Search

This information stealing malware arrives as spam spoofing an invoice or payment notification. If the user clicks the URL in the email, it executes a PowerShell command that downloads EMOTET. It then gathers information on the affected system and sen...

This malware is related to an active campaign that compromised Japanese websites and used these as C&C servers of EMDIVI Backdoor. To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below. T...

This backdoor is implicated in the 2015 compromise of the German parliament, also known as Bundestag. This malware connects to a specific C&C server that we believe was controlled by Operation Pawn Storm during extended periods from Febru...

This backdoor is implicated in the 2015 compromise of the German parliament, also known as Bundestag. This malware connects to a specific C&C server that we believe was controlled by Operation Pawn Storm during extended periods from February ...

ZLOADER is a banking trojan also known as Terdot and Zbot . This malware is based on leaked code of known ZeuS malware. It uses web injects to steal user credentials and other private information from the victim. It can also steal passwords and cooki...

DRIDEX is a banking Trojan that was first seen in 2011 and is still in the wild up to this day. It was created from the source code of the BUGAT, also known as CRIDEX, banking Trojan. This malware arrives in a system as an email attachment or in some...

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

This information stealing malware arrives as spam spoofing an invoice or payment notification. If the user clicks the URL in the email, it executes a PowerShell command that downloads EMOTET. It then gathers information on the affected system and sen...

This information stealing malware arrives as spam spoofing an invoice or payment notification. If the user clicks the URL in the email, it executes a PowerShell command that downloads EMOTET. It then gathers information on the affected system and sen...

This information stealing malware arrives as spam spoofing an invoice or payment notification. If the user clicks the URL in the email, it executes a PowerShell command that downloads EMOTET. It then gathers information on the affected system and sen...

This file infector hooks certain APIs so that when these APIs are called, the virus code is executed which then infects files. It does not infect files with certain characteristics. It returns execution to the host file's original code after executio...

Remcos or Remote Control and Surveillance, marketed as a legitimate software by a Germany-based firm Breaking Security for remotely managing Windows systems, is now widely used in multiple malicious campaigns by threat actors. Remcos is a sophisticat...

ICEDID, also known as BokBot, is a modular banking malware designed to steal financial information. It was first discovered around 2017 and observed in the wild downloaded as a second stage payload from EMOTET campaigns. It is capable of propagation ...

The AZORULT malware was first discovered in 2016 to be an information stealer that steals browsing history, cookies, ID/passwords, cryptocurrency information and more. It can also act as a downloader of other malware. It was sold on Russian undergrou...

The Predator malware first appeared in July 2018 and is used to steal usernames, passwords, browser data and the contents of cryptocurrency wallets, as well as take photos using the infected victim's webcam. The malware is commonly sold on undergroun...

QAKBOT, also known as QBOT, is a banking Trojan discovered in 2007. Its main purpose is to steal banking credentials and other financial information. It continuously evolves with variants having worm-like capabilities, able to drop additional malware...

BAZAR is a loader and backdoor. The loader gives the attacker its initial foothold in the environment, while the backdoor establishes persistence. Together they give the attacker a chance to drop another payload such as ransomware and exploits that c...

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

This spyware executes when a user accesses certain websites where it is hosted. It logs a user's keystrokes to steal information.