This strike sends a polymorphic malware sample known as LokiBot. Lokibot is an information-stealing malware designed to siphon off sensitive information stored on an infected device. It is modular in nature, supporting the ability to steal sensitive information from a number of popular applications. It is commonly pushed via malicious documents delivered via spam emails.The binary has random bytes...
The sample has been identified as being associated with the 'Crypmodadv' family of malware. The sample targets Win32 platforms. The sample is categorized as 'ransomware'. The sample was first seen in the wild on 2022-02-28.
The sample has been identified as being associated with the 'Shifu' family of malware. The sample targets Win32 platforms. The sample is categorized as 'retail'. The sample was first seen in the wild on 2022-03-31.
The sample has been identified as being associated with the 'Virlock' family of malware. The sample targets Win32 platforms. The sample is categorized as 'ransomware'. The sample was first seen in the wild on 2022-05-25.
The sample has been identified as being associated with the 'Virlock' family of malware. The sample targets Win32 platforms. The sample is categorized as 'ransomware'. The sample was first seen in the wild on 2022-08-22.
The sample has been identified as being associated with the 'TeslaCrypt' family of malware. The sample targets Win32 platforms. The sample is categorized as 'ransomware'. The sample was first seen in the wild on 2022-07-12.
The sample has been identified as being associated with the 'Haperlock' family of malware. The sample targets Win32 platforms. The sample is categorized as 'ransomware'. The sample was first seen in the wild on 2022-04-22.
The sample has been identified as being associated with the 'Ramnit' family of malware. The sample platform is Document. The sample is categorized as 'financial'. The sample was first seen in the wild on 2022-06-28.
The sample has been identified as being associated with the 'Shifu' family of malware. The sample targets Win32 platforms. The sample is categorized as 'retail'. The sample was first seen in the wild on 2022-02-02.
The sample has been identified as being associated with the 'TeslaCrypt' family of malware. The sample targets Win32 platforms. The sample is categorized as 'ransomware'. The sample was first seen in the wild on 2022-03-29.
The sample has been identified as being associated with the 'ZeGhost' family of malware. The sample targets Win32 platforms. The sample is categorized as 'apt'. The sample was first seen in the wild on 2022-08-29.
The sample has been identified as being associated with the 'Zeus' family of malware. The sample targets Win32 platforms. The sample is categorized as 'financial'. The sample was first seen in the wild on 2022-02-14.
This strike sends a malware sample known as Zeus. Zeus is a trojan that steals information such as banking credentials using methods such as key-logging and form-grabbing. The MD5 hash of this Zeus sample is 2da29c85052f458428e01873526fd980.
The sample has been identified as being associated with the 'Ramnit' family of malware. The sample platform is Document. The sample is categorized as 'financial'. The sample was first seen in the wild on 2022-08-04.
The sample has been identified as being associated with the 'Virlock' family of malware. The sample targets Win32 platforms. The sample is categorized as 'ransomware'. The sample was first seen in the wild on 2022-04-28.
The sample has been identified as being associated with the 'StopCrypt' family of malware. The sample targets Win32 platforms. The sample is categorized as 'ransomware'. The sample was first seen in the wild on 2022-06-15.
The sample has been identified as being associated with the 'ZeGhost' family of malware. The sample targets Win32 platforms. The sample is categorized as 'apt'. The sample was first seen in the wild on 2022-06-09.
CVSS: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
This strike exploits Movable Type 4.2x, 4.3x upgrade script to gain remote code execution on target server.
The sample has been identified as being associated with the 'Emotet' family of malware. The sample targets Win32 platforms. The sample is categorized as 'financial'. The sample was first seen in the wild on 2022-03-10.
The sample has been identified as being associated with the 'CosmicDuke' family of malware. The sample targets Win32 platforms. The sample is categorized as 'apt'. The sample was first seen in the wild on 2022-06-23.