Tool
threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.
Authors
Authors and/or Contributors |
---|
Alexandre Dulaunoy |
Florian Roth |
Timo Steffens |
Christophe Vandeplas |
Dennis Rand |
raw-data |
Tinba
Banking Malware
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Tinba.
Known Synonyms |
---|
Hunter |
TinyBanker |
Zusy |
Internal MISP references
UUID 75f53ead-1aee-4f91-8cb9-b4170d747cfc
which can be used as unique global reference for Tinba
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Banking'] |
Related clusters
To see the related clusters, click here.
PlugX
Malware
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PlugX.
Known Synonyms |
---|
Agent.dhwf |
Backdoor.FSZO-5117 |
Korplug |
Trojan.Heur.JP.juW@ayZZvMb |
Trojan.Inject1.6386 |
Internal MISP references
UUID f4b159ea-97e5-483b-854b-c48a78d562aa
which can be used as unique global reference for PlugX
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
MSUpdater
Trojan (RAT) linked to current targeted attacks and others dating back to at least early 2009
Internal MISP references
UUID f85d2d5a-6e3c-44e4-bd3b-6100c04b4ba9
which can be used as unique global reference for MSUpdater
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Lazagne
A password sthealing tool regularly used by attackers
Internal MISP references
UUID d0394d50-5316-4405-aa77-1070bdf68b6a
which can be used as unique global reference for Lazagne
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['HackTool'] |
Related clusters
To see the related clusters, click here.
Poison Ivy
Poison Ivy is a RAT which was freely available and first released in 2005.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Poison Ivy.
Known Synonyms |
---|
Backdoor.Win32.PoisonIvy |
Gen:Trojan.Heur.PT |
Internal MISP references
UUID 2abe89de-46dd-4dae-ae22-b49a593aff54
which can be used as unique global reference for Poison Ivy
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
SPIVY
In March 2016, Unit 42 observed this new Poison Ivy variant we’ve named SPIVY being deployed via weaponized documents leveraging CVE-2015-2545.
Internal MISP references
UUID a3d2e7fe-a8e4-48c7-8d47-b9430898af08
which can be used as unique global reference for SPIVY
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Torn RAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Torn RAT.
Known Synonyms |
---|
Anchor Panda |
Internal MISP references
UUID 32a67552-3b31-47bb-8098-078099bbc813
which can be used as unique global reference for Torn RAT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
OzoneRAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular OzoneRAT.
Known Synonyms |
---|
Ozone RAT |
ozonercp |
Internal MISP references
UUID e3010d81-94e2-43a9-98ed-61925b02be6e
which can be used as unique global reference for OzoneRAT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
ZeGhost
ZeGhots is a RAT which was freely available and first released in 2014.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ZeGhost.
Known Synonyms |
---|
BackDoor-FBZT!52D84425CDF2 |
Trojan.Win32.Staser.ytq |
Win32/Zegost.BW |
Internal MISP references
UUID c7706d12-fb62-4db6-bbe3-fef2da0181e7
which can be used as unique global reference for ZeGhost
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Elise Backdoor
Trojan (RAT) linked to current targeted attacks and others dating back to at least early 2009
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Elise Backdoor.
Known Synonyms |
---|
Elise |
Internal MISP references
UUID d70fd29d-590e-4ed5-b72f-6ce0142019c6
which can be used as unique global reference for Elise Backdoor
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['dropper', 'PWS'] |
Related clusters
To see the related clusters, click here.
Trojan.Laziok
A new information stealer, Trojan.Laziok, acts as a reconnaissance tool allowing attackers to gather information and tailor their attack methods for each compromised computer.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Trojan.Laziok.
Known Synonyms |
---|
Laziok |
Internal MISP references
UUID 7ccd3821-e825-4ff8-b4be-92c9732ce708
which can be used as unique global reference for Trojan.Laziok
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['PWS', 'reco'] |
Related clusters
To see the related clusters, click here.
Slempo
Android-based malware
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Slempo.
Known Synonyms |
---|
Acecard |
Bankosy |
GM-Bot |
SlemBunk |
Internal MISP references
UUID f8047de2-fefc-4ee0-825b-f1fae4b20c09
which can be used as unique global reference for Slempo
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Spyware', 'AndroidOS'] |
Related clusters
To see the related clusters, click here.
PWOBot
We have discovered a malware family named ‘PWOBot’ that is fairly unique because it is written entirely in Python, and compiled via PyInstaller to generate a Microsoft Windows executable. The malware has been witnessed affecting a number of Europe-based organizations, particularly in Poland. Additionally, the malware is delivered via a popular Polish file-sharing web service.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PWOBot.
Known Synonyms |
---|
PWOHTTPD |
PWOKeyLogger |
PWOLauncher |
PWOMiner |
PWOPyExec |
PWOQuery |
Internal MISP references
UUID 17de0952-3841-44d3-b03a-cc90e123d2b8
which can be used as unique global reference for PWOBot
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Dropper', 'Miner', 'Spyware'] |
Lost Door RAT
We recently came across a cyber attack that used a remote access Trojan (RAT) called Lost Door, a tool currently offered on social media sites. What also struck us the most about this RAT (detected as BKDR_LODORAT.A) is how it abuses the Port Forward feature in routers.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Lost Door RAT.
Known Synonyms |
---|
BKDR_LODORAT |
LostDoor RAT |
Internal MISP references
UUID 6d0b7543-a6e5-49fc-832e-bd594460187c
which can be used as unique global reference for Lost Door RAT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
njRAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular njRAT.
Known Synonyms |
---|
Bladabindi |
Jorik |
Internal MISP references
UUID a860d257-4a39-47ec-9230-94cac67ebf7e
which can be used as unique global reference for njRAT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
NanoCoreRAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular NanoCoreRAT.
Known Synonyms |
---|
Atros2.CKPN |
Nancrat |
NanoCore |
Zurten |
Internal MISP references
UUID a8111fb7-d4c4-4671-a6f9-f62fea8bad60
which can be used as unique global reference for NanoCoreRAT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
Sakula
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sakula.
Known Synonyms |
---|
Sakurel |
Internal MISP references
UUID f6c137f0-979c-4ce2-a0e5-2a080a5a1746
which can be used as unique global reference for Sakula
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
Hi-ZOR
Internal MISP references
UUID e8fbb7b4-2f27-4028-975a-485d4c2dd977
which can be used as unique global reference for Hi-ZOR
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Derusbi
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Derusbi.
Known Synonyms |
---|
TROJ_DLLSERV.BE |
Internal MISP references
UUID eff68b97-f36e-4827-ab1a-90523c16774c
which can be used as unique global reference for Derusbi
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
EvilGrab
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular EvilGrab.
Known Synonyms |
---|
BKDR_EVILOGE |
BKDR_HGDER |
BKDR_NVICM |
Wmonder |
Internal MISP references
UUID c9b4ec27-0a43-4671-a967-bcac5df0e056
which can be used as unique global reference for EvilGrab
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
Trojan.Naid
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Trojan.Naid.
Known Synonyms |
---|
AGENT.ABQMR |
AGENT.AQUP.DROPPER |
AGENT.BMZA |
AGENT.GUNZ |
MCRAT.A |
Mdmbot.E |
Naid |
Internal MISP references
UUID 170db76b-93f7-4fd1-97fc-55937c079b66
which can be used as unique global reference for Trojan.Naid
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Dropper'] |
Related clusters
To see the related clusters, click here.
Moudoor
Backdoor.Moudoor, a customized version of Gh0st RAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Moudoor.
Known Synonyms |
---|
KillProc.14145 |
SCAR |
Internal MISP references
UUID 46fd9884-208c-43c7-8ec3-b9fabce30b30
which can be used as unique global reference for Moudoor
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
NetTraveler
APT that infected hundreds of high profile victims in more than 40 countries. Known targets of NetTraveler include Tibetan/Uyghur activists, oil industry companies, scientific research centers and institutes, universities, private companies, governments and governmental institutions, embassies and military contractors.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular NetTraveler.
Known Synonyms |
---|
Netfile |
TravNet |
Internal MISP references
UUID 59b70721-6fed-4805-afa5-4ff2554bef81
which can be used as unique global reference for NetTraveler
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
Winnti
APT used As part of Operation SMN, Novetta analyzed recent versions of the Winnti malware. The samples, compiled from mid- to late 2014, exhibited minimal functional changes over the previous generations Kaspersky reported in 2013.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Winnti.
Known Synonyms |
---|
Agent.ALQHI |
Etso |
HIGHNOON |
RbDoor |
RibDoor |
SUQ |
Internal MISP references
UUID 9b3a4cff-1c5a-4fd6-b49c-27240b6d622c
which can be used as unique global reference for Winnti
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
Mimikatz
Ease Credential stealh and replay, A little tool to play with Windows security.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mimikatz.
Known Synonyms |
---|
Mikatz |
Internal MISP references
UUID 7f3a035d-d83a-45b8-8111-412aa8ade802
which can be used as unique global reference for Mimikatz
in MISP communities and other software using the MISP galaxy
External references
- https://github.com/gentilkiwi/mimikatz - webarchive
- https://researchcenter.paloaltonetworks.com/2017/07/unit42-twoface-webshell-persistent-access-point-lateral-movement/ - webarchive
- https://www.ncsc.gov.uk/content/files/protected_files/article_files/Joint%20report%20on%20publicly%20available%20hacking%20tools%20%28NCSC%29.pdf - webarchive
Associated metadata
Metadata key | Value |
---|---|
type | ['HackTool'] |
Related clusters
To see the related clusters, click here.
WEBC2
Backdoor attribued to APT1
Internal MISP references
UUID b5be84b7-bf2c-40d0-85a9-14c040881a98
which can be used as unique global reference for WEBC2
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
Pirpi
Symantec has observed Buckeye activity dating back to 2009, involving attacks on various organizations in several regions. Buckeye used a remote access Trojan (Backdoor.Pirpi) in attacks against a US organization’s network in 2009. The group delivered Backdoor.Pirpi through malicious attachments or links in convincing spear-phishing emails.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pirpi.
Known Synonyms |
---|
Badey |
EXL |
Internal MISP references
UUID 4859330d-c6a5-4b9c-b45b-536ec983cd4a
which can be used as unique global reference for Pirpi
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
RARSTONE
RARSTONE is a Remote Access Tool (RAT) discovered early 2013 by TrendMicro, it’s characterized by a great affinity with the other RAT know as Plug is and was used in April for phishing campaigns that followed the dramatic attack to the Boston Marathon.
Internal MISP references
UUID 5d2dd6ad-6bb2-45d3-b295-e125d3399c8d
which can be used as unique global reference for RARSTONE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
Backspace
Backspace is a Backdoor that targets the Windows platform. This malware is reportedly associated with targeted attacks against Association of Southeast Asian Nations (ASEAN) members (APT30).
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Backspace.
Known Synonyms |
---|
Lecna |
Internal MISP references
UUID cd6c5f27-cf7e-4529-ae9c-ab5b85102bde
which can be used as unique global reference for Backspace
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
XSControl
Backdoor user by he Naikon APT group
Internal MISP references
UUID 2e3712e3-fd7b-43d1-8b4f-2ba7fc551bbb
which can be used as unique global reference for XSControl
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Neteagle
NETEAGLE is a backdoor developed by APT30 with compile dates as early as 2008. It has two main variants known as Scout and Norton.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Neteagle.
Known Synonyms |
---|
norton |
scout |
Internal MISP references
UUID 0ee08ab5-140c-44c3-9b0a-4a352500b14e
which can be used as unique global reference for Neteagle
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
Agent.BTZ
In November 2014, the experts of the G DATA SecurityLabs published an article about ComRAT, the Agent.BTZ successor. We explained that this case is linked to the Uroburos rootkit.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Agent.BTZ.
Known Synonyms |
---|
ComRat |
Internal MISP references
UUID da079741-05e6-458c-b434-011263dc691c
which can be used as unique global reference for Agent.BTZ
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
Heseber BOT
RAT bundle with standard VNC (to avoid/limit A/V detection).
Internal MISP references
UUID b1b7e7d8-3778-4783-9cc7-9ec04b146031
which can be used as unique global reference for Heseber BOT
in MISP communities and other software using the MISP galaxy
Agent.dne
Internal MISP references
UUID 93fe1644-a7a6-4e5a-bc3b-88984b251fde
which can be used as unique global reference for Agent.dne
in MISP communities and other software using the MISP galaxy
Wipbot
Waterbug is the name given to the actors who use the malware tools Trojan.Wipbot (also known as Tavdig and Epic Turla)
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Wipbot.
Known Synonyms |
---|
Epic Turla |
TadjMakhal |
Tavdig |
WorldCupSec |
Internal MISP references
UUID 36c0faf0-428e-4e7f-93c5-824bb0495ac9
which can be used as unique global reference for Wipbot
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
Turla
Family of related sophisticated backdoor software - Name comes from Microsoft detection signature – anagram of Ultra (Ultra3) was a name of the fake driver). A macOS version exists but appears incomplete and lacking features...for now!
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Turla.
Known Synonyms |
---|
Snake |
Uroburos |
Urouros |
Internal MISP references
UUID 22332d52-c0c2-443c-9ffb-f08c0d23722c
which can be used as unique global reference for Turla
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor', 'Rootkit'] |
Related clusters
To see the related clusters, click here.
Winexe
Internal MISP references
UUID 811bdec0-e236-48ae-b27c-1a8fe0bfc3a9
which can be used as unique global reference for Winexe
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
Dark Comet
RAT initialy identified in 2011 and still actively used.
Internal MISP references
UUID 9ad11139-e928-45cf-a0b4-937290642e92
which can be used as unique global reference for Dark Comet
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
Cadelspy
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cadelspy.
Known Synonyms |
---|
WinSpy |
Internal MISP references
UUID 38d6a0a1-0388-40d4-b8f4-1d58eeb9a07d
which can be used as unique global reference for Cadelspy
in MISP communities and other software using the MISP galaxy
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
CMStar
Internal MISP references
UUID e81b96a2-22e9-445e-88c7-65b67c2299ec
which can be used as unique global reference for CMStar
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
DHS2015
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DHS2015.
Known Synonyms |
---|
iRAT |
Internal MISP references
UUID d6420953-0e85-4330-abc2-3a8b9dda046b
which can be used as unique global reference for DHS2015
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Gh0st Rat
Gh0st Rat is a well-known Chinese remote access trojan which was originally made by C.Rufus Security Team several years ago. GH0ST is a backdoor written in C++ that communicates via a custom binary protocol over TCP or UDP. It typically features a packet signature at the start of each message that varies between samples. Availability: Public
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gh0st Rat.
Known Synonyms |
---|
Gh0stRat, GhostRat |
Internal MISP references
UUID cb8c8253-4024-4cc9-8989-b4a5f95f6c2f
which can be used as unique global reference for Gh0st Rat
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Fakem RAT
Fakem RAT makes their network traffic look like well-known protocols (e.g. Messenger traffic, HTML pages).
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Fakem RAT.
Known Synonyms |
---|
FAKEM |
Internal MISP references
UUID eead5605-0d79-4942-a6c2-efa6853cdf6b
which can be used as unique global reference for Fakem RAT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
MFC Huner
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MFC Huner.
Known Synonyms |
---|
BKDR_HUPIGON |
Hupigon |
Internal MISP references
UUID a5a48311-afbf-44c4-8045-46ffd51cd4d0
which can be used as unique global reference for MFC Huner
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Blackshades
Blackshades Remote Access Tool targets Microsoft Windows operating systems. Authors were arrested in 2012 and 2014.
Internal MISP references
UUID 8c3202d5-1671-46ec-9d42-cb50dbe2f667
which can be used as unique global reference for Blackshades
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
CHOPSTICK
backdoor used by apt28
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CHOPSTICK.
Known Synonyms |
---|
(.v2 fysbis) |
SPLM |
webhp |
Internal MISP references
UUID 0a32ceea-fa66-47ab-8bde-150dbd6d2e40
which can be used as unique global reference for CHOPSTICK
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
possible_issues | Report tells that is could be Xagent alias (Java Rat) |
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
EVILTOSS
backdoor used by apt28
Sedreco serves as a spying backdoor; its functionalities can be extended with dynamically loaded plugins. It is made up of two distinct components: a dropper and the persistent payload installed by this dropper. We have not seen this component since April 2016.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular EVILTOSS.
Known Synonyms |
---|
ADVSTORESHELL |
AZZY |
NETUI |
Sedreco |
Internal MISP references
UUID 6374fc53-9a0d-41ba-b9cf-2a9765d69fbb
which can be used as unique global reference for EVILTOSS
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
possible_issues | Report tells that is could be Xagent alias (Java Rat) |
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
GAMEFISH
backdoor
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GAMEFISH.
Known Synonyms |
---|
JHUHUGIT |
Sednit |
Seduploader |
Sofacy |
Internal MISP references
UUID 43cd8a09-9c80-48c8-9568-1992433af60a
which can be used as unique global reference for GAMEFISH
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
SOURFACE
downloader - Older version of CORESHELL
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SOURFACE.
Known Synonyms |
---|
Sofacy |
Internal MISP references
UUID 1de47f51-1f20-403b-a2e1-5eaabe275faa
which can be used as unique global reference for SOURFACE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
OLDBAIT
credential harvester
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular OLDBAIT.
Known Synonyms |
---|
BackDoor-FDU |
IEChecker |
Sasfis |
Internal MISP references
UUID 6d1e2736-d363-49aa-9054-9c9e4ac0c520
which can be used as unique global reference for OLDBAIT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['PWS'] |
Related clusters
To see the related clusters, click here.
CORESHELL
downloader - Newer version of SOURFACE
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CORESHELL.
Known Synonyms |
---|
Sofacy |
Internal MISP references
UUID 3948ce95-468e-4ce1-82b1-57439c6d6afd
which can be used as unique global reference for CORESHELL
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Havex RAT
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Havex RAT.
Known Synonyms |
---|
Havex |
Internal MISP references
UUID d7183f66-59ec-4803-be20-237b442259fc
which can be used as unique global reference for Havex RAT
in MISP communities and other software using the MISP galaxy
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
KjW0rm
RAT initially written in VB.
Internal MISP references
UUID b3f7a454-3b23-4149-99aa-0132323814d0
which can be used as unique global reference for KjW0rm
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
TinyTyphon
Internal MISP references
UUID 1b591586-e1ef-4a32-8dae-791aca5ddf41
which can be used as unique global reference for TinyTyphon
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
Badnews
Internal MISP references
UUID 48ca79ff-ea36-4a47-8231-0f7f0db0e09e
which can be used as unique global reference for Badnews
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
LURK
Internal MISP references
UUID fcece2f7-e0ef-44e0-aa9f-578c2a56f532
which can be used as unique global reference for LURK
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
Oldrea
Internal MISP references
UUID f2e17736-9575-4a91-92ab-bb82bb0bf900
which can be used as unique global reference for Oldrea
in MISP communities and other software using the MISP galaxy
AmmyAdmin
Internal MISP references
UUID d1006b04-3015-49ea-9414-a968a0f74106
which can be used as unique global reference for AmmyAdmin
in MISP communities and other software using the MISP galaxy
Matryoshka
Internal MISP references
UUID cb6c49ab-b9ac-459f-b765-05cbe2e63b0d
which can be used as unique global reference for Matryoshka
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
TinyZBot
Internal MISP references
UUID e2cc27a2-4146-4f08-8e80-114a99204cea
which can be used as unique global reference for TinyZBot
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
GHOLE
Internal MISP references
UUID 43a0d8a7-558d-4104-8a24-55e6e7a503db
which can be used as unique global reference for GHOLE
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
CWoolger
Internal MISP references
UUID 005b46a2-9498-473a-bee2-0db91e5fb327
which can be used as unique global reference for CWoolger
in MISP communities and other software using the MISP galaxy
FireMalv
Internal MISP references
UUID 6ef11b6e-d81a-465b-9dce-fab5c6fe807b
which can be used as unique global reference for FireMalv
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
Regin
Regin (also known as Prax or WarriorPride) is a sophisticated malware toolkit revealed by Kaspersky Lab, Symantec, and The Intercept in November 2014. The malware targets specific users of Microsoft Windows-based computers and has been linked to the US intelligence gathering agency NSA and its British counterpart, the GCHQ. The Intercept provided samples of Regin for download including malware discovered at Belgian telecommunications provider, Belgacom. Kaspersky Lab says it first became aware of Regin in spring 2012, but that some of the earliest samples date from 2003. The name Regin is first found on the VirusTotal website on 9 March 2011.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Regin.
Known Synonyms |
---|
Prax |
WarriorPride |
Internal MISP references
UUID 0cf21558-1217-4d36-9536-2919cfd44825
which can be used as unique global reference for Regin
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Duqu
Internal MISP references
UUID 809b54c3-dd6a-4ec9-8c3a-a27b9baa6732
which can be used as unique global reference for Duqu
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
Flame
Internal MISP references
UUID d7963066-62ed-4494-9b8c-4b8b691a7c82
which can be used as unique global reference for Flame
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
Stuxnet
Internal MISP references
UUID 1b63293f-13f0-4c25-9bf6-6ebc023fc8ff
which can be used as unique global reference for Stuxnet
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
EquationLaser
Internal MISP references
UUID 21f7a57b-7778-4b3e-9b50-5289ae3b445d
which can be used as unique global reference for EquationLaser
in MISP communities and other software using the MISP galaxy
EquationDrug
Internal MISP references
UUID 3e0c2d35-87cb-40f9-b341-a6c8dbec697e
which can be used as unique global reference for EquationDrug
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
DoubleFantasy
Internal MISP references
UUID fb8828a4-76de-467d-9f52-528984aa9b8d
which can be used as unique global reference for DoubleFantasy
in MISP communities and other software using the MISP galaxy
TripleFantasy
Internal MISP references
UUID a4cebcc4-9e9b-415f-aa05-dd71c4e288fe
which can be used as unique global reference for TripleFantasy
in MISP communities and other software using the MISP galaxy
Fanny
Internal MISP references
UUID 1e25d254-3f03-4752-b8d6-023a23e7d4ae
which can be used as unique global reference for Fanny
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
GrayFish
Internal MISP references
UUID 2407bd9a-a3a4-40c4-86de-be6965243c67
which can be used as unique global reference for GrayFish
in MISP communities and other software using the MISP galaxy
Babar
Internal MISP references
UUID 57b221bc-7ed6-4080-bc66-813d17009485
which can be used as unique global reference for Babar
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
Bunny
Internal MISP references
UUID 5589c428-792b-4439-b0db-07862765d96b
which can be used as unique global reference for Bunny
in MISP communities and other software using the MISP galaxy
Casper
Internal MISP references
UUID 63b3e6fb-9bb8-43dc-9cbf-7681b049b5d6
which can be used as unique global reference for Casper
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
NBot
Internal MISP references
UUID 97fa32d6-5d1d-43df-b765-4a0e31d7f179
which can be used as unique global reference for NBot
in MISP communities and other software using the MISP galaxy
Tafacalou
Internal MISP references
UUID 835943ed-75d7-4225-9075-a8e2b2136fad
which can be used as unique global reference for Tafacalou
in MISP communities and other software using the MISP galaxy
Tdrop
Internal MISP references
UUID 4d81c146-56e1-45d2-b0e4-75d0acec8102
which can be used as unique global reference for Tdrop
in MISP communities and other software using the MISP galaxy
Troy
Internal MISP references
UUID 9825aa1f-6414-4f26-8487-605dd6c718d1
which can be used as unique global reference for Troy
in MISP communities and other software using the MISP galaxy
Tdrop2
Internal MISP references
UUID aff99aad-5231-4f14-8e68-67e87fb13b5c
which can be used as unique global reference for Tdrop2
in MISP communities and other software using the MISP galaxy
ZXShell
ZxShell is a remote access trojan (RAT). It was developed in 2006 by the persona "LZX", who then publicly released the source code in 2007
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ZXShell.
Known Synonyms |
---|
Sensode |
Internal MISP references
UUID 5b9dc67e-bae4-44f3-b58d-6d842a744104
which can be used as unique global reference for ZXShell
in MISP communities and other software using the MISP galaxy
External references
- http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html - webarchive
- https://blogs.cisco.com/security/talos/opening-zxshell - webarchive
- https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox - webarchive
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
T9000
Internal MISP references
UUID 66575fb4-7f92-42d8-8c47-e68a26413081
which can be used as unique global reference for T9000
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
T5000
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular T5000.
Known Synonyms |
---|
Plat1 |
Internal MISP references
UUID e957f773-f6d2-410f-8163-5f0c17a7bde2
which can be used as unique global reference for T5000
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Taidoor
Internal MISP references
UUID cda7d605-23d0-4f93-a585-1276f094c04a
which can be used as unique global reference for Taidoor
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Swisyn
Internal MISP references
UUID 1688dc7a-0ef9-49a9-a467-5231a5552b41
which can be used as unique global reference for Swisyn
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Rekaf
Internal MISP references
UUID cfe948c6-b8a6-437a-9d82-d81660e0287b
which can be used as unique global reference for Rekaf
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Scieron
Internal MISP references
UUID 267bf78e-f430-47b6-8ba0-1ae31698c711
which can be used as unique global reference for Scieron
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
SkeletonKey
Internal MISP references
UUID 7709fedd-5083-4b54-bcd8-af3f76f6d171
which can be used as unique global reference for SkeletonKey
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Skyipot
Internal MISP references
UUID 72e2b7b5-2718-4942-9ca2-17fa6730261f
which can be used as unique global reference for Skyipot
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Spindest
Internal MISP references
UUID 447735ac-82e4-4c97-b048-56b7e47203ef
which can be used as unique global reference for Spindest
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Preshin
Internal MISP references
UUID d87326a3-fb94-448c-9615-8ec036c1df3a
which can be used as unique global reference for Preshin
in MISP communities and other software using the MISP galaxy
Oficla
Internal MISP references
UUID b3ea33fd-eaa0-4bab-9bd0-12534c9aa987
which can be used as unique global reference for Oficla
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
PCClient RAT
Internal MISP references
UUID f68d2200-cb9d-42de-9e5e-be2a8f674c5e
which can be used as unique global reference for PCClient RAT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Plexor
Internal MISP references
UUID 8fb00a59-0dec-4d7f-bd53-9826b3929f39
which can be used as unique global reference for Plexor
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
Mongall
Internal MISP references
UUID aa3aa21f-bc4e-4fb6-acd2-f4b6de482dfe
which can be used as unique global reference for Mongall
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
NeD Worm
Internal MISP references
UUID eedcf785-d011-4e17-96c4-6ff39138ada0
which can be used as unique global reference for NeD Worm
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
NewCT
Internal MISP references
UUID c5e3766c-9527-47c3-94db-f10de2c56248
which can be used as unique global reference for NewCT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Nflog
Internal MISP references
UUID b2ec2dca-5d49-4efa-9a9e-75126346d1ed
which can be used as unique global reference for Nflog
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Janicab
Internal MISP references
UUID c3c20c4b-e12a-42e5-960a-eea4644014f4
which can be used as unique global reference for Janicab
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Jripbot
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Jripbot.
Known Synonyms |
---|
Jiripbot |
Internal MISP references
UUID 05e2ccec-7050-47cf-b925-50907f57c639
which can be used as unique global reference for Jripbot
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Jolob
Internal MISP references
UUID 4d4528ff-6260-4b5d-b2ea-6e11ca02c396
which can be used as unique global reference for Jolob
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
IsSpace
Internal MISP references
UUID b9707a57-d15f-4937-b022-52cc17f6783f
which can be used as unique global reference for IsSpace
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Emotet
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Emotet.
Known Synonyms |
---|
Geodo |
Internal MISP references
UUID 3f7616bd-f1de-46ee-87c2-43c0c2edaa28
which can be used as unique global reference for Emotet
in MISP communities and other software using the MISP galaxy
External references
- https://securelist.com/analysis/publications/69560/the-banking-trojan-emotet-detailed-analysis/ - webarchive
- https://www.forcepoint.com/blog/security-labs/thanks-giving-emotet - webarchive
- https://www.bleepingcomputer.com/news/security/emotet-returns-with-thanksgiving-theme-and-better-phishing-tricks/ - webarchive
- https://cofense.com/major-us-financial-institutions-imitated-advanced-geodo-emotet-phishing-lures-appear-authentic-containing-proofpoint-url-wrapped-links/ - webarchive
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Hoardy
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Hoardy.
Known Synonyms |
---|
BS2005 |
Hoarde |
Phindolp |
Internal MISP references
UUID 25cd01bc-1346-4415-8f8d-d3656309ef6b
which can be used as unique global reference for Hoardy
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Htran
HUC Packet Transmitter (HTran) is a proxy tool, used to intercept and redirect Transmission Control Protocol (TCP) connections from the local host to a remote host. This makes it possible to obfuscate an attacker's communications with victim networks. The tool has been freely available on the internet since at least 2009. HTran facilitates TCP connections between the victim and a hop point controlled by an attacker. Malicious cyber actors can use this technique to redirect their packets through multiple compromised hosts running HTran, to gain greater access to hosts in a network
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Htran.
Known Synonyms |
---|
HTran |
HUC Packet Transmitter |
Internal MISP references
UUID f3bfe513-2a65-49b5-9d64-a66541dce697
which can be used as unique global reference for Htran
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
HTTPBrowser
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HTTPBrowser.
Known Synonyms |
---|
TokenControl |
Internal MISP references
UUID 08e2c9ef-aa62-429f-a6e5-e901ff6883cd
which can be used as unique global reference for HTTPBrowser
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Disgufa
Internal MISP references
UUID 3a57bb24-b493-4698-bf46-6465c6cf5446
which can be used as unique global reference for Disgufa
in MISP communities and other software using the MISP galaxy
Elirks
Internal MISP references
UUID c0ea7b89-d246-4eb7-8de4-b4e17e135051
which can be used as unique global reference for Elirks
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
Snifula
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Snifula.
Known Synonyms |
---|
Ursnif |
Internal MISP references
UUID 75b01a1e-3269-4f4c-bdba-37af4e9c3f54
which can be used as unique global reference for Snifula
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Aumlib
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Aumlib.
Known Synonyms |
---|
Graftor |
Yayih |
mswab |
Internal MISP references
UUID f3ac3d86-0fa2-4049-bfbc-1970004b8d32
which can be used as unique global reference for Aumlib
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
CTRat
Internal MISP references
UUID f78cfa32-a629-421e-94f7-1e696bba2892
which can be used as unique global reference for CTRat
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Emdivi
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Emdivi.
Known Synonyms |
---|
Newsripper |
Internal MISP references
UUID a8395aae-1496-417d-98ee-3ecbcd9a94a0
which can be used as unique global reference for Emdivi
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Etumbot
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Etumbot.
Known Synonyms |
---|
Exploz |
RIPTIDE |
Specfix |
Internal MISP references
UUID 91583583-95c0-444e-8175-483cbebc640b
which can be used as unique global reference for Etumbot
in MISP communities and other software using the MISP galaxy
External references
- www.arbornetworks.com/asert/wp-content/uploads/2014/06/ASERT-Threat-Intelligence-Brief-2014-07-Illuminating-Etumbot-APT.pdf
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Fexel
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Fexel.
Known Synonyms |
---|
Loneagent |
Internal MISP references
UUID ba992105-373e-484a-ac81-2464deba93b7
which can be used as unique global reference for Fexel
in MISP communities and other software using the MISP galaxy
Associated metadata
Metadata key | Value |
---|---|
Fysbis
Internal MISP references
UUID bb929d1d-de95-4c3d-be79-55db3152dba1
which can be used as unique global reference for Fysbis
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Hikit
Internal MISP references
UUID 06953055-92ed-4936-8ffd-d9d72ab6bef6
which can be used as unique global reference for Hikit
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Hancitor
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Hancitor.
Known Synonyms |
---|
Chanitor |
Pony |
Tordal |
Internal MISP references
UUID ff0404a1-465f-4dd5-8b66-ee773628ca64
which can be used as unique global reference for Hancitor
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Ruckguv
Internal MISP references
UUID d70bd6a8-5fd4-42e8-8e39-fb18daeccdb2
which can be used as unique global reference for Ruckguv
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
HerHer Trojan
Internal MISP references
UUID 0798f8d2-1099-4122-8735-5a116264d3db
which can be used as unique global reference for HerHer Trojan
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Helminth backdoor
Internal MISP references
UUID 7bc1110b-fdc5-4501-a19b-e86304da4eb9
which can be used as unique global reference for Helminth backdoor
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
HDRoot
Internal MISP references
UUID d2c1a439-585a-48bc-8176-c0c46dfac270
which can be used as unique global reference for HDRoot
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
IRONGATE
Internal MISP references
UUID 5514e486-6158-40d8-b258-047938b8ee20
which can be used as unique global reference for IRONGATE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
ShimRAT
Internal MISP references
UUID 487f26a5-8531-4ec6-bfa4-691834b156b8
which can be used as unique global reference for ShimRAT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
X-Agent
APT28's second-stage persistent macOS backdoor. This backdoor component is known to have a modular structure featuring various espionage functionalities, such as key-logging, screen grabbing and file exfiltration. This component is available for Osx, Windows, Linux and iOS operating systems.
Xagent is a modular backdoor with spying functionalities such as keystroke logging and file exfiltration. Xagent is the group’s flagship backdoor and heavily used in their operations. Early versions for Linux and Windows were seen years ago, then in 2015 an iOS version came out. One year later, an Android version was discovered and finally, in the beginning of 2017, an Xagent sample for OS X was described.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular X-Agent.
Known Synonyms |
---|
XAgent |
Internal MISP references
UUID 3e2c99f9-66cd-48be-86e9-d7c1c164d87c
which can be used as unique global reference for X-Agent
in MISP communities and other software using the MISP galaxy
External references
- http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-update-ios-espionage-app-found/ - webarchive
- https://app.box.com/s/l7n781ig6n8wlf1aff5hgwbh4qoi5jqq - webarchive
- https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/ - webarchive
- https://objective-see.com/blog/blog_0x25.html#XAgent - webarchive
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
X-Tunnel
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular X-Tunnel.
Known Synonyms |
---|
XTunnel |
Internal MISP references
UUID 6d180bd7-3c77-4faf-b98b-dc2ab5f49101
which can be used as unique global reference for X-Tunnel
in MISP communities and other software using the MISP galaxy
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Foozer
Internal MISP references
UUID e4137f66-be82-4da7-96e6-e37ab33ea34f
which can be used as unique global reference for Foozer
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
WinIDS
Internal MISP references
UUID 82875947-fafb-467a-82df-0d2e37111b97
which can be used as unique global reference for WinIDS
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
DownRange
Internal MISP references
UUID 56349213-b73e-4a30-8188-08de1a77b960
which can be used as unique global reference for DownRange
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Mad Max
Internal MISP references
UUID d3d56dd0-3409-470a-958b-a865fdd158f9
which can be used as unique global reference for Mad Max
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Crimson
Crimson is malware used as part of a campaign known as Operation Transparent Tribe that targeted Indian diplomatic and military victims
Internal MISP references
UUID 858edfb8-793a-430b-8acc-4310e7d2f0d3
which can be used as unique global reference for Crimson
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
Prikormka
Operation Groundbait based on our research into the Prikormka malware family. This includes detailed technical analysis of the Prikormka malware family and its spreading mechanisms, and a description of the most noteworthy attack campaigns.
Internal MISP references
UUID 67ade442-63f2-4319-bdcd-d2564b963ed6
which can be used as unique global reference for Prikormka
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
NanHaiShu
This whitepaper details a malicious program we identify as NanHaiShu. Based on our analysis, the threat actor behind this malware targets government and private-sector organizations.
Internal MISP references
UUID 7abd6950-7a07-4d9e-ade1-62414fa50619
which can be used as unique global reference for NanHaiShu
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Umbreon
Umbreon (sharing the same name as the Pokémon) targets Linux systems, including systems running both Intel and ARM processors, expanding the scope of this threat to include embedded devices as well.
Internal MISP references
UUID 2a18f5dd-40fc-444b-a7c6-85f94b3eee13
which can be used as unique global reference for Umbreon
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Odinaff
Odinaff is typically deployed in the first stage of an attack, to gain a foothold onto the network, providing a persistent presence and the ability to install additional tools onto the target network. These additional tools bear the hallmarks of a sophisticated attacker which has plagued the financial industry since at least 2013–Carbanak. This new wave of attacks has also used some infrastructure that has previously been used in Carbanak campaigns.
Internal MISP references
UUID e2fa7aea-fb33-4efc-b61b-ccae71b32e7d
which can be used as unique global reference for Odinaff
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Hworm
Unit 42 has observed a new version of Hworm (or Houdini) being used within multiple attacks. This blog outlines technical details of this new Hworm version and documents an attack campaign making use of the backdoor. Of the samples used in this attack, the first we observed were June 2016, while as-of publication we were still seeing attacks as recently as mid-October, suggesting that this is likely an active, ongoing campaign.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Hworm.
Known Synonyms |
---|
Houdini |
Internal MISP references
UUID e5f7bb36-c982-4f5a-9b29-ab73d2c5f70e
which can be used as unique global reference for Hworm
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Backdoor.Dripion
Backdoor.Dripion was custom developed, deployed in a highly targeted fashion, and used command and control servers disguised as antivirus company websites.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Backdoor.Dripion.
Known Synonyms |
---|
Dripion |
Internal MISP references
UUID 9dec36a3-b7df-477d-8f38-90aed47ca7cf
which can be used as unique global reference for Backdoor.Dripion
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Adwind
Adwind is a backdoor written purely in Java that targets system supporting the Java runtime environment. Commands that can be used, among other things, to display messages on the system, open URLs, update the malware, download/execute files, and download/load plugins. A significant amount of additional functionality can be provided through downloadable plugins, including such things as remote control options and shell command execution.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Adwind.
Known Synonyms |
---|
AlienSpy |
Backdoor:Java/Adwind |
Frutas |
JSocket |
Sockrat |
Unrecom |
jRat |
Internal MISP references
UUID ab4694d6-7043-41f2-b328-d93bec9c1b22
which can be used as unique global reference for Adwind
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Bedep
Internal MISP references
UUID 066f8ad3-0c99-43eb-990c-8fae2c232f62
which can be used as unique global reference for Bedep
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
Cromptui
Internal MISP references
UUID c4d80484-9486-4d5f-95f3-f40cc2de45ea
which can be used as unique global reference for Cromptui
in MISP communities and other software using the MISP galaxy
Dridex
Dridex is a strain of banking malware that leverages macros in Microsoft Office to infect systems. Once a computer has been infected, Dridex attackers can steal banking credentials and other personal information on the system to gain access to the financial records of a user.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Dridex.
Known Synonyms |
---|
Cridex |
Internal MISP references
UUID 276c2c2e-09da-44cf-a3f7-806b3feb41da
which can be used as unique global reference for Dridex
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Fareit
Internal MISP references
UUID 652b5242-b790-4695-ad0e-b79bbf78f351
which can be used as unique global reference for Fareit
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
Gafgyt
Internal MISP references
UUID 5fe338c6-723e-43ed-8165-43d95fa93689
which can be used as unique global reference for Gafgyt
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
Gamarue
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gamarue.
Known Synonyms |
---|
Andromeda |
Internal MISP references
UUID b9f00c61-6cd1-4112-a632-c8d3837a7ddd
which can be used as unique global reference for Gamarue
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Necurs
The Necurs botnet is a distributor of many pieces of malware, most notably Locky.
Internal MISP references
UUID 97d34770-44cc-4ecb-bdce-ba11581c0e2a
which can be used as unique global reference for Necurs
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Palevo
Internal MISP references
UUID af0ea2b8-97ae-4ec1-a2c5-8f5dd0c9537b
which can be used as unique global reference for Palevo
in MISP communities and other software using the MISP galaxy
Akbot
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Akbot.
Known Synonyms |
---|
PinkSlipBot |
Qakbot |
Qbot |
Internal MISP references
UUID ac2ff27d-a7cb-46fe-ae32-cfe571dc614d
which can be used as unique global reference for Akbot
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Upatre
Upatre is a Trojan downloader that is used to set up other threats on the victim's PC. Upatre has been used recently in several high profile Trojan attacks involving the Gameover Trojan.
Internal MISP references
UUID 99d9110d-85a4-4819-9f85-05e4b73aa5f3
which can be used as unique global reference for Upatre
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
Vawtrak
Vawtrak is an information stealing malware family that is primarily used to gain unauthorised access to bank accounts through online banking websites.
Internal MISP references
UUID e95dd1ba-7485-4c02-bf2e-14beedbcf053
which can be used as unique global reference for Vawtrak
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Empire
Empire is a pure PowerShell post-exploitation agent built on cryptologically-secure communications and a flexible architecture. Empire implements the ability to run PowerShell agents without needing powershell.exe, rapidly deployable post-exploitation modules ranging from key loggers to Mimikatz, and adaptable communications to evade network detection, all wrapped up in a usability-focused framework
Internal MISP references
UUID 525ce93a-76a1-441a-9c45-0eac64d0ed12
which can be used as unique global reference for Empire
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Explosive
Beginning in late 2012, a carefully orchestrated attack campaign we call Volatile Cedar has been targeting individuals, companies and institutions worldwide. This campaign, led by a persistent attacker group, has successfully penetrated a large number of targets using various attack techniques, and specifically, a custom-made malware implant codenamed Explosive.
Internal MISP references
UUID 0155c3b1-8c7c-4176-aeda-68678dd99992
which can be used as unique global reference for Explosive
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
KeyBoy
The actors used a new version of “KeyBoy,” a custom backdoor first disclosed by researchers at Rapid7 in June 2013. Their work outlined the capabilities of the backdoor, and exposed the protocols and algorithms used to hide the network communication and configuration data
Internal MISP references
UUID 74167065-90b3-4c29-807a-79b6f098e45b
which can be used as unique global reference for KeyBoy
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Yahoyah
The attacks in this case are associated with a campaign called Tropic Trooper, which has been active since at least 2011 and is known for heavily targeting Taiwan. One of the attacks used their known Yahoyah malware...
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Yahoyah.
Known Synonyms |
---|
W32/Seeav |
Internal MISP references
UUID 2a16a1d4-a098-4f17-80f3-3cfc6c60b539
which can be used as unique global reference for Yahoyah
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Tartine
Delphi RAT used by Sofacy.
Internal MISP references
UUID 67f0b6cb-a484-4b8c-aacb-88a7238568b0
which can be used as unique global reference for Tartine
in MISP communities and other software using the MISP galaxy
Mirai
Mirai (Japanese for "the future") is malware that turns computer systems running Linux into remotely controlled "bots", that can be used as part of a botnet in large-scale network attacks. It primarily targets online consumer devices such as remote cameras and home routers. The Mirai botnet has been used in some of the largest and most disruptive distributed denial of service (DDoS) attacks, including an attack on 20 September 2016 on computer security journalist Brian Krebs's web site, an attack on French web host OVH and the October 2016 Dyn cyberattack.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mirai.
Known Synonyms |
---|
Linux/Mirai |
Internal MISP references
UUID dcbf1aaa-1fdd-4bfc-a35e-145ffdfb5ac5
which can be used as unique global reference for Mirai
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Masuta
IoT malware based on Mirai but slightly improved.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Masuta.
Known Synonyms |
---|
PureMasuta |
Internal MISP references
UUID 1d4dec2c-915a-4fef-ba7a-633421bd0848
which can be used as unique global reference for Masuta
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
BASHLITE
Internal MISP references
UUID 55f8fb60-6339-4bc2-baa0-41e698e11f95
which can be used as unique global reference for BASHLITE
in MISP communities and other software using the MISP galaxy
Related clusters
To see the related clusters, click here.
BlackEnergy
BlackEnergy is a trojan which has undergone significant functional changes since it was first publicly analysed by Arbor Networks in 2007. It has evolved from a relatively simple DDoS trojan into a relatively sophisticated piece of modern malware with a modular architecture, making it a suitable tool for sending spam and for online bank fraud, as well as for targeted attacks. BlackEnergy version 2, which featured rootkit techniques, was documented by SecureWorks in 2010. The targeted attacks recently discovered are proof that the trojan is still alive and kicking in 2014. We provide a technical analysis of the BlackEnergy family, focusing on novel functionality and the differences introduced by new lite variants. We describe the most notable aspects of the malware, including its techniques for bypassing UAC, defeating the signed driver requirement in Windows and a selection of BlackEnergy2 plug-ins used for parasitic file infections, network discovery and remote code execution and data collection.
Internal MISP references
UUID 5a22cad7-65fa-4b7a-a7aa-7915a6101efa
which can be used as unique global reference for BlackEnergy
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Trojan.Seaduke
Trojan.Seaduke is a Trojan horse that opens a back door on the compromised computer. It may also download potentially malicious files.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Trojan.Seaduke.
Known Synonyms |
---|
Seaduke |
Internal MISP references
UUID 3449215f-2650-48bb-a4fb-6549654cbccc
which can be used as unique global reference for Trojan.Seaduke
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Backdoor.Tinybaron
Internal MISP references
UUID 2b6b35fb-2ed4-46ce-b603-62ca2b9b2812
which can be used as unique global reference for Backdoor.Tinybaron
in MISP communities and other software using the MISP galaxy
Incognito RAT
Internal MISP references
UUID 307803df-6537-4e4d-a1c8-f219f278e564
which can be used as unique global reference for Incognito RAT
in MISP communities and other software using the MISP galaxy
DownRage
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DownRage.
Known Synonyms |
---|
Carberplike |
Internal MISP references
UUID ab5c4362-c369-4c78-985d-04ba1226ea32
which can be used as unique global reference for DownRage
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
GeminiDuke
GeminiDuke is malware that was used by APT29 from 2009 to 2012.
Internal MISP references
UUID 6a28a648-30c0-4d1d-bd67-81a8dc6486ba
which can be used as unique global reference for GeminiDuke
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Zeus
Trojan.Zbot, also called Zeus, is a Trojan horse that attempts to steal confidential information from the compromised computer. It may also download configuration files and updates from the Internet. The Trojan is created using a Trojan-building toolkit.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Zeus.
Known Synonyms |
---|
Trojan.Zbot |
Zbot |
Internal MISP references
UUID 0ce448de-c2bb-4c6e-9ad7-c4030f02b4d7
which can be used as unique global reference for Zeus
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Shifu
Shifu is a Banking Trojan first discovered in 2015. Shifu is based on the Shiz source code which incorporated techniques used by Zeus. Attackers use Shifu to steal credentials for online banking websites around the world, starting in Russia but later including the UK, Italy, and others.
Internal MISP references
UUID 67d712c8-d254-4820-83fa-9a892b87923b
which can be used as unique global reference for Shifu
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Shiz
The new variant of the Shiz Trojan malware targets mission-critical enterprise resource planning (ERP) applications — particularly SAP users.
Internal MISP references
UUID e6085ce0-af6d-41f7-8bcb-7f2eed246941
which can be used as unique global reference for Shiz
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
MM Core
Also known as “BaneChant”, MM Core is a file-less APT which is executed in memory by a downloader component. It was first reported in 2013 under the version number “2.0-LNK” where it used the tag “BaneChant” in its command-and-control (C2) network request. A second version “2.1-LNK” with the network tag “StrangeLove” was discovered shortly after.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MM Core.
Known Synonyms |
---|
BaneChant |
BigBoss |
MM Core backdoor |
SillyGoose |
StrangeLove |
Internal MISP references
UUID 74bd8c09-73d5-4ad8-ab1f-e94a4853c936
which can be used as unique global reference for MM Core
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Shamoon
Shamoon,[a] also known as Disttrack, is a modular computer virus discovered by Seculert[1] in 2012, targeting recent NT kernel-based versions of Microsoft Windows. The virus has been used for cyber espionage in the energy sector.[2][3][4] Its discovery was announced on 16 August 2012 by Symantec,[3] Kaspersky Lab,[5] and Seculert.[6] Similarities have been highlighted by Kaspersky Lab and Seculert between Shamoon and the Flame malware.[5][6]
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Shamoon.
Known Synonyms |
---|
DistTrack |
Internal MISP references
UUID 776b1849-8d5b-4762-8ba1-cbbaddb4ce3a
which can be used as unique global reference for Shamoon
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
GhostAdmin
According to MalwareHunterTeam and other researchers that have looked at the malware's source code, GhostAdmin seems to be a reworked version of CrimeScene, another botnet malware family that was active around 3-4 years ago.
Internal MISP references
UUID a68f1b43-c742-4f90-974d-2e74ec703e44
which can be used as unique global reference for GhostAdmin
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
EyePyramid Malware
Two Italians referred to as the “Occhionero brothers” have been arrested and accused of using malware and a carefully-prepared spear-phishing scheme to spy on high-profile politicians and businessmen. This case has been called “EyePyramid”, which we first discussed last week. (Conspiracy theories aside, the name came from a domain name and directory path that was found during the research.)
Internal MISP references
UUID 52c2499f-c74f-4bab-bad2-c278e798654c
which can be used as unique global reference for EyePyramid Malware
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
country | IT |
LuminosityLink
LuminosityLink is a malware family costing $40 that purports to be a system administration utility
Internal MISP references
UUID f586d3e4-39fc-489a-808b-03f590bfe092
which can be used as unique global reference for LuminosityLink
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Flokibot
Floki Bot, described recently by Dr. Peter Stephenson from SC Magazine, is yet another bot based on the leaked Zeus code. However, the author came up with various custom modifications that makes it more interesting.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Flokibot.
Known Synonyms |
---|
Floki |
Floki Bot |
Internal MISP references
UUID 8034978b-3a32-4662-b1bf-b525e59e469f
which can be used as unique global reference for Flokibot
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
ZeroT
Most recently, we have observed the same group targeting military and aerospace interests in Russia and Belarus. Since the summer of 2016, this group began using a new downloader known as ZeroT to install the PlugX remote access Trojan (RAT) and added Microsoft Compiled HTML Help (.chm) as one of the initial droppers delivered in spear-phishing emails.
Internal MISP references
UUID ff00fa92-b32e-46b6-88ca-98357ebe3f54
which can be used as unique global reference for ZeroT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
StreamEx
Cylance dubbed this family of malware StreamEx, based upon a common exported function used across all samples ‘stream’, combined with the dropper functionality to append ‘ex’ to the DLL file name. The StreamEx family has the ability to access and modify the user’s file system, modify the registry, create system services, enumerate process and system information, enumerate network resources and drive types, scan for security tools such as firewall products and antivirus products, change browser security settings, and remotely execute commands. The malware documented in this post was predominantly 64-bit, however, there are 32-bit versions of the malware in the wild.
Internal MISP references
UUID 9991ace8-1a62-498c-a9ef-19d474deb505
which can be used as unique global reference for StreamEx
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
adzok
Remote Access Trojan
Internal MISP references
UUID d08201b8-9774-41a1-abdb-c7f3828139b0
which can be used as unique global reference for adzok
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
albertino
Remote Access Trojan
Internal MISP references
UUID 18c31de5-41b3-4a92-a6ee-23b74cc2797d
which can be used as unique global reference for albertino
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
arcom
Remote Access Trojan
Internal MISP references
UUID 00dcba51-126f-4758-8273-9770ddf9031c
which can be used as unique global reference for arcom
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
blacknix
Remote Access Trojan
Internal MISP references
UUID 0a5d5825-0ab9-48ff-a5d9-b6b131b65833
which can be used as unique global reference for blacknix
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
bluebanana
Remote Access Trojan
Internal MISP references
UUID df7deaa3-2a2c-4460-8674-20ec24e89fba
which can be used as unique global reference for bluebanana
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
bozok
Remote Access Trojan
Internal MISP references
UUID cff2e174-52b8-4304-903a-012f97d70b7c
which can be used as unique global reference for bozok
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
clientmesh
Remote Access Trojan
Internal MISP references
UUID 26785174-0b89-4cec-9ed0-5a72a0ff4c49
which can be used as unique global reference for clientmesh
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
cybergate
Remote Access Trojan
Internal MISP references
UUID f6e6540e-c21f-4202-ac46-185e735215db
which can be used as unique global reference for cybergate
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
darkcomet
Remote Access Trojan
Internal MISP references
UUID 15949ecb-1f2b-4f59-9cf7-5751694e8fba
which can be used as unique global reference for darkcomet
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
darkrat
Remote Access Trojan
Internal MISP references
UUID c9e6e42a-65c0-418e-ab77-09bcdb1214a3
which can be used as unique global reference for darkrat
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
gh0st
Remote Access Trojan
Internal MISP references
UUID 1b1ae63f-bcee-4aba-8994-6c60cee5e16f
which can be used as unique global reference for gh0st
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
greame
Remote Access Trojan
Internal MISP references
UUID 43e400b3-918b-4a2c-9a69-7166c81a835b
which can be used as unique global reference for greame
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
hawkeye
Remote Access Trojan
Internal MISP references
UUID 3edd9d1b-e15d-4411-a67f-01e04701e95d
which can be used as unique global reference for hawkeye
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
javadropper
Remote Access Trojan
Internal MISP references
UUID 3a80cc5e-ae91-4aa4-aa2b-8f538861acbe
which can be used as unique global reference for javadropper
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
lostdoor
Remote Access Trojan
Internal MISP references
UUID 3fcebce8-fb31-4edb-ae88-7fb0d90d440c
which can be used as unique global reference for lostdoor
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
luxnet
Remote Access Trojan
Internal MISP references
UUID df6ccb07-a26c-427a-9d93-5fed2609a1d4
which can be used as unique global reference for luxnet
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
pandora
Remote Access Trojan
Internal MISP references
UUID 2c215062-5739-4859-bd82-9639ae1d1756
which can be used as unique global reference for pandora
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
poisonivy
Remote Access Trojan
Internal MISP references
UUID e336aeba-b61a-44e0-a0df-cd52a5839db5
which can be used as unique global reference for poisonivy
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
predatorpain
Remote Access Trojan
Internal MISP references
UUID 6762975d-ddbc-4871-ab14-4796c9f38307
which can be used as unique global reference for predatorpain
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
punisher
Remote Access Trojan
Internal MISP references
UUID 0d8d212a-d327-406e-8954-5b20158a9966
which can be used as unique global reference for punisher
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
qrat
Remote Access Trojan
Internal MISP references
UUID c3a784ee-cef7-4604-a5ba-ec7b193a5152
which can be used as unique global reference for qrat
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
shadowtech
Remote Access Trojan
Internal MISP references
UUID d5e53ee4-1114-4801-83c9-58c633049aff
which can be used as unique global reference for shadowtech
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
smallnet
Remote Access Trojan
Internal MISP references
UUID 73ee15e9-ffb3-496d-ae65-fad50e675bdd
which can be used as unique global reference for smallnet
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
spygate
Remote Access Trojan
Internal MISP references
UUID 408ff7f3-f30c-481f-a3e7-2c69b375f7d9
which can be used as unique global reference for spygate
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
template
Remote Access Trojan
Internal MISP references
UUID 244be9e7-4f68-4fd8-9abd-ee6ca591aa00
which can be used as unique global reference for template
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
tapaoux
Remote Access Trojan
Internal MISP references
UUID b7b4c682-090b-4da2-abc2-541fd3157579
which can be used as unique global reference for tapaoux
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
vantom
Remote Access Trojan
Internal MISP references
UUID aba90e76-ce56-4660-a498-90eeb1f0195b
which can be used as unique global reference for vantom
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
virusrat
Remote Access Trojan
Internal MISP references
UUID aa054c62-3595-4c65-97ee-209029cc6004
which can be used as unique global reference for virusrat
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
xena
Remote Access Trojan
Internal MISP references
UUID 87596188-4c1f-494c-8713-21d5fa062580
which can be used as unique global reference for xena
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
xtreme
Remote Access Trojan
Internal MISP references
UUID 2d4e2910-4b25-4562-ad88-b35dd678a117
which can be used as unique global reference for xtreme
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
darkddoser
Remote Access Trojan
Internal MISP references
UUID 505629dc-6b81-424e-a452-164629a7a66f
which can be used as unique global reference for darkddoser
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
jspy
Remote Access Trojan
Internal MISP references
UUID 8abd10df-2c31-4895-8ec1-270603078f47
which can be used as unique global reference for jspy
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
xrat
Remote Access Trojan
Internal MISP references
UUID c76e2ee8-52d1-4a55-81df-5542d232ca32
which can be used as unique global reference for xrat
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['Backdoor'] |
Related clusters
To see the related clusters, click here.
PupyRAT
Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python.
Internal MISP references
UUID 4d6dec19-b0bc-4698-87ed-272823c45d95
which can be used as unique global reference for PupyRAT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
ELF_IMEIJ
Linux Arm malware spread via RFIs in cgi-bin scripts. This backdoor executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.
Internal MISP references
UUID acb6ae45-d4e2-48a1-ab72-86e72004c27a
which can be used as unique global reference for ELF_IMEIJ
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
KHRAT
KHRAT is a small backdoor that has three exports (functions), namely, K1, K2, and K3. K1 checks if the current user is an administrator. If not, it uninstalls itself by calling the K2 function.
Internal MISP references
UUID 72b702d9-43c3-40b9-b004-8d0671225fb8
which can be used as unique global reference for KHRAT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Trochilus
The Trochilus RAT is a threatening RAT (Remote Access Trojan) that may evade many anti-virus programs. The Trochilus RAT is currently being used as part of an extended threat campaign in South East Asia. The first appearance of the Trochilus RAT in this campaign, which has been active since August of 2015, was first detected in the summer of 2015. The Trochilus RAT is currently being used against civil society organizations and government computers in the South East Asia region, particularly in attacks directed towards the government of Myanmar.
Internal MISP references
UUID 5e15e4ca-0e04-4af1-ab2a-779dbcad545d
which can be used as unique global reference for Trochilus
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
MoonWind
The MoonWind sample used for this analysis was compiled with a Chinese compiler known as BlackMoon, the same compiler used for the BlackMoon banking Trojan. While a number of attributes match the BlackMoon banking Trojan, the malware is not the same. Both malware families were simply compiled using the same compiler, and it was the BlackMoon artifacts that resulted in the naming of the BlackMoon banking Trojan. But because this new sample is different from the BlackMoon banking Trojan,
Internal MISP references
UUID 76ec1827-68a1-488f-9899-2b788ea8db64
which can be used as unique global reference for MoonWind
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Chrysaor
Chrysaor is spyware believed to be created by NSO Group Technologies, specializing in the creation and sale of software and infrastructure for targeted attacks. Chrysaor is believed to be related to the Pegasus spyware that was first identified on iOS and analyzed by Citizen Lab and Lookout.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Chrysaor.
Known Synonyms |
---|
Pegasus |
Pegasus spyware |
Internal MISP references
UUID 9d7c772b-43f1-49cf-bc70-7a7cd2ed34c8
which can be used as unique global reference for Chrysaor
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Sathurbot
The trojan serves as a backdoor. It can be controlled remotely.
Internal MISP references
UUID 35849d8f-5bac-475b-82f8-7d555f37de12
which can be used as unique global reference for Sathurbot
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
AURIGA
The AURIGA malware family shares a large amount of functionality with the BANGAT backdoor. The malware family contains functionality for keystroke logging, creating and killing processes, performing file system and registry modifications, spawning interactive command shells, performing process injection, logging off the current user or shutting down the local machine. The AURIGA malware contains a driver component which is used to inject the malware DLL into other processes. This driver can also perform process and IP connection hiding. The malware family will create a copy of cmd.exe to perform its C2 activity, and replace the "Microsoft corp" strings in the cmd.exe binary with different values. The malware family typically maintains persistence through installing itself as a service.
Internal MISP references
UUID 316c87d4-4404-42ab-9887-f9e321aed93c
which can be used as unique global reference for AURIGA
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
BANGAT
The BANGAT malware family shares a large amount of functionality with the AURIGA backdoor. The malware family contains functionality for keylogging, creating and killing processes, performing filesystem and registry modifications, spawning interactive command shells, performing process injection, logging off the current user or shutting down the local machine. In addition, the malware also implements a custom VNC like protocol which sends screenshots of the desktop to the C2 server and accepts keyboard and mouse input. The malware communicates to its C2 servers using SSL, with self signed SSL certificates. The malware family will create a copy of cmd.exe to perform its C2 activity, and replace the "Microsoft corp" strings in the cmd.exe binary with different values. The malware family typically maintains persistence through installing itself as a service.
Internal MISP references
UUID fa9b2176-1248-4d59-8da2-c31c7501a81d
which can be used as unique global reference for BANGAT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
BISCUIT
BISCUIT provides attackers with full access to an infected host. BISCUIT capabilities include launching an interactive command shell, enumerating servers on a Windows network, enumerating and manipulating process, and transferring files. BISCUIT communicates using a custom protocol, which is then encrypted using SSL. Once installed BISCUIT will attempt to beacon to its command/control servers approximately every 10 or 30 minutes. It will beacon its primary server first, followed by a secondary server. All communication is encrypted with SSL (OpenSSL 0.9.8i).
Internal MISP references
UUID f1e05a12-ca50-41ab-a963-d7df5bcb141d
which can be used as unique global reference for BISCUIT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
BOUNCER
BOUNCER will load an extracted DLL into memory, and then will call the DLL's dump export. The dump export is called with the parameters passed via the command line to the BOUNCER executable. It requires at least two arguments, the IP and port to send the password dump information. It can accept at most five arguments, including a proxy IP, port and an x.509 key for SSL authentication. The DLL backdoor has the capability to execute arbitrary commands, collect database and server information, brute force SQL login credentials, launch arbitrary programs, create processes and threads, delete files, and redirect network traffic.
Internal MISP references
UUID 52d9a474-fc37-48b5-8e39-4394194b9573
which can be used as unique global reference for BOUNCER
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
CALENDAR
This family of malware uses Google Calendar to retrieve commands and send results. It retrieves event feeds associated with Google Calendar, where each event contains commands from the attacker for the malware to perform. Results are posted back to the event feed. The malware authenticates with Google using the hard coded email address and passwords. The malware uses the deprecated ClientLogin authentication API from Google. The malware is registered as a service dll as a persistence mechanism. Artifacts of this may be found in the registry.
Internal MISP references
UUID e2c18713-0a95-4092-a0e9-76358512daad
which can be used as unique global reference for CALENDAR
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
COMBOS
The COMBOS malware family is an HTTP based backdoor. The backdoor is capable of file upload, file download, spawning a interactive reverse shell, and terminating its own process. The backdoor may decrypt stored Internet Explorer credentials from the local system and transmit the credentials to the C2 server. The COMBOS malware family does not have any persistence mechanisms built into itself.
Internal MISP references
UUID fa38b79c-9774-45a0-831c-24c6c8d39a22
which can be used as unique global reference for COMBOS
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
COOKIEBAG
his family of malware is a backdoor capable of file upload and download as well as providing remote interactive shell access to the compromised machine. Communication with the Command & Control (C2) servers uses a combination of single-byte XOR and Base64 encoded data in the Cookie and Set-Cookie HTTP header fields. Communication with the C2 servers is over port 80. Some variants install a registry key as means of a persistence mechanism. The hardcoded strings cited include a string of a command in common with several other APT1 families.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular COOKIEBAG.
Known Synonyms |
---|
TROJAN.COOKIES |
Internal MISP references
UUID 63be3d30-0c8d-4c0a-8eee-6c96880734cb
which can be used as unique global reference for COOKIEBAG
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
DAIRY
Members of this malware family are backdoors that provide file downloading, process listing, process killing, and reverse shell capabilities. This malware may also add itself to the Authorized Applications list for the Windows Firewall.
Internal MISP references
UUID 2a56538f-7c21-44b3-b438-5baa025ed005
which can be used as unique global reference for DAIRY
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
GETMAIL
Members of this family of malware are utilities designed to extract email messages and attachments from Outlook PST files. One part of this utility set is an executable, one is a dll. The malware may create a registry artifact related to the executable.
Internal MISP references
UUID 5abd7dee-cca1-4bee-9b82-da3f9be2970b
which can be used as unique global reference for GETMAIL
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
GDOCUPLOAD
This family of malware is a utility designed to upload files to Google Docs. Nearly all communications are with docs.google.com are SSL encrypted. The malware does not use Google's published API to interact with their services. The malware does not currently work with Google Docs. It does not detect HTTP 302 redirections and will get caught in an infinite loop attempting to parse results from Google that are not present.
Internal MISP references
UUID 4bb4320f-9379-43ba-ba8c-09dfece39000
which can be used as unique global reference for GDOCUPLOAD
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
GLOOXMAIL
GLOOXMAIL communicates with Google's Jabber/XMPP servers and authenticates with a hard-coded username and password. The malware can accept commands over XMPP that includes file upload and download, provide a remote shell, sending process listings, and terminating specified processes. The malware makes extensive use of the open source gloox library (http://camaya.net/gloox/, version 0.9.9.12) to communicate using the Jabber/XMPP protocol. All communications with the Google XMPP server are encrypted.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GLOOXMAIL.
Known Synonyms |
---|
TROJAN.GTALK |
Internal MISP references
UUID a379f09b-5cec-4bdb-9735-125cef2de073
which can be used as unique global reference for GLOOXMAIL
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
GOGGLES
A family of downloader malware, that retrieves an encoded payload from a fixed location, usually in the form of a file with the .jpg extension. Some variants have just an .exe that acts as a downloader, others have an .exe launcher that runs as a service and then loads an associated .dll of the same name that acts as the downloader. This IOC is targeted at the downloaders only. After downloading the file, the malware decodes the downloaded payload into an .exe file and launches it. The malware usually stages the files it uses in the %TEMP% directory or the %WINDIR%\Temp directory.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GOGGLES.
Known Synonyms |
---|
TROJAN.FOXY |
Internal MISP references
UUID 4bc55eb3-7c92-4668-a75a-d5e291387613
which can be used as unique global reference for GOGGLES
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
GREENCAT
Members of this family are full featured backdoors that communicates with a Web-based Command & Control (C2) server over SSL. Features include interactive shell, gathering system info, uploading and downloading files, and creating and killing processes, Malware in this family usually communicates with a hard-coded domain using SSL on port 443. Some members of this family rely on launchers to establish persistence mechanism for them. Others contains functionality that allows it to install itself, replacing an existing Windows service, and uninstall itself. Several variants use %SystemRoot%\Tasks or %WinDir%\Tasks as working directories, additional malware artifacts may be found there.
Internal MISP references
UUID 21a1d15c-acdd-49d1-aa8e-8d5b311024f0
which can be used as unique global reference for GREENCAT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
HACKFASE
This family of malware is a backdoor that provides reverse shell, process creation, system statistics collection, process enumeration, and process termination capabilities. This family is designed to be a service DLL and does not contain an installation mechanism. It usually communicates over port 443. Some variants use their own encryption, others use SSL.
Internal MISP references
UUID aef3e40b-d295-4663-a2d0-585512b3ae44
which can be used as unique global reference for HACKFASE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
HELAUTO
This family of malware is designed to operate as a service and provides remote command execution and file transfer capabilities to a fixed IP address or domain name. All communication with the C2 server happens over port 443 using SSL. This family can be installed as a service DLL. Some variants allow for uninstallation.
Internal MISP references
UUID 7c05c816-481f-499e-9545-d48b635dc2eb
which can be used as unique global reference for HELAUTO
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
KURTON
This family of malware is a backdoor that tunnels its connection through a preconfigured proxy. The malware communicates with a remote command and control server over HTTPS via the proxy. The malware installs itself as a Windows service with a service name supplied by the attacker but defaults to IPRIP if no service name is provided during install.
Internal MISP references
UUID 616c7c32-110e-4bb3-8e99-4c2aeb8f8272
which can be used as unique global reference for KURTON
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
LIGHTBOLT
LIGHTBOLT is a utility with the ability to perform HTTP GET requests for a list of user-specified URLs. The responses of the HTTP requests are then saved as MHTML files, which are added to encrypted RAR files. LIGHTBOLT has the ability to use software certificates for authentication.
Internal MISP references
UUID 57e43779-0665-427c-abcb-997c1c0ced8d
which can be used as unique global reference for LIGHTBOLT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
LIGHTDART
LIGHTDART is a tool used to access a pre-configured web page that hosts an interface to query a database or data set. The tool then downloads the results of a query against that web page to an encrypted RAR file. This RAR file (1.rar) is renamed and uploaded to an attacker controlled FTP server, or uploaded via an HTTP POST with a .jpg extension. The malware will execute this search once a day. The target webpage usually contains information useful to the attacker, which is updated on a regular basis. Examples of targeted information include weather information or ship coordinates.
Internal MISP references
UUID 986f6b0f-51f8-4f83-bb38-8354a83a7f32
which can be used as unique global reference for LIGHTDART
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
LONGRUN
LONGRUN is a backdoor designed to communicate with a hard-coded IP address and provide the attackers with a custom interactive shell. It supports file uploads and downloads, and executing arbitrary commands on the compromised machine. When LONGRUN executes, it first loads configuration data stored as an obfuscated string inside the PE resource section. The distinctive string thequickbrownfxjmpsvalzydg is used as part of the input to the decoding algorithm. When the configuration data string is decoded it is parsed and treated as an IP and port number. The malware then connects to the host and begins interacting with it over a custom protocol.
Internal MISP references
UUID 5a2fc164-f6cf-4528-b85f-f2319545c8ad
which can be used as unique global reference for LONGRUN
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
MANITSME
This family of malware will beacon out at random intervals to the remote attacker. The attacker can run programs, execute arbitrary commands, and easily upload and download files. This IOC looks for both the dropper file and the backdoor.
Internal MISP references
UUID 25db921d-d753-4fb1-b51b-961d7fdae6f4
which can be used as unique global reference for MANITSME
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
MAPIGET
This malware utility is a set of two files that operate in conjunction to extract email messages and attachments from an Exchange server. In order to operate successfully, these programs require authentication credentials for a user on the Exchange server, and must be run from a machine joined to the domain that has Microsoft Outlook installed (or equivalent software that provides the Microsoft 'Messaging API' (MAPI) service).
Internal MISP references
UUID bf08965f-03a5-4cf6-83fb-8d3c9e9398ee
which can be used as unique global reference for MAPIGET
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
MINIASP
This family of malware consists of backdoors that attempt to fetch encoded commands over HTTP. The malware is capable of downloading a file, downloading and executing a file, executing arbitrary shell commands, or sleeping a specified interval.
Internal MISP references
UUID ea9c7068-1c28-4826-a7d1-7ac04760e5c9
which can be used as unique global reference for MINIASP
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
NEWSREELS
The NEWSREELS malware family is an HTTP based backdoor. When first started, NEWSREELS decodes two strings from its resources section. These strings are both used as C2 channels, one URL is used as a beacon URL (transmitting) and the second URL is used to get commands (receiving). The NEWSREELS malware family is capable of performing file uploads, downloads, creating processes or creating an interactive reverse shell.
Internal MISP references
UUID 5abc6792-be17-48ee-a765-29cffa4242ee
which can be used as unique global reference for NEWSREELS
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
SEASALT
The SEASALT malware family communicates via a custom binary protocol. It is capable of gathering some basic system information, file system manipulation, file upload and download, process creation and termination, and spawning an interactive reverse shell. The malware maintains persistence by installing itself as a service.
Internal MISP references
UUID 7429aaf8-85a8-4ae9-b583-c7eec0f5b0cb
which can be used as unique global reference for SEASALT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
STARSYPOUND
STARSYPOUND provides an interactive remote shell over an obfuscated communications channel. When it is first run, it loads a string (from the executable PE resource section) containing the beacon IP address and port. The malware sends the beacon string "(SY)#
Internal MISP references
UUID d0220108-48d7-4056-babc-189048f37a59
which can be used as unique global reference for STARSYPOUND
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
SWORD
This family of malware provides a backdoor over the network to the attackers. It is configured to connect to a single host and offers file download over HTTP, program execution, and arbitrary execution of commands through a cmd.exe instance.
Internal MISP references
UUID 96fb29fa-7c3a-4124-baf5-cc5f99b2a05f
which can be used as unique global reference for SWORD
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
TABMSGSQL
This malware family is a full-featured backdoor capable of file uploading and downloading, arbitrary execution of programs, and providing a remote interactive command shell. All communications with the C2 server are sent over HTTP to a static URL, appending various URL parameters to the request. Some variants use a slightly different URL.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TABMSGSQL.
Known Synonyms |
---|
TROJAN LETSGO |
Internal MISP references
UUID d5a4cbe7-81c9-4a52-80ee-07ca3f625844
which can be used as unique global reference for TABMSGSQL
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
TARSIP-ECLIPSE
The TARSIP malware family is a backdoor which communicates over encoded information in HTTPS headers. Typical TARSIP malware samples will only beacon out to their C2 servers if the C2 DNS address resolves to a specific address. The capability of TARSIP backdoors includes file uploading, file downloading, interactive command shells, process enumeration, process creation, process termination. The TARSIP-ECLIPSE family is distinguished by the presence of 'eclipse' in .pdb debug strings present in the malware samples. It does not provide a built in mechanism to maintain persistence.
Internal MISP references
UUID 049590f1-3f3a-4670-a341-d6d29fbb123f
which can be used as unique global reference for TARSIP-ECLIPSE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
TARSIP-MOON
The TARSIP malware family is a backdoor which communicates over encoded information in HTTPS headers. Typical TARSIP malware samples will only beacon out to their C2 servers if the C2 DNS address resolves to a specific address. The capability of TARSIP backdoors includes file uploading, file downloading, interactive command shells, process enumeration, process creation, process termination. The TARSIP-MOON family is distinguished by the presence of 'moon' in .pdb debug strings present in the malware samples. It does not provide a built in mechanism to maintain persistence.
Internal MISP references
UUID dbce78ac-5729-4bd1-b7c0-6bc0344564bc
which can be used as unique global reference for TARSIP-MOON
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
WARP
The WARP malware family is an HTTP based backdoor written in C++, and the majority of its code base is borrowed from source code available in the public domain. Network communications are implemented using the same WWW client library (w3c.cpp) available from www.dankrusi.com/file_69653F3336383837.html. The malware has system survey functionality (collects hostname, current user, system uptime, CPU speed, etc.) taken directly from the BO2K backdoor available from www.bo2k.com. It also contains the hard disk identification code found at www.winsim.com/diskid32/diskid32.cpp. When the WARP executing remote commands, the malware creates a copy of the ?%SYSTEMROOT%\system32\cmd.exe? file as '%USERPROFILE%\Temp\~ISUN32.EXE'. The version signature information of the duplicate executable is zeroed out. Some WARP variants maintain persistence through the use of DLL search order hijacking.
Internal MISP references
UUID 29917fb3-6c56-4659-a203-5885c4a8e70f
which can be used as unique global reference for WARP
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
WEBC2-ADSPACE
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This family of malware is capable of downloading and executing a file. All variants represented here are the same file with different MD5 signatures. This malware attempts to contact its C2 once a week (Thursday at 10:00 AM). It looks for commands inside a set of HTML tags, part of which are in the File Strings indicator term below.
Internal MISP references
UUID 2d8043b4-48ef-4992-a04a-c342cbbb4f87
which can be used as unique global reference for WEBC2-ADSPACE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
WEBC2-AUSOV
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This malware family is a only a downloader which operates over the HTTP protocol with a hard-coded URL. If directed, it has the capability to download, decompress, and execute compressed binaries.
Internal MISP references
UUID e2a27431-28ea-42e3-a0cc-72f29828c292
which can be used as unique global reference for WEBC2-AUSOV
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
WEBC2-BOLID
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This family of malware is a backdoor capable of downloading files and updating its configuration. Communication with the command and control (C2) server uses a combination of single-byte XOR and Base64 encoded data wrapped in standard HTML tags. The malware family installs a registry key as a persistence mechanism.
Internal MISP references
UUID a601e1b0-c0bc-4665-9639-4dc5e588520c
which can be used as unique global reference for WEBC2-BOLID
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
WEBC2-CLOVER
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The family of malware provides the attacker with an interactive command shell, the ability to upload and download files, execute commands on the system, list processes and DLLs, kill processes, and ping hosts on the local network. Responses to these commands are encrypted and compressed before being POSTed to the server. Some variants copy cmd.exe to Updatasched.exe in a temporary directory, and then may launch that in a process if an interactive shell is called. On initial invocation, the malware also attempts to delete previous copies of the Updatasched.exe file.
Internal MISP references
UUID d7fa0245-2cff-475f-9d8c-3728c83ac194
which can be used as unique global reference for WEBC2-CLOVER
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
WEBC2-CSON
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. Members of this family of malware act only as downloaders and droppers for other malware. They communicate with a hard-coded C2 server, reading commands embedded in HTML comment fields. Some variants are executables which act upon execution, others are DLLs which can be attached to services or loaded through search order hijacking.
Internal MISP references
UUID 950a8038-eeec-44a0-b3db-a557e5796416
which can be used as unique global reference for WEBC2-CSON
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
WEBC2-DIV
The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-DIV variant searches for the strings "div safe:" and " balance" to delimit encoded C2 information. If the decoded string begins with the letter "J" the malware will parse additional arguments in the decoded string to specify the sleep interval to use. WEBC2-DIV is capable of downloading a file, downloading and executing a file, or sleeping a specified interval.
Internal MISP references
UUID 54be66ea-fd26-4f25-b4af-d10d16fa919f
which can be used as unique global reference for WEBC2-DIV
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
WEBC2-GREENCAT
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This malware is a variant on the GREENCAT family, using a fixed web C2. This family is a full featured backdoor which provides remote command execution, file transfer, process and service enumeration and manipulation. It installs itself persistently through the current user's registry Run key.
Internal MISP references
UUID bfe69071-17bf-466f-97fd-669b72053137
which can be used as unique global reference for WEBC2-GREENCAT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
WEBC2-HEAD
The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-HEAD variant communicates over HTTPS, using the system's SSL implementation to encrypt all communications with the C2 server. WEBC2-HEAD first issues an HTTP GET to the host, sending the Base64-encoded string containing the name of the compromised machine running the malware.
Internal MISP references
UUID 4ef97a7e-5686-44cb-ad91-7a393f32f39b
which can be used as unique global reference for WEBC2-HEAD
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
WEBC2-KT3
The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-KT3 variant searches for commands in a specific comment tag. Network traffic starting with *!Kt3+v| may indicate WEBC2-KT3 activity.
Internal MISP references
UUID e2afc267-9674-4ca3-807f-47678fb40da4
which can be used as unique global reference for WEBC2-KT3
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
WEBC2-QBP
The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-QBP variant will search for two strings in a HTML comment. The first will be "2010QBP " followed by " 2010QBP//--". Inside these tags will be a DES-encrypted string.
Internal MISP references
UUID 84f3bacf-abd5-445e-a98a-5b02f1eaac92
which can be used as unique global reference for WEBC2-QBP
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
WEBC2-RAVE
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This family of malware will set itself up as a service and connect out to a hardcoded web page and read a modified base64 string from this webpage. The later versions of this malware supports three commands (earlier ones are just downloaders or reverse shells). The first commands will sleep the malware for N number of hours. The second command will download a binary from the encoded HTML comment and execute it on the infected host. The third will spawn an encoded reverse shell to an attacker specified location and port.
Internal MISP references
UUID 9e36feee-e7d2-400a-960e-5f2bd6ac0c15
which can be used as unique global reference for WEBC2-RAVE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
WEBC2-TABLE
The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-TABLE variant looks for web pages containing 'background', 'align', and 'bgcolor' tags to be present in the requested Web page. If the data in these tags are formatted correctly, the malware will decode a second URL and a filename. This URL is then retrieved, written to the decoded filename and executed.
Internal MISP references
UUID 269fee27-f275-44e9-a0db-bebf14d2f83c
which can be used as unique global reference for WEBC2-TABLE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
WEBC2-TOCK
The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-TABLE variant looks for web pages containing 'background', 'align', and 'bgcolor' tags to be present in the requested Web page. If the data in these tags are formatted correctly, the malware will decode a second URL and a filename. This URL is then retrieved, written to the decoded filename and executed.
Internal MISP references
UUID 3213c61f-100c-4174-b50b-c7e256ae5474
which can be used as unique global reference for WEBC2-TOCK
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
WEBC2-UGX
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. Members of this family of malware provide remote command shell and remote file download and execution capabilities. The malware downloads a web page containing a crafted HTML comment that subsequently contains an encoded command. The contents of this command tell the malware whether to download and execute a program, launch a reverse shell to a specific host and port number, or to sleep for a period of time.
Internal MISP references
UUID d155c213-02bd-4992-a410-a541a1c1eb40
which can be used as unique global reference for WEBC2-UGX
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
WEBC2-Y21K
A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. Members of this family of backdoor malware talk to specific Web-based Command & Control (C2) servers. The backdoor has a limited command set, depending on version. It is primarily a downloader, but it classified as a backdoor because it can accept a limited command set, including changing local directories, downloading and executing additional files, sleeping, and connecting to a specific IP & port not initially included in the instruction set for the malware. Each version of the malware has at least one hardcoded URL to which it connects to receive its initial commands. This family of malware installs itself as a service, with the malware either being the executable run by the service, or the service DLL loaded by a legitimate service. The same core code is seen recompiled on different dates or with different names, but the same functionality. Key signatures include a specific set of functions (some of which can be used with the OS-provided rundll32.exe tool to install the malware as a service), and hardcoded strings used in communication with C2 servers to issue commands to the implant.
Internal MISP references
UUID 215f6352-324f-4735-9fda-ffec0daaa2d2
which can be used as unique global reference for WEBC2-Y21K
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
WEBC2-YAHOO
The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-YAHOO variant enters a loop where every ten minutes it attempts to download a web page that may contain an encoded URL. The encoded URL will be found in the pages returned inside an attribute named 'sb' or 'ex' within a tag named 'yahoo'. The embedded link can direct the malware to download and execute files.
Internal MISP references
UUID d49f372e-c4ee-47bd-bc98-e3877fabaf9e
which can be used as unique global reference for WEBC2-YAHOO
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
HAYMAKER
HAYMAKER is a backdoor that can download and execute additional payloads in the form of modules. It also conducts basic victim profiling activity, collecting the computer name, running process IDs, %TEMP% directory path and version of Internet Explorer. It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string.
Internal MISP references
UUID d71604d2-a17e-4b4e-82be-19cb54f93161
which can be used as unique global reference for HAYMAKER
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
BUGJUICE
BUGJUICE is a backdoor that is executed by launching a benign file and then hijacking the search order to load a malicious dll into it. That malicious dll then loads encrypted shellcode from the binary, which is decrypted and runs the final BUGJUICE payload. BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2. It has the capability to find files, enumerate drives, exfiltrate data, take screenshots and provide a reverse shell.
Internal MISP references
UUID 90124cc8-1205-4e63-83ad-5c45a110b1e6
which can be used as unique global reference for BUGJUICE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
SNUGRIDE
SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests. Messages are encrypted using AES with a static key. The malware’s capabilities include taking a system survey, access to the filesystem, executing commands and a reverse shell. Persistence is maintained through a Run registry key.
Internal MISP references
UUID 6a42aa10-5b7e-43b0-8c58-414cdaeda453
which can be used as unique global reference for SNUGRIDE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
QUASARRAT
QUASARRAT is an open-source RAT available at https://github.com/quasar/QuasarRat . The versions used by APT10 (1.3.4.0, 2.0.0.0, and 2.0.0.1) are not available via the public GitHub page, indicating that APT10 has further customized the open source version. The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload. QUASARRAT is a fully functional .NET backdoor that has been used by multiple cyber espionage groups in the past. QUASARRAT is a publicly available Windows backdoor. It may visit a website, download, upload, and execute files. QUASARRAT may acquire system information, act as a remote desktop or shell, or remotely activate the webcam. The backdoor may also log keystrokes and steal passwords from commonly used browsers and FTP clients. QUASARRAT was originally named xRAT before it was renamed by the developers in August 2015. Availability: Public
Internal MISP references
UUID 4d58ad7d-b5ee-4efb-b6af-6c70aadb326a
which can be used as unique global reference for QUASARRAT
in MISP communities and other software using the MISP galaxy
External references
- https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html - webarchive
- https://researchcenter.paloaltonetworks.com/2017/10/unit42-tracking-subaat-targeted-phishing-attacks-point-leader-threat-actors-repository/ - webarchive
- https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
da Vinci RCS
Hacking Team’s "DaVinci" Remote Control System is able, the company says, to break encryption and allow law enforcement agencies to monitor encrypted files and emails (even ones encrypted with PGP), Skype and other Voice over IP or chat communication. It allows identification of the target’s location and relationships. It can also remotely activate microphones and cameras on a computer and works worldwide. Hacking Team claims that its software is able to monitor hundreds of thousands of computers at once, all over the country. Trojans are available for Windows, Mac, Linux, iOS, Android, Symbian and Blackberry.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular da Vinci RCS.
Known Synonyms |
---|
DaVinci |
Morcut |
Internal MISP references
UUID 37709067-e55e-473b-bb1c-312a27714d0c
which can be used as unique global reference for da Vinci RCS
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
LATENTBOT
LATENTBOT, a new, highly obfuscated BOT that has been in the wild since mid-2013. It has managed to leave hardly any traces on the Internet, is capable of watching its victims without ever being noticed, and can even corrupt a hard disk, thus making a PC useless.
Internal MISP references
UUID 635d260f-39d9-4d3f-99ec-d2560cb5d694
which can be used as unique global reference for LATENTBOT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
FINSPY
Though we have not identified the targets, FINSPY is sold by Gamma Group to multiple nation-state clients, and we assess with moderate confidence that it was being used along with the zero-day to carry out cyber espionage.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FINSPY.
Known Synonyms |
---|
BlackOasis |
Internal MISP references
UUID dd4358a4-7a43-42f7-8322-0f941ee61e57
which can be used as unique global reference for FINSPY
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
RCS Galileo
HackingTeam Remote Control System (RCS) Galileo hacking platform
Internal MISP references
UUID 8a15832a-2cb1-47cc-8916-c16a507f7154
which can be used as unique global reference for RCS Galileo
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
EARLYSHOVEL
RedHat 7.0 - 7.1 Sendmail 8.11.x exploit
Internal MISP references
UUID 80c7b1bf-c35f-4831-90ce-0699f6173f1b
which can be used as unique global reference for EARLYSHOVEL
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
EBBISLAND (EBBSHAVE)
root RCE via RPC XDR overflow in Solaris 6, 7, 8, 9 & 10 (possibly newer) both SPARC and x86
Internal MISP references
UUID 370331a1-2178-4369-afb7-ce2da134a2ba
which can be used as unique global reference for EBBISLAND (EBBSHAVE)
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
ECHOWRECKER
remote Samba 3.0.x Linux exploit
Internal MISP references
UUID 0381c40e-81c6-4a18-b5b6-48b7eef211c7
which can be used as unique global reference for ECHOWRECKER
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
EASYBEE
appears to be an MDaemon email server vulnerability
Internal MISP references
UUID 7f96b58d-0f41-46cd-8141-c53d2a03fb81
which can be used as unique global reference for EASYBEE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
EASYPI
an IBM Lotus Notes exploit that gets detected as Stuxnet
Internal MISP references
UUID 4f3df03f-336d-4a2b-a500-47e93a4259e6
which can be used as unique global reference for EASYPI
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
EWOKFRENZY
an exploit for IBM Lotus Domino 6.5.4 & 7.0.2
Internal MISP references
UUID c8fedb97-4f7e-48d1-8f2a-5e0562c1fba0
which can be used as unique global reference for EWOKFRENZY
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
EXPLODINGCAN
an IIS 6.0 exploit that creates a remote backdoor
Internal MISP references
UUID f843ef63-9e42-42d0-84a0-40d863985088
which can be used as unique global reference for EXPLODINGCAN
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
ETERNALROMANCE
a SMB1 exploit over TCP port 445 which targets XP, 2003, Vista, 7, Windows 8, 2008, 2008 R2, and gives SYSTEM privileges (MS17-010)
Internal MISP references
UUID b5c5174e-36a2-4b53-aed7-91b006514c8b
which can be used as unique global reference for ETERNALROMANCE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
EDUCATEDSCHOLAR
a SMB exploit (MS09-050)
Internal MISP references
UUID 342a64db-f130-4ac2-96d2-a773fb2bf86d
which can be used as unique global reference for EDUCATEDSCHOLAR
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
EMERALDTHREAD
a SMB exploit for Windows XP and Server 2003 (MS10-061)
Internal MISP references
UUID 32cd0bfb-9269-43ba-9c43-9fc484a30ad0
which can be used as unique global reference for EMERALDTHREAD
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
EMPHASISMINE
a remote IMAP exploit for IBM Lotus Domino 6.6.4 to 8.5.2
Internal MISP references
UUID 48393a71-3814-48ab-805b-a7914e006814
which can be used as unique global reference for EMPHASISMINE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
ENGLISHMANSDENTIST
Outlook Exchange WebAccess rules to trigger executable code on the client's side to send an email to other users
Internal MISP references
UUID ce484c02-b538-4351-ba7e-48c7d05c013f
which can be used as unique global reference for ENGLISHMANSDENTIST
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
EPICHERO
0-day exploit (RCE) for Avaya Call Server
Internal MISP references
UUID 7120af74-6589-44a4-aee6-0f8fd3808d54
which can be used as unique global reference for EPICHERO
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
ERRATICGOPHER
SMBv1 exploit targeting Windows XP and Server 2003
Internal MISP references
UUID a82fa4a0-1904-4c03-9fc4-7cbcd255ce58
which can be used as unique global reference for ERRATICGOPHER
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
ETERNALSYNERGY
a SMBv3 remote code execution flaw for Windows 8 and Server 2012 SP0 (MS17-010)
Internal MISP references
UUID b4547fe9-25c9-40b6-9256-07f1ed7548c4
which can be used as unique global reference for ETERNALSYNERGY
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
ETERNALBLUE
SMBv2 exploit for Windows 7 SP1 (MS17-010)
Internal MISP references
UUID e5b14d3e-ae59-495e-bdcb-f9d876db3f87
which can be used as unique global reference for ETERNALBLUE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
ETERNALCHAMPION
a SMBv1 exploit
Internal MISP references
UUID 4aee9bfe-f01d-44ea-9edd-91ecad88413a
which can be used as unique global reference for ETERNALCHAMPION
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
ESKIMOROLL
Kerberos exploit targeting 2000, 2003, 2008 and 2008 R2 domain controllers
Internal MISP references
UUID 4a8db2c4-04fb-49e0-b688-1bc5d8354072
which can be used as unique global reference for ESKIMOROLL
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
ESTEEMAUDIT
RDP exploit and backdoor for Windows Server 2003
Internal MISP references
UUID 5d9131be-c3bb-44ac-9c4d-19fcc97d2efd
which can be used as unique global reference for ESTEEMAUDIT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
ECLIPSEDWING
RCE exploit for the Server service in Windows Server 2008 and later (MS08-067)
Internal MISP references
UUID 406ad0a9-b1fc-4edc-aa20-692a69f349a6
which can be used as unique global reference for ECLIPSEDWING
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
ETRE
exploit for IMail 8.10 to 8.22
Internal MISP references
UUID 3aaef939-132c-4cfb-9243-20918373ccfe
which can be used as unique global reference for ETRE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
FUZZBUNCH
an exploit framework, similar to MetaSploit
Internal MISP references
UUID 3de1aa96-24cd-4790-babc-df0b2d657bdb
which can be used as unique global reference for FUZZBUNCH
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
ODDJOB
implant builder and C&C server that can deliver exploits for Windows 2000 and later, also not detected by any AV vendors
Internal MISP references
UUID d20f9a41-db27-4d53-995e-547f86ff3d1e
which can be used as unique global reference for ODDJOB
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
PASSFREELY
utility which Bypasses authentication for Oracle servers
Internal MISP references
UUID b68ac0c5-124a-4f22-9c99-0c1cd42bdee3
which can be used as unique global reference for PASSFREELY
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
SMBTOUCH
check if the target is vulnerable to samba exploits like ETERNALSYNERGY, ETERNALBLUE, ETERNALROMANCE
Internal MISP references
UUID 48cf4f29-41a2-4244-bb25-377362eaa3ae
which can be used as unique global reference for SMBTOUCH
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
ERRATICGOPHERTOUCH
Check if the target is running some RPC
Internal MISP references
UUID a122b8e0-1249-4c77-8ef7-6b9caf48ab4f
which can be used as unique global reference for ERRATICGOPHERTOUCH
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
IISTOUCH
check if the running IIS version is vulnerable
Internal MISP references
UUID 7b4bf6dd-d191-429b-a5ee-9305093aa1ec
which can be used as unique global reference for IISTOUCH
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
RPCOUTCH
get info about windows via RPC
Internal MISP references
UUID 2c9e90ea-7421-4101-97a6-ebe095bd29ad
which can be used as unique global reference for RPCOUTCH
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
DOPU
used to connect to machines exploited by ETERNALCHAMPIONS
Internal MISP references
UUID f1657aac-a6be-4383-8cd6-06b833acf07c
which can be used as unique global reference for DOPU
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
FlexSpy
covert surveillance tools
Internal MISP references
UUID 71d6e949-69df-4d64-9637-136780226f49
which can be used as unique global reference for FlexSpy
in MISP communities and other software using the MISP galaxy
feodo
Unfortunately, it is time to meet 'Feodo'. Since august of this year when FireEye's MPS devices detected this malware in the field, we have been monitoring this banking trojan very closely. In many ways, this malware looks similar to other famous banking trojans like Zbot and SpyEye. Although my analysis says that this malware is not a toolkit and is in the hands of a single criminal group.
Internal MISP references
UUID 372cdc12-d909-463c-877a-175f97f7abb5
which can be used as unique global reference for feodo
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Cardinal RAT
Palo Alto Networks has discovered a previously unknown remote access Trojan (RAT) that has been active for over two years. It has a very low volume in this two-year period, totaling roughly 27 total samples. The malware is delivered via an innovative and unique technique: a downloader we are calling Carp uses malicious macros in Microsoft Excel documents to compile embedded C# (C Sharp) Programming Language source code into an executable that in turn is run to deploy the Cardinal RAT malware family. These malicious Excel files use a number of different lures, providing evidence of what attackers are using to entice victims into executing them.
Internal MISP references
UUID 1d9fbf33-faea-40c1-b543-c7b39561f0ff
which can be used as unique global reference for Cardinal RAT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
REDLEAVES
The REDLEAVES implant consists of three parts: an executable, a loader, and the implant shellcode. The REDLEAVES implant is a remote administration Trojan (RAT) that is built in Visual C++ and makes heavy use of thread generation during its execution. The implant contains a number of functions typical of RATs, including system enumeration and creating a remote shell back to the C2.
Internal MISP references
UUID 179f7228-6fcf-4664-a084-57bd296d0cde
which can be used as unique global reference for REDLEAVES
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Kazuar
Kazuar is a fully featured backdoor written using the .NET Framework and obfuscated using the open source packer called ConfuserEx. Unit 42 researchers have uncovered a backdoor Trojan used in an espionage campaign. The developers refer to this tool by the name Kazuar, which is a Trojan written using the Microsoft .NET Framework that offers actors complete access to compromised systems targeted by its operator. Kazuar includes a highly functional command set, which includes the ability to remotely load additional plugins to increase the Trojan’s capabilities. During our analysis of this malware we uncovered interesting code paths and other artifacts that may indicate a Mac or Unix variant of this same tool also exists. Also, we discovered a unique feature within Kazuar: it exposes its capabilities through an Application Programming Interface (API) to a built-in webserver. We suspect the Kazuar tool may be linked to the Turla threat actor group (also known as Uroburos and Snake), who have been reported to have compromised embassies, defense contractors, educational institutions, and research organizations across the globe. A hallmark of Turla operations is iterations of their tools and code lineage in Kazuar can be traced back to at least 2005. If the hypothesis is correct and the Turla threat group is using Kazuar, we believe they may be using it as a replacement for Carbon and its derivatives. Of the myriad of tools observed in use by Turla Carbon and its variants were typically deployed as a second stage backdoor within targeted environments and we believe Kazuar may now hold a similar role for Turla operations.
Internal MISP references
UUID a5399473-859b-4c64-999b-a3b4070cd513
which can be used as unique global reference for Kazuar
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Trick Bot
Many links indicate, that this bot is another product of the people previously involved in Dyreza. It seems to be rewritten from scratch – however, it contains many similar features and solutions to those we encountered analyzing Dyreza (read more).
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Trick Bot.
Known Synonyms |
---|
TrickBot |
TrickLoader |
Internal MISP references
UUID a7dbd72f-8d53-48c6-a9db-d16e7648b2d4
which can be used as unique global reference for Trick Bot
in MISP communities and other software using the MISP galaxy
External references
- https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/ - webarchive
- https://blog.fraudwatchinternational.com/malware/trickbot-malware-works - webarchive
- https://securityintelligence.com/trickbot-is-hand-picking-private-banks-for-targets-with-redirection-attacks-in-tow/ - webarchive
- https://www.bleepingcomputer.com/news/security/trickbot-banking-trojan-gets-screenlocker-component/ - webarchive
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Hackshit
Netskope Threat Research Labs recently discovered a Phishing-as-a-Service (PhaaS) platform named Hackshit, that records the credentials of the phished bait victims. The phished bait pages are packaged with base64 encoding and served from secure (HTTPS) websites with “.moe” top level domain (TLD) to evade traditional scanners. “.moe” TLD is intended for the purpose of ‘The marketing of products or services deemed’. The victim’s credentials are sent to the Hackshit PhaaS platform via websockets. The Netskope Active Platform can proactively protect customers by creating custom applications and a policy to block all the activities related to Hackshit PhaaS.
Internal MISP references
UUID 02d2ed4a-ce3f-430b-a8da-5b9750c148ca
which can be used as unique global reference for Hackshit
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Moneygram Adwind
Internal MISP references
UUID 6c6e717d-03c5-496d-83e9-13bdaa408348
which can be used as unique global reference for Moneygram Adwind
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Banload
Banload has been around since the last decade. This malware generally arrives on a victim’s system through a spam email containing an archived file or bundled software as an attachment. In a few cases, this malware may also be dropped by other malware or a drive-by download. When executed, Banload downloads other malware, often banking Trojans, on the victim’s system to carry out further infections.
Internal MISP references
UUID d279bc1c-baa6-49aa-ab1b-7d012ae8db4e
which can be used as unique global reference for Banload
in MISP communities and other software using the MISP galaxy
External references
- https://researchcenter.paloaltonetworks.com/2016/03/banload-malware-affecting-brazil-exhibits-unusually-complex-infection-process/ - webarchive
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/banload - webarchive
- http://blog.trendmicro.com/trendlabs-security-intelligence/banload-limits-targets-via-security-plugin/ - webarchive
- https://securingtomorrow.mcafee.com/mcafee-labs/banload-trojan-targets-brazilians-with-malware-downloads/ - webarchive
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Smoke Loader
This small application is used to download other malware. What makes the bot interesting are various tricks that it uses for deception and self protection.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Smoke Loader.
Known Synonyms |
---|
SmokeLoader |
Internal MISP references
UUID 81f41bae-2ba9-4cec-9613-776be71645ca
which can be used as unique global reference for Smoke Loader
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
LockPoS
The analyzed sample has a recent compilation date (2017-06-24) and is available on VirusTotal. It starts out by resolving several Windows functions using API hashing (CRC32 is used as the hashing function).
Internal MISP references
UUID c740c46b-1d95-42b5-ac3d-2bbab071b859
which can be used as unique global reference for LockPoS
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Fadok
Win.Worm.Fadok drops several files. %AppData%\RAC\mls.exe or %AppData%\RAC\svcsc.exe are instances of the malware which are auto-started when Windows starts. Further, the worm drops and opens a Word document. It connects to the domain wxanalytics[.]ru.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Fadok.
Known Synonyms |
---|
Win32/Fadok |
Internal MISP references
UUID 6243b2d1-381b-4aa4-a59f-839afcdf03f2
which can be used as unique global reference for Fadok
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Loki Bot
Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets.
Internal MISP references
UUID 9085faf1-e5ec-4e51-83eb-92620afda7be
which can be used as unique global reference for Loki Bot
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
KONNI
Talos has discovered an unknown Remote Administration Tool that we believe has been in use for over 3 years. During this time it has managed to avoid scrutiny by the security community. The current version of the malware allows the operator to steal files, keystrokes, perform screenshots, and execute arbitrary code on the infected host. Talos has named this malware KONNI. Throughout the multiple campaigns observed over the last 3 years, the actor has used an email attachment as the initial infection vector. They then use additional social engineering to prompt the target to open a .scr file, display a decoy document to the users, and finally execute the malware on the victim's machine. The malware infrastructure of the analysed samples was hosted by a free web hosting provider: 000webhost. The malware has evolved over time. In this article, we will analyse this evolution:
Internal MISP references
UUID 24ee55e3-697f-482f-8fa8-d05999df40cd
which can be used as unique global reference for KONNI
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
NOKKI
Beginning in early 2018, Unit 42 observed a series of attacks using a previously unreported malware family, which we have named ‘NOKKI’. The malware in question has ties to a previously reported malware family named KONNI, however, after careful consideration, we believe enough differences are present to introduce a different malware family name. To reflect the close relationship with KONNI, we chose NOKKI, swapping KONNI’s Ns and Ks. Because of code overlap found within both malware families, as well as infrastructure overlap, we believe the threat actors responsible for KONNI are very likely also responsible for NOKKI. Previous reports stated it was likely KONNI had been in use for over three years in multiple campaigns with a heavy interest in the Korean peninsula and surrounding areas. As of this writing, it is not certain if the KONNI or NOKKI operators are related to known adversary groups operating in the regions of interest, although there is evidence of a tenuous relationship with a group known as Reaper.
Internal MISP references
UUID 9e4fd0d3-9736-421c-b1e1-96c1d3665c80
which can be used as unique global reference for NOKKI
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
SpyDealer
Recently, Palo Alto Networks researchers discovered an advanced Android malware we’ve named “SpyDealer” which exfiltrates private data from more than 40 apps and steals sensitive messages from communication apps by abusing the Android accessibility service feature. SpyDealer uses exploits from a commercial rooting app to gain root privilege, which enables the subsequent data theft.
Internal MISP references
UUID f86b4977-228d-4b31-854d-8bdc92db4653
which can be used as unique global reference for SpyDealer
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
CowerSnail
CowerSnail was compiled using Qt and linked with various libraries. This framework provides benefits such as cross-platform capability and transferability of the source code between different operating systems.
Internal MISP references
UUID 6da16d56-eaf9-475d-a7e0-4a11e0200c14
which can be used as unique global reference for CowerSnail
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Svpeng
In mid-July 2017, we found a new modification of the well-known mobile banking malware family Svpeng – Trojan-Banker.AndroidOS.Svpeng.ae. In this modification, the cybercriminals have added new functionality: it now also works as a keylogger, stealing entered text through the use of accessibility services.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Svpeng.
Known Synonyms |
---|
trojan-banker.androidos.svpeng.ae |
Internal MISP references
UUID a33df440-f112-4a5e-a290-3c65dae6091d
which can be used as unique global reference for Svpeng
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
TwoFace
While investigating a recent security incident, Unit 42 found a webshell that we believe was used by the threat actor to remotely access the network of a targeted Middle Eastern organization. The construction of the webshell was interesting by itself, as it was actually two separate webshells: an initial webshell that was responsible for saving and loading the second fully functional webshell. It is this second webshell that enabled the threat actor to run a variety of commands on the compromised server. Due to these two layers, we use the name TwoFace to track this webshell. During our analysis, we extracted the commands executed by the TwoFace webshell from the server logs on the compromised server. Our analysis shows that the commands issued by the threat actor date back to June 2016; this suggests that the actor had access to this shell for almost an entire year. The commands issued show the actor was interested in gathering credentials from the compromised server using the Mimikatz tool. We also saw the attacker using the TwoFace webshell to move laterally through the network by copying itself and other webshells to other servers.
Internal MISP references
UUID 9334c430-0d83-4893-8982-66a1dc1a2b11
which can be used as unique global reference for TwoFace
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['webshell'] |
Related clusters
To see the related clusters, click here.
IntrudingDivisor
Like TwoFace, the IntrudingDivisor webshell requires the threat actor to authenticate before issuing commands. To authenticate, the actor must provide two pieces of information, first an integer that is divisible by 5473 and a string whose MD5 hash is “9A26A0E7B88940DAA84FC4D5E6C61AD0”. Upon successful authentication, the webshell has a command handler that uses integers within the request to determine the command to execute - To complete
Internal MISP references
UUID bb2bd10b-b36d-4390-bf60-bd8d2d7cedec
which can be used as unique global reference for IntrudingDivisor
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
type | ['webshell'] |
JS_POWMET
Attacks that use completely fileless malware are a rare occurrence, so we thought it important to discuss a new trojan known as JS_POWMET (Detected by Trend Micro as JS_POWMET.DE), which arrives via an autostart registry procedure. By utilizing a completely fileless infection chain, the malware will be more difficult to analyze using a sandbox, making it more difficult for anti-malware engineers to examine.
Internal MISP references
UUID c602edae-b186-4c60-a4f6-8785d6aa0eb0
which can be used as unique global reference for JS_POWMET
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
EngineBox Malware
The main malware capabilities include a privilege escalation attempt using MS16–032 exploitation; a HTTP Proxy to intercept banking transactions; a backdoor to make it possible for the attacker to issue arbitrary remote commands and a C&C through a IRC channel. As it's being identified as a Generic Trojan by most of VirusTotal (VT) engines, let s name it EngineBox— the core malware class I saw after reverse engineering it.
Internal MISP references
UUID 17839df6-aa15-4269-b4b1-9e7ae8cfec1e
which can be used as unique global reference for EngineBox Malware
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Joao
Spread via hacked Aeria games offered on unofficial websites, the modular malware can download and install virtually any other malicious code on the victim’s computer. To spread their malware, the attackers behind Joao have misused massively-multiplayer online role-playing games (MMORPGs) originally published by Aeria Games. At the time of writing this article, the Joao downloader was being distributed via the anime-themed MMORPG Grand Fantasia offered on gf.ignitgames[.]to.
Internal MISP references
UUID 673d05fa-4066-442c-bdb6-0c0a2da5ae62
which can be used as unique global reference for Joao
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Fireball
Upon execution, Fireball installs a browser hijacker as well as any number of adware programs. Several different sources have linked different indicators of compromise (IOCs) and varied payloads, but a few details remain the same.
Internal MISP references
UUID 968df869-7f60-4420-989f-23dfdbd58668
which can be used as unique global reference for Fireball
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
ShadowPad
ShadowPad is a modular cyber-attack platform that attackers deploy in victim networks to gain flexible remote control capabilities. The platform is designed to run in two stages. The first stage is a shellcode that was embedded in a legitimate nssock2.dll used by Xshell, Xmanager and other software packages produced by NetSarang. This stage is responsible for connecting to “validation” command and control (C&C) servers and getting configuration information including the location of the real C&C server, which may be unique per victim. The second stage acts as an orchestrator for five main modules responsible for C&C communication, working with the DNS protocol, loading and injecting additional plugins into the memory of other processes.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ShadowPad.
Known Synonyms |
---|
Barlaiy |
POISONPLUG |
Internal MISP references
UUID 2448a4e1-46e3-4c42-9fd1-f51f8ede58c1
which can be used as unique global reference for ShadowPad
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
IoT_reaper
IoT_reaper is fairly large now and is actively expanding. For example, there are multiple C2s we are tracking, the most recently data (October 19) from just one C2 shows the number of unique active bot IP address is more than 10k per day. While at the same time, there are millions of potential vulnerable device IPs being queued into the c2 system waiting to be processed by an automatic loader that injects malicious code to the devices to expand the size of the botnet.
Internal MISP references
UUID 6052becf-3060-444c-8ed7-d4a3901ae7dd
which can be used as unique global reference for IoT_reaper
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
FormBook
FormBook is a data stealer and form grabber that has been advertised in various hacking forums since early 2016.
Internal MISP references
UUID c7e7063b-b2a2-4046-8a19-94dea018eaa0
which can be used as unique global reference for FormBook
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Dimnie
Dimnie, the commonly agreed upon name for the binary dropped by the PowerShell script above, has been around for several years. Palo Alto Networks has observed samples dating back to early 2014 with identical command and control mechanisms. The malware family serves as a downloader and has a modular design encompassing various information stealing functionalities. Each module is injected into the memory of core Windows processes, further complicating analysis. During its lifespan, it appears to have undergone few changes and its stealthy command and control methods combined with a previously Russian focused target base has allowed it to fly under the radar up until this most recent campaign.
Internal MISP references
UUID 9fed4326-a7ad-4c58-ab87-90ac3957d82f
which can be used as unique global reference for Dimnie
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
ALMA Communicator
The ALMA Communicator Trojan is a backdoor Trojan that uses DNS tunneling exclusively to receive commands from the adversary and to exfiltrate data. This Trojan specifically reads in a configuration from the cfg file that was initially created by the Clayslide delivery document. ALMA does not have an internal configuration, so the Trojan does not function without the cfg file created by the delivery document.
Internal MISP references
UUID 45de0d28-5a20-4190-ae21-68067e36e316
which can be used as unique global reference for ALMA Communicator
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Silence
In September 2017, we discovered a new targeted attack on financial institutions. Victims are mostly Russian banks but we also found infected organizations in Malaysia and Armenia. The attackers were using a known but still very effective technique for cybercriminals looking to make money: gaining persistent access to an internal banking network for a long period of time, making video recordings of the day to day activity on bank employees’ PCs, learning how things works in their target banks, what software is being used, and then using that knowledge to steal as much money as possible when ready. We saw that technique before in Carbanak, and other similar cases worldwide. The infection vector is a spear-phishing email with a malicious attachment. An interesting point in the Silence attack is that the cybercriminals had already compromised banking infrastructure in order to send their spear-phishing emails from the addresses of real bank employees and look as unsuspicious as possible to future victims.
Internal MISP references
UUID 304fd753-c917-4008-8f85-81390c37a070
which can be used as unique global reference for Silence
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Volgmer
Volgmer is a backdoor Trojan designed to provide covert access to a compromised system. Since at least 2013, HIDDEN COBRA actors have been observed using Volgmer malware in the wild to target the government, financial, automotive, and media industries. It is suspected that spear phishing is the primary delivery mechanism for Volgmer infections; however, HIDDEN COBRA actors use a suite of custom tools, some of which could also be used to initially compromise a system. Therefore, it is possible that additional HIDDEN COBRA malware may be present on network infrastructure compromised with Volgmer
Internal MISP references
UUID 0a52e73b-d7e9-45ae-9bda-46568f753931
which can be used as unique global reference for Volgmer
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Nymaim
Nymaim is a 2-year-old strain of malware most closely associated with ransomware. We have seen recent attacks spreading it using an established email marketing service provider to avoid blacklists and detection tools. But instead of ransomware, the malware is now being used to distribute banking Trojans
Internal MISP references
UUID d36f4834-b958-4f32-aff0-5263e0034408
which can be used as unique global reference for Nymaim
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
GootKit
As was the case earlier, the bot Gootkit is written in NodeJS, and is downloaded to a victim computer via a chain of downloaders. The main purpose of the bot also remained the same – to steal banking data. The new Gootkit version, detected in September, primarily targets clients of European banks, including those in Germany, France, Italy, the Netherlands, Poland, etc.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GootKit.
Known Synonyms |
---|
Gootkit |
Internal MISP references
UUID 07ffcf9f-b9c0-4b22-af4b-78527427e6f5
which can be used as unique global reference for GootKit
in MISP communities and other software using the MISP galaxy
External references
- https://securelist.com/inside-the-gootkit-cc-server/76433/ - webarchive
- https://securityintelligence.com/gootkit-bobbing-and-weaving-to-avoid-prying-eyes/ - webarchive
- https://securityintelligence.com/gootkit-launches-redirection-attacks-in-the-uk/ - webarchive
- https://www.symantec.com/security_response/writeup.jsp?docid=2010-051118-0604-99 - webarchive
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Agent Tesla
Agent Tesla is modern powerful keystroke logger. It provides monitoring your personel computer via keyboard and screenshot. Keyboard, screenshot and registered passwords are sent in log. You can receive your logs via e-mail, ftp or php(web panel).
Internal MISP references
UUID f8cd62cb-b9d3-4352-8f46-0961cfde104c
which can be used as unique global reference for Agent Tesla
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Ordinypt
A new ransomware strain called Ordinypt is currently targeting victims in Germany, but instead of encrypting users' documents, the ransomware rewrites files with random data. Ordinypt is actually a wiper and not ransomware because it does not bother encrypting anything, but just replaces files with random data.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ordinypt.
Known Synonyms |
---|
HSDFSDCrypt |
Internal MISP references
UUID 1d46f816-d159-4457-b98e-c34307d90655
which can be used as unique global reference for Ordinypt
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
StrongPity2
Detected by ESET as Win32/StrongPity2, this spyware notably resembles one that was attributed to the group called StrongPity.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular StrongPity2.
Known Synonyms |
---|
Win32/StrongPity2 |
Internal MISP references
UUID d422e7c9-a2ac-45b2-9804-61d16a6e30e7
which can be used as unique global reference for StrongPity2
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
wp-vcd
WordPress site owners should be on the lookout for a malware strain tracked as wp-vcd that hides in legitimate WordPress files and that is used to add a secret admin user and grant attackers control over infected sites. The malware was first spotted online over the summer by Italian security researcher Manuel D'Orso. The initial version of this threat was loaded via an include call for the wp-vcd.php file —hence the malware's name— and injected malicious code into WordPress core files such as functions.php and class.wp.php. This was not a massive campaign, but attacks continued throughout the recent months.
Internal MISP references
UUID 99de56dc-92c5-4540-91bc-a6cd1e3a3c7f
which can be used as unique global reference for wp-vcd
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
MoneyTaker 5.0
malicious program for auto replacement of payment data in AWS CBR
Internal MISP references
UUID 0acb6f04-7e51-44bb-843c-4bb55a3647d5
which can be used as unique global reference for MoneyTaker 5.0
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Quant Loader
Described as a "professional exe loader / dll dropper" Quant Loader is in fact a very basic trojan downloader. It began being advertised on September 1, 2016 on various Russian underground forums.
Internal MISP references
UUID 2d1aadfb-03c1-4580-b6ac-f12c6941067d
which can be used as unique global reference for Quant Loader
in MISP communities and other software using the MISP galaxy
External references
- https://www.bleepingcomputer.com/news/security/quant-loader-is-now-bundled-with-other-crappy-malware/ - webarchive
- https://blogs.forcepoint.com/security-labs/locky-distributor-uses-newly-released-quant-loader-sold-russian-underground - webarchive
- https://www.bleepingcomputer.com/news/security/worlds-largest-spam-botnet-finds-a-new-way-to-avoid-detection-for-now/ - webarchive
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
SSHDoor
The Secure Shell Protocol (SSH) is a very popular protocol used for secure data communication. It is widely used in the Unix world to manage remote servers, transfer files, etc. The modified SSH daemon described here, Linux/SSHDoor.A, is designed to steal usernames and passwords and allows remote access to the server via either an hardcoded password or SSH key.
Internal MISP references
UUID f258f96c-8281-4b24-8aa7-4e23d1a5540e
which can be used as unique global reference for SSHDoor
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
TRISIS
(Dragos Inc.) The team identifies this malware as TRISIS because it targets Schneider Electric’s Triconex safety instrumented system (SIS) enabling the replacement of logic in final control elements. TRISIS is highly targeted and likely does not pose an immediate threat to other Schneider Electric customers, let alone other SIS products. (FireEye Inc.) This malware, which we call TRITON, is an attack framework built to interact with Triconex Safety Instrumented System (SIS) controllers. We have not attributed the incident to a threat actor, though we believe the activity is consistent with a nation state preparing for an attack. TRITON is one of a limited number of publicly identified malicious software families targeted at industrial control systems (ICS). It follows Stuxnet which was used against Iran in 2010 and Industroyer which we believe was deployed by Sandworm Team against Ukraine in 2016.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TRISIS.
Known Synonyms |
---|
TRITON |
Internal MISP references
UUID 8a45d1a5-8157-4303-a47a-352282065059
which can be used as unique global reference for TRISIS
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
OSX.Pirrit
macOS adware strain
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular OSX.Pirrit.
Known Synonyms |
---|
OSX/Pirrit |
Internal MISP references
UUID e2b7ddc2-2fce-4ef9-9054-609e74a8775e
which can be used as unique global reference for OSX.Pirrit
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
GratefulPOS
GratefulPOS has the following functions 1. Access arbitrary processes on the target POS system 2. Scrape track 1 and 2 payment card data from the process(es) 3. Exfiltrate the payment card data via lengthy encoded and obfuscated DNS queries to a hardcoded domain registered and controlled by the perpetrators, similar to that described by Paul Rascagneres in his analysis of FrameworkPOS in 2014[iii], and more recently by Luis Mendieta of Anomoli in analysis of a precursor to this sample.
Internal MISP references
UUID 4cfe3f22-96b8-4d3d-a6cc-85835d9471e2
which can be used as unique global reference for GratefulPOS
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
PRILEX
Prilex malware steals the information of the infected ATM’s users. In this case, it was a Brazilian bank, but consider the implications of such an attack in your region, whether you’re a customer or the bank.
Internal MISP references
UUID 523e8772-0610-424c-bcfb-9123bcb8328f
which can be used as unique global reference for PRILEX
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
CUTLET MAKER
Cutlet Maker is an ATM malware designed to empty the machine of all its banknotes. Interestingly, while its authors have been advertising its sale, their competitors have already cracked the program, allowing anybody to use it for free.
Internal MISP references
UUID c03e7054-6013-4f69-994d-7cdaa41588ed
which can be used as unique global reference for CUTLET MAKER
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Satori
According to a report Li shared with Bleeping Computer today, the Mirai Satori variant is quite different from all previous pure Mirai variants.Previous Mirai versions infected IoT devices and then downloaded a Telnet scanner component that attempted to find other victims and infect them with the Mirai bot.The Satori variant does not use a scanner but uses two embedded exploits that will try to connect to remote devices on ports 37215 and 52869.Effectively, this makes Satori an IoT worm, being able to spread by itself without the need for separate components.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Satori.
Known Synonyms |
---|
Okiru |
Internal MISP references
UUID 1ad4697b-3388-48ed-8621-85abebf5dbbf
which can be used as unique global reference for Satori
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
PowerSpritz
PowerSpritz is a Windows executable that hides both its legitimate payload and malicious PowerShell command using a non-standard implementation of the already rarely used Spritz encryption algorithm (see the Attribution section for additional analysis of the Spritz implementation). This malicious downloader has been observed being delivered via spearphishing attacks using the TinyCC link shortener service to redirect to likely attacker-controlled servers hosting the malicious PowerSpritz payload.
Internal MISP references
UUID 5629bc84-58eb-42d9-adc6-cd0eeb08ccaf
which can be used as unique global reference for PowerSpritz
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
PowerRatankba
PowerRatankba is used for the same purpose as Ratankba: as a first stage reconnaissance tool and for the deployment of further stage implants on targets that are deemed interesting by the actor. Similar to its predecessor, PowerRatankba utilizes HTTP for its C&C communication.
Internal MISP references
UUID 1f1be19e-d1b5-408b-90a0-03ad27cc8924
which can be used as unique global reference for PowerRatankba
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Ratankba
In one instance we observed, one of the initial malware delivered to the victim, RATANKBA, connects to a legitimate but compromised website from which a hack tool (nbt_scan.exe) is also downloaded. The domain also serves as one of the campaign’s platform for C&C communication. The threat actor uses RATANKBA to survey the lay of the land as it looks into various aspects of the host machine where it has been initially downloaded—the machine that has been victim of the watering hole attack. Information such as the running tasks, domain, shares, user information, if the host has default internet connectivity, and so forth.
Internal MISP references
UUID 64b3c66b-fc70-4b5a-83a9-866cde2ccb0b
which can be used as unique global reference for Ratankba
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
USBStealer
USBStealer serves as a network tool that extracts sensitive information from air-gapped networks. We have not seen this component since mid 2015.
Internal MISP references
UUID 44909efb-7cd3-42e3-b225-9f3e96b5f362
which can be used as unique global reference for USBStealer
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Downdelph
Downdelph is a lightweight downloader developed in the Delphi programming language. As we already mentioned in our white paper, its period of activity was from November 2013 to September 2015 and there have been no new variants seen since.
Internal MISP references
UUID 837a295c-15ff-41c0-9b7e-5f2fb502b00a
which can be used as unique global reference for Downdelph
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
CoinMiner
Monero-mining malware
Internal MISP references
UUID 89bd2020-2594-45c4-8957-522c0ac41370
which can be used as unique global reference for CoinMiner
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
FruitFly
A fully-featured backdoor, designed to perversely spy on Mac users
Internal MISP references
UUID 6a6525b9-4656-4973-ab45-588592395d0c
which can be used as unique global reference for FruitFly
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
MacDownloader
Iranian macOS exfiltration agent, targeting the 'defense industrial base' and human rights advocates.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MacDownloader.
Known Synonyms |
---|
iKitten |
Internal MISP references
UUID 14f08f6f-7f58-48a8-8469-472244ffb571
which can be used as unique global reference for MacDownloader
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Empyre
The open-source macOS backdoor, 'Empye', maliciously packaged into a macro'd Word document
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Empyre.
Known Synonyms |
---|
Empye |
Internal MISP references
UUID cf55bbb8-37eb-4cc6-ac14-7b42b950c687
which can be used as unique global reference for Empyre
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Proton
A fully-featured macOS backdoor, designed to collect and exfiltrate sensitive user data such as 1Password files, browser login data, and keychains.
Internal MISP references
UUID a495d254-7092-4a63-9872-3a82c13fe2dd
which can be used as unique global reference for Proton
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Mughthesec
Adware which hijacks a macOS user's homepage to redirect search queries.
Internal MISP references
UUID 4e2f0af2-6d2d-4a49-adc9-fae3745fcb72
which can be used as unique global reference for Mughthesec
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Pwnet
A macOS crypto-currency miner, distributed via a trojaned 'CS-GO' hack.
Internal MISP references
UUID 29e52693-b325-4c14-93de-8f2ff9dca8bf
which can be used as unique global reference for Pwnet
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
CpuMeaner
A macOS crypto-currency mining trojan.
Internal MISP references
UUID 5bc62523-dc80-46b4-b5cb-9caf44c11552
which can be used as unique global reference for CpuMeaner
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Travle
The Travle sample found during our investigation was a DLL with a single exported function (MSOProtect). The malware name Travle was chosen given a string found in early samples of this family: “Travle Path Failed!”. This typo was replaced with correct word “Travel” in newer releases. We believe that Travle could be a successor to the NetTraveler family.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Travle.
Known Synonyms |
---|
PYLOT |
Internal MISP references
UUID 9d689318-2bc1-4bfb-92ee-a81fea35434f
which can be used as unique global reference for Travle
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Digmine
Digmine is coded in AutoIt, and sent to would-be victims posing as a video file but is actually an AutoIt executable script. If the user’s Facebook account is set to log in automatically, Digmine will manipulate Facebook Messenger in order to send a link to the file to the account’s friends. The abuse of Facebook is limited to propagation for now, but it wouldn’t be implausible for attackers to hijack the Facebook account itself down the line. This functionality’s code is pushed from the command-and-control (C&C) server, which means it can be updated.
Internal MISP references
UUID d248a27c-d036-4032-bc70-803a1b0c8148
which can be used as unique global reference for Digmine
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
TSCookie
TSCookie itself only serves as a downloader. It expands functionality by downloading modules from C&C servers. The sample that was examined downloaded a DLL file which has exfiltrating function among many others (hereafter “TSCookieRAT”). Downloaded modules only runs on memory.
Internal MISP references
UUID a71ed71f-b8f4-416d-9c57-910a42e59430
which can be used as unique global reference for TSCookie
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Exforel
Exforel backdoor malware, VirTool:WinNT/Exforel.A, backdoor implemented at the Network Driver Interface Specification (NDIS) level.
Internal MISP references
UUID 3119554e-236e-11e8-ae2e-b7063732fd07
which can be used as unique global reference for Exforel
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Rotinom
W32.Rotinom is a worm that spreads by copying itself to removable drives.
Internal MISP references
UUID 5f4be30a-2373-11e8-bbab-774ff49fd040
which can be used as unique global reference for Rotinom
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Aurora
You probably have heard the recent news about a widespread attack that was carried out using a 0-Day exploit for Internet Explorer as one of the vectors. This exploit is also known as the "Aurora Exploit". The code has recently gone public and it was also added to the Metasploit framework. This exploit was used to deliver a malicious payload, known by the name of Trojan.Hydraq, the main purpose of which was to steal information from the compromised computer and report it back to the attackers. The exploit code makes use of known techniques to exploit a vulnerability that exists in the way Internet Explorer handles a deleted object. The final purpose of the exploit itself is to access an object that was previously deleted, causing the code to reference a memory location over which the attacker has control and in which the attacker dropped his malicious code.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Aurora.
Known Synonyms |
---|
Hydraq |
Internal MISP references
UUID 70c31066-237a-11e8-8eff-37ef1ad0c703
which can be used as unique global reference for Aurora
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Cheshire Cat
Oldest Cheshire Cat malware compiled in 2002. It's a very old family of malware. The time stamps may be forged but the malware does have support for very old operating systems. The 2002 implant retrieves a handle for an asr2892 drives that they never got their hands on. It checks for a NE header which is a header type used before PE headers even existed. References to 16bit or DOS on a non 9x platform. This malware implant IS REALLY for old systems. The malware is for espionage - it's very carefully made to stay hidden. Newer versions install as icon handler shell extension for .lnk files. Shell in this case means the program manager because windows explorer was not yet a thing. It sets up COM server objects. It looks like it was written in pure C, but made to look like C++. A sensitive implant as well: it checks for all kinds of old MS platforms including Windows NT, win95, win98, winME and more. It checks the patch level as well. A lot of effort was put into adapting this malware to a lot of different operating systems with very granular decision chains.
Internal MISP references
UUID 7af226a0-237d-11e8-b438-075460988010
which can be used as unique global reference for Cheshire Cat
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Downloader-FGO
Downloader-FGO is a trojan that comes hidden in malicious programs. Once you install the source (carrier) program, this trojan attempts to gain "root" access (administrator level access) to your computer without your knowledge
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Downloader-FGO.
Known Synonyms |
---|
Generic30.ASYL (Trojan horse) |
Mal/Behav-112 |
SB/Malware |
TR/Agent.84480.85 |
TROJ_KAZY.SM1 |
Trj/CI.A |
Trojan.Generic.8627031 |
Trojan.Spuler |
Trojan:Win32/Sisproc |
Win32/FakePPT_i |
Win32:Malware-gen |
Internal MISP references
UUID 1a3f876f-0f52-497f-b3ff-b995e2d42c15
which can be used as unique global reference for Downloader-FGO
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
uuid | c565a3a4-2384-11e8-99e9-ebd8ea5c3c3e |
miniFlame
Newly discovered spying malware designed to steal data from infected systems was likely built from the same cyber-weaponry factory that produced two other notorious cyberespionage software Flame and Gauss, a security vendor says. Kaspersky Lab released a technical paper Monday outlining the discovery of the malware the vendor has dubbed "miniFlame." While capable of working with Flame and Gauss, miniFlame is a "small, fully functional espionage module designed for data theft and direct access to infected systems," Kaspersky said.
Internal MISP references
UUID 16c57264-239f-11e8-9469-0738871e7aa4
which can be used as unique global reference for miniFlame
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
GHOTEX
PE_GHOTEX.A-O is a portable executable (PE is the standard executable format for 32-bit Windows files) virus. PE viruses infect executable Windows files by incorporating their code into these files such that they are executed when the infected files are opened.
Internal MISP references
UUID 231b7572-239f-11e8-8404-df420a5d403b
which can be used as unique global reference for GHOTEX
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Shipup
Trojan:Win32/Shipup.G is a trojan that modifies the Autorun feature for certain devices.
Internal MISP references
UUID 4613b76c-4966-44b6-bcd5-f74fa64deb18
which can be used as unique global reference for Shipup
in MISP communities and other software using the MISP galaxy
External references
- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Shipup.G - webarchive
- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan%3AWin32%2FShipup.K - webarchive
- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Shipup.A - webarchive
- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~ShipUp-F/detailed-analysis.aspx - webarchive
- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~ShipUp-A/detailed-analysis.aspx - webarchive
Associated metadata
Metadata key | Value |
---|---|
Neuron
Neuron consists of both client and server components. The Neuron client and Neuron service are written using the .NET framework with some codebase overlaps. The Neuron client is used to infect victim endpoints and extract sensitive information from local client machines. The Neuron server is used to infect network infrastructure such as mail and web servers, and acts as local Command & Control (C2) for the client component. Establishing a local C2 limits interaction with the target network and remote hosts. It also reduces the log footprint of actor infrastructure and enables client interaction to appear more convincing as the traffic is contained within the target network.
Internal MISP references
UUID 5c2eeaec-25e3-11e8-9d28-7f64aba5b173
which can be used as unique global reference for Neuron
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Nautilus
Nautilus is very similar to Neuron both in the targeting of mail servers and how client communications are performed. This malware is referred to as Nautilus due to its embedded internal DLL name “nautilus-service.dll”, again sharing some resemblance to Neuron. The Nautilus service listens for HTTP requests from clients to process tasking requests such as executing commands, deleting files and writing files to disk
Internal MISP references
UUID 73cb7ecc-25e3-11e8-a97b-c35ec4e7dcf8
which can be used as unique global reference for Nautilus
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Gamut Botnet
Gamut was found to be downloaded by a Trojan Downloader that arrives as an attachment from a spam email message. The bot installation is quite simple. After the malware binary has been downloaded, it launches itself from its current directory, usually the Windows %Temp% folder and installs itself as a Windows service. The malware utilizes an anti-VM (virtual machine) trick and terminates itself if it detects that it is running in a virtual machine environment. The bot uses INT 03h trap sporadically in its code, an anti-debugging technique which prevents its code from running within a debugger environment. It can also determine if it is being debugged by using the Kernel32 API - IsDebuggerPresent function.
Internal MISP references
UUID 492879ac-285b-11e8-a06e-33f548e66e42
which can be used as unique global reference for Gamut Botnet
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
CORALDECK
CORALDECK is an exfiltration tool that searches for specified files and exfiltrates them in password protected archives using hardcoded HTTP POST headers. CORALDECK has been observed dropping and using Winrar to exfiltrate data in password protected RAR files as well as WinImage and zip archives
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CORALDECK.
Known Synonyms |
---|
APT.InfoStealer.Win.CORALDECK |
FE_APT_InfoStealer_Win_CORALDECK_1 |
Internal MISP references
UUID becf81e5-f989-4093-a67d-d55a0483885f
which can be used as unique global reference for CORALDECK
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
DOGCALL
DOGCALL is a backdoor commonly distributed as an encoded binary file downloaded and decrypted by shellcode following the exploitation of weaponized documents. DOGCALL is capable of capturing screenshots, logging keystrokes, evading analysis with anti-virtual machine detections, and leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex. DOGCALL was used to target South Korean Government and military organizations in March and April 2017. The malware is typically dropped using an HWP exploit in a lure document. The wiper tool, RUHAPPY, was found on some of the systems targeted by DOGCALL. While DOGCALL is primarily an espionage tool, RUHAPPY is a destructive wiper tool meant to render systems inoperable.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DOGCALL.
Known Synonyms |
---|
APT.Backdoor.Win.DOGCALL |
FE_APT_Backdoor_Win32_DOGCALL_1 |
FE_APT_RAT_DOGCALL |
Internal MISP references
UUID a5e851b4-e046-43b6-bc6e-c6c008e3c5aa
which can be used as unique global reference for DOGCALL
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
GELCAPSULE
GELCAPSULE is a downloader traditionally dropped or downloaded by an exploit document. GELCAPSULE has been observed downloading SLOWDRIFT to victim systems.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GELCAPSULE.
Known Synonyms |
---|
FE_APT_Downloader_Win32_GELCAPSULE_1 |
Internal MISP references
UUID ac008bbd-f415-458e-96bf-be7d158df2d8
which can be used as unique global reference for GELCAPSULE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
HAPPYWORK
HAPPYWORK is a malicious downloader that can download and execute a second-stage payload, collect system information, and beacon it to the command and control domains. The collected system information includes: computer name, user name, system manufacturer via registry, IsDebuggerPresent state, and execution path. In November 2016, HAPPYWORK targeted government and financial targets in South Korea.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HAPPYWORK.
Known Synonyms |
---|
Downloader.APT.HAPPYWORK |
FE_APT_Downloader_HAPPYWORK |
FE_APT_Exploit_HWP_Happy |
Internal MISP references
UUID 656cd201-d57a-4a2f-a201-531eb4922a72
which can be used as unique global reference for HAPPYWORK
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
KARAE
Karae backdoors are typically used as first-stage malware after an initial compromise. The backdoors can collect system information, upload and download files, and may be used to retrieve a second-stage payload. The malware uses public cloud-based storage providers for command and control. In March 2016, KARAE malware was distributed through torrent file-sharing websites for South Korean users. During this campaign, the malware used a YouTube video downloader application as a lure.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular KARAE.
Known Synonyms |
---|
Backdoor.APT.Karae |
FE_APT_Backdoor_Karae |
FE_APT_Backdoor_Karae_enc |
Internal MISP references
UUID 70ca8408-bc45-4d39-acd2-9190ba15ea97
which can be used as unique global reference for KARAE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
MILKDROP
MILKDROP is a launcher that sets a persistence registry key and launches a backdoor.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MILKDROP.
Known Synonyms |
---|
FE_Trojan_Win32_MILKDROP_1 |
Internal MISP references
UUID 1064c911-44e6-4c84-8e11-f476a8b06ce8
which can be used as unique global reference for MILKDROP
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
POORAIM
POORAIM malware is designed with basic backdoor functionality and leverages AOL Instant Messenger for command and control communications. POORAIM includes the following capabilities: System information enumeration, File browsing, manipulation and exfiltration, Process enumeration, Screen capture, File execution, Exfiltration of browser favorites, and battery status. Exfiltrated data is sent via files over AIM. POORAIM has been involved in campaigns against South Korean media organizations and sites relating to North Korean refugees and defectors since early 2014. Compromised sites have acted as watering holes to deliver newer variants of POORAIM.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular POORAIM.
Known Synonyms |
---|
Backdoor.APT.POORAIM |
Internal MISP references
UUID fe97ace3-9a80-42af-9eae-1f9245927e5d
which can be used as unique global reference for POORAIM
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
RICECURRY
RICECURRY is a Javascript based profiler used to fingerprint a victim's web browser and deliver malicious code in return. Browser, operating system, and Adobe Flash version are detected by RICECURRY, which may be a modified version of PluginDetect.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RICECURRY.
Known Synonyms |
---|
Exploit.APT.RICECURRY |
Internal MISP references
UUID 6f37edf6-f5e6-4749-82f9-2aa7c30582c4
which can be used as unique global reference for RICECURRY
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
RUHAPPY
RUHAPPY is a destructive wiper tool seen on systems targeted by DOGCALL. It attempts to overwrite the MBR, causing the system not to boot. When victims' systems attempt to boot, the string 'Are you Happy?' is displayed. The malware is believed to be tied to the developers of DOGCALL and HAPPYWORK based on similar PDB paths in all three.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RUHAPPY.
Known Synonyms |
---|
FE_APT_Trojan_Win32_RUHAPPY_1 |
Internal MISP references
UUID 96296d57-e9d9-42f1-b08c-c8636369b9aa
which can be used as unique global reference for RUHAPPY
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
SHUTTERSPEED
SHUTTERSPEED is a backdoor that can collect system information, acquire screenshots, and download/execute an arbitrary executable. SHUTTERSPEED typically requires an argument at runtime in order to execute fully. Observed arguments used by SHUTTERSPEED include: 'help', 'console', and 'sample'. The spear phishing email messages contained documents exploiting RTF vulnerability CVE-2017-0199. Many of the compromised domains in the command and control infrastructure are linked to South Korean companies. Most of these domains host a fake webpage pertinent to targets.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SHUTTERSPEED.
Known Synonyms |
---|
APT.Backdoor.SHUTTERSPEED |
FE_APT_Backdoor_SHUTTERSPEED |
Internal MISP references
UUID d909efe3-abc3-4be0-9640-e4727542fa2b
which can be used as unique global reference for SHUTTERSPEED
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
SLOWDRIFT
SLOWDRIFT is a launcher that communicates via cloud based infrastructure. It sends system information to the attacker command and control and then downloads and executes additional payloads.Lure documents distributing SLOWDRIFT were not tailored for specific victims, suggesting that TEMP.Reaper is attempting to widen its target base across multiple industries and in the private sector. SLOWDRIFT was seen being deployed against academic and strategic targets in South Korea using lure emails with documents leveraging the HWP exploit. Recent SLOWDRIFT samples were uncovered in June 2017 with lure documents pertaining to cyber crime prevention and news stories. These documents were last updated by the same actor who developed KARAE, POORAIM and ZUMKONG.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SLOWDRIFT.
Known Synonyms |
---|
APT.Downloader.SLOWDRIFT |
FE_APT_Downloader_Win_SLOWDRIFT_1 |
FE_APT_Downloader_Win_SLOWDRIFT_2 |
Internal MISP references
UUID e5a9a2ec-348e-4a2f-98dd-16c3e8845576
which can be used as unique global reference for SLOWDRIFT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
SOUNDWAVE
SOUNDWAVE is a windows based audio capturing utility. Via command line it accepts the -l switch (for listen probably), captures microphone input for 100 minutes, writing the data out to a log file in this format: C:\Temp\HncDownload\YYYYMMDDHHMMSS.log.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SOUNDWAVE.
Known Synonyms |
---|
FE_APT_HackTool_Win32_SOUNDWAVE_1 |
Internal MISP references
UUID 6a0e3c75-5a59-4747-8fec-2e344a328575
which can be used as unique global reference for SOUNDWAVE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
ZUMKONG
ZUMKONG is a credential stealer capable of harvesting usernames and passwords stored by Internet Explorer and Chrome browsers. Stolen credentials are emailed to the attacker via HTTP POST requests to mail[.]zmail[.]ru.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ZUMKONG.
Known Synonyms |
---|
FE_APT_Trojan_Zumkong |
Trojan.APT.Zumkong |
Internal MISP references
UUID 6f1b9155-5de4-4ef7-9f42-60007599c477
which can be used as unique global reference for ZUMKONG
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
WINERACK
WINERACK is backdoor whose primary features include user and host information gathering, process creation and termination, filesystem and registry manipulation, as well as the creation of a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands. Other capabilities include the enumeration of files, directories, services, active windows and processes.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular WINERACK.
Known Synonyms |
---|
Backdoor.APT.WINERACK |
FE_APT_Backdoor_WINERACK |
Internal MISP references
UUID 49025073-4cd3-43b8-b893-e80a1d3adc04
which can be used as unique global reference for WINERACK
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
RoyalCli
The RoyalCli backdoor appears to be an evolution of BS2005 and uses familiar encryption and encoding routines. The name RoyalCli was chosen by us due to a debugging path left in the binary: 'c:\users\wizard\documents\visual studio 2010\Projects\RoyalCli\Release\RoyalCli.pdb' RoyalCli and BS2005 both communicate with the attacker's command and control (C2) through Internet Explorer (IE) by using the COM interface IWebBrowser2. Due to the nature of the technique, this results in C2 data being cached to disk by the IE process; we'll get to this later.
Internal MISP references
UUID ac04d0b0-c6b5-4125-acd7-c58dfe7ad4cf
which can be used as unique global reference for RoyalCli
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
RoyalDNS
Internal MISP references
UUID 7b20b78a-df6e-40c7-9a3a-363f040cfad7
which can be used as unique global reference for RoyalDNS
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
SHARPKNOT
Internal MISP references
UUID 203fd529-6382-417e-a68f-7565fbf89ece
which can be used as unique global reference for SHARPKNOT
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
KillDisk Wiper
KillDisk, along with the multipurpose, cyberespionage-related BlackEnergy, was used in cyberattacks in late December 2015 against Ukraine’s energy sector as well as its banking, rail, and mining industries. The malware has since metamorphosed into a threat used for digital extortion, affecting Windows and Linux platforms. The note accompanying the ransomware versions, like in the case of Petya, was a ruse: Because KillDisk also overwrites and deletes files (and don’t store the encryption keys on disk or online), recovering the scrambled files was out of the question. The new variant we found, however, does not include a ransom note.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular KillDisk Wiper.
Known Synonyms |
---|
KillDisk |
Internal MISP references
UUID aef0fdd4-38b6-11e8-afdd-3b6145112467
which can be used as unique global reference for KillDisk Wiper
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
UselessDisk
A new MBR bootlocker called DiskWriter, or UselessDisk, has been discovered that overwrites the MBR of a victim's computer and then displays a ransom screen on reboot instead of booting into Windows. This ransom note asks for $300 in bitcoins in order to gain access to Windows again. Might be a wiper.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular UselessDisk.
Known Synonyms |
---|
DiskWriter |
Internal MISP references
UUID b5112fe0-38b6-11e8-af9f-6381b5e5403f
which can be used as unique global reference for UselessDisk
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
GoScanSSH
During a recent Incident Response (IR) engagement, Talos identified a new malware family that was being used to compromise SSH servers exposed to the internet. This malware, which we have named GoScanSSH, was written using the Go programming language, and exhibited several interesting characteristics. This is not the first malware family that Talos has observed that was written using Go. However, it is relatively uncommon to see malware written in this programming language. In this particular case, we also observed that the attacker created unique malware binaries for each host that was infected with the GoScanSSH malware. Additionally, the GoScanSSH command and control (C2) infrastructure was observed leveraging the Tor2Web proxy service in an attempt to make tracking the attacker-controlled infrastructure more difficult and resilient to takedowns.
Internal MISP references
UUID 8c0a7e1e-3cc4-11e8-8f03-2f71e72f737b
which can be used as unique global reference for GoScanSSH
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Rovnix
We recently found that the malware family ROVNIX is capable of being distributed via macro downloader. This malware technique was previously seen in the DRIDEX malware, which was notable for using the same routines. DRIDEX is also known as the successor of the banking malware CRIDEX.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Rovnix.
Known Synonyms |
---|
ROVNIX |
Internal MISP references
UUID a4036a28-3d94-11e8-ad9f-97ada3c6d5fb
which can be used as unique global reference for Rovnix
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Kwampirs
Once Orangeworm has infiltrated a victim’s network, they deploy Trojan.Kwampirs, a backdoor Trojan that provides the attackers with remote access to the compromised computer. When executed, Kwampirs decrypts and extracts a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.
Internal MISP references
UUID d1e548b8-4793-11e8-8dea-6beff82cac0a
which can be used as unique global reference for Kwampirs
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Rubella Macro Builder
A crimeware kit dubbed the Rubella Macro Builder has recently been gaining popularity among members of a top-tier Russian hacking forum. Despite being relatively new and unsophisticated, the kit has a clear appeal for cybercriminals: it’s cheap, fast, and can defeat basic static antivirus detection.
Internal MISP references
UUID b7be6732-4ed5-11e8-8b82-dff39eb7a396
which can be used as unique global reference for Rubella Macro Builder
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
kitty Malware
Researchers at Imperva's Incapsula said a new piece malware called Kitty leaves a note for cat lovers. It attacks the Drupal content management system (CMS) to illegally mine cryptocurrency Monero.
Internal MISP references
UUID 85d5da28-51f7-11e8-bbeb-af367d720136
which can be used as unique global reference for kitty Malware
in MISP communities and other software using the MISP galaxy
External references
- https://www.zdnet.com/article/hello-kitty-malware-targets-drupal-to-mine-for-cryptocurrency/ - webarchive
- https://threatpost.com/kitty-cryptomining-malware-cashes-in-on-drupalgeddon-2-0/131668/ - webarchive
- https://cryptovest.com/news/hello-kitty-new-malware-me0ws-its-way-into-mining-monero/ - webarchive
Associated metadata
Metadata key | Value |
---|---|
Maikspy
We discovered a malware family called Maikspy — a multi-platform spyware that can steal users’ private data. The spyware targets Windows and Android users, and first posed as an adult game named after a popular U.S.-based adult film actress. Maikspy, which is an alias that combines the name of the adult film actress and spyware, has been around since 2016.
Internal MISP references
UUID d83ec444-535c-11e8-ae83-831d0a85d77a
which can be used as unique global reference for Maikspy
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Huigezi malware
backdoor trojan popular found prevalently in China
Internal MISP references
UUID 6aef5a32-5381-11e8-ac5a-bb46d8986552
which can be used as unique global reference for Huigezi malware
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
FacexWorm
Facebook, Chrome, and cryptocurrency users should be on the lookout for a new malware strain named FacexWorm that infects victims for the purpose of stealing passwords, stealing cryptocurrency funds, running cryptojacking scripts, and spamming Facebook users. This new strain was spotted in late April by Trend Micro researchers and appears to be related to two other Facebook Messenger spam campaigns, one that took place last August, and another one from December 2017, the latter spreading the Digmine malware. Researchers say FacexWorm's modus operandi is similar to the previous two campaigns, but with the addition of new techniques aimed at cryptocurrency users.
Internal MISP references
UUID 86ac8c80-5382-11e8-b893-4f1651951472
which can be used as unique global reference for FacexWorm
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Bankshot
implant used in Operation GhostSecret
Internal MISP references
UUID d9431c02-5391-11e8-931f-4beceb8bd697
which can be used as unique global reference for Bankshot
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Proxysvc
downloader used in Operation GhostSecret
Internal MISP references
UUID dafba168-5391-11e8-87e4-0f93b75d6ac0
which can be used as unique global reference for Proxysvc
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Escad
backdoor used in Operation GhostSecret
Internal MISP references
UUID db36cf9a-5391-11e8-b53a-97adedf48055
which can be used as unique global reference for Escad
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
StalinLocker
A new in-development screenlocker/wiper called StalinLocker, or StalinScreamer, was discovered by MalwareHunterTeam that gives you 10 minutes to enter a code or it will try to delete the contents of the drives on the computer. While running, it will display screen that shows Stalin while playing the USSR anthem and displaying a countdown until files are deleted.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular StalinLocker.
Known Synonyms |
---|
StalinScreamer |
Internal MISP references
UUID 50eb8c54-5828-11e8-8d6b-232bb9329fc0
which can be used as unique global reference for StalinLocker
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
VPNFilter
Advanced, likely state-sponsored or state-affiliated modular malware. The code of this malware overlaps with versions of the BlackEnergy malware. Targeted devices are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well as QNAP network-attached storage (NAS) systems.
Internal MISP references
UUID 895d769e-b288-4977-a4e1-7d64eb134bf9
which can be used as unique global reference for VPNFilter
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Iron Backdoor
Iron Backdoor uses a virtual machine detection code taken directly from HackingTeam’s Soldier implant leaked source code. Iron Backdoor is also using the DynamicCall module from HackingTeam core library. Backdoor was used to drop cryptocurrency miners.
Internal MISP references
UUID 5433edec-f1c3-4051-a3cc-c7f9fc8972ee
which can be used as unique global reference for Iron Backdoor
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Brambul
Brambul malware is a malicious Windows 32-bit SMB worm that functions as a service dynamic link library file or a portable executable file often dropped and installed onto victims’ networks by dropper malware. When executed, the malware attempts to establish contact with victim systems and IP addresses on victims’ local subnets. If successful, the application attempts to gain unauthorized access via the SMB protocol (ports 139 and 445) by launching brute-force password attacks using a list of embedded passwords. Additionally, the malware generates random IP addresses for further attacks.
Internal MISP references
UUID 4c057ade-6989-11e8-9efd-ab33ed427468
which can be used as unique global reference for Brambul
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
PLEAD
PLEAD has two kinds – RAT (Remote Access Tool) and downloader. The RAT operates based on commands that are provided from C&C servers. On the other hand, PLEAD downloader downloads modules and runs it on memory in the same way as TSCookie does.
Internal MISP references
UUID d1482c9e-6af3-11e8-aa8e-279274bd10c7
which can be used as unique global reference for PLEAD
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
BabaYaga
The group behind BabaYaga —believed to be Russian-speaking hackers— uses this malware to inject sites with special keyboards to drive SEO traffic to hidden pages on compromised sites. These pages are then used to redirect users to affiliate marketing links, where if the user purchases advertised goods, the hackers also make a profit. The malware per-se is comprised of two modules —one that injects the spam content inside the compromised sites, and a backdoor module that gives attackers control over an infected site at any time. The intricacies of both modules are detailed in much more depth in this 26-page report authored by Defiant (formerly known as WordFence), the security firm which dissected the malware's more recent versions. "[BabaYaga] is relatively well-written, and it demonstrates that the author has some understanding of software development challenges, like code deployment, performance and management," Defiant researchers say. "It can also infect Joomla and Drupal sites, or even generic PHP sites, but it is most fully developed around Wordpress."
Internal MISP references
UUID 65c0dff4-6b23-11e8-899f-8fcb21ad9649
which can be used as unique global reference for BabaYaga
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
InvisiMole
Except for the malware's binary file, very little is known of who's behind it, how it spreads, or in what types of campaigns has this been used.
"Our telemetry indicates that the malicious actors behind this malware have been active at least since 2013, yet the cyber-espionage tool was never analyzed nor detected until discovered by ESET products on compromised computers in Ukraine and Russia," said ESET researcher Zuzana Hromcová, who recently penned an in-depth report about this new threat.
"All infection vectors are possible, including installation facilitated by physical access to the machine," Hromcová added.
Typical to malware used in highly-targeted attacks, the malware has been stripped of most clues that could lead researchers back to its author. With the exception of one file (dating to October 13, 2013), all compilation dates have been stripped and replaced with zeros, giving little clues regarding its timeline and lifespan.
Furthermore, the malware is some clever piece of coding in itself, as it's comprised of two modules, both with their own set of spying features, but which can also help each other in exfiltrating data.
Internal MISP references
UUID 10f50ef8-6e3b-11e8-a648-d73fb4d2f48e
which can be used as unique global reference for InvisiMole
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Roaming Mantis
Roaming Mantis malware is designed for distribution through a simple, but very efficient trick based on a technique known as DNS hijacking. When a user attempts to access any website via a compromised router, they will be redirected to a malicious website. For example, if a user were to navigate to www.securelist.com using a web browser, the browser would be redirected to a rogue server which has nothing to do with the security research blog. As long as the browser displays the original URL, users are likely to believe the website is genuine. The web page from the rogue server displays the popup message: To better experience the browsing, update to the latest chrome version.
Internal MISP references
UUID f35f219a-6eed-11e8-980a-93bb96299951
which can be used as unique global reference for Roaming Mantis
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
PLEAD Downloader
PLEAD is referred to both as a name of malware including TSCookie and its attack campaign. PLEAD has two kinds – RAT (Remote Access Tool) and downloader. The RAT operates based on commands that are provided from C&C servers. On the other hand, PLEAD downloader downloads modules and runs it on memory in the same way as TSCookie does.
Internal MISP references
UUID 7cda6406-6eef-11e8-a2ad-9340096d5711
which can be used as unique global reference for PLEAD Downloader
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
ClipboardWalletHijacker
The malware's purpose is to intercept content recorded in the Windows clipboard, look for strings resembling Bitcoin and Ethereum addresses, and replace them with ones owned by the malware's authors. ClipboardWalletHijacker's end-plan is to hijack BTC and ETH transactions, so victims unwittingly send funds to the malware's authors.
Internal MISP references
UUID 9f926c84-72cb-11e8-a1f2-676d779700ba
which can be used as unique global reference for ClipboardWalletHijacker
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
TYPEFRAME
Trojan malware
Internal MISP references
UUID 8981aaca-72dc-11e8-8649-838c1b2613c5
which can be used as unique global reference for TYPEFRAME
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Olympic Destroyer
The Winter Olympics this year is being held in Pyeongchang, South Korea. The Guardian, a UK Newspaper reported an article that suggested the Olympic computer systems suffered technical issues during the opening ceremony. Officials at the games confirmed some technical issues to non-critical systems and they completed recovery within around 12 hours. Sunday 11th February the Olympic games officials confirmed a cyber attack occurred but did not comment or speculate further. Talos have identified the samples, with moderate confidence, used in this attack. The infection vector is currently unknown as we continue to investigate. The samples identified, however, are not from adversaries looking for information from the games but instead they are aimed to disrupt the games. The samples analysed appear to perform only destructive functionality. There does not appear to be any exfiltration of data. Analysis shows that actors are again favouring legitimate pieces of software as PsExec functionality is identified within the sample. The destructive nature of this malware aims to render the machine unusable by deleting shadow copies, event logs and trying to use PsExec & WMI to further move through the environment. This is something we have witnessed previously with BadRabbit and Nyetya.
Internal MISP references
UUID 76d5c7a2-73c3-11e8-bd92-db4d715af093
which can be used as unique global reference for Olympic Destroyer
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
DDKONG
The malware in question is configured with the following three exported functions: ServiceMain,Rundll32Call, DllEntryPoint. The ServiceMain exported function indicates that this DLL is expected to be loaded as a service. If this function is successfully loaded, it will ultimately spawn a new instance of itself with the Rundll32Call export via a call to rundll32.exe. The Rundll32Call exported function begins by creating a named event named ‘RunOnce’. This event ensures that only a single instance of DDKong is executed at a given time. If this is the only instance of DDKong running at the time, the malware continues. If it’s not, it dies. This ensures that only a single instance of DDKong is executed at a given time. DDKong attempts to decode an embedded configuration using a single byte XOR key of 0xC3. After this configuration is decoded and parsed, DDKONG proceeds to send a beacon to the configured remote server via a raw TCP connection. The packet has a header of length 32 and an optional payload. In the beacon, no payload is provided, and as such, the length of this packet is set to zero. After it sends the beacon, the malware expects a response command of either 0x4 or 0x6. Both responses instruct the malware to download and load a remote plugin. In the event 0x4 is specified, the malware is instructed to load the exported ‘InitAction’ function. If 0x6 is specified, the malware is instructed to load the exported ‘KernelDllCmdAction’ function. Prior to downloading the plugin, the malware downloads a buffer that is concatenated with the embedded configuration and ultimately provided to the plugin at runtime. As we can see in the above text, two full file paths are included in this buffer, providing us with insight into the original malware family’s name, as well as the author. After this buffer is collected, the malware downloads the plugin and loads the appropriate function. This plugin provides the attacker with the ability to both list files and download/upload files on the victim machine.
Internal MISP references
UUID 57dd0828-79d7-11e8-a7d8-57db14e1ef24
which can be used as unique global reference for DDKONG
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
PLAINTEE
This sample is configured with three exported functions: Add, Sub, DllEntryPoint. The DLL expects the export named ‘Add’ to be used when initially loaded. When this function is executed PLAINTEE executes a command in a new process to add persistence. Next, the malware calls the ‘Sub’ function which begins by spawning a mutex named ‘microsoftfuckedupb’ to ensure only a single instance is running at a given time. In addition, PLAINTEE will create a unique GUID via a call to CoCreateGuid() to be used as an identifier for the victim. The malware then proceeds to collect general system enumeration data about the infected machine and enters a loop where it will decode an embedded config blob and send an initial beacon to the C2 server. The configuration blob is encoded using a simple single-byte XOR scheme. The first byte of the string is used as the XOR key to in turn decode the remainder of the data. The malware then proceeds to beacon to the configured port via a custom UDP protocol. The network traffic is encoded in a similar fashion, with a random byte being selected as the first byte, which is then used to decode the remainder of the packet via XOR. This beacon is continuously sent out until a valid response is obtained from the C2 server (there is no sleep timer set). After the initial beacon, there is a two second delay in between all other requests made. This response is expected to have a return command of 0x66660002 and to contain the same GUID that was sent to the C2 server. Once this response is received, the malware spawns several new threads, with different Command parameters, with the overall objective of loading and executing a new plugin that is to be received from the C2 server. During a file analysis of PLAINTEE in WildFire, we observed the attackers download and execute a plugin during the runtime for that sample. PLAINTEE expects the downloaded plugin to be a DLL with an export function of either ‘shell’ or ‘file’. The plugin uses the same network protocol as PLAINTEE and so we were able to trivially decode further commands that were sent. The following commands were observed: tasklist, ipconfig /all. The attacker performed these two commands 33 seconds apart. As automated commands are typically performed more quickly this indicates that they may have been sent manually by the attacker.
Internal MISP references
UUID 58b24db2-79d7-11e8-9b1b-bbdbc798af4f
which can be used as unique global reference for PLAINTEE
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Koadic
Koadic, or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire. The major difference is that Koadic does most of its operations using Windows Script Host
Internal MISP references
UUID f9e0b922-253c-40fa-a6d2-e60ec9c6980b
which can be used as unique global reference for Koadic
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Bisonal
In early May, Unit 42 discovered an attack campaign against at least one defense company in Russia and one unidentified organization in South Korea delivering a variant of Bisonal malware. While not previously publicly documented, the variant has been in the wild since at least 2014. There are three primary differences between it and older Bisonal malware including a different cipher and encryption for C2 communication, and a large rewrite of the code for both network communication and maintaining persistence. To date, we have only collected 14 samples of this variant, indicating it may be sparingly used. The adversary behind these attacks lured the targets into launching the Microsoft Windows executable malware by masquerading it as a PDF file (using a fake PDF icon) and reusing publicly available data for the decoy PDF file’s contents. Attacks using Bisonal have been blogged about in the past. In 2013, both COSEINC and FireEye revealed attacks using Bisonal against Japanese organizations . In October 2017, AhnLab published a report called “Operation Bitter Biscuit,” an attack campaign against South Korea, Japan, India and Russia using Bisonal and its successors, Bioazih and Dexbia.
Internal MISP references
UUID 23f6da78-873a-4ab0-9167-c8b0563627a5
which can be used as unique global reference for Bisonal
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
Sekur
Sekur has been CARBON SPIDER’s primary tool for several years, although usage over the last year appears to have declined. It contains all the functionality you would expect from a RAT, allowing the adversary to execute commands, manage the file system, manage processes, and collect data. In addition, it can record videos of victim sessions, log keystrokes, enable remote desktop, or install Ammyy Admin or VNC modules. From July 2014 on, samples were compiled with the capability to target Epicor POS systems and to collect credit card data.
Internal MISP references
UUID ddbd9db5-7875-437b-b7c5-a17d2892d218
which can be used as unique global reference for Sekur
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Agent ORM
Agent ORM began circulating alongside Skeur in campaigns throughout the second half of 2015. The malware collects basic system information and is able to take screenshots of victim systems. It is used to download next-stage payloads when systems of interest are identified. It is strongly suspected that Agent ORM has been deprecated in favor of script-based first-stage implants (VB Flash, JS Flash, and Bateleur).
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Agent ORM.
Known Synonyms |
---|
DRIFTPIN |
Tosliph |
Internal MISP references
UUID c1159097-3dad-48ab-91cf-c055182f5785
which can be used as unique global reference for Agent ORM
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
VB Flash
VB Flash was first observed being deployed alongside Agent ORM in September 2015. It is likely that this was developed as a replacement to Agent ORM and contained similar capabilities. The first observed instance of VB Flash included comments and was easy to analyze—later versions soon began to integrate multiple layers of obfuscation. Several versions of VB Flash were developed including ones that utilized Google Forms, Google Macros, and Google Spreadsheets together to make a command-and-control (C2) channel. This variant would POST victim data to a specified Google form, then make a request to a Google macro script, receiving an address for a Google Spreadsheet from which to request commands.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular VB Flash.
Known Synonyms |
---|
HALFBAKED |
Internal MISP references
UUID 2815a353-cd56-4ed0-8581-812b94f7a326
which can be used as unique global reference for VB Flash
in MISP communities and other software using the MISP galaxy
External references
Associated metadata
Metadata key | Value |
---|---|
Related clusters
To see the related clusters, click here.
JS Flash
JS Flash capabilities closely resemble those of VB Flash and leverage interesting techniques in deployment via batch scripts embedded as OLE objects in malicious documents. Many iterations of JS Flash were observed being tested before deployment, containing minor changes to obfuscation and more complex additions, such as the ability to download TinyMet (a cutdown of the Metasploit Meterpreter payload). PowerShell was also used heavily for the execution of commands and arbitrary script execution. No JS Flash samples were observed being deployed after November 2017.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular JS Flash.
Known Synonyms |
---|
JavaScript variant of HALFBAKED |
Internal MISP references
UUID bf03a7ae-3c5e-47b9-84c6-27756297f1b5
which can be used as unique global reference for JS Flash
in MISP communities and other software using the MISP galaxy