Search

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It requires its main component to successfully perform its intended routine. However, as of this writing, ...

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It requires its main component to successfully perform its intended routine. However, as of this writing, ...

This Trojan may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It connects to certain websites to sen...

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It takes advantage of certain vulnerabilities.

This ransomware uses a free photo upload service as its C&C server. This way, it is able to mask its C&C routines. To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram show...

JACKPOS is another PoS (point-of-sale) malware which gathers credit cards information. JACKPOS may arrive via drive-by attacks and presents itself as a legit Java (TM) platform SE binary or Java updater to trick users from installing it. This malware...

This Trojan drops a component that overwrites disk partitions. It renders the computer unusable after reboot. It is also used by TROJ_DISTTRACK.C when reporting to its C&C server. This Trojan may be dropped by other malware.

The crypto-ransomware CTB (Curve-Tor-Bitcoin) Locker/Critroin surfaced in July 2014 . Apart from demanding for ransom and encrypting files, this ransomware uses Tor network to hide its C&C activities. This ransomware variant may arrive as an attachme...

This malware masquerades as popular apps like MMS, whatsapp, and Pokemon Go. It is capable of hijacking a phone and is capable of many actions including calling a number or sending an SMS indicated by an attacker, upload files into a C&C server, ...

This malware can be found in some malicious apps that used to be available on Google Play. The app targeted Arabic-speaking users in the Middle East. It is capable of cyberespionage techniques such as recording data, stealing information, sending in...

ANSERVER is the first known Android malware that reads blog posts and interprets these as commands. It can download and install additional applications, thus further compromising the infected device. It uses a third-party app store as its avenue for ...

This malware abuses the Apple enterprise certificates to install third-party apps into devices only when the iOS system is older than version 8.3. It is able to receive commands from C&C server. It is able to replace legitimate apps with malicious ap...

This Trojan overwrites disk partitions, rendering the affected computer unusable and unrecoverable. To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below. This Trojan drops a component that ove...

GAFGYT, also known as BASHLITE, was first discovered in 2014. It is a Linux-based IoT botnet primarily targets any vulnerable IoT devices and uses the device to launch a large-scale distributed denial-of-service attacks. In previous iterations of the...

This threat is related to banking Trojans targeting South Korean banks that used Pinterest as their command and control (C&C) channel. To get a one-glance comprehensive view of the behavior of this Spyware, refer to the Threat Diagram shown below...

This is the first Android malware discovered to abuse the TOR network in order to conceal its connection to its C&C server. Users affected by this malware may find the security of their mobile devices compromised. To get a one-glance comprehe...

The DUNIHI malware family is commonly obfuscated VBS malware which is capable of propagating via removable drive infection. DUNIHI may arrive as an attachment to spam. It may also arrive via removable drives or as a file dropped by other malware or d...

SIMBOT is a backdoor family that accesses certain remote servers in order to receive commands from a remote attacker. The following are the executed commands on the affected system: Download and executes files Execute a DOS command sent by the remote...

Trickbot is a banking trojan used in attacks usually against small- and medium-sized businesses. It is designed to access online accounts, especially bank accounts, to obtain Personally Identifiable Information (PII). The obtained data is mostly used...