Skip to main content
Customer Support Customer Support

Malware Manifesto

A database of major known threats as seen by Webroot and other security channels.

  • 73 Topics
  • 0 Replies
Knowledge Base

Trojan

  • 6
  • 0
Knowledge base

Cryptominer

  • 4
  • 0
Knowledge Base

Ransomware

  • 2
  • 0
73 Topics
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
WannaCry

Summary - This is a ransomware payload distributed using wormlike exploit kits. Together with NotPeya, they were most devasting type of ransomware attack that's been released to date causing over $5 Billion in damages. The exploit kits used were EternalBlue and EternalRomance and they abused the SMB (Server Message Block) that's built into windows XP and newer operating systems. What's important about this is it allowed the ransomware to infect computers that had no external connection to the internet, but instead were on a local network in the organization. This meant that only one computer on the local network needed connection to the internet to act as a gateway and infect all these machines that had previously never been infected by ransomware. This allowed the WannaCry payload to infect over a hundred thousand computers in under 24 hours and shut down hospitals, power grids, car manufacturing plants, and shipping vessels. The attack only lasted a few days from May 12th - May 15th

290
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
GANDCRAB

28th February, 2018 By Tomas Meskauskas PCrisk Summary - GANDCRAB is another ransomware-type virus distributed using RigEK toolkit. Once infiltrated, encrypts most stored data and adds the ".GDCB" extension to the name of each compromised file. From this point, files become unusable. Immediately after encryption, GANDCRAB generates a "GDCB-DECRYPT.txt" file and places a copy in every existing folder. The new text file contains information regarding the current situation and instructs victims what to do next. To decrypt data, victims must open a Tor web page and follow the instructions within. The website states that decryption requires a unique key, which is stored on a remote server controlled by GANDCRAB's developers. Unfortunately, this information is accurate. Although it is currently unknown whether GANDCRAB uses symmetric or asymmetric cryptography, in all cases, file decryption without the key is impossible. Therefore, victims are encouraged to pay 1.5 Dash (cryptocurrency), cur

240
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
ADB.Miner

12th June, 2018 By Chris Smith BGR Summary - Be careful what you side-load on your Amazon Fire TV and Fire TV Stick, as there’s a new strain of malware going around that can affect Amazon’s products even though the app isn’t exactly tailored for these devices. The purpose of the virus app called ADB.Miner is quite simple: to turn gadgets into cryptocurrency miners. I’m sure you’ve heard of this type of malware before, as it targets plenty of other platforms. But yes, it’s 2018, and your TV can get a virus now, because we live in the future. Article Link - Read more Glossary Blog Back to the Malware Manifesto

220
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
PyRoMineloT

June 12th, 2018 By Ionut Arghire Security Week Summary - A recently discovered piece of crypto-currency miner malware isn’t only abusing a National Security Agency-linked remote code execution exploit to spread, but also abuses infected machines to scan for vulnerable Internet of Things (IoT) devices. Dubbed PyRoMineIoT, the malware is similar to the PyRoMine crypto-currency miner that was detailed in late April. Both mine for Monero, both are Python-based, and both use the EternalRomance exploit for propagation purposes (the vulnerability was patched in April last year). Article Link - Read more Glossary Blog Back to the Malware Manifesto

150
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
InvisiMole

8th June, 2018 By Catalin Cimpanu Bleeping Computer Summary - Security researchers from ESET have discovered a complex piece of spyware that was used sparingly in the last five years to infect and spy on a very small number of targets in Russia and Ukraine. While the origin of this new malware strain —named InvisiMole— have not been determined yet, it is believed that this is an advanced cyber-espionage tool, most likely created for nation-state or financially-motivated hacks. This assessment is based on the fact that the malware has been seen very rarely, being found on "only a few dozen computers," but also because of its broad spectrum of capabilities, something that would have taken months if not years to develop, and certainly not the work of your ordinary slash-and-grab cyber-criminal. Article Link - Read more Glossary Blog Back to the Malware Manifesto

190
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
DMOSK

June 8, 2018 By Pierluigi Paganini Security Affairs Summary - The security expert and malware researcher Marco Ramilli published a detailed analysis on a new strain of malware dubbed DMOSK that targets Italian firms. Today I’d like to share another interesting analysis made by my colleagues and I. It would be a nice and interesting analysis since it targeted many Italian and European companies. Fortunately, the attacker forgot the LOG.TXT freely available on the dropping URL letting us know the IP addresses who clicked on the first stage analyzed stage (yes, we know the companies who might be infected). Despite what we did with TaxOlolo we will not disclose the victims IP addresses and so the companies which might be infected. National CERTs have been involved and they’ve got alerted. Since we believe the threat could radically increase its magnitude in the following hours, we decided to write up this quick dirty analysis focusing on speed rather than on details. So please forgive some

140
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
Killdisk

8th June, 2018 By Ionut Arghire Security Week Summary - A new version of the destructive KillDisk malware was observed earlier this year targeting organizations in Latin America, Trend Micro reports. KillDisk has been around for several years, and was used in attacks targeting Ukraine’s energy sector in 2015, orchestrated by the Russia-linked threat actor BlackEnergy. Initially designed to wipe hard drives and render systems inoperable, the malware received file-encrypting capabilities in late 2016, with a Linux-targeting variant of the ransomware spotted shortly after. Article Link - Read more Glossary Blog Back to the Malware Manifesto

400
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
BabaYaga

7th June, 2018 By Catalin Cimpanu Bleeping Computer Summary - Security researchers have spotted a malware strain targeting WordPress sites that includes some pretty clever self-preservation techniques, such as removing competing malware and updating the victim's site. Named BabaYaga, this malware strain isn't new, but recent updates have transformed this former low-key player into a considerable foe for WordPress site administrators. Article Link - Read more Glossary Blog Back to the Malware Manifesto

150
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
RedEye

6th June, 2018 By Anonymous Blaze's Security Blog Summary - A rather anonymous account reached out to me on Twitter asking to check out a "scary & really nasty" sample. It turned out to be RedEye ransomware, a new strain or variant by the same creator of Annabelle ransomware, which I discovered in February earlier this year. Article Link - Read more Glossary Blog Back to the Malware Manifesto

140
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
SocketPlayer

6th June, 2018 By Ionut Arghire Security Week Summary - A recently discovered remote access Trojan is using a specialized program library that allows operators to interact with the infected machines directly, without an initial “beacon” message, G Data reports. Dubbed SocketPlayer, the backdoor stands out because it doesn’t use the typical one-way communication system that most banking Trojans, backdoors, and keyloggers use. Instead, it employs the socket.io library, which enables real-time, bi-directional communication between applications. Article Link - Read more Glossary Blog Back to the Malware Manifesto

250
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
DanaBot

31st May, 2018 By Anonymous Proofpoint Staff Summary - 2018 has seen a marked shift away from high-volume, immediately destructive ransomware campaigns to distribution of banking Trojans, information stealers, and downloaders. Banking Trojans now make up almost 60% of malicious payloads we observe in email. Now a new banking Trojan has emerged, adding to the growing diversity of this segment specifically and malicious email campaigns in general. Proofpoint researchers discovered a new banking Trojan, dubbed “DanaBot”, targeting users in Australia via emails containing malicious URLs. Written in Delphi, the malware is still under active development. To date, we have only observed it in use by a single threat actor. However, it remains to be seen if distribution and use becomes more widespread given that the actor is known for purchasing banking Trojans from other developers and operators. We also found additional samples in malware repositories other than those we observed in the wild,

390
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
Mirai

1st June, 2018 By John Leyden The Register Summary - Cybercrooks are using the infamous Mirai IoT botnet as a framework to quickly add in new exploits and functionalities, it has emerged. The tactic is dramatically decreasing the development time for new botnets, according to research from Netscout's Arbor Security Engineering and Response Team (ASERT). The work looks at four Mirai variants – Satori, JenX, OMG and Wicked – to illustrate how their authors have built upon Mirai and added their own flair. Article Link - Read more Glossary Blog Back to the Malware Manifesto

160
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
Emotet

25th May, 2018 By Vishal Thakur MalwareBytes Labs Summary - Emotet Banking Trojan malware has been around for quite some time now. As such, infosec researchers have made several attempts to develop tools to de-obfuscate and even decrypt the AES-encrypted code belonging to this malware. The problem with these tools is that they target active versions of the malware. They run into problems when the authors of the malware change the code. The change could be anything from slight variations to the code structure to drastic changes such as moving from a VBA project to PowerShell scripting. Usually, even a minor code variation breaks the tools. Article Link - Read more Quote from Threat - "Be sure to watch out this year for new social engineering scams looking to take advantage of this holiday. All of these fake greeting card links lead to a word document that will download emotet banking trojan if you enable the macro." Glossary Blog Back to the Malware Manifesto

1630
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
The Nocturnal Stealer

31st May, 2018 By Tara Seals Threat Post Summary - The Nocturnal Stealer malware has crept into the Dark Web like a thief in the night, offering criminals a lucrative payday for a small price — and little effort. It’s a commodity malware, debuting on an underground forum in March for the low price of $25. It steals things, including 28 different kinds of cryptocurrency wallets, saved FTP passwords within FileZilla, and Chrome and Firefox browser information (such as login credentials, cookies, web data, autofill data and stored credit cards). It also zips up system data, including IP address and language, machine ID, date/time, installation location, operating system, architecture, username, processor type, video card info and a list of all running processes, to send to the C2 server. Article Link - Read more Glossary Blog Back to the Malware Manifesto

310
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
Brambul

30th May, 2018 By Eduard Kovacs Security Week Summary - The U.S. Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have issued another joint technical alert on the North Korea-linked threat group known as Hidden Cobra. The latest alert attributes the Joanap backdoor trojan and the Brambul worm to the North Korean government. It provides IP addresses and other indicators of compromise (IoC) associated with these threats in an effort to help organizations protect their networks against attacks. Article Link - Read more Glossary Blog Back to the Malware Manifesto

270
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
Joanap

30th May, 2018 By Eduard Kovacs Security Week Summary - The U.S. Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have issued another joint technical alert on the North Korea-linked threat group known as Hidden Cobra. The latest alert attributes the Joanap backdoor trojan and the Brambul worm to the North Korean government. It provides IP addresses and other indicators of compromise (IoC) associated with these threats in an effort to help organizations protect their networks against attacks. Article Link - Read more Glossary Blog Back to the Malware Manifesto

220
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
MnuBot

29th May, 2018 By Ionut Arghire Security Week Summary - A recently discovered banking Trojan leverages Microsoft SQL Server for communication with the command and control (C&C), IBM has discovered. Dubbed MnuBot, the malware uses the database server for communication with the bot and to send commands to the infected machines. The Trojan features two components, each in charge of a different phase of a two-stage attack flow. Article Link - Read more Glossary Blog Back to the Malware Manifesto

190
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
MalHide

28th May, 2018 By Pierluigi Paganini Security Affairs Summary - The cybersecurity experts Marco Ramilli analyzed a new sample of malware dubbed MalHide that implements a quite new attack path to use the compromised system as eMail relay in order to hide the attacker networks. I believe this is a quite interesting Malware because it firstly implements several obfuscation stages by using different obfuscation techniques and secondly it implements a quite new attack path (not new per-se but new on opportunistic malware families) where the attacker doesn’t want to steal information and/or compromise a system for possession and/or destruction but the attacker uses the compromised system as eMail relay in order to hide the attacker networks. It is amazing to figure out that attackers are primary moving on fraud direction. For example, having a successful privilege access on the victim machine, the attacker might decide to perform several malicious actions, but among all the choices, he decid

140
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
BackSwap

25th May, 2018 By Catalin Cimpanu Bleeping Computer Summary - Security researchers have discovered a new banking trojan named BackSwap that uses never-before-seen techniques to facilitate the theft of online funds. The techniques the trojan uses have not been observed with another malware family, and they can bypass antivirus software detection and security protections put in place at the browser level. Experts believe these techniques will soon be copied by other groups and spread around to trigger a new wave of banking trojan attacks right when infections with this malware type have begun to go down. Article Link - Read more Glossary Blog Back to the Malware Manifesto

210
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
VPNFilter

23rd May, 2018 By William Largent Talos Intelligence Summary - For several months, Talos has been working with public- and private-sector threat intelligence partners and law enforcement in researching an advanced, likely state-sponsored or state-affiliated actor's widespread use of a sophisticated modular malware system we call "VPNFilter." We have not completed our research, but recent events have convinced us that the correct way forward is to now share our findings so that affected parties can take the appropriate action to defend themselves. In particular, the code of this malware overlaps with versions of the BlackEnergy malware — which was responsible for multiple large-scale attacks that targeted devices in Ukraine. While this isn't definitive by any means, we have also observed VPNFilter, a potentially destructive malware, actively infecting Ukrainian hosts at an alarming rate, utilizing a command and control (C2) infrastructure dedicated to that country. Weighing these factor

150
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
CryptoLocker

Summary - The very first variants of Cryptolocker ransomware came out in late September 2013. The idea behind it stemmed directly from the FBI Moneypak/Ukash scams that would lock your computer right before you could log into windows and demand ransom to get back into the computer. Except with this family of malware, your files were locked away through encryption and victims had to pay the ransom to get their files back. The big difference was that you couldn't fix this malware by taking it to a computer technician as there was no way for technicians to decypt the files - you had to pay the ransom. It was an instant success as far as criminal business models go, and soon there were many variants of ransomware infecting users around the world. Early editions also accepted the still widely used Ukash and MoneyPak as forms of payment, but would provide a discount for Bitcoin. This set the precedence for a preference of cryptocurrency over preloaded cash cards and from then on out Ransomwa

190
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
CryptON

23rd May, 2018 By Lawrence Abrams Bleeping Computer Summary - A new and active campaign for the CryptON Ransomware is currently underway where attackers are hacking into computers with Internet accessible Remote Desktop Services. Once the attackers gain access to the computer they manually execute the ransomware and encrypt your files. This new campaign was first discovered by Malwarebytes security researcher S!Ri who posted about it on Twitter. Article Link - Read more Glossary Blog Back to the Malware Manifesto

130
LLiddell
LLiddell
LLiddellRetired Webrooter
posted in Malware Manifesto
Vega Stealer

Summary - There's a new form of malware on the Web that is stealing card information from browsers (among other things) and we've had a few people reach out and ask if they are protected. So to answer that question, yes, so long as you have Webroot installed, we have you covered. Article Link - Read more Glossary Blog Back to the Malware Manifesto

150
LLiddell

Latest solutions

Leaderboard

Badges

  • Most Wanted
    Tarnakhas earned the badge Most Wanted
  • Beta To The Max
    Tarnakhas earned the badge Beta To The Max
  • Most Wanted
    Muddy7has earned the badge Most Wanted
  • Beta To The Max
    Muddy7has earned the badge Beta To The Max
  • Beta To The Max
    pierrequiroulehas earned the badge Beta To The Max
Show all badges

Popular Tags

Join the Conversation

Terms & Conditions