Malware Manifesto

Summary - LockerGoga is a Ransomware variant that appears to be targeting European companies. The encryption process used by LockerGoga is slow, showing a lack of sophistication. LockerGoga was signed using a valid Digital Certificate which has since been revoked. Glossary Blog Back to the Malware Manifesto

Summary - Antova is Ransomware that encrypts files that are 1MB or smaller in size and will also encrypt files on connected network shares. This Ransomware appears to support additional modules which could be used to perform other malicious activities in addition to file encryption. Glossary Blog Back to the Malware Ma

Summary - Adwind RAT, first discovered in 2013, is a multi-platform Remote Access Trojan written in Java which is more commonly known as jRat. Adwind is provided as a malware-as-a-service for the attackers most commonly distributing it via malspam. When via a malspam email, a .jar attachment will be the payload. Adwinds capabilities range from collecting keystrokes, taking screen shots and viewing webcam to even stealing VPN certificates. Glossary Blog

Summary - Nanobot is a botnet with hosts controlled by the NanoCore RAT, a Remote Access Trojan that targets Windows operating system users. All versions of the RAT feature base plugins and functionalities such as screen capture, crypto currency mining, remote control of the desktop and webcam session theft. NanoCore is sold on dark web forums for approximately 25 USD, but various versions of the RAT were leaked over time. Glossary Blog

Summary - Andromeda, also known as Gamarue, is a modular botnet whose functionailities can be modified via plugins. Some of its functions include: keylogging, rootkit, teamviewer and spreader. Andromeda was spread many different ways such as malspam, trojan downloads and exploit kits. The primary goal of Andromeda was to distribute other malware families, on top of stealing personal information. In November 2017, in a joint operation, international law enforcement took down the Andromeda botnet by taking control of servers and domains used as C&Cs for the botnet. G

Summary - These are variants which you will typically see come in via compromised RDP accounts in bruteforce attacks. Crysis was first spotted some time in 2016. Due to similarities in code, Dharma is thought to be a product of Crysis. Crysis will usually demand a payment of around $1000-$1500, per machine. GlossaryBlogBack

Summary - Bitpaymer is a multi vector ransomware which has been seen in RDP scenarios as well as dropped by trojans, such as Trickbot. Bitpaymer is a unique ransomware in that it utilizes alternate data streams (ADS) to hide itself from antivirus. This essentially makes the ransomware file-less shortly after execution. Bitpaymer has been known to charge hefty ransoms, in the case of a London college, reaching 53 bitcoins. GlossaryBlog

  29th August, 2018 By Charlie Osborne ZD Net   Summary - The RIG exploit kit, which at its peak infected an average of 27,000 machines per day, has been grafted with a new tool designed to hijack browsing sessions.  The malware in question, a rootkit called CEIDPageLock, has been distributed through the exploit kit in recent weeks.   According to researchers from Check Point, the rootkit was first discovered in the wild several months ago. &nbsp

     22nd August, 2018  By Pierluigi Paganini Security Affairs   Summary - Security experts from Kaspersky Labs have spotted a sophisticated strain of banking malware dubbed Dark Tequila that was used to target customers of several Mexican financial institutions. According to the researchers, the complex Dark Tequila malware went undetected since at least 2013.   Dark Tequila is a multistage malware that spreads via spear-phishing messages and infected

     21st August, 2018  By Catalin Cimpanu Bleeping Computer   Summary - A new ransomware strain named Ryuk is making the rounds, and, according to current reports, the group behind it has already made over $640,000 worth of Bitcoin. Attacks with this ransomware strain were first spotted last Monday, August 13, according to independent security researcher MalwareHunter, who first tweeted about this new threat.   Article Link - 

     16th August, 2018  By Linday O'Donnell Threat Post   Summary - A new downloader, which has been spotted in an array of recent email campaigns, uses anti-analysis techniques and calls in a system fingerprinting module.   A newly discovered downloader malware has been discovered as part of a new campaign primarily targeting financial institutions.   Researchers at Proofpoint said today that the downloader – dubbed “Marap” after its command-and-control phone-h

     10th August, 2018  By Juha Saarinen IT News   Summary - The United States Computer Emergency Readiness Team (US-CERT) has issued a fresh warning that a new piece of malware believed to be created by North Korean government actors is on the lose on networks around the world.   Known as KEYMARBLE, the malware is a Remote Access Trojan (RAT), US-CERT said and cautioned users against opening attachments in emails, even when the sender appears to be known. &n

     8th August, 2018  By Nicky Cappella The Stack   Summary - While DeepLocker has yet to be seen outside of the research lab, all of the tools used to create it are readily available: existing malware, and AI tools that can be trained to recognize a target.   DeepLocker malware can remain undetected for lengthy periods, inactive until presented with an AI trigger – through facial or voice recognition, or geolocation – that indicates a specifically targeted individual

     6th August, 2018  By Nick Lewis TechTarget   Summary - Dark Caracal is written in Java, so it can be used against any computer that executes Java code. It is an immature remote access tool that appears to be used by nation-state actors, but it only works on systems with Java installed -- so it shouldn't affect most systems running macOS 10.7 and later, as those versions no longer install the Java runtime by default.   Article Link -&nbsp

   6th August, 2018  By Tara Seals Bleeping Computer   Summary - A massive proxy botnet is just the tip of the iceberg, a warning sign of a bigger operation in the works by the Ramnit operators.   The recently uncovered “Black” botnet campaign using the Ramnit malware racked up 100,000 infections in the two months through July– but the offensive could just be a precursor to a much larger attack coming down the pike, according to researchers, thanks to a second-stage malware called Ngioweb.