‘Black Rose Lucy’ is Back, Now Pushing Ransomware
Researchers say incidents of mobile malware are becoming more common and growing more sophisticated. Continue reading ‘Black Rose Lucy’ is Back, Now Pushing Ransomware
Category Archives: Dropper
TrickBot Adds ActiveX Control, Hides Dropper in Images
The tricky trojan has evolved again, to stay a step ahead of defenders. Continue reading TrickBot Adds ActiveX Control, Hides Dropper in Images
Fin7 Cybergang Retools With New Malicious Code
A new dropper and payload show that Fin7 isn’t going anywhere despite a crackdown on the infamous group by law enforcement in 2018. Continue reading Fin7 Cybergang Retools With New Malicious Code
HQWar: the higher it flies, the harder it drops
Now one can say that only the lazy did not use Hqwar: Kaspersky’s collection of viruses features over 200,000 Trojans packed using Hqwar. Continue reading HQWar: the higher it flies, the harder it drops
Hello! My name is Dtrack
When we first discovered ATMDtrack, we thought we were just looking at another ATM malware family. Now we can add another family to the Lazarus group’s arsenal: ATMDtrack and Dtrack. Continue reading Hello! My name is Dtrack
Malicious App on Google Play Tallies 100 Million Downloads
Seemingly handy PDF and OCR app turns out to be a privacy horror show. Continue reading Malicious App on Google Play Tallies 100 Million Downloads
[SANS ISC] Simple Mimikatz & RDPWrapper Dropper
I published the following diary on isc.sans.edu: “Simple Mimikatz & RDPWrapper Dropper“: Let’s review a malware sample that I spotted a few days ago. I found it interesting because it’s not using deep techniques to infect its victims. The initial sample is a malicious VBScript. For a few weeks, I started
[The post [SANS ISC] Simple Mimikatz & RDPWrapper Dropper has been first published on /dev/random]
Continue reading [SANS ISC] Simple Mimikatz & RDPWrapper Dropper
Turla renews its arsenal with Topinambour
2019 has seen the Turla actor actively renew its arsenal. Its developers are still using a familiar coding style, but they’re creating new tools. Here we’ll tell you about several of them, namely “Topinambour” and its related modules. Continue reading Turla renews its arsenal with Topinambour
New FormBook Dropper Harbors Obfuscation, Persistence
Never-before-seen dropper found in FormBook samples that has increased persistence and obfuscation capabilities. Continue reading New FormBook Dropper Harbors Obfuscation, Persistence
Platinum is back
In June 2018, we came across an unusual set of samples spreading throughout South and Southeast Asian countries targeting diplomatic, government and military entities. Continue reading Platinum is back