Search

This CryptoWall ransomware can be downloaded from a supposedly Dropbox link found in a spammed message with voicemail. To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below. This Trojan arrive...

This malware is related to a spam run that displays a malicious link which leads to the download of KULUOZ malware. To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below. This Backdoor arriv...

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded from remote sites by other malware.

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It doe...

This Trojan arrives as an attachment to email messages mass-mailed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Ho...

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It connects to Internet Relay Chat (IRC) servers. It joins an Internet Relay Chat (IRC) channel. It perf...

Ever since Microsoft disabled running macros from Office files downloaded from the internet or email attachments, threat actors have been compelled to find new ways to spread malware. Such...

DISTTRACK, also known as Shamoon , is known for infecting the Master Boot Record (MBR) and overwriting files. Accordingly, once these files are overwritten, users cannot open or restore thir access. This malware family of worms propagate via network ...

DISTTRACK, also known as Shamoon , is known for infecting the Master Boot Record (MBR) and overwriting files. Accordingly, once these files are overwritten, users cannot open or restore thir access. This malware family of worms propagate via network ...

The spam emails contain a recent payment notification from different spoofed bank email addresses. The mail's body has a link that downloads a .doc file. This .doc file contains macros which need to b...

Recently, there has been a spike in incidents involving information-stealing malware, commonly known as info-stealers, which uses cloud sharing services to attack victims. Threat actors have been le...

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It encrypts files with specific file extensions. It encrypts files found in specific folders.

This Backdoor uses a user interface (UI).

This worm arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It gathe...

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It executes commands from a remote malicious user, effectively compromising the affected system.

Microsoft addresses several vulnerabilities in its June security bulletin. Trend Micro Deep Security covers the following: CVE-2020-1213 - VBScript Remote Code Execution Vulnerability Risk Rating: Criti...

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be executed using command-line and specific parameters. It sends ICMP PING requests to random IP addresses and scans for Port 4899 (Radmin Port) to check if those IP addresses have RADMIN service running. Once successful, it uses the following...