue arbitrary remote commands and a C&C through a IRC channel. As it's being identified as a Generic Trojan by most of VirusTotal (VT) engines, let s name it EngineBox— the core malware class I saw after reverse engineering it.

Internal MISP references

UUID 17839df6-aa15-4269-b4b1-9e7ae8cfec1e which can be used as unique global reference for EngineBox Malware in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Joao

Spread via hacked Aeria games offered on unofficial websites, the modular malware can download and install virtually any other malicious code on the victim’s computer. To spread their malware, the attackers behind Joao have misused massively-multiplayer online role-playing games (MMORPGs) originally published by Aeria Games. At the time of writing this article, the Joao downloader was being distributed via the anime-themed MMORPG Grand Fantasia offered on gf.ignitgames[.]to.

Internal MISP references

UUID 673d05fa-4066-442c-bdb6-0c0a2da5ae62 which can be used as unique global reference for Joao in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Fireball

Upon execution, Fireball installs a browser hijacker as well as any number of adware programs. Several different sources have linked different indicators of compromise (IOCs) and varied payloads, but a few details remain the same.

Internal MISP references

UUID 968df869-7f60-4420-989f-23dfdbd58668 which can be used as unique global reference for Fireball in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

ShadowPad

ShadowPad is a modular cyber-attack platform that attackers deploy in victim networks to gain flexible remote control capabilities. The platform is designed to run in two stages. The first stage is a shellcode that was embedded in a legitimate nssock2.dll used by Xshell, Xmanager and other software packages produced by NetSarang. This stage is responsible for connecting to “validation” command and control (C&C) servers and getting configuration information including the location of the real C&C server, which may be unique per victim. The second stage acts as an orchestrator for five main modules responsible for C&C communication, working with the DNS protocol, loading and injecting additional plugins into the memory of other processes.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ShadowPad.

Known Synonyms
Barlaiy
POISONPLUG
Internal MISP references

UUID 2448a4e1-46e3-4c42-9fd1-f51f8ede58c1 which can be used as unique global reference for ShadowPad in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

IoT_reaper

IoT_reaper is fairly large now and is actively expanding. For example, there are multiple C2s we are tracking, the most recently data (October 19) from just one C2 shows the number of unique active bot IP address is more than 10k per day. While at the same time, there are millions of potential vulnerable device IPs being queued into the c2 system waiting to be processed by an automatic loader that injects malicious code to the devices to expand the size of the botnet.

Internal MISP references

UUID 6052becf-3060-444c-8ed7-d4a3901ae7dd which can be used as unique global reference for IoT_reaper in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

FormBook

FormBook is a data stealer and form grabber that has been advertised in various hacking forums since early 2016.

Internal MISP references

UUID c7e7063b-b2a2-4046-8a19-94dea018eaa0 which can be used as unique global reference for FormBook in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Dimnie

Dimnie, the commonly agreed upon name for the binary dropped by the PowerShell script above, has been around for several years. Palo Alto Networks has observed samples dating back to early 2014 with identical command and control mechanisms. The malware family serves as a downloader and has a modular design encompassing various information stealing functionalities. Each module is injected into the memory of core Windows processes, further complicating analysis. During its lifespan, it appears to have undergone few changes and its stealthy command and control methods combined with a previously Russian focused target base has allowed it to fly under the radar up until this most recent campaign.

Internal MISP references

UUID 9fed4326-a7ad-4c58-ab87-90ac3957d82f which can be used as unique global reference for Dimnie in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

ALMA Communicator

The ALMA Communicator Trojan is a backdoor Trojan that uses DNS tunneling exclusively to receive commands from the adversary and to exfiltrate data. This Trojan specifically reads in a configuration from the cfg file that was initially created by the Clayslide delivery document. ALMA does not have an internal configuration, so the Trojan does not function without the cfg file created by the delivery document.

Internal MISP references

UUID 45de0d28-5a20-4190-ae21-68067e36e316 which can be used as unique global reference for ALMA Communicator in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Silence

In September 2017, we discovered a new targeted attack on financial institutions. Victims are mostly Russian banks but we also found infected organizations in Malaysia and Armenia. The attackers were using a known but still very effective technique for cybercriminals looking to make money: gaining persistent access to an internal banking network for a long period of time, making video recordings of the day to day activity on bank employees’ PCs, learning how things works in their target banks, what software is being used, and then using that knowledge to steal as much money as possible when ready. We saw that technique before in Carbanak, and other similar cases worldwide. The infection vector is a spear-phishing email with a malicious attachment. An interesting point in the Silence attack is that the cybercriminals had already compromised banking infrastructure in order to send their spear-phishing emails from the addresses of real bank employees and look as unsuspicious as possible to future victims.

Internal MISP references

UUID 304fd753-c917-4008-8f85-81390c37a070 which can be used as unique global reference for Silence in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Volgmer

Volgmer is a backdoor Trojan designed to provide covert access to a compromised system. Since at least 2013, HIDDEN COBRA actors have been observed using Volgmer malware in the wild to target the government, financial, automotive, and media industries. It is suspected that spear phishing is the primary delivery mechanism for Volgmer infections; however, HIDDEN COBRA actors use a suite of custom tools, some of which could also be used to initially compromise a system. Therefore, it is possible that additional HIDDEN COBRA malware may be present on network infrastructure compromised with Volgmer

Internal MISP references

UUID 0a52e73b-d7e9-45ae-9bda-46568f753931 which can be used as unique global reference for Volgmer in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Nymaim

Nymaim is a 2-year-old strain of malware most closely associated with ransomware. We have seen recent attacks spreading it using an established email marketing service provider to avoid blacklists and detection tools. But instead of ransomware, the malware is now being used to distribute banking Trojans

Internal MISP references

UUID d36f4834-b958-4f32-aff0-5263e0034408 which can be used as unique global reference for Nymaim in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

GootKit

As was the case earlier, the bot Gootkit is written in NodeJS, and is downloaded to a victim computer via a chain of downloaders. The main purpose of the bot also remained the same – to steal banking data. The new Gootkit version, detected in September, primarily targets clients of European banks, including those in Germany, France, Italy, the Netherlands, Poland, etc.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GootKit.

Known Synonyms
Gootkit
Internal MISP references

UUID 07ffcf9f-b9c0-4b22-af4b-78527427e6f5 which can be used as unique global reference for GootKit in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Agent Tesla

Agent Tesla is modern powerful keystroke logger. It provides monitoring your personel computer via keyboard and screenshot. Keyboard, screenshot and registered passwords are sent in log. You can receive your logs via e-mail, ftp or php(web panel).

Internal MISP references

UUID f8cd62cb-b9d3-4352-8f46-0961cfde104c which can be used as unique global reference for Agent Tesla in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Ordinypt

A new ransomware strain called Ordinypt is currently targeting victims in Germany, but instead of encrypting users' documents, the ransomware rewrites files with random data. Ordinypt is actually a wiper and not ransomware because it does not bother encrypting anything, but just replaces files with random data.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ordinypt.

Known Synonyms
HSDFSDCrypt
Internal MISP references

UUID 1d46f816-d159-4457-b98e-c34307d90655 which can be used as unique global reference for Ordinypt in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

StrongPity2

Detected by ESET as Win32/StrongPity2, this spyware notably resembles one that was attributed to the group called StrongPity.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular StrongPity2.

Known Synonyms
Win32/StrongPity2
Internal MISP references

UUID d422e7c9-a2ac-45b2-9804-61d16a6e30e7 which can be used as unique global reference for StrongPity2 in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

wp-vcd

WordPress site owners should be on the lookout for a malware strain tracked as wp-vcd that hides in legitimate WordPress files and that is used to add a secret admin user and grant attackers control over infected sites. The malware was first spotted online over the summer by Italian security researcher Manuel D'Orso. The initial version of this threat was loaded via an include call for the wp-vcd.php file —hence the malware's name— and injected malicious code into WordPress core files such as functions.php and class.wp.php. This was not a massive campaign, but attacks continued throughout the recent months.

Internal MISP references

UUID 99de56dc-92c5-4540-91bc-a6cd1e3a3c7f which can be used as unique global reference for wp-vcd in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

MoneyTaker 5.0

malicious program for auto replacement of payment data in AWS CBR

Internal MISP references

UUID 0acb6f04-7e51-44bb-843c-4bb55a3647d5 which can be used as unique global reference for MoneyTaker 5.0 in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Quant Loader

Described as a "professional exe loader / dll dropper" Quant Loader is in fact a very basic trojan downloader. It began being advertised on September 1, 2016 on various Russian underground forums.

Internal MISP references

UUID 2d1aadfb-03c1-4580-b6ac-f12c6941067d which can be used as unique global reference for Quant Loader in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

SSHDoor

The Secure Shell Protocol (SSH) is a very popular protocol used for secure data communication. It is widely used in the Unix world to manage remote servers, transfer files, etc. The modified SSH daemon described here, Linux/SSHDoor.A, is designed to steal usernames and passwords and allows remote access to the server via either an hardcoded password or SSH key.

Internal MISP references

UUID f258f96c-8281-4b24-8aa7-4e23d1a5540e which can be used as unique global reference for SSHDoor in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

TRISIS

(Dragos Inc.) The team identifies this malware as TRISIS because it targets Schneider Electric’s Triconex safety instrumented system (SIS) enabling the replacement of logic in final control elements. TRISIS is highly targeted and likely does not pose an immediate threat to other Schneider Electric customers, let alone other SIS products. (FireEye Inc.) This malware, which we call TRITON, is an attack framework built to interact with Triconex Safety Instrumented System (SIS) controllers. We have not attributed the incident to a threat actor, though we believe the activity is consistent with a nation state preparing for an attack. TRITON is one of a limited number of publicly identified malicious software families targeted at industrial control systems (ICS). It follows Stuxnet which was used against Iran in 2010 and Industroyer which we believe was deployed by Sandworm Team against Ukraine in 2016.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TRISIS.

Known Synonyms
TRITON
Internal MISP references

UUID 8a45d1a5-8157-4303-a47a-352282065059 which can be used as unique global reference for TRISIS in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

OSX.Pirrit

macOS adware strain

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular OSX.Pirrit.

Known Synonyms
OSX/Pirrit
Internal MISP references

UUID e2b7ddc2-2fce-4ef9-9054-609e74a8775e which can be used as unique global reference for OSX.Pirrit in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

GratefulPOS

GratefulPOS has the following functions 1. Access arbitrary processes on the target POS system 2. Scrape track 1 and 2 payment card data from the process(es) 3. Exfiltrate the payment card data via lengthy encoded and obfuscated DNS queries to a hardcoded domain registered and controlled by the perpetrators, similar to that described by Paul Rascagneres in his analysis of FrameworkPOS in 2014[iii], and more recently by Luis Mendieta of Anomoli in analysis of a precursor to this sample.

Internal MISP references

UUID 4cfe3f22-96b8-4d3d-a6cc-85835d9471e2 which can be used as unique global reference for GratefulPOS in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

PRILEX

Prilex malware steals the information of the infected ATM’s users. In this case, it was a Brazilian bank, but consider the implications of such an attack in your region, whether you’re a customer or the bank.

Internal MISP references

UUID 523e8772-0610-424c-bcfb-9123bcb8328f which can be used as unique global reference for PRILEX in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

CUTLET MAKER

Cutlet Maker is an ATM malware designed to empty the machine of all its banknotes. Interestingly, while its authors have been advertising its sale, their competitors have already cracked the program, allowing anybody to use it for free.

Internal MISP references

UUID c03e7054-6013-4f69-994d-7cdaa41588ed which can be used as unique global reference for CUTLET MAKER in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Satori

According to a report Li shared with Bleeping Computer today, the Mirai Satori variant is quite different from all previous pure Mirai variants.Previous Mirai versions infected IoT devices and then downloaded a Telnet scanner component that attempted to find other victims and infect them with the Mirai bot.The Satori variant does not use a scanner but uses two embedded exploits that will try to connect to remote devices on ports 37215 and 52869.Effectively, this makes Satori an IoT worm, being able to spread by itself without the need for separate components.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Satori.

Known Synonyms
Okiru
Internal MISP references

UUID 1ad4697b-3388-48ed-8621-85abebf5dbbf which can be used as unique global reference for Satori in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

PowerSpritz

PowerSpritz is a Windows executable that hides both its legitimate payload and malicious PowerShell command using a non-standard implementation of the already rarely used Spritz encryption algorithm (see the Attribution section for additional analysis of the Spritz implementation). This malicious downloader has been observed being delivered via spearphishing attacks using the TinyCC link shortener service to redirect to likely attacker-controlled servers hosting the malicious PowerSpritz payload.

Internal MISP references

UUID 5629bc84-58eb-42d9-adc6-cd0eeb08ccaf which can be used as unique global reference for PowerSpritz in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

PowerRatankba

PowerRatankba is used for the same purpose as Ratankba: as a first stage reconnaissance tool and for the deployment of further stage implants on targets that are deemed interesting by the actor. Similar to its predecessor, PowerRatankba utilizes HTTP for its C&C communication.

Internal MISP references

UUID 1f1be19e-d1b5-408b-90a0-03ad27cc8924 which can be used as unique global reference for PowerRatankba in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Ratankba

In one instance we observed, one of the initial malware delivered to the victim, RATANKBA, connects to a legitimate but compromised website from which a hack tool (nbt_scan.exe) is also downloaded. The domain also serves as one of the campaign’s platform for C&C communication. The threat actor uses RATANKBA to survey the lay of the land as it looks into various aspects of the host machine where it has been initially downloaded—the machine that has been victim of the watering hole attack. Information such as the running tasks, domain, shares, user information, if the host has default internet connectivity, and so forth.

Internal MISP references

UUID 64b3c66b-fc70-4b5a-83a9-866cde2ccb0b which can be used as unique global reference for Ratankba in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

USBStealer

USBStealer serves as a network tool that extracts sensitive information from air-gapped networks. We have not seen this component since mid 2015.

Internal MISP references

UUID 44909efb-7cd3-42e3-b225-9f3e96b5f362 which can be used as unique global reference for USBStealer in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Downdelph

Downdelph is a lightweight downloader developed in the Delphi programming language. As we already mentioned in our white paper, its period of activity was from November 2013 to September 2015 and there have been no new variants seen since.

Internal MISP references

UUID 837a295c-15ff-41c0-9b7e-5f2fb502b00a which can be used as unique global reference for Downdelph in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

CoinMiner

Monero-mining malware

Internal MISP references

UUID 89bd2020-2594-45c4-8957-522c0ac41370 which can be used as unique global reference for CoinMiner in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

FruitFly

A fully-featured backdoor, designed to perversely spy on Mac users

Internal MISP references

UUID 6a6525b9-4656-4973-ab45-588592395d0c which can be used as unique global reference for FruitFly in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

MacDownloader

Iranian macOS exfiltration agent, targeting the 'defense industrial base' and human rights advocates.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MacDownloader.

Known Synonyms
iKitten
Internal MISP references

UUID 14f08f6f-7f58-48a8-8469-472244ffb571 which can be used as unique global reference for MacDownloader in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Empyre

The open-source macOS backdoor, 'Empye', maliciously packaged into a macro'd Word document

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Empyre.

Known Synonyms
Empye
Internal MISP references

UUID cf55bbb8-37eb-4cc6-ac14-7b42b950c687 which can be used as unique global reference for Empyre in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Proton

A fully-featured macOS backdoor, designed to collect and exfiltrate sensitive user data such as 1Password files, browser login data, and keychains.

Internal MISP references

UUID a495d254-7092-4a63-9872-3a82c13fe2dd which can be used as unique global reference for Proton in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Mughthesec

Adware which hijacks a macOS user's homepage to redirect search queries.

Internal MISP references

UUID 4e2f0af2-6d2d-4a49-adc9-fae3745fcb72 which can be used as unique global reference for Mughthesec in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Pwnet

A macOS crypto-currency miner, distributed via a trojaned 'CS-GO' hack.

Internal MISP references

UUID 29e52693-b325-4c14-93de-8f2ff9dca8bf which can be used as unique global reference for Pwnet in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

CpuMeaner

A macOS crypto-currency mining trojan.

Internal MISP references

UUID 5bc62523-dc80-46b4-b5cb-9caf44c11552 which can be used as unique global reference for CpuMeaner in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Travle

The Travle sample found during our investigation was a DLL with a single exported function (MSOProtect). The malware name Travle was chosen given a string found in early samples of this family: “Travle Path Failed!”. This typo was replaced with correct word “Travel” in newer releases. We believe that Travle could be a successor to the NetTraveler family.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Travle.

Known Synonyms
PYLOT
Internal MISP references

UUID 9d689318-2bc1-4bfb-92ee-a81fea35434f which can be used as unique global reference for Travle in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Digmine

Digmine is coded in AutoIt, and sent to would-be victims posing as a video file but is actually an AutoIt executable script. If the user’s Facebook account is set to log in automatically, Digmine will manipulate Facebook Messenger in order to send a link to the file to the account’s friends. The abuse of Facebook is limited to propagation for now, but it wouldn’t be implausible for attackers to hijack the Facebook account itself down the line. This functionality’s code is pushed from the command-and-control (C&C) server, which means it can be updated.

Internal MISP references

UUID d248a27c-d036-4032-bc70-803a1b0c8148 which can be used as unique global reference for Digmine in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

TSCookie

TSCookie itself only serves as a downloader. It expands functionality by downloading modules from C&C servers. The sample that was examined downloaded a DLL file which has exfiltrating function among many others (hereafter “TSCookieRAT”). Downloaded modules only runs on memory.

Internal MISP references

UUID a71ed71f-b8f4-416d-9c57-910a42e59430 which can be used as unique global reference for TSCookie in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Exforel

Exforel backdoor malware, VirTool:WinNT/Exforel.A, backdoor implemented at the Network Driver Interface Specification (NDIS) level.

Internal MISP references

UUID 3119554e-236e-11e8-ae2e-b7063732fd07 which can be used as unique global reference for Exforel in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Rotinom

W32.Rotinom is a worm that spreads by copying itself to removable drives.

Internal MISP references

UUID 5f4be30a-2373-11e8-bbab-774ff49fd040 which can be used as unique global reference for Rotinom in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Aurora

You probably have heard the recent news about a widespread attack that was carried out using a 0-Day exploit for Internet Explorer as one of the vectors. This exploit is also known as the "Aurora Exploit". The code has recently gone public and it was also added to the Metasploit framework. This exploit was used to deliver a malicious payload, known by the name of Trojan.Hydraq, the main purpose of which was to steal information from the compromised computer and report it back to the attackers. The exploit code makes use of known techniques to exploit a vulnerability that exists in the way Internet Explorer handles a deleted object. The final purpose of the exploit itself is to access an object that was previously deleted, causing the code to reference a memory location over which the attacker has control and in which the attacker dropped his malicious code.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Aurora.

Known Synonyms
Hydraq
Internal MISP references

UUID 70c31066-237a-11e8-8eff-37ef1ad0c703 which can be used as unique global reference for Aurora in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Cheshire Cat

Oldest Cheshire Cat malware compiled in 2002. It's a very old family of malware. The time stamps may be forged but the malware does have support for very old operating systems. The 2002 implant retrieves a handle for an asr2892 drives that they never got their hands on. It checks for a NE header which is a header type used before PE headers even existed. References to 16bit or DOS on a non 9x platform. This malware implant IS REALLY for old systems. The malware is for espionage - it's very carefully made to stay hidden. Newer versions install as icon handler shell extension for .lnk files. Shell in this case means the program manager because windows explorer was not yet a thing. It sets up COM server objects. It looks like it was written in pure C, but made to look like C++. A sensitive implant as well: it checks for all kinds of old MS platforms including Windows NT, win95, win98, winME and more. It checks the patch level as well. A lot of effort was put into adapting this malware to a lot of different operating systems with very granular decision chains.

Internal MISP references

UUID 7af226a0-237d-11e8-b438-075460988010 which can be used as unique global reference for Cheshire Cat in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Downloader-FGO

Downloader-FGO is a trojan that comes hidden in malicious programs. Once you install the source (carrier) program, this trojan attempts to gain "root" access (administrator level access) to your computer without your knowledge

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Downloader-FGO.

Known Synonyms
Generic30.ASYL (Trojan horse)
Mal/Behav-112
SB/Malware
TR/Agent.84480.85
TROJ_KAZY.SM1
Trj/CI.A
Trojan.Generic.8627031
Trojan.Spuler
Trojan:Win32/Sisproc
Win32/FakePPT_i
Win32:Malware-gen
Internal MISP references

UUID 1a3f876f-0f52-497f-b3ff-b995e2d42c15 which can be used as unique global reference for Downloader-FGO in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
uuid c565a3a4-2384-11e8-99e9-ebd8ea5c3c3e

miniFlame

Newly discovered spying malware designed to steal data from infected systems was likely built from the same cyber-weaponry factory that produced two other notorious cyberespionage software Flame and Gauss, a security vendor says. Kaspersky Lab released a technical paper Monday outlining the discovery of the malware the vendor has dubbed "miniFlame." While capable of working with Flame and Gauss, miniFlame is a "small, fully functional espionage module designed for data theft and direct access to infected systems," Kaspersky said.

Internal MISP references

UUID 16c57264-239f-11e8-9469-0738871e7aa4 which can be used as unique global reference for miniFlame in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

GHOTEX

PE_GHOTEX.A-O is a portable executable (PE is the standard executable format for 32-bit Windows files) virus. PE viruses infect executable Windows files by incorporating their code into these files such that they are executed when the infected files are opened.

Internal MISP references

UUID 231b7572-239f-11e8-8404-df420a5d403b which can be used as unique global reference for GHOTEX in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Shipup

Trojan:Win32/Shipup.G is a trojan that modifies the Autorun feature for certain devices.

Internal MISP references

UUID 4613b76c-4966-44b6-bcd5-f74fa64deb18 which can be used as unique global reference for Shipup in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Neuron

Neuron consists of both client and server components. The Neuron client and Neuron service are written using the .NET framework with some codebase overlaps. The Neuron client is used to infect victim endpoints and extract sensitive information from local client machines. The Neuron server is used to infect network infrastructure such as mail and web servers, and acts as local Command & Control (C2) for the client component. Establishing a local C2 limits interaction with the target network and remote hosts. It also reduces the log footprint of actor infrastructure and enables client interaction to appear more convincing as the traffic is contained within the target network.

Internal MISP references

UUID 5c2eeaec-25e3-11e8-9d28-7f64aba5b173 which can be used as unique global reference for Neuron in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Nautilus

Nautilus is very similar to Neuron both in the targeting of mail servers and how client communications are performed. This malware is referred to as Nautilus due to its embedded internal DLL name “nautilus-service.dll”, again sharing some resemblance to Neuron. The Nautilus service listens for HTTP requests from clients to process tasking requests such as executing commands, deleting files and writing files to disk

Internal MISP references

UUID 73cb7ecc-25e3-11e8-a97b-c35ec4e7dcf8 which can be used as unique global reference for Nautilus in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Gamut Botnet

Gamut was found to be downloaded by a Trojan Downloader that arrives as an attachment from a spam email message. The bot installation is quite simple. After the malware binary has been downloaded, it launches itself from its current directory, usually the Windows %Temp% folder and installs itself as a Windows service. The malware utilizes an anti-VM (virtual machine) trick and terminates itself if it detects that it is running in a virtual machine environment. The bot uses INT 03h trap sporadically in its code, an anti-debugging technique which prevents its code from running within a debugger environment. It can also determine if it is being debugged by using the Kernel32 API - IsDebuggerPresent function.

Internal MISP references

UUID 492879ac-285b-11e8-a06e-33f548e66e42 which can be used as unique global reference for Gamut Botnet in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

CORALDECK

CORALDECK is an exfiltration tool that searches for specified files and exfiltrates them in password protected archives using hardcoded HTTP POST headers. CORALDECK has been observed dropping and using Winrar to exfiltrate data in password protected RAR files as well as WinImage and zip archives

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CORALDECK.

Known Synonyms
APT.InfoStealer.Win.CORALDECK
FE_APT_InfoStealer_Win_CORALDECK_1
Internal MISP references

UUID becf81e5-f989-4093-a67d-d55a0483885f which can be used as unique global reference for CORALDECK in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

DOGCALL

DOGCALL is a backdoor commonly distributed as an encoded binary file downloaded and decrypted by shellcode following the exploitation of weaponized documents. DOGCALL is capable of capturing screenshots, logging keystrokes, evading analysis with anti-virtual machine detections, and leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex. DOGCALL was used to target South Korean Government and military organizations in March and April 2017. The malware is typically dropped using an HWP exploit in a lure document. The wiper tool, RUHAPPY, was found on some of the systems targeted by DOGCALL. While DOGCALL is primarily an espionage tool, RUHAPPY is a destructive wiper tool meant to render systems inoperable.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DOGCALL.

Known Synonyms
APT.Backdoor.Win.DOGCALL
FE_APT_Backdoor_Win32_DOGCALL_1
FE_APT_RAT_DOGCALL
Internal MISP references

UUID a5e851b4-e046-43b6-bc6e-c6c008e3c5aa which can be used as unique global reference for DOGCALL in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

GELCAPSULE

GELCAPSULE is a downloader traditionally dropped or downloaded by an exploit document. GELCAPSULE has been observed downloading SLOWDRIFT to victim systems.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GELCAPSULE.

Known Synonyms
FE_APT_Downloader_Win32_GELCAPSULE_1
Internal MISP references

UUID ac008bbd-f415-458e-96bf-be7d158df2d8 which can be used as unique global reference for GELCAPSULE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

HAPPYWORK

HAPPYWORK is a malicious downloader that can download and execute a second-stage payload, collect system information, and beacon it to the command and control domains. The collected system information includes: computer name, user name, system manufacturer via registry, IsDebuggerPresent state, and execution path. In November 2016, HAPPYWORK targeted government and financial targets in South Korea.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HAPPYWORK.

Known Synonyms
Downloader.APT.HAPPYWORK
FE_APT_Downloader_HAPPYWORK
FE_APT_Exploit_HWP_Happy
Internal MISP references

UUID 656cd201-d57a-4a2f-a201-531eb4922a72 which can be used as unique global reference for HAPPYWORK in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

KARAE

Karae backdoors are typically used as first-stage malware after an initial compromise. The backdoors can collect system information, upload and download files, and may be used to retrieve a second-stage payload. The malware uses public cloud-based storage providers for command and control. In March 2016, KARAE malware was distributed through torrent file-sharing websites for South Korean users. During this campaign, the malware used a YouTube video downloader application as a lure.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular KARAE.

Known Synonyms
Backdoor.APT.Karae
FE_APT_Backdoor_Karae
FE_APT_Backdoor_Karae_enc
Internal MISP references

UUID 70ca8408-bc45-4d39-acd2-9190ba15ea97 which can be used as unique global reference for KARAE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

MILKDROP

MILKDROP is a launcher that sets a persistence registry key and launches a backdoor.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MILKDROP.

Known Synonyms
FE_Trojan_Win32_MILKDROP_1
Internal MISP references

UUID 1064c911-44e6-4c84-8e11-f476a8b06ce8 which can be used as unique global reference for MILKDROP in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

POORAIM

POORAIM malware is designed with basic backdoor functionality and leverages AOL Instant Messenger for command and control communications. POORAIM includes the following capabilities: System information enumeration, File browsing, manipulation and exfiltration, Process enumeration, Screen capture, File execution, Exfiltration of browser favorites, and battery status. Exfiltrated data is sent via files over AIM. POORAIM has been involved in campaigns against South Korean media organizations and sites relating to North Korean refugees and defectors since early 2014. Compromised sites have acted as watering holes to deliver newer variants of POORAIM.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular POORAIM.

Known Synonyms
Backdoor.APT.POORAIM
Internal MISP references

UUID fe97ace3-9a80-42af-9eae-1f9245927e5d which can be used as unique global reference for POORAIM in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

RICECURRY

RICECURRY is a Javascript based profiler used to fingerprint a victim's web browser and deliver malicious code in return. Browser, operating system, and Adobe Flash version are detected by RICECURRY, which may be a modified version of PluginDetect.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RICECURRY.

Known Synonyms
Exploit.APT.RICECURRY
Internal MISP references

UUID 6f37edf6-f5e6-4749-82f9-2aa7c30582c4 which can be used as unique global reference for RICECURRY in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

RUHAPPY

RUHAPPY is a destructive wiper tool seen on systems targeted by DOGCALL. It attempts to overwrite the MBR, causing the system not to boot. When victims' systems attempt to boot, the string 'Are you Happy?' is displayed. The malware is believed to be tied to the developers of DOGCALL and HAPPYWORK based on similar PDB paths in all three.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RUHAPPY.

Known Synonyms
FE_APT_Trojan_Win32_RUHAPPY_1
Internal MISP references

UUID 96296d57-e9d9-42f1-b08c-c8636369b9aa which can be used as unique global reference for RUHAPPY in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

SHUTTERSPEED

SHUTTERSPEED is a backdoor that can collect system information, acquire screenshots, and download/execute an arbitrary executable. SHUTTERSPEED typically requires an argument at runtime in order to execute fully. Observed arguments used by SHUTTERSPEED include: 'help', 'console', and 'sample'. The spear phishing email messages contained documents exploiting RTF vulnerability CVE-2017-0199. Many of the compromised domains in the command and control infrastructure are linked to South Korean companies. Most of these domains host a fake webpage pertinent to targets.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SHUTTERSPEED.

Known Synonyms
APT.Backdoor.SHUTTERSPEED
FE_APT_Backdoor_SHUTTERSPEED
Internal MISP references

UUID d909efe3-abc3-4be0-9640-e4727542fa2b which can be used as unique global reference for SHUTTERSPEED in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

SLOWDRIFT

SLOWDRIFT is a launcher that communicates via cloud based infrastructure. It sends system information to the attacker command and control and then downloads and executes additional payloads.Lure documents distributing SLOWDRIFT were not tailored for specific victims, suggesting that TEMP.Reaper is attempting to widen its target base across multiple industries and in the private sector. SLOWDRIFT was seen being deployed against academic and strategic targets in South Korea using lure emails with documents leveraging the HWP exploit. Recent SLOWDRIFT samples were uncovered in June 2017 with lure documents pertaining to cyber crime prevention and news stories. These documents were last updated by the same actor who developed KARAE, POORAIM and ZUMKONG.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SLOWDRIFT.

Known Synonyms
APT.Downloader.SLOWDRIFT
FE_APT_Downloader_Win_SLOWDRIFT_1
FE_APT_Downloader_Win_SLOWDRIFT_2
Internal MISP references

UUID e5a9a2ec-348e-4a2f-98dd-16c3e8845576 which can be used as unique global reference for SLOWDRIFT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

SOUNDWAVE

SOUNDWAVE is a windows based audio capturing utility. Via command line it accepts the -l switch (for listen probably), captures microphone input for 100 minutes, writing the data out to a log file in this format: C:\Temp\HncDownload\YYYYMMDDHHMMSS.log.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SOUNDWAVE.

Known Synonyms
FE_APT_HackTool_Win32_SOUNDWAVE_1
Internal MISP references

UUID 6a0e3c75-5a59-4747-8fec-2e344a328575 which can be used as unique global reference for SOUNDWAVE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

ZUMKONG

ZUMKONG is a credential stealer capable of harvesting usernames and passwords stored by Internet Explorer and Chrome browsers. Stolen credentials are emailed to the attacker via HTTP POST requests to mail[.]zmail[.]ru.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ZUMKONG.

Known Synonyms
FE_APT_Trojan_Zumkong
Trojan.APT.Zumkong
Internal MISP references

UUID 6f1b9155-5de4-4ef7-9f42-60007599c477 which can be used as unique global reference for ZUMKONG in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

WINERACK

WINERACK is backdoor whose primary features include user and host information gathering, process creation and termination, filesystem and registry manipulation, as well as the creation of a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands. Other capabilities include the enumeration of files, directories, services, active windows and processes.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular WINERACK.

Known Synonyms
Backdoor.APT.WINERACK
FE_APT_Backdoor_WINERACK
Internal MISP references

UUID 49025073-4cd3-43b8-b893-e80a1d3adc04 which can be used as unique global reference for WINERACK in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

RoyalCli

The RoyalCli backdoor appears to be an evolution of BS2005 and uses familiar encryption and encoding routines. The name RoyalCli was chosen by us due to a debugging path left in the binary: 'c:\users\wizard\documents\visual studio 2010\Projects\RoyalCli\Release\RoyalCli.pdb' RoyalCli and BS2005 both communicate with the attacker's command and control (C2) through Internet Explorer (IE) by using the COM interface IWebBrowser2. Due to the nature of the technique, this results in C2 data being cached to disk by the IE process; we'll get to this later.

Internal MISP references

UUID ac04d0b0-c6b5-4125-acd7-c58dfe7ad4cf which can be used as unique global reference for RoyalCli in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

RoyalDNS

Internal MISP references

UUID 7b20b78a-df6e-40c7-9a3a-363f040cfad7 which can be used as unique global reference for RoyalDNS in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

SHARPKNOT

Internal MISP references

UUID 203fd529-6382-417e-a68f-7565fbf89ece which can be used as unique global reference for SHARPKNOT in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

KillDisk Wiper

KillDisk, along with the multipurpose, cyberespionage-related BlackEnergy, was used in cyberattacks in late December 2015 against Ukraine’s energy sector as well as its banking, rail, and mining industries. The malware has since metamorphosed into a threat used for digital extortion, affecting Windows and Linux platforms. The note accompanying the ransomware versions, like in the case of Petya, was a ruse: Because KillDisk also overwrites and deletes files (and don’t store the encryption keys on disk or online), recovering the scrambled files was out of the question. The new variant we found, however, does not include a ransom note.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular KillDisk Wiper.

Known Synonyms
KillDisk
Internal MISP references

UUID aef0fdd4-38b6-11e8-afdd-3b6145112467 which can be used as unique global reference for KillDisk Wiper in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

UselessDisk

A new MBR bootlocker called DiskWriter, or UselessDisk, has been discovered that overwrites the MBR of a victim's computer and then displays a ransom screen on reboot instead of booting into Windows. This ransom note asks for $300 in bitcoins in order to gain access to Windows again. Might be a wiper.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular UselessDisk.

Known Synonyms
DiskWriter
Internal MISP references

UUID b5112fe0-38b6-11e8-af9f-6381b5e5403f which can be used as unique global reference for UselessDisk in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

GoScanSSH

During a recent Incident Response (IR) engagement, Talos identified a new malware family that was being used to compromise SSH servers exposed to the internet. This malware, which we have named GoScanSSH, was written using the Go programming language, and exhibited several interesting characteristics. This is not the first malware family that Talos has observed that was written using Go. However, it is relatively uncommon to see malware written in this programming language. In this particular case, we also observed that the attacker created unique malware binaries for each host that was infected with the GoScanSSH malware. Additionally, the GoScanSSH command and control (C2) infrastructure was observed leveraging the Tor2Web proxy service in an attempt to make tracking the attacker-controlled infrastructure more difficult and resilient to takedowns.

Internal MISP references

UUID 8c0a7e1e-3cc4-11e8-8f03-2f71e72f737b which can be used as unique global reference for GoScanSSH in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Rovnix

We recently found that the malware family ROVNIX is capable of being distributed via macro downloader. This malware technique was previously seen in the DRIDEX malware, which was notable for using the same routines. DRIDEX is also known as the successor of the banking malware CRIDEX.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Rovnix.

Known Synonyms
ROVNIX
Internal MISP references

UUID a4036a28-3d94-11e8-ad9f-97ada3c6d5fb which can be used as unique global reference for Rovnix in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Kwampirs

Once Orangeworm has infiltrated a victim’s network, they deploy Trojan.Kwampirs, a backdoor Trojan that provides the attackers with remote access to the compromised computer. When executed, Kwampirs decrypts and extracts a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.

Internal MISP references

UUID d1e548b8-4793-11e8-8dea-6beff82cac0a which can be used as unique global reference for Kwampirs in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Rubella Macro Builder

A crimeware kit dubbed the Rubella Macro Builder has recently been gaining popularity among members of a top-tier Russian hacking forum. Despite being relatively new and unsophisticated, the kit has a clear appeal for cybercriminals: it’s cheap, fast, and can defeat basic static antivirus detection.

Internal MISP references

UUID b7be6732-4ed5-11e8-8b82-dff39eb7a396 which can be used as unique global reference for Rubella Macro Builder in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

kitty Malware

Researchers at Imperva's Incapsula said a new piece malware called Kitty leaves a note for cat lovers. It attacks the Drupal content management system (CMS) to illegally mine cryptocurrency Monero.

Internal MISP references

UUID 85d5da28-51f7-11e8-bbeb-af367d720136 which can be used as unique global reference for kitty Malware in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Maikspy

We discovered a malware family called Maikspy — a multi-platform spyware that can steal users’ private data. The spyware targets Windows and Android users, and first posed as an adult game named after a popular U.S.-based adult film actress. Maikspy, which is an alias that combines the name of the adult film actress and spyware, has been around since 2016.

Internal MISP references

UUID d83ec444-535c-11e8-ae83-831d0a85d77a which can be used as unique global reference for Maikspy in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Huigezi malware

backdoor trojan popular found prevalently in China

Internal MISP references

UUID 6aef5a32-5381-11e8-ac5a-bb46d8986552 which can be used as unique global reference for Huigezi malware in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

FacexWorm

Facebook, Chrome, and cryptocurrency users should be on the lookout for a new malware strain named FacexWorm that infects victims for the purpose of stealing passwords, stealing cryptocurrency funds, running cryptojacking scripts, and spamming Facebook users. This new strain was spotted in late April by Trend Micro researchers and appears to be related to two other Facebook Messenger spam campaigns, one that took place last August, and another one from December 2017, the latter spreading the Digmine malware. Researchers say FacexWorm's modus operandi is similar to the previous two campaigns, but with the addition of new techniques aimed at cryptocurrency users.

Internal MISP references

UUID 86ac8c80-5382-11e8-b893-4f1651951472 which can be used as unique global reference for FacexWorm in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Bankshot

implant used in Operation GhostSecret

Internal MISP references

UUID d9431c02-5391-11e8-931f-4beceb8bd697 which can be used as unique global reference for Bankshot in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Proxysvc

downloader used in Operation GhostSecret

Internal MISP references

UUID dafba168-5391-11e8-87e4-0f93b75d6ac0 which can be used as unique global reference for Proxysvc in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Escad

backdoor used in Operation GhostSecret

Internal MISP references

UUID db36cf9a-5391-11e8-b53a-97adedf48055 which can be used as unique global reference for Escad in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

StalinLocker

A new in-development screenlocker/wiper called StalinLocker, or StalinScreamer, was discovered by MalwareHunterTeam that gives you 10 minutes to enter a code or it will try to delete the contents of the drives on the computer. While running, it will display screen that shows Stalin while playing the USSR anthem and displaying a countdown until files are deleted.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular StalinLocker.

Known Synonyms
StalinScreamer
Internal MISP references

UUID 50eb8c54-5828-11e8-8d6b-232bb9329fc0 which can be used as unique global reference for StalinLocker in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

VPNFilter

Advanced, likely state-sponsored or state-affiliated modular malware. The code of this malware overlaps with versions of the BlackEnergy malware. Targeted devices are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well as QNAP network-attached storage (NAS) systems.

Internal MISP references

UUID 895d769e-b288-4977-a4e1-7d64eb134bf9 which can be used as unique global reference for VPNFilter in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Iron Backdoor

Iron Backdoor uses a virtual machine detection code taken directly from HackingTeam’s Soldier implant leaked source code. Iron Backdoor is also using the DynamicCall module from HackingTeam core library. Backdoor was used to drop cryptocurrency miners.

Internal MISP references

UUID 5433edec-f1c3-4051-a3cc-c7f9fc8972ee which can be used as unique global reference for Iron Backdoor in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Brambul

Brambul malware is a malicious Windows 32-bit SMB worm that functions as a service dynamic link library file or a portable executable file often dropped and installed onto victims’ networks by dropper malware. When executed, the malware attempts to establish contact with victim systems and IP addresses on victims’ local subnets. If successful, the application attempts to gain unauthorized access via the SMB protocol (ports 139 and 445) by launching brute-force password attacks using a list of embedded passwords. Additionally, the malware generates random IP addresses for further attacks.

Internal MISP references

UUID 4c057ade-6989-11e8-9efd-ab33ed427468 which can be used as unique global reference for Brambul in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

PLEAD

PLEAD has two kinds – RAT (Remote Access Tool) and downloader. The RAT operates based on commands that are provided from C&C servers. On the other hand, PLEAD downloader downloads modules and runs it on memory in the same way as TSCookie does.

Internal MISP references

UUID d1482c9e-6af3-11e8-aa8e-279274bd10c7 which can be used as unique global reference for PLEAD in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

BabaYaga

The group behind BabaYaga —believed to be Russian-speaking hackers— uses this malware to inject sites with special keyboards to drive SEO traffic to hidden pages on compromised sites. These pages are then used to redirect users to affiliate marketing links, where if the user purchases advertised goods, the hackers also make a profit. The malware per-se is comprised of two modules —one that injects the spam content inside the compromised sites, and a backdoor module that gives attackers control over an infected site at any time. The intricacies of both modules are detailed in much more depth in this 26-page report authored by Defiant (formerly known as WordFence), the security firm which dissected the malware's more recent versions. "[BabaYaga] is relatively well-written, and it demonstrates that the author has some understanding of software development challenges, like code deployment, performance and management," Defiant researchers say. "It can also infect Joomla and Drupal sites, or even generic PHP sites, but it is most fully developed around Wordpress."

Internal MISP references

UUID 65c0dff4-6b23-11e8-899f-8fcb21ad9649 which can be used as unique global reference for BabaYaga in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

InvisiMole

Except for the malware's binary file, very little is known of who's behind it, how it spreads, or in what types of campaigns has this been used.

"Our telemetry indicates that the malicious actors behind this malware have been active at least since 2013, yet the cyber-espionage tool was never analyzed nor detected until discovered by ESET products on compromised computers in Ukraine and Russia," said ESET researcher Zuzana Hromcová, who recently penned an in-depth report about this new threat.

"All infection vectors are possible, including installation facilitated by physical access to the machine," Hromcová added.

Typical to malware used in highly-targeted attacks, the malware has been stripped of most clues that could lead researchers back to its author. With the exception of one file (dating to October 13, 2013), all compilation dates have been stripped and replaced with zeros, giving little clues regarding its timeline and lifespan.

Furthermore, the malware is some clever piece of coding in itself, as it's comprised of two modules, both with their own set of spying features, but which can also help each other in exfiltrating data.

Internal MISP references

UUID 10f50ef8-6e3b-11e8-a648-d73fb4d2f48e which can be used as unique global reference for InvisiMole in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Roaming Mantis

Roaming Mantis malware is designed for distribution through a simple, but very efficient trick based on a technique known as DNS hijacking. When a user attempts to access any website via a compromised router, they will be redirected to a malicious website. For example, if a user were to navigate to www.securelist.com using a web browser, the browser would be redirected to a rogue server which has nothing to do with the security research blog. As long as the browser displays the original URL, users are likely to believe the website is genuine. The web page from the rogue server displays the popup message: To better experience the browsing, update to the latest chrome version.

Internal MISP references

UUID f35f219a-6eed-11e8-980a-93bb96299951 which can be used as unique global reference for Roaming Mantis in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

PLEAD Downloader

PLEAD is referred to both as a name of malware including TSCookie and its attack campaign. PLEAD has two kinds – RAT (Remote Access Tool) and downloader. The RAT operates based on commands that are provided from C&C servers. On the other hand, PLEAD downloader downloads modules and runs it on memory in the same way as TSCookie does.

Internal MISP references

UUID 7cda6406-6eef-11e8-a2ad-9340096d5711 which can be used as unique global reference for PLEAD Downloader in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

ClipboardWalletHijacker

The malware's purpose is to intercept content recorded in the Windows clipboard, look for strings resembling Bitcoin and Ethereum addresses, and replace them with ones owned by the malware's authors. ClipboardWalletHijacker's end-plan is to hijack BTC and ETH transactions, so victims unwittingly send funds to the malware's authors.

Internal MISP references

UUID 9f926c84-72cb-11e8-a1f2-676d779700ba which can be used as unique global reference for ClipboardWalletHijacker in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

TYPEFRAME

Trojan malware

Internal MISP references

UUID 8981aaca-72dc-11e8-8649-838c1b2613c5 which can be used as unique global reference for TYPEFRAME in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Olympic Destroyer

The Winter Olympics this year is being held in Pyeongchang, South Korea. The Guardian, a UK Newspaper reported an article that suggested the Olympic computer systems suffered technical issues during the opening ceremony. Officials at the games confirmed some technical issues to non-critical systems and they completed recovery within around 12 hours. Sunday 11th February the Olympic games officials confirmed a cyber attack occurred but did not comment or speculate further. Talos have identified the samples, with moderate confidence, used in this attack. The infection vector is currently unknown as we continue to investigate. The samples identified, however, are not from adversaries looking for information from the games but instead they are aimed to disrupt the games. The samples analysed appear to perform only destructive functionality. There does not appear to be any exfiltration of data. Analysis shows that actors are again favouring legitimate pieces of software as PsExec functionality is identified within the sample. The destructive nature of this malware aims to render the machine unusable by deleting shadow copies, event logs and trying to use PsExec & WMI to further move through the environment. This is something we have witnessed previously with BadRabbit and Nyetya.

Internal MISP references

UUID 76d5c7a2-73c3-11e8-bd92-db4d715af093 which can be used as unique global reference for Olympic Destroyer in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

DDKONG

The malware in question is configured with the following three exported functions: ServiceMain,Rundll32Call, DllEntryPoint. The ServiceMain exported function indicates that this DLL is expected to be loaded as a service. If this function is successfully loaded, it will ultimately spawn a new instance of itself with the Rundll32Call export via a call to rundll32.exe. The Rundll32Call exported function begins by creating a named event named ‘RunOnce’. This event ensures that only a single instance of DDKong is executed at a given time. If this is the only instance of DDKong running at the time, the malware continues. If it’s not, it dies. This ensures that only a single instance of DDKong is executed at a given time. DDKong attempts to decode an embedded configuration using a single byte XOR key of 0xC3. After this configuration is decoded and parsed, DDKONG proceeds to send a beacon to the configured remote server via a raw TCP connection. The packet has a header of length 32 and an optional payload. In the beacon, no payload is provided, and as such, the length of this packet is set to zero. After it sends the beacon, the malware expects a response command of either 0x4 or 0x6. Both responses instruct the malware to download and load a remote plugin. In the event 0x4 is specified, the malware is instructed to load the exported ‘InitAction’ function. If 0x6 is specified, the malware is instructed to load the exported ‘KernelDllCmdAction’ function. Prior to downloading the plugin, the malware downloads a buffer that is concatenated with the embedded configuration and ultimately provided to the plugin at runtime. As we can see in the above text, two full file paths are included in this buffer, providing us with insight into the original malware family’s name, as well as the author. After this buffer is collected, the malware downloads the plugin and loads the appropriate function. This plugin provides the attacker with the ability to both list files and download/upload files on the victim machine.

Internal MISP references

UUID 57dd0828-79d7-11e8-a7d8-57db14e1ef24 which can be used as unique global reference for DDKONG in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

PLAINTEE

This sample is configured with three exported functions: Add, Sub, DllEntryPoint. The DLL expects the export named ‘Add’ to be used when initially loaded. When this function is executed PLAINTEE executes a command in a new process to add persistence. Next, the malware calls the ‘Sub’ function which begins by spawning a mutex named ‘microsoftfuckedupb’ to ensure only a single instance is running at a given time. In addition, PLAINTEE will create a unique GUID via a call to CoCreateGuid() to be used as an identifier for the victim. The malware then proceeds to collect general system enumeration data about the infected machine and enters a loop where it will decode an embedded config blob and send an initial beacon to the C2 server. The configuration blob is encoded using a simple single-byte XOR scheme. The first byte of the string is used as the XOR key to in turn decode the remainder of the data. The malware then proceeds to beacon to the configured port via a custom UDP protocol. The network traffic is encoded in a similar fashion, with a random byte being selected as the first byte, which is then used to decode the remainder of the packet via XOR. This beacon is continuously sent out until a valid response is obtained from the C2 server (there is no sleep timer set). After the initial beacon, there is a two second delay in between all other requests made. This response is expected to have a return command of 0x66660002 and to contain the same GUID that was sent to the C2 server. Once this response is received, the malware spawns several new threads, with different Command parameters, with the overall objective of loading and executing a new plugin that is to be received from the C2 server. During a file analysis of PLAINTEE in WildFire, we observed the attackers download and execute a plugin during the runtime for that sample. PLAINTEE expects the downloaded plugin to be a DLL with an export function of either ‘shell’ or ‘file’. The plugin uses the same network protocol as PLAINTEE and so we were able to trivially decode further commands that were sent. The following commands were observed: tasklist, ipconfig /all. The attacker performed these two commands 33 seconds apart. As automated commands are typically performed more quickly this indicates that they may have been sent manually by the attacker.

Internal MISP references

UUID 58b24db2-79d7-11e8-9b1b-bbdbc798af4f which can be used as unique global reference for PLAINTEE in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Koadic

Koadic, or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire. The major difference is that Koadic does most of its operations using Windows Script Host

Internal MISP references

UUID f9e0b922-253c-40fa-a6d2-e60ec9c6980b which can be used as unique global reference for Koadic in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Bisonal

In early May, Unit 42 discovered an attack campaign against at least one defense company in Russia and one unidentified organization in South Korea delivering a variant of Bisonal malware. While not previously publicly documented, the variant has been in the wild since at least 2014. There are three primary differences between it and older Bisonal malware including a different cipher and encryption for C2 communication, and a large rewrite of the code for both network communication and maintaining persistence. To date, we have only collected 14 samples of this variant, indicating it may be sparingly used. The adversary behind these attacks lured the targets into launching the Microsoft Windows executable malware by masquerading it as a PDF file (using a fake PDF icon) and reusing publicly available data for the decoy PDF file’s contents. Attacks using Bisonal have been blogged about in the past. In 2013, both COSEINC and FireEye revealed attacks using Bisonal against Japanese organizations . In October 2017, AhnLab published a report called “Operation Bitter Biscuit,” an attack campaign against South Korea, Japan, India and Russia using Bisonal and its successors, Bioazih and Dexbia.

Internal MISP references

UUID 23f6da78-873a-4ab0-9167-c8b0563627a5 which can be used as unique global reference for Bisonal in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Sekur

Sekur has been CARBON SPIDER’s primary tool for several years, although usage over the last year appears to have declined. It contains all the functionality you would expect from a RAT, allowing the adversary to execute commands, manage the file system, manage processes, and collect data. In addition, it can record videos of victim sessions, log keystrokes, enable remote desktop, or install Ammyy Admin or VNC modules. From July 2014 on, samples were compiled with the capability to target Epicor POS systems and to collect credit card data.

Internal MISP references

UUID ddbd9db5-7875-437b-b7c5-a17d2892d218 which can be used as unique global reference for Sekur in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Agent ORM

Agent ORM began circulating alongside Skeur in campaigns throughout the second half of 2015. The malware collects basic system information and is able to take screenshots of victim systems. It is used to download next-stage payloads when systems of interest are identified. It is strongly suspected that Agent ORM has been deprecated in favor of script-based first-stage implants (VB Flash, JS Flash, and Bateleur).

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Agent ORM.

Known Synonyms
DRIFTPIN
Tosliph
Internal MISP references

UUID c1159097-3dad-48ab-91cf-c055182f5785 which can be used as unique global reference for Agent ORM in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

VB Flash

VB Flash was first observed being deployed alongside Agent ORM in September 2015. It is likely that this was developed as a replacement to Agent ORM and contained similar capabilities. The first observed instance of VB Flash included comments and was easy to analyze—later versions soon began to integrate multiple layers of obfuscation. Several versions of VB Flash were developed including ones that utilized Google Forms, Google Macros, and Google Spreadsheets together to make a command-and-control (C2) channel. This variant would POST victim data to a specified Google form, then make a request to a Google macro script, receiving an address for a Google Spreadsheet from which to request commands.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular VB Flash.

Known Synonyms
HALFBAKED
Internal MISP references

UUID 2815a353-cd56-4ed0-8581-812b94f7a326 which can be used as unique global reference for VB Flash in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

JS Flash

JS Flash capabilities closely resemble those of VB Flash and leverage interesting techniques in deployment via batch scripts embedded as OLE objects in malicious documents. Many iterations of JS Flash were observed being tested before deployment, containing minor changes to obfuscation and more complex additions, such as the ability to download TinyMet (a cutdown of the Metasploit Meterpreter payload). PowerShell was also used heavily for the execution of commands and arbitrary script execution. No JS Flash samples were observed being deployed after November 2017.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular JS Flash.

Known Synonyms
JavaScript variant of HALFBAKED
Internal MISP references

UUID bf03a7ae-3c5e-47b9-84c6-27756297f1b5 which can be used as unique global reference for JS Flash in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

Bateleur

Bateleur deployments began not long after JS Flash and were also written in JavaScript. Deployments were more infrequent and testing was not observed. It is likely that Bateleur was run in parallel as an alternative tool and eventually replaced JS Flash as CARBON SPIDER’s first stage tool of choice. Although much simpler in design than JS Flash, all executing out of a single script with more basic obfuscation, Bateleur has a wealth of capabilities—including the ability to download arbitrary scripts and executables, deploy TinyMet, execute commands via PowerShell, deploy a credential stealer, and collect victim system information such as screenshots.

Internal MISP references

UUID 81faf0c1-0595-436b-a66a-05d8b435bccd which can be used as unique global reference for Bateleur in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

JexBoss

A tool for testing and exploiting vulnerabilities in JBoss Application Servers.

Internal MISP references

UUID 509fc49c-9bd8-11e8-ade9-af561325f046 which can be used as unique global reference for JexBoss in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

reGeorg

“Provides TCP tunneling over HTTP and bolts a SOCKS4/5 proxy on top of it, so, reGeorg is a fully-functional SOCKS proxy and gives ability to analyze target internal network.”

Internal MISP references

UUID 2c62f08a-9bd9-11e8-9e20-db9ec0d2b277 which can be used as unique global reference for reGeorg in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Related clusters

To see the related clusters, click here.

Hyena

An Active Directory and Windows system management software, which can be used for remote administration of servers and workstations.

Internal MISP references

UUID 511d1000-9bd8-11e8-8477-8f5bcff04fb0 which can be used as unique global reference for Hyena in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value

csvde.exe

Imports and exports data from Active Direc