Search

This Trojan overwrites disk partitions, rendering the affected computer unusable and unrecoverable. To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below. This Trojan drops a component that ove...

GAFGYT, also known as BASHLITE, was first discovered in 2014. It is a Linux-based IoT botnet primarily targets any vulnerable IoT devices and uses the device to launch a large-scale distributed denial-of-service attacks. In previous iterations of the...

This threat is related to banking Trojans targeting South Korean banks that used Pinterest as their command and control (C&C) channel. To get a one-glance comprehensive view of the behavior of this Spyware, refer to the Threat Diagram shown below...

This is the first Android malware discovered to abuse the TOR network in order to conceal its connection to its C&C server. Users affected by this malware may find the security of their mobile devices compromised. To get a one-glance comprehe...

This Ransomware arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It disables antivirus services. This is done to allow this malware to...

The DUNIHI malware family is commonly obfuscated VBS malware which is capable of propagating via removable drive infection. DUNIHI may arrive as an attachment to spam. It may also arrive via removable drives or as a file dropped by other malware or d...

SIMBOT is a backdoor family that accesses certain remote servers in order to receive commands from a remote attacker. The following are the executed commands on the affected system: Download and executes files Execute a DOS command sent by the remote...

XTOB is a family of backdoors, which can communicate with command-and-control (C&C) servers to send and receive information and commands from malicious users. Variants can perform notable commands such as SYN flood and DDOS attacks, and opening conne...

Trickbot is a banking trojan used in attacks usually against small- and medium-sized businesses. It is designed to access online accounts, especially bank accounts, to obtain Personally Identifiable Information (PII). The obtained data is mostly used...

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It executes then deletes itself afterward. It is injected into all running processes to remain memory reside...

This information stealing malware arrives as spam spoofing an invoice or payment notification. If the user clicks the URL in the email, it executes a PowerShell command that downloads EMOTET. It then gathers information on the affected system and sen...

This malware is related to an active campaign that compromised Japanese websites and used these as C&C servers of EMDIVI Backdoor. To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below. T...

TEQUILA is bot malware which made headlines after targeting Mexico's financial institutions in 2010. The botnet particularly targeted the country's local Paypal site and the country's largest bank, Bancomer . This malware connects to a C&C server in ...

This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It does not have any backdoor routine. It gathers certain information on the affected computer. It uses...

This backdoor is implicated in the 2015 compromise of the German parliament, also known as Bundestag. This malware connects to a specific C&C server that we believe was controlled by Operation Pawn Storm during extended periods from Febru...

This backdoor is implicated in the 2015 compromise of the German parliament, also known as Bundestag. This malware connects to a specific C&C server that we believe was controlled by Operation Pawn Storm during extended periods from February ...

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. As of this writing, the said sites are inaccessible. It terminates itself if it detects it is being run in...

ZLOADER is a banking trojan also known as Terdot and Zbot . This malware is based on leaked code of known ZeuS malware. It uses web injects to steal user credentials and other private information from the victim. It can also steal passwords and cooki...

DRIDEX is a banking Trojan that was first seen in 2011 and is still in the wild up to this day. It was created from the source code of the BUGAT, also known as CRIDEX, banking Trojan. This malware arrives in a system as an email attachment or in some...

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.