Skip to main content

Events
Leaderboard
Customer Support

Nastiest Malware 2023

11 months ago

Home
Community overview
Welcome
Malware Manifesto

Malware Manifesto

A database of major known threats as seen by Webroot and other security channels.

73 Topics
0 Replies

When you subscribe we will email you when there is a new topic in this category

Knowledge Base

Trojan

6
0

Knowledge base

Cryptominer

3
0

Knowledge Base

Ransomware

2
0

73 Topics

Recently active

Most replies Most views Newest first

LLiddellRetired Webrooter

published in Malware Manifesto

BotnetKnowledge Base

A network of private computers infected with malicious software and controlled as a group without the owners' knowledge, e.g., to send spam messages. [list] [*][url=https://community.webroot.com/malware-manifesto-5/andromeda-336692]Andromeda[/url] [*][url=https://community.webroot.com/malware-manifesto-5/nanobot-336693]Nanobot[/url] [*][url=https://community.webroot.com/malware-manifesto-5/adwind-336694]Adwind[/url] [/list]

LLiddellRetired Webrooter

published in Malware Manifesto

SpywareKnowledge Base

Spyware is software that aims to gather information about a person or organization sometimes without their knowledge, that may send such information to another entity without the consumer's consent, that asserts control over a device without the consumer's knowledge, or it may send such information to another entity with the consumer's consent, through cookies.Below are some of the known spyware variants: KEYMARBLE RANCOR Vermin HeroRAT InvisiMole SocketPlayer Joker

LLiddellRetired Webrooter

published in Malware Manifesto

WormKnowledge Base

A Worm’s purpose is to propagate and spread as much as it can because it’s usually designed to find a specific environment as its target. It differs from a virus in that it doesn’t need a host file to infect and spread. Once the worm reaches its target environment it has limitless options of the end goal from the attacker, like deleting files or delivering other malware payloads like ransomware. Ransomware combined with worms using exploits was made famous with the WannaCry and NotPetya attacks in 2017 that caused over $5 Billion in damage. [b]Below are some of the known worm variants:[/b] [list] [*][url=https://community.webroot.com/malware-manifesto-5/brambul-322239]Brambul[/url] [/list]

LLiddellRetired Webrooter

published in Malware Manifesto

TrojanKnowledge Base

Trojans are installed generally without a user’s full, meaningful, and informed consent. A Trojan differs from most malware as the payload (or the behavior) of a Trojan can be controlled potentially from a remote site. [b]Trojan Dropper[/b]: A file that contains at least one additional, malicious file. For a file to be a Trojan Dropper and not solely a “dropper” its payload must be comprised of multiple, unrelated spies (multiple, unrelated spies indicate that this is a custom, affiliate installer). A Trojan Dropper may be an executable that contains multiple files. When the Trojan Dropper executes, the files inside the .exe are installed. A Trojan Dropper may also be a .chm (Windows Help File). Since a .chm is really a Windows proprietary compressor, it may contain multiple, malicious bundles inside the .chm, which the Trojan Dropper installs when the user exec Trojan Downloader: After installation, the Trojan contacts a remote host/site and installs packages or affiliates from the

LLiddellRetired Webrooter

published in Malware Manifesto

CryptominerKnowledge base

The world of cryptocurrency is in its infancy stages, but criminals have been using it for years and proving the utility and anonymity of blockchain technology. Not to mention the spike in interest and speculative price on the technology has really put a focus for criminals to accumulate as much as possible. The ledger system required for blockchain tech requires mining as a fundamental. Criminals have found ways to leverage victims computers to be part of the mining operation. Victims computers will have their CPU stolen in order to mine the cryptocurrency to which the criminals will be directly rewarded without having to deal with victims for any payment scheme. It’s now grown so popular with the profitability along with minimal illegal footprint, that its one of top threats in the landscape today. [b]Below are some of the known cryptominer variants:[/b] [list] [*][url=https://community.webroot.com/malware-manifesto-5/powerghost-325335]PowerGhost[/url] [*][url=https://communi

LLiddellRetired Webrooter

published in Malware Manifesto

RansomwareKnowledge Base

Quite possibly the most devastating malware for victims and most profitable for criminals. This type of malware aims to block access to your data by either encrypting your files or the entire hard drive. To get your data back, victims are forced pay the criminals ransom to get their files back. Historically, ransom payments to cybercriminals was through Ukash and Moneypak, but with the emergence of cryptocurrency and the anonymity and versatility it offers, crypto is now the only payment criminals will take. There is no guarantee that victims will get their files back, but for the most part criminals do decrypt the files or else no one would pay the ransom. This is one of the most popular payloads of choice for criminals and it’s been featured in just about every type of attack vector like email attachments, exploit kits, browser extensions, office macros, Remote Desktop Protocol (RDP), ect. If a cybercriminal has breached your system the most likely end result will be ransomware. F

LLiddellRetired Webrooter

published in Malware Manifesto

VirusKnowledge Base

The oldest of all malware is the virus and it’s been around since the 70's. Designed to attach its code to other programs. Once those infected programs are executed, the virus will duplicate itself and spread like mad. Today, “Viruses” by their strict definition are rare in the wild and are usually in the form of file infectors. [b]Below are some of the known virus variants:[/b] [list] [*][url=https://community.webroot.com/malware-manifesto-5/ceidpagelock-331470]CEIDPageLock[/url] [*][url=https://community.webroot.com/malware-manifesto-5/dark-tequila-327238]Dark Tequila[/url] [*][url=https://community.webroot.com/malware-manifesto-5/marap-326787]Marap[/url] [*][url=https://community.webroot.com/malware-manifesto-5/deeplocker-326191]DeepLocker[/url] [*][url=https://community.webroot.com/malware-manifesto-5/dark-caracal-325951]Dark Caracal[/url] [*][url=https://community.webroot.com/malware-manifesto-5/ramnit-325795]Ramnit[/url] [*][url=https://community.webroot.com/malware-

LLiddellRetired Webrooter

published in Malware Manifesto

Keyloggers/System MonitorsKnowledge Base

Keyloggers and System monitors are either commercial or non-commercial. A commercial system monitor is a piece of software with system monitor characteristics, obtained with a legitimate license by legal means. All other system monitors are non-commercial system monitors. The system monitor category encompasses any software that performs the following actions: [list] [*]Overtly or covertly records system processes and/or user actions [*]Makes those records available for retrieval and review at a later time [/list]These processes can include any action on a machine from the time it turns on to the time it turns off, such as: [list] [*]Time of power on [*]Login information [*]E-mail passwords [*]Financial account information [*]Credit card numbers [*]Social security numbers [*]Screenshots [*]Phone numbers [*]Addresses [*]Keystrokes [*]Webcam photos [*]Sound [*]Time of power off [*]Any other computer activity [/list] [url=https://community.webroot.com/t5/Malware-M

freydrewRetired Webrooter

published in Malware Manifesto

Joker is Spyware and a premium subscription bot that was found on Google Play. It has been detected in 24 apps so far with over 472,000 installs. The name "the Joker" was borrowed from one of the C&C domain names. It silently simulates the interaction with advertisement sites, steals SMS messages, contacts, and device info. Google has already removed all of the apps listed in this article from Google Play and we have had these marked in our system since early last week[i].[/i] Article Link - Read moreGlossary Blog Back to the Malware Manifesto [i]Use our[/i] [url=https://www.webroot.com/us/en/home/products/free-virus-scan][i]free virus scanner[/i][/url][i] to make sure your devices aren't affected or use our[/i] [url=https://www.webroot.com/us/en/home/products/av][i]antivirus software[/i][/url][i] to always stay protected.[/i]

LLiddellRetired Webrooter

published in Malware Manifesto

Jokeroo (Formerly GandCrab)

[b][u]Summary[/u] -[/b] Jokeroo is a RaaS or Ransomware-as-a-Service being sold on the Darkweb. This RaaS requires an up front member fee. This ranges from $90 - $600 which allows the purchaser to keep anywhere from 85% to 100% of profits and even extra items such as Salsa20 encryption. Jokeroo was initially promoting itself as GandCrab which was then later changed to Jokeroo. [url=https://www.webroot.com/us/en/resources/glossary]Glossary[/url] [url=https://www.webroot.com/blog/]Blog[/url] [url=https://community.webroot.com/t5/Malware-Manifesto/tkb-p/Malware_Archive_KB]Back to the Malware Manifesto[/url]

LLiddellRetired Webrooter

posted in Malware Manifesto

[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/09eec67f-769d-43c4-a57b-32e223c4a7a5.png[/img] [b][u]Summary[/u][/b] - LockerGoga is a Ransomware variant that appears to be targeting European companies. The encryption process used by LockerGoga is slow, showing a lack of sophistication. LockerGoga was signed using a valid Digital Certificate which has since been revoked. [url=https://www.webroot.com/us/en/resources/glossary]Glossary[/url] [url=https://www.webroot.com/blog/]Blog[/url] [url=https://community.webroot.com/t5/Malware-Manifesto/tkb-p/Malware_Archive_KB]Back to the Malware Manifesto[/url]

LLiddellRetired Webrooter

posted in Malware Manifesto

[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/1fc778ba-96db-47b2-ae20-565227f38a96.png[/img] [b][u]Summary[/u][/b] - Antova is Ransomware that encrypts files that are 1MB or smaller in size and will also encrypt files on connected network shares. This Ransomware appears to support additional modules which could be used to perform other malicious activities in addition to file encryption. [url=https://www.webroot.com/us/en/resources/glossary]Glossary[/url] [url=https://www.webroot.com/blog/]Blog[/url] [url=https://community.webroot.com/t5/Malware-Manifesto/tkb-p/Malware_Archive_KB]Back to the Malware Manifesto[/url]

LLiddellRetired Webrooter

posted in Malware Manifesto

[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/d05721c3-4a8f-44f8-8bd1-4559662db16e.png[/img] [b][u]Summary[/u] - [/b]Adwind RAT, first discovered in 2013, is a multi-platform Remote Access Trojan written in Java which is more commonly known as jRat. Adwind is provided as a malware-as-a-service for the attackers most commonly distributing it via malspam. When via a malspam email, a .jar attachment will be the payload. Adwinds capabilities range from collecting keystrokes, taking screen shots and viewing webcam to even stealing VPN certificates. [url=https://www.webroot.com/us/en/resources/glossary]Glossary[/url] [url=https://www.webroot.com/blog/]Blog[/url] [url=https://community.webroot.com/t5/Malware-Manifesto/tkb-p/Malware_Archive_KB]Back to the Malware Manifesto[/url]

LLiddellRetired Webrooter

posted in Malware Manifesto

[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/723be623-6ddf-4ce0-ada2-b0a67b3cb0b2.png[/img] [b][u]Summary[/u] - [/b]Nanobot is a botnet with hosts controlled by the NanoCore RAT, a Remote Access Trojan that targets Windows operating system users. All versions of the RAT feature base plugins and functionalities such as screen capture, crypto currency mining, remote control of the desktop and webcam session theft. NanoCore is sold on dark web forums for approximately 25 USD, but various versions of the RAT were leaked over time. [url=https://www.webroot.com/us/en/resources/glossary]Glossary[/url] [url=https://www.webroot.com/blog/]Blog[/url] [url=https://community.webroot.com/t5/Malware-Manifesto/tkb-p/Malware_Archive_KB]Back to the Malware Manifesto[/url]

LLiddellRetired Webrooter

posted in Malware Manifesto

[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/f53e4222-1e10-44fe-97a2-b1ac76836226.png[/img] [b]Summary -[/b] Andromeda, also known as Gamarue, is a modular botnet whose functionailities can be modified via plugins. Some of its functions include: keylogging, rootkit, teamviewer and spreader. Andromeda was spread many different ways such as malspam, trojan downloads and exploit kits. The primary goal of Andromeda was to distribute other malware families, on top of stealing personal information. In November 2017, in a joint operation, international law enforcement took down the Andromeda botnet by taking control of servers and domains used as C&Cs for the botnet. [url=https://www.webroot.com/us/en/resources/glossary]Glossary[/url] [url=https://www.webroot.com/blog/]Blog[/url] [url=https://community.webroot.com/t5/Malware-Manifesto/tkb-p/Malware_Archive_KB]Back to the Malware Manifesto[/url]

LLiddellRetired Webrooter

posted in Malware Manifesto

[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/38f222e4-8dda-441a-85b4-f739eb0c8af5.png[/img] [b]Summary -[/b] These are variants which you will typically see come in via compromised RDP accounts in bruteforce attacks. Crysis was first spotted some time in 2016. Due to similarities in code, Dharma is thought to be a product of Crysis. Crysis will usually demand a payment of around $1000-$1500, per machine. [url=https://www.webroot.com/us/en/resources/glossary]Glossary[/url][url=https://www.webroot.com/blog/]Blog[/url][url=https://community.webroot.com/t5/Malware-Manifesto/tkb-p/Malware_Archive_KB]Back to the Malware Manifesto[/url]

LLiddellRetired Webrooter

posted in Malware Manifesto

[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/2d324c5f-11d3-40a2-9678-87c362fb9276.png[/img] [b]Summary -[/b] Bitpaymer is a multi vector ransomware which has been seen in RDP scenarios as well as dropped by trojans, such as Trickbot. Bitpaymer is a unique ransomware in that it utilizes alternate data streams (ADS) to hide itself from antivirus. This essentially makes the ransomware file-less shortly after execution. Bitpaymer has been known to charge hefty ransoms, in the case of a London college, reaching 53 bitcoins. [url=https://www.webroot.com/us/en/resources/glossary]Glossary[/url][url=https://www.webroot.com/blog/]Blog[/url][url=https://community.webroot.com/t5/Malware-Manifesto/tkb-p/Malware_Archive_KB]Back to the Malware Manifesto[/url]

LLiddellRetired Webrooter

posted in Malware Manifesto

[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/36389iF8252C3A4F490267.png[/img]   [i]29th August, 2018 By Charlie Osborne [url=https://www.zdnet.com/article/meet-the-malware-which-hijacks-your-browser-redirects-you-to-fake-pages/]ZD Net[/url][/i]   [u][b]Summary[/b][/u][b] - [/b]The RIG exploit kit, which at its peak infected an average of 27,000 machines per day, has been grafted with a new tool designed to hijack browsing sessions.  The malware in question, a rootkit called CEIDPageLock, has been distributed through the exploit kit in recent weeks.   According to researchers from Check Point, the rootkit was first discovered in the wild several months ago.   CEIDPageLock was detected when it attempted to tamper with a victim's browser. The malware was attempting to turn their homepage into 2345.com, a legitimate Chinese directory for weather forecasts, TV listings, and more. [b][u]Article Link[/u] - [url=ht

LLiddellRetired Webrooter

posted in Malware Manifesto

  [img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/35582i135D5A2F168353F7.png[/img]    [i]22nd August, 2018  By Pierluigi Paganini [url=https://securityaffairs.co/wordpress/75523/malware/dark-tequila-banking-malware.html]Security Affairs[/url][/i]   [u][b]Summary[/b][/u] - Security experts from Kaspersky Labs have spotted a sophisticated strain of banking malware dubbed Dark Tequila that was used to target customers of several Mexican financial institutions. According to the researchers, the complex Dark Tequila malware went undetected since at least 2013.   Dark Tequila is a multistage malware that spreads via spear-phishing messages and infected USB devices. The malware steals financial data from a long list of online banking sites from infected systems, it is also able to gather credentials to popular websites, business and personal email addresses, domain registers, and file storage acco