Malware Manifesto

Summary - LockerGoga is a Ransomware variant that appears to be targeting European companies. The encryption process used by LockerGoga is slow, showing a lack of sophistication. LockerGoga was signed using a valid Digital Certificate which has since been revoked. Glossary Blog Back to the Malware Manifesto

Summary - Antova is Ransomware that encrypts files that are 1MB or smaller in size and will also encrypt files on connected network shares. This Ransomware appears to support additional modules which could be used to perform other malicious activities in addition to file encryption. Glossary Blog Back to the Malware Manifesto

Summary - Adwind RAT, first discovered in 2013, is a multi-platform Remote Access Trojan written in Java which is more commonly known as jRat. Adwind is provided as a malware-as-a-service for the attackers most commonly distributing it via malspam. When via a malspam email, a .jar attachment will be the payload. Adwinds capabilities range from collecting keystrokes, taking screen shots and viewing webcam to even stealing VPN certificates. Glossary Blog Back to the Malware Manifesto

Summary - Nanobot is a botnet with hosts controlled by the NanoCore RAT, a Remote Access Trojan that targets Windows operating system users. All versions of the RAT feature base plugins and functionalities such as screen capture, crypto currency mining, remote control of the desktop and webcam session theft. NanoCore is sold on dark web forums for approximately 25 USD, but various versions of the RAT were leaked over time. Glossary Blog Back to the Malware Manifesto

Summary - Andromeda, also known as Gamarue, is a modular botnet whose functionailities can be modified via plugins. Some of its functions include: keylogging, rootkit, teamviewer and spreader. Andromeda was spread many different ways such as malspam, trojan downloads and exploit kits. The primary goal of Andromeda was to distribute other malware families, on top of stealing personal information. In November 2017, in a joint operation, international law enforcement took down the Andromeda botnet by taking control of servers and domains used as C&Cs for the botnet. Glossary Blog Back to the Malware Manifesto

Summary - These are variants which you will typically see come in via compromised RDP accounts in bruteforce attacks. Crysis was first spotted some time in 2016. Due to similarities in code, Dharma is thought to be a product of Crysis. Crysis will usually demand a payment of around $1000-$1500, per machine. GlossaryBlogBack to the Malware Manifesto

Summary - Bitpaymer is a multi vector ransomware which has been seen in RDP scenarios as well as dropped by trojans, such as Trickbot. Bitpaymer is a unique ransomware in that it utilizes alternate data streams (ADS) to hide itself from antivirus. This essentially makes the ransomware file-less shortly after execution. Bitpaymer has been known to charge hefty ransoms, in the case of a London college, reaching 53 bitcoins. GlossaryBlogBack to the Malware Manifesto

  29th August, 2018 By Charlie Osborne ZD Net   Summary - The RIG exploit kit, which at its peak infected an average of 27,000 machines per day, has been grafted with a new tool designed to hijack browsing sessions.  The malware in question, a rootkit called CEIDPageLock, has been distributed through the exploit kit in recent weeks.   According to researchers from Check Point, the rootkit was first discovered in the wild several months ago.   CEIDPageLock was detected when it attempted to tamper with a victim's browser. The malware was attempting to turn their homepage into 2345.com, a legitimate Chinese directory for weather forecasts, TV listings, and more. Article Link - Read more   Glossary Blog Back to the Malware Manifesto

     22nd August, 2018  By Pierluigi Paganini Security Affairs   Summary - Security experts from Kaspersky Labs have spotted a sophisticated strain of banking malware dubbed Dark Tequila that was used to target customers of several Mexican financial institutions. According to the researchers, the complex Dark Tequila malware went undetected since at least 2013.   Dark Tequila is a multistage malware that spreads via spear-phishing messages and infected USB devices. The malware steals financial data from a long list of online banking sites from infected systems, it is also able to gather credentials to popular websites, business and personal email addresses, domain registers, and file storage accounts.   Article Link - Read more  Glossary Blog Back to the Malware Manifesto

     21st August, 2018  By Catalin Cimpanu Bleeping Computer   Summary - A new ransomware strain named Ryuk is making the rounds, and, according to current reports, the group behind it has already made over $640,000 worth of Bitcoin. Attacks with this ransomware strain were first spotted last Monday, August 13, according to independent security researcher MalwareHunter, who first tweeted about this new threat.   Article Link - Read more  Glossary Blog Back to the Malware Manifesto

     16th August, 2018  By Linday O'Donnell Threat Post   Summary - A new downloader, which has been spotted in an array of recent email campaigns, uses anti-analysis techniques and calls in a system fingerprinting module.   A newly discovered downloader malware has been discovered as part of a new campaign primarily targeting financial institutions.   Researchers at Proofpoint said today that the downloader – dubbed “Marap” after its command-and-control phone-home parameter, “param,” spelled backwards – is notable for its focused functionality and modular nature, as well as its ability to perform reconnaissance through a systems-fingerprinting module.   Article Link - Read more  Glossary Blog Back to the Malware Manifesto

     10th August, 2018  By Juha Saarinen IT News   Summary - The United States Computer Emergency Readiness Team (US-CERT) has issued a fresh warning that a new piece of malware believed to be created by North Korean government actors is on the lose on networks around the world.   Known as KEYMARBLE, the malware is a Remote Access Trojan (RAT), US-CERT said and cautioned users against opening attachments in emails, even when the sender appears to be known.   The RAT is a 32-bit Windows executable that can access device configuration data, download further files, run commands, modify the Windows Registry configuration and settings database, take screenshots and exfiltrate data, according to the Malware Analysis Report (MAR) by US-CERT.   Article Link - Read more  Glossary Blog Back to the Malware Manifesto

     8th August, 2018  By Nicky Cappella The Stack   Summary - While DeepLocker has yet to be seen outside of the research lab, all of the tools used to create it are readily available: existing malware, and AI tools that can be trained to recognize a target.   DeepLocker malware can remain undetected for lengthy periods, inactive until presented with an AI trigger – through facial or voice recognition, or geolocation – that indicates a specifically targeted individual. When the trigger is recognized, it acts as a key, activating the dormant malware on the system.   Article Link - Read more  Glossary Blog Back to the Malware Manifesto

     6th August, 2018  By Nick Lewis TechTarget   Summary - Dark Caracal is written in Java, so it can be used against any computer that executes Java code. It is an immature remote access tool that appears to be used by nation-state actors, but it only works on systems with Java installed -- so it shouldn't affect most systems running macOS 10.7 and later, as those versions no longer install the Java runtime by default.   Article Link - Read more  Glossary Blog Back to the Malware Manifesto

   6th August, 2018  By Tara Seals Bleeping Computer   Summary - A massive proxy botnet is just the tip of the iceberg, a warning sign of a bigger operation in the works by the Ramnit operators.   The recently uncovered “Black” botnet campaign using the Ramnit malware racked up 100,000 infections in the two months through July– but the offensive could just be a precursor to a much larger attack coming down the pike, according to researchers, thanks to a second-stage malware called Ngioweb.   Check Point Research said that the actors behind the Black botnet are mainly working on creating a network of malicious proxy servers; infected machines that together operate as a high-centralized botnet, “though its architecture implies division into independent botnets.”   Article Link - Read more  Glossary Blog Back to the Malware Manifesto