{ "authors": [ "Davide Arcuri", "Alexandre Dulaunoy", "Steffen Enders", "Andrea Garavaglia", "Andras Iklody", "Daniel Plohmann", "Christophe Vandeplas" ], "category": "tool", "description": "Malware galaxy cluster based on Malpedia.", "name": "Malpedia", "source": "Malpedia", "type": "malpedia", "uuid": "1d1c9af9-37fa-4deb-a928-f9b0abc7354a", "values": [ { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/aix.fastcash", "https://doubleagent.net/fastcash-for-linux/", "https://www.us-cert.gov/ncas/alerts/TA18-275A", "https://i.blackhat.com/USA-20/Wednesday/us-20-Perlow-FASTCash-And-INJX_Pure-How-Threat-Actors-Use-Public-Standards-For-Financial-Fraud.pdf", "https://i.blackhat.com/USA-20/Wednesday/us-20-Perlow-FASTCash-And-INJX_Pure-How-Threat-Actors-Use-Public-Standards-For-Financial-Fraud-wp.pdf", "https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/", "https://www.youtube.com/watch?v=zGvQPtejX9w", "https://i.blackhat.com/eu-20/Wednesday/eu-20-Rivera-From-Zero-To-Sixty-The-Story-Of-North-Koreas-Rapid-Ascent-To-Becoming-A-Global-Cyber-Superpower.pdf", "https://symantec-blogs.broadcom.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware", "https://www.cisa.gov/uscert/ncas/alerts/aa20-239a", "https://threatrecon.nshc.net/2019/01/23/sectora01-custom-proxy-utility-tool-analysis/", "https://www.cisa.gov/uscert/sites/default/files/publications/AA22-108A-TraderTraitor-North_Korea_APT_Targets_Blockchain_Companies.pdf", "https://www.symantec.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware", "https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf", "https://www.cisa.gov/uscert/ncas/alerts/TA18-275A", "https://www.youtube.com/watch?v=LUxOcpIRxmg", "https://blog.talosintelligence.com/2019/05/10-years-of-virtual-dynamite.html", "https://github.com/fboldewin/FastCashMalwareDissected/" ], "synonyms": [], "type": [] }, "uuid": "e8a04177-6a91-46a6-9f63-6a9fac4dfa02", "value": "FastCash" }, { "description": "According to ESET, this is a commercial, multiplatform RAT, originally developed for Windows and extended to Android. In short, it can steal and delete files from a device, take screenshots, get device location, phish Facebook credentials, get a list of installed apps, steal user photos, take photos, record surrounding audio and phone calls, make calls, steal SMS messages, steal the device\u2019s contact list, send text messages, etc.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.888_rat", "https://www.welivesecurity.com/2021/09/07/bladehawk-android-espionage-kurdish/" ], "synonyms": [], "type": [] }, "uuid": "e98ae895-0831-4e10-aad1-593d1c678db1", "value": "888 RAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.aberebot", "https://hothardware.com/news/escobar-banking-trojan-targets-mfa-codes", "https://blog.cyble.com/2021/07/30/aberebot-on-the-rise-new-banking-trojan-targeting-users-through-phishing/", "https://blog.cyble.com/2022/03/10/aberebot-returns-as-escobar/", "https://www.bleepingcomputer.com/news/security/android-malware-escobar-steals-your-google-authenticator-mfa-codes/", "https://twitter.com/_icebre4ker_/status/1460527428544176128", "https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord" ], "synonyms": [ "Escobar" ], "type": [] }, "uuid": "4b9c0228-2bfd-4bc7-bd64-8357a2da12ee", "value": "Aberebot" }, { "description": "According to PCrisk, AbstractEmu is the name of rooting malware that can gain privileged access to the Android operating system. Threat actors behind AbstractEmu are using legitimate-looking apps (like password managers, app launchers, data savers) to trick users into downloading and opening/executing this malware.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.abstract_emu", "https://www.sentinelone.com/labs/the-art-and-science-of-macos-malware-hunting-with-radare2-leveraging-xrefs-yara-and-zignatures/", "https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord", "https://blog.lookout.com/lookout-discovers-global-rooting-malware-campaign" ], "synonyms": [], "type": [] }, "uuid": "57a4c8c0-140a-45e3-9166-64e3e35c5986", "value": "AbstractEmu" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.actionspy", "https://about.fb.com/news/2021/03/taking-action-against-hackers-in-china/", "https://www.trendmicro.com/en_us/research/20/f/new-android-spyware-actionspy-revealed-via-phishing-attacks-from-earth-empusa.html", "https://blog.trendmicro.com/trendlabs-security-intelligence/new-android-spyware-actionspy-revealed-via-phishing-attacks-from-earth-empusa/" ], "synonyms": [ "AxeSpy" ], "type": [] }, "uuid": "5c7a35bf-e5f1-4b07-b93a-c3608cc9142e", "value": "ActionSpy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.adobot", "https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord", "https://twitter.com/LukasStefanko/status/1243198756981559296" ], "synonyms": [], "type": [] }, "uuid": "d95708e9-220a-428c-b126-a63986099892", "value": "AdoBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.adultswine", "https://research.checkpoint.com/malware-displaying-porn-ads-discovered-in-game-apps-on-google-play/" ], "synonyms": [], "type": [] }, "uuid": "824f284b-b38b-4a57-9e4a-aee4061a5b2d", "value": "AdultSwine" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.agentsmith", "https://research.checkpoint.com/2019/agent-smith-a-new-species-of-mobile-malware/" ], "synonyms": [], "type": [] }, "uuid": "34770e6e-e2c3-4e45-aa86-9d74b5309773", "value": "Agent Smith" }, { "description": "According to PCrisk, Ahmyth is a Remote Access Trojan (RAT) targeting Android users. It is distributed via trojanized (fake) applications. Ahmyth RAT steals cryptocurrency and banking credentials, 2FA codes, lock screen passcodes, and captures screenshots.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.ahmyth", "https://www.secrss.com/articles/24995", "https://mp.weixin.qq.com/s/J_A12SOX0k5TOYFAegBv_w", "https://www.welivesecurity.com/2019/08/22/first-spyware-android-ahmyth-google-play/", "https://deform.co/hacker-group-caracal-kitten-targets-kdp-activists-with-malware/", "https://securelist.com/transparent-tribe-part-2/98233/", "https://www.stratosphereips.org/blog/2020/11/10/android-mischief-rats-dataset" ], "synonyms": [], "type": [] }, "uuid": "86a5bb47-ac59-449a-8ff2-ae46e19cc6d2", "value": "AhMyth" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.albiriox", "https://www.cleafy.com/cleafy-labs/albiriox-rat-mobile-malware-targeting-global-finance-and-crypto-wallets" ], "synonyms": [], "type": [] }, "uuid": "29bc0acd-37b8-4882-843b-f7dc69d57061", "value": "Albiriox" }, { "description": "According to ThreatFabric, this is a fork of Cerberus v1 (active January 2020+). Alien is a rented banking trojan that can remotely control a phone and achieves RAT functionality by abusing TeamViewer.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.alien", "https://research.checkpoint.com/2021/clast82-a-new-dropper-on-google-play-dropping-the-alienbot-banker-and-mrat/", "https://www.checkpoint.com/press/2022/march-2022s-most-wanted-malware-easter-phishing-scams-help-emotet-assert-its-dominance/", "https://muha2xmad.github.io/malware-analysis/alien/", "https://resecurity.com/blog/article/in-the-box-mobile-malware-webinjects-marketplace", "https://www.bleepingcomputer.com/news/security/google-predator-spyware-infected-android-devices-using-zero-days/", "https://www.prodaft.com/m/reports/BrunHilda_DaaS.pdf", "https://www.threatfabric.com/blogs/alien_the_story_of_cerberus_demise.html", "https://twitter.com/_CPResearch_/status/1603375823448317953", "https://info.phishlabs.com/blog/alien-mobile-malware-evades-detection-increases-targets", "https://drive.google.com/file/d/1qd7Nqjhe2vyGZ5bGm6gVw0mM1D6YDolu/view?usp=sharing", "https://preyproject.com/blog/en/cerberus-and-alien-the-malware-that-has-put-android-in-a-tight-spot/", "https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html" ], "synonyms": [ "AlienBot" ], "type": [] }, "uuid": "de483b10-4247-46b3-8ab5-77d089f0145c", "value": "Alien" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.amextroll", "https://www.threatfabric.com/blogs/brata-a-tale-of-three-families", "https://www.threatfabric.com/blogs/brata-a-tale-of-three-families.html" ], "synonyms": [], "type": [] }, "uuid": "6b153952-9415-4710-8175-354b59252dbc", "value": "AmexTroll" }, { "description": "This malware was initially named BlackRock and later renamed to AmpleBot.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.amplebot", "https://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html", "https://www.threatfabric.com/blogs/blackrock_the_trojan_that_wanted_to_get_them_all.html", "https://www.threatfabric.com/blogs/alien_the_story_of_cerberus_demise.html" ], "synonyms": [ "BlackRock" ], "type": [] }, "uuid": "2f3f82f6-ec21-489e-8257-0967c567798a", "value": "AmpleBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.anatsa", "https://www.cleafy.com/cleafy-labs/a-stealthy-threat-uncovered-teabot-on-google-play-store", "https://labs.bitdefender.com/2021/06/threat-actors-use-mockups-of-popular-apps-to-spread-teabot-and-flubot-malware-on-android/", "https://www.cleafy.com/cleafy-labs/teabot-is-now-spreading-across-the-globe", "https://www.cleafy.com/documents/teabot", "https://twitter.com/_icebre4ker_/status/1416409813467156482", "https://www.zscaler.com/blogs/security-research/android-document-readers-and-deception-tracking-latest-updates-anatsa", "https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html", "https://blog.nviso.eu/2021/05/11/android-overlay-attacks-on-belgian-financial-applications/", "https://www.buguroo.com/hubfs/website/pdf/reports/buguroo-malware-report-Toddler_EN.pdf", "https://www.prodaft.com/m/reports/Toddler___TLPWHITE_V2.pdf", "https://labs.k7computing.com/index.php/play-store-app-serves-teabot-via-github/", "https://thehackernews.com/2022/01/widespread-flubot-and-teabot-malware.html", "https://twitter.com/ThreatFabric/status/1394958795508523008", "https://www.threatfabric.com/blogs/anatsa-hits-uk-and-dach-with-new-campaign", "https://www.threatfabric.com/blogs/smishing-campaign-in-nl-spreading-cabassous-and-anatsa.html", "https://gbhackers.com/teabot-banking-trojan/", "https://www.telekom.com/en/blog/group/article/flubot-under-the-microscope-636368", "https://www.cleafy.com/cleafy-labs/teabot", "https://www.threatfabric.com/blogs/anatsa-trojan-returns-targeting-europe-and-expanding-its-reach", "https://www.bitdefender.com/blog/labs/new-flubot-and-teabot-global-malware-campaigns-discovered", "https://labs.k7computing.com/?p=22407" ], "synonyms": [ "ReBot", "TeaBot", "Toddler" ], "type": [] }, "uuid": "147081b9-7e59-4613-ad55-bbc08141fee1", "value": "Anatsa" }, { "description": "Androrat is a remote administration tool developed in Java Android for the client side and in Java/Swing for the Server. The name Androrat is a mix of Android and RAT (Remote Access Tool). It has been developed in a team of 4 for a university project. The goal of the application is to give the control of the android system remotely and retrieve informations from it.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.androrat", "https://www.kaspersky.com/blog/mobile-malware-part-4/24290/", "https://www.stratosphereips.org/blog/2021/5/6/dissecting-a-rat-analysis-of-the-command-line-androrat", "https://github.com/DesignativeDave/androrat", "https://www.bitdefender.com/files/News/CaseStudies/study/352/Bitdefender-PR-Whitepaper-BitterAPT-creat4571-en-EN-GenericUse.pdf", "https://cocomelonc.github.io/book/2025/05/19/aiya-mmd-book.html", "https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html", "https://hotforsecurity.bitdefender.com/blog/possibly-italy-born-android-rat-reported-in-china-find-bitdefender-researchers-16264.html", "https://mp.weixin.qq.com/s/AhxP5HmROtMsFBiUxj0cFg", "https://blog.trendmicro.com/trendlabs-security-intelligence/the-urpage-connection-to-bahamut-confucius-and-patchwork/", "https://www.stratosphereips.org/blog/2021/3/29/dissecting-a-rat-analysis-of-the-androrat", "https://www.stratosphereips.org/blog/2020/11/10/android-mischief-rats-dataset" ], "synonyms": [], "type": [] }, "uuid": "80447111-8085-40a4-a052-420926091ac6", "value": "AndroRAT" }, { "description": "According to Google, a Chrome cookie stealer.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.androsnatch", "https://blog.google/threat-analysis-group/state-backed-attackers-and-commercial-surveillance-vendors-repeatedly-use-the-same-exploits/" ], "synonyms": [], "type": [] }, "uuid": "8cd795ed-3a4d-41a3-abb1-0c3dd3aa4eab", "value": "ANDROSNATCH" }, { "description": "The malware displays fake Google Play update pages in multiple languages, including German, French, Spanish, Russian, Portuguese, Romanian, and English, indicating potential targets in these regions.\r\n\r\nAntidot uses overlay attacks and keylogging techniques to efficiently collect sensitive information such as login credentials. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.antidot", "https://catalyst.prodaft.com/public/report/antidot/overview", "https://medium.com/@mvaks/two-tales-and-one-antidot-e-a-new-mobile-malware-campaign-in-poland-de704997096f", "https://cyble.com/blog/new-antidot-android-banking-trojan-masquerading-as-google-play-updates/" ], "synonyms": [], "type": [] }, "uuid": "c1f3e4c7-ab9d-4cde-b5df-cbd256c0bd8e", "value": "Antidot" }, { "description": "BleepingComputer found that Anubis will display fake phishing login forms when users open up apps for targeted platforms to steal credentials. This overlay screen will be shown over the real app's login screen to make victims think it's a legitimate login form when in reality, inputted credentials are sent to the attackers.\r\n\r\nIn the new version spotted by Lookout, Anubis now targets 394 apps and has the following capabilities:\r\n\r\nRecording screen activity and sound from the microphone\r\nImplementing a SOCKS5 proxy for covert communication and package delivery\r\nCapturing screenshots\r\nSending mass SMS messages from the device to specified recipients\r\nRetrieving contacts stored on the device\r\nSending, reading, deleting, and blocking notifications for SMS messages received by the device\r\nScanning the device for files of interest to exfiltrate\r\nLocking the device screen and displaying a persistent ransom note\r\nSubmitting USSD code requests to query bank balances\r\nCapturing GPS data and pedometer statistics\r\nImplementing a keylogger to steal credentials\r\nMonitoring active apps to mimic and perform overlay attacks\r\nStopping malicious functionality and removing the malware from the device", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.anubis", "https://0x1c3n.tech/anubis-android-malware-analysis", "https://sysopfb.github.io/malware,/reverse-engineering/2018/08/30/Unpacking-Anubis-APK.html", "http://blog.koodous.com/2017/04/decrypting-bankbot-communications.html", "https://securityaffairs.co/wordpress/133115/hacking/anubis-networks-new-c2.html", "https://www.fortinet.com/blog/threat-research/bankbot-the-prequel.html", "https://www.youtube.com/watch?v=U0UsfO-0uJM", "https://pentest.blog/n-ways-to-unpack-mobile-malware/", "https://www.threatfabric.com/blogs/the-rage-of-android-banking-trojans.html", "https://www.fortinet.com/blog/threat-research/a-look-into-the-new-strain-of-bankbot.html", "https://labs.bitdefender.com/2020/03/android-apps-and-malware-capitalize-on-coronavirus", "https://assets.virustotal.com/reports/2021trends.pdf", "https://cocomelonc.github.io/book/2025/05/19/aiya-mmd-book.html", "https://securelist.com/mobile-malware-evolution-2019/96280/", "https://securityboulevard.com/2018/09/android-malware-intercepts-sms-2fa-we-have-the-logs/ ", "https://blog.trendmicro.com/trendlabs-security-intelligence/google-play-apps-drop-anubis-banking-malware-use-motion-based-evasion-tactics/", "http://b0n1.blogspot.de/2017/05/tracking-android-bankbot.html", "https://community.riskiq.com/article/85b3db8c", "https://securityboulevard.com/2018/09/android-malware-intercepts-sms-2fa-we-have-the-logs/", "https://info.phishlabs.com/blog/new-variant-bankbot-banking-trojan-aubis", "https://www.welivesecurity.com/2017/11/21/new-campaigns-spread-banking-malware-google-play/", "https://n1ght-w0lf.github.io/malware%20analysis/anubis-banking-malware/", "https://muha2xmad.github.io/malware-analysis/anubis/", "https://eybisi.run/Mobile-Malware-Analysis-Tricks-used-in-Anubis/", "https://intel-honey.medium.com/reversing-anubis-malware-93f28d154bbb", "https://bushidotoken.blogspot.com/2020/05/turkey-targeted-by-cerberus-and-anubis.html", "https://securityintelligence.com/after-big-takedown-efforts-20-more-bankbot-mobile-malware-apps-make-it-into-google-play/", "https://intel471.com/blog/china-cybercrime-undergrond-deepmix-tea-horse-road-great-firewall/", "https://www.threatfabric.com/blogs/2020_year_of_the_rat.html", "http://blog.koodous.com/2017/05/bankbot-on-google-play.html" ], "synonyms": [ "BankBot", "android.bankbot", "android.bankspy" ], "type": [] }, "uuid": "85975621-5126-40cb-8083-55cbfa75121b", "value": "Anubis (Android)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.anubisspy", "http://blog.trendmicro.com/trendlabs-security-intelligence/cyberespionage-campaign-sphinx-goes-mobile-anubisspy/", "https://documents.trendmicro.com/assets/tech-brief-cyberespionage-campaign-sphinx-goes-mobile-with-anubisspy.pdf" ], "synonyms": [], "type": [] }, "uuid": "06ffb614-33ca-4b04-bf3b-623e68754184", "value": "AnubisSpy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.asacub", "https://securelist.com/mobile-malware-evolution-2019/96280/", "https://securelist.com/the-rise-of-mobile-banker-asacub/87591/" ], "synonyms": [], "type": [] }, "uuid": "dffa06ec-e94f-4fd7-8578-2a98aace5473", "value": "Asacub" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.ashas", "https://www.welivesecurity.com/2019/10/24/tracking-down-developer-android-adware/" ], "synonyms": [], "type": [] }, "uuid": "aabcfbb6-6385-486d-a30b-e3a2edcf493d", "value": "Ashas" }, { "description": "According to Lukas Stefanko, this is an open-source crypto-ransomware found on Github in 2018.\r\nIT can en/decrypt files (AES, key: 32 random chars, sent to C&C), uses email as contact point but will remove all files after 24 hours or after a reboot.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.atank", "https://twitter.com/LukasStefanko/status/1268070798293708800" ], "synonyms": [], "type": [] }, "uuid": "231f9f49-6752-49af-9ee0-7774578fcbe4", "value": "ATANK" }, { "description": "According to EnigmaSoft, AxBanker is a banking Trojan targeting Android devices specifically. The threatening tool has been deployed as part of large attack campaigns against users in India. The threat actors use smishing (SMS phishing) techniques to smuggle the malware threat onto the victims' devices. The fake applications carrying AxBanker are designed to visually impersonate the official applications of popular Indian banking organizations. The weaponized applications use fake promises or rewards and discounts as additional lures.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.axbanker", "https://www.trendmicro.com/en_vn/research/22/k/massive-phishing-campaigns-target-india-banks-clients.html#:~:text=We%20found%20five%20banking%20malware,card%20information%20via%20phishing%20campaigns.&text=We%20observed%20an%20uptick%20in,message%20with%20a%20phishing%20link.", "https://blog.polyswarm.io/phishing-and-android-malware-campaign-targets-indian-banks" ], "synonyms": [], "type": [] }, "uuid": "4a854e8c-d6ad-4997-8931-b27e39b7f7fa", "value": "AxBanker" }, { "description": "BadBazaar is a type of malware primarily functioning as a spyware. Designed to compromise Android and iOS devices, it is often distributed through malicious apps downloaded from unofficial app stores, third-party websites, Telegram channels, and social engineering. Once installed, BadBazaar seeks to surveil the victim by intercepting SMS messages, performing screen recordings, and logging keystrokes on the device. Additionally, it can execute remote commands and download and install other malicious applications, further compromising the security of the affected device.\r\n\r\n", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.badbazaar", "https://www.lookout.com/threat-intelligence/article/badbazaar-surveillanceware-apt15", "https://www.ncsc.gov.uk/news/ncsc-partners-share-guidance-for-communities-at-high-risk-of-digital-surveillance", "https://www.ncsc.gov.uk/files/NCSC-Advisory-BADBAZAAR-and-MOONSHINE-guidance.pdf", "https://www.ncsc.gov.uk/files/NCSC-Advisory-BADBAZAAR-and-MOONSHINE-technical-analysis-and-mitigations.pdf" ], "synonyms": [], "type": [] }, "uuid": "80b30290-40d3-4ce3-a878-2e0af4b107d8", "value": "badbazaar" }, { "description": "According to BitSight, BADBOX is a large-scale cybercriminal operation selling off-brand Android TV boxes, smartphones, and other Android electronics with preinstalled malware.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.badbox", "https://www.badbox2serviceofprocess.com/", "https://xdaforums.com/t/owner-of-an-android-tv-box-may-want-to-check-if-its-an-active-botnet-member.4519567/", "https://github.com/DesktopECHO/T95-H616-Malware", "https://www.bleepingcomputer.com/news/security/badbox-malware-botnet-infects-192-000-android-devices-despite-disruption/", "https://krebsonsecurity.com/2026/01/who-operates-the-badbox-2-0-botnet/", "https://www.bitsight.com/blog/badbox-botnet-back", "https://www.bleepingcomputer.com/news/security/android-tv-box-on-amazon-came-pre-installed-with-malware/", "https://www.ic3.gov/PSA/2025/PSA250605#fn2", "https://www.bleepingcomputer.com/news/security/germany-blocks-badbox-malware-loaded-on-30-000-android-devices/", "https://www.humansecurity.com/learn/blog/satori-threat-intelligence-disruption-badbox-2-0/", "https://censys.com/unpacking-the-badbox-botnet/", "https://www.qurium.org/forensics/finding-popa/" ], "synonyms": [], "type": [] }, "uuid": "b7a96690-4547-43a2-98e9-91cc56affbe4", "value": "BADBOX" }, { "description": "remote access tool (RAT) payload on Android devices", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.badcall", "https://www.us-cert.gov/ncas/analysis-reports/ar19-252a" ], "synonyms": [], "type": [] }, "uuid": "5eec00de-5d81-4907-817d-f99cb33d9b66", "value": "BADCALL (Android)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.badpatch", "https://www.welivesecurity.com/2020/07/14/welcome-chat-secure-messaging-app-nothing-further-truth/" ], "synonyms": [ "WelcomeChat" ], "type": [] }, "uuid": "9b96e274-1602-48a4-8e0d-9f756d4e835b", "value": "BadPatch" }, { "description": "According to PCrisk, Bahamut is the name of Android malware with spyware functionality. Threat actors use Bahamut to steal sensitive information. The newest malware version targets various messaging apps and personally identifiable information.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.bahamut", "https://blog.cyble.com/2022/06/29/bahamut-android-malware-returns-with-new-spying-capabilities/", "https://www.trendmicro.com/en_us/research/18/h/the-urpage-connection-to-bahamut-confucius-and-patchwork.html", "https://www.welivesecurity.com/2022/11/23/bahamut-cybermercenary-group-targets-android-users-fake-vpn-apps/", "https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf", "https://www.bellingcat.com/resources/case-studies/2017/10/27/bahamut-revisited-cyber-espionage-middle-east-south-asia/", "https://mp.weixin.qq.com/s/YAAybJBAvxqrQWYDg31BBw", "https://www.bellingcat.com/news/mena/2017/06/12/bahamut-pursuing-cyber-espionage-actor-middle-east/", "https://blog.trendmicro.com/trendlabs-security-intelligence/the-urpage-connection-to-bahamut-confucius-and-patchwork/" ], "synonyms": [], "type": [] }, "uuid": "4038c3bc-b559-45bb-bac1-9665a54dedf9", "value": "Bahamut (Android)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.basbanke", "https://seguranca-informatica.pt/hackers-are-again-attacking-portuguese-banking-organizations-via-android-trojan-banker/#.YHTDZS2tEUE", "https://securelist.com/basbanke-trend-setting-brazilian-banking-trojan/90365/", "https://twitter.com/LukasStefanko/status/1280243673100402690" ], "synonyms": [], "type": [] }, "uuid": "c59b65d6-d363-4b19-b082-d72508e782c0", "value": "Basbanke" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.bianlian", "https://cryptax.medium.com/multidex-trick-to-unpack-android-bianlian-ed52eb791e56", "https://cryptax.medium.com/quick-look-into-a-new-sample-of-android-bianlian-bc5619efa726", "https://cryptax.medium.com/bad-zip-and-new-packer-for-android-bianlian-5bdad4b90aeb", "https://www.youtube.com/watch?v=DPFcvSy4OZk", "https://www.fortinet.com/blog/threat-research/new-wave-bianlian-malware.html", "https://cryptax.medium.com/creating-a-safe-dummy-c-c-to-test-android-bots-ffa6e7a3dce5", "https://www.threatfabric.com/blogs/bianlian_from_rags_to_riches_the_malware_dropper_that_had_a_dream.html", "https://cryptax.medium.com/android-bianlian-payload-61febabed00a", "https://cryptax.medium.com/bianlian-c-c-domain-name-4f226a29e221" ], "synonyms": [ "Hydra" ], "type": [] }, "uuid": "1faaa5c5-ab4e-4101-b2d9-0e12207d70fc", "value": "BianLian (Android)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.bingomod", "https://www.cleafy.com/cleafy-labs/bingomod-the-new-android-rat-that-steals-money-and-wipes-data" ], "synonyms": [], "type": [] }, "uuid": "2778f61a-48e4-4585-8eff-983d5a4fd6ac", "value": "BingoMod" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.blankbot", "https://intel471.com/blog/blankbot-a-new-android-banking-trojan-with-screen-recording-keylogging-and-remote-control-capabilities" ], "synonyms": [], "type": [] }, "uuid": "c4a42580-bc5e-4185-adfd-cc6ade9b8424", "value": "BlankBot" }, { "description": "According to Lookout, BoneSpy is based on the Russian-developed, open-source DroidWatcher surveillanceware, featuring nearly identical code, names, and log messages in multiple classes related to the handling of databases containing collected exfil data such as call logs, location tracking, SMS messages, notifications, and browser bookmarks. Class names for many entry points (receivers, activities, and services) were either the same or very similar to DroidWatcher samples.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.bone_spy", "https://www.lookout.com/threat-intelligence/article/gamaredon-russian-android-surveillanceware" ], "synonyms": [], "type": [] }, "uuid": "54723362-0b25-4e84-b5ff-5e50083b0b52", "value": "BoneSpy" }, { "description": "According to PCrisk, BraDex is a banking malware targeting Android operating systems. This malicious program aims to gain access to victims' bank accounts and make fraudulent transactions.\r\n\r\nAt the time of writing, BrasDex targets Brazilian banking applications exclusively. In previous BrasDex campaigns, it infiltrated devices under the guise of Android system related apps. Lately, this malware has been installed by a fake Brazilian Banco Santander banking application.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.brasdex", "https://www.threatfabric.com/blogs/brasdex-a-new-brazilian-ats-malware.html" ], "synonyms": [], "type": [] }, "uuid": "dc5408e9-e9e8-44fd-ac5c-231483d0ebe3", "value": "BrasDex" }, { "description": "According to Cleafy, the victim's Android device is factory reset after the attackers siphon money from the victim's bank account. This distracts users from the crime, while removing traces or footprints that might be of interest to forensic analysts.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.brata", "https://securelist.com/spying-android-rat-from-brazil-brata/92775/", "https://www.advintel.io/post/economic-growth-digital-inclusion-specialized-crime-financial-cyber-fraud-in-latam", "https://www.threatfabric.com/blogs/brata-a-tale-of-three-families.html", "https://www.cleafy.com/cleafy-labs/how-brata-is-monitoring-your-bank-account", "https://www.threatfabric.com/blogs/toad-fraud", "https://www.cleafy.com/cleafy-labs/brata-is-evolving-into-an-advanced-persistent-threat", "https://www.cleafy.com/cleafy-labs/mobile-banking-fraud-brata-strikes-again" ], "synonyms": [ "AmexTroll", "Copybara" ], "type": [] }, "uuid": "d9ff080d-cde0-48da-89db-53435c99446b", "value": "BRATA" }, { "description": "PRODAFT describes Brunhilda as a \"Dropper as a Service\" for Google Play, delivering e.g. Alien.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.brunhilda", "https://www.threatfabric.com/blogs/the-attack-of-the-droppers.html", "https://www.cleafy.com/cleafy-labs/the-android-malwares-journey-from-google-play-to-banking-fraud", "https://blog.fox-it.com/2024/03/28/android-malware-vultur-expands-its-wingspan", "https://www.prodaft.com/m/reports/BrunHilda_DaaS.pdf" ], "synonyms": [], "type": [] }, "uuid": "5d3d5f52-0a55-4c81-af87-7809ce43906b", "value": "Brunhilda" }, { "description": "According to Cyble, this is an advanced Android malware evolved from SpySolr that features remote control, credential theft, and data exfiltration. It spreads via phishing sites impersonating streaming services like iNat TV and fake mining platforms. The malware abuses Android\u2019s Accessibility Service to unlock devices, log keystrokes, and automate credential theft through injections. It uses WebSocket-based C&C communication for real-time command execution and data theft. BTMOB RAT supports various malicious actions, including live screen sharing, file management, audio recording, and web injections.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.btmob", "https://any.run/malware-trends/btmob/", "https://cyble.com/blog/btmob-rat-newly-discovered-android-malware/" ], "synonyms": [], "type": [] }, "uuid": "3d244016-fa66-45ac-8f96-7ae7d158e931", "value": "BTMOB RAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.busygasper", "https://securelist.com/busygasper-the-unfriendly-spy/87627/" ], "synonyms": [], "type": [] }, "uuid": "4bf68bf8-08e5-46f3-ade5-0bd4f124b168", "value": "BusyGasper" }, { "description": "According to PCrisk, CapraRAT is the name of an Android remote access trojan (RAT), possibly a modified version of another (open-source) RAT called AndroRAT. It is known that CapraRAT is used by an advanced persistent threat group (ATP) called APT36 (also known as Earth Karkaddan). CapraRAT allows attackers to perform certain actions on the infected Android device.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.capra_rat", "https://www.welivesecurity.com/2023/03/07/love-scam-espionage-transparent-tribe-lures-indian-pakistani-officials/", "https://www.sentinelone.com/labs/capratube-transparent-tribes-caprarat-mimics-youtube-to-hijack-android-phones/", "https://www.trendmicro.com/en_us/research/22/a/investigating-apt36-or-earth-karkaddans-attack-chain-and-malware.html" ], "synonyms": [], "type": [] }, "uuid": "7cd1c5f3-7635-46d2-87f1-e638fb8d714c", "value": "CapraRAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.carbonsteal", "https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf" ], "synonyms": [], "type": [] }, "uuid": "56090c0b-2b9b-4624-8eff-ef6d3632fd2b", "value": "CarbonSteal" }, { "description": "Catelites Bot (identified by Avast and SfyLabs in December 2017) is an Android trojan, with ties to CronBot. Once the malicious app is installed, attackers use social engineering tricks and window overlays to get credit card details from the victim.\r\nThe distribution vector seems to be fake apps from third-party app stores (not Google Play) or via malvertisement. After installation and activation, the app creates fake Gmail, Google Play and Chrome icons. Furthermore, the malware sends a fake system notification, telling the victim that they need to re-authenticate with Google Services and ask for their credit card details to be entered.\r\nCurrently the malware has overlays for over 2,200 apps of banks and financial institutions.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.catelites", "https://www.youtube.com/watch?v=1LOy0ZyjEOk", "https://blog.avast.com/new-version-of-mobile-malware-catelites-possibly-linked-to-cron-cyber-gang" ], "synonyms": [], "type": [] }, "uuid": "2c672b27-bc65-48ba-ba3d-6318473e78b6", "value": "Catelites" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.cecbot", "https://github.com/deepfield/public-research/blob/main/cecbot/report.md" ], "synonyms": [], "type": [] }, "uuid": "02b3b02e-92f7-4551-8582-e7e69fa8e830", "value": "CECbot" }, { "description": "According to PCrisk, Cerberus is an Android banking Trojan which can be rented on hacker forums. It was been created in 2019 and is used to steal sensitive, confidential information. Cerberus can also be used to send commands to users' devices and perform dangerous actions.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.cerberus", "https://labs.bitdefender.com/2020/09/apps-on-google-play-tainted-with-cerberus-banker-malware/", "https://cyberint.com/blog/research/cerberus-is-dead-long-live-cerberus/", "https://blog.cyberint.com/cerberus-is-dead-long-live-cerberus", "https://www.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revealing-threat-in-the-shadow-by-chi-en-shen-ashley-oleg-bondarenko", "https://securelist.com/the-state-of-stalkerware-in-2021/106193/", "https://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html", "https://github.com/ics-iot-bootcamp/cerberus_research", "https://go.recordedfuture.com/hubfs/reports/cta-2020-1016.pdf", "https://preyproject.com/blog/en/cerberus-and-alien-the-malware-that-has-put-android-in-a-tight-spot/", "https://community.riskiq.com/article/85b3db8c", "https://nur.pub/cerberus-analysis", "https://resecurity.com/blog/article/in-the-box-mobile-malware-webinjects-marketplace", "https://www.threatfabric.com/blogs/alien_the_story_of_cerberus_demise.html", "https://twitter.com/AndroidCerberus", "https://insights.oem.avira.com/in-depth-analysis-of-a-cerberus-trojan-variant/", "https://www.biznet.com.tr/wp-content/uploads/2020/08/Cerberus.pdf", "https://www.threatfabric.com/blogs/cerberus-a-new-banking-trojan-from-the-underworld.html", "https://bushidotoken.blogspot.com/2020/05/turkey-targeted-by-cerberus-and-anubis.html", "https://www.forbes.com/sites/zakdoffman/2019/08/16/dangerous-new-android-trojan-hides-from-malware-researchers-and-taunts-them-on-twitter/", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/04/12075509/EN_The-State-of-Stalkerware-2021.pdf", "https://www.threatfabric.com/blogs/2020_year_of_the_rat.html" ], "synonyms": [], "type": [] }, "uuid": "c3a2448f-bb41-4201-b524-3ddcb02ddbf4", "value": "Cerberus" }, { "description": "The malware chamaleon is an Android trojan that pretends to be legitimate entities to steal data from users in Australia and Poland. It exploits the Accessibility Service to monitor and modify the device screen.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.chameleon", "https://www.threatfabric.com/blogs/chameleon-is-now-targeting-employees-masquerading-as-crm-app", "https://www.threatfabric.com/blogs/android-banking-trojan-chameleon-is-back-in-action", "https://blog.cyble.com/2023/04/13/chameleon-a-new-android-malware-spotted-in-the-wild/" ], "synonyms": [], "type": [] }, "uuid": "90b3a256-311d-416b-b333-e02b910ba75d", "value": "Chameleon" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.chamois", "https://www.virusbulletin.com/virusbulletin/2019/01/vb2018-paper-unpacking-packed-unpacker-reversing-android-anti-analysis-native-library/", "https://android-developers.googleblog.com/2017/03/detecting-and-eliminating-chamois-fraud.html", "https://github.com/maddiestone/ConPresentations/blob/master/KasperskySAS2019.Chamois.pdf" ], "synonyms": [], "type": [] }, "uuid": "2e230ff8-3971-4168-a966-176316cbdbf2", "value": "Chamois" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.charger", "http://blog.joesecurity.org/2017/01/deep-analysis-of-android-ransom-charger.html", "http://blog.checkpoint.com/2017/01/24/charger-malware/", "https://www.welivesecurity.com/wp-content/uploads/2019/02/ESET_Android_Banking_Malware.pdf", "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-recap-january-14-29-2017" ], "synonyms": [], "type": [] }, "uuid": "6e0545df-8df6-4990-971c-e96c4c60d561", "value": "Charger" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.chinotto", "https://blog.cyble.com/2021/12/06/apt37-using-a-new-android-spyware-chinotto/", "https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/" ], "synonyms": [], "type": [] }, "uuid": "6cc7b402-21cf-4510-be7d-d7f811a57bc1", "value": "Chinotto (Android)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.chrysaor", "https://citizenlab.ca/2021/07/amnesty-peer-review/", "https://forbiddenstories.org/pegasus-the-new-global-weapon-for-silencing-journalists/", "https://media.ccc.de/v/33c3-7901-pegasus_internals", "https://cybergeeks.tech/a-technical-analysis-of-pegasus-for-android-part-3/", "https://www.amnesty.org/en/latest/news/2021/07/the-pegasus-project/", "https://lifars.com/2022/01/forensics-analysis-of-the-nso-groups-pegasus-spyware/", "https://www.washingtonpost.com/investigations/interactive/2021/nso-spyware-pegasus-cellphones/", "https://www.washingtonpost.com/technology/2021/07/18/reactions-pegasus-project-nso/", "https://www.bleepingcomputer.com/news/security/google-predator-spyware-infected-android-devices-using-zero-days/", "https://www.theguardian.com/news/series/pegasus-project", "https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html", "https://forbiddenstories.org/the-pegasus-project-a-worldwide-collaboration-to-counter-a-global-crime/", "https://cybergeeks.tech/a-technical-analysis-of-pegasus-for-android-part-1", "https://www.washingtonpost.com/world/2021/07/19/india-nso-pegasus/", "https://citizenlab.ca/2021/11/palestinian-human-rights-defenders-hacked-nso-groups-pegasus-spyware/", "https://forbiddenstories.org/about-the-pegasus-project/", "https://www.washingtonpost.com/technology/2021/07/19/apple-iphone-nso/", "https://android-developers.googleblog.com/2017/04/an-investigation-of-chrysaor-malware-on.html", "https://thewire.in/tag/pegasus-project", "https://security.googleblog.com/2017/04/an-investigation-of-chrysaor-malware-on.html", "https://blog.zecops.com/research/the-recent-ios-0-click-cve-2021-30860-sounds-familiar-an-unreleased-write-up-one-year-later/", "https://twitter.com/HackSysTeam/status/1418223814387765258?s=20", "https://citizenlab.ca/2021/08/bahrain-hacks-activists-with-nso-group-zero-click-iphone-exploits/", "https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html", "https://www.vice.com/en/article/xgx5bw/amazon-aws-shuts-down-nso-group-infrastructure", "https://citizenlab.ca/2022/04/peace-through-pegasus-jordanian-human-rights-defenders-and-journalists-hacked-with-pegasus-spyware/", "https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/", "https://citizenlab.ca/2018/09/hide-and-seek-tracking-nso-groups-pegasus-spyware-to-operations-in-45-countries/", "https://irpimedia.irpi.eu/sorveglianze-cy4gate/", "https://twitter.com/alexanderjaeger/status/1417447732030189569", "https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-android-technical-analysis.pdf", "https://thewire.in/government/project-pegasus-journalists-ministers-activists-phones-spying", "https://github.com/AmnestyTech/investigations/tree/master/2021-07-18_nso", "https://unit42.paloaltonetworks.com/strategically-aged-domain-detection/", "https://www.lemonde.fr/projet-pegasus/article/2021/07/18/au-maroc-comme-en-france-des-journalistes-mis-sous-surveillance-avec-le-logiciel-pegasus_6088654_6088648.html", "https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/", "https://www.theguardian.com/world/2021/jul/18/nso-spyware-used-to-target-family-of-jamal-khashoggi-leaked-data-shows-saudis-pegasus", "https://www.cybertrends.it/pegasus-lo-spyware-per-smartphone-come-funziona-e-come-ci-si-puo-proteggere/", "https://thewire.in/rights/sar-geelani-pegasus-spyware-phone-messages", "https://thewire.in/government/indian-army-bsf-raw-pegasus-spyware-threat", "https://www.reuters.com/technology/how-saudi-womans-iphone-revealed-hacking-around-world-2022-02-17/", "https://www.washingtonpost.com/investigations/2021/07/18/takeaways-nso-pegasus-project/", "https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf", "https://therecord.media/mexican-army-spyware", "https://zetter.substack.com/p/pegasus-spyware-how-it-works-and", "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/", "https://www.theguardian.com/news/2021/jul/18/viktor-orban-using-nso-spyware-in-assault-on-media-data-suggests", "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-appendix-d/", "https://threatpost.com/nso-pegasus-spyware-bans-apple-accountability/167965/", "https://citizenlab.ca/2020/01/stopping-the-press-new-york-times-journalist-targeted-by-saudi-linked-pegasus-spyware-operator/", "https://thewire.in/media/pegasus-project-spyware-indian-journalists", "https://cybergeeks.tech/a-technical-analysis-of-pegasus-for-android-part-2/", "https://www.iverify.io/post/clipping-wings-our-analysis-of-a-pegasus-spyware-sample", "https://objective-see.com/blog/blog_0x67.html", "https://nex.sx/blog/2021/08/03/the-pegasus-project.html", "https://www.bleepingcomputer.com/news/security/iphones-running-latest-ios-hacked-to-deploy-nso-group-spyware/", "https://citizenlab.ca/2021/10/breaking-news-new-york-times-journalist-ben-hubbard-pegasus/", "https://arkadiyt.com/2021/07/25/scanning-your-iphone-for-nso-group-pegasus-malware/", "https://www.theguardian.com/news/2021/jul/18/revealed-murdered-journalist-number-selected-mexico-nso-client-cecilio-pineda-birto", "https://www.theguardian.com/world/2021/jul/18/revealed-leak-uncovers-global-abuse-of-cyber-surveillance-weapon-nso-group-pegasus", "https://twitter.com/billmarczak/status/1416801439402262529", "https://citizenlab.ca/2022/04/catalangate-extensive-mercenary-spyware-operation-against-catalans-using-pegasus-candiru/", "https://www.trendmicro.com/en_us/research/21/i/analyzing-pegasus-spywares-zero-click-iphone-exploit-forcedentry.html", "https://www.washingtonpost.com/investigations/interactive/2021/jamal-khashoggi-wife-fiancee-cellphone-hack/?itid=co_pegasus_5", "https://www.cyjax.com/2021/10/26/mercenary-apts-an-exploration/" ], "synonyms": [ "JigglyPuff", "Pegasus" ], "type": [] }, "uuid": "52acea22-7d88-433c-99e6-8fef1657e3ad", "value": "Chrysaor" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.clientor", "https://twitter.com/LukasStefanko/status/1042297855602503681" ], "synonyms": [], "type": [] }, "uuid": "c0a48ca3-682d-45bc-805c-e62aecd4c724", "value": "Clientor" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.clipper", "https://web.archive.org/web/20201107225915/https://lukasstefanko.com/2019/02/android-clipper-found-on-google-play.html", "https://www.welivesecurity.com/2019/02/08/first-clipper-malware-google-play/", "https://news.drweb.com/show?lng=en&i=12739", "https://lukasstefanko.com/2019/02/android-clipper-found-on-google-play.html" ], "synonyms": [], "type": [] }, "uuid": "ff9b47c6-a5b5-4531-abfc-2e4db3dcdc7e", "value": "Clipper" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.cloudatlas", "https://web.archive.org/web/20160710180729/https://www.bluecoat.com/security-blog/2014-12-09/blue-coat-exposes-%E2%80%9C-inception-framework%E2%80%9D-very-sophisticated-layered-malware" ], "synonyms": [], "type": [] }, "uuid": "ed780667-b67c-4e17-ab43-db1b7e018e66", "value": "CloudAtlas" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.comet_bot", "https://twitter.com/LukasStefanko/status/1102937833071935491" ], "synonyms": [], "type": [] }, "uuid": "151bf399-aa8f-4160-b9b5-8fe222f2a6b1", "value": "CometBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.connic", "https://www.welivesecurity.com/2017/12/11/banking-malware-targets-polish-banks/" ], "synonyms": [ "SpyBanker" ], "type": [] }, "uuid": "93b1c63a-4a34-44fd-805b-0a3470ff7e6a", "value": "Connic" }, { "description": "Coper is an Android banking trojan and RAT descended from ExobotCompact, itself a rewrite of Exobot. It uses a modular architecture, a multi-stage infection chain and (in some variants) a DGA. First observed in Colombia, it has since spread to Europe.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.coper", "https://twitter.com/_icebre4ker_/status/1541875982684094465", "https://www.threatfabric.com/blogs/octo2-european-banks-already-under-attack-by-new-malware-variant", "https://thehackernews.com/2022/04/new-octo-banking-trojan-spreading-via.html", "https://blog.cyble.com/2022/03/24/coper-banking-trojan/", "https://threatfabric.com/blogs/octo-new-odf-banking-trojan.html", "https://www.intrinsec.com/prospero-proton66-tracing-uncovering-the-links-between-bulletproof-networks/", "https://cert.pl/posts/2021/12/aktywacja-aplikacji-iko/", "https://cert-agid.gov.it/news/analisi-e-approfondimenti-tecnici-sul-malware-coper-utilizzato-per-attaccare-dispositivi-mobili/", "https://labs.k7computing.com/index.php/play-store-app-serves-coper-via-github/", "https://www.bleepingcomputer.com/news/security/new-android-banking-malware-remotely-takes-control-of-your-device/", "https://www.domaintools.com/resources/blog/uncovering-octo2-domains/", "https://x.com/cleafylabs/status/1833145006585987374", "https://info.spamhaus.com/hubfs/Botnet%20Reports/Jul-Dec%202024%20Botnet%20Threat%20Update.pdf", "https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-january-to-june-2025/", "https://resecurity.com/blog/article/in-the-box-mobile-malware-webinjects-marketplace", "https://www.intrinsec.com/wp-content/uploads/2024/11/TLP-CLEAR-PROSPERO-Proton66-Uncovering-the-links-between-bulletproof-networks.pdf", "https://www.team-cymru.com/post/coper-octo-a-conductor-for-mobile-mayhem-with-eight-limbs", "https://www.trendmicro.com/en_us/research/22/g/examining-new-dawdropper-banking-dropper-and-daas-on-the-dark-we.html", "https://info.spamhaus.com/hubfs/Botnet%20Reports/Jan-Jun%202024%20Botnet%20Threat%20Update.pdf", "https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-july-to-december-2025/", "https://labs.k7computing.com/index.php/android-banking-trojan-octov2-masquerading-as-deepseek-ai/", "https://www.virusbulletin.com/conference/vb2024/abstracts/octopus-prime-didnt-turn-truck-widely-spread-android-botnet/", "https://news.drweb.com/show/?p=0&lng=en&i=14259&c=0" ], "synonyms": [ "ExobotCompact", "Octo" ], "type": [] }, "uuid": "70973ef7-e031-468f-9420-d8aa4eb7543a", "value": "Coper" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.copybara", "https://www.threatfabric.com/blogs/brata-a-tale-of-three-families", "https://www.threatfabric.com/blogs/brata-a-tale-of-three-families.html", "https://www.cleafy.com/cleafy-labs/on-device-fraud-on-the-rise-exposing-a-recent-copybara-fraud-campaign", "https://www.threatfabric.com/blogs/toad-fraud", "https://www.zscaler.com/blogs/security-research/technical-analysis-copybara" ], "synonyms": [], "type": [] }, "uuid": "e3d07fda-d29d-42e4-a0d6-5827b2d14d17", "value": "Copybara" }, { "description": "Poses as an app that can offer a \"corona safety mask\" but phone's address book and sends sms to contacts, spreading its own download link.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.corona_worm", "https://dissectingmalwa.re/jamba-superdeal-helo-sir-you-want-to-buy-mask-corona-safety-mask-sms-scam.html", "https://www.zscaler.com/blogs/research/new-android-app-offers-coronavirus-safety-mask-delivers-sms-trojan" ], "synonyms": [], "type": [] }, "uuid": "f041032e-01af-4e66-9fb2-f8da88a6ea35", "value": "Coronavirus Android Worm" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.cpuminer", "https://blog.trendmicro.com/trendlabs-security-intelligence/coin-miner-mobile-malware-returns-hits-google-play/" ], "synonyms": [], "type": [] }, "uuid": "8a42a699-1746-498b-a558-e7113bb916c0", "value": "Cpuminer (Android)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.craxs_rat", "https://www.group-ib.com/blog/craxs-rat-malware/", "https://cocomelonc.github.io/book/2025/05/19/aiya-mmd-book.html", "https://cloud.google.com/blog/topics/threat-intelligence/russian-espionage-influence-ukrainian-military-recruits-anti-mobilization-narratives?hl=en", "https://cloud.google.com/blog/topics/threat-intelligence/russian-espionage-influence-ukrainian-military-recruits-anti-mobilization-narratives" ], "synonyms": [], "type": [] }, "uuid": "1f7a8a57-f3e2-4e4b-a4d7-8eb0ba9243c5", "value": "CraxsRAT" }, { "description": "According to ThreatFabric, this malware offers remote control, black screen overlays, and advanced data harvesting via accessibility logging.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.crocodilus", "https://www.threatfabric.com/blogs/exposing-crocodilus-new-device-takeover-malware-targeting-android-devices", "https://www.threatfabric.com/blogs/crocodilus-mobile-malware-evolving-fast-going-global", "https://shindan.io/blog/crocodilus-a-deep-dive-into-its-structure-and-capabilities", "https://medium.com/@mvaks/bombardino-crocodilo-in-poland-analysis-of-iko-lokaty-mobile-malware-campaign-502bd74947f3", "https://medium.com/@mvaks/crocodilus-in-the-wild-mapping-the-campaign-in-poland-15d3078eb954" ], "synonyms": [], "type": [] }, "uuid": "a2b69930-86ad-47ab-a8a1-1601f30b7f0d", "value": "Crocodilus" }, { "description": "According to NHS Digital, CryCryptor is distributed via websites that spoof health organisations. At the time of publication these websites have affected the Canadian health service. CryCryptor cannot be obtained from the Google Play store, so devices restricted to only running apps from the store are not affected.\r\n\r\nWhen CryCryptor is run it encrypts common file types and saves a ransom note to every directory where files have been encrypted. Encrypted files have the extension '.enc' appended to the filenames. Additional files are saved containing the salt values used in each encryption and an initialisation vector. These files have the extensions '.enc.salt' and '.enc.iv' respectively.\r\n\r\nWhen files have been encrypted, a notification is displayed directing users to open the ransom note.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.crycryptor", "https://www.welivesecurity.com/2020/06/24/new-ransomware-uses-covid19-tracing-guise-target-canada-eset-decryptor/" ], "synonyms": [ "CryCrypter", "CryDroid" ], "type": [] }, "uuid": "21e9d7e6-6e8c-49e4-8869-6bac249cda8a", "value": "CryCryptor" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.cyber_azov", "https://twitter.com/sekoia_io/status/1554086468104196096", "https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag", "https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag/" ], "synonyms": [], "type": [] }, "uuid": "bb1821f9-eace-4e63-b55d-fc7821a6e5f1", "value": "CyberAzov" }, { "description": "According to PCrisk, DAAM is an Android malware utilized to gain unauthorized access to targeted devices since 2021. With the DAAM Android botnet, threat actors can bind harmful code with a genuine application using its APK binding service.\r\n\r\nLookout refers to this malware as BouldSpy and assesses with medium confidence that this Android surveillance tool is used by the Law Enforcement Command of the Islamic Republic of Iran (FARAJA).", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.daam", "https://www.lookout.com/blog/iranian-spyware-bouldspy", "https://blog.cyble.com/2023/04/20/daam-android-botnet-being-distributed-through-trojanized-applications/" ], "synonyms": [ "BouldSpy" ], "type": [] }, "uuid": "37a3b62e-99da-47d7-81fb-78f745427b16", "value": "DAAM" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.darkshades", "https://twitter.com/LukasStefanko/status/1252163657036976129" ], "synonyms": [ "Rogue" ], "type": [] }, "uuid": "97fe35c9-f50c-495f-8736-0ecd95c70192", "value": "Dark Shades" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.dawdropper", "https://www.trendmicro.com/en_us/research/22/g/examining-new-dawdropper-banking-dropper-and-daas-on-the-dark-we.html" ], "synonyms": [], "type": [] }, "uuid": "bd9756da-220d-48d6-a4f5-6646558c4b30", "value": "DawDropper" }, { "description": "According to Lookout, DCHSpy is an Android surveillanceware tool leveraged by Iranian cyber espionage group MuddyWater. DCHSpy collects WhatsApp data, accounts, contacts, SMS, files, location, and call logs, and can record audio and take photos.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.dchspy", "https://shindan.io/blog/dhcspy-discovering-the-iranian-apt-muddywater", "https://www.lookout.com/threat-intelligence/article/lookout-discovers-iranian-dchsy-surveillanceware" ], "synonyms": [], "type": [] }, "uuid": "d70da110-3e0d-475d-8dd2-d8614f07a3ae", "value": "DCHSpy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.defensor_id", "https://www.welivesecurity.com/2020/05/22/insidious-android-malware-gives-up-all-malicious-features-but-one-gain-stealth/", "https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf" ], "synonyms": [ "Defensor Digital" ], "type": [] }, "uuid": "76346e4d-d14e-467b-9409-82b28a4d6cd6", "value": "DEFENSOR ID" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.dendroid", "https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=a29d7d7a-f150-46cf-9bb9-a1f9f4d32a80&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments", "https://cocomelonc.github.io/book/2025/05/19/aiya-mmd-book.html" ], "synonyms": [], "type": [] }, "uuid": "89989df2-e8bc-4074-a8a2-130a15d6625f", "value": "Dendroid" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.dmsspy", "https://blog.trendmicro.com/trendlabs-security-intelligence/operation-poisoned-news-hong-kong-users-targeted-with-mobile-malware-via-local-news-links/", "https://securelist.com/ios-exploit-chain-deploys-lightspy-malware/96407/", "https://documents.trendmicro.com/assets/Tech-Brief-Operation-Poisoned-News-Hong-Kong-Users-Targeted-with-Mobile-Malware-via-Local-News-Links.pdf" ], "synonyms": [], "type": [] }, "uuid": "72a25832-4bf4-4505-a77d-8c0fc52dc85d", "value": "dmsSpy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.doubleagent", "https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf" ], "synonyms": [], "type": [] }, "uuid": "73fd1bda-e4aa-4777-a628-07580bc070f4", "value": "DoubleAgent" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.doublelocker", "https://www.welivesecurity.com/2017/10/13/doublelocker-innovative-android-malware/" ], "synonyms": [], "type": [] }, "uuid": "10d0115a-00b4-414e-972b-8320a2bb873c", "value": "DoubleLocker" }, { "description": "Android malware that impersonates genuine applications such as Signal, Telegram, WhatsApp, YouTube, and other chat applications and distributes through phishing sites.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.dracarys", "https://blog.cyble.com/2022/08/09/bitter-apt-group-using-dracarys-android-spyware/" ], "synonyms": [], "type": [] }, "uuid": "bf94eee6-2274-40f4-b181-2b49ce6ef9fb", "value": "Dracarys" }, { "description": "Android variant of ios.LightSpy.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.dragonegg", "https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack", "https://www.lookout.com/threat-intelligence/article/wyrmspy-dragonegg-surveillanceware-apt41" ], "synonyms": [ "LightSpy" ], "type": [] }, "uuid": "4ef28f14-17f4-4f87-a292-e63b42027c8c", "value": "DragonEgg" }, { "description": "According to Cleafy, DroidBot is a modern RAT that combines hidden VNC and overlay attack techniques with spyware-like capabilities, such as keylogging and user interface monitoring. Moreover, it leverages dual-channel communication, transmitting outbound data through MQTT and receiving inbound commands via HTTPS, providing enhanced operation flexibility and resilience.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.droidbot", "https://www.cleafy.com/cleafy-labs/droidbot-insights-from-a-new-turkish-maas-fraud-operation" ], "synonyms": [], "type": [] }, "uuid": "1e0562cd-981a-4b81-b813-9a59fff6fb71", "value": "DroidBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.droidjack", "https://www.stratosphereips.org/blog/2021/1/22/analysis-of-droidjack-v44-rat-network-traffic" ], "synonyms": [], "type": [] }, "uuid": "8990cec7-ddd8-435e-97d6-5b36778e86fe", "value": "DroidJack" }, { "description": "According to Zimperium, DroidLock has the ability to lock device screens with a ransomware-like overlay and illegally acquire app lock credentials, leading to a total takeover of the compromised device.\r\n\r\nIt employs deceptive system update screens to trick victims and can stream and remotely control devices via VNC. The malware also exploits device administrator privileges to lock or erase data, capture the victim's image with the front camera, and silence the device. Overall, it utilizes 15 distinct commands to interact with its C2 panel.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.droidlock", "https://zimperium.com/blog/total-takeover-droidlock-hijacks-your-device" ], "synonyms": [], "type": [] }, "uuid": "2f3b54fe-6a17-4584-a6bb-ebcdb755624d", "value": "DroidLock" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.droidwatcher", "https://documents.trendmicro.com/assets/white_papers/wp-void-balaur-tracking-a-cybermercenarys-activities.pdf", "https://www.lookout.com/threat-intelligence/article/gamaredon-russian-android-surveillanceware" ], "synonyms": [], "type": [] }, "uuid": "15f3e50b-9fa5-4eab-ac2b-928e9ce03b72", "value": "DroidWatcher" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.dualtoy", "http://researchcenter.paloaltonetworks.com/2016/09/dualtoy-new-windows-trojan-sideloads-risky-apps-to-android-and-ios-devices/" ], "synonyms": [], "type": [] }, "uuid": "8269e779-db23-4c94-aafb-36ee94879417", "value": "DualToy (Android)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.dvmap", "https://securelist.com/mobile-malware-evolution-2019/96280/", "https://securelist.com/dvmap-the-first-android-malware-with-code-injection/78648/" ], "synonyms": [], "type": [] }, "uuid": "e5de818e-d25d-47a8-ab31-55fc992bf91b", "value": "Dvmap" }, { "description": "According to Lookout, EagleMsgSpy is a lawful intercept surveillance tool developed by a Chinese software development company with use by public security bureaus in mainland China. Early samples indicate the surveillance tool has been operational since at least 2017, with development continued into late 2024. EagleMsgSpy collects extensive data from the user: third-party chat messages, screen recording and screenshot capture, audio recordings, call logs, device contacts, SMS messages, location data, network activity. \r\nThrough infrastructure overlap and artifacts from open command and control directories, Lookout attributes EagleMsgSpy to Wuhan Chinasoft Token Information Technology Co., Ltd. with high confidence.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.eagle_msg_spy", "https://www.lookout.com/threat-intelligence/article/eaglemsgspy-chinese-android-surveillanceware" ], "synonyms": [], "type": [] }, "uuid": "1b53d17e-ab9c-4b9f-8c01-588bccac4dee", "value": "EagleMsgSpy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.elibomi", "https://blog.cyble.com/2021/09/07/fake-income-tax-application-targets-indian-taxpayers/", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/phishing-android-malware-targets-taxpayers-in-india/", "https://www.trendmicro.com/en_vn/research/22/k/massive-phishing-campaigns-target-india-banks-clients.html#:~:text=We%20found%20five%20banking%20malware,card%20information%20via%20phishing%20campaigns.&text=We%20observed%20an%20uptick%20in,message%20with%20a%20phishing%20link." ], "synonyms": [ "Drinik" ], "type": [] }, "uuid": "63cc0b01-c92e-40e7-8669-48d10a490ffb", "value": "Elibomi" }, { "description": "According to Intel471, ERMAC, an Android banking trojan enables bad actors to determine when certain apps are launched and then overwrites the screen display to steal the user's credentials", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.ermac", "https://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html", "https://twitter.com/ESETresearch/status/1445618031464357888", "https://www.linkedin.com/posts/threatmon_rising-threat-ermac-variant-activity-7305193522180071426-J8c5", "https://resecurity.com/blog/article/in-the-box-mobile-malware-webinjects-marketplace", "https://intel471.com/blog/rmac-2-0-perfecting-the-art-of-account-takeover", "https://hunt.io/blog/ermac-v3-banking-trojan-source-code-leak", "https://research.nccgroup.com/2023/09/11/from-ermac-to-hook-investigating-the-technical-differences-between-two-android-malware-variants/", "https://twitter.com/ShilpeshTrivedi/status/1709096404835356883", "https://blog.cyble.com/2022/05/25/ermac-back-in-action/", "https://www.threatfabric.com/blogs/zombinder-ermac-and-desktop-stealers.html" ], "synonyms": [], "type": [] }, "uuid": "602944f4-a86c-4a05-b98f-cfb525fb8896", "value": "ERMAC" }, { "description": "ErrorFather is an Android banking trojan with a multi-stage dropper. The final payload is derived from the Cerberus source code leak.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.errorfather", "https://cyble.com/blog/hidden-in-plain-sight-errorfathers-deadly-deployment-of-cerberus/" ], "synonyms": [], "type": [] }, "uuid": "2c7f6a97-4469-4f97-9a69-5549282a94a6", "value": "ErrorFather" }, { "description": "According to ThreatFabric, the app overlays 15 financial targets from UK, Italy, and Spain, sniffs 234 apps from banks located in Europe as well as crypto wallets.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.eventbot", "https://www.cybereason.com/blog/eventbot-a-new-mobile-banking-trojan-is-born", "https://twitter.com/ThreatFabric/status/1240664876558823424", "https://www.youtube.com/watch?v=qqwOrLR2rgU" ], "synonyms": [], "type": [] }, "uuid": "5a6fb8cd-d582-4c8c-b7e0-a5b4cf4f248f", "value": "Eventbot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.exobot", "https://www.bleepingcomputer.com/news/security/exobot-author-calls-it-quits-and-sells-off-banking-trojan-source-code/", "https://blog.cyble.com/2022/03/24/coper-banking-trojan/", "https://www.bleepingcomputer.com/news/security/source-code-for-exobot-android-banking-trojan-leaked-online/", "https://www.bleepingcomputer.com/news/security/new-android-banking-malware-remotely-takes-control-of-your-device/", "https://threatfabric.com/blogs/octo-new-odf-banking-trojan.html", "https://www.bleepingcomputer.com/news/security/new-exo-android-trojan-sold-on-hacking-forums-dark-web/", "https://securityintelligence.com/ibm-x-force-delves-into-exobots-leaked-source-code/" ], "synonyms": [], "type": [] }, "uuid": "c9f2b058-6c22-462a-a20a-fca933a597dd", "value": "ExoBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.exodus", "https://motherboard.vice.com/en_us/article/eveeq4/prosecutors-investigation-esurv-exodus-malware-on-google-play-store", "https://motherboard.vice.com/en_us/article/43z93g/hackers-hid-android-malware-in-google-play-store-exodus-esurv", "https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf", "https://securitywithoutborders.org/blog/2019/03/29/exodus.html" ], "synonyms": [], "type": [] }, "uuid": "462bc006-b7bd-4e10-afdb-52baf86121e8", "value": "Exodus" }, { "description": "Facebook Credential Stealer.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.facestealer", "https://www.trendmicro.com/en_us/research/22/e/fake-mobile-apps-steal-facebook-credentials--crypto-related-keys.html", "https://labs.k7computing.com/index.php/facestealer-the-rise-of-facebook-credential-stealer-malware/", "https://threatpost.com/facestealer-trojan-google-play-facebook/179015/", "https://blogs.quickheal.com/stay-alert-of-facebook-credential-stealer-applications-stealing-users-credentials/" ], "synonyms": [], "type": [] }, "uuid": "c35ebd96-d2f8-4add-b86f-f552ed5dfa9b", "value": "FaceStealer" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.fakeadblocker", "https://www.welivesecurity.com/2021/07/20/url-shortener-services-android-malware-banking-sms-trojans/" ], "synonyms": [], "type": [] }, "uuid": "d0ae2b6b-5137-4b64-be3e-4bbc9aa007a6", "value": "FakeAdBlocker" }, { "description": "According to Kaspersky, Fakecalls is a Trojan that masquerades as a banking app and imitates phone conversations with bank employees.\r\n\r\n", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.fakecalls", "https://research.checkpoint.com/2023/south-korean-android-banking-menace-fakecalls/", "https://www.kaspersky.com.au/blog/fakecalls-banking-trojan/30379/" ], "synonyms": [], "type": [] }, "uuid": "014aeab6-2292-4ee5-83d6-fffb0fc21423", "value": "Fakecalls" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.fakedefend", "https://www.fortiguard.com/encyclopedia/virus/5543975/android-fakedefend-c-tr" ], "synonyms": [], "type": [] }, "uuid": "8ea1fc8c-ec66-4d39-b32a-da69d3277da4", "value": "FakeDefend" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.fakespy", "https://blog.trendmicro.com/trendlabs-security-intelligence/a-look-into-the-connection-between-xloader-and-fakespy-and-their-possible-ties-with-the-yanbian-gang/", "https://www.trendmicro.com/en_us/research/18/k/a-look-into-the-connection-between-xloader-and-fakespy-and-their-possible-ties-with-the-yanbian-gang.html", "https://medium.com/csis-techblog/the-roamingmantis-groups-expansion-to-european-apple-accounts-and-android-devices-e6381723c681", "https://blog.trendmicro.com/trendlabs-security-intelligence/fakespy-android-information-stealing-malware-targets-japanese-and-korean-speaking-users/", "https://www.trendmicro.com/en_us/research/18/f/fakespy-android-information-stealing-malware-targets-japanese-and-korean-speaking-users.html" ], "synonyms": [], "type": [] }, "uuid": "dd821edd-901b-4a5e-b35f-35bb811964ab", "value": "FakeSpy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.faketgram", "https://blog.talosintelligence.com/2018/11/persian-stalker.html", "https://cocomelonc.github.io/book/2025/05/19/aiya-mmd-book.html" ], "synonyms": [ "FakeTGram" ], "type": [] }, "uuid": "6c0fc7e4-4629-494f-b471-f7a8cc47c0e0", "value": "FakeGram" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.fastfire", "https://medium.com/s2wblog/unveil-the-evolution-of-kimsuky-targeting-android-devices-with-newly-discovered-mobile-malware-280dae5a650f" ], "synonyms": [], "type": [] }, "uuid": "5613da3a-06f5-4363-b468-0b8a03ffc292", "value": "FastFire" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.fastspy", "https://medium.com/s2wblog/unveil-the-evolution-of-kimsuky-targeting-android-devices-with-newly-discovered-mobile-malware-280dae5a650f" ], "synonyms": [], "type": [] }, "uuid": "a5e3e217-3790-4d7c-b67a-906b9ee69034", "value": "FastSpy" }, { "description": "According to heimdal, A new strain of ransomware emerged on Android mobile devices. It targets those who are running the operating system Android 5.1 and higher. This Android ransomware strain has been dubbed by security researchers FileCoder (Android/Filecoder.c) and it spreads via text messages containing a malicious link.\r\n", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.filecoder", "https://www.welivesecurity.com/2019/07/29/android-ransomware-back/" ], "synonyms": [], "type": [] }, "uuid": "09ff3520-b643-44bd-a0de-90c0e75ba12f", "value": "FileCoder" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.finfisher", "https://securelist.com/finspy-unseen-findings/104322/", "https://securelist.com/new-finspy-ios-and-android-implants-revealed-itw/91685/", "https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/", "https://github.com/linuzifer/FinSpy-Dokumentation", "https://netzpolitik.org/2020/our-criminal-complaint-german-state-malware-company-finfisher-raided/", "https://raw.githubusercontent.com/DefensiveLabAgency/FinSpy-for-Android/master/20200806_finspy_android_analysis_public_release.pdf" ], "synonyms": [], "type": [] }, "uuid": "0bf7acd4-6493-4126-9598-d2ed069e32eb", "value": "FinFisher (Android)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.flexispy", "https://mobisec.reyammer.io/slides", "https://www.randhome.io/blog/2017/04/23/lets-talk-about-flexispy/" ], "synonyms": [], "type": [] }, "uuid": "4305d59a-0d07-4021-a902-e7996378898b", "value": "FlexiSpy (Android)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.flexnet", "https://securelist.com/mobile-malware-evolution-2019/96280/", "https://twitter.com/LukasStefanko/status/886849558143279104" ], "synonyms": [ "gugi" ], "type": [] }, "uuid": "80d7d229-b3a7-4205-8304-f7b18bda129f", "value": "FlexNet" }, { "description": "PRODAFT describes FluBot as a banking malware which originally targeted Spain. Since the first quarter of 2021 it has been targeting many other European countries as well as Japan. It uses a DGA for it's C&C and relies on both DNS and DNS-over-HTTPS for name resolution. Despite arrests of multiple people suspected of involvement with this malware in March of 2021, the campaign has only intensified since.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.flubot", "https://www.checkpoint.com/press/2022/march-2022s-most-wanted-malware-easter-phishing-scams-help-emotet-assert-its-dominance/", "https://blog.zimperium.com/flubot-vs-zimperium/", "https://www.europol.europa.eu/media-press/newsroom/news/takedown-of-sms-based-flubot-spyware-infecting-android-phones", "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf", "https://medium.com/csis-techblog/the-brief-glory-of-cabassous-flubot-a-private-android-banking-botnet-bc2ed7917027", "https://labs.bitdefender.com/2021/06/threat-actors-use-mockups-of-popular-apps-to-spread-teabot-and-flubot-malware-on-android/", "https://twitter.com/alberto__segura/status/1395675479194095618", "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://hispasec.com/resources/FedexBanker.pdf", "https://www.nortonlifelock.com/blogs/research-group/flubot-targets-android-phone-users", "https://www.proofpoint.com/us/blog/threat-insight/flubot-android-malware-spreading-rapidly-through-europe-may-hit-us-soon", "https://www.threatfabric.com/blogs/partners-in-crime-medusa-cabassous.html", "https://blog.nviso.eu/2021/04/19/how-to-analyze-mobile-malware-a-cabassous-flubot-case-study/", "https://securityblog.switch.ch/2021/06/19/android-flubot-enters-switzerland/", "https://medium.com/walmartglobaltech/a-look-at-an-android-bot-from-unpacking-to-dga-e331554f9fb9", "https://twitter.com/alberto__segura/status/1384840011892285440", "https://therecord.media/flubot-malware-gang-arrested-in-barcelona/", "https://raw.githubusercontent.com/prodaft/malware-ioc/master/FluBot/FluBot.pdf", "https://twitter.com/alberto__segura/status/1399249798063087621?s=20", "https://www.prodaft.com/m/reports/FluBot_4.pdf", "https://securityintelligence.com/posts/story-of-fakechat-malware/", "https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf", "https://info.spamhaus.com/hubfs/Botnet%20Reports/Jul-Dec%202024%20Botnet%20Threat%20Update.pdf", "https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-january-to-june-2025/", "https://www.ncsc.admin.ch/22w12-de", "https://cryptax.medium.com/android-flubot-preparing-for-a-new-campaign-2f7563fc6c06", "https://blog.fox-it.com/2022/06/29/flubot-the-evolution-of-a-notorious-android-banking-malware/", "https://www.f5.com/labs/articles/threat-intelligence/flubots-authors-employ-creative-and-sophisticated-techniques-to-achieve-their-goals-in-version-50-and-beyond", "https://twitter.com/malwrhunterteam/status/1359939300238983172", "https://info.spamhaus.com/hubfs/Botnet%20Reports/Jan-Jun%202024%20Botnet%20Threat%20Update.pdf", "https://thehackernews.com/2022/01/widespread-flubot-and-teabot-malware.html", "https://info.spamhaus.com/hubfs/Botnet%20Reports/Q4%202023%20Botnet%20Threat%20Update.pdf", "https://www.bitsight.com/blog/flubot-malware-persists-most-prevalent-germany-and-spain", "https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-july-to-december-2025/", "https://news.netcraft.com/archives/2021/08/17/resurgent-flubot-malware-targets-german-and-polish-banks.html", "https://www.cert.govt.nz/individuals/news-and-events/parcel-delivery-text-message-infecting-android-phones/", "https://twitter.com/alberto__segura/status/1404098461440659459", "https://mobile.twitter.com/alberto__segura/status/1400396365759500289", "https://blog.cyble.com/2021/09/09/flubot-variant-masquerading-as-the-default-android-voicemail-app/", "https://twitter.com/alberto__segura/status/1402615237296148483", "https://www.infinitumit.com.tr/flubot-zararlisi/", "https://www.telekom.com/en/blog/group/article/flubot-under-the-microscope-636368", "https://www.bitdefender.com/blog/labs/new-flubot-and-teabot-global-malware-campaigns-discovered", "https://therecord.media/despite-arrests-in-spain-flubot-operations-explode-across-europe-and-japan/", "https://news.netcraft.com/archives/2021/08/04/flubot-malware-spreads-to-australia.html" ], "synonyms": [ "Cabassous", "FakeChat" ], "type": [] }, "uuid": "ef91833f-3334-4955-9218-f106494e9fc0", "value": "FluBot" }, { "description": "According to Check Point, this malware features several malicious Android applications that mimic legitimate applications, most of which have more than 1,000,000 installs. These malicious apps steal the victims\u2019 credentials and Two-Factor Authentication (2FA) codes. FluHorse targets different sectors of Eastern Asian markets and is distributed via emails. In some cases, the emails used in the first stage of the attacks belong to high-profile entities. The malware can remain undetected for months making it a persistent, dangerous, and hard-to-spot threat.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.fluhorse", "https://www.fortinet.com/blog/threat-research/fortinet-reverses-flutter-based-android-malware-fluhorse", "https://research.checkpoint.com/2023/eastern-asian-android-assault-fluhorse/", "https://cryptax.medium.com/inside-kangapack-the-kangaroo-packer-with-native-decryption-3e7e054679c4" ], "synonyms": [], "type": [] }, "uuid": "aeaeb8b2-650e-471d-a901-3c4fbae42854", "value": "FluHorse" }, { "description": "Zimperium notes that this malware has hit more than 10,000 victims in 140+ countries using social media hijacking, 3rd party app stores and sideloading. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.flytrap", "https://blog.zimperium.com/flytrap-android-malware-compromises-thousands-of-facebook-accounts/" ], "synonyms": [], "type": [] }, "uuid": "24af5bcc-d4bd-42dd-aed4-f994b30b4921", "value": "FlyTrap" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.funkybot", "https://medium.com/csis-techblog/the-roamingmantis-groups-expansion-to-european-apple-accounts-and-android-devices-e6381723c681", "https://securelist.com/roaming-mantis-part-v/96250/", "https://www.fortinet.com/blog/threat-research/funkybot-malware-targets-japan.html" ], "synonyms": [], "type": [] }, "uuid": "bc0d37fa-113a-45ba-8a1c-b9d818e31f27", "value": "FunkyBot" }, { "description": "According to Check Point, they uncovered an operation dubbed \"Domestic Kitten\", which uses malicious Android applications to steal sensitive personal information from its victims: screenshots, messages, call logs, surrounding voice recordings, and more. This operation managed to remain under the radar for a long time, as the associated files were not attributed to a known malware family and were only detected by a handful of security vendors.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.furball", "https://research.checkpoint.com/2021/domestic-kitten-an-inside-look-at-the-iranian-surveillance-operations/", "https://www.bleepingcomputer.com/news/security/domestic-kitten-apt-operates-in-silence-since-2016/", "https://www.trendmicro.com/en_us/research/19/f/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east.html", "https://www.bleepingcomputer.com/news/security/hacking-group-updates-furball-android-spyware-to-evade-detection/", "https://ti.qianxin.com/blog/articles/surprised-by-cyrus-the-great-disclosure-against-Iran-cyrus-attack/", "https://documents.trendmicro.com/assets/appendix-mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east.pdf", "https://www.virusbulletin.com/conference/vb2019/abstracts/domestic-kitten-iranian-surveillance-program" ], "synonyms": [], "type": [] }, "uuid": "53282cc8-fefc-47d7-b6a5-a82a05a88f2a", "value": "FurBall" }, { "description": "According to Synthient, Gaganode is a decentralized bandwidth monetization service that enables both users and publishers to earn crypto for their bandwidth or monetize other people's bandwidth. The SDK intentionally implements RCE, thus aligning Gaganode more closely with malware than standard commercial SDKs.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.gaganode", "https://synthient.com/blog/ipcola-a-tangled-mess" ], "synonyms": [], "type": [] }, "uuid": "1034e0e2-0643-40e3-b25e-32f541e9d3c1", "value": "Gaganode (Android)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.geost", "https://www.trendmicro.com/en_us/research/20/c/dissecting-geost-exposing-the-anatomy-of-the-android-trojan-targeting-russian-banks.html", "https://www.virusbulletin.com/virusbulletin/2019/10/vb2019-paper-geost-botnet-story-discovery-new-android-banking-trojan-opsec-error/", "https://www.gosecure.net/blog/2020/12/02/deep-dive-into-an-obfuscation-as-a-service-for-android-malware/" ], "synonyms": [], "type": [] }, "uuid": "b9639878-733c-4f30-9a13-4680a7e17415", "value": "Geost" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.ghimob", "https://securelist.com/ghimob-tetrade-threat-mobile-devices/99228/" ], "synonyms": [], "type": [] }, "uuid": "3d1f2591-05fe-42f4-aaf8-ed1428f17605", "value": "Ghimob" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.ghostctrl", "https://blog.trendmicro.com/trendlabs-security-intelligence/android-backdoor-ghostctrl-can-silently-record-your-audio-video-and-more/" ], "synonyms": [], "type": [] }, "uuid": "3b6c1771-6d20-4177-8be0-12116e254bf5", "value": "GhostCtrl" }, { "description": "According to ESET Research, GhostChat is a malicious Android app (package name com.datingbatch.chatapp) disguised to appear a legitimate chat platform called Dating Apps without payment; this legitimate app is available on Google Play and is unrelated to GhostChat other than through the latter using its icon. Ghostchat\u2019s source and mode of distribution remain unknown.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.ghost_chat", "https://www.welivesecurity.com/en/eset-research/love-actually-fake-dating-app-used-lure-targeted-spyware-campaign-pakistan/" ], "synonyms": [], "type": [] }, "uuid": "1810d84c-c167-4fc7-b12a-363b6b005030", "value": "GhostChat" }, { "description": "Gigabud is the name of an Android Remote Access Trojan (RAT) Android that can record the victim's screen and steal banking credentials by abusing the Accessibility Service. Gigabud masquerades as banking, shopping, and other applications. Threat actors have been observed using deceptive websites to distribute Gigabud RAT.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.gigabud", "https://blog.cyble.com/2023/01/19/gigabud-rat-new-android-rat-masquerading-as-government-agencies/", "https://www.group-ib.com/blog/gigabud-banking-malware/" ], "synonyms": [], "type": [] }, "uuid": "8f188382-7a31-46a5-83c6-5991dfe739ee", "value": "Gigabud" }, { "description": "Ginp is a mobile banking software targeting Android devices that was discovered by Kaspersky. The malware is able to steal both user credentials and credit cards numbers by implementing overlay attacks. For this, overlay targets are for example the default SMS application. What makes Ginp a remarkable family is how its operators managed to have it remain undetected over time even and it receiving version upgrades over many years. According to ThreatFabric, Ginp has the following features:\r\n\r\nOverlaying: Dynamic (local overlays obtained from the C2)\r\nSMS harvesting: SMS listing\r\nSMS harvesting: SMS forwarding\r\nContact list collection\r\nApplication listing\r\nOverlaying: Targets list update\r\nSMS: Sending\r\nCalls: Call forwarding\r\nC2 Resilience: Auxiliary C2 list\r\nSelf-protection: Hiding the App icon\r\nSelf-protection: Preventing removal\r\nSelf-protection: Emulation-detection.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.ginp", "https://www.kaspersky.com/blog/ginp-trojan-coronavirus-finder/34338/", "https://muha2xmad.github.io/malware-analysis/ginp/", "https://twitter.com/ESETresearch/status/1269945115738542080", "https://www.threatfabric.com/blogs/2020_year_of_the_rat.html", "https://www.threatfabric.com/blogs/ginp_a_malware_patchwork_borrowing_from_anubis.html", "https://securityintelligence.com/posts/ginp-malware-operations-rising-expansions-turkey/", "https://www.youtube.com/watch?v=WeL_xSryj8E" ], "synonyms": [], "type": [] }, "uuid": "77e9ace0-f6e5-4d6e-965a-a653ff626be1", "value": "Ginp" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.glancelove", "https://securelist.com/breaking-the-weakest-link-of-the-strongest-chain/77562/", "https://www.clearskysec.com/glancelove/", "https://www.idf.il/en/minisites/hamas/hamas-uses-fake-facebook-profiles-to-target-israeli-soldiers/", "https://www.haaretz.com/israel-news/hamas-cyber-ops-spied-on-israeli-soldiers-using-fake-world-cup-app-1.6241773" ], "synonyms": [], "type": [] }, "uuid": "24a709ef-c2e4-45ca-90b6-dfa184472f49", "value": "GlanceLove" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.gnatspy", "https://www.trendmicro.com/en_us/research/17/l/new-gnatspy-mobile-malware-family-discovered.html" ], "synonyms": [], "type": [] }, "uuid": "a3b6a355-3afe-49ae-9f87-679c6c382943", "value": "GnatSpy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.goat_rat", "https://labs.k7computing.com/index.php/goatrat-attacks-automated-payment-systems/" ], "synonyms": [], "type": [] }, "uuid": "f699d295-1072-418b-8aa2-cb36fbd4c6c7", "value": "GoatRAT" }, { "description": "According to PCrisk, Godfather is the name of an Android malware targeting online banking pages and cryptocurrency exchanges in 16 countries. It opens fake login windows over legitimate applications. Threat actors use Godfather to steal account credentials. Additionally, Godfather can steal SMSs, device information, and other data.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.godfather", "https://muha2xmad.github.io/malware-analysis/godfather/", "https://blog.group-ib.com/godfather-trojan", "https://github.com/LaurieWired/StrangeLoop", "https://brandefense.io/blog/godfather-android-banking-trojan/", "https://shindan.io/blog/godfather-part-1-a-multistage-dropper" ], "synonyms": [], "type": [] }, "uuid": "8e95a9d5-08fb-4f11-b70a-622148bd1e62", "value": "Godfather" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.goldeneagle", "https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf" ], "synonyms": [], "type": [] }, "uuid": "b7c0c11d-8471-4b10-bbf2-f9c0f30bc27e", "value": "GoldenEagle" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.goldenrat", "https://ti.360.net/blog/articles/apt-c-27-(goldmouse):-suspected-target-attack-against-the-middle-east-with-winrar-exploit-en/" ], "synonyms": [], "type": [] }, "uuid": "e111fff8-c73c-4069-b804-2d3732653481", "value": "GoldenRAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.gold_digger", "https://www.group-ib.com/blog/golddigger-fraud-matrix/" ], "synonyms": [], "type": [] }, "uuid": "8ff9cde1-627e-4967-8b12-195544f31d83", "value": "GoldDigger" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.goontact", "https://blog.cyble.com/2021/09/03/spyware-variant-disguised-as-korean-video-app-targets-multiple-asian-countries/", "https://blog.lookout.com/lookout-discovers-new-spyware-goontact-used-by-sextortionists-for-blackmail" ], "synonyms": [], "type": [] }, "uuid": "008ef3f3-579e-4065-ad0a-cf96be00becf", "value": "goontact" }, { "description": "Cisco Talos identifies GPlayed as a malware written in .NET using the Xamarin environment for mobile applications. It is considered powerful because of its capability to adapt after its deployment. In order to achieve this adaptability, the operator has the capability to remotely load plugins, inject scripts and even compile new .NET code that can be executed. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.gplayed", "https://blog.talosintelligence.com/2018/10/gplayerbanker.html", "https://blog.talosintelligence.com/2018/10/gplayedtrojan.html" ], "synonyms": [], "type": [] }, "uuid": "13dc1ec7-aba7-4553-b990-8323405a1d32", "value": "GPlayed" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.gravity_rat", "https://www.welivesecurity.com/2023/06/15/android-gravityrat-goes-after-whatsapp-backups/", "https://securelist.com/gravityrat-the-spy-returns/99097/", "https://blog.talosintelligence.com/cosmic-leopard/" ], "synonyms": [], "type": [] }, "uuid": "fed09d31-6378-4e85-b644-5500491dff88", "value": "Gravity RAT (Android)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.grifthorse", "https://blog.zimperium.com/grifthorse-android-trojan-steals-millions-from-over-10-million-victims-globally/" ], "synonyms": [], "type": [] }, "uuid": "fe40a0b2-be48-41c5-8814-7fa3a6a993b9", "value": "GriftHorse" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.guerrilla", "https://www.trendmicro.com/en_us/research/22/b/sms-pva-services-use-of-infected-android-phones-reveals-flaws-in-sms-verification.html" ], "synonyms": [], "type": [] }, "uuid": "57de6ac2-8cf0-4022-aee2-5f76e3dbd503", "value": "Guerrilla" }, { "description": "Group-IB describes Gustuff as a mobile Android Trojan, which includes potential targets of customers in leading international banks, users of cryptocurrency services, popular ecommerce websites and marketplaces. Gustuff has previously never been reported. Gustuff is a new generation of malware complete with fully automated features designed to steal both fiat and crypto currency from user accounts en masse. The Trojan uses the Accessibility Service, intended to assist people with disabilities.\r\nThe analysis of Gustuff sample revealed that the Trojan is equipped with web fakes designed to potentially target users of Android apps of top international banks including Bank of America, Bank of Scotland, J.P.Morgan, Wells Fargo, Capital One, TD Bank, PNC Bank, and crypto services such as Bitcoin Wallet, BitPay, Cryptopay, Coinbase etc. Group-IB specialists discovered that Gustuff could potentially target users of more than 100 banking apps, including 27 in the US, 16 in Poland, 10 in Australia, 9 in Germany, and 8 in India and users of 32 cryptocurrency apps.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.gustuff", "https://www.threatfabric.com/blogs/the-rage-of-android-banking-trojans.html", "https://gallery.mailchimp.com/c35aef82661dad887b8162a4f/files/e24e8206-a157-4796-a8cb-2b7262cc76e8/CSIS_Threat_Matrix_H1_2019.pdf", "https://www.group-ib.com/media/gustuff/", "https://blog.talosintelligence.com/2019/04/gustuff-targets-australia.html", "https://blog.talosintelligence.com/2019/10/gustuffv2.html", "https://www.threatfabric.com/blogs/2020_year_of_the_rat.html" ], "synonyms": [], "type": [] }, "uuid": "a5e2b65f-2087-465d-bf14-4acf891d5d0f", "value": "Gustuff" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.hardrain", "https://unit42.paloaltonetworks.com/unit42-operation-blockbuster-goes-mobile/", "https://securingtomorrow.mcafee.com/mcafee-labs/android-malware-appears-linked-to-lazarus-cybercrime-group/#sf174581990", "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-F.pdf" ], "synonyms": [], "type": [] }, "uuid": "0caf0292-b01a-4439-b56f-c75b71900bc0", "value": "HARDRAIN (Android)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.hawkshaw", "https://www.stratosphereips.org/blog/2021/5/6/dissecting-a-rat-analysis-of-the-hawkshaw", "https://research.checkpoint.com/2021/going-rogue-a-mastermind-behind-android-malware-returns-with-a-new-rat/" ], "synonyms": [], "type": [] }, "uuid": "5ae490bd-84ca-434f-ab34-b87bd38e4523", "value": "HawkShaw" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.henbox", "https://unit42.paloaltonetworks.com/pkplug_chinese_cyber_espionage_group_attacking_asia/", "https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-pulling-pkplug-adversary-playbook-long-standing-espionage-activity-chinese-nation-state-adversary/", "https://unit42.paloaltonetworks.com/unit42-henbox-chickens-come-home-roost/" ], "synonyms": [], "type": [] }, "uuid": "0185f9f6-018e-4eb5-a214-d810cb759a38", "value": "HenBox" }, { "description": "Lookout states that Hermit is an advanced spyware designed to target iOS and Android mobile devices. It is designed to collect extensive amounts of sensitive data on its victims such as their location, contacts, private messages, photos, call logs, phone conversations, ambient audio recordings, and more.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.hermit", "https://www.lighthousereports.nl/investigation/revealing-europes-nso", "https://blog.google/threat-analysis-group/italian-spyware-vendor-targets-users-in-italy-and-kazakhstan/", "https://de.lookout.com/blog/hermit-spyware-discovery" ], "synonyms": [], "type": [] }, "uuid": "b95f25a0-ba22-4320-95e3-323fbf852846", "value": "Hermit" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.hero_rat", "https://www.welivesecurity.com/2018/06/18/new-telegram-abusing-android-rat/" ], "synonyms": [], "type": [] }, "uuid": "537f17ac-74e5-440b-8659-d4fdb4af41a6", "value": "HeroRAT" }, { "description": "HiddenAd is a malware that shows ads as overlays on the phone.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.hiddenad", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/new-hiddenads-malware-that-runs-automatically-and-hides-on-google-play-1m-users-affected/", "https://labs.bitdefender.com/2020/03/infected-zoom-apps-for-android-target-work-from-home-users", "https://securelist.com/mobile-malware-evolution-2019/96280/", "https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf", "https://twitter.com/LukasStefanko/status/1136568939239137280" ], "synonyms": [], "type": [] }, "uuid": "171c97ca-6b61-426d-8f72-c099528625e9", "value": "HiddenAd" }, { "description": "RAT, which can be used to extract sensitive information, e.g. contact lists, txt messages, location information.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.hilalrat", "https://thehackernews.com/2022/04/microsoft-obtains-court-order-to-take.html" ], "synonyms": [], "type": [] }, "uuid": "96bea6aa-3202-4352-8e36-fa05c677c0e8", "value": "HilalRAT" }, { "description": "According to ThreatFabric, this is a malware family based on apk.ermac. The name hook is the self-advertised named by its vendor DukeEugene. It provides WebSocket communication and has RAT capabilities.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.hook", "https://medium.com/@joshuapenny88/hostinghunter-series-chang-way-technologies-co-limited-a9ba4fce0f65", "https://info.spamhaus.com/hubfs/Botnet%20Reports/Jul-Dec%202024%20Botnet%20Threat%20Update.pdf", "https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-january-to-june-2025/", "https://zimperium.com/blog/hook-version-3-the-banking-trojan-with-the-most-advanced-capabilities", "https://cebrf.knf.gov.pl/komunikaty/artykuly-csirt-knf/362-ostrzezenia/858-hookbot-a-new-mobile-malware", "https://research.nccgroup.com/2023/09/11/from-ermac-to-hook-investigating-the-technical-differences-between-two-android-malware-variants/", "https://www.threatfabric.com/blogs/hook-a-new-ermac-fork-with-rat-capabilities.html", "https://info.spamhaus.com/hubfs/Botnet%20Reports/Jan-Jun%202024%20Botnet%20Threat%20Update.pdf", "https://www.sciencedirect.com/science/article/pii/S266628172400088X", "https://info.spamhaus.com/hubfs/Botnet%20Reports/Q4%202023%20Botnet%20Threat%20Update.pdf", "https://github.com/0xperator/hookbot_source" ], "synonyms": [], "type": [] }, "uuid": "c101bc42-1011-43f6-9d30-629013c318cd", "value": "Hook" }, { "description": "Avira states that Hydra is an Android BankBot variant, a type of malware designed to steal banking credentials. The way it does this is by requesting the user enables dangerous permissions such as accessibility and every time the banking app is opened, the malware is hijacking the user by overwriting the legit banking application login page with a malicious one. The goal is the same, to trick the user to enter his login credentials so that it will go straight to the malware authors.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.hydra", "https://medium.com/@joshuapenny88/hostinghunter-series-chang-way-technologies-co-limited-a9ba4fce0f65", "https://www.avira.com/en/blog/avira-labs-research-reveals-hydra-banking-trojan-2-0", "https://cryptax.medium.com/quick-look-into-a-new-sample-of-android-bianlian-bc5619efa726", "https://resecurity.com/blog/article/in-the-box-mobile-malware-webinjects-marketplace", "https://twitter.com/muha2xmad/status/1570788983474638849", "https://muha2xmad.github.io/malware-analysis/hydra/", "https://cocomelonc.github.io/book/2025/05/19/aiya-mmd-book.html", "https://www.threatfabric.com/blogs/2020_year_of_the_rat.html", "https://cryptax.medium.com/creating-a-safe-dummy-c-c-to-test-android-bots-ffa6e7a3dce5", "https://blog.cyble.com/2022/06/13/hydra-android-malware-distributed-via-play-store/", "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf", "https://pentest.blog/android-malware-analysis-dissecting-hydra-dropper/", "https://cryptax.medium.com/android-bianlian-payload-61febabed00a", "https://cryptax.medium.com/bianlian-c-c-domain-name-4f226a29e221", "https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html" ], "synonyms": [], "type": [] }, "uuid": "ae25953d-cf7c-4304-9ea2-2ea1498ea035", "value": "Hydra" }, { "description": "Android variant of IPStorm (InterPlanetary Storm).", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.ipstorm", "https://www.justice.gov/usao-pr/pr/russian-and-moldovan-national-pleads-guilty-operating-illegal-botnet-proxy-service", "https://www.bitdefender.com/files/News/CaseStudies/study/376/Bitdefender-Whitepaper-IPStorm.pdf", "https://blog.barracuda.com/2020/10/01/threat-spotlight-new-interplanetary-storm-variant-iot/", "https://cocomelonc.github.io/book/2025/05/19/aiya-mmd-book.html" ], "synonyms": [ "InterPlanetary Storm" ], "type": [] }, "uuid": "dc0c8824-64ac-4ab2-a0e4-955a14ecc59c", "value": "IPStorm (Android)" }, { "description": "According to redpiranha, IRATA (Iranian Remote Access Trojan) Android Malware is a new malware detected in the wild. It originates from a phishing attack through SMS. The theme of the message resembles information coming from the government that will ask you to download this malicious application. IRATA can collect sensitive information from your mobile phone including bank details. Since it infects your mobile, it can also gather your SMS messages which then can be used to obtain 2FA tokens.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.irata", "https://onecert.ir/portal/blog/irata", "https://twitter.com/muha2xmad/status/1562831996078157826", "https://muha2xmad.github.io/malware-analysis/irata/" ], "synonyms": [], "type": [] }, "uuid": "24fb43b4-d6a6-49c0-a862-4211a245b635", "value": "IRATA" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.irrat", "https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/" ], "synonyms": [], "type": [] }, "uuid": "3e7c6e8c-46fc-4498-a28d-5b3d144c51cf", "value": "IRRat" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.jaderat", "https://blog.lookout.com/mobile-threat-jaderat" ], "synonyms": [], "type": [] }, "uuid": "8804e02c-a139-4c3d-8901-03302ca1faa0", "value": "JadeRAT" }, { "description": "Joker is one of the most well-known malware families on Android devices. It manages to take advantage of Google\u2019s official app store with the help of its trail signatures which includes updating the virus\u2019s code, execution process, and payload-retrieval techniques. This malware is capable of stealing users\u2019 personal information including contact details, device data, WAP services, and SMS messages.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.joker", "https://labs.k7computing.com/index.php/joker-unleashes-itself-again-on-google-play-store/", "https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-january-to-june-2025/", "https://medium.com/csis-techblog/analysis-of-joker-a-spy-premium-subscription-bot-on-googleplay-9ad24f044451", "https://www.trendmicro.com/en_us/research/20/k/an-old-jokers-new-tricks--using-github-to-hide-its-payload.html", "https://labs.bitdefender.com/2020/03/android-apps-and-malware-capitalize-on-coronavirus", "https://security.googleblog.com/2020/01/pha-family-highlights-bread-and-friends.html", "https://muha2xmad.github.io/malware-analysis/hydra/", "https://research.checkpoint.com/2020/new-joker-variant-hits-google-play-with-an-old-trick/", "https://cryptax.medium.com/tracking-android-joker-payloads-with-medusa-static-analysis-and-patience-672348b81ac2", "https://hunt.io/blog/uncovering-joker-c2-network", "https://web.archive.org/web/20210714010827/https://blog.zimperium.com/joker-is-still-no-laughing-matter/", "https://www.microsoft.com/security/blog/2022/06/30/toll-fraud-malware-how-an-android-application-can-drain-your-wallet/", "https://labs.k7computing.com/?p=22199", "https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-july-to-december-2025/", "https://www.threatfabric.com/blogs/toad-fraud", "https://blogs.quickheal.com/google-play-store-applications-laced-with-joker-malware-yet-again/", "https://blogs.quickheal.com/stay-alert-joker-still-making-its-way-on-google-play-store/", "https://cryptax.medium.com/live-reverse-engineering-of-a-trojanized-medical-app-android-joker-632d114073c1" ], "synonyms": [ "Bread" ], "type": [] }, "uuid": "aa2ad8f4-3c46-4f16-994b-2a79c7481cac", "value": "Joker" }, { "description": "Keenadu is an Android backdoor that is distributed primarily through pre-infected device firmware, as well as through malicious apps. Its capabilities include full remote control of a victim's device, ad fraud, and browser search hijacking. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.keenadu", "https://www.kaspersky.com/about/press-releases/kaspersky-discovers-keenadu-a-multifaceted-android-malware-that-can-come-preinstalled-on-new-devices", "https://www.sophos.com/en-us/blog/android-devices-ship-with-firmware-level-malware" ], "synonyms": [], "type": [] }, "uuid": "e6d59e4d-e122-4c21-ad0b-502a6acf39cb", "value": "Keenadu" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.kevdroid", "https://researchcenter.paloaltonetworks.com/2018/04/unit42-reaper-groups-updated-mobile-arsenal/", "https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf", "https://blog.talosintelligence.com/2018/04/fake-av-investigation-unearths-kevdroid.html" ], "synonyms": [], "type": [] }, "uuid": "1e1924b5-89cb-408b-bcee-d6aaef7b24e0", "value": "KevDroid" }, { "description": "KIMWOLF is an android based malware which uses compromised systems to relay malicious and abusive Internet traffic, as well as participating in distributed denial-of-service (DDoS). KIMWOLF primarily infects unofficial Android-TV set-top boxes and digital photo frames. The malware has frequently been noted to achieve infection spread via abusing Android Debug Bridge (ADB) and residential proxies. There are multiple reports suggesting a connection to the Aisuru botnet, with Kimwolf acting as the Android variant.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.kimwolf", "https://synthient.com/blog/a-broken-system-fueling-botnets", "https://krebsonsecurity.com/2026/01/who-benefited-from-the-aisuru-and-kimwolf-botnets/", "https://krebsonsecurity.com/2026/01/who-operates-the-badbox-2-0-botnet/", "https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-local-network/", "https://blog.cloudflare.com/ddos-threat-report-2025-q4/", "https://www.infoblox.com/blog/threat-intelligence/kimwolf-howls-from-inside-the-enterprise/", "https://krebsonsecurity.com/2026/01/kimwolf-botnet-lurking-in-corporate-govt-networks/", "http://blog.xlab.qianxin.com/kimwolf-botnet-en/", "https://www.securityweek.com/kimwolf-android-botnet-grows-through-residential-proxy-networks/" ], "synonyms": [], "type": [] }, "uuid": "e2ca108a-3d4b-4988-bdac-e79038ced814", "value": "Kimwolf" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.knspy", "https://cybleinc.com/2021/04/21/donot-team-apt-group-is-back-to-using-old-malicious-patterns/", "https://community.riskiq.com/article/6f60db72", "https://twitter.com/voodoodahl1/status/1267571622732578816", "https://s.tencent.com/research/report/951.html", "https://blogs.360.cn/post/APT-C-35_target_at_armed_forces_in_Pakistan.html", "https://blog.talosintelligence.com/2020/10/donot-firestarter.html" ], "synonyms": [], "type": [] }, "uuid": "084ebca7-91da-4d9c-8211-a18f358ac28b", "value": "KnSpy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.koler", "https://twitter.com/LukasStefanko/status/928262059875213312" ], "synonyms": [], "type": [] }, "uuid": "4ff34778-de4b-4f48-9184-4975c8ccc3f3", "value": "Koler" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.konni", "https://www.rewterz.com/rewterz-news/rewterz-threat-alert-konni-apt-group-active-iocs-11" ], "synonyms": [], "type": [] }, "uuid": "d4f90ffc-72cb-49a5-b796-527785f49161", "value": "Konni (Android)" }, { "description": "According to Lookout, this spyware was first observed in March 2022 and remains active with new samples still publicly hosted. It uses a two-stage C2 infrastructure that retrieves initial configurations from a Firebase cloud database. KoSpy can collect extensive data, such as SMS messages, call logs, location, files, audio, and screenshots via dynamically loaded plugins. The spyware has Korean language support with samples distributed across Google Play and third-party app stores such as Apkpure.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.kospy", "https://www.lookout.com/threat-intelligence/article/lookout-discovers-new-spyware-by-north-korean-apt37" ], "synonyms": [], "type": [] }, "uuid": "b7a1499f-b5fb-4b1f-a2ec-f7907faa506b", "value": "KoSpy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.ksremote", "https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/" ], "synonyms": [], "type": [] }, "uuid": "196d51bf-cf97-455d-b997-fc3e377f2188", "value": "KSREMOTE" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.landfall", "https://unit42.paloaltonetworks.com/landfall-is-new-commercial-grade-android-spyware/" ], "synonyms": [], "type": [] }, "uuid": "f5c4095f-d1c5-4026-8fc0-946f0575cd7f", "value": "LANDFALL" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.little_looter", "https://securityintelligence.com/posts/itg18-operational-security-errors-plague-iranian-threat-group/", "https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-The-Kitten-That-Charmed-Me-The-9-Lives-Of-A-Nation-State-Attacker.pdf", "https://twitter.com/malwrhunterteam/status/1337684036374945792", "https://www.youtube.com/watch?v=nilzxS9rxEM" ], "synonyms": [], "type": [] }, "uuid": "41cb4397-7ae0-4a9f-894f-47828e768aa9", "value": "LittleLooter" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.loki", "http://blog.checkpoint.com/2017/03/10/preinstalled-malware-targeting-mobile-users/" ], "synonyms": [], "type": [] }, "uuid": "a6f481fe-b6db-4507-bb3c-28f10d800e2f", "value": "Loki" }, { "description": "Android banker Trojan with the standard banking capabilities such as overlays, SMS stealing. It also features ransomware functionality. Note, the network traffic is obfuscated the same way as in Android Bankbot.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.lokibot", "https://github.com/vc0RExor/Malware-Threat-Reports/blob/main/Lokibot/Machete-Weapons-Lokibot/Machete%20weapons-Lokibot_EN.pdf", "https://drive.google.com/file/d/144cOnM6fxfuBeP0V2JQshp8C0Zlk_0kH/view", "https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/", "https://isc.sans.edu/diary/27282", "https://news.sophos.com/en-us/2020/07/14/raticate-rats-as-service-with-commercial-crypter/?cmp=30728", "https://securelist.com/emotet-darkgate-lokibot-crimeware-report/110286/", "https://www.threatfabric.com/blogs/lokibot_the_first_hybrid_android_malware.html", "https://yoroi.company/research/aggah-how-to-run-a-botnet-without-renting-a-server-for-more-than-a-year/", "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/steganoamor-campaign-ta558-mass-attacking-companies-and-public-institutions-all-around-the-world/", "https://muha2xmad.github.io/mal-document/lokibotpdf/" ], "synonyms": [], "type": [] }, "uuid": "4793a29b-1191-4750-810e-9301a6576fc4", "value": "LokiBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.luckycat", "https://blog.talosintelligence.com/2019/02/exilerat-shares-c2-with-luckycat.html" ], "synonyms": [], "type": [] }, "uuid": "1785a4dd-4044-4405-91c2-efb722801867", "value": "LuckyCat" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.luna_spy", "https://www.kaspersky.com/blog/disguised-spy-for-android/54051/" ], "synonyms": [ "Backdoor.916" ], "type": [] }, "uuid": "259eb95e-f622-40d2-b6e0-79d07035fef5", "value": "LunaSpy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.mandrake", "https://www.bitdefender.com/files/News/CaseStudies/study/329/Bitdefender-PR-Whitepaper-Mandrake-creat4464-en-EN-interactive.pdf" ], "synonyms": [], "type": [] }, "uuid": "0f587654-7f70-43be-9f1f-95e3a2cc2014", "value": "Mandrake" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.marcher", "https://securelist.com/mobile-malware-evolution-2019/96280/", "https://www.clientsidedetection.com/exobot_v2_update___staying_ahead_of_the_competition.html", "https://www.zscaler.de/blogs/research/android-marcher-continuously-evolving-mobile-malware", "https://www.proofpoint.com/us/blog/threat-insight/update-fake-updates-two-new-actors-and-new-mac-malware" ], "synonyms": [ "ExoBot" ], "type": [] }, "uuid": "f691663a-b360-4c0d-a4ee-e9203139c38e", "value": "Marcher" }, { "description": "According to heimdal, MasterFred malware, this is designed as an Android trojan that makes use of false login overlays to target not only Netflix, Instagram, and Twitter users, but also bank customers. The hackers\u2019 goal is to steal credit card information.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.masterfred", "https://twitter.com/AvastThreatLabs/status/1458162276708483073" ], "synonyms": [ "Brox" ], "type": [] }, "uuid": "87131ea3-4c5e-42ba-a8e2-edd62a0bcd8d", "value": "MasterFred" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.mazarbot", "https://heimdalsecurity.com/blog/security-alert-mazar-bot-active-attacks-android-malware/", "https://b0n1.blogspot.de/2017/08/phishing-attack-at-raiffeisen-bank-by.html" ], "synonyms": [], "type": [] }, "uuid": "38cbdc29-a5af-46ae-ab82-baf3f6999826", "value": "MazarBot" }, { "description": "According to ThreatFabric, this is an Android banking trojan under active development as of July 2020. It is using TCP for C&C communication and targets Turkish banks.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.medusa", "https://www.cleafy.com/cleafy-labs/medusa-reborn-a-new-compact-variant-discovered", "https://twitter.com/ThreatFabric/status/1285144962695340032", "https://www.threatfabric.com/blogs/the-rage-of-android-banking-trojans.html", "https://www.threatfabric.com/blogs/partners-in-crime-medusa-cabassous.html" ], "synonyms": [ "Gorgona" ], "type": [] }, "uuid": "f155e529-dbea-4e4d-9df3-518401191c82", "value": "Medusa (Android)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.meterpreter", "https://www.trendmicro.com/en_us/research/20/l/sidewinder-leverages-south-asian-territorial-issues-for-spear-ph.html", "https://medium.com/@cryptax/into-android-meterpreter-and-how-the-malware-launches-it-part-2-ef5aad2ebf12", "https://medium.com/@cryptax/locating-the-trojan-inside-an-infected-covid-19-contact-tracing-app-21e23f90fbfe", "https://mp.weixin.qq.com/s/J_A12SOX0k5TOYFAegBv_w" ], "synonyms": [], "type": [] }, "uuid": "e1ae3e4e-5aaf-4ffe-ba2f-7871507f6d52", "value": "Meterpreter (Android)" }, { "description": "Mirax is an Android RAT / banking trojan sold as a private Malware-as-a-Service since December 2025 by an actor using the moniker \"Mirax Bot\", advertised only to a small pool of predominantly Russian-speaking affiliates. It combines a conventional banking-trojan stack \u2014 HTML/JavaScript overlay injection against banking and cryptocurrency apps, Accessibility-Services abuse, HVNC, keylogging, SMS interception, and lock-screen (PIN / pattern / biometric) intelligence harvesting \u2014 with an integrated SOCKS5 residential-proxy module multiplexed with Yamux over the WebSocket C2 channel, which turns infected handsets into residential-IP proxy nodes for follow-on fraud. C2 traffic is routed through a C2 Gate server on three concurrent WebSocket channels (control on 8443, data/streaming on 8444, proxy tunnel on 8445). Observed campaigns rely on paid Meta ads impersonating IPTV and illegal sports-streaming apps that redirect to droppers hosted on GitHub Releases with daily-rotating hashes; the analysed campaign targeted Spanish-speaking users (Spain) and reached more than 220,000 accounts, though the platform's overlay inventory includes templates for German, French, Italian, Polish, Portuguese, and other European languages.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.mirax", "https://www.cleafy.com/cleafy-labs/mirax-a-new-android-rat-turning-infected-devices-into-potential-residential-proxy-nodes", "https://zimperium.com/blog/android-bankers-4-campaigns-in-a-row" ], "synonyms": [ "Astrinox", "Mirax Bot", "MiraxRAT" ], "type": [] }, "uuid": "594da544-9485-482c-93e0-d04edf18cdbf", "value": "Mirax" }, { "description": "Check Point has identified samples of this spyware being distributed since 2015. No samples were found on Google Play, meaning they were likely through other channels like social engineering.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.mobile_order", "https://research.checkpoint.com/2022/never-truly-left-7-years-of-scarlet-mimics-mobile-surveillance-campaign-targeting-uyghurs/" ], "synonyms": [], "type": [] }, "uuid": "ee19588f-9752-4516-85f4-de18acfc64b3", "value": "MobileOrder" }, { "description": "Monokle is a sophisticated mobile surveillanceware that possesses remote access trojan (RAT) functionality, advanced data exfiltration techniques as well as the ability to install an attacker-specified certificate to the trusted certificates on an infected device that would allow for man-in-the-middle (MITM) attacks.\r\nAccording to Lookout researchers, It is believed to be developed by Special Technology Center (STC), which is a Russian defense contractor sanctioned by the U.S. Government in connection to alleged interference in the 2016 US presidential elections.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.monokle", "https://citizenlab.ca/2024/12/device-confiscated-by-russian-authorities-returned-with-monokle-type-spyware-installed/", "https://www.lookout.com/documents/threat-reports/lookout-discovers-monokle-threat-report.pdf" ], "synonyms": [], "type": [] }, "uuid": "739d6d22-b187-4754-9098-22625ea612cc", "value": "Monokle" }, { "description": "MoqHao, also called Wroba and XLoader (not to be confused with the malware of the same name for Windows and macOS), is an Android-based mobile threat that is associated with a financially motivated Chinese group called Roaming Mantis. The malware claims to be the default SMS application and has dropper and banker capabilities. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.moqhao", "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_4_ogawa-niseki_en.pdf", "https://www.trendmicro.com/en_us/research/18/d/xloader-android-spyware-and-banking-trojan-distributed-via-dns-spoofing.html", "https://team-cymru.com/blog/2021/01/20/moqhao-part-1-identifying-phishing-infrastructure/", "https://www.team-cymru.com/post/moqhao-part-3-recent-global-targeting-trends", "https://blog.trendmicro.com/trendlabs-security-intelligence/a-look-into-the-connection-between-xloader-and-fakespy-and-their-possible-ties-with-the-yanbian-gang/", "https://www.xanhacks.xyz/p/moqhao-malware-analysis", "https://www.trendmicro.com/en_us/research/18/k/a-look-into-the-connection-between-xloader-and-fakespy-and-their-possible-ties-with-the-yanbian-gang.html", "https://www.broadcom.com/support/security-center/protection-bulletin/moqhao-malware-continues-to-target-mobile-users-in-europe", "https://team-cymru.com/blog/2022/04/07/moqhao-part-2-continued-european-expansion/", "https://cryptax.medium.com/a-native-packer-for-android-moqhao-6362a8412fe1", "https://medium.com/csis-techblog/the-roamingmantis-groups-expansion-to-european-apple-accounts-and-android-devices-e6381723c681", "https://www.telekom.com/en/blog/group/article/moqhao-masters-new-tricks-1031484", "https://blog.sekoia.io/ongoing-roaming-mantis-smishing-campaign-targeting-france/", "https://securelist.com/roaming-mantis-dns-changer-in-malicious-mobile-app/108464/", "https://www.kashifali.ca/2021/05/05/roaming-mantis-amplifies-smishing-campaign-with-os-specific-android-malware/", "https://team-cymru.com/blog/2021/08/11/moqhao-part-1-5-high-level-trends-of-recent-campaigns-targeting-japan/", "https://securelist.com/roaming-mantis-part-v/96250/", "https://hitcon.org/2019/CMT/slide-files/d2_s1_r1.pdf" ], "synonyms": [ "Shaoye", "Wroba", "XLoader" ], "type": [] }, "uuid": "41a9408d-7020-4988-af2c-51baf4d20763", "value": "MoqHao" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.morder_rat", "https://www.ctfiot.com/138538.html" ], "synonyms": [], "type": [] }, "uuid": "f91f27ad-edcd-4e3d-824e-23f6acd81a7b", "value": "MOrder RAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.mudwater", "https://documents.trendmicro.com/assets/white_papers/wp_new_muddywater_findings_uncovered.pdf" ], "synonyms": [], "type": [] }, "uuid": "9a8a5dd0-c86e-40d1-bc94-51070447c907", "value": "Mudwater" }, { "description": "MysteryBot is an Android banking Trojan with overlay capabilities with support for Android 7/8 but also provides other features such as key logging and ransomware functionality.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.mysterybot", "https://www.threatfabric.com/blogs/mysterybot__a_new_android_banking_trojan_ready_for_android_7_and_8.html" ], "synonyms": [], "type": [] }, "uuid": "0a53ace4-98ae-442f-be64-b8e373948bde", "value": "MysteryBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.nexus", "https://liansecurity.com/#/main/news/RWt_ZocBrFZDfCElFqw_/detail", "https://www.cleafy.com/cleafy-labs/nexus-a-new-android-botnet" ], "synonyms": [], "type": [] }, "uuid": "fe0b4e6e-268e-4c63-a095-bf1ddff95055", "value": "Nexus" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.omnirat", "https://github.com/threatland/TL-TROJAN/tree/master/TL.RAT/RAT.Android.OmniRAT", "https://securityintelligence.com/news/omnirat-takes-over-android-devices-through-social-engineering-tricks/", "https://blog.avast.com/2015/11/05/droidjack-isnt-the-only-spying-software-out-there-avast-discovers-that-omnirat-is-currently-being-used-and-spread-by-criminals-to-gain-full-remote-co" ], "synonyms": [], "type": [] }, "uuid": "ec936d58-6607-4e33-aa97-0e587bbbdda5", "value": "OmniRAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.oscorp", "https://cert-agid.gov.it/news/individuato-sito-che-veicola-in-italia-un-apk-malevolo/", "https://www.cleafy.com/cleafy-labs/ubel-oscorp-evolution" ], "synonyms": [ "UBEL" ], "type": [] }, "uuid": "8d383260-102f-46da-8cc6-7659cbbd9452", "value": "Oscorp" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.packchat", "https://news.sophos.com/en-us/2021/01/12/new-android-spyware-targets-users-in-pakistan/" ], "synonyms": [], "type": [] }, "uuid": "b0f56103-1771-4e01-9ed7-44149e39ce93", "value": "PackChat" }, { "description": "According to TechCrunch, this is a remote surveillance app that allows ordinary consumers to buy software capable of tracking people and their data without their knowledge. Once physically planted on a person\u2019s phone or computer (usually with knowledge of the victim\u2019s passcode or login), the app would continuously upload a copy of the victim\u2019s information, including messages, photos, and location data, to pcTattletale\u2019s servers and make the data accessible to whoever planted the spyware.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.pctattletale", "https://techcrunch.com/2026/01/06/founder-of-spyware-maker-pctattletale-pleads-guilty-to-hacking-and-advertising-surveillance-software/" ], "synonyms": [], "type": [] }, "uuid": "157a13ca-95db-4b05-a0f1-44d45beb98ee", "value": "pcTattletale" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.phantomlance", "https://drive.google.com/file/d/1m0Qg8e1Len1My6ssDy6F0oQ7JdkJUkuu/view", "https://threatvector.cylance.com/en_us/home/mobile-malware-and-apt-espionage-prolific-pervasive-and-cross-platform.html", "https://securelist.com/apt-trends-report-q2-2020/97937/", "https://securelist.com/apt-phantomlance/96772/", "https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/mobile-malware-report.pdf", "https://securelist.com/it-threat-evolution-q2-2020/98230" ], "synonyms": [ "PWNDROID1" ], "type": [] }, "uuid": "a73375a5-3384-4515-8538-b598d225586d", "value": "PhantomLance" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.phoenix", "https://cryptax.medium.com/reverse-engineering-of-android-phoenix-b59693c03bd3" ], "synonyms": [], "type": [] }, "uuid": "b5d57344-0486-4580-a437-54c61cb0bf4d", "value": "Phoenix" }, { "description": "According to Zimperium, PhoneSpy is a spyware aimed at South Korean residents with Android devices.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.phonespy", "https://blog.zimperium.com/phonespy-the-app-based-cyberattack-snooping-south-korean-citizens/" ], "synonyms": [], "type": [] }, "uuid": "ff00bbb6-6856-4cf5-adde-d1cc536dd0e2", "value": "PhoneSpy" }, { "description": "According to Mandiant, PINEFLOWER is an Android malware family capable of a wide range of backdoor functionality, including stealing system inform information, logging and recording phone calls, initiating audio recordings, reading SMS inboxes and sending SMS messages. The malware also has features to facilitate device location tracking, deleting, downloading, and uploading files, reading connectivity state, speed, and activity, and toggling Bluetooth, Wi-Fi, and mobile data settings.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.pineflower", "https://www.mandiant.com/media/17826", "https://socradar.io/dark-web-profile-apt42-iranian-cyber-espionage-group/" ], "synonyms": [], "type": [] }, "uuid": "a17a7c5d-0a8f-42e7-b4c9-63c258267776", "value": "PINEFLOWER" }, { "description": "According to PCrisk, The PixPirate is a dangerous Android banking Trojan that has the capability to carry out ATS (Automatic Transfer System) attacks. This allows threat actors to automatically transfer funds through the Pix Instant Payment platform, which numerous Brazilian banks use.\r\n\r\nIn addition to launching ATS attacks, PixPirate can intercept and delete SMS messages, prevent the uninstallation process, and carry out malvertising attacks.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.pixpirate", "https://www.cleafy.com/cleafy-labs/pixpirate-a-new-brazilian-banking-trojan", "https://securityintelligence.com/posts/pixpirate-back-spreading-via-whatsapp/" ], "synonyms": [], "type": [] }, "uuid": "cdf707bd-a8b0-4ee3-917d-a56b11f30206", "value": "PixPirate" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.pixstealer", "https://research.checkpoint.com/2021/pixstealer-a-new-wave-of-android-banking-trojans-abusing-accessibility-services/", "https://securityintelligence.com/posts/brazking-android-malware-upgraded-targeting-brazilian-banks/" ], "synonyms": [ "BrazKing" ], "type": [] }, "uuid": "5d047596-eb67-4fed-b41d-65fa975150c5", "value": "PixStealer" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.pjobrat", "https://mp.weixin.qq.com/s/VTHvmRTeu3dw8HFyusKLqQ", "https://cybleinc.com/2021/06/22/android-application-disguised-as-dating-app-targets-indian-military-personnel/", "https://labs.k7computing.com/?p=22537" ], "synonyms": [], "type": [] }, "uuid": "6fa6c769-2546-4a5c-a3c7-24dda4ab597d", "value": "PjobRAT" }, { "description": "According to Lookout, PlainGnome consists of a two-stage deployment in which a very minimal first stage drops a malicious APK once it\u2019s installed. The code of PlainGnome\u2019s second stage payload evolved significantly from January 2024 through at least October. In particular, PlainGnome\u2019s developers shifted to using Jetpack WorkManager classes to handle data exfiltration, which eases development and maintenance of related code. In addition, WorkManager allows for specifying execution conditions. For example, PlainGnome only exfiltrates data from victim devices when the device enters an idle state. This mechanism is probably intended to reduce the chance of a victim noticing the presence of PlainGnome on their device. As opposed to the minimalist first (installer) stage, the second stage carries out all surveillance functionality and relies on 38 permissions.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.plain_gnome", "https://www.lookout.com/threat-intelligence/article/gamaredon-russian-android-surveillanceware" ], "synonyms": [], "type": [] }, "uuid": "d67bedfc-11d6-4784-83f2-9a38887e1298", "value": "PlainGnome" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.podec", "https://securelist.com/jack-of-all-trades/83470/" ], "synonyms": [], "type": [] }, "uuid": "82f9c4c1-2619-4236-a701-776c6c781f45", "value": "Podec" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.popr-d30", "http://blog.crysys.hu/2017/03/update-on-the-fancy-bear-android-malware-poprd30-apk/", "http://blog.crysys.hu/2017/01/technical-details-on-the-fancy-bear-android-malware-poprd30-apk/" ], "synonyms": [ "Popr-d30" ], "type": [] }, "uuid": "0a7d9d22-a26d-4a2b-ab9b-b296176c3ecf", "value": "X-Agent (Android)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.pornhub" ], "synonyms": [], "type": [] }, "uuid": "3272a8d8-8323-4e98-b6ce-cb40789a3616", "value": "Fake Pornhub" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.premier_rat", "https://twitter.com/LukasStefanko/status/1084774825619537925" ], "synonyms": [], "type": [] }, "uuid": "661471fe-2cb6-4b83-9deb-43225192a849", "value": "Premier RAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.princess", "https://www.sentinelone.com/labs/phantomcaptcha-multi-stage-websocket-rat-targets-ukraine-in-single-day-spearphishing-operation/" ], "synonyms": [], "type": [] }, "uuid": "2665959a-8686-44b3-ad01-5ef21a5cac1b", "value": "Princess" }, { "description": "According to Lookout, ProSpy is a feature-packed spyware developed in Kotlin Language. It has the common spyware functions like collecting private information and exfiltrating sensitive files.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.prospy", "https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire" ], "synonyms": [], "type": [] }, "uuid": "4ad1cef5-c5ce-4dd6-b9f3-79632d8cd90b", "value": "ProSpy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.rafelrat", "https://research.checkpoint.com/2024/foxit-pdf-flawed-design-exploitation/", "https://github.com/swagkarna/Rafel-Rat" ], "synonyms": [], "type": [] }, "uuid": "cdaa0a6d-3709-4e6f-8807-fff388baaba0", "value": "Rafel RAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.rambleon", "https://interlab.or.kr/archives/2567", "https://medium.com/s2wblog/scarcruft-bolsters-arsenal-for-targeting-individual-android-devices-97d2bcef4ab" ], "synonyms": [], "type": [] }, "uuid": "41ab3c99-297c-465c-8375-3e9f7ce4b996", "value": "RambleOn" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.rana", "https://blog.reversinglabs.com/blog/rana-android-malware" ], "synonyms": [], "type": [] }, "uuid": "65a8e406-b535-4c0a-bc6d-d1bec3c55623", "value": "Rana" }, { "description": "RatMilad, a newly discovered Android spyware, has been stealing data from mobile devices in the Middle East.\r\nThe malware is spread through links on social media and pretends to be applications for services like VPN and phone number spoofing. Unwary users download these trojan applications and grant access to malware. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.ratmilad", "https://socradar.io/new-spyware-ratmilad-targets-middle-eastern-mobile-devices" ], "synonyms": [], "type": [] }, "uuid": "542c3e5e-2124-4c36-af05-65893974d5ce", "value": "RatMilad" }, { "description": "According to ThreatFabric, this RAT can perform NFC relay attacks and has Automated Transfer ystem (ATS) capabilities", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.rat_on", "https://www.threatfabric.com/blogs/the-rise-of-raton-from-nfc-heists-to-remote-control-and-ats" ], "synonyms": [], "type": [] }, "uuid": "0bc2b50d-9627-4eaf-a320-9d3f0f53981a", "value": "RatOn" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.raxir", "https://twitter.com/PhysicalDrive0/statuses/798825019316916224" ], "synonyms": [], "type": [] }, "uuid": "f5cabe73-b5d6-4503-8350-30a6d54c32ef", "value": "Raxir" }, { "description": "RedAlert 2 is an new Android malware used by an attacker to gain access to login credentials of various e-banking apps. The malware works by overlaying a login screen with a fake display that sends the credentials to a C2 server.\r\nThe malware also has the ability to block incoming calls from banks, to prevent the victim of being notified.\r\nAs a distribution vector RedAlert 2 uses third-party app stores and imitates real Android apps like Viber, Whatsapp or fake Adobe Flash Player updates.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.redalert2", "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/red-alert-2-0-android-trojan-spreads-via-third-party-app-stores", "https://www.threatfabric.com/blogs/new_android_trojan_targeting_over_60_banks_and_social_apps.html" ], "synonyms": [], "type": [] }, "uuid": "e9aaab46-abb1-4390-b37b-d0457d05b28f", "value": "RedAlert2" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.remo", "https://cdn.prod.website-files.com/66fbdb04ee8bb0436308fc15/67cec4cfaddc1d68628d2ef6_CTM360%20Report_%20PlayPraetor%20Trojan%20-%20Clear%20TLP%20(2).pdf", "https://cyble.com/blog/new-remo-android-banking-trojan-targets-over-50-banking-applications-and-crypto-wallets/" ], "synonyms": [ "PlayPraetor" ], "type": [] }, "uuid": "74450154-9b2d-434c-b1d7-846bfb8d1de3", "value": "Remo" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.remrat", "https://blogs.360.cn/post/analysis-of-RemRAT.html" ], "synonyms": [], "type": [] }, "uuid": "23809a2b-3c24-41c5-a310-2b8045539202", "value": "RemRAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.residentbat", "https://rsf.org/sites/default/files/medias/file/2025/12/report1.pdf" ], "synonyms": [], "type": [] }, "uuid": "8f239014-c9ef-4e98-97d2-174f7c7de740", "value": "ResidentBat" }, { "description": "The Android app using for Retefe is a SMS stealer, used to forward mTAN codes to the threat actor. Further is a bank logo added to the specific Android app to trick users into thinking this is a legitimate app. Moreover, if the victim is not a real victim, the link to download the APK is not the malicious APK, but the real 'Signal Private Messenger' tool, hence the victim's phone doesn't get infected.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.retefe", "http://maldr0id.blogspot.ch/2014/09/android-malware-based-on-sms-encryption.html", "http://blog.angelalonso.es/2015/11/reversing-sms-c-protocol-of-emmental.html", "http://blog.angelalonso.es/2017/02/hunting-retefe-with-splunk-some24.html", "http://blog.dornea.nu/2014/07/07/disect-android-apks-like-a-pro-static-code-analysis/", "http://blog.angelalonso.es/2015/10/reversing-c2c-http-emmental.html", "https://www.govcert.admin.ch/blog/33/the-retefe-saga" ], "synonyms": [], "type": [] }, "uuid": "22ef1e56-7778-41d1-9b2b-737aa5bf9777", "value": "Retefe (Android)" }, { "description": "According to PCrisk, Revive is the name of a banking Trojan targeting Android users (customers of a specific Spanish bank). It steals sensitive information. Cybercriminals use Revive to take ownership of online accounts using stolen login credentials. This malware abuses Accessibility Services to perform malicious activities.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.revive", "https://www.cleafy.com/cleafy-labs/revive-from-spyware-to-android-banking-trojan" ], "synonyms": [], "type": [] }, "uuid": "25669934-14bf-463f-bcae-c59c590c3bf8", "value": "Revive" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.riltok", "https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145", "https://securelist.com/mobile-banker-riltok/91374/" ], "synonyms": [], "type": [] }, "uuid": "d7b347f8-77a5-4197-b818-f3af504da2c1", "value": "Riltok" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.roaming_mantis", "https://securelist.com/roaming-mantis-dabbles-in-mining-and-phishing-multilingually/85607/", "https://systemweakness.com/a-strange-font-smishing-that-changes-behaviour-based-on-user-agent-and-abuses-duck-dns-1c1a45863ff7", "https://securelist.com/roaming-mantis-uses-dns-hijacking-to-infect-android-smartphones/85178/", "https://systemweakness.com/investigating-a-fake-mobile-payment-smishing-that-abuses-duck-dns-d07c72468ba8", "https://securelist.com/roaming-mantis-reaches-europe/105596/", "https://www.kashifali.ca/2021/05/05/roaming-mantis-amplifies-smishing-campaign-with-os-specific-android-malware/", "https://securelist.com/roaming-mantis-part-v/96250/", "https://hitcon.org/2019/CMT/slide-files/d2_s1_r1.pdf" ], "synonyms": [], "type": [] }, "uuid": "31d2ce1f-44bf-4738-a41d-ddb43466cd82", "value": "Roaming Mantis" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.rogue", "https://research.checkpoint.com/2021/going-rogue-a-mastermind-behind-android-malware-returns-with-a-new-rat/" ], "synonyms": [], "type": [] }, "uuid": "4b53480a-8006-4af7-8e4e-cc8727c62648", "value": "Rogue" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.rootnik", "https://blog.fortinet.com/2017/01/24/deep-analysis-of-android-rootnik-malware-using-advanced-anti-debug-and-anti-hook-part-i-debugging-in-the-scope-of-native-layer", "https://blog.fortinet.com/2017/01/26/deep-analysis-of-android-rootnik-malware-using-advanced-anti-debug-and-anti-hook-part-ii-analysis-of-the-scope-of-java" ], "synonyms": [], "type": [] }, "uuid": "db3dcfd1-79d2-4c91-898f-5f2463d7c417", "value": "Rootnik" }, { "description": "According to ANY.RUN, this is a banking trojan that this collection sensitive user information, including: Registered mobile number, Aadhaar number, PAN card details, Date of birth, and Net banking user ID and password. It uses Telegram as C2.\r\n", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.salvador", "https://any.run/cybersecurity-blog/salvador-stealer-malware-analysis/" ], "synonyms": [], "type": [] }, "uuid": "a815d079-3e70-4c51-9bf6-76217beb49fc", "value": "Salvador Stealer" }, { "description": "An Android ransomware that locks the device, changes the wallpaper, and demands money in exchange for unlocking the phone. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.sauron_locker", "https://twitter.com/LukasStefanko/status/1117795290155819008" ], "synonyms": [], "type": [] }, "uuid": "a7c058cf-d482-42cf-9ea7-d5554287ea65", "value": "Sauron Locker" }, { "description": "SharkBot is a piece of malicious software targeting Android Operating Systems (OSes). It is designed to obtain and misuse financial data by redirecting and stealthily initiating money transfers. SharkBot is particularly active in Europe (United Kingdom, Italy, etc.), but its activity has also been detected in the United States.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.sharkbot", "https://muha2xmad.github.io/malware-analysis/sharkbot/", "https://services.google.com/fh/files/blogs/gcat_threathorizons_full_jul2023.pdf", "https://research.checkpoint.com/2022/google-is-on-guard-sharks-shall-not-pass/", "https://blog.fox-it.com/2022/09/02/sharkbot-is-back-in-google-play/", "https://www.cleafy.com/cleafy-labs/sharkbot-a-new-generation-of-android-trojan-is-targeting-banks-in-europe", "https://blog.fox-it.com/2022/03/03/sharkbot-a-new-generation-android-banking-trojan-being-distributed-on-google-play-store/", "https://www.threatfabric.com/blogs/the-attack-of-the-droppers.html", "https://bin.re/blog/the-dgas-of-sharkbot/", "https://research.nccgroup.com/2022/03/03/sharkbot-a-new-generation-android-banking-trojan-being-distributed-on-google-play-store/" ], "synonyms": [], "type": [] }, "uuid": "7b20fdb1-5aee-4f17-a88e-bcd72c893f0a", "value": "SharkBot" }, { "description": "Shopper/LeifAccess is a malicious Android app that uses Android's AccessibilityService to secretly control the device. It installs apps, leaves fake reviews, opens ads, and even registers users on various platforms. Disguised as a system app, it collects personal and device information and sends it to remote servers. The malware was most active in late 2019, especially in Russia, Brazil, and India.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.shopper", "https://securelist.com/smartphone-shopaholic/95544/" ], "synonyms": [ "LeifAccess" ], "type": [] }, "uuid": "e48ccf61-6c7b-400a-8c7f-2e8f3421f32e", "value": "Shopper" }, { "description": "SideWinder involved a fake VPN app for Android devices published on Google Play Store along with a custom tool that filters victims for better targeting.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.sidewinder", "https://ti.qianxin.com/blog/articles/analysis-of-malware-android-software-spread-by-sidewinder-using-google-play/", "https://www.group-ib.com/blog/hunting-sidewinder/" ], "synonyms": [], "type": [] }, "uuid": "af929cac-e0c6-4a63-ac5a-02c4cbbab746", "value": "SideWinder (Android)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.silkbean", "https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf" ], "synonyms": [], "type": [] }, "uuid": "00ab3d3b-dbbf-40de-b3d8-a3466704a1a7", "value": "SilkBean" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.skygofree", "https://securelist.com/skygofree-following-in-the-footsteps-of-hackingteam/83603/" ], "synonyms": [], "type": [] }, "uuid": "f5fded3c-8f45-471a-a372-d8be101e1b22", "value": "Skygofree" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.slempo", "https://www.fireeye.com/blog/threat-research/2015/12/slembunk_an_evolvin.html", "https://www.pcworld.com/article/3035725/source-code-for-powerful-android-banking-malware-is-leaked.html" ], "synonyms": [ "SlemBunk" ], "type": [] }, "uuid": "d87e2574-7b9c-4ea7-98eb-88f3e139f6ff", "value": "Slempo" }, { "description": "Slocker also known as jisut and pigetrl, is a screen locker that is distributed through telegram groups.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.slocker", "https://labs.bitdefender.com/2020/05/android-slocker-variant-uses-coronavirus-scare-to-take-android-hostage/", "https://www.bitdefender.com/en-us/blog/labs/android-slocker-variant-uses-coronavirus-scare-to-take-android-hostage", "https://blog.trendmicro.com/trendlabs-security-intelligence/slocker-mobile-ransomware-starts-mimicking-wannacry/" ], "synonyms": [ "Jisut", "Simple Locker" ], "type": [] }, "uuid": "fe187c8a-25d4-4d30-bd43-efca18d527f0", "value": "Slocker" }, { "description": "SMSAgent appears as a game application, but silently performs malicious routines in the background. It attempts to download other potentially malicious files from a remote server and sends out SMS or MMS messages that places expensive charges on the user's bill.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.smsagent", "https://blog.alyac.co.kr/2128", "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/moqhao-related-android-spyware-targeting-japan-and-korea-found-on-google-play/" ], "synonyms": [], "type": [] }, "uuid": "ee42986c-e736-4092-a2f9-2931a02c688d", "value": "SmsAgent" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.smsspy" ], "synonyms": [], "type": [] }, "uuid": "7a38c552-0e1a-4980-8d62-1aa38617efab", "value": "SMSspy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.soumnibot", "https://securelist.com/soumnibot-android-banker-obfuscates-app-manifest/112334/" ], "synonyms": [], "type": [] }, "uuid": "ed53cdaf-0649-4ca5-adcd-592a46f79da8", "value": "SoumniBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.sova", "https://cryptax.medium.com/eyes-on-android-s-o-v-a-botnet-sample-fb5ed332d08", "https://blog.cyble.com/2021/09/14/deep-dive-analysis-of-s-o-v-a-android-banking-trojan/", "https://liansecurity.com/#/main/news/RWt_ZocBrFZDfCElFqw_/detail", "https://www.threatfabric.com/blogs/sova-new-trojan-with-fowl-intentions.html", "https://blog.cyble.com/2023/03/09/nexus-the-latest-android-banking-trojan-with-sova-connections", "https://www.cleafy.com/cleafy-labs/sova-malware-is-back-and-is-evolving-rapidly", "https://muha2xmad.github.io/malware-analysis/sova/" ], "synonyms": [], "type": [] }, "uuid": "2aa95661-b63a-432e-8e5e-74ac93b42d57", "value": "S.O.V.A." }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.spybanker", "https://news.drweb.com/show/?i=11104&lng=en", "http://www.welivesecurity.com/2017/02/23/released-android-malware-source-code-used-run-banking-botnet/" ], "synonyms": [], "type": [] }, "uuid": "e186384b-8001-4cdd-b170-1548deb8bf04", "value": "SpyBanker" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.spyc23", "https://www.welivesecurity.com/2020/09/30/aptc23-group-evolves-its-android-spyware/" ], "synonyms": [], "type": [] }, "uuid": "8fb4910f-e645-4465-a202-a20835416c87", "value": "SpyC23" }, { "description": "A sophisticated mobile surveillance implant operating as a Remote Control System (RCS). This malware family is characterized by a unique, multi-sided communication architecture that abandons traditional HTTP polling. Instead, it hybridizes Firebase Cloud Messaging (FCM) for asynchronous command signaling with Fast Reverse Proxy (FRP) to establish persistent, NAT-bypassing network tunnels, effectively turning the infected mobile device into a server accessible by the attacker.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.spyfrptunnel", "https://cert.pl/posts/2026/03/analiza-fvncbot/", "https://medium.com/@ireneusz.tarnowski/operational-analysis-of-communication-channels-in-mobile-rcs-437f9aad5653" ], "synonyms": [ "fvncBot" ], "type": [] }, "uuid": "66936fd7-8cd9-4968-b78f-0c1de91c747e", "value": "SpyFRPTunnel" }, { "description": "SpyMax is a popular Android surveillance tool. Its predecessor, SpyNote, was one of the most widely used spyware frameworks.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.spymax", "https://labs.k7computing.com/index.php/spymax-a-fake-wedding-invitation-app-targeting-indian-mobile-users/", "https://www.threatfabric.com/blogs/spynote-rat-targeting-financial-institutions", "https://twitter.com/malwrhunterteam/status/1250412485808717826", "https://www.mobile-hacker.com/2025/06/05/analysis-of-spyware-that-helped-to-compromise-a-syrian-army-from-within/#google_vignette", "https://www.zscaler.com/blogs/research/android-spyware-targeting-tanzania-premier-league", "https://www.group-ib.com/blog/craxs-rat-malware/", "https://www.threatfabric.com/blogs/spynote-rat-targeting-financial-institutions.html", "https://www.stratosphereips.org/blog/2020/11/10/android-mischief-rats-dataset" ], "synonyms": [], "type": [] }, "uuid": "e1dfb554-4c17-4d4c-ac48-604c48d8ab0b", "value": "SpyMax" }, { "description": "According to Cleafy, SpyNote abuses Accessibility services and other Android permissions in order to: Collect SMS messages and contacts list; Record audio and screen; Perform keylogging activities; Bypass 2FA; Track GPS locations.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.spynote", "https://www.threatfabric.com/blogs/spynote-rat-targeting-financial-institutions", "https://docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc/edit#heading=h.hcd1wvpsrgfr", "https://dti.domaintools.com/newly-registered-domains-distributing-spynote-malware/", "https://www.intrinsec.com/prospero-proton66-tracing-uncovering-the-links-between-bulletproof-networks/", "https://cocomelonc.github.io/book/2025/05/19/aiya-mmd-book.html", "https://mp.weixin.qq.com/s/J_A12SOX0k5TOYFAegBv_w", "https://www.civilsphereproject.org/blog/2021/9/21/capturing-and-detecting-androidtester-remote-access-trojan-with-the-emergency-vpn", "https://cryptax.medium.com/android-spynote-bypasses-restricted-settings-breaks-many-re-tools-8791b3e6bf38", "https://labs.k7computing.com/index.php/spynote-an-android-snooper/", "https://medium.com/@mvaks/analysis-of-malicious-mobile-applications-impersonating-popular-polish-apps-olx-allegro-iko-7dab879a320d", "https://mp.weixin.qq.com/s/mstwBMkS0G3Et4GOji2mwA", "https://www.volexity.com/blog/2020/03/31/storm-cloud-unleashed-tibetan-community-focus-of-highly-targeted-fake-flash-campaign/", "https://www.intrinsec.com/wp-content/uploads/2024/11/TLP-CLEAR-PROSPERO-Proton66-Uncovering-the-links-between-bulletproof-networks.pdf", "https://hunt.io/blog/inside-a-cybercriminal-s-server-ddos-tools-spyware-apks-and-phishing-pages", "https://www.bleepingcomputer.com/news/security/spynote-android-malware-infections-surge-after-source-code-leak/", "https://labs.k7computing.com/index.php/spynote-targets-irctc-users/", "https://www.group-ib.com/blog/craxs-rat-malware/", "https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/", "https://www.fortinet.com/blog/threat-research/android-spynote-moves-to-crypto-currencies", "https://medium.com/@ireneusz.tarnowski/spynote-d7d0f31ec697", "https://ti.qianxin.com/blog/articles/Blade-hawk-The-activities-of-targeted-the-Middle-East-and-West-Asia-are-exposed/", "https://intel471.com/blog/china-cybercrime-undergrond-deepmix-tea-horse-road-great-firewall/", "https://hunt.io/blog/caught-in-the-act-uncovering-spynote-in-unexpected-places", "https://bulldogjob.pl/articles/1200-an-in-depth-analysis-of-spynote-remote-access-trojan", "https://www.cleafy.com/cleafy-labs/spynote-continues-to-attack-financial-institutions", "https://www.threatfabric.com/blogs/spynote-rat-targeting-financial-institutions.html" ], "synonyms": [ "CypherRat" ], "type": [] }, "uuid": "31592c69-d540-4617-8253-71ae0c45526c", "value": "SpyNote" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.stealthagent", "https://www.amnesty.org/download/Documents/ASA3383662018ENGLISH.PDF" ], "synonyms": [], "type": [] }, "uuid": "0777cb30-534f-44bb-a7af-906a422bd624", "value": "StealthAgent" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.stealthmango", "https://www.lookout.com/info/stealth-mango-report-ty", "https://www.lookout.com/blog/stealth-mango" ], "synonyms": [], "type": [] }, "uuid": "7d480f11-3de8-463d-8a19-54685c8b9e0f", "value": "Stealth Mango" }, { "description": "According to ThreatFabric, Sturnus is a privately operated Android banking trojan. This malware supports a broad range of fraud-related capabilities, including full device takeover. A key differentiator is its ability to bypass encrypted messaging. By capturing content directly from the device screen after decryption, Sturnus can monitor communications via WhatsApp, Telegram, and Signal.\r\n\r\nThe trojan can harvest banking credentials through convincing fake login screens that replicate legitimate banking apps. In addition, it provides attackers with extensive remote control, enabling them to observe all user activity, inject text without physical interaction, and even black out the device screen while executing fraudulent transactions in the background\u2014without the victim\u2019s knowledge.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.sturnus", "https://www.threatfabric.com/blogs/sturnus-banking-trojan-bypassing-whatsapp-telegram-and-signal" ], "synonyms": [], "type": [] }, "uuid": "5bd9ebca-e0dd-4d68-8ac9-7a384415d6e2", "value": "Sturnus" }, { "description": "Svpeng is a malicious banking trojan targeting Android devices, and it poses a significant threat to both mobile users and the developers of mobile banking apps. Svpeng has been active since around 2013. It primarily targets Android users, and its main objective is to steal sensitive financial information, particularly login credentials and personal data related to banking and financial apps. Svpeng typically spreads through malicious apps, phishing campaigns, or drive-by downloads.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.svpeng", "https://securelist.com/a-new-era-in-mobile-banking-trojans/79198/", "https://securelist.com/mobile-malware-evolution-2019/96280/" ], "synonyms": [], "type": [] }, "uuid": "d99c0a47-9d61-4d92-86ec-86a87b060d76", "value": "Svpeng" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.switcher", "https://securelist.com/blog/mobile/76969/switcher-android-joins-the-attack-the-router-club/" ], "synonyms": [], "type": [] }, "uuid": "e3e90666-bc19-4741-aca8-1e4cbc2f4c9e", "value": "Switcher" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.talent_rat", "https://twitter.com/LukasStefanko/status/1118066622512738304", "https://www.secureworks.com/research/threat-profiles/platinum-terminal" ], "synonyms": [ "Assassin RAT" ], "type": [] }, "uuid": "46151a0d-aa0a-466c-9fff-c2c3474f572e", "value": "TalentRAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.tangle_bot", "https://www.proofpoint.com/us/blog/threat-insight/mobile-malware-tanglebot-untangled", "https://www.cleafy.com/cleafy-labs/medusa-reborn-a-new-compact-variant-discovered" ], "synonyms": [], "type": [] }, "uuid": "1e37d712-df02-48aa-82fc-28fa80c92c2b", "value": "TangleBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.telerat", "https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/" ], "synonyms": [], "type": [] }, "uuid": "e1600d04-d2f7-4862-8bbc-0f038ea683ea", "value": "TeleRAT" }, { "description": "Tempting cedar spyware is an Android spyware campaign, active since at least 2015, that used social engineering via fake, attractive Facebook profiles to trick victims into downloading malware. The spyware was designed to steal a wide range of sensitive personal data.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.tempting_cedar", "https://blog.avast.com/avast-tracks-down-tempting-cedar-spyware" ], "synonyms": [], "type": [] }, "uuid": "982c3554-1df2-4062-8f32-f311940ad9ff", "value": "TemptingCedar Spyware" }, { "description": "According to Trend Micro, TgToxic has been used in an ongoing campaign that has been targeting Android users in Southeast Asia since July 2022. Goal of the campaign is to steal victims\u2019 assets from finance and banking applications (such as cryptocurrency wallets, credentials for official bank apps on mobile, and money in deposit), via a banking trojan they named TgToxic (based on its special encrypted filename) embedded in multiple fake apps. While previously targeting users in Taiwan, Trend Micro observed the fraudulent activities and phishing lures targeting users from Thailand and Indonesia as of this writing. Users are advised to be wary of opening embedded links from unknown email and message senders, and to avoid downloading apps from third party platforms.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.tgtoxic", "https://www.bitsight.com/blog/toxicpanda-android-banking-malware-2025-study", "https://www.trendmicro.com/en_us/research/23/b/tgtoxic-malware-targets-southeast-asia-android-users.html", "https://intel471.com/blog/android-trojan-tgtoxic-updates-its-capabilities" ], "synonyms": [], "type": [] }, "uuid": "06e9c140-c0de-4abe-97c3-4b0e985114bd", "value": "TgToxic" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.thiefbot", "https://business.xunison.com/thiefbot-a-new-android-banking-trojan-targeting-turkish-banking-users/" ], "synonyms": [], "type": [] }, "uuid": "5863d2eb-920d-4263-8c4b-7a16d410ff89", "value": "ThiefBot" }, { "description": "According to Trend Micro, this malware appears to have been designed to steal credentials associated with membership websites of major Japanese telecommunication services.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.tianyspy", "https://www.trendmicro.com/en_us/research/22/a/tianyspy-malware-uses-smishing-disguised-as-message-from-telco.html" ], "synonyms": [], "type": [] }, "uuid": "8260dda5-f608-48f2-9341-28dbc5a8e895", "value": "TianySpy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.tinyz", "http://blog.group-ib.com/cron" ], "synonyms": [ "Catelites Android Bot", "MarsElite Android Bot" ], "type": [] }, "uuid": "93b27a50-f9b7-4ab6-bb9f-70a4b914eec3", "value": "TinyZ" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.titan", "https://www.alienvault.com/blogs/labs-research/delivery-keyboy", "https://blog.lookout.com/titan-mobile-threat" ], "synonyms": [], "type": [] }, "uuid": "7d418da3-d9d2-4005-8cc7-7677d1b11327", "value": "Titan" }, { "description": "ToxicPanda is an Android banking RAT first identified by Cleafy in October 2024. It shows similarity to the TgToxic campaign, but appears to be a new development rather than a derivative. The threat actors are likely Chinese speakers. ToxicPanda initially made use of hardcoded C2 domains only, but started to incorporate a DGA in late 2024.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.toxic_panda", "https://www.bitsight.com/blog/toxicpanda-android-banking-malware-2025-study", "https://www.cleafy.com/cleafy-labs/toxicpanda-a-new-banking-trojan-from-asia-hit-europe-and-latam" ], "synonyms": [], "type": [] }, "uuid": "7ac4865d-dc9d-468e-a462-67dfc63d118b", "value": "ToxicPanda" }, { "description": "Triada is a remote access trojan (RAT) malware that is used to compromise Android devices in order to steal confidential and sensitive information such as credit card numbers, passwords, bank account information, etc. It also provides a backdoor for attackers to include the device as part of a botnet and perform other malicious activities.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.triada", "https://blog.checkpoint.com/2016/06/17/in-the-wild-mobile-malware-implements-new-features/", "https://securelist.com/triada-trojan-in-whatsapp-mod/103679/", "https://www.nowsecure.com/blog/2016/11/21/android-malware-analysis-radare-triada-trojan/", "https://security.googleblog.com/2019/06/pha-family-highlights-triada.html", "https://securelist.com/apkpure-android-app-store-infected/101845/", "https://arstechnica.com/information-technology/2019/06/google-confirms-2017-supply-chain-attack-that-sneaked-backdoor-on-android-devices/", "https://securelist.com/mobile-malware-evolution-2019/96280/", "https://securelist.com/attack-on-zygote-a-new-twist-in-the-evolution-of-mobile-threats/74032/", "http://contagiominidump.blogspot.de/2016/07/android-triada-modular-trojan.html", "https://securelist.com/everyone-sees-not-what-they-want-to-see/74997/" ], "synonyms": [], "type": [] }, "uuid": "fa5fdfd2-8142-43f5-9b48-d1033b5398c8", "value": "Triada" }, { "description": "TrickMo is an advanced banking trojan for Android. Starting out as a companion malware to TrickBot in 2020, it first became a standalone banking trojan by addition of overlay attacks in 2021 and was later (2024) upgraded with remote control capabilities for on-device fraud. The continued development and progressively improved obfuscation suggests an active Threat Actor.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.trickmo", "https://www.threatfabric.com/blogs/new-trickmo-variant-device-take-over-malware-targeting-banking-fintech-wallet-auth-app", "https://www.zimperium.com/blog/expanding-the-investigation-deep-dive-into-latest-trickmo-samples/", "https://medium.com/@mvaks/analysis-of-malicious-mobile-applications-impersonating-popular-polish-apps-olx-allegro-iko-7dab879a320d", "https://securityintelligence.com/posts/trickbot-pushing-a-2fa-bypass-app-to-bank-customers-in-germany/", "https://cyble.com/blog/trickmos-return-banking-trojan-resurgence-with-new-features/", "https://www.cleafy.com/cleafy-labs/a-new-trickmo-saga-from-banking-trojan-to-victims-data-leak" ], "synonyms": [], "type": [] }, "uuid": "cff89ce1-a133-48a6-b8bd-e4f97cf23d6a", "value": "TrickMo" }, { "description": "Bitdefender described Triout as a Android spyware, which appears to act as a framework for building extensive surveillance capabilities into seemingly benign applications. Found bundled with a repackaged app, the spyware\u2019s surveillance capabilities involve hiding its presence on the device, recording phone calls, logging incoming text messages, recoding videos, taking pictures and collecting GPS coordinates, then broadcasting all of that to an attacker-controlled C&C (command and control) server.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.triout" ], "synonyms": [], "type": [] }, "uuid": "bd9ce51c-53f9-411b-b46a-aba036c433b1", "value": "Triout" }, { "description": "According to Cyble, this is a banking trojan that targets over 750 applications globally, including banking, finance, cryptocurrency, and e-commerce apps. The malware spreads via phishing sites masquerading as legitimate financial platforms and is installed through a dropper disguised as Google Play Services. It uses overlay attacks to steal banking credentials, credit card details, and login credentials by displaying fake login pages over legitimate apps. TsarBot can record and remotely control the screen, executing fraud by simulating user actions such as swiping, tapping, and entering credentials while hiding malicious activities using a black overlay screen. It captures device lock credentials using a fake lock screen to gain full control. TsarBot communicates with its C&C server using WebSocket across multiple ports to receive commands, send stolen data, and dynamically execute on-device fraud.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.tsarbot", "https://cyble.com/blog/tsarbot-using-overlay-attacks-targeting-bfsi-sector/" ], "synonyms": [], "type": [] }, "uuid": "58f59789-6677-403e-8af4-e7a8c7a4cb4b", "value": "TsarBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.ultima_sms", "https://blog.avast.com/premium-sms-scam-apps-on-play-store-avast" ], "synonyms": [], "type": [] }, "uuid": "65476d5f-321f-4385-867a-383094cadb58", "value": "UltimaSMS" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.unidentified_001", "https://www.welivesecurity.com/2017/02/14/new-android-trojan-mimics-user-clicks-download-dangerous-malware/" ], "synonyms": [], "type": [] }, "uuid": "bbd5a32e-a080-4f16-98ea-ad8863507aa6", "value": "Unidentified APK 001" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.unidentified_002" ], "synonyms": [], "type": [] }, "uuid": "afb6a7cc-4185-4f19-8ad4-45dcbb76e544", "value": "Unidentified APK 002" }, { "description": "According to Check Point Research, this is a RAT that is disguised as a set of dating apps like \"GrixyApp\", \"ZatuApp\", \"Catch&See\", including dedicated websites to conceal their malicious purpose.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.unidentified_004", "https://research.checkpoint.com/2020/hamas-android-malware-on-idf-soldiers-this-is-how-it-happened/" ], "synonyms": [], "type": [] }, "uuid": "55626b63-4b9a-468e-92ae-4b09b303d0ed", "value": "Unidentified APK 004" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.unidentified_005" ], "synonyms": [], "type": [] }, "uuid": "5413ca94-1385-40c0-8eb2-1fc3aff87fb1", "value": "Unidentified APK 005" }, { "description": "Information stealer posing as a fake banking app, targeting Korean users.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.unidentified_006", "https://twitter.com/MsftSecIntel/status/1441524497924833282?s=20", "https://blog.cyble.com/2021/09/17/sophisticated-spyware-posing-as-a-banking-application-to-target-korean-users/", "https://twitter.com/ReBensk/status/1438027183490940931", "https://medium.com/@ThreatMiner/android-trojan-targeting-korean-demographic-using-github-for-c2-8219fc39f749" ], "synonyms": [], "type": [] }, "uuid": "2263198d-af38-4e38-a7a8-4435d29d88e8", "value": "Unidentified APK 006" }, { "description": "According to Cyble, this is an Android application that pretends to be the legitimate application for the Army Mobile Aadhaar App Network (ARMAAN), intended to be used by Indian army personnel. The application was customized to include RAT functionality.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.unidentified_007", "https://blog.cyble.com/2022/01/28/indian-army-personnel-face-remote-access-trojan-attacks/" ], "synonyms": [], "type": [] }, "uuid": "75c641c4-17df-43c4-9773-c27464c5d2ff", "value": "Unidentified 007 (ARMAAN RAT)" }, { "description": "Android malware distributed through fake shopping websites targeting Malaysian users, targeting banking information.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.unidentified_008", "https://www.welivesecurity.com/2022/04/06/fake-eshops-prowl-banking-credentials-android-malware/" ], "synonyms": [], "type": [] }, "uuid": "2ffddca0-841c-4eb6-9983-ff38abb5d6d6", "value": "Unidentified APK 008" }, { "description": "According to Google, a Chrome reconnaissance payload", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.unidentified_009", "https://blog.google/threat-analysis-group/state-backed-attackers-and-commercial-surveillance-vendors-repeatedly-use-the-same-exploits/" ], "synonyms": [], "type": [] }, "uuid": "6d3bcabe-6b3a-49c1-b1a9-2239ce06deae", "value": "Unidentified APK 009 (Chrome Recon)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.vajraspy", "https://twitter.com/malwrhunterteam/status/1481312752782258176", "https://mp.weixin.qq.com/s/B0ElRhbqLzs-wGQh79fTww", "https://twitter.com/LukasStefanko/status/1509451238366236674" ], "synonyms": [], "type": [] }, "uuid": "c328b30f-e076-47dc-8c93-4d20f62c72ab", "value": "VajraSpy" }, { "description": "Related to the micropsia windows malware and also sometimes named micropsia.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.vamp", "https://unit42.paloaltonetworks.com/unit42-targeted-attacks-middle-east-using-kasperagent-micropsia/" ], "synonyms": [ "android.micropsia" ], "type": [] }, "uuid": "1ad5b462-1b0d-4c2f-901d-ead6c9f227bc", "value": "vamp" }, { "description": "According to Mandiant, VINETHORN is an Android malware family capable of a wide range of backdoor functionality. It can steal system information, read SMS inboxes, send SMS messages, access contact lists and call histories, record audio and video, and track device location via GPS.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.vinethorn", "https://www.mandiant.com/media/17826", "https://socradar.io/dark-web-profile-apt42-iranian-cyber-espionage-group/" ], "synonyms": [], "type": [] }, "uuid": "6da6dfb6-2c50-465c-9394-26695d72e8c7", "value": "VINETHORN" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.viper_rat", "https://about.fb.com/wp-content/uploads/2021/04/Technical-threat-report-Arid-Viper-April-2021.pdf", "https://securelist.com/blog/incidents/77562/breaking-the-weakest-link-of-the-strongest-chain/", "https://blog.lookout.com/blog/2017/02/16/viperrat-mobile-apt/" ], "synonyms": [], "type": [] }, "uuid": "3482f5fe-f129-4c77-ae98-76e25f6086b9", "value": "Viper RAT" }, { "description": "According to Xlab, this malware is used to compromise Android TVs and set-top boxes, and its corresponding botnet had more than 1 million nodes observed via sinkholing (Jan 2025).", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.vo1d", "https://news.drweb.com/show/?i=14900", "https://blog.xlab.qianxin.com/long-live-the-vo1d_botnet/" ], "synonyms": [], "type": [] }, "uuid": "7e068dd0-5fc4-4c46-8766-09258654934a", "value": "vo1d" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.vultur", "https://twitter.com/_icebre4ker_/status/1485651238175846400", "https://embeeresearch.io/infrastructure-tracking-locating-vultur-domains-with-passive-dns/", "https://www.threatfabric.com/blogs/vultur-v-for-vnc.html", "https://www.cleafy.com/cleafy-labs/the-android-malwares-journey-from-google-play-to-banking-fraud", "https://blog.fox-it.com/2024/03/28/android-malware-vultur-expands-its-wingspan", "https://www.threatfabric.com/blogs/the-attack-of-the-droppers.html" ], "synonyms": [ "Vulture" ], "type": [] }, "uuid": "49b1c344-ce13-48bf-9839-909ba57649c4", "value": "Vultur" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.wirex", "https://therecord.media/turkish-national-charged-for-ddos-attacks-with-the-wirex-botnet/", "https://www.flashpoint-intel.com/blog/wirex-botnet-industry-collaboration/", "https://www.justice.gov/usao-ndil/pr/federal-indictment-chicago-charges-turkish-national-directing-cyber-attack", "https://krebsonsecurity.com/2017/08/tech-firms-team-up-to-take-down-wirex-android-ddos-botnet/" ], "synonyms": [], "type": [] }, "uuid": "77f2254c-9886-4eed-a7c3-bbcef4a97d46", "value": "WireX" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.wolf_rat", "https://blog.talosintelligence.com/2020/05/the-wolf-is-back.html", "https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html" ], "synonyms": [], "type": [] }, "uuid": "994c7bb3-ba40-41bb-89b3-f05996924b10", "value": "WolfRAT" }, { "description": "According to Avira, this is a banking trojan targeting Japan.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.wroba", "https://www.avira.com/en/blog/the-android-banking-trojan-wroba-shifts-attack-from-south-korea-to-target-users-in-japan", "https://securelist.com/roaming-mantis-reaches-europe/105596/" ], "synonyms": [], "type": [] }, "uuid": "40a5d526-ef9f-4ddf-a326-6f33dceeeebc", "value": "Wroba" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.wyrmspy", "https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack", "https://www.lookout.com/threat-intelligence/article/wyrmspy-dragonegg-surveillanceware-apt41", "https://cryptax.medium.com/organizing-malware-analysis-with-colander-example-on-android-wyrmspy-1f3ec30ae33b" ], "synonyms": [ "AndroidControl" ], "type": [] }, "uuid": "77f81373-bb3a-449d-82ff-b28fe31acef6", "value": "WyrmSpy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.xbot", "https://researchcenter.paloaltonetworks.com/2016/02/new-android-trojan-xbot-phishes-credit-cards-and-bank-accounts-encrypts-devices-for-ransom/", "https://blog.avast.com/2015/02/17/angry-android-hacker-hides-xbot-malware-in-popular-application-icons/" ], "synonyms": [], "type": [] }, "uuid": "4cfa42a3-71d9-43e2-bf23-daa79f326387", "value": "Xbot" }, { "description": "Xenomorph is a Android Banking RAT developed by the Hadoken.Security actor.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.xenomorph", "https://www.threatfabric.com/blogs/xenomorph-a-newly-hatched-banking-trojan.html", "https://www.threatfabric.com/blogs/bugdrop-new-dropper-bypassing-google-security-measures.html", "https://www.zscaler.com/blogs/security-research/rise-banking-trojan-dropper-google-play-0", "https://cryptax.medium.com/unpacking-a-jsonpacker-packed-sample-4038e12119f5", "https://www.threatfabric.com/blogs/xenomorph-v3-new-variant-with-ats.html", "https://www.threatfabric.com/blogs/zombinder-ermac-and-desktop-stealers.html" ], "synonyms": [], "type": [] }, "uuid": "d202e42d-2c35-4c1c-90f1-644a8cae38f1", "value": "Xenomorph" }, { "description": "Xhelper is a very persistent malware that can reinstall itself after factory reset, Xhelper downloads malicious apps and displays annoying ads. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.xhelper", "https://securelist.com/unkillable-xhelper-and-a-trojan-matryoshka/96487/" ], "synonyms": [], "type": [] }, "uuid": "f54dec1f-bec6-4f4a-a909-690d65e0f14b", "value": "xHelper" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.xploitspy", "https://twitter.com/malwrhunterteam/status/1249768400806653952", "https://www.welivesecurity.com/en/eset-research/exotic-visit-campaign-tracing-footprints-virtual-invaders/" ], "synonyms": [], "type": [] }, "uuid": "57600f52-b55f-49c7-9c0c-de10b2d23370", "value": "XploitSPY" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.xrat", "https://asec.ahnlab.com/en/59590/", "https://blog.lookout.com/xrat-mobile-threat", "https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_202_niwa-yanagishita_en.pdf" ], "synonyms": [], "type": [] }, "uuid": "a8f167a8-30b9-4953-8eb6-247f0d046d32", "value": "XRat" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.yellyouth", "https://www.mulliner.org/blog/blosxom.cgi/security/yellyouth_android_malware.html" ], "synonyms": [], "type": [] }, "uuid": "a2dad59d-2355-415c-b4d6-62236d3de4c7", "value": "YellYouth" }, { "description": "According to cyware, Zanubis malware pretends to be a malicious PDF application. The threat actor uses it as a key to decrypt responses received from the C2 server.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.zanubis", "https://labs.k7computing.com/index.php/an-upsurge-of-new-android-banking-trojan-zanubis/" ], "synonyms": [], "type": [] }, "uuid": "cebf13e5-dbfc-49d6-8715-e3b7687d386f", "value": "Zanubis" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.zen", "https://security.googleblog.com/2019/01/pha-family-highlights-zen-and-its.html" ], "synonyms": [], "type": [] }, "uuid": "46d6d102-fc38-46f7-afdc-689cafe13de5", "value": "Zen" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.zoopark", "https://securelist.com/whos-who-in-the-zoo/85394", "https://securelist.com/apt-trends-report-q2-2019/91897/", "https://securelist.com/whos-who-in-the-zoo/85394/", "https://www.secureworks.com/research/threat-profiles/cobalt-juno", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/05/03114450/ZooPark_for_public_final_edit.pdf" ], "synonyms": [], "type": [] }, "uuid": "b1fc66de-fda7-4f0c-af00-751d334444b3", "value": "ZooPark" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.ztorg", "https://blog.fortinet.com/2017/03/15/teardown-of-a-recent-variant-of-android-ztorg-part-1", "https://securelist.com/ztorg-from-rooting-to-sms/78775/", "http://blog.fortinet.com/2017/03/08/teardown-of-android-ztorg-part-2" ], "synonyms": [ "Qysly" ], "type": [] }, "uuid": "9fbf97c0-d87a-47b0-a511-0147a58b5202", "value": "Ztorg" }, { "description": "According to Microsoft, this is a web shell, written in ASPX supporting C#, carrying sufficient yet rudimentary functionality to support the following secondary activities: uploading and downloading files, running shell commands, opening a port (default port is set to TCP 250).", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/asp.localolive", "https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/" ], "synonyms": [], "type": [] }, "uuid": "96224956-2167-4c19-abc9-dd901043d485", "value": "LocalOlive" }, { "description": "WebShell.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/asp.nightrunner", "https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/" ], "synonyms": [], "type": [] }, "uuid": "b0206aac-30ff-41ce-b7d4-1b94ab15e3b1", "value": "Nightrunner" }, { "description": "WebShell.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/asp.tunna", "https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/", "https://research.checkpoint.com/2023/from-albania-to-the-middle-east-the-scarred-manticore-is-listening/" ], "synonyms": [], "type": [] }, "uuid": "b057f462-dc32-4f7b-95e0-98a20a48f2b2", "value": "Tunna" }, { "description": "According to Unit42, TwoFace is a two-staged (loader+payload) webshell, written in C# and meant to run on webservers with ASP.NET. The author of the initial loader webshell included legitimate and expected content that will be displayed if a visitor accesses the shell in a browser, likely to remain undetected. The code in the loader webshell includes obfuscated variable names and the embedded payload is encoded and encrypted. To interact with the loader webshell, the threat actor uses HTTP POST requests to the compromised server.\r\n\r\nThe secondary webshell, which we call the payload, is embedded within the loader in encrypted form and contains additional functionality that we will discuss in further detail. When the threat actor wants to interact with the remote server, they provide data that the loader will use to modify a decryption key embedded within the loader that will be in turn used to decrypt the embedded TwoFace payload. Commands supported by the payload are execution of programs, up-, download and deletion of files and capability to manipulate MAC timestamps.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/asp.twoface", "https://www.cyber.gov.au/sites/default/files/2020-06/ACSC-Advisory-2020-008-Copy-Paste-Compromises.pdf", "https://www.youtube.com/watch?time_continue=1333&v=1CGAmjAV8nI", "https://go.recordedfuture.com/hubfs/reports/mtp-2021-1214.pdf", "https://www.youtube.com/watch?v=GjquFKa4afU", "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/incident-response-polar-ransomware-apt27/", "https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1536345486.pdf", "https://unit42.paloaltonetworks.com/atoms/evasive-serpens/", "https://www.zdnet.com/article/source-code-of-iranian-cyber-espionage-tools-leaked-on-telegram/", "https://go.recordedfuture.com/hubfs/reports/cta-2020-0312.pdf", "https://unit42.paloaltonetworks.com/unit42-twoface-webshell-persistent-access-point-lateral-movement/", "https://web.archive.org/web/20200307113010/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1574947864.pdf", "https://www.recordedfuture.com/full-spectrum-detections-five-popular-web-shells/", "https://cyware.com/blog/apt34-the-helix-kitten-cybercriminal-group-loves-to-meow-middle-eastern-and-international-organizations-48ae", "https://drive.google.com/file/d/1oA4YSwXLxEF-EXJcrM76Bc4_7ZfBGYE4/view", "https://www.secureworks.com/research/threat-profiles/cobalt-gypsy", "https://unit42.paloaltonetworks.com/unit42-oilrig-performs-tests-twoface-webshell/" ], "synonyms": [ "HighShell", "HyperShell", "Minion", "SEASHARPEE" ], "type": [] }, "uuid": "a98a04e5-1f86-44b8-91ff-dbe1534782ba", "value": "TwoFace" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/asp.unidentified_001" ], "synonyms": [], "type": [] }, "uuid": "d4318f40-a39a-4ce0-8d3c-246d9923d222", "value": "Unidentified ASP 001 (Webshell)" }, { "description": "This is a Linux malware program consisting of several modules, parts of which were likely programmed using AI. It consists of a rootkit and an agent capable of executing malicious code.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.1337_gtwk_rootkit", "https://medium.com/@prtheus/linux-malware-1337-gwtk-server-analysis-96e98ecca1fc", "https://medium.com/@prtheus/1337-gtwk-linux-malware-analysis-ac6157014521" ], "synonyms": [], "type": [] }, "uuid": "5034a631-56bb-4d50-a229-e92e51a30e9b", "value": "1337_GTWK" }, { "description": "3snake can be used to read and extract memory from sshd and sudo system calls which utilize password based authentication. 3snake does not write to the memory of the traced process but instead spawns a new process for the command to extract strings related to password based authentication.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.3snake", "https://medium.com/verint-cyber-engineering/linux-threat-hunting-primer-part-ii-69484f58ac92", "https://github.com/blendin/3snake" ], "synonyms": [], "type": [] }, "uuid": "0ae06f6d-db14-4256-b8d0-53f46fcc4345", "value": "3snake" }, { "description": "Abcbot is a modular Go-based botnet and malware that propagates via exploits and brute force attempts. The botnet was observed launching DDoS attacks, perform internet scans, and serve web pages. It is probably linked to Xanthe-based clipjacking campaign.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.abcbot", "https://www.cadosecurity.com/abcbot-an-evolution-of-xanthe/", "https://blog.netlab.360.com/abcbot_an_evolving_botnet_en/", "https://www.lacework.com/blog/abc-botnet-attacks-on-the-rise/", "https://www.cadosecurity.com/the-continued-evolution-of-abcbot/" ], "synonyms": [], "type": [] }, "uuid": "8d17175b-4e9f-43a9-851d-898bb6696984", "value": "Abcbot" }, { "description": "Family based on HelloKitty Ransomware. Encryption algorithm changed from AES to ChaCha. Sample seems to be unpacked.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.abyss", "https://www.bleepingcomputer.com/news/security/linux-version-of-abyss-locker-ransomware-targets-vmware-esxi-servers/", "https://idanmalihi.com/revealing-the-abyss-ransomware/" ], "synonyms": [ "elf.hellokitty" ], "type": [] }, "uuid": "302a96b1-73cb-4f70-a329-e68debd87bf8", "value": "Abyss Locker" }, { "description": "A Linux backdoor that was apparently ported to Windows. This entry represents the Linux version. This version appears to have been written first and the Windows version was ported later, without full functionality. The Linux version offers persistence as well as some process manipulation techniques, though both versions apparently offer the ability to access the command line and execute programs as well as self-update.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.acbackdoor", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf", "https://medium.com/@Ilandu/portdoor-malware-afc9d0796cba", "https://www.bleepingcomputer.com/news/security/linux-windows-users-targeted-with-new-acbackdoor-malware/" ], "synonyms": [], "type": [] }, "uuid": "cd2d7040-edc4-4985-b708-b206b08cc1fe", "value": "ACBackdoor (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.acidpour", "https://twitter.com/juanandres_gs/status/1769726024600768959", "https://www.trellix.com/blogs/research/pouring-acid-rain/" ], "synonyms": [], "type": [] }, "uuid": "11981e96-be46-4ce9-8085-af7224591951", "value": "AcidPour" }, { "description": "A MIPS ELF binary with wiper functionality used against Viasat KA-SAT modems.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.acidrain", "https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat", "https://www.youtube.com/watch?v=mrTdSdMMgnk", "https://www.techtimes.com/articles/273755/20220331/viasat-hit-russia-s-wiper-malware-called-acidrain-affecting-european.htm", "https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/", "https://www.reversemode.com/2022/03/viasat-incident-from-speculation-to.html", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war", "https://www.trellix.com/blogs/research/pouring-acid-rain/", "https://cybersecuritynews.com/acidrain-wiper-malware/", "https://cybersecurity.att.com/blogs/labs-research/analysis-on-recent-wiper-attacks-examples-and-how-they-wiper-malware-works", "https://www.splunk.com/en_us/blog/security/threat-update-acidrain-wiper.html", "https://www.splunk.com/en_us/blog/security/strt-ta03-cpe-destructive-software.html", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/", "https://www.bleepingcomputer.com/news/security/viasat-confirms-satellite-modems-were-wiped-with-acidrain-malware/" ], "synonyms": [], "type": [] }, "uuid": "6108aa3d-ea6e-47fd-9344-d333b07f5a56", "value": "AcidRain" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.age_locker", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://therecord.media/qnap-warns-of-agelocker-ransomware-attacks-against-nas-devices/", "https://twitter.com/IntezerLabs/status/1326880812344676352" ], "synonyms": [], "type": [] }, "uuid": "5d04aac3-fdf5-4922-9976-3a5a75e96e1a", "value": "AgeLocker" }, { "description": "According to Xlab, this is a DDoS bot.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.airashi", "https://blog.apnic.net/2025/03/13/botnets-never-die/", "https://krebsonsecurity.com/2025/05/krebsonsecurity-hit-with-near-record-6-3-tbps-ddos/", "https://blog.xlab.qianxin.com/large-scale-botnet-airashi/" ], "synonyms": [], "type": [] }, "uuid": "833056f7-9aae-4846-bc6c-e8a1b00c06b7", "value": "AIRASHI" }, { "description": "AirDropBot is used to create a DDoS botnet. It spreads as a worm, currently targeting Linksys routers. Backdoor and other bot functionality is present in this family. Development seems to be ongoing. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.airdrop", "https://blog.malwaremustdie.org/2019/09/mmd-0064-2019-linuxairdropbot.html" ], "synonyms": [ "CloudBot" ], "type": [] }, "uuid": "e91fcb82-e788-44cb-be5d-73b9601b9533", "value": "AirDropBot" }, { "description": "Honeypot-aware variant of Mirai.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.aisuru", "https://blog.xlab.qianxin.com/large-scale-botnet-airashi/", "https://blog.apnic.net/2025/03/13/botnets-never-die/", "https://blog.xlab.qianxin.com/super-large-scale-botnet-aisuru-en/", "https://krebsonsecurity.com/2025/05/krebsonsecurity-hit-with-near-record-6-3-tbps-ddos/", "https://www.forescout.com/blog/targeting-ot-security-ics-threats-malware/", "https://krebsonsecurity.com/2026/01/kimwolf-botnet-lurking-in-corporate-govt-networks/", "https://cybernews.com/security/steam-riot-gaming-services-hit-by-disruptions-ddos-suspected/", "https://insights.oem.avira.com/new-mirai-variant-aisuru-detects-cowrie-opensource-honeypots/", "https://www.bleepingcomputer.com/news/security/cloudflare-mitigates-new-record-breaking-222-tbps-ddos-attack/", "https://krebsonsecurity.com/2025/10/ddos-botnet-aisuru-blankets-us-isps-in-record-ddos/", "https://x.com/DarkWebInformer/status/1983679959924383956", "https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-local-network/", "https://blog.cloudflare.com/ddos-threat-report-2025-q4/", "https://synthient.com/blog/a-broken-system-fueling-botnets", "https://krebsonsecurity.com/2025/11/cloudflare-scrubs-aisuru-botnet-from-top-domains-list/", "https://krebsonsecurity.com/2026/01/who-benefited-from-the-aisuru-and-kimwolf-botnets/", "https://krebsonsecurity.com/2025/10/aisuru-botnet-shifts-from-ddos-to-residential-proxies/", "https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-july-to-december-2025/", "https://cyberch.com/posts/aisuru-botnet-shifts-from-ddos-to-residential-proxies/", "https://gist.github.com/heavyscientist/de6a7c14e68b5862734b94a3c10e574c", "https://krebsonsecurity.com/2026/01/who-operates-the-badbox-2-0-botnet/", "https://www.infoblox.com/blog/threat-intelligence/kimwolf-howls-from-inside-the-enterprise/", "http://blog.xlab.qianxin.com/kimwolf-botnet-en/" ], "synonyms": [], "type": [] }, "uuid": "e288425b-40f0-441e-977f-5f1264ed61b6", "value": "Aisuru" }, { "description": "Ransomware", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.akira", "https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/", "https://zensec.co.uk/blog/unmasking-akira-the-ransomware-tactics-you-cant-afford-to-ignore/", "https://arcticwolf.com/resources/blog/smash-and-grab-aggressive-akira-campaign-targets-sonicwall-vpns/", "https://arcticwolf.com/resources/blog/arctic-wolf-labs-observes-increased-fog-and-akira-ransomware-activity-linked-to-sonicwall-ssl-vpn/", "https://medium.com/@DCSO_CyTec/unransomware-from-zero-to-full-recovery-in-a-blink-8a47dd031df3", "https://tinyhack.com/2025/03/13/decrypting-encrypted-files-from-akira-ransomware-linux-esxi-variant-2024-using-a-bunch-of-gpus/", "https://www.security-chu.com/2025/05/entidades-negociando-con-el-grupo-akira-ransomware.html", "https://www.trellix.com/en-us/about/newsroom/stories/research/akira-ransomware.html", "https://labs.k7computing.com/index.php/akiras-play-with-linux/", "https://www.microsoft.com/en-us/security/blog/2023/10/11/automatic-disruption-of-human-operated-attacks-through-containment-of-compromised-user-accounts/", "https://www.loginsoft.com/post/akira-ransomware-the-evolution-of-a-major-threat", "https://research.checkpoint.com/2024/inside-akira-ransomwares-rust-experiment/", "https://malwareanalysisspace.blogspot.com/2025/03/akira-ransomware-expands-to-linux.html", "https://services.google.com/fh/files/misc/m-trends-2025-en.pdf" ], "synonyms": [ "REDBIKE" ], "type": [] }, "uuid": "365081b9-f60d-4484-befa-d4fc9d0f55d7", "value": "Akira (ELF)" }, { "description": "Backdoor deployed by the TrickBot actors. It uses DNS as the command and control channel as well as for exfiltration of data.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.anchor_dns", "https://hello.global.ntt/en-us/insights/blog/trickbot-variant-communicating-over-dns", "https://medium.com/stage-2-security/anchor-dns-malware-family-goes-cross-platform-d807ba13ca30", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/", "https://www.netscout.com/blog/asert/dropping-anchor", "https://www.domaintools.com/resources/blog/finding-anchordns-c2s-with-iris-investigate", "https://cyware.com/news/trickbots-anchordns-is-now-upgraded-to-anchormail-a21f5490/", "https://securityintelligence.com/posts/new-malware-trickbot-anchordns-backdoor-upgrades-anchormail/", "https://us-cert.cisa.gov/sites/default/files/publications/AA20-302A_Ransomware%20_Activity_Targeting_the_Healthcare_and_Public_Health_Sector.pdf", "https://mal-eats.net/2021/05/10/campo_new_attack_campaign_targeting_japan/" ], "synonyms": [], "type": [] }, "uuid": "b88dc3ec-d94c-4e6e-a846-5d07130df550", "value": "AnchorDNS" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.angryrebel", "https://cloud.google.com/blog/topics/threat-intelligence/threat-actors-exploit-react2shell-cve-2025-55182", "https://news.sophos.com/wp-content/uploads/2020/02/CloudSnooper_report.pdf", "https://www.secureworks.com/research/threat-profiles/bronze-olive" ], "synonyms": [ "Ghost RAT" ], "type": [] }, "uuid": "6cb47609-b03e-43d9-a4c7-8342f1011f3b", "value": "ANGRYREBEL" }, { "description": "According to Unit 42, Auto-Color was discovered in November 2024 named based on the file name of the initial payload. It hides its C2 communication similarly to Symbiote, including the use of proprietary encryption algorithms.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.auto_color", "https://medium.com/@0xzyadelzyat/reverse-engineering-the-auto-color-linux-backdoor-db2aecbd2887", "https://zw01f.github.io/malware%20analysis/auto-color/" ], "synonyms": [], "type": [] }, "uuid": "4e3f0985-d3c6-429f-89d6-f2e364cf7350", "value": "Auto-Color" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.avoslocker", "https://blog.lexfo.fr/Avoslocker.html", "https://blogs.blackberry.com/en/2022/04/threat-thursday-avoslocker-prompts-advisory-from-fbi-and-fincen", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://blog.qualys.com/vulnerabilities-threat-research/2022/03/06/avoslocker-ransomware-behavior-examined-on-windows-linux", "https://blog.cyble.com/2022/01/17/avoslocker-ransomware-linux-version-targets-vmware-esxi-servers/", "https://blogs.vmware.com/security/2022/02/avoslocker-modern-linux-ransomware-threats.html", "https://www.ic3.gov/Media/News/2022/220318.pdf" ], "synonyms": [], "type": [] }, "uuid": "465b6a74-87ca-4459-b4be-3f8b272f4485", "value": "Avoslocker" }, { "description": "AVrecon is a Linux-based Remote Access Trojan (RAT) targeting small-office/home-office (SOHO) routers and other ARM-embedded devices. The malware is distributed via exploitation of unpatched vulnerabilities or common misconfiguration of the targeted devices. Once deployed, AVreckon will collect some information about the infected device, open a session to pre-configured C&C server, and spawn a remote shell for command execution. It might also download additional arbitrary files and run them. The malware has recently been used in campaigns aimed at ad-fraud activities, password spraying and data exfiltration.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.avrecon", "https://krebsonsecurity.com/2023/07/who-and-what-is-behind-the-malware-proxy-service-socksescort/", "https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/", "https://spur.us/2023/07/christmas-in-july-a-finely-wrapped-proxy-service/", "https://twitter.com/BlackLotusLabs/status/1684290046235484160" ], "synonyms": [], "type": [] }, "uuid": "1b218432-dd5c-4593-8f37-e202f9418fff", "value": "AVrecon" }, { "description": "Azazel is a Linux user-mode rootkit based off of a technique from the Jynx rootkit (LD_PRELOAD technique). Azazel is purportedly more robust than Jynx and has many more anti-analysis features ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.azazel", "https://github.com/chokepoint/azazel" ], "synonyms": [], "type": [] }, "uuid": "37374572-3346-4c00-abc9-9f6883c8866e", "value": "azazel" }, { "description": "B1txor20 is a malware that was discovered by 360 Netlab along others exploiting Log4J. the name is derived from using the file name \"b1t\", the XOR encrpytion algorithm, and the RC4 algorithm key length of 20 bytes. According to 360 Netlab this Backdoor for Linux platform uses DNS Tunnel to build a C2 communication channel. They also had the assumption that the malware is still in development, because of some bugs and not fully implemented features.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.b1txor20", "https://blog.netlab.360.com/b1txor20-use-of-dns-tunneling_cn/" ], "synonyms": [], "type": [] }, "uuid": "05e6d9ff-93a1-429b-b856-794d9ded75df", "value": "B1txor20" }, { "description": "ESX and NAS modules for Babuk ransomware.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.babuk", "https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/", "https://krebsonsecurity.com/2023/05/russian-hacker-wazawaka-indicted-for-ransomware/", "https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf", "https://medium.com/s2wlab/grooves-thoughts-on-blackmatter-babuk-and-interruption-in-the-supply-of-cheese-in-the-b5328bc764f2", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://medium.com/s2wlab/groove-x-ramp-the-relation-between-groove-babuk-ramp-and-blackmatter-f75644f8f92d", "https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/", "https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/how-groove-gang-is-shaking-up-the-ransomware-as-a-service-market-to-empower-affiliates/", "https://securelist.com/cyber-anarchy-squad-attacks-with-uncommon-trojans/114990/", "https://therecord.media/ransomware-ukraine-russia-bearlyfy", "https://marcoramilli.com/2021/07/05/babuk-ransomware-the-builder/", "https://raw.githubusercontent.com/antonioCoco/infosec-talks/main/InsomniHack_2022_Ransomware_Encryption_Internals.pdf", "https://www.advintel.io/post/groove-vs-babuk-groove-ransom-manifesto-ramp-underground-platform-secret-inner-workings", "https://medium.com/s2wlab/blackmatter-x-babuk-using-the-same-web-server-for-sharing-leaked-files-d01c20a74751" ], "synonyms": [], "type": [] }, "uuid": "26b4d805-890b-4767-9d9f-a08adeee1c96", "value": "Babuk (ELF)" }, { "description": "According to Avast Decoded, Backdoorit is a multiplatform RAT written in Go programming language and supporting both Windows and Linux/Unix operating systems. In many places in the code it is also referred to as backd00rit.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.backdoorit", "https://decoded.avast.io/davidalvarez/go-malware-on-the-rise/" ], "synonyms": [ "backd00rit" ], "type": [] }, "uuid": "4a4bc444-9e93-47a6-a572-0e13f743d875", "value": "Backdoorit" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.backdoor_irc16", "https://news.drweb.com/show/?c=5&i=10193&lng=en" ], "synonyms": [], "type": [] }, "uuid": "3008fa01-492a-42e2-ab9b-a0a9d12823b8", "value": "Irc16" }, { "description": "BADCALL is a Trojan malware variant used by the group Lazarus Group. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.badcall", "https://www.acronis.com/en/tru/posts/acronis-tru-alliance-huntio-hunting-dprk-threats-new-global-lazarus-and-kimsuky-campaigns/", "https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack" ], "synonyms": [], "type": [] }, "uuid": "350817e8-4d70-455e-b1fd-000bed4a4cf4", "value": "BADCALL (ELF)" }, { "description": "Ballista is an IoT botnet, infecting unpatched TP-Link Archer AX21 (AX1800) routers. It spreads through automatic exploitation of CVE-2023-1389. Its capabilities include remote code execution and DDoS attacks.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.ballista", "https://www.catonetworks.com/blog/cato-ctrl-ballista-new-iot-botnet-targeting-thousands-of-tp-link-archer-routers/" ], "synonyms": [], "type": [] }, "uuid": "a4364bfb-e440-4a57-9c0f-ad5aa76c3868", "value": "Ballista" }, { "description": "Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite", "https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/", "https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo", "https://www.nozominetworks.com/blog/could-threat-actors-be-downgrading-their-malware-to-evade-detection/", "https://www.uptycs.com/blog/mirai-code-re-use-in-gafgyt", "https://unit42.paloaltonetworks.com/new-hoaxcalls-ddos-botnet/", "https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/", "https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/", "https://blog.cyber5w.com/gafgyt-backdoor-analysis", "https://blog.netlab.360.com/wo-men-kan-dao-de-wu-ke-lan-bei-ddosgong-ji-xi-jie/", "https://www.aquasec.com/blog/gafgyt-malware-variant-exploits-gpu-power-and-cloud-native-environments/", "https://unit42.paloaltonetworks.com/hoaxcalls-mirai-target-legacy-symantec-web-gateways/", "https://www.avira.com/en/blog/a-gafgyt-variant-that-exploits-pulse-secure-cve-2020-8218", "https://unit42.paloaltonetworks.com/unit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall/", "https://blog.netlab.360.com/the-gafgyt-variant-vbot-and-its-31-campaigns/", "https://securityscorecard.com/wp-content/uploads/2024/01/Report-A-Detailed-Analysis-Of-The-Gafgyt-Malware-Targeting-IoT-Devices.pdf", "https://cujo.com/mirai-gafgyt-with-new-ddos-modules-discovered/", "https://vb2020.vblocalhost.com/uploads/VB2020-Liu.pdf", "https://www.virusbulletin.com/uploads/pdf/conference/vb2015/KalnaiHorejsi-VB2015.pdf", "https://info.spamhaus.com/hubfs/Botnet%20Reports/Jan-Jun%202024%20Botnet%20Threat%20Update.pdf", "https://unit42.paloaltonetworks.com/cve-2022-22954-vmware-vulnerabilities/", "https://cybersecurity.att.com/blogs/labs-research/code-similarity-analysis-with-r2diaphora", "http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/", "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf", "https://maxkersten.nl/binary-analysis-course/malware-analysis/corona-ddos-bot/", "https://www.uptycs.com/blog/discovery-of-simps-botnet-leads-ties-to-keksec-group", "https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/" ], "synonyms": [ "Gafgyt", "gayfgt", "lizkebab", "qbot", "torlus" ], "type": [] }, "uuid": "81917a93-6a70-4334-afe2-56904c1fafe9", "value": "Bashlite" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bcmpupnp_hunter", "https://blog.netlab.360.com/bcmpupnp_hunter-a-100k-botnet-turns-home-routers-to-email-spammers-en/" ], "synonyms": [], "type": [] }, "uuid": "d8dd47a5-85fe-4f07-89dc-00301468d209", "value": "BCMPUPnP_Hunter" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bianlian", "https://www.youtube.com/live/O2Wx7mQHR2I?si=uydJupvHK6sxxw3n", "https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/", "https://rhisac.org/threat-intelligence/bianlian-ransomware-expanding-c2-infrastructure-and-operational-tempo/", "https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/" ], "synonyms": [], "type": [] }, "uuid": "f6be433e-7ed0-4777-876b-e3e2ba7d5c7f", "value": "BianLian (ELF)" }, { "description": "According to Security Joes, this malware is an x64 ELF executable, lacking obfuscation or protective measures. It allows attackers to specify target folders and can potentially destroy an entire operating system if run with root permissions. During execution, it produces extensive output, which can be mitigated using the \"nohup\" command. It also leverages multiple threads and a queue to corrupt files concurrently, enhancing its speed and reach. Its actions include overwriting files, renaming them with a random string containing \"BiBi,\" and excluding certain file types from corruption.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bibi_linux", "https://www.securityjoes.com/post/mission-data-destruction-a-large-scale-data-wiping-campaign-targeting-israel", "https://www.securityjoes.com/post/bibi-linux-a-new-wiper-dropped-by-pro-hamas-hacktivist-group", "https://research.checkpoint.com/2024/bad-karma-no-justice-void-manticore-destructive-activities-in-israel" ], "synonyms": [], "type": [] }, "uuid": "efec7bb0-4ec7-4c97-a8a9-28e0fea19852", "value": "BiBi-Linux" }, { "description": "Linux version of the bifrose malware that originally targeted Windows platform only. The backdoor has the ability to perform file management, start or end a process, or start a remote shell. The connection is encrypted using a modified RC4 algorithm.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bifrost", "https://teamt5.org/tw/posts/technical-analysis-on-backdoor-bifrost-of-the-Chinese-apt-group-huapi/", "https://cyberandramen.net/2022/12/30/a-quick-look-at-elf-bifrose/", "https://twitter.com/strinsert1Na/status/1595553530579890176", "https://jp.security.ntt/resources/EN-BlackTech_2021.pdf" ], "synonyms": [ "elf.bifrose" ], "type": [] }, "uuid": "8fa6dd0e-b630-419f-bd01-5271dd8f27c6", "value": "Bifrost" }, { "description": "A DDoS bot abusing CVE-2020-8515 to target DrayTek Vigor routers. It uses a wordlist-based DGA to generate its C&C domains.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bigviktor", "https://blog.netlab.360.com/bigviktor-dga-botnet/" ], "synonyms": [], "type": [] }, "uuid": "901ab128-2d23-41d7-a9e7-6a34e281804e", "value": "BigViktor" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bioset", "https://twitter.com/IntezerLabs/status/1409844721992749059" ], "synonyms": [], "type": [] }, "uuid": "8e301f58-acef-48e7-ad8b-c27d3ed38eed", "value": "BioSet" }, { "description": "ESXi encrypting ransomware, using a combination of the stream cipher ChaCha20 and RSA.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.blackbasta", "https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/A_Deep_Dive_into_the_Leaked_Black_Basta_Chat_Logs.pdf", "https://www.youtube.com/watch?v=bJILHYLX4C4", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a", "https://medium.com/@a-poc/black-basta-leak-analysis-add723b179a5", "https://www.youtube.com/watch?v=cH7BYWbtsfI", "https://services.google.com/fh/files/misc/m-trends-2025-en.pdf", "https://cyber.levelblue.com/m/356d41d295da03cc/original/WP-LevelBlue-MDRs-Guide-Against-Black-Basta.docx", "https://quadrantsec.com/resource/technical-analysis/black-basta-malware-overview", "https://www.cynet.com/blog/orion-threat-alert-qakbot-ttps-arsenal-and-the-black-basta-ransomware/", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf", "https://www.ontinue.com/resource/inside-black-basta-leaked-coversations/", "https://spycloud.com/blog/digesting-messages-from-the-black-basta-chats/", "https://stairwell.com/resources/stairwell-threat-report-black-basta-overview-and-detection-rules/", "https://www.linkedin.com/pulse/attackers-leveraging-microsoft-teams-defaults-quick-assist-p1u5c", "https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators/", "https://medium.com/walmartglobaltech/agent-ai-basta-parser-extraordinaire-24edfc59992a", "https://analyst1.com/wp-content/uploads/2026/01/Yalishanda.pdf", "https://expel.com/blog/code-signing-certificate-abuse-in-the-black-basta-chat-leaks-and-how-to-fight-back/", "https://flare.io/learn/resources/blog/deciphering-black-bastas-infrastructure-from-the-chat-le", "https://intel471.com/blog/black-basta-exposed-a-look-at-a-cybercrime-data-leak", "https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/", "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/pdf/2022-year-in-retrospect-report.pdf", "https://www.trellix.com/blogs/research/analysis-of-black-basta-ransomware-chat-leaks/", "http://ropgadget.com/posts/blackbasta_leaks.html", "https://analyst1.com/wp-content/uploads/2025/04/Anastasia-Inside-BlackBasta.pdf", "https://www.trendmicro.com/en_us/research/25/b/black-basta-cactus-ransomware-backconnect.html", "https://intel471.com/blog/an-in-depth-look-at-black-bastas-ttps", "https://www.lemagit.fr/actualites/366619807/Ransomware-de-REvil-a-Black-Basta-que-sait-on-de-Tramp", "https://www.cloudflare.com/threat-intelligence/research/report/black-bastas-blunder-exploiting-the-gangs-leaked-chats/", "https://www.esentire.com/blog/initial-takeaways-from-the-black-basta-chat-leaks", "https://www.crowdstrike.com/adversaries/wandering-spider/" ], "synonyms": [], "type": [] }, "uuid": "35c86fef-18fe-491c-ad3c-13f98e8f5584", "value": "Black Basta (ELF)" }, { "description": "ALPHV, also known as BlackCat or Noberus, is a ransomware family that is deployed as part of Ransomware as a Service (RaaS) operations. ALPHV is written in the Rust programming language and supports execution on Windows, Linux-based operating systems (Debian, Ubuntu, ReadyNAS, Synology), and VMWare ESXi. ALPHV is marketed as ALPHV on cybercrime forums, but is commonly called BlackCat by security researchers due to an icon of a black cat appearing on its leak site. ALPHV has been observed being deployed in ransomware attacks since November 18, 2021.\r\n\r\nALPHV can be configured to encrypt files using either the AES or ChaCha20 algorithms. In order to maximize the amount of ransomed data, ALPHV can delete volume shadow copies, stop processes and services, and stop virtual machines on ESXi servers. ALPHV can self-propagate by using PsExec to remote execute itself on other hosts on the local network.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.blackcat", "https://github.com/rivitna/Malware/tree/main/BlackCat/ALPHV3", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://breached.company/when-the-defenders-become-the-attackers-cybersecurity-experts-indicted-for-blackcat-ransomware-operations/", "https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/", "https://blog.emsisoft.com/en/40931/ransomware-profile-alphv/", "https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/", "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/blackcat-ransomware-as-a-service.html", "https://securityscorecard.com/research/the-increase-in-ransomware-attacks-on-local-governments", "https://securelist.com/a-bad-luck-blackcat/106254/", "https://www.cisa.gov/sites/default/files/2023-11/aa23-320a_scattered_spider.pdf", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://blog.group-ib.com/blackcat", "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v", "https://securityintelligence.com/posts/blackcat-ransomware-levels-up-stealth-speed-exfiltration/", "https://www.advintel.io/post/blackcat-in-a-shifting-threat-landscape-it-helps-to-land-on-your-feet-tech-dive", "https://www.theregister.com/2022/03/22/talos-ransomware-blackcat/", "https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf", "https://krebsonsecurity.com/2022/01/who-wrote-the-alphv-blackcat-ransomware-strain/", "https://securelist.com/new-ransomware-trends-in-2022/106457/", "https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/", "https://www.forescout.com/resources/analysis-of-an-alphv-incident", "https://www.zdnet.com/article/blackcat-ransomware-implicated-in-attack-on-german-oil-companies/", "https://killingthebear.jorgetesta.tech/actors/alphv", "https://www.bleepingcomputer.com/news/security/hive-ransomware-ports-its-linux-vmware-esxi-encryptor-to-rust/", "https://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html", "https://mssplab.github.io/threat-hunting/2023/07/13/malware-analysis-blackcat.html", "https://www.intrinsec.com/alphv-ransomware-gang-analysis/", "https://www.crowdstrike.com/blog/hypervisor-jackpotting-lack-of-antivirus-support-opens-the-door-to-adversaries/", "https://x.com/vxunderground/status/1731138180672344095?t=reBMQQFFMGQ_zkV8KmL_LA&s=01", "https://www.computerweekly.com/news/252525240/ALPHV-BlackCat-ransomware-family-becoming-more-dangerous", "https://www.justice.gov/opa/pr/two-americans-plead-guilty-targeting-multiple-us-victims-using-alphv-blackcat-ransomware", "https://thehackernews.com/2022/04/researchers-connect-blackcat-ransomware.html", "https://twitter.com/sisoma2/status/1473243875158499330" ], "synonyms": [ "ALPHV", "Noberus" ], "type": [] }, "uuid": "860e9d03-830e-4410-ac89-75b6eb89e7e5", "value": "BlackCat (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.blackmatter", "https://www.bleepingcomputer.com/news/security/darkside-ransomware-rushes-to-cash-out-7-million-in-bitcoin/", "https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.youtube.com/watch?v=NIiEcOryLpI", "https://therecord.media/darkside-ransomware-gang-moves-some-of-its-bitcoin-after-revil-got-hit-by-law-enforcement/", "https://us-cert.cisa.gov/ncas/alerts/aa21-291a", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/", "https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf", "https://medium.com/s2wlab/grooves-thoughts-on-blackmatter-babuk-and-interruption-in-the-supply-of-cheese-in-the-b5328bc764f2", "https://medium.com/s2wlab/groove-x-ramp-the-relation-between-groove-babuk-ramp-and-blackmatter-f75644f8f92d", "https://blogs.blackberry.com/en/2021/09/threat-thursday-blackmatter-ransomware-as-a-service", "https://twitter.com/VK_Intel/status/1423188690126266370", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf", "https://www.mandiant.com/resources/chasing-avaddon-ransomware", "https://www.hhs.gov/sites/default/files/demystifying-blackmatter.pdf", "https://medium.com/s2wlab/blackmatter-x-babuk-using-the-same-web-server-for-sharing-leaked-files-d01c20a74751", "https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/", "https://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html", "https://umbrella.cisco.com/blog/cybersecurity-threat-spotlight-blackmatter-lockbit-thor", "https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-moves-victims-to-lockbit-after-shutdown/", "https://blog.group-ib.com/blackmatter#", "https://twitter.com/GelosSnake/status/1451465959894667275", "https://www.elliptic.co/blog/darkside-bitcoins-on-the-move-following-government-cyberattack-against-revil-ransomware-group", "https://thehackernews.com/2022/04/researchers-connect-blackcat-ransomware.html", "https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-2/", "https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/how-groove-gang-is-shaking-up-the-ransomware-as-a-service-market-to-empower-affiliates/", "https://www.bleepingcomputer.com/news/security/linux-version-of-blackmatter-ransomware-targets-vmware-esxi-servers/", "https://blog.group-ib.com/blackmatter2" ], "synonyms": [], "type": [] }, "uuid": "1277a4bf-466c-40bc-b000-f55cbd0994a7", "value": "BlackMatter (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.blackrota", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://blog.netlab.360.com/blackrota-an-obfuscated-backdoor-written-in-go-en/", "https://www.kryptoslogic.com/blog/2020/12/automated-string-de-gobfuscation/" ], "synonyms": [], "type": [] }, "uuid": "a30aedcc-562e-437a-827c-55bc00cf3506", "value": "Blackrota" }, { "description": "According to Trend Micro, this ransomware has significant code overlap with Royal Ransomware.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.blacksuit", "https://blog.cyble.com/2023/05/12/blacksuit-ransomware-strikes-windows-and-linux-users/", "https://www.trendmicro.com/en_us/research/23/e/investigating-blacksuit-ransomwares-similarities-to-royal.html", "https://redsense.com/publications/royal-blacksuit-how-ransomware-rebrand-reshaped-them/", "https://www.bleepingcomputer.com/news/security/law-enforcement-seizes-blacksuit-ransomware-leak-sites/" ], "synonyms": [], "type": [] }, "uuid": "5bdbeaae-0def-4547-9940-33ad94060955", "value": "BlackSuit (ELF)" }, { "description": "According to Mandiant, this malware family is attributed to potential chinese background and directly related to observed exploitation of Fortinet's SSL-VPN (CVE-2022-42475). There is also a Windows variant.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.boldmove", "https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf", "https://thehackernews.com/2023/01/new-chinese-malware-spotted-exploiting.html", "https://services.google.com/fh/files/misc/01-chinese-espionage-article-m-trends-2024.pdf", "https://www.mandiant.com/resources/blog/chinese-actors-exploit-fortios-flaw" ], "synonyms": [], "type": [] }, "uuid": "8f347147-c34e-4698-9439-c640233fca15", "value": "BOLDMOVE (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bootkitty", "https://www.welivesecurity.com/en/eset-research/bootkitty-analyzing-first-uefi-bootkit-linux/" ], "synonyms": [], "type": [] }, "uuid": "8fc5c777-379e-4487-b108-88af1fca8a01", "value": "Bootkitty" }, { "description": "This is a pentesting tool and according to the author, \"BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies.\".\r\n\r\nIt has been observed being used by TeamTNT in their activities for spreading crypto-mining malware.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.botb", "https://github.com/brompwnie/botb" ], "synonyms": [ "BOtB" ], "type": [] }, "uuid": "57c9ab70-7133-441a-af66-10c0e4eb898b", "value": "Break out the Box" }, { "description": "According to Alien Labs, this malware targets embedded devices including routers with more than 30 exploits.\r\nSourceCode: https://github.com/Egida/kek/blob/19991ef983f838287aa9362b78b4ed8da0929184/loader_multi.go (2021-10-16)", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.botenago", "https://cybersecurity.att.com/blogs/labs-research/att-alien-labs-finds-new-golang-malwarebotenago-targeting-millions-of-routers-and-iot-devices-with-more-than-30-exploits", "https://cybersecurity.att.com/blogs/labs-research/botenago-strike-again-malware-source-code-uploaded-to-github", "https://www.nozominetworks.com/blog/new-botenago-variant-discovered-by-nozomi-networks-labs/", "https://lifars.com/2022/01/newly-found-malware-threatens-iot-devices/", "https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealthy-malware-targeting-linux" ], "synonyms": [], "type": [] }, "uuid": "dffcc168-cb76-4ae6-b913-c369e92c614b", "value": "BotenaGo" }, { "description": "BPFDoor is a passive backdoor used by a China-based threat actor. This backdoor supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP allowing the threat actor a variety of mechanisms to interact with the implant.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bpfdoor", "https://en.yna.co.kr/view/AEN20250526002700320", "https://twitter.com/CraigHRowland/status/1523266585133457408", "https://haxrob.net/bpfdoor-past-and-present-part-1/", "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf", "https://elastic.github.io/security-research/intelligence/2022/05/04.bpfdoor/article/#", "https://www.trendmicro.com/en_us/research/23/g/detecting-bpfdoor-backdoor-variants-abusing-bpf-filters.html", "https://lolcads.github.io/posts/2023/12/bpf_memory_forensics_with_volatility3/", "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896", "https://unfinished.bike/fun-with-the-new-bpfdoor-2023", "https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/", "https://nikhilh-20.github.io/blog/cbpf_bpfdoor/", "https://troopers.de/troopers22/talks/7cv8pz/", "https://haxrob.net/bpfdoor-past-and-present-part-2/", "https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/", "https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/", "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor", "https://blog.qualys.com/vulnerabilities-threat-research/2022/08/01/heres-a-simple-script-to-detect-the-stealthy-nation-state-bpfdoor", "https://www.trendmicro.com/en_us/research/25/d/bpfdoor-hidden-controller.html", "https://exatrack.com/public/Tricephalic_Hellkeeper.pdf", "https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game", "https://www.bleepingcomputer.com/news/security/stealthier-version-of-linux-bpfdoor-malware-spotted-in-the-wild/", "https://twitter.com/cyb3rops/status/1523227511551033349", "https://www.mandiant.com/resources/blog/chinese-espionage-tactics" ], "synonyms": [ "JustForFun" ], "type": [] }, "uuid": "3c7082b6-0181-4064-8e35-ab522b49200f", "value": "BPFDoor" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bqtlock", "https://x.com/nextronresearch/status/1985729005777989655" ], "synonyms": [], "type": [] }, "uuid": "871ddba3-5479-41b4-986b-97f3baef6be8", "value": "BQTlock (ELF)" }, { "description": "According to Google, BRICKSTORM is used to consistently target appliances, among them primarily VMware vCenter and ESXi hosts.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.brickstorm", "https://blog.nviso.eu/wp-content/uploads/2025/04/NVISO-BRICKSTORM-Report.pdf", "https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day", "https://www.crowdstrike.com/en-us/blog/warp-panda-cloud-threats/", "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign", "https://www.cisa.gov/news-events/analysis-reports/ar25-338a", "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement?hl=en", "https://threatprotect.qualys.com/2025/10/16/f5-big-ip-source-code-leaked-in-state-linked-cyberattack-brickstorm-malware/", "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement" ], "synonyms": [], "type": [] }, "uuid": "3b503e48-c50c-49ee-ab68-3c2f87eae398", "value": "BRICKSTORM" }, { "description": "According to Cisco Talos, BruteEntry is a Go-based ELF malware family used to convert compromised Linux systems, particularly edge devices, into operational relay boxes that perform large-scale credential brute forcing. It consists of a daemon-like agent and an \"instrumentor\" written in Go that ensures the agent is running, after which the agent registers with a command-and-control server and receives tasking that includes lists of target hosts and service types. BruteEntry uses embedded credential lists to systematically attempt logins against services such as SSH, PostgreSQL databases, and application servers, reporting back detailed results on success or failure. By distributing scanning and brute-force activity across many infected nodes, BruteEntry provides resilient, outsourced access acquisition capabilities for the operator\u2019s broader intrusion campaigns.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.brute_entry", "https://blog.talosintelligence.com/uat-9244/" ], "synonyms": [], "type": [] }, "uuid": "7512df49-31d2-428a-bd7b-f4215f82b787", "value": "BruteEntry" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.brute_ratel", "https://bruteratel.com/" ], "synonyms": [], "type": [] }, "uuid": "2fa4ac4e-3f89-4fd0-b4fd-2c776dcf69d8", "value": "brute_ratel" }, { "description": "According to Mandiant, this is a webshell, written in Perl.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bushwalk", "https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence", "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ivanti-exploitation-persistence/" ], "synonyms": [], "type": [] }, "uuid": "77b96da8-d4c1-430d-8b08-3b4893e5d3ce", "value": "BUSHWALK" }, { "description": "Pangu Lab discovered this backdoor during a forensic investigation in 2013. They refer to related incidents as \"Operation Telescreen\".", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bvp47", "https://www.pangulab.cn/en/post/the_bvp47_a_top-tier_backdoor_of_us_nsa_equation_group/", "https://exatrack.com/public/Tricephalic_Hellkeeper.pdf", "https://thehackernews.com/2022/02/chinese-experts-uncover-details-of.html", "https://www.bleepingcomputer.com/news/security/nsa-linked-bvp47-linux-backdoor-widely-undetected-for-10-years/", "https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group_ii.en.pdf", "https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en.pdf" ], "synonyms": [], "type": [] }, "uuid": "0492f9bf-3c5d-4c17-993b-2b53d0fb06f7", "value": "Bvp47" }, { "description": "According to FortiGuard Labs, C0XMO is a newly identified Gafgyt variant that propagates by exploiting CVE-2021-27137 in DD-WRT routers, enabling remote attackers to control vulnerable systems. Unlike traditional Gafgyt, C0XMO modularizes its lateral movement into a standalone Python script, allowing it to efficiently target multiple Linux architectures. The malware is written in both Python and compiled ELF binaries, and features persistence, competitor process termination, and a broad set of DDoS attack methods. Its architecture is more advanced than typical Gafgyt, with separate scanning and propagation components, extensive exploitation capabilities, and improved scalability for botnet deployment.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.c0xmo", "https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo" ], "synonyms": [], "type": [] }, "uuid": "1b9a4508-ee8a-4d6d-ae00-c3c8da8cec94", "value": "C0XMO" }, { "description": "Linux malware cross-compiled for x86, MIPS, ARM. XOR encoded strings, 13 commands supported for its C&C, including downloading, file modification and execution and ability to run shell commands.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.caja", "https://mp.weixin.qq.com/s/pd6fUs5TLdBtwUHauclDOQ" ], "synonyms": [], "type": [] }, "uuid": "06816c22-be7c-44db-8d0d-395ab306bb9b", "value": "Caja" }, { "description": "According to Avast Decoded, Caligula is an IRC multiplatform bot that allows to perform DDoS attacks. It is written in Go and distributed in ELF files targeting Intel 32/64bit code, as well as ARM 32bit and PowerPC 64bit. It is based on the Hellabot open source project.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.caligula", "https://decoded.avast.io/davidalvarez/go-malware-on-the-rise/" ], "synonyms": [], "type": [] }, "uuid": "c936f24c-c04a-4cab-9ac6-6384a2d4c283", "value": "Caligula" }, { "description": "XMRig-based mining malware written in Go.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.capoae", "https://www.akamai.com/blog/security/capoae-malware-ramps-up-uses-multiple-vulnerabilities-and-tactics-to-spread" ], "synonyms": [], "type": [] }, "uuid": "c1b0528b-c674-4c76-8e1d-5846ba8af261", "value": "Capoae" }, { "description": "A backdoor for UNIX operating systems that implements knocking as authentication method.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.cd00r", "https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631", "https://github.com/aaaaaaaannn/cd00r.c/blob/master/cd00r.c" ], "synonyms": [], "type": [] }, "uuid": "94b4c990-9beb-4bcd-bd19-9ad8fe4386b9", "value": "cd00r" }, { "description": "This is in the same family as eBury, Calfbot, and is also likely related to DarkLeech", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.cdorked", "https://blogs.cisco.com/security/linuxcdorked-faqs", "https://www.symantec.com/security-center/writeup/2013-050214-5501-99", "https://blog.sucuri.net/2014/03/windigo-linux-analysis-ebury-and-cdorked.html", "https://www.welivesecurity.com/2013/05/02/the-stealthiness-of-linuxcdorked-a-clarification/", "https://www.welivesecurity.com/2013/04/26/linuxcdorked-new-apache-backdoor-in-the-wild-serves-blackhole/" ], "synonyms": [ "CDorked.A" ], "type": [] }, "uuid": "bb9eaaec-97c9-4014-94dd-129cecf31ff0", "value": "CDorked" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.cdrthief", "https://www.welivesecurity.com/2020/09/10/who-callin-cdrthief-linux-voip-softswitches/" ], "synonyms": [], "type": [] }, "uuid": "27d06ac9-42c4-433a-b1d7-660710d9e8df", "value": "CDRThief" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.cephei", "https://cybersecurity.att.com/blogs/labs-research/malware-using-new-ezuri-memory-loader" ], "synonyms": [], "type": [] }, "uuid": "baa0704b-50d8-48af-91e1-049f30f422cc", "value": "Cephei" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.cetus", "https://unit42.paloaltonetworks.com/cetus-cryptojacking-worm/" ], "synonyms": [], "type": [] }, "uuid": "7a226df2-9599-4002-9a38-b044e16f76a9", "value": "Cetus" }, { "description": "Sophos describes this malware as a DDoS bot, with its name originating from ChaCha-Lua-bot due to its use of ChaCha cipher and Lua. Variants exist for multiple architectures and it incorporates code from XorDDoS and Mirai.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.chalubo", "https://blog.centurylink.com/the-pumpkin-eclipse/", "https://blog.lumen.com/the-pumpkin-eclipse/", "https://news.sophos.com/en-us/2018/10/22/chalubo-botnet-wants-to-ddos-from-your-server-or-iot-device/" ], "synonyms": [ "ChaChaDDoS" ], "type": [] }, "uuid": "af91c777-93f7-4b7f-981f-141478972011", "value": "Chalubo" }, { "description": "Multi-functional malware written in Go, targeting both Linux and Windows, evolved from elf.kaiji.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.chaos", "https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/", "https://www.trendmicro.com/en_us/research/22/l/linux-cryptomining-enhanced-via-chaos-rat-.html" ], "synonyms": [], "type": [] }, "uuid": "ef03e3c3-32d5-483a-bd1f-97dd531c4bca", "value": "Chaos (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.chapro", "http://contagiodump.blogspot.com/2012/12/dec-2012-linuxchapro-trojan-apache.html", "http://blog.eset.com/2012/12/18/malicious-apache-module-used-for-content-injection-linuxchapro-a" ], "synonyms": [], "type": [] }, "uuid": "700366d8-4036-4e48-9a5f-bd6e09fb9b6b", "value": "Chapro" }, { "description": "Chisel is an open-source project by Jaime Pillora (jpillora) that allows tunneling TCP and UDP connections via HTTP. It is available across platforms and written in Go. While benign in itself, Chisel has been utilized by multiple threat actors. It was for example observed by SentinelOne during a PYSA ransomware campaign to achieve persistence and used as backdoor.\r\nGithub: https://github.com/jpillora/chisel", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.chisel", "https://www.sentinelone.com/blog/from-the-front-lines-peering-into-a-pysa-ransomware-attack/" ], "synonyms": [], "type": [] }, "uuid": "e5600185-39b7-49a0-bd60-a6806c7d47dd", "value": "Chisel (ELF)" }, { "description": "ELF version of clop ransomware.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.clop", "https://www.helpnetsecurity.com/2023/02/07/cl0p-ransomware-decryptor-linux/", "https://www.bleepingcomputer.com/news/security/march-2023-broke-ransomware-attack-records-with-459-incidents/", "https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2019-CTI-009.pdf", "https://www.sentinelone.com/labs/cl0p-ransomware-targets-linux-systems-with-flawed-encryption-decryptor-available/" ], "synonyms": [ "Cl0p" ], "type": [] }, "uuid": "3d11ec52-9ca8-4d83-99d4-6658f306e8e4", "value": "Clop (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.cloud_snooper", "https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://news.sophos.com/wp-content/uploads/2020/02/CloudSnooper_report.pdf", "https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-cloud-snooper-report.pdf", "https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/" ], "synonyms": [ "Snoopy" ], "type": [] }, "uuid": "0b1c514d-f617-4380-a28c-a1ed305a7538", "value": "Cloud Snooper" }, { "description": "According to CISA, this is an implant found in firmware for the Contec CMS8000, a patient monitor used by the Healthcare and Public Health sector. An embedded backdoor function with a hard-coded IP address and functionality that enables patient data spillage was identified.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.cms8000_backdoor", "https://claroty.com/team82/research/are-contec-cms8000-patient-monitors-infected-with-a-chinese-backdoor-the-reality-is-more-complicated", "https://www.cisa.gov/sites/default/files/2025-01/fact-sheet-contec-cms8000-contains-a-backdoor-508c.pdf" ], "synonyms": [], "type": [] }, "uuid": "879cf39e-ca87-402f-87c6-2689c7da0238", "value": "CMS8000 Backdoor" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.compood", "https://cloud.google.com/blog/topics/threat-intelligence/threat-actors-exploit-react2shell-cve-2025-55182" ], "synonyms": [], "type": [] }, "uuid": "888e5665-8593-4db8-9d4a-9b42582ab86f", "value": "COMPOOD" }, { "description": "ConnectBack malware is a type of malicious software designed to establish unauthorized connections from an infected system to a remote server. Once a victim's device is compromised, ConnectBack creates a covert channel for communication, allowing the attacker to remotely control and gather sensitive information from the compromised system.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.connectback", "https://labs.sucuri.net/signatures/malwares/pl-backdoor-connectback-001/" ], "synonyms": [ "Getshell" ], "type": [] }, "uuid": "82c57d1b-c11b-44f7-9675-2f0d23fb543f", "value": "ConnectBack" }, { "description": "Ransomware", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.conti", "https://www.justice.gov/opa/pr/multiple-foreign-nationals-charged-connection-trickbot-malware-and-conti-ransomware", "https://securelist.com/new-ransomware-trends-in-2022/106457/", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.shadowbanker.io/2025/05/shadow-banker-makes-glorious-return-interviews-guy-exposing-conti-command-control/", "https://www.threatstop.com/blog/first-conti-then-hive-costa-rica-gets-hit-with-ransomware-again", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-group-targets-esxi-hypervisors-with-its-linux-variant.html", "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v", "https://intel471.com/blog/malware-before-ransomware-trojan-information-stealer-cobalt-strike", "https://damonmccoy.com/papers/Ransomware_eCrime22.pdf", "https://resources.prodaft.com/wazawaka-report", "https://www.advintel.io/post/advintel-s-state-of-emotet-aka-spmtools-displays-over-million-compromised-machines-through-2022", "https://www.esentire.com/blog/analysis-of-leaked-conti-intrusion-procedures-by-esentires-threat-response-unit-tru", "https://www.secureworks.com/blog/gold-ulrick-continues-conti-operations-despite-public-disclosures", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf", "https://www.youtube.com/watch?v=cYx7sQRbjGA" ], "synonyms": [ "Conti Locker" ], "type": [] }, "uuid": "c1ab8323-ce61-409a-80f3-b945c8ffcd42", "value": "Conti (ELF)" }, { "description": "This was observed to be pushed by IoT malware, abusing devices for LiteCoin and BitCoin mining.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.cpuminer", "https://yoroi.company/research/outlaw-is-back-a-new-crypto-botnet-targets-european-organizations/", "https://github.com/pooler/cpuminer" ], "synonyms": [], "type": [] }, "uuid": "8196b6f6-386e-4499-b269-4e5c65f74141", "value": "Cpuminer (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.cr1ptt0r", "https://resolverblog.blogspot.com/2019/03/de-cr1pt0r-tool-cr1pt0r-ransomware.html", "https://resolverblog.blogspot.com/2019/02/d-link-dns-320-nas-cr1ptt0r-ransomware.html", "https://www.bleepingcomputer.com/news/security/cr1ptt0r-ransomware-infects-d-link-nas-devices-targets-embedded-systems/" ], "synonyms": [ "CriptTor" ], "type": [] }, "uuid": "196b20ec-c3d1-4136-ab94-a2a6cc150e74", "value": "Cr1ptT0r" }, { "description": "A malware written in Bash that hides in the Linux calendar system on February 31st. Observed in relation to Magecart attacks.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.cronrat", "https://sansec.io/research/cronrat" ], "synonyms": [], "type": [] }, "uuid": "c49062cc-ceef-4794-9d8a-93ede434ecfd", "value": "CronRAT" }, { "description": "According to CISA, Cyclops Blink appears to be a replacement framework for the VPNFilter malware exposed in 2018, and which exploited network devices, primarily small office/home office (SOHO) routers and network attached storage (NAS) devices. Cyclops Blink has been deployed since at least June 2019, fourteen months after VPNFilter was disrupted. In common with VPNFilter, Cyclops Blink deployment also appears indiscriminate and widespread. The actor has so far primarily deployed Cyclops Blink to WatchGuard and ASUS devices, but it is likely that Sandworm would be capable of compiling the malware for other architectures and firmware.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.cyclops_blink", "https://www.shadowserver.org/news/shadowserver-special-reports-cyclops-blink/", "https://inquest.net/blog/2022/04/07/ukraine-cyberwar-overview", "https://www.justice.gov/opa/press-release/file/1491281/download", "https://www.bleepingcomputer.com/news/security/cisa-warns-orgs-of-watchguard-bug-exploited-by-russian-state-hackers/", "https://www.theregister.com/2022/03/18/cyclops_asus_routers/", "https://attack.mitre.org/groups/G0034", "https://www.bleepingcomputer.com/news/security/asus-warns-of-cyclops-blink-malware-attacks-targeting-routers/", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/c/cyclops-blink-sets-sights-on-asus-routers/Appendix_Cyclops%20Blink%20Sets%20Sights%20on%20ASUS%20Routers.pdf", "https://github.com/trendmicro/research/blob/main/cyclops_blink/c2-scripts/check.py", "https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html", "https://www.splunk.com/en_us/blog/security/strt-ta03-cpe-destructive-software.html", "https://www.justice.gov/opa/video/attorney-general-merrick-b-garland-announces-enforcement-actions-disrupt-and-prosecute", "https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-disruption-botnet-controlled-russian-federation", "https://www.cisa.gov/uscert/ncas/alerts/aa22-054a", "https://www.bleepingcomputer.com/news/security/us-disrupts-russian-cyclops-blink-botnet-before-being-used-in-attacks/" ], "synonyms": [], "type": [] }, "uuid": "76d4b754-e025-41c5-a767-7b00a39bd255", "value": "CyclopsBlink" }, { "description": "According to PCrisk, Dacls is the name of a remote access Trojan (RAT), a malicious program that allows cyber criminals to control infected computers remotely.\r\n\r\nResearch shows that this malware is tied to Lazarus Group (a group of cyber criminals) and targets Linux and the Windows Operating System. Typically, cyber criminals use RATs to steal sensitive, confidential information, infect systems with other malware, and so on. In any case, no RAT is harmless and should be uninstalled immediately.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.dacls", "https://vblocalhost.com/uploads/VB2021-Park.pdf", "https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought", "https://www.sygnia.co/mata-framework", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://blog.netlab.360.com/dacls-the-dual-platform-rat/", "https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf", "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/", "https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/", "https://securelist.com/apt-trends-report-q2-2020/97937/", "https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/" ], "synonyms": [], "type": [] }, "uuid": "2e5e2a7e-4ee5-4954-9c92-e9b21649ae1b", "value": "Dacls (ELF)" }, { "description": "Mirai variant exploiting CVE-2021-20090 and CVE2021-35395 for spreading.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.dark", "https://www.radware.com/getmedia/d312a5fa-2d8d-4c1e-b31e-73046f24bf35/Alert-Dark-OMIGOD.aspx", "https://twitter.com/ESETresearch/status/1440052837820428298?s=20", "https://blogs.juniper.net/en-us/threat-research/attacks-continue-against-realtek-vulnerabilities", "https://www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/", "https://www.radware.com/getmedia/18d24c2d-c092-4a61-9ad6-ebb92b7a49b8/Alert_Realtek_SDK.aspx" ], "synonyms": [ "Dark.IoT" ], "type": [] }, "uuid": "d499e7ad-332f-4057-b31d-a69916408057", "value": "Dark" }, { "description": "A sophisticated payload delivery and upgrade framework, discovered in 2024. DarkCracks exploits compromised GLPI and WordPress sites to function as Downloaders and C2 servers.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.darkcracks", "https://blog.xlab.qianxin.com/darkcracks-an-advanced-stealthy-payload-delivery-and-upgrade-framework/" ], "synonyms": [], "type": [] }, "uuid": "043c46fc-b98a-438e-b071-3ac76380f082", "value": "DarkCracks" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.darknexus", "https://www.trendmicro.com/en_us/research/21/l/the-evolution-of-iot-linux-malware-based-on-mitre-att&ck-ttps.html", "https://www.stratosphereips.org/blog/2020/6/8/dark-nexus-the-old-the-new-and-the-ugly" ], "synonyms": [], "type": [] }, "uuid": "dfba0c8f-9d06-448b-817e-6fffa1b22cb9", "value": "Dark Nexus" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.darkside", "https://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/", "https://www.bleepingcomputer.com/news/security/darkside-ransomware-rushes-to-cash-out-7-million-in-bitcoin/", "https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.wsj.com/articles/colonial-pipeline-ceo-tells-why-he-paid-hackers-a-4-4-million-ransom-11621435636", "https://www.crowdstrike.com/blog/how-to-defend-against-conti-darkside-revil-and-other-ransomware/", "https://www.bleepingcomputer.com/news/security/chemical-distributor-pays-44-million-to-darkside-ransomware/", "https://therecord.media/darkside-ransomware-gang-moves-some-of-its-bitcoin-after-revil-got-hit-by-law-enforcement/", "https://www.secureworks.com/blog/ransomware-groups-use-tor-based-backdoor-for-persistent-access", "https://www.youtube.com/watch?v=NIiEcOryLpI", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/darkside-ransomware-victims-sold-short/", "https://securityscorecard.com/blog/new-evidence-supports-assessment-that-darkside-likely-responsible-for-colonial-pipeline-ransomware-attack-others-targeted", "https://medium.com/s2wlab/w1-jun-en-story-of-the-week-ransomware-on-the-darkweb-af491d33868b", "https://www.databreaches.net/a-former-darkside-listing-shows-up-on-revils-leak-site/", "https://www.ic3.gov/Media/News/2021/211101.pdf", "https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/", "https://pylos.co/2021/05/13/mind-the-air-gap/", "https://therecord.media/popular-hacking-forum-bans-ransomware-ads/", "https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://cybersecurity.att.com/blogs/labs-research/darkside-raas-in-linux-version", "https://twitter.com/JAMESWT_MHT/status/1388301138437578757", "https://cloud.google.com/blog/topics/threat-intelligence/darkside-affiliate-supply-chain-software-compromise", "https://www.technologyreview.com/2021/05/24/1025195/colonial-pipeline-ransomware-bitdefender/", "https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/", "https://www.nytimes.com/2021/05/29/world/europe/ransomware-russia-darkside.html", "https://www.youtube.com/watch?v=qxPXxWMI2i4", "https://otx.alienvault.com/pulse/60d0afbc395c24edefb33bb9", "https://www.justice.gov/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside", "https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/", "https://www.elliptic.co/blog/elliptic-follows-bitcoin-ransoms-paid-by-darkside-ransomware-victims", "https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf", "https://therecord.media/darkside-ransomware-gang-says-it-lost-control-of-its-servers-money-a-day-after-biden-threat/", "https://blogs.blackberry.com/en/2021/09/threat-thursday-blackmatter-ransomware-as-a-service", "https://www.intel471.com/blog/darkside-ransomware-shut-down-revil-avaddon-cybercrime", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf", "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations", "https://blog.gigamon.com/2021/05/17/tracking-darkside-and-ransomware-the-network-view/", "https://www.crowdstrike.com/blog/falcon-protects-from-darkside-ransomware/", "https://www.elliptic.co/blog/darkside-ransomware-has-netted-over-90-million-in-bitcoin", "https://www.guidepointsecurity.com/from-zloader-to-darkside-a-ransomware-story/", "https://blog.group-ib.com/blackmatter#", "https://twitter.com/GelosSnake/status/1451465959894667275", "https://www.bleepingcomputer.com/news/security/darkside-ransomware-made-90-million-in-just-nine-months/", "https://www.elliptic.co/blog/darkside-bitcoins-on-the-move-following-government-cyberattack-against-revil-ransomware-group", "https://www.maltego.com/blog/chasing-darkside-affiliates-identifying-threat-actors-connected-to-darkside-ransomware-using-maltego-intel-471-1/", "https://abcnews.go.com/Politics/biden-speak-colonial-pipeline-attack-americans-face-gasoline/story?id=77666212", "https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout", "https://www.bleepingcomputer.com/news/security/darkside-ransomware-servers-reportedly-seized-revil-restricts-targets/", "https://www.crowdstrike.com/blog/how-ransomware-adversaries-reacted-to-the-darkside-pipeline-attack/", "https://www.bleepingcomputer.com/news/security/popular-russian-hacking-forum-xss-bans-all-ransomware-topics/", "https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html", "https://blog.group-ib.com/blackmatter2", "https://www.digitalshadows.com/blog-and-research/ransomware-as-a-service-rogue-affiliates-and-whats-next/", "https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/" ], "synonyms": [], "type": [] }, "uuid": "61796628-c37b-4284-9aa4-9f054cc6c3c2", "value": "DarkSide (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.dark_radiation", "https://www.sentinelone.com/blog/darkradiation-abusing-bash-for-linux-and-docker-container-ransomware/" ], "synonyms": [], "type": [] }, "uuid": "39be337b-8a9a-4d71-949b-5efd6248fc80", "value": "DarkRadiation" }, { "description": "First activity observed in October 2017. DDG is a botnet with P2P capability that is targeting crypto currency mining (Monero).", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.ddg", "https://blog.netlab.360.com/old-botnets-never-die-and-ddg-refuse-to-fade-away/", "https://blog.netlab.360.com/ddg-botnet-round-x-is-there-an-ending/", "https://blog.netlab.360.com/ddg-a-mining-botnet-aiming-at-database-servers/", "https://blog.netlab.360.com/threat-alert-ddg-3013-is-out/", "https://blog.netlab.360.com/ddg-mining-botnet-jin-qi-huo-dong-fen-xi/" ], "synonyms": [], "type": [] }, "uuid": "5c42585b-ea92-4fe2-8a79-bb47a3df67ad", "value": "DDG" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.ddoor", "https://github.com/rek7/ddoor" ], "synonyms": [], "type": [] }, "uuid": "07f48866-647c-46b0-a0d4-29c81ad488a8", "value": "ddoor" }, { "description": "DEADBOLT is a linux ransomware written in Go, targeting QNAP NAS devices worldwide. The files are encrypted with AES128 encryption and will have the .deadbolt extension appended to file names.\r\n\r\n", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.deadbolt", "https://www.bleepingcomputer.com/news/security/new-deadbolt-ransomware-targets-qnap-devices-asks-50-btc-for-master-key/", "https://community.riskiq.com/article/1601124b", "https://www.trendmicro.com/en_us/research/22/f/closing-the-door-deadbolt-ransomware-locks-out-vendors-with-mult.html", "https://securelist.com/new-ransomware-trends-in-2022/106457/" ], "synonyms": [], "type": [] }, "uuid": "b37c9ba2-f1b0-4a2f-9387-7310939d2189", "value": "DEADBOLT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.decoy_dog", "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/hellhounds-operation-lahat/" ], "synonyms": [], "type": [] }, "uuid": "6452720d-bd35-4c55-8178-ed0dd86f4c53", "value": "Decoy Dog RAT" }, { "description": "Cado discovered this malware, written in Go and targeting AWS Lambda environments.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.denonia", "https://www.cadosecurity.com/cado-discovers-denonia-the-first-malware-specifically-targeting-lambda/", "https://thehackernews.com/2022/04/first-malware-targeting-aws-lambda.html" ], "synonyms": [], "type": [] }, "uuid": "d5d9bb86-715d-4d86-a4d2-ab73085d1b0c", "value": "Denonia" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.derusbi", "https://attack.mitre.org/groups/G0001/", "https://twitter.com/IntezerLabs/status/1407676522534735873?s=20", "https://attack.mitre.org/groups/G0096" ], "synonyms": [], "type": [] }, "uuid": "494dcdfb-88cb-456d-a95a-252ff10c0ba9", "value": "Derusbi (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.disgomoji", "https://anchorednarratives.substack.com/p/reversing-disgomoji-with-malcat-like", "https://www.seqrite.com/blog/umbrella-of-pakistani-threats-converging-tactics-of-cyber-operations-targeting-india/" ], "synonyms": [], "type": [] }, "uuid": "1f6098a1-2395-4329-8865-49602638f45a", "value": "DISGOMOJI" }, { "description": "Dofloo (aka AESDDoS) is a popular malware used to create large scale botnets that can launch DDoS attacks and load cryptocurrency miners to the infected machines. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.dofloo", "https://www.trendmicro.com/en_us/research/19/f/aesddos-botnet-malware-infiltrates-containers-via-exposed-docker-apis.html", "https://digital.nhs.uk/cyber-alerts/2019/cc-3043" ], "synonyms": [ "AESDDoS" ], "type": [] }, "uuid": "ffb5789f-d7e6-4723-a447-e5bb2fe713a0", "value": "Dofloo" }, { "description": "According to Cisco Talos, DOGLEASH is a C-based passive backdoor for Linux networking devices that binds and listens on a hardcoded port, decodes incoming TCP data with a hardcoded password, spawns threads to run actions such as executing shell commands, reading and renaming files, reporting OS information, and executing code in memory.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.dogleash", "https://blog.talosintelligence.com/uat-7810/" ], "synonyms": [], "type": [] }, "uuid": "10849129-e613-45ec-8a65-a2f90cef1270", "value": "DOGLEASH" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.doki", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://www.securecoding.com/blog/all-about-doki-malware/", "https://www.intezer.com/container-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/" ], "synonyms": [], "type": [] }, "uuid": "a5446b35-8613-4121-ada4-c0b1d6f72851", "value": "Doki" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.doublefantasy", "https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/", "https://www.antiy.com/response/FROM_EQUATION_TO_EQUATIONS.pdf" ], "synonyms": [], "type": [] }, "uuid": "a41d8c89-8229-4936-96c2-4b194ebaf858", "value": "DoubleFantasy (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.dreambus", "https://blogs.juniper.net/en-us/threat-research/dreambus-botnet-resurfaces-targets-rocketmq-vulnerability", "https://www.aquasec.com/blog/aqua-cndr-stop-dreambus-botnet-attack/" ], "synonyms": [], "type": [] }, "uuid": "22ff8eac-d92e-4c6e-829b-9b565d90eddd", "value": "DreamBus" }, { "description": "According to Cisco Talos, DriveSwitch is a launcher for SilentRaid.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.drive_switch", "https://blog.talosintelligence.com/uat-7290/" ], "synonyms": [], "type": [] }, "uuid": "a8492beb-8b19-410b-9185-ec1e94380a69", "value": "DriveSwitch" }, { "description": "This payload has been used to compromise kernel.org back in August of 2011 and has hit cPanel Support which in turn, has infected quite a few cPanel servers. It is a credential stealing payload which steals SSH keys, passwords, and potentially other credentials.\r\n\r\nThis family is part of a wider range of tools which are described in detail in the operation windigo whitepaper by ESET.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.ebury", "https://security.web.cern.ch/security/advisories/windigo/windigo.shtml", "https://www.welivesecurity.com/2018/12/05/dark-side-of-the-forsshe/", "https://www.justice.gov/opa/pr/russian-citizen-pleads-guilty-involvement-global-botnet-conspiracy", "https://www.welivesecurity.com/wp-content/uploads/2014/03/operation_windigo.pdf", "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf", "https://www.welivesecurity.com/2014/10/15/operation-windigo-good-job-eset-says-malware-author/", "https://www.welivesecurity.com/en/eset-research/ebury-alive-unseen-400k-linux-servers-compromised-cryptotheft-financial-gain/", "https://csirt.gov.it/data/cms/posts/582/attachments/66ca2e9a-68cd-4df5-81a2-674c31a699c2/download", "https://www.welivesecurity.com/2017/10/30/windigo-ebury-update-2/", "https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/", "https://web-assets.esetstatic.com/wls/en/papers/white-papers/ebury-is-alive-but-unseen.pdf", "https://www.acn.gov.it/portale/documents/20119/586040/CSIRT_Italiano_Windigo_Ebury_Variant.pdf" ], "synonyms": [], "type": [] }, "uuid": "ce79265c-a467-4a17-b27d-7ec7954688d5", "value": "Ebury" }, { "description": "The latest in this long line of Mirai scourges is a new variant named Echobot. Coming to life in mid-May, the malware was first described by Palo Alto Networks in a report published at the start of June, and then again in a report by security researchers from Akamai, in mid-June.\r\n\r\nWhen it was first spotted by Palo Alto Networks researchers in early June, Echobot was using exploits for 18 vulnerabilities. In the Akamai report, a week later, Echobot was at 26.\r\n\r\nhttps://www.zdnet.com/article/new-echobot-malware-is-a-smorgasbord-of-vulnerabilities", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.echobot", "https://unit42.paloaltonetworks.com/new-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices/", "https://blogs.akamai.com/sitr/2019/06/latest-echobot-26-infection-vectors.html", "https://www.bleepingcomputer.com/news/security/new-echobot-botnet-variant-uses-over-50-exploits-to-propagate/", "https://www.f5.com/labs/articles/threat-intelligence/echobot-malware-now-up-to-71-exploits--targeting-scada", "https://unit42.paloaltonetworks.com/mirai-variant-echobot-resurfaces-with-13-previously-unexploited-vulnerabilities/" ], "synonyms": [], "type": [] }, "uuid": "040ac9c6-e3ab-4b51-88a9-5380101c74f8", "value": "Echobot" }, { "description": "According to ESET Research, EdgeStepper is an adversary-in-the-middle tool, which forwards DNS traffic from machines in a targeted network to a malicious DNS node. This allows the attackers to redirect the traffic from software updates to a hijacking node that serves instructions to the legitimate software to download a malicious update.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.edgestepper", "https://www.welivesecurity.com/en/eset-research/plushdaemon-compromises-network-devices-for-adversary-in-the-middle-attacks/" ], "synonyms": [], "type": [] }, "uuid": "48969976-4b49-48f9-98d1-6b85beae2a3b", "value": "EdgeStepper" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.elevator", "https://blog.lumen.com/taking-the-elevator-down-to-ring-0/" ], "synonyms": [], "type": [] }, "uuid": "6ee05063-4f73-4a99-86a5-906164039a3a", "value": "Elevator" }, { "description": "According to the Infosec Institute, EnemyBot is a dangerous IoT botnet that has made headlines in the last few weeks. This threat, which seems to be disseminated by the Keksec group, expanded its features by adding recent vulnerabilities discovered in 2022. It was designed to attack web servers, Android devices and content management systems (CMS) servers.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.enemybot", "https://www.securonix.com/blog/detecting-the-enemybot-botnet-advisory/", "https://www.securonix.com/blog/detecting-the-enemybot-botnet-advisory", "https://www.fortinet.com/blog/threat-research/enemybot-a-look-into-keksecs-latest-ddos-botnet", "https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealthy-malware-targeting-linux", "https://cybersecurity.att.com/blogs/labs-research/rapidly-evolving-iot-malware-enemybot-now-targeting-content-management-system-servers" ], "synonyms": [], "type": [] }, "uuid": "262d18be-7cab-46c2-bcb0-47fff17604aa", "value": "EnemyBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.erebus", "https://blog.trendmicro.com/trendlabs-security-intelligence/erebus-resurfaces-as-linux-ransomware/", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf" ], "synonyms": [], "type": [] }, "uuid": "479353aa-c6d7-47a7-b5f0-3f97fd904864", "value": "Erebus (ELF)" }, { "description": "Ransomware used to target ESXi servers.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.esxi_args", "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/", "https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/", "https://blog.ovhcloud.com/ransomware-targeting-vmware-esxi/", "https://www.youtube.com/watch?v=bBcvqxPdjoI" ], "synonyms": [], "type": [] }, "uuid": "7550af7f-91cc-49e7-a4c5-d4e4d993cbef", "value": "ESXiArgs" }, { "description": "According to the author, Evilginx is a standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.evilginx", "https://osamaellahi.medium.com/the-art-of-defense-evasion-part-3-bypass-multi-factor-authentication-mfa-26d3a87dea0f", "https://github.com/kgretzky/evilginx2", "https://www.ironnet.com/blog/robin-banks-still-might-be-robbing-your-bank-part-2" ], "synonyms": [], "type": [] }, "uuid": "8eee410f-0538-4a6c-897b-c6bf4f9f28d7", "value": "Evilginx" }, { "description": "According to Infosec Institute, EvilGnome presents itself to unwitting Linux users as a legitimate GNOME extension. Legitimate extensions help to extend Linux functionality, but instead of a healthy boost in system functionality, EvilGnome begins spying on users with an array of functionalities uncommon for most Linux malware types.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.evilgnome", "https://ssu.gov.ua/uploads/files/DKIB/Technical%20report%20Armagedon.pdf", "https://cocomelonc.github.io/linux/2024/11/22/linux-hacking-3.html", "https://www.intezer.com/blog-evilgnome-rare-malware-spying-on-linux-desktop-users/", "https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought" ], "synonyms": [], "type": [] }, "uuid": "149e693c-4b51-4143-9061-6a8698b0e7f5", "value": "EvilGnome" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.ewdoor", "https://blog.netlab.360.com/warning-ewdoor-botnet-is-attacking-att-customers/" ], "synonyms": [], "type": [] }, "uuid": "e75eb723-7c23-4a3b-9419-cefb88e5f6b7", "value": "EwDoor" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.exaramel", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf", "https://www.wired.com/story/sandworm-centreon-russia-hack/", "https://attack.mitre.org/groups/G0034", "https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/", "https://twitter.com/craiu/status/1361581668092493824", "https://www.domaintools.com/resources/blog/centreon-to-exim-and-back-on-the-trail-of-sandworm", "https://pylos.co/wp-content/uploads/2020/02/Threat-Intelligence-and-the-Limits-of-Malware-Analysis.pdf", "https://www.welivesecurity.com/wp-content/uploads/2021/04/ESET_Industry_Report_Government.pdf" ], "synonyms": [], "type": [] }, "uuid": "1e0540f3-bad3-403f-b8ed-ce40a276559e", "value": "Exaramel (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.ext4", "https://www.recordedfuture.com/chinese-cyberespionage-operations", "https://www.recordedfuture.com/chinese-cyberespionage-operations/" ], "synonyms": [], "type": [] }, "uuid": "79b2b3c0-6119-4511-9c33-2a48532b6a60", "value": "ext4" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.facefish", "https://blog.netlab.360.com/ssh_stealer_facefish_en/" ], "synonyms": [], "type": [] }, "uuid": "106487ea-a710-4546-bd62-bdbfa0b0447e", "value": "Facefish" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.fbot", "https://blog.malwaremustdie.org/2020/01/mmd-0065-2020-linuxmirai-fbot.html", "https://securitynews.sonicwall.com/xmlpost/vigilante-malware-removes-cryptominers-from-the-infected-device/", "https://blog.netlab.360.com/fbot-is-now-riding-the-traffic-and-transportation-smart-devices-en/", "https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html" ], "synonyms": [], "type": [] }, "uuid": "501e5434-5796-4d63-8539-d99ec48119c2", "value": "FBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.finaldraft", "https://unit42.paloaltonetworks.com/advanced-backdoor-squidoor/", "https://www.elastic.co/security-labs/fragile-web-ref7707", "https://www.elastic.co/security-labs/finaldraft" ], "synonyms": [], "type": [] }, "uuid": "b82fc089-4c16-4bd6-a6d8-602b1d29e96c", "value": "FINALDRAFT (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.finfisher", "https://securelist.com/finspy-unseen-findings/104322/", "https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/", "https://netzpolitik.org/2020/our-criminal-complaint-german-state-malware-company-finfisher-raided/" ], "synonyms": [], "type": [] }, "uuid": "44018d71-25fb-4959-b61e-d7af97c85131", "value": "FinFisher (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.firewood", "https://intezer.com/blog/threat-bulletin-firewood/", "https://www.welivesecurity.com/en/eset-research/unveiling-wolfsbane-gelsemiums-linux-counterpart-to-gelsevirine/" ], "synonyms": [], "type": [] }, "uuid": "a65d5d88-c414-4670-afff-b2ff555ede8b", "value": "FireWood" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.flodrix", "https://www.trendmicro.com/en_us/research/25/f/langflow-vulnerability-flodric-botnet.html" ], "synonyms": [], "type": [] }, "uuid": "c7410cab-4912-4a7b-aa7f-db5f4dbbb5e1", "value": "Flodrix" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.floodor", "https://github.com/Thibault-69/Floodor" ], "synonyms": [], "type": [] }, "uuid": "ac30f2be-8153-4588-b29c-5e5863792930", "value": "floodor" }, { "description": "Malware used to run a DDoS botnet.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.fodcha", "https://blog.netlab.360.com/fodcha-a-new-ddos-botnet/", "https://www.bleepingcomputer.com/news/security/fodcha-ddos-botnet-reaches-1tbps-in-power-injects-ransoms-in-packets/" ], "synonyms": [], "type": [] }, "uuid": "4a64a1ca-e5bc-4a27-bff2-1c68cea05ba7", "value": "Fodcha" }, { "description": "This family utilizes custom modules allowing for remote access, credential harvesting (e.g. by modifying sshd) and proxy usage.\r\n\r\nIt comes with a rootkit as well.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.fontonlake", "https://www.welivesecurity.com/2021/10/07/fontonlake-previously-unknown-malware-family-targeting-linux/" ], "synonyms": [], "type": [] }, "uuid": "c530d62b-e49f-4ccf-9c87-d9f6c16617b7", "value": "FontOnLake" }, { "description": "Guardicore has discovered FritzFrog, a sophisticated peer-to-peer (P2P) botnet which has been actively breaching SSH servers since January 2020. It is a worm which is written in Golang, and is modular, multi-threaded and fileless, leaving no trace on the infected machine\u2019s disk. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.fritzfrog", "https://www.akamai.com/blog/security/fritzfrog-a-new-generation-of-peer-to-peer-botnets", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://www.securityweek.com/sophisticated-fritzfrog-p2p-botnet-returns-after-long-break", "https://www.akamai.com/blog/security/fritzfrog-p2p", "https://www.guardicore.com/2020/08/fritzfrog-p2p-botnet-infects-ssh-servers/", "https://blog.netlab.360.com/p2p-botnets-review-status-continuous-monitoring/", "https://www.cyberkendra.com/2024/02/fritzfrog-botnet-expands-attack-arsenal.html", "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf" ], "synonyms": [], "type": [] }, "uuid": "b43b7b4a-9cf4-4f98-b4d2-617a7d84bfa7", "value": "FritzFrog" }, { "description": "According to Synthient, Gaganode is a decentralized bandwidth monetization service that enables both users and publishers to earn crypto for their bandwidth or monetize other people's bandwidth. The SDK intentionally implements RCE, thus aligning Gaganode more closely with malware than standard commercial SDKs.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.gaganode", "https://synthient.com/blog/ipcola-a-tangled-mess" ], "synonyms": [], "type": [] }, "uuid": "87d98b0f-a0a2-4de2-987b-abff4a9f4cce", "value": "Gaganode (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.ghostpenguin", "https://www.trendmicro.com/en_us/research/25/l/ghostpenguin.html" ], "synonyms": [], "type": [] }, "uuid": "9a7d9f84-13ed-4952-bf12-5efb7382d263", "value": "GhostPenguin " }, { "description": "Gitpaste-12 is a modular malware first observed in October 2020 targeting Linux based x86 servers, as well as Linux ARM and MIPS based IoT devices. It uses GitHub and Pastebin as dead drop C2 locations.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.gitpaste12", "https://blogs.juniper.net/en-us/threat-research/gitpaste-12" ], "synonyms": [], "type": [] }, "uuid": "ffd09324-b585-49c0-97e5-536d386f49a5", "value": "Gitpaste-12" }, { "description": "ARM32 SOCKS proxy, written in Go, used in the Glupteba campaign.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.glupteba_proxy", "https://thehackernews.com/2022/03/over-200000-microtik-routers-worldwide.html", "https://decoded.avast.io/martinhron/meris-and-trickbot-standing-on-the-shoulders-of-giants/" ], "synonyms": [], "type": [] }, "uuid": "bcfec1d3-ff29-4677-a5f6-be285e98a9db", "value": "Glupteba Proxy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.gobrat", "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html" ], "synonyms": [], "type": [] }, "uuid": "ddba032c-ebde-4736-b7ef-8376702dac6a", "value": "GobRAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.godlua", "https://blog.netlab.360.com/an-analysis-of-godlua-backdoor-en/" ], "synonyms": [], "type": [] }, "uuid": "f3cb0a78-1608-44b1-9949-c6addf6c13ce", "value": "Godlua" }, { "description": "According to LAC, this malware is written in Go and was observed in 2022 used by an unknown China-based APT across several incidents in Japan. This backdoor has 20 commands and connects with C2 servers via KCP over UDP. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.gokcpdoor", "https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Lets-go-door-with-KCP.pdf" ], "synonyms": [], "type": [] }, "uuid": "23f97417-5028-47c0-8d97-a86b55d4f613", "value": "gokcpdoor" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.gomir", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/springtail-kimsuky-backdoor-espionage" ], "synonyms": [], "type": [] }, "uuid": "6fb012ce-c822-471c-9c15-4c7ecfb55528", "value": "Gomir" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.goreshell", "https://www.sentinelone.com/labs/follow-the-smoke-china-nexus-threat-actors-hammer-at-the-doors-of-top-tier-targets/", "https://cert.ssi.gouv.fr/uploads/CERTFR-2025-CTI-009.pdf" ], "synonyms": [], "type": [] }, "uuid": "886757fe-ef0b-47fd-a236-5331d1e0aa4e", "value": "GOREshell" }, { "description": "GOREVERSE is a publicly available reverse shell backdoor written in GoLang that operates over Secure Shell (SSH).", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.goreverse", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2025-CTI-009.pdf", "https://cloud.google.com/blog/topics/threat-intelligence/initial-access-brokers-exploit-f5-screenconnect", "https://www.mandiant.com/resources/blog/initial-access-brokers-exploit-f5-screenconnect", "https://rhisac.org/threat-intelligence/f5-big-ip-and-screenconnect-cves/" ], "synonyms": [], "type": [] }, "uuid": "f282559f-27a9-42f6-b4c7-c1cc547fb63f", "value": "GOREVERSE" }, { "description": "A DDoS botnet, based on Mirai.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.gorilla", "https://www.ncsc.admin.ch/ncsc/en/home/aktuell/im-fokus/2024/gorilla_bericht.html" ], "synonyms": [], "type": [] }, "uuid": "029f052f-a0f9-4902-a403-b4568fb2f25d", "value": "Gorilla" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.gosh", "https://twitter.com/IntezerLabs/status/1291355808811409408" ], "synonyms": [], "type": [] }, "uuid": "931f57f9-1edd-47b8-bf80-ae7190434558", "value": "GOSH" }, { "description": "GoTitan is a DDoS bot under development, which support ten different methods of launching distributed denial-of-service (DDoS) attacks: UDP, UDP HEX, TCP, TLS, RAW, HTTP GET, HTTP POST, HTTP HEAD, and HTTP PUT.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.gotitan", "https://www.fortinet.com/blog/threat-research/gotitan-botnet-exploitation-on-apache-activemq" ], "synonyms": [], "type": [] }, "uuid": "92007a5e-d408-4c95-b4c2-7b4e4e29559e", "value": "GoTitan" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.greedyantd", "https://www.intezer.com/blog-technical-analysis-cryptocurrency-mining-war-on-the-cloud/" ], "synonyms": [], "type": [] }, "uuid": "6aee7daf-9f63-4a70-bfe5-9c95cbdcb1e3", "value": "GreedyAntd" }, { "description": "According to Google, GRIDTIDE is a sophisticated backdoor written in C and delivered as a Linux ELF binary that provides remote shell command execution, file upload, and file download capabilities. It uses a cloud-based spreadsheet service as its command-and-control channel, interacting via official APIs and encoding all traffic with a URL-safe Base64 scheme to blend into legitimate HTTPS traffic. The malware relies on an external 16-byte key file to decrypt its cloud configuration using AES-128 in CBC mode, then performs detailed host reconnaissance (user, host, OS, network, and locale information) and stores this metadata in designated spreadsheet cells. GRIDTIDE establishes persistence through a system service, uses a cell-based polling mechanism for tasking and responses, and can stage tooling and exfiltrated data in spreadsheet cells to avoid traditional network-based detection.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.gridtide", "https://cloud.google.com/blog/topics/threat-intelligence/disrupting-gridtide-global-espionage-campaign/" ], "synonyms": [], "type": [] }, "uuid": "81174d13-4277-4160-8502-5fee4886281d", "value": "GRIDTIDE" }, { "description": "According to Mandiant, GRIMBOLT is a C#-written foothold backdoor compiled using native ahead-of-time (AOT) compilation and packed with UPX. It provides a remote shell capability and uses the same command and control as previously deployed BRICKSTORM payload. It's unclear if the threat actor's replacement of BRICKSTORM with GRIMBOLT was part of a pre-planned life cycle iteration by the threat actor or a reaction to incident response.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.grimbolt", "https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day" ], "synonyms": [], "type": [] }, "uuid": "cee445c0-d66b-4b25-a053-230ba9becd18", "value": "GRIMBOLT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.gwisin", "https://research.checkpoint.com/2023/the-platform-matters-a-comparative-study-on-linux-and-windows-ransomware-attacks/" ], "synonyms": [], "type": [] }, "uuid": "c02d252d-95cc-45bc-adb6-bae51b16c55b", "value": "Gwisin (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.habitsrat", "https://twitter.com/michalmalik/status/1435918937162715139" ], "synonyms": [], "type": [] }, "uuid": "e87e7f26-f2a1-437f-8650-312050e3cd48", "value": "HabitsRAT (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hadooken", "https://www.aquasec.com/blog/hadooken-malware-targets-weblogic-applications/", "https://www.bleepingcomputer.com/news/security/new-linux-malware-hadooken-targets-oracle-weblogic-servers/" ], "synonyms": [], "type": [] }, "uuid": "84e9e1ec-3676-4d64-9134-c48221c03e38", "value": "Hadooken" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.haiduc", "https://documents.trendmicro.com/assets/Perl-Based_Shellbot_Looks_to_Target_Organizations_via_C&C_appendix.pdf" ], "synonyms": [], "type": [] }, "uuid": "dd85732f-cbf8-4f2c-af5c-f51ef7d99b6a", "value": "Haiduc" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hajime", "https://security.radware.com/WorkArea/DownloadAsset.aspx?id=1461", "https://security.rapiditynetworks.com/publications/2016-10-16/hajime.pdf", "https://x86.re/blog/hajime-a-follow-up/", "http://blog.netlab.360.com/hajime-status-report-en/", "https://github.com/Psychotropos/hajime_hashes", "https://par.nsf.gov/servlets/purl/10096257", "https://blog.netlab.360.com/quick-summary-port-8291-scan-en/", "https://blog.netlab.360.com/p2p-botnets-review-status-continuous-monitoring/", "https://www.symantec.com/connect/blogs/hajime-worm-battles-mirai-control-internet-things" ], "synonyms": [], "type": [] }, "uuid": "ff8ee85f-4175-4f5a-99e5-0cbc378f1489", "value": "Hajime" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hakai", "https://researchcenter.paloaltonetworks.com/2018/07/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/" ], "synonyms": [], "type": [] }, "uuid": "0839c28a-ea11-44d4-93d1-24b246ef6743", "value": "Hakai" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.handymannypot", "https://twitter.com/liuya0904/status/1171633662502350848" ], "synonyms": [], "type": [] }, "uuid": "0b323b91-ad57-4127-99d1-6a2485be70df", "value": "HandyMannyPot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hand_of_thief", "https://web.archive.org/web/20130815040638/https://blogs.rsa.com/thieves-reaching-for-linux-hand-of-thief-trojan-targets-linux-inth3wild/", "https://blog.avast.com/2013/08/27/linux-trojan-hand-of-thief-ungloved/" ], "synonyms": [ "Hanthie" ], "type": [] }, "uuid": "db3e17f0-677b-4bdb-bc26-25e62a74673d", "value": "Hand of Thief" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.headcrab", "https://www.aquasec.com/blog/headcrab-2-0-evolving-threat-in-redis-malware-landscape/", "https://www.aquasec.com/blog/headcrab-attacks-servers-worldwide-with-novel-state-of-art-redis-malware/" ], "synonyms": [], "type": [] }, "uuid": "7bb684d8-ad5c-4d01-91eb-2c600dbcda2a", "value": "HeadCrab" }, { "description": "Ransomware.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.helldown", "https://x.com/nextronresearch/status/1851983952409473308", "https://www.linkedin.com/posts/threatmon_helldown-ransomware-malware-technical-analysis-activity-7288187849458245633-cyFk", "https://medium.com/@lcam/how-to-target-european-smes-with-ransomware-through-zyxel-c9779e96369a" ], "synonyms": [], "type": [] }, "uuid": "6dd0e6e4-536b-4271-a948-39282ff48940", "value": "HellDown" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hellobot", "https://blog.exatrack.com/melofee/", "https://www.trendmicro.com/en_us/research/22/d/new-apt-group-earth-berberoka-targets-gambling-websites-with-old.html" ], "synonyms": [], "type": [] }, "uuid": "b9fec670-2b1e-4287-ac93-68360d5adcf4", "value": "HelloBot (ELF)" }, { "description": "Linux version of the HelloKitty ransomware.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hellokitty", "https://blog.sekoia.io/vice-society-a-discreet-but-steady-double-extortion-ransomware-group/", "https://unit42.paloaltonetworks.com/emerging-ransomware-groups/", "https://soolidsnake.github.io/2021/07/17/hellokitty_linux.html", "https://www.esentire.com/blog/conti-affiliate-exposed-new-domain-names-ip-addresses-and-email-addresses-uncovered-by-esentire", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.bleepingcomputer.com/news/security/linux-version-of-hellokitty-ransomware-targets-vmware-esxi-servers/", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf", "https://www.govinfosecurity.com/vice-society-ransomware-gang-disrupted-spar-stores-a-18225", "https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/", "https://blog.sekoia.io/vice-society-a-discreet-but-steady-double-extortion-ransomware-group" ], "synonyms": [], "type": [] }, "uuid": "785cadf7-5c99-40bc-b718-8a98d9aa90b7", "value": "HelloKitty (ELF)" }, { "description": "Lumen discovered this malware used in campaign targeting business-grade routers using a RAT they call HiatusRAT and a variant of tcpdump for traffic interception.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hiatus_rat", "https://blog.lumen.com/hiatusrat-takes-little-time-off-in-a-return-to-action/", "https://blog.lumen.com/new-hiatusrat-router-malware-covertly-spies-on-victims/" ], "synonyms": [], "type": [] }, "uuid": "69dcee87-dc61-48d4-a6af-177396bdb850", "value": "HiatusRAT" }, { "description": "HiddenWasp is a Linux-based Trojan used to target systems for remote control. It comes in the form of a statically linked ELF binary with stdlibc++.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hiddenwasp", "https://cocomelonc.github.io/linux/2024/11/22/linux-hacking-3.html", "https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/", "https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/", "https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought" ], "synonyms": [], "type": [] }, "uuid": "ae00d48d-c515-4ca9-a29c-8c53a78f8c73", "value": "HiddenWasp" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hideandseek", "https://www.bleepingcomputer.com/news/security/hide-and-seek-becomes-first-iot-botnet-capable-of-surviving-device-reboots/", "https://labs.bitdefender.com/2018/01/new-hide-n-seek-iot-botnet-using-custom-built-peer-to-peer-communication-spotted-in-the-wild/", "https://www.bleepingcomputer.com/news/security/hns-evolves-from-iot-to-cross-platform-botnet/", "https://unit42.paloaltonetworks.com/hide-n-seek-botnet-updates-arsenal-with-exploits-against-nexus-repository-manager-thinkphp/", "https://blog.avast.com/hide-n-seek-botnet-continues", "https://threatlabs.avast.com/botnet", "https://www.fortinet.com/blog/threat-research/searching-for-the-reuse-of-mirai-code--hide--n-seek-bot.html", "https://www.bleepingcomputer.com/news/security/new-hns-iot-botnet-has-already-amassed-14k-bots/", "https://blog.netlab.360.com/hns-botnet-recent-activities-en/", "https://labs.bitdefender.com/2018/05/hide-and-seek-iot-botnet-resurfaces-with-new-tricks-persistence/" ], "synonyms": [ "HNS" ], "type": [] }, "uuid": "41bf8f3e-bb6a-445d-bb74-d08aae61a94b", "value": "Hide and Seek" }, { "description": "HinataBot is a Go-based DDoS-focused botnet. It was observed in the first quarter of 2023 targeting HTTP and SSH endpoints leveraging old vulnerabilities and weak credentials. Amongst those infection vectors are exploitation of the miniigd SOAP service on Realtek SDK devices (CVE-2014-8361), Huawei HG532 routers (CVE-2017-17215), and exposed Hadoop YARN servers.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hinata_bot", "https://www.akamai.com/blog/security-research/hinatabot-uncovering-new-golang-ddos-botnet" ], "synonyms": [], "type": [] }, "uuid": "b10fc382-b740-417a-98fa-e23d10223958", "value": "HinataBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hipid", "https://blogs.jpcert.or.jp/en/2022/09/bigip-exploit.html" ], "synonyms": [], "type": [] }, "uuid": "d55eb2f1-e24d-4b50-9839-2e53b5059bae", "value": "Hipid" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hive", "https://therecord.media/hive-ransomware-shuts-down-california-health-care-organization/", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://twitter.com/malwrhunterteam/status/1455628865229950979", "https://arxiv.org/pdf/2202.08477.pdf", "https://github.com/reecdeep/HiveV5_file_decryptor", "https://therecord.media/academics-publish-method-for-recovering-data-encrypted-by-the-hive-ransomware/", "https://krebsonsecurity.com/2023/05/russian-hacker-wazawaka-indicted-for-ransomware/", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v", "https://blog.group-ib.com/hive", "https://www.threatstop.com/blog/first-conti-then-hive-costa-rica-gets-hit-with-ransomware-again", "https://twitter.com/ESETresearch/status/1454100591261667329", "https://thehackernews.com/2022/02/master-key-for-hive-ransomware.html", "https://yoroi.company/research/on-the-footsteps-of-hive-ransomware/", "https://www.bleepingcomputer.com/news/security/hive-ransomware-ports-its-linux-vmware-esxi-encryptor-to-rust/", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-april-1st-2022-i-can-fight-with-a-keyboard/", "https://yoroi.company/wp-content/uploads/2022/07/Yoroi-On-The-Footsteps-of-Hive-Ransomware.pdf", "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-hive", "https://github.com/rivitna/Malware/tree/main/Hive", "https://lifars.com/2022/02/how-to-decrypt-the-files-encrypted-by-the-hive-ransomware/", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf", "https://securityaffairs.co/wordpress/128232/security/recover-files-hive-ransomware.html" ], "synonyms": [], "type": [] }, "uuid": "c22452c8-c818-4577-9737-0b87342c7913", "value": "Hive (ELF)" }, { "description": "Checkpoint Research describes this as part of a custom firmware image affiliated with the Chinese state-sponsored actor \u201cCamaro Dragon\u201d, a custom MIPS32 ELF implant. HorseShell, the main implant inserted into the modified firmware by the attackers, provides the attacker with 3 main functionalities:\r\n* Remote shell: Execution of arbitrary shell commands on the infected router\r\n* File transfer: Upload and download files to and from the infected router.\r\n* SOCKS tunneling: Relay communication between different clients.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.horseshell", "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/" ], "synonyms": [], "type": [] }, "uuid": "9d04d96a-92fd-4731-a3b5-a3fdafd3e523", "value": "Horse Shell" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hubnr", "https://github.com/carbreal/Malware_Analysis/tree/master/Hubnr_botnet" ], "synonyms": [], "type": [] }, "uuid": "c55389b0-e778-4cf9-9030-3d1efc1224c9", "value": "Hubnr" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hyperssl", "https://x.com/Unit42_Intel/status/1933565063736021372", "https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html" ], "synonyms": [ "SysUpdate" ], "type": [] }, "uuid": "263aaef5-9758-49f1-aff1-9a509f545bb3", "value": "HyperSSL (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.icefire", "https://www.sentinelone.com/labs/icefire-ransomware-returns-now-targeting-linux-enterprise-networks/" ], "synonyms": [], "type": [] }, "uuid": "c03b2f7f-31ed-4133-b947-4b8846d90f19", "value": "iceFire" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.icnanker", "https://blog.netlab.360.com/icnanker-trojan-downloader-shc-en/" ], "synonyms": [], "type": [] }, "uuid": "cd9f128b-6502-4e1b-a5b3-25f3c7f01ca3", "value": "Icnanker" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.inc", "https://twitter.com/malwrhunterteam/status/1689029459255373826", "https://medium.com/@ireneusz.tarnowski/inc-ransom-infrastructure-analysis-operational-tradecraft-and-detection-opportunities-b581d0ee723a", "https://x.com/MsftSecIntel/status/1836456406276342215", "https://cisoseries.com/cybersecurity-news-inc-targets-healthcare-providence-schools-cyberattack-apple-ipads-bricked/", "https://unit42.paloaltonetworks.com/inc-ransomware-rebrand-to-lynx/", "https://nikhilh-20.github.io/blog/inc_ransomware/" ], "synonyms": [], "type": [] }, "uuid": "fa3f90a3-40e3-4636-90f9-3e02bf645afd", "value": "INC (ELF)" }, { "description": "RAT. Functionality like ExecShell, GetFileList/SendFile/DownloadFile, Socks5, PortmapManager/GetConn/SendConn. Transport also supports Quic.\r\n\r\nVariants in C# and GO.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.insidiousgh0st", "https://blogapp.bitdefender.com/labs/content/files/2024/05/Bitdefender-Report-DeepDive-creat7721-en_EN.pdf" ], "synonyms": [], "type": [] }, "uuid": "17c90d11-601e-4694-9bf1-78a1fe225fe1", "value": "InsidiousGh0st (ELF)" }, { "description": "According to Sekoia, this is the ransomware used by the Interlock ransomware intrusion set, which was first observed in September 2024 conducting Big Game Hunting and double extortion campaigns.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.interlock", "https://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar/", "https://www.fortinet.com/blog/threat-research/ransomware-roundup-interlock" ], "synonyms": [], "type": [] }, "uuid": "d43c0e42-27e5-4eeb-aeca-65f3eec67d6f", "value": "Interlock (ELF)" }, { "description": "IOControl is a Linux backdoor which targets ARM-based IoT and OT systems, which a particular focus on Fuel and Industrial Control Systems. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.iocontrol", "https://www.armis.com/blog/iocontrol-malware-whats-new-whats-not/", "https://web-assets.claroty.com/resource-downloads/team82_iocontrol.pdf", "https://www.bleepingcomputer.com/news/security/new-iocontrol-malware-used-in-critical-infrastructure-attacks/", "https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol" ], "synonyms": [ "OrpraCab", "QueueCat" ], "type": [] }, "uuid": "d681df67-ea57-4384-a8bc-8f24f811000b", "value": "elf.iocontrol" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.iot_reaper", "http://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/", "https://research.checkpoint.com/new-iot-botnet-storm-coming/", "https://krebsonsecurity.com/2017/10/reaper-calm-before-the-iot-security-storm" ], "synonyms": [ "IoTroop", "Reaper", "iotreaper" ], "type": [] }, "uuid": "37c357a1-ec09-449f-b5a9-c1ef1fba2de2", "value": "IoT Reaper" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.ipstorm", "https://www.intezer.com/blog/research/a-storm-is-brewing-ipstorm-now-has-linux-malware/", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://www.justice.gov/usao-pr/pr/russian-and-moldovan-national-pleads-guilty-operating-illegal-botnet-proxy-service", "https://www.bitdefender.com/files/News/CaseStudies/study/376/Bitdefender-Whitepaper-IPStorm.pdf", "https://maldbg.com/ipstorm-golang-malware-windows", "https://www.anomali.com/blog/the-interplanetary-storm-new-malware-in-wild-using-interplanetary-file-systems-ipfs-p2p-network", "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf" ], "synonyms": [ "InterPlanetary Storm" ], "type": [] }, "uuid": "a24f9c4b-1fa7-4da2-9929-064345389e67", "value": "IPStorm (ELF)" }, { "description": "ccording to Fortinet, this is a Mirai-based DDoS botnet.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.iz1h9", "https://www.fortinet.com/blog/threat-research/Iz1h9-campaign-enhances-arsenal-with-scores-of-exploits" ], "synonyms": [], "type": [] }, "uuid": "6e98a149-9ce2-4750-9680-69f3ced5f33e", "value": "IZ1H9" }, { "description": "Jackskid is a Mirai-derived Linux/IoT DDoS botnet, first publicly documented by Foresiet in November 2025 and tracked by CNCERT/SecrSS as RCtea. It encrypts its configuration with a custom RC4 cipher post-processed by an LCG (key DEADBEEF CAFEBABE E0A4CBD6 BADC0DE5) and negotiates per-session ChaCha20 keys via XXTEA (passphrase FrshPckBnnnSplit). The same RC4+LCG modification appears in Aisuru, indicating a shared code lineage, and the family sits within the CatDDoS-derivative ecosystem. Later builds add ENS-based C2 resolution, an anti-competition module (0clKiller) backed by a NETLINK process monitor, and a pivot toward Android/ADB-exposed TV boxes. Jackskid and several related botnets were disrupted by law enforcement in March 2026.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.jackskid", "https://github.com/deepfield/public-research/blob/main/reports/2026-07-24-jackskid-residential-proxy-upnp.md", "https://github.com/deepfield/public-research/blob/main/jackskid/report.md" ], "synonyms": [ "RCtea" ], "type": [] }, "uuid": "f8477b0b-26df-48bc-9017-f89664000aea", "value": "Jackskid" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.jenx", "https://blog.radware.com/security/2018/02/jenx-los-calvos-de-san-calvicie/", "https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401" ], "synonyms": [], "type": [] }, "uuid": "6a4365fc-8448-4270-ba93-0341788d004b", "value": "JenX" }, { "description": "According to Lumen, J-Magic is a variant of cd00r and passively scans for five different predefined parameters before activating. If any of these parameters or \u201cmagic packets\u201d are received, the agent sends back a secondary challenge. Once that challenge is complete, J-magic establishes a reverse shell on the local file system, allowing the operators to control the device, steal data, or deploy malicious software. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.j_magic", "https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-them/" ], "synonyms": [], "type": [] }, "uuid": "7398222a-c9a5-4f59-8799-1f8fce3604c8", "value": "J-Magic" }, { "description": "Kaden is a DDoS botnet that is heavily based on Bashlite/Gafgyt. Next to DDoS capabilities it contains wiper functionality, which currently can not be triggerred (yet). ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.kaden", "https://www.forescout.com/blog/emerging-iot-wiper-malware-kaden-and-new-lolfme-botnet/" ], "synonyms": [], "type": [] }, "uuid": "eebd19b4-6671-4b17-be6a-cc467e5869a5", "value": "Kaden" }, { "description": "According to Black Lotus Labs, KadNap primarily targets Asus routers, conscripting them into a botnet that proxies malicious traffic. It employs a custom version of the Kademlia Distributed Hash Table (DHT) protocol, which is used to conceal the IP address of their infrastructure within a peer-to-peer system to evade traditional network monitoring.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.kadnap", "https://blog.lumen.com/silence-of-the-hops-the-kadnap-botnet/" ], "synonyms": [], "type": [] }, "uuid": "249b9f71-2a9d-4b23-b704-1fec143017b0", "value": "KadNap" }, { "description": "Surfaced in late April 2020, Intezer describes Kaiji as a DDoS malware written in Go that spreads through SSH brute force attacks. Recovered function names are an English representation of Chinese words, hinting about the origin. The name Kaiji was given by MalwareMustDie based on strings found in samples.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.kaiji", "https://www.bitdefender.com/box/blog/iot-news/kaiji-new-strain-iot-malware-seizing-control-launching-ddos-attacks/", "https://intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/", "https://blog.trendmicro.com/trendlabs-security-intelligence/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers/", "https://www.ibm.com/downloads/cas/WMDZOWK6?social_post=5483919673&linkId=131648775", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://www.elastic.co/security-labs/betting-on-bots", "https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/" ], "synonyms": [], "type": [] }, "uuid": "33fe7943-c1b3-48d5-b287-126390b091f0", "value": "Kaiji" }, { "description": "According to netenrich, Kaiten is a Trojan horse that opens a back door on the compromised computer that allows it to perform other malicious activities. The trojan does not create any copies of itself. This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.kaiten", "https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/kaiten-std-router-ddos-malware-threat-advisory.pdf", "https://www.trendmicro.com/en_us/research/20/i/exposed-docker-server-abused-to-drop-cryptominer-ddos-bot-.html", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/apache-log4j-zero-day", "https://www.lacework.com/blog/the-kek-security-network/", "https://www.lacework.com/the-kek-security-network/", "https://www.blackarrow.net/attackers-abuse-mobileirons-rce-to-deliver-kaiten/" ], "synonyms": [ "STD" ], "type": [] }, "uuid": "9b618703-58f6-4f0b-83a4-d4f13e2e5d12", "value": "Kaiten" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.kerberods", "https://www.fortinet.com/blog/threat-research/rocke-variant-ready-to-box-mining-challengers.html", "https://blog.trendmicro.com/trendlabs-security-intelligence/cve-2019-3396-redux-confluence-vulnerability-exploited-to-deliver-cryptocurrency-miner-with-rootkit/", "https://isc.sans.edu/forums/diary/Vulnerable+Apache+Jenkins+exploited+in+the+wild/24916", "https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang", "https://blog.talosintelligence.com/2019/09/watchbog-patching.html" ], "synonyms": [], "type": [] }, "uuid": "e3787d95-2595-449e-8cf9-90845a9b7444", "value": "kerberods" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.keyplug", "https://www.mandiant.com/resources/apt41-us-state-governments", "https://www.virusbulletin.com/uploads/pdf/conference/vb2024/papers/Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf", "https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf", "https://go.recordedfuture.com/hubfs/reports/cta-2023-0330.pdf", "https://web.archive.org/web/20240523105313/https://yoroi.company/en/research/uncovering-an-undetected-keyplug-implant-attacking-industries-in-italy/", "https://www.mandiant.com/resources/mobileiron-log4shell-exploitation", "https://hunt.io/blog/keyplug-infrastructure-tls-certificates-ghostwolf-activity", "https://twitter.com/CyberJack42/status/1501290277864046595", "https://www.sentinelone.com/labs/sandman-apt-china-based-adversaries-embrace-lua/", "https://experience.mandiant.com/trending-evil/p/1" ], "synonyms": [ "ELFSHELF" ], "type": [] }, "uuid": "2c4bfc14-3ea4-4ced-806a-fcac30b2a9d7", "value": "KEYPLUG" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.kfos", "https://twitter.com/r3dbU7z/status/1378564694462586880" ], "synonyms": [], "type": [] }, "uuid": "5e353bc2-4d32-409b-aeb6-c7df32607c56", "value": "kfos" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.kinsing", "https://www.trendmicro.com/en_us/research/20/k/analysis-of-kinsing-malwares-use-of-rootkit.html", "https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability", "https://sysdig.com/blog/zoom-into-kinsing-kdevtmpfsi/", "https://medium.com/s2wblog/logs-of-log4shell-cve-2021-44228-log4j-is-ubiquitous-en-809064312039", "https://twitter.com/MsftSecIntel/status/1535417776290111489", "https://www.trendmicro.com/en_us/research/22/i/a-post-exploitation-look-at-coinminers-abusing-weblogic-vulnerab.html", "https://unit42.paloaltonetworks.com/cve-2020-25213/", "https://twitter.com/IntezerLabs/status/1259818964848386048", "https://www.trendmicro.com/en_us/research/21/g/threat-actors-exploit-misconfigured-apache-hadoop-yarn.html", "https://www.zscaler.com/blogs/security-research/threatlabz-analysis-log4shell-cve-2021-44228-exploit-attempts", "https://www.alibabacloud.com/blog/new-outbreak-of-h2miner-worms-exploiting-redis-rce-detected_595743", "https://www.cyberark.com/resources/threat-research-blog/kinsing-the-malware-with-two-faces", "https://unit42.paloaltonetworks.com/atoms/moneylibra/", "https://www.ibm.com/downloads/cas/WMDZOWK6?social_post=5483919673&linkId=131648775", "https://www.aquasec.com/blog/aqua-cndr-stop-dreambus-botnet-attack/", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf", "https://blog.aquasec.com/kinsing-malware-exploits-novel-openfire-vulnerability", "https://www.aquasec.com/blog/loony-tunables-vulnerability-exploited-by-kinsing/", "https://www.bleepingcomputer.com/news/security/log4shell-exploits-now-used-mostly-for-ddos-botnets-cryptominers/", "https://redcanary.com/blog/kinsing-malware-citrix-saltstack/", "https://www.cadosecurity.com/analysis-of-initial-in-the-wild-attacks-exploiting-log4shell-log4j-cve-2021-44228/", "https://1665891.fs1.hubspotusercontent-na1.net/hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf", "https://www.aquasec.com/blog/kinsing-malware-exploits-novel-openfire-vulnerability/" ], "synonyms": [ "h2miner" ], "type": [] }, "uuid": "ef0e3a56-e614-4dc1-bb20-0dcf7215c1ea", "value": "Kinsing" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.kitty_soks5", "https://blog.apnic.net/2025/03/13/botnets-never-die/", "https://blog.xlab.qianxin.com/large-scale-botnet-airashi/" ], "synonyms": [], "type": [] }, "uuid": "687213a8-2e55-4a89-add7-b79e6fd5e46a", "value": "kitty-socks5" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.kivars", "https://www.trendmicro.com/en_us/research/16/c/threat-actors-behind-shrouded-crossbow-creates-bifrose-for-unix.html" ], "synonyms": [], "type": [] }, "uuid": "e8b24118-4ce8-471b-8683-1077a0f5f2a9", "value": "KIVARS (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.kobalos", "https://www.welivesecurity.com/wp-content/uploads/2021/05/eset_threat_report_t12021.pdf", "https://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure/", "https://team-cymru.com/blog/2021/02/05/kobalos-malware-mapping/", "https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf" ], "synonyms": [], "type": [] }, "uuid": "201d54ae-7fb0-4522-888c-758fa9019737", "value": "Kobalos" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.krasue_rat", "https://www.group-ib.com/blog/krasue-rat/" ], "synonyms": [], "type": [] }, "uuid": "b111325d-dd90-47cc-8777-fcb7e610a76e", "value": "Krasue RAT" }, { "description": "ELF x64 Rust downloader first discovered on Ivanti Connect Secure VPN after the exploitation of CVE-2024-21887 and CVE-2023-46805. Downloads Sliver backdoor and deletes itself.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.krustyloader", "https://nofix.re/posts/2024-11-02-rust-symbs/", "https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures", "https://www.synacktiv.com/publications/krustyloader-rust-malware-linked-to-ivanti-connectsecure-compromises", "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/", "https://nofix.re/posts/2024-08-03-arti-rust/" ], "synonyms": [], "type": [] }, "uuid": "1a5d8c38-42fa-4405-83fc-4e07b4407205", "value": "KrustyLoader" }, { "description": "According to Trend Micro, KTLVdoor is a highly obfuscated malware that masquerades as different system utilities, allowing attackers to carry out a variety of tasks including file manipulation, command execution, and remote port scanning.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.ktlv_door", "https://www.trendmicro.com/en_us/research/24/i/earth-lusca-ktlvdoor.html" ], "synonyms": [], "type": [] }, "uuid": "3ee0b08d-b872-4eda-8f8f-6d2f37b053ae", "value": "KTLVdoor (ELF)" }, { "description": "According to the author if this open source project, this is a library for injecting a shared library into a Linux, Windows and MacOS process.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.kubo_injector", "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ivanti-exploitation-persistence/" ], "synonyms": [], "type": [] }, "uuid": "ad8b5e47-338f-42ff-8aed-a455f697d5a7", "value": "Kubo Injector" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.kuiper", "https://www.trellix.com/about/newsroom/stories/research/the-evolution-of-the-kuiper-ransomware/" ], "synonyms": [], "type": [] }, "uuid": "30ad3f49-bffd-4383-88b3-067ccfac7038", "value": "Kuiper (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.lady", "https://news.drweb.com/news/?i=10140&lng=en" ], "synonyms": [], "type": [] }, "uuid": "f8b91c34-b4f0-4ef2-b9fb-15bd5ec0a66d", "value": "Lady" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.leethozer", "https://blog.netlab.360.com/the-leethozer-botnet-en/" ], "synonyms": [], "type": [] }, "uuid": "e9f2857a-cb91-4715-ac8b-fdc89bc9a03e", "value": "LeetHozer" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.lightning", "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/" ], "synonyms": [], "type": [] }, "uuid": "927bc8fc-fef4-4331-877d-18bcd33bdf9c", "value": "Lightning Framework" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.lilock", "https://fossbytes.com/lilocked-ransomware-infected-linux-servers/", "https://id-ransomware.blogspot.com/2019/07/lilu-lilocked-ransomware.html", "https://www.bleepingcomputer.com/news/security/lilocked-ransomware-actively-targeting-servers-and-web-sites/" ], "synonyms": [ "Lilocked", "Lilu" ], "type": [] }, "uuid": "1328ed0d-9c1c-418b-9a96-1c538e4893bc", "value": "LiLock" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.lilyofthevalley", "https://github.com/En14c/LilyOfTheValley" ], "synonyms": [], "type": [] }, "uuid": "f789442f-8f50-4e55-8fbc-b93d22b5314e", "value": "lilyofthevalley" }, { "description": "According to Synacktiv, LinkPro targets the GNU/Linux systems and is developed in Golang. It is named after its main module and the corresponding (private) GitHub repository. LinkPro uses eBPF technology, to activate only when receiving a \"magic package\", and to hide on the compromised system.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.linkpro", "https://www.synacktiv.com/en/publications/linkpro-ebpf-rootkit-analysis", "https://www.synacktiv.com/publications/linkpro-analyse-dun-rootkit-ebpf" ], "synonyms": [], "type": [] }, "uuid": "ae50535d-9f43-4131-9b2e-46c8fadcbda5", "value": "LinkPro" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.linodas", "https://research.checkpoint.com/2024/29676/" ], "synonyms": [ "DinodasRAT", "XDealer" ], "type": [] }, "uuid": "e47295eb-e907-410a-ab16-62ed8652d8bf", "value": "Linodas" }, { "description": "BitDefender tracked the development of a Mirai-inspired botnet, dubbed LiquorBot, which seems to be actively in development and has recently incorporated Monero cryptocurrency mining features. Interestingly, LiquorBot is written in Go (also known as Golang), which offers some programming advantages over traditional C-style code, such as memory safety, garbage collection, structural typing, and even CSP-style concurrency. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.liquorbot", "https://www.zdnet.com/article/naive-iot-botnet-wastes-its-time-mining-cryptocurrency/", "https://labs.bitdefender.com/2020/01/hold-my-beer-mirai-spinoff-named-liquorbot-incorporates-cryptomining/" ], "synonyms": [], "type": [] }, "uuid": "3fe8f3db-4861-4e78-8b60-a794fe22ae3f", "value": "LiquorBot" }, { "description": "According to ESET Research, LittleDaemon is the first stage deployed on the victim\u2019s machine through hijacked updates. It was observed in both DLL and executable versions, both of them 32-bit PEs. The main purpose of LittleDaemon is to communicate with the hijacking node to obtain the downloader that we call DaemonicLogistics. LittleDaemon does not establish persistence.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.little_daemon", "https://www.welivesecurity.com/en/eset-research/plushdaemon-compromises-network-devices-for-adversary-in-the-middle-attacks/" ], "synonyms": [], "type": [] }, "uuid": "cb4b6ab8-5f13-4635-b67b-6d49a545402d", "value": "LittleDaemon" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.lockbit", "https://www.bleepingcomputer.com/news/security/lockbit-victim-estimates-cost-of-ransomware-attack-to-be-42-million/", "https://www.trendmicro.com/en_us/research/25/i/lockbit-5-targets-windows-linux-esxi.html", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://analyst1.com/lockbit-takedown-operation-cronos-a-long-awaited-psyops-against-ransomware/", "https://nationalcrimeagency.gov.uk/news/nca-leads-international-investigation-targeting-worlds-most-harmful-ransomware-group", "https://github.com/prodaft/malware-ioc/tree/master/PTI-257", "https://securelist.com/crimeware-report-lockbit-switchsymb/110068/", "https://www.europol.europa.eu/media-press/newsroom/news/law-enforcement-disrupt-worlds-biggest-ransomware-operation", "https://www.linkedin.com/pulse/intrusion-insights-straight-from-leaked-operator-chats-ahmad-abdillah-p1ejc?utm_source=share&utm_medium=member_ios&utm_campaign=share_via", "https://lifars.com/wp-content/uploads/2022/02/LockBitRansomware_Whitepaper.pdf", "https://services.google.com/fh/files/misc/m-trends-2025-en.pdf", "https://www.washingtonpost.com/business/2024/02/20/lockbit-ransomware-cronos-nca-fbi/", "https://krebsonsecurity.com/2023/05/russian-hacker-wazawaka-indicted-for-ransomware/", "https://www.dragos.com/blog/industry-news/dragos-ics-ot-ransomware-analysis-q4-2021/", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://blog.compass-security.com/2022/03/vpn-appliance-forensics/", "https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/", "https://analyst1.com/ransomware-diaries-volume-1/", "https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf", "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html", "https://www.levelblue.com/blogs/spiderlabs-blog/19-shades-of-lockbit5.0-inside-the-latest-cross-platform-ransomware-part-1", "https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html", "https://security.packt.com/understanding-lockbit/", "https://www.crowdstrike.com/blog/better-together-global-attitude-survey-takeaways-2021/", "https://www.resecurity.com/blog/article/the-aviation-and-aerospace-sectors-face-skyrocketing-cyber-threats", "https://www.f6.ru/blog/bearlyfy/", "https://analyst1.com/ransomware-diaries-volume-3-lockbits-secrets/", "https://medium.com/@lcam/lighting-the-exfiltration-infrastructure-of-a-lockbit-affiliate-and-more-f57fbb7a4e79", "https://socradar.io/lockbit-3-another-upgrade-to-worlds-most-active-ransomware/", "https://www.fortinet.com/blog/threat-research/ransomware-roundup-new-variants", "https://www.ic3.gov/Media/News/2022/220204.pdf" ], "synonyms": [], "type": [] }, "uuid": "afce6aba-d4c4-49fa-b9a9-1a70e92e5a0e", "value": "LockBit (ELF)" }, { "description": "Loader and Cleaner components used in attacks against high-performance computing centers in Europe.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.loerbas", "https://twitter.com/nunohaien/status/1261281419483140096", "https://www.cadosecurity.com/2020/05/16/1318/", "https://atdotde.blogspot.com/2020/05/high-performance-hackers.html" ], "synonyms": [], "type": [] }, "uuid": "6332d57c-c46f-4907-8dac-965b15ffbed6", "value": "Loerbas" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.log_collector", "https://blog.netlab.360.com/dacls-the-dual-platform-rat/" ], "synonyms": [], "type": [] }, "uuid": "0473214a-2daa-4b5b-84bc-1bcbab11ef80", "value": "Log Collector" }, { "description": "According to Cisco Talos, LONGLEASH is a new version of the previously disclosed SHORTLEASH backdoor, built from the same C++ codebase and compiled for Linux on MIPS using the Boost.Asio asynchronous networking library along with open-source components for protobuf processing and TLS, and it offers extensive proxying and tunneling capabilities such as reverse shells, HTTP/DNS/SOCKS/TCP/ICMP/UDP proxies, SMTP, packet redirection, and the ability to act as an intermediate command and control server while self-removing if tampering is detected.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.longleash", "https://blog.talosintelligence.com/uat-7810/" ], "synonyms": [], "type": [] }, "uuid": "594a0465-95c5-491a-a83d-a3eefbb23d77", "value": "LONGLEASH" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.lootwodniw", "https://twitter.com/ddash_ct/status/1326887125103616000" ], "synonyms": [], "type": [] }, "uuid": "cfcf8608-03e7-4a5b-a46c-af342db2d540", "value": "Lootwodniw" }, { "description": "ESXi encrypting ransomware written in Rust.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.luna", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://nikhilh-20.github.io/blog/luna_ransomware/" ], "synonyms": [], "type": [] }, "uuid": "bc9022d6-ee65-463f-9823-bc0f96963a75", "value": "Luna" }, { "description": "According to Akamai, a Mirai variant exploiting GeoVision IoT devices, (possibly CVE-2024-6047 and/or CVE-2024-11120).", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.lzrd", "https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet" ], "synonyms": [], "type": [] }, "uuid": "d705d9cf-279d-40ef-8447-8d35604a2bed", "value": "LZRD" }, { "description": "Cisco Talos compared this RAT to Cobalt Strike and Sliver. Written in Rust.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.manjusaka", "https://github.com/avast/ioc/tree/master/Manjusaka", "https://blog.talosintelligence.com/2022/08/manjusaka-offensive-framework.html" ], "synonyms": [], "type": [] }, "uuid": "cd3a3a96-af66-4470-8115-b8bf3eef005a", "value": "Manjusaka (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.masol", "https://censys.com/blog/the-persistent-threat-of-salt-typhoon-tracking-exposures-of-potentially-targeted-devices", "https://www.trendmicro.com/en_us/research/24/k/earth-estries.html" ], "synonyms": [], "type": [] }, "uuid": "ab541e72-13a1-4156-af0b-144e1ad5aeb3", "value": "MASOL (ELF)" }, { "description": "Masuta is a variant of Mirai that targets IoT devices, primarily routers, using dictionary attacks to target weak credentials. PureMasuta is a variant of Masuta that targets the EDB 38722 D-Link HNAP Bug.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.masuta", "https://threatpost.com/satori-author-linked-to-new-mirai-variant-masuta/129640/", "https://blog.newskysecurity.com/masuta-satori-creators-second-botnet-weaponizes-a-new-router-exploit-2ddc51cc52a7", "https://www.virusbulletin.com/virusbulletin/2018/12/vb2018-paper-tracking-mirai-variants/#h2-appendix-sample-sha256-hashes" ], "synonyms": [ "PureMasuta" ], "type": [] }, "uuid": "b9168ff8-01df-4cd0-9f70-fe9e7a11eccd", "value": "Masuta" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.matryosh", "https://blog.netlab.360.com/matryosh-botnet-is-spreading-en/" ], "synonyms": [], "type": [] }, "uuid": "4e989704-c49f-468c-95e1-1b7c5a58b3c4", "value": "Matryosh" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.melofee", "https://blog.xlab.qianxin.com/analysis_of_new_melofee_variant_en/", "https://asec.ahnlab.com/en/55785/", "https://blog.exatrack.com/melofee/", "https://blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat/" ], "synonyms": [ "M\u00e9lof\u00e9e" ], "type": [] }, "uuid": "1ffd85bd-389c-4e04-88fd-8186423c3691", "value": "Melofee" }, { "description": "MESSAGETAP is a 64-bit ELF data miner initially loaded by an installation script. It is designed to monitor and save SMS traffic from specific phone numbers, IMSI numbers and keywords for subsequent theft.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.messagetap", "https://attack.mitre.org/groups/G0096", "https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf", "https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought", "https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf", "https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/", "https://www.fireeye.com/blog/threat-research/2019/10/messagetap-who-is-reading-your-text-messages.html", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf" ], "synonyms": [], "type": [] }, "uuid": "a07d6748-3557-41ac-b55b-f4348dc2a3c7", "value": "MESSAGETAP" }, { "description": "A x64 ELF file infector with non-destructive payload.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.midrashim", "https://github.com/guitmz/midrashim", "https://www.guitmz.com/linux-midrashim-elf-virus/" ], "synonyms": [], "type": [] }, "uuid": "fe220358-7118-4feb-b43e-cbdaf2ea09dc", "value": "Midrashim" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.mikey", "https://github.com/malware-kitten/securitykitten.github.io/blob/master/_posts/2016-12-14-mikey.md", "https://securitykitten.github.io/2016/12/14/mikey.html" ], "synonyms": [], "type": [] }, "uuid": "aae3b83d-a116-4ebc-aae0-f6327ef174ea", "value": "MiKey" }, { "description": "According to Google, MINOCAT is an 64-bit ELF executable for Linux that includes a custom \"NSS\" wrapper and an embedded, open-source Fast Reverse Proxy (FRP) client that handles the actual tunneling.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.minocat", "https://cloud.google.com/blog/topics/threat-intelligence/threat-actors-exploit-react2shell-cve-2025-55182" ], "synonyms": [], "type": [] }, "uuid": "741cb7a5-fd97-4a24-9164-d95a60db8c9e", "value": "MINOCAT" }, { "description": "Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means \"future\" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on \"Hack Forums\" many variants of the Mirai family appeared, infecting mostly home networks all around the world.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai", "https://blog.netlab.360.com/rimasuta-spread-with-ruijie-0day-en/", "https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/", "https://medium.com/s2wblog/logs-of-log4shell-cve-2021-44228-log4j-is-ubiquitous-en-809064312039", "https://blog.trendmicro.com/trendlabs-security-intelligence/mirai-botnet-exploit-weaponized-to-attack-iot-devices-via-cve-2020-5902/", "https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/", "https://twitter.com/MsftSecIntel/status/1535417776290111489", "https://unit42.paloaltonetworks.com/cve-2021-32305-websvn/", "https://isc.sans.edu/diary/22786", "https://krebsonsecurity.com/2017/12/mirai-iot-botnet-co-authors-plead-guilty/", "https://www.fortinet.com/blog/threat-research/totolink-vulnerabilities-beastmode-mirai-campaign", "https://socradar.io/what-you-need-to-know-about-russian-cyber-escalation-in-ukraine/", "https://unit42.paloaltonetworks.com/iot-vulnerabilities-mirai-payloads/", "https://www.cisecurity.org/insights/blog/top-10-malware-march-2022", "https://synthesis.to/2021/06/30/automating_string_decryption.html", "https://www.uptycs.com/blog/mirai-code-re-use-in-gafgyt", "https://www.cadosecurity.com/technical-analysis-of-the-ddos-attacks-against-ukrainian-websites/", "https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/", "https://blog.xlab.qianxin.com/mirai-nomi-en/", "https://www.lacework.com/blog/malware-targeting-latest-f5-vulnerability/", "https://unit42.paloaltonetworks.com/cve-2020-17496/", "http://osint.bambenekconsulting.com/feeds/", "https://www.greynoise.io/blog/new-ddos-botnet-discovered", "https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/", "https://cert.gov.ua/article/37139", "https://techcommunity.microsoft.com/t5/azure-sentinel/hunting-for-omi-vulnerability-exploitation-with-azure-sentinel/ba-p/2764093", "https://unit42.paloaltonetworks.com/new-mirai-variant-mukashi/", "https://blog.trendmicro.com/trendlabs-security-intelligence/new-mirai-variant-expands-arsenal-exploits-cve-2020-10173/", "https://unit42.paloaltonetworks.com/new-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices/", "https://www.zscaler.com/blogs/security-research/threatlabz-analysis-log4shell-cve-2021-44228-exploit-attempts", "https://blog.reversinglabs.com/blog/mirai-botnet-continues-to-plague-iot-space", "https://forensicitguy.github.io/extracting-indicators-from-packed-mirai/", "https://www.crowdstrike.com/blog/linux-targeted-malware-increased-by-35-percent-in-2021/", "https://www.trendmicro.com/en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tough-times-for-ukrainian-honeypot", "https://www.youtube.com/watch?v=KVJyYTie-Dc", "https://blog.netlab.360.com/wo-men-kan-dao-de-wu-ke-lan-bei-ddosgong-ji-xi-jie/", "https://www.bleepingcomputer.com/news/security/mirai-activity-picks-up-once-more-after-publication-of-poc-exploit-code/", "https://researchcenter.paloaltonetworks.com/2018/07/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/", "https://cybersecurity.att.com/blogs/labs-research/malware-hosting-domain-cyberium-fanning-out-mirai-variants", "https://exchange.xforce.ibmcloud.com/collection/InfectedNight-Mirai-Variant-With-Massive-Attacks-On-Our-Honeypots-dbea3e9e39b8265e729545fa798e4d18", "https://unit42.paloaltonetworks.com/hoaxcalls-mirai-target-legacy-symantec-web-gateways/", "https://blog.netlab.360.com/what-our-honeypot-sees-just-one-day-after-the-spring4shell-advisory-en/", "https://info.spamhaus.com/hubfs/Botnet%20Reports/Jul-Dec%202024%20Botnet%20Threat%20Update.pdf", "https://unit42.paloaltonetworks.com/mirai-compiled-for-new-processor-surfaces/", "https://unit42.paloaltonetworks.com/unit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall/", "https://blog.netlab.360.com/new-mirai-variant-with-dga/", "https://www.lacework.com/blog/mirai-goes-stealth-tls-iot-malware/", "https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-january-to-june-2025/", "https://thehackernews.com/2022/04/hackers-exploiting-spring4shell.html", "https://cujo.com/mirai-gafgyt-with-new-ddos-modules-discovered/", "https://www.tesorion.nl/en/resources/pdfstore/Report-OSINT-Russia-Ukraine-Conflict-Cyberaspect.pdf", "https://www.radware.com/getmedia/18d24c2d-c092-4a61-9ad6-ebb92b7a49b8/Alert_Realtek_SDK.aspx", "https://www.stratosphereips.org/blog/2019/4/12/analysis-of-a-irc-based-botnet", "https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/", "https://info.spamhaus.com/hubfs/Botnet%20Reports/Jan-Jun%202024%20Botnet%20Threat%20Update.pdf", "https://unit42.paloaltonetworks.com/cve-2022-22954-vmware-vulnerabilities/", "https://github.com/jgamblin/Mirai-Source-Code", "http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/", "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf", "https://blogs.jpcert.or.jp/en/2022/03/anti_upx_unpack.html", "https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/", "https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-july-to-december-2025/", "https://www.fortinet.com/blog/threat-research/the-ghosts-of-mirai", "https://www.crowdstrike.com/blog/linux-mirai-malware-double-on-stronger-chips/", "https://www.cadosecurity.com/analysis-of-initial-in-the-wild-attacks-exploiting-log4shell-log4j-cve-2021-44228/", "https://www.politie.nl/nieuws/2019/oktober/2/11-servers-botnet-offline.html", "https://blog.trendmicro.com/trendlabs-security-intelligence/with-mirai-comes-miori-iot-botnet-delivered-via-thinkphp-remote-code-execution-exploit/", "https://prod-blog.avira.com/katana-a-new-variant-of-the-mirai-botnet", "https://www.uptycs.com/blog/discovery-of-simps-botnet-leads-ties-to-keksec-group", "https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html", "https://www.netscout.com/blog/asert/ddos-attack-campaign-targeting-multiple-organizations-ukraine", "https://www.fortinet.com/blog/threat-research/multiple-malware-campaigns-target-vmware-vulnerability", "https://unit42.paloaltonetworks.com/mirai-variant-echobot-resurfaces-with-13-previously-unexploited-vulnerabilities/", "https://www.youtube.com/watch?v=fei0mN7pkvA&t=10s", "https://deform.co/the-infamous-mirai-trojan-evolves-new-pandora-variant-targets-android-tvs/", "https://community.riskiq.com/article/d8a78daf" ], "synonyms": [ "Katana" ], "type": [] }, "uuid": "17e12216-a303-4a00-8283-d3fe92d0934c", "value": "Mirai (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.mokes", "https://securelist.com/from-linux-to-windows-new-family-of-cross-platform-desktop-backdoors-discovered/73503/" ], "synonyms": [], "type": [] }, "uuid": "6d5a5357-4126-4950-b8c3-ee78b1172217", "value": "Mokes (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.momentum", "https://www.trendmicro.com/en_us/research/19/l/ddos-attacks-and-iot-exploits-new-activity-from-momentum-botnet.html" ], "synonyms": [], "type": [] }, "uuid": "aaf8ce1b-3117-47c6-b756-809538ac8ff2", "value": "Momentum" }, { "description": "A ransomware, derived from the leaked Conti source code.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.monti", "https://resources.prodaft.com/wazawaka-report", "https://www.trendmicro.com/en_us/research/23/h/monti-ransomware-unleashes-a-new-encryptor-for-linux.html" ], "synonyms": [], "type": [] }, "uuid": "7df77b77-00dd-4eba-a697-b9a7be262acc", "value": "Monti" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot", "https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b", "https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-botnet-controlled-russian", "https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/", "https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-RUSSIAN-ACTORS-USE-ROUTERS-FACILITATE-CYBER_OPERATIONS.PDF", "https://github.com/blackorbird/APT_REPORT/blob/master/APT28/APT28%20the%20long%20hand%20of%20Russian%20interests.pdf", "https://www.fortinet.com/blog/threat-research/mirai-based-botnet-moobot-targets-hikvision-vulnerability", "https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/", "https://blog.netlab.360.com/ddos-botnet-moobot-en/", "https://unit42.paloaltonetworks.com/moobot-d-link-devices/" ], "synonyms": [], "type": [] }, "uuid": "cd8deffe-eb0b-4451-8a13-11f6d291064a", "value": "MooBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.moose", "http://www.welivesecurity.com/2016/11/02/linuxmoose-still-breathing/", "http://www.welivesecurity.com/2015/05/26/moose-router-worm/", "http://gosecure.net/2016/11/02/exposing-the-ego-market-the-cybercrime-performed-by-the-linux-moose-botnet/", "https://www.virusbulletin.com/uploads/pdf/magazine/2018/VB2018-Paquet-Clouston.pdf", "https://web-assets.esetstatic.com/wls/2015/05/Dissecting-LinuxMoose.pdf" ], "synonyms": [], "type": [] }, "uuid": "7fdb91ea-52dc-499c-81f9-3dd824e2caa0", "value": "Moose" }, { "description": "Mozi is a IoT botnet, that makes use of P2P for communication and reuses source code of other well-known malware families, including Gafgyt, Mirai, and IoT Reaper.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.mozi", "https://cujo.com/upx-anti-unpacking-techniques-in-iot-malware/", "https://www.nozominetworks.com/blog/overcoming-the-challenges-of-detecting-p2p-botnets-on-your-network/", "https://www.nozominetworks.com/blog/how-iot-botnets-evade-detection-and-analysis/", "https://blog.centurylink.com/new-mozi-malware-family-quietly-amasses-iot-bots/", "https://www.cloudsek.com/blog/mozi-resurfaces-as-androxgh0st-botnet-unraveling-the-latest-exploitation-wave", "https://go.recordedfuture.com/hubfs/reports/cta-2021-1112.pdf", "https://www.youtube.com/watch?v=cDFO_MRlg3M", "https://www.crowdstrike.com/blog/linux-targeted-malware-increased-by-35-percent-in-2021/", "https://www.microsoft.com/security/blog/2021/08/19/how-to-proactively-defend-against-mozi-iot-botnet/", "https://www.elastic.co/blog/collecting-and-operationalizing-threat-data-from-the-mozi-botnet", "https://blog.netlab.360.com/mozi-another-botnet-using-dht/", "https://blog.netlab.360.com/p2p-botnets-review-status-continuous-monitoring/", "https://blog.netlab.360.com/the-mostly-dead-mozi-and-its-lingering-bots/" ], "synonyms": [], "type": [] }, "uuid": "236ba358-4c70-434c-a7ac-7a31e76c398a", "value": "Mozi" }, { "description": "MrBlack, first identified in May 2014 by Russian security firm Dr. Web, is a botnet that targets Linux OS and is designed to conduct distributed denial-of-service (DDoS) attacks. In May 2015, Incapsula clients suffered a large-scale DDoS attack which the company attributed to network traffic generated by tens of thousands of small office/home office (SOHO) routers infected with MrBlack. This massive botnet spans over 109 countries, especially in Thailand and Brazil.\r\n\r\nMrBlack scans for and infects routers that have not had their default login credentials changed and that allow remote access to HTTP and SSH via port 80 and port 22, respectively. One of the most impacted router brands is Ubiquiti, a U.S.-based firm that provides bulk network hub solutions for internet service providers to lease to their customers. Once a vulnerable router is compromised and MrBlack is injected into the system, a remote server is contacted and system information from the device is transmitted. This allows the host server to receive commands in order to perform different types of DDoS attacks, download and execute files, and terminate processes.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.mrblack", "https://news.drweb.com/?i=5760&c=23&lng=en", "https://www.botconf.eu/wp-content/uploads/2015/12/OK-P13-Liu-Ya-Automatically-Classify-Unknown-Bots-by-The-Register-Messages.pdf", "https://blog.syscall.party/post/aes-ddos-analysis-part-1/", "https://www.bleepingcomputer.com/news/security/exposed-docker-apis-abused-by-ddos-cryptojacking-botnet-malware/", "https://www.virusbulletin.com/uploads/pdf/conference/vb2015/KalnaiHorejsi-VB2015.pdf" ], "synonyms": [ "AESDDoS", "Dofloo" ], "type": [] }, "uuid": "fc047e32-9cf2-4a92-861a-be882efd8a50", "value": "MrBlack" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.mumblehard", "https://www.welivesecurity.com/wp-content/uploads/2015/04/mumblehard.pdf" ], "synonyms": [], "type": [] }, "uuid": "5f78127b-25d3-4f86-8a64-f9549b2db752", "value": "Mumblehard" }, { "description": "Ransomware used against Linux servers.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.nextcry", "https://www.bleepingcomputer.com/news/security/new-nextcry-ransomware-encrypts-data-on-nextcloud-linux-servers/" ], "synonyms": [], "type": [] }, "uuid": "7ec8a41f-c72e-4832-a5a4-9d7380cea083", "value": "Nextcry" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.ngioweb", "https://www.trendmicro.com/en_us/research/24/k/water-barghest.html", "https://blog.netlab.360.com/linux-ngioweb-v2-going-after-iot-devices-en/", "https://levelblue.com/blogs/labs-research/ngioweb-remains-active-7-years-later", "https://blog.netlab.360.com/an-analysis-of-linux-ngioweb-botnet-en/", "https://blog.lumen.com/one-sock-fits-all-the-use-and-abuse-of-the-nsocks-botnet/", "https://twitter.com/IntezerLabs/status/1324346324683206657", "https://www.trendmicro.com/pt_br/research/24/k/water-barghest.html", "https://www.trendmicro.com/de_de/research/24/k/water-barghest.html", "https://www.trendmicro.com/en_in/research/24/e/router-roulette.html" ], "synonyms": [], "type": [] }, "uuid": "a4ad242c-6fd0-4b1d-8d97-8f48150bf242", "value": "Ngioweb (ELF)" }, { "description": "According to the author, Nimbo-C2 is yet another (simple and lightweight) C2 framework. The agent currently supports Windows x64 and Linux. It's written in Nim, with some usage of .NET (by dynamically loading the CLR to the process).", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.nimbo_c2", "https://github.com/itaymigdal/Nimbo-C2", "https://www.sentinelone.com/labs/follow-the-smoke-china-nexus-threat-actors-hammer-at-the-doors-of-top-tier-targets/" ], "synonyms": [], "type": [] }, "uuid": "5dbdf2ea-a15b-4ad6-bf7a-a030998c66b4", "value": "Nimbo-C2 (ELF)" }, { "description": "Golang-based RAT that offers execution of shell commands and download+run capability. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.niub", "https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf", "https://labs.bitdefender.com/2020/10/theres-a-new-a-golang-written-rat-in-town/" ], "synonyms": [], "type": [] }, "uuid": "7c516b66-f4a4-406a-bf35-d898ac8bffec", "value": "NiuB" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.noabot", "https://nikhilh-20.github.io/blog/noabot_botnet/", "https://www.akamai.com/blog/security-research/mirai-based-noabot-crypto-mining" ], "synonyms": [], "type": [] }, "uuid": "b5ee45a0-d75b-40e7-b737-3cfa1cc8246c", "value": "NoaBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.noodrat", "https://asec.ahnlab.com/en/62144/" ], "synonyms": [], "type": [] }, "uuid": "59ac87c0-f2ce-4e83-83bd-299e123b72a7", "value": "Nood RAT" }, { "description": "According to Black Lotus Labs, Nosedive is a custom variation of the Mirai implant that is supported on all major SOHO and IoT architectures (e.g. MIPS, ARM, SuperH, PowerPC, etc.). Nosedive implants are typically deployed from Tier 2 payload servers in the Raptor Train infrastructure through a unique URL encoding scheme and domain injection method. Nosedive droppers use this method to request payloads for specific C2s by encoding the requested C2 domain and joining it with a unique \"key\" that identifies the bot and the target architecture of the compromised device (e.g. MIPS, ARM, etc.), which is then injected into the Nosedive implant payload that is deployed to the Tier 1 node. Once deployed, Nosedive runs in-memory only and allows the operators to execute commands, upload and download files, and run DDoS attacks on compromised devices. \r\n\r\nThe malware and its associated droppers are memory-resident only and deleted from disk. This, in addition to anti-forensics techniques employed on these devices including the obfuscation of running process names, compromising devices through a multi-stage infection chain, and killing remote management processes, makes detection and forensics much more difficult. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.nosedive", "https://blog.lumen.com/derailing-the-raptor-train/", "https://www.justice.gov/d9/2024-09/redacted_24-mj-1484_signed_search_and_seizure_warrant_for_disclosure.pdf", "https://assets.lumen.com/is/content/Lumen/raptor-train-handbook-copy", "https://media.defense.gov/2024/Sep/18/2003547016/-1/-1/0/CSA-PRC-LINKED-ACTORS-BOTNET.PDF" ], "synonyms": [], "type": [] }, "uuid": "13840bb0-494d-403e-a37d-65cf144d71e9", "value": "Nosedive" }, { "description": "FireEye states that NOTROBIN is a utility written in Go 1.10 and compiled to a 64-bit ELF binary for BSD systems. It periodically scans for and deletes files matching filename patterns and content characteristics. The purpose seems to be to block exploitation attempts against the CVE-2019-19781 vulnerability; however, FireEye believes that NOTROBIN provides backdoor access to the compromised system.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.notrobin", "https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought", "https://www.fireeye.com/blog/threat-research/2020/01/vigilante-deploying-mitigation-for-citrix-netscaler-vulnerability-while-maintaining-backdoor.html", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://www.theregister.co.uk/2020/01/17/hackers_patch_citrix_vulnerability/", "https://news.sophos.com/en-us/2020/05/21/asnarok2/", "https://dcso.de/2020/01/16/a-curious-case-of-cve-2019-19781-palware-remove_bds/", "https://blog.dcso.de/a-curious-case-of-cve-2019-19781-palware-remove_bds/", "https://www.fireeye.com/blog/products-and-services/2020/01/rough-patch-promise-it-will-be-200-ok.html" ], "synonyms": [ "remove_bds" ], "type": [] }, "uuid": "aaeb76b3-3885-4dc6-9501-4504fed9f20b", "value": "NOTROBIN" }, { "description": "According to stormshield, Orbit is a two-stage malware that appeared in July 2022, discovered by Intezer lab. Acting as a stealer and backdoor on 64-bit Linux systems, it consists of an executable acting as a dropper and a dynamic library.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.orbit", "https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/" ], "synonyms": [], "type": [] }, "uuid": "ae9d84f2-60e5-4a33-98f4-a0061938ec6d", "value": "OrBit" }, { "description": "Mirai variant by actor \"Anarchy\" that used CVE-2017-17215 in July 2018 to compromise 18,000+ devices.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.owari", "https://www.scmagazine.com/malware-author-anarchy-builds-18000-strong-huawei-router-botnet/article/782395/", "https://twitter.com/hrbrmstr/status/1019922651203227653", "https://twitter.com/360Netlab/status/1019759516789821441", "https://blog.newskysecurity.com/understanding-the-iot-hacker-a-conversation-with-owari-sora-iot-botnet-author-117feff56863", "https://www.bleepingcomputer.com/news/security/router-crapfest-malware-author-builds-18-000-strong-botnet-in-a-day/", "https://www.fortinet.com/blog/threat-research/a-wicked-family-of-bots.html", "https://twitter.com/ankit_anubhav/status/1019647993547550720" ], "synonyms": [], "type": [] }, "uuid": "ec67f206-6464-48cf-a012-3cdfc1278488", "value": "Owari" }, { "description": "According to Yarix digital security, this is a malware that allows to sniff on HTTPS traffic, implemented as Apache module.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.p0st5n1f3r", "https://www.vargroup.it/wp-content/uploads/2019/10/ReverseEngineering_SecurityReport_EN_2019.10.16-2.pdf", "https://blog.kartone.ninja/the-p0st5n1f3r-backdoor/" ], "synonyms": [], "type": [] }, "uuid": "cc48c6ae-d274-4ad0-b013-bd75041a20c8", "value": "p0sT5n1F3r" }, { "description": "P2Pinfect is a fast-growing multi platform botnet, the purpose of which is still unknown. Written in Rust, it is compatible with Windows and Linux, including a MIPS variant for Linux based routers and IoT devices. It is capable of brute forcing SSH logins and exploiting Redis servers in order to propagate itself both to random IPs on the internet and to hosts it can find references to in files present on the infected system.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.p2pinfect", "https://www.cadosecurity.com/blog/from-dormant-to-dangerous-p2pinfect-evolves-to-deploy-new-ransomware-and-cryptominer", "https://www.nozominetworks.com/blog/p2pinfect-worm-evolves-to-target-a-new-platform", "https://www.cadosecurity.com/p2pinfect-new-variant-targets-mips-devices/", "https://www.cadosecurity.com/redis-p2pinfect/", "https://www.cadosecurity.com/cado-security-labs-researchers-witness-a-600x-increase-in-p2pinfect-traffic/", "https://unit42.paloaltonetworks.com/peer-to-peer-worm-p2pinfect/" ], "synonyms": [], "type": [] }, "uuid": "31a32308-7034-4419-b1f3-56a4d64b4358", "value": "P2Pinfect" }, { "description": "According to 0x3oBAD, this is a 64-bit Linux ELF ransomware binary targeting VMware ESXi hypervisor environments. The sample combines a robust cryptographic scheme Curve25519 ECDHand ChaCha20 with ESXi-specific VM enumeration via the vmInventory.xml inventory file, graceful shutdown of running VMs before encryption, and a multi-threaded file encryption pipeline scaled to available CPU cores. The ransom note is delivered inside ESXi\u2019s own web UI welcome.txt, replacing the host management interface greeting.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.payload", "https://www.egfincirt.org.eg/payload-ransomware", "https://0x3obad.github.io/posts/payload-ransomware-writeup/" ], "synonyms": [], "type": [] }, "uuid": "f35bb242-d065-4b1a-9f1f-b774383747ef", "value": "Payload " }, { "description": "P2P botnet derived from the Mirai source code.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.pbot", "https://www.cert.org.cn/publish/main/11/2021/20210628133948926376206/20210628133948926376206_.html" ], "synonyms": [], "type": [] }, "uuid": "7aff049d-9326-466d-bbcc-d62da673b32c", "value": "pbot" }, { "description": "According to Cisco Talos, PeerTime is an ELF-based backdoor compiled for multiple architectures including common embedded and server platforms, with one version written in C/C++ and a newer version written in Rust. It is deployed via shell scripts and an auxiliary \"instrumentor\" component that can detect container runtimes and launch the loader in these environments, with the instrumentor containing debug strings in Simplified Chinese that point to Chinese-speaking developers. PeerTime\u2019s loader decrypts and decompresses the main payload in memory, can rename its process to appear benign, and uses the BitTorrent protocol to discover command-and-control information, exchange data with peers, and download and execute additional payloads. The malware uses standard Unix utilities to copy and place downloaded files, enabling flexible post-compromise tool delivery across diverse Linux and embedded systems.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.peer_time", "https://blog.talosintelligence.com/uat-9244/" ], "synonyms": [], "type": [] }, "uuid": "b29ad13b-65b1-422f-ba32-8ed4869937aa", "value": "PeerTime" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.penquin_turla", "https://securelist.com/big-threats-using-code-similarity-part-1/97239/", "https://securelist.com/files/2017/04/Penquins_Moonlit_Maze_AppendixB.pdf", "https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf", "https://lab52.io/blog/looking-for-penquins-in-the-wild/", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf", "https://www.youtube.com/watch?v=JXsjRUxx47E", "https://www.leonardocompany.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf", "https://securelist.com/apt-trends-report-q2-2020/97937/", "https://twitter.com/juanandres_gs/status/944741575837528064", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180251/Penquins_Moonlit_Maze_PDF_eng.pdf", "https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/", "https://securelist.com/files/2017/04/Penquins_Moonlit_Maze_PDF_eng.pdf" ], "synonyms": [], "type": [] }, "uuid": "262e0cf2-2fed-4d37-8d7a-0fd62c712840", "value": "Penquin Turla" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.perfctl", "https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-millions-of-linux-servers/", "https://www.cadosecurity.com/blog/from-automation-to-exploitation-the-growing-misuse-of-selenium-grid-for-cryptomining-and-proxyjacking" ], "synonyms": [ "perfcc" ], "type": [] }, "uuid": "5a4408f2-6ee3-4c82-9ee2-a1b4290666be", "value": "perfctl" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.perlbot", "https://brianstadnicki.github.io/posts/malware-gitlab-perlbot/", "https://www.trendmicro.com/en_us/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html", "https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/", "https://us-cert.cisa.gov/ncas/alerts/aa20-345a", "https://unit42.paloaltonetworks.com/los-zetas-from-eleethub-botnet/", "https://yoroi.company/research/outlaw-is-back-a-new-crypto-botnet-targets-european-organizations/", "https://asec.ahnlab.com/en/49769/", "https://asec.ahnlab.com/en/54647/", "https://therecord.media/agents-raid-home-of-kansas-man-seeking-info-on-botnet-that-infected-dod-network/", "https://sysdig.com/blog/rubycarp-romanian-botnet-group/", "https://twitter.com/Nocturnus/status/1308430959512092673", "https://documents.trendmicro.com/assets/Perl-Based_Shellbot_Looks_to_Target_Organizations_via_C&C_appendix.pdf", "https://sysdig.com/blog/malware-analysis-shellbot-sysdig/", "https://jask.com/wp-content/uploads/2019/02/Shellbot-Campaign_v2.pdf", "https://unit42.paloaltonetworks.com/cve-2022-22954-vmware-vulnerabilities/", "https://unit42.paloaltonetworks.com/cve-2020-17496/" ], "synonyms": [ "DDoS Perl IrcBot", "ShellBot" ], "type": [] }, "uuid": "24b77c9b-7e7e-4192-8161-b6727728170f", "value": "PerlBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.persirai", "http://blog.trendmicro.com/trendlabs-security-intelligence/persirai-new-internet-things-iot-botnet-targets-ip-cameras/" ], "synonyms": [], "type": [] }, "uuid": "2ee05352-3d4a-448b-825d-9d6c10792bf7", "value": "Persirai" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.pg_mem", "https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-processes/" ], "synonyms": [], "type": [] }, "uuid": "74ffa404-9082-4db9-ac19-18a875db9fe7", "value": "PG_MEM" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.pigmy_goat", "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/pygmy-goat/ncsc-mar-pygmy-goat.pdf" ], "synonyms": [], "type": [] }, "uuid": "fcdcdc68-4c82-4d3d-aef1-96eac0a62761", "value": "PigmyGoat" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.pingpull", "https://unit42.paloaltonetworks.com/alloy-taurus/", "https://blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat/" ], "synonyms": [], "type": [] }, "uuid": "65a7944c-15d9-4ca5-8561-7c97b18684c8", "value": "PingPull" }, { "description": "A botnet with P2P and centralized C&C capabilities.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.pink", "https://blog.netlab.360.com/p2p-botnets-review-status-continuous-monitoring/", "https://blog.netlab.360.com/pink-en/" ], "synonyms": [], "type": [] }, "uuid": "67063764-a47c-4058-9cb2-1685ffa14fe8", "value": "Pink" }, { "description": "According to Mandiant, this is a SparkGateway plugin that loads LITTLELAMB.WOOLTEA through JNI.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.pitfuel", "https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence", "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ivanti-exploitation-persistence/" ], "synonyms": [], "type": [] }, "uuid": "af5d3d2c-6cb4-4890-8f06-fa76c9d684e8", "value": "PITFUEL" }, { "description": "According to Mandiant, PITHOOK hooks the accept and accept4 functions within the web process by modifying the PLT. When PITHOOK receives a buffer matching the predefined magic byte sequence, it will duplicate the socket and forward it to PITSTOP over the Unix domain socket /data/runtime/cockpit/wd.fd.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.pithook", "https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence", "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ivanti-exploitation-persistence/" ], "synonyms": [], "type": [] }, "uuid": "666aa489-0e84-4f7e-a513-f3f13c18ac43", "value": "PITHOOK" }, { "description": "According to Mandiant, this is backdoor which hooks the accept and setsockopt of the web process by modifying its procedure linkage table (PLT). This enables backdoor communication via the Unix socket /tmp/clientsDownload.sock when it receives a specific 48-byte magic byte sequence in the incoming buffer.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.pitsock", "https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence", "https://cloud.google.com/blog/topics/threat-intelligence/investigating-ivanti-exploitation-persistence/" ], "synonyms": [], "type": [] }, "uuid": "c7c64576-526e-420c-9ec8-d6b899014c89", "value": "PITSOCK" }, { "description": "According to Nexttron Systems, this is an implant built as a malicious PAM (Pluggable Authentication Module), enabling attackers to silently bypass system authentication and gain persistent SSH access.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.plague", "https://www.nextron-systems.com/2025/08/01/plague-a-newly-discovered-pam-based-backdoor-for-linux/" ], "synonyms": [], "type": [] }, "uuid": "47988844-818c-4a59-a089-fdd6c10e7a3c", "value": "Plague" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.plead", "https://www.macnica.net/file/mpressioncss_ta_report_2019_2_nopw.pdf", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://www.ironnet.com/blog/china-cyber-attacks-the-current-threat-landscape", "https://blogs.jpcert.or.jp/en/2020/11/elf-plead.html", "https://cyberandramen.net/2021/02/11/blacktech-updates-elf-plead-backdoor/", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf", "https://www.cyberandramen.net/home/blacktech-doesnt-miss-a-step-a-quick-analysis-of-a-busy-2020", "https://jp.security.ntt/resources/EN-BlackTech_2021.pdf" ], "synonyms": [], "type": [] }, "uuid": "de3c14aa-f9f4-4071-8e6e-a2c16a3394ad", "value": "PLEAD (ELF)" }, { "description": "According to Sekoia, this is a form of TLS backdoor containing pre-defined commands. Their investigation initially identified Cisco routers as a target but they also uncovered other payloads from the same family, but targeting different devices, notably Asus, QNAP and Synology. A working hypothesis suggests that devices compromised with PolarEdge could be used as Operational Relay Boxes (ORB) to facilitate offensive cyber operations.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.polaredge", "https://blog.sekoia.io/polaredge-unveiling-an-uncovered-iot-botnet/", "https://blog.xlab.qianxin.com/smoking-gun-uncovered-rpx-relay-at-polaredges-core-exposed/", "https://censys.com/blog/2025-state-of-the-internet-digging-into-residential-proxy-infrastructure" ], "synonyms": [], "type": [] }, "uuid": "30e97f5e-69d8-48f4-93b9-cc0a33de7db6", "value": "PolarEdge" }, { "description": "Part of Mythic C2, written in Golang.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.poseidon", "https://www.seqrite.com/blog/umbrella-of-pakistani-threats-converging-tactics-of-cyber-operations-targeting-india/", "https://cert.gov.ua/article/6123309", "https://github.com/MythicAgents/poseidon", "https://brandefense.io/blog/apt-36-campaign-poseidon-malware-technical-analysis/" ], "synonyms": [], "type": [] }, "uuid": "ad796632-2595-4ae5-a563-b92197210d61", "value": "Poseidon (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.prism", "https://cybersecurity.att.com/blogs/labs-research/prism-attacks-fly-under-the-radar" ], "synonyms": [ "waterdrop" ], "type": [] }, "uuid": "9a4a866b-84a9-4778-8de8-2780a27c0597", "value": "PRISM" }, { "description": "Black Lotus Labs identified malware for the Windows Subsystem for Linux (WSL). Mostly written in Python but compiled as Linux ELF files.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.privet_sanya", "https://blog.lumen.com/no-longer-just-theory-black-lotus-labs-uncovers-linux-executables-deployed-as-stealth-windows-loaders/" ], "synonyms": [], "type": [] }, "uuid": "41e5aafb-5847-421e-813d-627414ee31bb", "value": "PrivetSanya" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.prometei", "https://blog.talosintelligence.com/2020/07/prometei-botnet-and-its-quest-for-monero.html", "https://cujo.com/iot-malware-journals-prometei-linux/", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://twitter.com/IntezerLabs/status/1338480158249013250", "https://www.trendmicro.com/en_us/research/21/e/proxylogon-a-coinminer--a-ransomware--and-a-botnet-join-the-part.html", "https://www.cybereason.com/blog/prometei-botnet-exploiting-microsoft-exchange-vulnerabilities", "https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html" ], "synonyms": [], "type": [] }, "uuid": "b6899bda-54e9-4953-8af5-22af39776b69", "value": "Prometei (ELF)" }, { "description": "Unit 42 describes this as a malware used by Rocke Group that deploys an XMRig miner.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.pro_ocean", "https://unit42.paloaltonetworks.com/pro-ocean-rocke-groups-new-cryptojacking-malware/", "https://seguranca-informatica.pt/new-cryptojacking-malware-called-pro-ocean-is-now-attacking-apache-oracle-and-redis-servers/" ], "synonyms": [], "type": [] }, "uuid": "aa918c10-e5c7-4abd-b8c0-3c938a6675f5", "value": "Pro-Ocean" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.pumabot", "https://www.darktrace.com/blog/pumabot-novel-botnet-targeting-iot-surveillance-devices" ], "synonyms": [], "type": [] }, "uuid": "5b7cb40f-38c3-4741-a288-e3b3b62ee2ae", "value": "PumaBot" }, { "description": "According to Elastic, PUMAKIT is a sophisticated loadable kernel module (LKM) rootkit that employs advanced stealth mechanisms to hide its presence and maintain communication with command-and-control servers. \r\n\r\nThe rootkit component, referenced by the malware authors as \u201cPUMA\", employs an internal Linux function tracer (ftrace) to hook 18 different syscalls and several kernel functions, enabling it to manipulate core system behaviors. Unique methods are used to interact with PUMA, including using the rmdir() syscall for privilege escalation and specialized commands for extracting configuration and runtime information. \r\n\r\nKey functionalities of the kernel module include privilege escalation, hiding files and directories, concealing itself from system tools, anti-debugging measures, and establishing communication with command-and-control (C2) servers.\r\n\r\nThere is also an accompanying userland SO rootkit internally referred to as Kitsune.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.pumakit", "https://www.elastic.co/security-labs/declawing-pumakit", "https://ptsecurity.com/research/pt-esc-threat-intelligence/ex-cobalt-a-review-of-the-group-s-attack-tools-for-2024-2025" ], "synonyms": [ "Kitsune", "PUMA" ], "type": [] }, "uuid": "8e589764-4941-4078-a793-71c0a19b2d9f", "value": "PUMAKIT" }, { "description": "Pupy is an open-source, cross-platform RAT and post-exploitation framework mainly written in python. Pupy can be loaded from various loaders, including PE EXE, reflective DLL, Linux ELF, pure python, powershell and APK. Most of the loaders bundle an embedded python runtime, python library modules in source/compiled/native forms as well as a flexible configuration. They bootstrap a python runtime environment mostly in-memory for the later stages of pupy to run in. Pupy can communicate using various transports, migrate into processes, load remote python code, python packages and python C-extensions from memory.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.pupy", "https://go.recordedfuture.com/hubfs/reports/cta-2020-0123.pdf", "https://github.com/n1nj4sec/pupy" ], "synonyms": [], "type": [] }, "uuid": "92a1288f-cc4d-47ca-8399-25fe5a39cf2d", "value": "pupy (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.pwnlnx", "https://x.com/IntezerLabs/status/1308740144120213506?ref=blog.xlab.qianxin.com" ], "synonyms": [], "type": [] }, "uuid": "401ebc95-1d41-4712-94ad-8d8993814d3d", "value": "PWNLNX" }, { "description": "Qilin ransomware, initially observed in July 2022 under the name \u201cAgenda,\u201d operates on a Ransomware-as-a-Service (RaaS) model. This model allows core developers to provide their malicious software and infrastructure to affiliates in exchange for a percentage of the profits generated from attacks. The name \u201cQilin\u201d references a Chinese mythological creature symbolizing power and prosperity, a fitting metaphor for the group\u2019s perceived influence and financial objectives. Despite the Chinese name, the group is linked to Russian-speaking cybercriminals, often recruiting affiliates on Russian-language forums and notably excluding Commonwealth of Independent States (CIS) countries from its targets.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.qilin", "https://www.bleepingcomputer.com/news/security/linux-version-of-qilin-ransomware-focuses-on-vmware-esxi/", "https://medium.com/@raghavtiresearch/qilin-ransomware-as-a-service-threat-analysis-and-strategic-outlook-daf8bd6808b5", "https://tehtris.com/en/blog/rage-against-the-powershell-qilin-in-the-name/", "https://x.com/MsftSecIntel/status/1897738961348374621", "https://twitter.com/malwrhunterteam/status/1724521714845937822", "https://research.checkpoint.com/2026/iranian-mois-actors-the-cyber-crime-connection/", "https://research.cert.orangecyberdefense.com/smokedham/smoking_out_an_affiliate.pdf" ], "synonyms": [], "type": [] }, "uuid": "d97af6c5-640f-46b4-943c-0e8940f8011e", "value": "Qilin" }, { "description": "According to Trend Micro, Quasar Linux RAT (QLNX) is a comprehensive Linux implant that combines remote access capabilities with advanced evasion, persistence, keylogging, and credential harvesting features. The malware carries embedded C source code for both its PAM backdoor and LD_PRELOAD rootkit as string literals within the binary. It dynamically compiles rootkit shared objects and PAM backdoor modules on the target host using gcc, then deploys them via /etc/ld.so.preload for system-wide interception.\r\nQLNX targets developers and DevOps credentials across the software supply chain. Its credential harvester extracts secrets from high-value files such as .npmrc (NPM tokens), .pypirc (PyPI credentials), .git-credentials, .aws/credentials, .kube/config, .docker/config.json, .vault-token, Terraform credentials, GitHub CLI tokens, and .env files. The compromise of these assets could allow the operator to push malicious packages to NPM or PyPI registries, access cloud infrastructure, or pivot through CI/CD pipelines.\r\nQLNX incorporates a PAM backdoor with inline hooking, enabling plaintext credential interception during authentication. It uses the hardcoded master password O$$f$QtYJK and XOR-encrypted credential harvesting to /var/log/.ICE-unix.\r\nQLNX includes a P2P mesh capability that transforms individual implants into a resilient network, making complete eradication significantly more difficult.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.qlnx", "https://www.trendmicro.com/en_us/research/26/e/quasar-linux-qlnx-a-silent-foothold-in-the-software-supply-chain.html" ], "synonyms": [ "Quasar Linux RAT" ], "type": [] }, "uuid": "882acf36-b0ea-4f37-975f-edcc444d1403", "value": "QLNX" }, { "description": "The QNAPCrypt ransomware works similarly to other ransomware, including encrypting all files and delivering a ransom note. However, there are several important differences:\r\n\r\n1. The ransom note was included solely as a text file, without any message on the screen\u2014naturally, because it is a server and not an endpoint.\r\n\r\n2. Every victim is provided with a different, unique Bitcoin wallet\u2014this could help the attackers avoid being traced.\r\n\r\n3. Once a victim is compromised, the malware requests a wallet address and a public RSA key from the command and control server (C&C) before file encryption.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.qnapcrypt", "https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought", "https://blog.netlab.360.com/qnap-nas-users-make-sure-you-check-your-system/", "https://www.intezer.com/blog/malware-analysis/when-viruses-mutate-did-suncrypt-ransomware-evolve-from-qnapcrypt", "https://www.bleepingcomputer.com/news/security/qnap-warns-of-ech0raix-ransomware-attacks-roon-server-zero-day/", "https://www.intezer.com/blog-russian-cybercrime-group-fullofdeep-behind-qnapcrypt-ransomware-campaigns/", "https://unit42.paloaltonetworks.com/ech0raix-ransomware-soho/", "https://documents.trendmicro.com/assets/pdf/wp-backing-your-backup-defending-nas-devices-against-evolving-threats.pdf", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf", "https://www.intezer.com/blog-seizing-15-active-ransomware-campaigns-targeting-linux-file-storage-servers/", "https://www.ibm.com/downloads/cas/Z81AVOY7", "https://www.qnap.com/en/security-advisory/QSA-20-02", "https://www.anomali.com/blog/the-ech0raix-ransomware" ], "synonyms": [ "eCh0raix" ], "type": [] }, "uuid": "a0b12e5f-0257-41f1-beda-001ad944c4ca", "value": "QNAPCrypt" }, { "description": "The malware infects QNAP NAS devices, is persisting via various mechanisms and resists cleaning by preventing firmware updates and interfering with QNAP MalwareRemover. The malware steals passwords and hashes", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.qsnatch", "https://www.ncsc.gov.uk/files/NCSC%20CISA%20Alert%20-QNAP%20NAS%20Devices.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa20-209a", "https://www.trendmicro.com/en_us/research/21/l/the-evolution-of-iot-linux-malware-based-on-mitre-att&ck-ttps.html", "https://bin.re/blog/the-dga-of-qsnatch/", "https://documents.trendmicro.com/assets/pdf/wp-backing-your-backup-defending-nas-devices-against-evolving-threats.pdf", "https://www.kyberturvallisuuskeskus.fi/en/news/qsnatch-malware-designed-qnap-nas-devices" ], "synonyms": [], "type": [] }, "uuid": "48389957-30e2-4747-b4c6-8b8a9f15250f", "value": "QSnatch" }, { "description": "Mandiant observed this backdoor being observed by UNC3524. It is based on the open-source Dropbear SSH source code. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.quietexit", "https://www.mandiant.com/resources/unc3524-eye-spy-email", "https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023" ], "synonyms": [], "type": [] }, "uuid": "6a5ab9ca-944c-4187-bdef-308516745d18", "value": "QUIETEXIT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.r2r2", "https://www.guardicore.com/2018/06/operation-prowli-traffic-manipulation-cryptocurrency-mining/" ], "synonyms": [], "type": [] }, "uuid": "759f8590-a049-4c14-be8a-e6605e2cd43d", "value": "r2r2" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.ragnarlocker", "https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf", "https://techcrunch.com/2023/10/20/ragnarlocker-ransomware-dark-web-portal-seized-in-international-sting/?guccounter=1", "https://twitter.com/malwrhunterteam/status/1475568201673105409", "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/analysis-and-protections-for-ragnarlocker-ransomware.html" ], "synonyms": [], "type": [] }, "uuid": "5f96787e-fc9f-486b-a15f-f46c8179a4d5", "value": "RagnarLocker (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.rakos", "https://journal.cecyf.fr/ojs/index.php/cybin/article/view/16/22", "http://www.welivesecurity.com/2016/12/20/new-linuxrakos-threat-devices-servers-ssh-scan/" ], "synonyms": [], "type": [] }, "uuid": "4592384c-48a7-4e16-b492-7add50a7d2f5", "value": "Rakos" }, { "description": "According to SentineOne, RansomEXX (aka Defray, Defray777), a multi-pronged extortion threat, has been observed in the wild since late 2020. RansomEXX is associated with attacks against the Texas Department of Transportation, Groupe Atlantic, and several other large enterprises. There are Windows and Linux variants of this malware family, and they are known for their limited and exclusive targeting.\r\n\r\n", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.ransomexx", "https://gustavopalazolo.medium.com/ransomexx-an%C3%A1lise-do-ransomware-utilizado-no-ataque-ao-stj-918001ec8195", "https://securelist.com/ransomexx-trojan-attacks-linux-systems/99279/", "https://www.cybereason.com/blog/cybereason-vs.-ransomexx-ransomware", "https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", "https://www.bleepingcomputer.com/news/security/ecuadors-state-run-cnt-telco-hit-by-ransomexx-ransomware/", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://www.ic3.gov/Media/News/2021/211101.pdf", "https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf", "https://www.sentinelone.com/anthology/ransomexx/", "https://securityintelligence.com/x-force/ransomexx-upgrades-rust/", "https://www.youtube.com/watch?v=qxPXxWMI2i4", "https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/", "https://www.ctir.gov.br/arquivos/alertas/2020/alerta_2020_03_ataques_de_ransomware.pdf", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf", "https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout", "https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/" ], "synonyms": [ "Defray777" ], "type": [] }, "uuid": "946814a1-957c-48ce-9068-fdef24a025bf", "value": "RansomEXX (ELF)" }, { "description": "According to IBM Security X-Force, this is a new but functionally very similar version of RansomExx, fully rewritten in Rust and internally referred to as RansomExx2.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.ransomexx2", "https://securityintelligence.com/x-force/ransomexx-upgrades-rust/" ], "synonyms": [], "type": [] }, "uuid": "c6d750d5-fa47-4fcb-9d24-2682036fc6e5", "value": "RansomExx2" }, { "description": "A Mirai derivate bruteforcing SSH servers.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.rapper_bot", "https://www.wsj.com/tech/oregon-man-accused-of-operating-one-of-most-powerful-attack-botnets-ever-seen-380b2caf?mod=RSSMSN", "https://www.bitsight.com/blog/rapperbot-infection-ddos-split-second", "https://socradar.io/linux-malware-rapperbot-brute-forcing-ssh-servers/", "https://www.fortinet.com/blog/threat-research/new-rapperbot-campaign-ddos-attacks", "https://www.fortinet.com/blog/threat-research/rapperbot-malware-discovery" ], "synonyms": [], "type": [] }, "uuid": "914c94eb-38e2-4cb8-a62b-21fbe9c48496", "value": "RapperBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.raspberrypibotnet", "https://kindredsec.com/2019/06/03/code-analysis-of-basic-cryptomining-malware/" ], "synonyms": [], "type": [] }, "uuid": "8dee025b-2233-4cd8-af02-fcdcd40b378f", "value": "RaspberryPiBotnet" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.rat_hodin", "https://github.com/Thibault-69/RAT-Hodin-v2.5" ], "synonyms": [], "type": [] }, "uuid": "6aacf515-de49-4afc-a135-727c9beaab0b", "value": "rat_hodin" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.rbs_srv", "https://github.com/Thibault-69/Remote_Shell" ], "synonyms": [], "type": [] }, "uuid": "a08d9f8b-2cc5-48c2-8cce-ee713bcdc4b7", "value": "rbs_srv" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.redshell", "https://www.trendaisecurity.com/en/resources-insights/trendai-security-blog/redc2-ai-powered-linux-implant" ], "synonyms": [], "type": [] }, "uuid": "f0f5c113-0ca5-4c52-bf83-20ee83d18b02", "value": "redshell" }, { "description": "RedTail is a cryptomining malware, which is based on the open-source XMRIG mining software. It is being spread via known vulnerabilities such as:\r\n- CVE-2024-3400 \r\n- CVE-2023-46805\r\n- CVE-2024-21887\r\n- CVE-2023-1389\r\n- CVE-2022-22954\r\n- CVE-2018-20062", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.redtail", "https://www.akamai.com/blog/security-research/2024-redtail-cryptominer-pan-os-cve-exploit", "https://securite360.net/how-long-can-a-vulnerable-server-stay-clean-on-the-internet-a-honeypot-tale" ], "synonyms": [], "type": [] }, "uuid": "ba89a509-ff8e-446b-867c-7f15efe0477f", "value": "RedTail" }, { "description": "RedXOR is a sophisticated backdoor targeting Linux systems disguised as polkit daemon and utilizing network data encoding based on XOR. Believed to be developed by Chinese nation-state actors, this malware shows similarities to other malware associated with the Winnti umbrella threat group. \r\n\r\nRedXOR uses various techniques such as open-source LKM rootkits, Python pty shell, and network data encoding with XOR. It also employs persistence methods and communication with a Command and Control server over HTTP. \r\n\r\nThe malware can execute various commands including system information collection, updates, shell commands, and network tunneling. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.redxor", "https://www.intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/" ], "synonyms": [], "type": [] }, "uuid": "421b2ec7-d4e6-4fc8-9bd3-55fe26337aae", "value": "RedXOR" }, { "description": "Ransomware that targets Linux VMware ESXi servers. Encryption procedure uses the NTRUEncrypt public-key encryption algorithm.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.red_alert", "https://blog.cyble.com/2022/07/12/new-ransomware-groups-on-the-rise/", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://www.bleepingcomputer.com/news/security/new-redalert-ransomware-targets-windows-linux-vmware-esxi-servers/" ], "synonyms": [ "N13V" ], "type": [] }, "uuid": "12137c8d-d3f4-44fe-b25e-2fb5f90cecce", "value": "RedAlert Ransomware" }, { "description": "A Trojan for Linux intended to infect machines with the SPARC architecture and Intel x86, x86-64 computers. The Trojan\u2019s configuration data is stored in a file encrypted with XOR algorithm.\r\n\r\nSome versions have there configuration stored within the .data section using RC4 to encrypt the details.\r\n\r\nConfiguration options include C2 IP and Port, as well as defence evasion details for changing the process name. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.rekoobe", "https://www.intezer.com/blog/malware-analysis/elf-malware-analysis-101-part-3-advanced-analysis/", "https://yoroi.company/research/shadows-from-the-past-threaten-italian-enterprises/", "https://twitter.com/billyleonard/status/1458531997576572929", "https://vms.drweb.com/virus/?i=7754026&lng=en", "https://www.sekoia.io/en/walking-on-apt31-infrastructure-footprints/", "https://documents.trendmicro.com/assets/txt/earth-berberoka-linux-iocs-2.txt", "https://sansec.io/research/rekoobe-fishpig-magento", "https://asec.ahnlab.com/en/55229/", "https://intezer.com/blog-linux-rekoobe-operating-with-new-undetected-malware-samples/", "https://hunt.io/blog/rekoobe-backdoor-discovered-in-open-directory-possibly-targeting-tradingview-users", "https://decoded.avast.io/davidalvarez/linux-threat-hunting-syslogk-a-kernel-rootkit-found-under-development-in-the-wild/", "https://blog.techevo.uk/analysis/linux/2024/11/30/rekoobe-apt31-linux-backdoor.html" ], "synonyms": [], "type": [] }, "uuid": "48b9a9fd-4c1a-428a-acc0-40b1a3fa7590", "value": "Rekoobe" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.reptile", "https://asec.ahnlab.com/en/55785/", "https://dfir.ch/posts/reptile_launcher/", "https://documents.trendmicro.com/assets/white_papers/wp-operation-earth-berberoka.pdf", "https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-40-LunghiHorejsi.pdf", "https://github.com/f0rb1dd3n/Reptile", "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers" ], "synonyms": [], "type": [] }, "uuid": "934478a1-1243-4c26-8360-be3d01ae193e", "value": "reptile" }, { "description": "ELF version of win.revil targeting VMware ESXi hypervisors.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.revil", "https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/", "https://www.digitalshadows.com/blog-and-research/revil-analysis-of-competing-hypotheses/", "https://www.bleepingcomputer.com/news/security/revil-ransomware-shuts-down-again-after-tor-sites-were-hijacked/", "https://www.youtube.com/watch?v=ptbNMlWxYnE", "https://www.domaintools.com/resources/blog/the-most-prolific-ransomware-families-a-defenders-guide", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.reuters.com/technology/exclusive-governments-turn-tables-ransomware-gang-revil-by-pushing-it-offline-2021-10-21/", "https://us-cert.cisa.gov/ncas/current-activity/2021/07/04/cisa-fbi-guidance-msps-and-their-customers-affected-kaseya-vsa", "https://www.br.de/nachrichten/deutschland-welt/mutmasslicher-ransomware-millionaer-identifiziert,Sn3iHgJ", "https://www.fincen.gov/sites/default/files/advisory/2021-11-08/FinCEN%20Ransomware%20Advisory_FINAL_508_.pdf", "https://ke-la.com/will-the-revils-story-finally-be-over/", "https://twitter.com/IntezerLabs/status/1452980772953071619", "http://www.fsb.ru/fsb/press/message/single.htm%21id%3D10439388%40fsbMessage.html", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://www.bbc.com/news/technology-59297187", "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v", "https://angle.ankura.com/post/102hcny/revix-linux-ransomware", "https://storage.courtlistener.com/recap/gov.uscourts.txnd.351760/gov.uscourts.txnd.351760.1.0_3.pdf", "https://diicot.ro/mass-media/3341-comunicat-de-presa-2-08-11-2021", "https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/", "https://krebsonsecurity.com/2021/11/revil-ransom-arrest-6m-seizure-and-10m-reward/", "https://threatpost.com/linux-variant-ransomware-vmwares-nas/167511/", "https://www.fbi.gov/wanted/cyber/yevgyeniy-igoryevich-polyanin", "https://www.justice.gov/opa/pr/ukrainian-arrested-and-charged-ransomware-attack-kaseya", "https://www.youtube.com/watch?v=mDUMpYAOMOo", "https://home.treasury.gov/news/press-releases/jy0471", "https://cybleinc.com/2021/07/03/uncensored-interview-with-revil-sodinokibi-ransomware-operators/", "https://www.secureworks.com/blog/revil-ransomware-reemerges-after-shutdown-universal-decryptor-released", "https://malienist.medium.com/revix-linux-ransomware-d736956150d0", "https://www.trendmicro.com/en_in/research/21/k/global-operations-lead-to-arrests-of-alleged-members-of-gandcrab.html", "https://threatpost.com/ransomware-revil-sites-disappears/167745/", "https://www.advintel.io/post/storm-in-safe-haven-takeaways-from-russian-authorities-takedown-of-revil", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf", "https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/", "https://twitter.com/AdamTheAnalyst/status/1409499591452639242?s=20", "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-revil", "https://otx.alienvault.com/pulse/60da2c80aa5400db8f1561d5", "https://cybersecurity.att.com/blogs/labs-research/revils-new-linux-version", "https://storage.courtlistener.com/recap/gov.uscourts.txnd.352371/gov.uscourts.txnd.352371.1.0_1.pdf", "https://analyst1.com/file-assets/History-of-REvil.pdf", "https://documents.trendmicro.com/assets/rpt/rpt-navigating-new-frontiers-trend-micro-2021-annual-cybersecurity-report.pdf", "https://www.flashpoint-intel.com/blog/interview-with-revil-affiliated-ransomware-contractor/", "https://therecord.media/us-arrests-and-charges-ukrainian-man-for-kaseya-ransomware-attack/", "https://twitter.com/VK_Intel/status/1409601311092490248", "https://www.darktrace.com/en/blog/staying-ahead-of-r-evils-ransomware-as-a-service-business-model/", "https://twitter.com/VK_Intel/status/1409601311092490248?s=20", "https://github.com/f0wl/REconfig-linux", "https://www.flashpoint-intel.com/blog/revil-disappears-again/", "https://www.darkowl.com/blog-content/page-not-found-revil-darknet-services-offline-after-attack-last-weekend", "https://www.elliptic.co/blog/revil-revealed-tracking-ransomware-negotiation-and-payment", "https://russian.rt.com/russia/article/926347-barnaulec-rozysk-fbr-kibermoshennichestvo", "https://www.accenture.com/us-en/blogs/cyber-defense/moving-left-ransomware-boom" ], "synonyms": [ "REvix" ], "type": [] }, "uuid": "d9d76456-01a3-4dcd-afc2-87529e00c1ba", "value": "REvil (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.rex", "https://rednaga.io/2016/09/21/reversing_go_binaries_like_a_pro/" ], "synonyms": [], "type": [] }, "uuid": "49639ff5-e0be-4b6a-850b-d5d8dd37e62b", "value": "Rex" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.rhombus", "https://old.reddit.com/r/LinuxMalware/comments/fh3zar/memo_rhombus_an_elf_bot_installerdropper/" ], "synonyms": [], "type": [] }, "uuid": "af886910-9a0b-478e-b53d-54c8a103acb4", "value": "RHOMBUS" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.rhysida", "https://twitter.com/malwrhunterteam/status/1724165711356993736", "https://www.shadowstackre.com/analysis/rhysida", "https://fourcore.io/blogs/rhysida-ransomware-history-ttp-adversary-emulation", "https://go.recordedfuture.com/hubfs/reports/cta-2025-0130.pdf" ], "synonyms": [], "type": [] }, "uuid": "1dbd7cbb-960d-4ef4-9520-1748fb7cd4c6", "value": "Rhysida (ELF)" }, { "description": "P2P Botnet discovered by Netlab360. The botnet infects linux servers via the Webmin RCE vulnerability (CVE-2019-15107) which allows attackers to run malicious code with root privileges and take over older Webmin versions. Based on the Netlabs360 analysis, the botnet serves mainly 7 functions: reverse shell, self-uninstall, gather process' network information, gather Bot information, execute system commands, run encrypted files specified in URLs and four DDoS attack methods: ICMP Flood, HTTP Flood, TCP Flood, and UDP Flood.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.roboto", "https://www.zdnet.com/article/new-roboto-botnet-emerges-targeting-linux-servers-running-webmin", "https://blog.netlab.360.com/the-awaiting-roboto-botnet-en" ], "synonyms": [], "type": [] }, "uuid": "e18bf514-b978-4bef-b4d9-834a5100fced", "value": "Roboto" }, { "description": "RotaJakiro is a stealthy Linux backdoor which remained undetected between 2018 and 2021.\r\nThe malware uses rotating encryption to encrypt the resource information within the sample, and C2 communication, using a combination of AES, XOR, ROTATE encryption and ZLIB compression.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.rotajakiro", "https://blog.netlab.360.com/rotajakiro_linux_version_of_oceanlotus/", "https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/", "https://www.domaintools.com/resources/blog/domaintools-and-digital-archeology-a-look-at-rotajakiro" ], "synonyms": [], "type": [] }, "uuid": "66fb7b48-60f2-44fc-9cbe-f70e776d058b", "value": "RotaJakiro" }, { "description": "According to Trendmicro, Royal ransomware was first observed in September 2022, and the threat actors behind it are believed to be seasoned cybercriminals who used to be part of Conti Team One.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.royal_ransom", "https://redsense.com/publications/royal-blacksuit-how-ransomware-rebrand-reshaped-them/", "https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/", "https://www.bleepingcomputer.com/news/security/law-enforcement-seizes-blacksuit-ransomware-leak-sites/", "https://unit42.paloaltonetworks.com/royal-ransomware/", "https://www.trendmicro.com/en_us/research/23/b/royal-ransomware-expands-attacks-by-targeting-linux-esxi-servers.html", "https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/" ], "synonyms": [ "Royal", "Royal_unix" ], "type": [] }, "uuid": "4e29dae1-5a8c-4b3c-81dc-dcc0fdd3c93a", "value": "Royal Ransom (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.rshell", "https://www.trendmicro.com/en_us/research/22/h/irontiger-compromises-chat-app-Mimi-targets-windows-mac-linux-users.html" ], "synonyms": [], "type": [] }, "uuid": "4947e9d3-aa13-4359-ac43-c1c436c409c9", "value": "Rshell" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.rude_devil", "https://www.elastic.co/security-labs/betting-on-bots" ], "synonyms": [], "type": [] }, "uuid": "923ee959-4ea5-46c5-8926-84e41ca77ca4", "value": "RudeDevil" }, { "description": "According to Cisco Talos, RushDrop is a dropper used by UAT-7290 for deploying SilentRaid", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.rush_drop", "https://blog.talosintelligence.com/uat-7290/" ], "synonyms": [ "ChronosRAT" ], "type": [] }, "uuid": "5fdf122c-0323-4357-ab91-22e08bf75684", "value": "RushDrop" }, { "description": "According to Mandiant, SALTWATER is a module for the Barracuda SMTP daemon (bsmtpd) that has backdoor functionality. SALTWATER can upload or download arbitrary files, execute commands, and has proxy and tunneling capabilities. The backdoor is implemented using hooks on the send, recv, close syscalls via the 3rd party kubo/funchook hooking library, and amounts to five components, most of which are referred to as \"Channels\" within the binary. In addition to providing backdoor and proxying capabilities, these components exhibit classic backdoor functionality.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.saltwater", "https://www.cisa.gov/sites/default/files/2023-09/MAR-10454006.r5.v1.CLEAR__0.pdf", "https://sansorg.egnyte.com/dd/8ekLJCPHPj/", "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally", "https://www.mandiant.com/resources/blog/chinese-espionage-tactics", "https://cloud.google.com/blog/topics/threat-intelligence/barracuda-esg-exploited-globally/", "https://www.youtube.com/watch?v=4zaStuUdvrE" ], "synonyms": [], "type": [] }, "uuid": "d55ea436-b2c1-400c-99dc-6e35bc05438b", "value": "SALTWATER" }, { "description": "Satori is a variation of elf.mirai which was first detected around 2017-11-27 by 360 Netlab. It uses exploit to exhibit worm-like behaviour to spread over ports 37215 and 52869 (CVE-2014-8361).", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.satori", "http://blog.netlab.360.com/art-of-steal-satori-variant-is-robbing-eth-bitcoin-by-replacing-wallet-address-en/", "https://www.arbornetworks.com/blog/asert/the-arc-of-satori/", "http://blog.netlab.360.com/warning-satori-a-new-mirai-variant-is-spreading-in-worm-style-on-port-37215-and-52869-en/", "https://krebsonsecurity.com/2018/09/alleged-satori-iot-botnet-operator-sought-media-spotlight-got-indicted/", "http://www.eweek.com/security/collaborative-takedown-kills-iot-worm-satori", "https://unit42.paloaltonetworks.com/satori-mirai-botnet-variant-targeting-vantage-velocity-field-unit-rce-vulnerability/", "https://blog.radware.com/security/botnets/2018/02/new-satori-botnet-variant-enslaves-thousands-dasan-wifi-routers/" ], "synonyms": [], "type": [] }, "uuid": "9e5d83a8-1181-43fe-a77f-28c8c75ffbd0", "value": "Satori" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.sbidiot", "https://www.nozominetworks.com/blog/how-iot-botnets-evade-detection-and-analysis/", "https://www.nozominetworks.com/blog/threat-intelligence-analysis-of-the-sbidiot-iot-malware/", "https://brianstadnicki.github.io/posts/malware-sbidiot-dec2021/" ], "synonyms": [], "type": [] }, "uuid": "b4c20cf4-8e94-4523-8d48-7781aab6785d", "value": "SBIDIOT" }, { "description": "According to CISA, this malware is a persistent backdoor that masquerades as a legitimate Barracuda Networks service. The malware is designed to listen to commands received from the Threat Actor\u2019s Command-and-Control through TCP packets. When executed, the malware uses libpcap sniffer to monitor traffic for a magic packet on TCP port 25 (SMTP) and TCP port 587. It checks the network packet captured for a hard-coded string. When the right sequence of packet is captured, it establishes a TCP reverse shell to the C2 server for further exploitation. This allows the TA to execute arbitrary commands on the compromised system.\r\nThe malware is based on an open-source backdoor program named \"cd00r\".", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.seaspy", "https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-them/", "https://sansorg.egnyte.com/dd/8ekLJCPHPj/", "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally", "https://www.cisa.gov/news-events/analysis-reports/ar23-209b", "https://www.youtube.com/watch?v=PSaix1C-UMI", "https://www.mandiant.com/resources/blog/chinese-espionage-tactics", "https://i.blackhat.com/Asia-24/Presentations/Asia-24-Chen-Chinese-APT.pdf", "https://www.cisa.gov/sites/default/files/2023-07/MAR-10454006.r2.v1.CLEAR_.pdf", "https://www.cisa.gov/sites/default/files/2023-08/MAR-10454006.r4.v2.CLEAR_.pdf", "https://www.cisa.gov/news-events/alerts/2023/07/28/cisa-releases-malware-analysis-reports-barracuda-backdoors", "https://cloud.google.com/blog/topics/threat-intelligence/barracuda-esg-exploited-globally/", "https://www.youtube.com/watch?v=4zaStuUdvrE" ], "synonyms": [], "type": [] }, "uuid": "a6699c42-69d8-4bdd-8dd9-72f4c80efefa", "value": "SEASPY" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.seconddate", "https://www.inversecos.com/2025/02/an-inside-look-at-nsa-equation-group.html" ], "synonyms": [], "type": [] }, "uuid": "6d864834-cc92-47ea-b2b5-7fe6331953d7", "value": "SECONDDATE" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.sedexp", "https://www.aon.com/en/insights/cyber-labs/unveiling-sedexp" ], "synonyms": [], "type": [] }, "uuid": "4e71e8ab-a34a-494f-814d-cc983a2de463", "value": "sedexp" }, { "description": "Ransomware, likely based on the leaked Babuk source code.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.sexi", "https://heimdalsecurity.com/blog/powerhosts-esxi-servers-encrypted-with-new-sexi-ransomware/", "https://x.com/BushidoToken/status/1775843087736025175", "https://www.darkreading.com/threat-intelligence/sexi-ransomware-desires-vmware-hypervisors", "https://www.cybersecurity-insiders.com/proven-data-restores-powerhosts-vmware-backups-after-sexi-ransomware-attack/" ], "synonyms": [ "Formosa", "Limpopo", "Socotra" ], "type": [] }, "uuid": "455156e4-57ca-45c7-bed8-a2c386aa0d5e", "value": "SEXi" }, { "description": "According to Fortinet, this is a Mirai fork propagating through multiple vulnerabilities. ShadowV2 had previously been observed targeting AWS EC2 instances in campaigns disclosed in September 2025.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.shadowv2", "https://www.fortinet.com/blog/threat-research/shadowv2-casts-a-shadow-over-iot-devices" ], "synonyms": [], "type": [] }, "uuid": "57d0498e-a0a1-4c04-8348-894e2851dc00", "value": "ShadowV2" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.shellbind", "http://blog.trendmicro.com/trendlabs-security-intelligence/linux-users-urged-update-new-threat-exploits-sambacry" ], "synonyms": [], "type": [] }, "uuid": "b51caf06-736e-46fc-9b13-48b0b81df4b7", "value": "ShellBind" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.shishiga", "https://www.welivesecurity.com/2017/04/25/linux-shishiga-malware-using-lua-scripts/" ], "synonyms": [], "type": [] }, "uuid": "51da734c-70dd-4337-ab08-ab61457e0da5", "value": "Shishiga" }, { "description": "According to STRIKE, ShortLeash is a custom backdoor used to create an ORB network. It generates unique, self-signed TLS certificates with spoofed metadata for each node. Analysis of these certificates revealed over 1000 active nodes globally and victimology supports attribution to China-Nexus APTs.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.shortleash", "https://securityscorecard.com/wp-content/uploads/2025/06/LapDogs-STRIKE-Report-June-2025.pdf", "https://blog.talosintelligence.com/uat-5918-targets-critical-infra-in-taiwan/" ], "synonyms": [], "type": [] }, "uuid": "396324ad-c2ed-4379-a248-d6f0a1f0510a", "value": "ShortLeash (ELF)" }, { "description": "According to Picus Security, Showboat is a modular post-exploitation framework implemented as a 64-bit ELF binary targeting AMD x86-64 Linux systems, used for long-term, covert access rather than initial compromise or encryption. It retrieves an XOR-encrypted configuration from its command-and-control server, uses randomized sleep intervals, and wraps host telemetry (including system information, running processes, and screenshots) in an encrypted, base64-encoded JSON blob disguised inside PNG metadata for beaconing. The framework provides standard remote access capabilities such as file transfer, directory and filesystem manipulation, and configurable persistence. For stealth, it can download and compile an additional C-based component on the victim and leverage dynamic linker preload mechanisms to hook system-level functions and hide selected processes from userland monitoring tools.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.showboat", "https://www.lumen.com/blog/en-us/introducing-showboat-a-new-malware-family-taunts-defenses-and-targets-international-telecom-firms", "https://www.picussecurity.com/resource/blog/showboat-malware-targeting-middle-east-telecom-firms-since-2022" ], "synonyms": [], "type": [] }, "uuid": "cd831b58-bef3-4594-a457-ebe88557267d", "value": "Showboat" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.sidewalk", "https://www.welivesecurity.com/2022/09/14/you-never-walk-alone-sidewalk-backdoor-linux-variant/", "https://www.fortinet.com/blog/threat-research/threat-actors-exploit-geoserver-vulnerability-cve-2024-36401", "https://www.mandiant.com/resources/blog/chinese-espionage-tactics" ], "synonyms": [], "type": [] }, "uuid": "ec994efc-a8a4-4e92-ada2-e37d421baf01", "value": "SideWalk (ELF)" }, { "description": "According to Cisco Talos, SilentRaid is a primary implant used by UAT-7290 in intrusions meant to establish persistent access to compromised endpoints. It communicates with its command-and-control server (C2) and carries out tasks defined in the malware.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.silent_raid", "https://blog.talosintelligence.com/uat-7290/" ], "synonyms": [ "MystRodX" ], "type": [] }, "uuid": "84f58c04-a700-41c1-97a2-fd4cf942395d", "value": "SilentRaid" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.silex", "https://www.bleepingcomputer.com/news/security/new-silex-malware-trashes-iot-devices-using-default-passwords/" ], "synonyms": [ "silexbot" ], "type": [] }, "uuid": "bf059cb4-f73a-4181-bf71-d8da7bf50dd8", "value": "Silex" }, { "description": "SimpleTea for Linux is an HTTP(S) RAT. \r\n\r\nIt was discovered in Q1 2023 as an instance of the Lazarus group's Operation DreamJob campaign for Linux. It was a payload downloaded in an execution chain which started with an HSBC-themed job offer lure. It shared the same C&C server as payloads from the 3CX incident around the same time.\r\n\r\nIt\u2019s an object-oriented project, which does not run on Linux distributions without a graphical user interface, and decrypts its configuration from /home/%user%/.config/apdl.cf using 0x7E as the XOR key. It uses AES-GCM for encryption and decryption of its network traffic.\r\n\r\nIt supports basic commands that include operations on the victim\u2019s filesystem, manipulation with its configuration, file exfiltration (via ZIP archives), and the download and execution of additional tools from the attacker\u2019s arsenal. The commands are indexed by 16-bit integers, starting with the value 0x27C3.\r\n\r\nSimpleTea for Linux seems like an updated version of BadCall for Linux, rewritten from C to C++, as there are similarities in class names and function names between the two.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.simpletea", "https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack", "https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Lazarus-campaigns-and-backdoors-in-2022-2023.pdf", "https://mp.weixin.qq.com/s?__biz=MzUyMjk4NzExMA%3D%3D&mid=2247499462&idx=1&sn=7cc55f3cc2740e8818648efbec21615f", "https://vipyrsec.com/research/elf64-rat-malware/", "https://blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-for-your-cheese/#7ad29534-c69c-41ce-ae8e-99c32f0d11b3" ], "synonyms": [ "PondRAT", "SimplexTea" ], "type": [] }, "uuid": "e8695701-8055-4b98-bcb6-e4bb7e0a3346", "value": "SimpleTea (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.sindoor", "https://www.nextron-systems.com/2025/08/29/sindoor-dropper-new-phishing-campaign/" ], "synonyms": [], "type": [] }, "uuid": "459c13d0-d206-4b97-8059-1449c9fa3991", "value": "Sindoor" }, { "description": "According to its author, this is a stealthy Linux Kernel Rootkit for modern kernels (6x).", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.singularity", "https://github.com/MatheuZSecurity/Singularity" ], "synonyms": [], "type": [] }, "uuid": "eb81e608-fd73-4a16-94d2-4e574994dfa6", "value": "Singularity" }, { "description": "According to FireEye, SLAPSTICK is a Solaris PAM backdoor that grants a user access to the system with a secret, hard-coded password.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.slapstick", "https://www.mandiant.com/resources/unc2891-overview", "https://www.fireeye.com/blog/threat-research/2020/11/live-off-the-land-an-overview-of-unc1945.html" ], "synonyms": [], "type": [] }, "uuid": "fb3e0a1d-3a98-4cbd-ad7f-4bbb4b9a8351", "value": "SLAPSTICK" }, { "description": "According to PwC, SnappyTCP is a simple reverse shell for Linux/Unix systems, with variants for plaintext and TLS communication. SeaTurtle has used SnappyTCP at least between 2021 and 2023.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.snappy_tcp", "https://blog.strikeready.com/blog/pivoting-through-a-sea-of-indicators-to-spot-turtles/", "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html", "https://www.huntandhackett.com/blog/turkish-espionage-campaigns" ], "synonyms": [], "type": [] }, "uuid": "72e045be-eba2-4571-9c6e-7d35add3d2f8", "value": "SnappyTCP" }, { "description": "According to sysdig, SNOWLIGHT is used as a dropper for its fileless payload (vshell).", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.snowlight", "https://sysdig.com/blog/unc5174-chinese-threat-actor-vshell/", "https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures", "https://cloud.google.com/blog/topics/threat-intelligence/initial-access-brokers-exploit-f5-screenconnect", "https://rhisac.org/threat-intelligence/f5-big-ip-and-screenconnect-cves/", "https://cloud.google.com/blog/topics/threat-intelligence/threat-actors-exploit-react2shell-cve-2025-55182", "https://blog.talosintelligence.com/uat-8302/", "https://www.mandiant.com/resources/blog/initial-access-brokers-exploit-f5-screenconnect" ], "synonyms": [], "type": [] }, "uuid": "e108e4df-5429-402c-b70a-4fa022093598", "value": "SNOWLIGHT" }, { "description": "This is an implant used by APT31 on home routers to utilize them as ORBs.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.sowat", "https://twitter.com/bkMSFT/status/1417823714922610689", "https://blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat/", "https://twitter.com/billyleonard/status/1417910729005490177", "https://www.cert.ssi.gouv.fr/ioc/CERTFR-2021-IOC-003", "https://imp0rtp3.wordpress.com/2021/11/25/sowat/" ], "synonyms": [], "type": [] }, "uuid": "c2866996-d622-4ee2-b548-a6598836e5ae", "value": "SoWaT" }, { "description": "According to TeamT5, SoxAgent is a Linux backdoor that covertly converts compromised hosts into SOCKS5 relay nodes. It maintains a persistent reverse connection to a hardcoded C2 and negotiates AES-encrypted tunnels, enabling the attacker to forward TCP traffic through the victim to conceal their origin. It supports remote updates, self-deletion, and heartbeat reporting with falsified tunnel metrics to enhance stealth. The activity associated with SoxAgent is part of a campaign that deployed the backdoor to form an ORB network tracked as GOBLIN14.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.soxagent", "https://teamt5.org/tw/posts/alert-exploitation-of-cve-2026-34197-in-apache-active-mq?utm_source=rss&tm_medium=rss" ], "synonyms": [], "type": [] }, "uuid": "ee9f23c6-0d7f-4dcf-bff4-8fbf21e95dbd", "value": "SoxAgent" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.spamtorte", "https://cis.verint.com/2016/11/08/spamtorte-version-2/" ], "synonyms": [], "type": [] }, "uuid": "7b9a9ea0-04d2-42ef-b72f-9d6476b9e0d0", "value": "Spamtorte" }, { "description": "According to Mandiant, this is a utility that is written in C and targets Linux. It can be used to extract the uncompressed linux kernel image (vmlinux) into a file and encrypt it using AES without the need for any command line tools.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.spawnsnare", "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability" ], "synonyms": [], "type": [] }, "uuid": "bbcfc37c-0d5c-455e-88f9-3de2df391986", "value": "SPAWNSNARE" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.speakup", "https://research.checkpoint.com/speakup-a-new-undetected-backdoor-linux-trojan/" ], "synonyms": [], "type": [] }, "uuid": "3ccd3143-c34d-4680-94b9-2cc4fa4f86fa", "value": "SpeakUp" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.specter", "https://blog.netlab.360.com/ghost-in-action-the-specter-botnet/", "https://blog.netlab.360.com/the-pitfall-of-threat-intelligence-whitelisting-specter-botnet-is-taking-over-top-legit-dns-domains-by-using-cloudns-service/" ], "synonyms": [], "type": [] }, "uuid": "b9ed5797-b591-4ca9-ba77-ce86308e333a", "value": "Specter" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.spectral_blur", "https://twitter.com/X__Junior/status/1743193763000828066" ], "synonyms": [], "type": [] }, "uuid": "a14e7ea4-668c-4990-a1a9-be99722f88f7", "value": "SpectralBlur (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.speculoos", "https://www.secureworks.com/research/threat-profiles/bronze-atlas", "https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html", "https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/" ], "synonyms": [], "type": [] }, "uuid": "df23ae3a-e10d-4c49-b379-2ea2fd1925af", "value": "Speculoos" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.spry_socks", "https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html" ], "synonyms": [], "type": [] }, "uuid": "3b5c485b-b6a6-4586-a7dc-9e23a3b0aa5a", "value": "SprySOCKS (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.sshdinjector", "https://www.fortinet.com/blog/threat-research/analyzing-elf-sshdinjector-with-a-human-and-artificial-analyst" ], "synonyms": [], "type": [] }, "uuid": "961ba66e-31de-4dcf-bbb3-27c30f404969", "value": "Sshdinjector" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.sshdoor", "http://contagiodump.blogspot.com/2013/02/linux-sshdoor-sample.html", "https://www.welivesecurity.com/2013/01/24/linux-sshdoor-a-backdoored-ssh-daemon-that-steals-passwords/", "https://www.trendmicro.com/en_in/research/24/e/router-roulette.html" ], "synonyms": [], "type": [] }, "uuid": "275d65b9-0894-4c9b-a255-83daddb2589c", "value": "SSHDoor" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.stantinko", "https://www.welivesecurity.com/2020/03/19/stantinko-new-cryptominer-unique-obfuscation-techniques/", "https://www.welivesecurity.com/2020/08/07/stadeo-deobfuscating-stantinko-and-more/", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://www.welivesecurity.com/2017/07/20/stantinko-massive-adware-campaign-operating-covertly-since-2012/", "https://www.welivesecurity.com/2019/11/26/stantinko-botnet-adds-cryptomining-criminal-activities/", "https://www.intezer.com/blog/research/stantinkos-proxy-after-your-apache-server/" ], "synonyms": [], "type": [] }, "uuid": "e8c131df-ee3b-41d4-992d-71d3090d2d98", "value": "Stantinko" }, { "description": "According to FireEye, STEELCORGI is a packer for Linux ELF files that makes use of execution guardrails by sourcing decryption key material from environment variables.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.steelcorgi", "https://www.mandiant.com/resources/unc2891-overview", "https://www.fireeye.com/blog/threat-research/2020/11/live-off-the-land-an-overview-of-unc1945.html", "https://yoroi.company/research/shadows-from-the-past-threaten-italian-enterprises/", "https://yoroi.company/research/opening-steelcorgi-a-sophisticated-apt-swiss-army-knife/" ], "synonyms": [], "type": [] }, "uuid": "21ff33b5-ef21-4263-8747-7de3d2dbdde6", "value": "STEELCORGI" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.sunless", "https://www.securityartwork.es/2019/01/09/analisis-de-linux-sunless/" ], "synonyms": [], "type": [] }, "uuid": "d03fa69b-53a4-4f61-b800-87e4246d2656", "value": "Sunless" }, { "description": "Sustes Malware doesn\u2019t infect victims by itself (it\u2019s not a worm) but it is spread over exploitation and brute-force activities with special focus on IoT and Linux servers. The initial infection stage comes from a custom wget directly on the victim machine followed by a simple /bin/bash mr.sh. The script is a simple bash script which drops and executes additional software. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.sustes", "https://marcoramilli.com/2018/09/20/sustes-malware-cpu-for-monero/" ], "synonyms": [], "type": [] }, "uuid": "5c117b01-826b-4656-b6ca-8b18b6e6159f", "value": "sustes miner" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.suterusu", "https://www.lacework.com/blog/hcrootkit-sutersu-linux-rootkit-analysis/" ], "synonyms": [ "HCRootkit" ], "type": [] }, "uuid": "d2748a0c-8739-4006-95c4-bdf6350d7fa9", "value": "Suterusu" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.sword2033", "https://unit42.paloaltonetworks.com/alloy-taurus/", "https://blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat/" ], "synonyms": [], "type": [] }, "uuid": "9c1a32c7-45b4-4d3a-9d15-300b353f32a7", "value": "Sword2033" }, { "description": "A malware capable of capturing credentials and enabling backdoor access, implemented as a userland rootkit. It uses three methods for hiding its network activity, by hooking and hijacking 1) fopen/fopen64, 2) eBPF, 3) a set of libpcap functions.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.symbiote", "https://cybergeeks.tech/how-to-analyze-linux-malware-a-case-study-of-symbiote", "https://www.trendmicro.com/en_us/research/23/g/detecting-bpfdoor-backdoor-variants-abusing-bpf-filters.html", "https://cybergeeks.tech/how-to-analyze-linux-malware-a-case-study-of-symbiote/", "https://blogs.blackberry.com/en/2022/06/symbiote-a-new-nearly-impossible-to-detect-linux-threat", "https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/" ], "synonyms": [], "type": [] }, "uuid": "4339d876-768c-4cdf-941f-3f55a08aafca", "value": "Symbiote" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.sysjoker", "https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/", "https://www.bleepingcomputer.com/news/security/new-sysjoker-backdoor-targets-windows-macos-and-linux/", "https://blogs.vmware.com/security/2022/03/%e2%80%afsysjoker-an-analysis-of-a-multi-os-rat.html" ], "synonyms": [], "type": [] }, "uuid": "c4b681ec-f5b5-433a-9314-07e06f739ba2", "value": "SysJoker (ELF)" }, { "description": "Cryptojacking botnet", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.sysrvhello", "https://www.riskiq.com/blog/external-threat-management/sysrv-hello-cryptojacking-botnet/", "https://dfir.ch/posts/sysrv/", "https://darktrace.com/blog/worm-like-propagation-of-sysrv-hello-crypto-jacking-botnet", "https://www.lacework.com/sysrv-hello-expands-infrastructure/", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf" ], "synonyms": [ "Sysrv" ], "type": [] }, "uuid": "d471083a-c8e1-4d9b-907e-685c9a75c1f9", "value": "Sysrv-hello (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.systembc", "https://blog.morphisec.com/unveiling-uac-0184-the-remcos-rat-steganography-saga", "https://www.silentpush.com/blog/systembc/", "https://x.com/anyrun_app/status/1884207667058463188", "https://blog.lumen.com/systembc-bringing-the-noise/", "https://services.google.com/fh/files/misc/m-trends-2025-en.pdf" ], "synonyms": [], "type": [] }, "uuid": "20de6d31-634d-4723-959d-4ced5bb03dc5", "value": "SystemBC (ELF)" }, { "description": "Since Fall 2019, Team TNT is a well known threat actor which targets *nix based systems and misconfigured Docker container environments. It has constantly evolved its capabilities for its cloud-based cryptojacking operations. They have shifted their focus on compromising Kubernetes Clusters. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.teamtnt", "https://unit42.paloaltonetworks.com/atoms/adept-libra/", "https://www.cadosecurity.com/teamtnt-script-employed-to-grab-aws-credentials/", "https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/", "https://www.aquasec.com/blog/teamtnt-reemerged-with-new-aggressive-cloud-campaign/", "https://www.cadosecurity.com/post/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials", "https://www.trendmicro.com/en_us/research/21/l/more-tools-in-the-arsenal-how-teamtnt-used-compromised-docker-hu.html", "https://malpedia.caad.fkie.fraunhofer.de/details/elf.teamtnt", "https://www.cadosecurity.com/2020/08/17/teamtnt-the-first-crypto-mining-worm-to-steal-aws-credentials/", "https://www.cyberark.com/resources/threat-research-blog/conti-group-leaked", "https://www.uptycs.com/blog/team-tnt-deploys-malicious-docker-image-on-docker-hub-with-pentesting-tools", "https://www.aquasec.com/blog/fileless-malware-container-security/", "https://cybersecurity.att.com/blogs/labs-research/teamtnt-delivers-malware-with-new-detection-evasion-tool", "https://www.aquasec.com/blog/container-security-tnt-container-attack/", "https://tolisec.com/active-crypto-mining-operation-by-teamtnt/", "https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf", "https://www.intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf", "https://www.group-ib.com/blog/teamtnt/", "https://www.aquasec.com/blog/container-attacks-on-redis-servers/", "https://www.intezer.com/blog/malware-analysis/teamtnt-cryptomining-explosion/", "https://www.trendmicro.com/en_ae/research/21/k/teamtnt-upgrades-arsenal-refines-focus-on-kubernetes-and-gpu-env.html", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://unit42.paloaltonetworks.com/atoms/thieflibra/", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf", "https://www.anomali.com/blog/inside-teamtnts-impressive-arsenal-a-look-into-a-teamtnt-server", "https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera", "https://blog.aquasec.com/teamtnt-campaign-against-docker-kubernetes-environment", "https://www.lacework.com/teamtnt-builds-botnet-from-chinese-cloud-servers/", "https://sysdig.com/blog/teamtnt-aws-credentials/", "https://www.aquasec.com/blog/threat-alert-anatomy-of-silentbobs-cloud-attack/" ], "synonyms": [], "type": [] }, "uuid": "24695f84-d3af-477e-92dd-c05c9536ebf5", "value": "TeamTNT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.themoon", "https://www.fortinet.com/blog/threat-research/themoon-a-p2p-botnet-targeting-home-routers", "https://www.ic3.gov/CSA/2025/250507.pdf", "https://www.justice.gov/usao-ndok/pr/botnet-dismantled-international-operation-russian-and-kazakhstani-administrators", "https://s3.documentcloud.org/documents/25935130/anyproxy-and-5socks-indictment.pdf", "https://www.sans.org/reading-room/whitepapers/malicious/analyzing-backdoor-bot-mips-platform-35902", "https://www.ic3.gov/PSA/2025/PSA250507", "https://blog.lumen.com/the-darkside-of-themoon", "https://blog.lumen.com/a-new-phase-of-themoon/" ], "synonyms": [], "type": [] }, "uuid": "ed098719-797b-4cb3-a73c-65b6d08ebdfa", "value": "TheMoon" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.tntbotinger", "https://www.trendmicro.com/en_us/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html", "https://www.lacework.com/teamtnt-builds-botnet-from-chinese-cloud-servers/" ], "synonyms": [], "type": [] }, "uuid": "00319b53-e31c-4623-a3ac-9a18bc52bf36", "value": "TNTbotinger" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.torii", "https://blog.avast.com/new-torii-botnet-threat-research" ], "synonyms": [], "type": [] }, "uuid": "a874575e-0ad7-464d-abb6-8f4b7964aa92", "value": "Torii" }, { "description": "According to its author, TripleCross is a Linux eBPF rootkit that demonstrates the offensive capabilities of the eBPF technology.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.triplecross", "https://github.com/h3xduck/TripleCross", "https://lolcads.github.io/posts/2023/12/bpf_memory_forensics_with_volatility3/" ], "synonyms": [], "type": [] }, "uuid": "a462c60d-a7f9-4a05-aaa1-be415870310e", "value": "TripleCross" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.trump_bot", "http://paper.seebug.org/345/" ], "synonyms": [], "type": [] }, "uuid": "feb6a5f6-32f9-447d-af9c-08e499457883", "value": "Trump Bot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.tscookie", "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_0_JPCERT_en.pdf", "https://www.macnica.net/file/mpressioncss_ta_report_2019_2_nopw.pdf", "https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://www.ironnet.com/blog/china-cyber-attacks-the-current-threat-landscape", "https://blogs.jpcert.or.jp/en/2020/03/elf-tscookie.html", "https://www.macnica.net/file/mpressioncss_ta_report_2019_4.pdf", "https://www.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revealing-threat-in-the-shadow-by-chi-en-shen-ashley-oleg-bondarenko", "https://www.cyberandramen.net/home/blacktech-doesnt-miss-a-step-a-quick-analysis-of-a-busy-2020", "https://twitter.com/ESETresearch/status/1382054011264700416", "https://jp.security.ntt/resources/EN-BlackTech_2021.pdf", "https://www.macnica.net/pdf/mpressioncss_ta_report_2019_4_en.pdf" ], "synonyms": [], "type": [] }, "uuid": "592f7cc6-1e07-4d83-8082-aef027e9f1e2", "value": "TSCookie" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.tsh", "https://github.com/creaktive/tsh", "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers/", "https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/", "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers", "https://supportportal.juniper.net/sfc/servlet.shepherd/document/download/069Dp00000FzdmIIAR?operationContext=S1" ], "synonyms": [ "TINYSHELL" ], "type": [] }, "uuid": "95a07de2-0e17-48a7-b935-0c1c0c0e39af", "value": "tsh" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.tsunami", "https://blogs.juniper.net/en-us/security/muhstik-gang-targets-redis-servers", "https://www.aquasec.com/blog/muhstik-malware-targets-message-queuing-services-applications/", "https://www.lacework.com/blog/muhstik-takes-aim-at-confluence-cve-2021-26084/", "https://www.fortinet.com/blog/threat-research/recent-attack-uses-vulnerability-on-confluence-server", "https://asec.ahnlab.com/en/54647/", "https://medium.com/s2wblog/logs-of-log4shell-cve-2021-44228-log4j-is-ubiquitous-en-809064312039", "https://tolisec.com/multi-vector-minertsunami-botnet-with-ssh-lateral-movement/", "https://www.cadosecurity.com/teamtnt-script-employed-to-grab-aws-credentials/", "https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/", "http://get.cyberx-labs.com/radiation-report", "https://blog.aquasec.com/8220-gang-confluence-vulnerability-cve-2022-26134", "https://www.aquasec.com/blog/container-security-tnt-container-attack/", "https://www.intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf", "https://blog.aquasec.com/fileless-malware-container-security", "http://researchcenter.paloaltonetworks.com/2017/04/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/log4j-vulnerabilities-attacks", "https://www.ibm.com/downloads/cas/WMDZOWK6?social_post=5483919673&linkId=131648775", "https://www.lacework.com/meet-muhstik-iot-botnet-infecting-cloud-servers/", "https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure", "https://blog.aquasec.com/new-malware-in-the-cloud-by-teamtnt", "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf", "https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/", "https://www.bleepingcomputer.com/news/security/log4shell-exploits-now-used-mostly-for-ddos-botnets-cryptominers/", "https://threatpost.com/muhstik-botnet-exploits-highly-critical-drupal-bug/131360/", "https://sysdig.com/blog/muhstik-malware-botnet-analysis/", "https://www.cadosecurity.com/analysis-of-initial-in-the-wild-attacks-exploiting-log4shell-log4j-cve-2021-44228/", "https://www.aquasec.com/blog/threat-alert-anatomy-of-silentbobs-cloud-attack/" ], "synonyms": [ "Amnesia", "Muhstik", "Radiation" ], "type": [] }, "uuid": "21540126-d0bb-42ce-9b93-341fedb94cac", "value": "Tsunami (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.turla_rat", "https://cocomelonc.github.io/malware/2022/09/20/malware-pers-11.html", "https://cocomelonc.github.io/linux/2024/11/22/linux-hacking-3.html", "https://cocomelonc.github.io/malware/2023/05/22/malware-tricks-29.html" ], "synonyms": [], "type": [] }, "uuid": "1b62a421-c0db-4425-bcb2-a4925d5d33e0", "value": "Turla RAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.umbreon", "http://contagiodump.blogspot.com/2018/03/rootkit-umbreon-umreon-x86-arm-samples.html", "http://blog.trendmicro.com/trendlabs-security-intelligence/pokemon-themed-umbreon-linux-rootkit-hits-x86-arm-systems/" ], "synonyms": [ "Espeon" ], "type": [] }, "uuid": "637000f7-4363-44e0-b795-9cfb7a3dc460", "value": "Umbreon" }, { "description": "According to Cybereason, these scripts have been used in an ongoing campaign exploiting a widespread vulnerability in the Exim MTA: CVE-2019-10149. This attack leverages a week-old vulnerability to gain remote command execution on the target machine, search the Internet for other machines to infect, and initiates a crypto miner.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.unidentified_001", "https://www.cybereason.com/blog/new-pervasive-worm-exploiting-linux-exim-server-vulnerability" ], "synonyms": [], "type": [] }, "uuid": "b5b59d9f-f9e2-4201-a017-f2bae0470808", "value": "Unidentified Linux 001" }, { "description": "Implant used by APT31 on compromised SOHO infrastructure, tries to camouflage as a tool (\"unifi-video\") related to Ubiquiti UniFi surveillance cameras. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.unidentified_004", "https://www.sekoia.io/en/walking-on-apt31-infrastructure-footprints/" ], "synonyms": [], "type": [] }, "uuid": "44a57915-2ec0-476f-9f20-b11082f5b5a4", "value": "Unidentified ELF 004" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.unidentified_005", "https://threatmon.io/apt-sidecopy-targeting-indian-government-entities/", "https://ti.qianxin.com/blog/articles/SideCopy's-Golang-based-Linux-tool/" ], "synonyms": [], "type": [] }, "uuid": "d49402b3-9f2a-4d9a-ae09-b1509da2e8fd", "value": "Unidentified 005 (Sidecopy)" }, { "description": "Enables remote execution of scripts on a host, communicates via Tox.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.unidentified_006", "https://www.uptycs.com/blog/is-tox-the-new-cc-method-for-coinminers" ], "synonyms": [], "type": [] }, "uuid": "61a36688-0a4f-4899-8b17-ca0d5ff7e800", "value": "Unidentified ELF 006 (Tox Backdoor)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.vault8_hive", "https://github.com/infoskirmish/hive", "https://wikileaks.org/vault8/" ], "synonyms": [], "type": [] }, "uuid": "721fa6d1-da73-4dd4-9154-a60ff4607467", "value": "Hive (Vault 8)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.vermilion_strike", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf", "https://notes.netbytesec.com/2021/09/discovering-linux-elf-beacon-of-cobalt_18.html", "https://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/" ], "synonyms": [], "type": [] }, "uuid": "a4ded098-be7b-4852-adfd-8971ace583f1", "value": "Vermilion Strike (ELF)" }, { "description": "According to Synacktiv, vGet is an in-memory stager for vShell, written in Rust.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.vget", "https://www.synacktiv.com/publications/linkpro-analyse-dun-rootkit-ebpf" ], "synonyms": [], "type": [] }, "uuid": "4bf5cdc7-5b74-4d05-852b-3b2a24779cd3", "value": "vGet" }, { "description": "VoidLink is a cloud-native Linux malware family designed as a modular post-exploitation framework for modern cloud and containerized environments. It features a plugin-based architecture with dynamically loadable components that provide reconnaissance, credential harvesting, privilege escalation, lateral movement, persistence, and anti-forensic capabilities. The framework demonstrates strong operational security through runtime encryption, environment awareness (cloud provider and container detection), and the use of user-mode and kernel-level rootkit techniques to evade detection.\r\n\r\nVoidLink is not a repurposed legacy tool but a purpose-built framework optimized for cloud infrastructure, indicating a shift in advanced threat development toward Linux-based cloud workloads. Although no confirmed large-scale infections have been observed, its maturity and design suggest potential use by sophisticated threat actors for long-term, stealthy access to cloud environments.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.voidlink", "https://www.sysdig.com/blog/voidlink-threat-analysis-sysdig-discovers-c2-compiled-kernel-rootkits", "https://research.checkpoint.com/2026/voidlink-the-cloud-native-malware-framework/", "https://isovalent.com/blog/post/voidlink-cloud-malware-detection/", "https://blog.talosintelligence.com/voidlink/", "https://research.checkpoint.com/2026/voidlink-early-ai-generated-malware-framework" ], "synonyms": [], "type": [] }, "uuid": "3873b949-1e20-42d5-84e6-56c709ab9627", "value": "VoidLink" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.vpnfilter", "https://blog.talosintelligence.com/2018/09/vpnfilter-part-3.html", "https://msrc-blog.microsoft.com/2019/08/05/corporate-iot-a-path-to-intrusion/", "https://www.trendmicro.com/en_us/research/21/a/vpnfilter-two-years-later-routers-still-compromised-.html", "https://securelist.com/vpnfilter-exif-to-c2-mechanism-analysed/85721/", "https://www.symantec.com/blogs/threat-intelligence/vpnfilter-iot-malware", "https://blog.talosintelligence.com/2022/02/current-executive-guidance-for-ongoing.html", "https://www.cisa.gov/uscert/sites/default/files/publications/AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf", "https://blog.talosintelligence.com/2019/05/one-year-later-vpnfilter-catastrophe.html", "https://cyberpeaceinstitute.org/ukraine-timeline-of-cyberattacks", "https://www.cisa.gov/uscert/ncas/alerts/aa22-054a", "https://www.cisa.gov/uscert/sites/default/files/publications/AA22-054A%20New%20Sandworm%20Malware%20Cyclops%20Blink%20Replaces%20VPN%20Filter.pdf", "https://i.blackhat.com/USA-19/Thursday/us-19-Doerr-The-Enemy-Within-Modern-Supply-Chain-Attacks.pdf", "https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-advanced-persistent-threat-28-botnet-infected", "https://www.lacework.com/blog/mirai-goes-stealth-tls-iot-malware/", "https://blog.talosintelligence.com/2018/05/VPNFilter.html", "https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/", "https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf", "https://www.tesorion.nl/en/resources/pdfstore/Report-OSINT-Russia-Ukraine-Conflict-Cyberaspect.pdf", "https://blog.talosintelligence.com/2022/02/threat-advisory-cyclops-blink.html", "https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games", "https://www.cisa.gov/uscert/ncas/alerts/aa22-110a", "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter", "https://blog.trendmicro.com/trendlabs-security-intelligence/vpnfilter-affected-devices-still-riddled-with-19-vulnerabilities", "https://blog.talosintelligence.com/2018/06/vpnfilter-update.html?m=1", "https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophos-VPN-Filter-analysis-v2.pdf?la=en", "https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf" ], "synonyms": [], "type": [] }, "uuid": "5ad30da2-2645-4893-acd9-3f8e0fbb5500", "value": "VPNFilter" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.walkloader", "https://bazaar.abuse.ch/sample/63deffbdd4053a38c95221589cc2ddd0595d451808a79432fa9f5476c4542390" ], "synonyms": [], "type": [] }, "uuid": "b7a76342-5da0-4774-82b4-65ae67312104", "value": "WalkLoader" }, { "description": "According to Intezer, this is a spreader module used by WatchBog. It is a dynamically linked ELF executable, compiled with Cython. C&C adresses are fetched from Pastebin. C&C communication references unique identification keys per victim. It contains a BlueKeep scanner, reporting positively scanned hosts to the C&C server (RC4 encrypted within SSL/TLS). It contains 5 exploits targeting Jira, Exim, Solr, Jenkins and Nexus Repository Manager 3. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.watchbog", "https://intezer.com/blog/linux/watching-the-watchbog-new-bluekeep-scanner-and-linux-exploits/" ], "synonyms": [], "type": [] }, "uuid": "aa00d8c9-b479-4d05-9887-cd172a11cfc9", "value": "WatchBog" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.wellmail", "https://securelist.com/apt-trends-report-q3-2020/99204/", "https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf", "https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development.pdf", "https://www.ironnet.com/blog/russian-cyber-attack-campaigns-and-actors", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198c", "https://www.pwc.co.uk/issues/cyber-security-services/insights/wellmail.html", "https://blog.talosintelligence.com/2020/08/attribution-puzzle.html" ], "synonyms": [], "type": [] }, "uuid": "93ffafbd-a8af-4164-b3ab-9b21e6d09232", "value": "WellMail" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.wellmess", "https://blogs.jpcert.or.jp/en/2018/07/malware-wellmes-9b78.html", "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf", "https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf", "https://www.ironnet.com/blog/russian-cyber-attack-campaigns-and-actors", "https://www.botconf.eu/wp-content/uploads/2018/12/2018-Y-Ishikawa-S-Nagano-Lets-go-with-a-Go-RAT-_final.pdf", "https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development.pdf", "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://services.global.ntt/en-us/insights/blog/the-layered-infrastructure-operated-by-apt29", "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-old-dogs-new-tricks.pdf", "https://community.riskiq.com/article/541a465f/description", "https://blog.talosintelligence.com/2020/08/attribution-puzzle.html", "https://securelist.com/apt-trends-report-q2-2020/97937/", "https://us-cert.cisa.gov/sites/default/files/publications/AA21-116A_Russian_Foreign_Intelligence_Service_Cyber_Operations_508C.pdf", "https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html", "https://www.pwc.co.uk/issues/cyber-security-services/insights/wellmess-analysis-command-control.html", "https://us-cert.cisa.gov/ncas/alerts/aa21-116a", "https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/" ], "synonyms": [], "type": [] }, "uuid": "b0046a6e-3b8b-45ad-a357-dabc46aba7de", "value": "elf.wellmess" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.whirlpool", "https://www.cisa.gov/news-events/analysis-reports/ar23-250a-0", "https://services.google.com/fh/files/misc/01-chinese-espionage-article-m-trends-2024.pdf", "https://www.cisa.gov/sites/default/files/2023-09/MAR-10454006.r5.v1.CLEAR__0.pdf", "https://sansorg.egnyte.com/dd/8ekLJCPHPj/", "https://www.cisa.gov/sites/default/files/2023-08/MAR-10459736.r1.v1.CLEAR_.pdf", "https://www.cisa.gov/sites/default/files/2023-08/MAR-10454006.r4.v2.CLEAR_.pdf", "https://cloud.google.com/blog/topics/threat-intelligence/barracuda-esg-exploited-globally/", "https://www.youtube.com/watch?v=4zaStuUdvrE" ], "synonyms": [], "type": [] }, "uuid": "be3a5211-45a8-496a-974f-6ef14f44af3d", "value": "WHIRLPOOL" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.whiterabbit", "https://www.bleepingcomputer.com/news/security/march-2023-broke-ransomware-attack-records-with-459-incidents/", "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.WHITERABBIT.YACAET" ], "synonyms": [], "type": [] }, "uuid": "901b88e6-4759-4aa6-b4d1-9f7da53c2adf", "value": "WhiteRabbit" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.winnti", "https://attack.mitre.org/groups/G0096", "https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought", "https://go.recordedfuture.com/hubfs/reports/cta-2023-0808.pdf", "https://asec.ahnlab.com/en/55785/", "https://blog.exatrack.com/melofee/", "https://blog.xlab.qianxin.com/glutton_stealthily_targets_mainstream_php_frameworks-en/", "https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a", "https://www.secureworks.com/research/threat-profiles/bronze-atlas" ], "synonyms": [], "type": [] }, "uuid": "d6c5211e-506d-415c-b886-0ced529399a1", "value": "Winnti (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.wirenet", "https://news.drweb.com/show/?i=2679&lng=en&c=14", "http://contagiodump.blogspot.com/2012/12/aug-2012-backdoorwirenet-osx-and-linux.html" ], "synonyms": [], "type": [] }, "uuid": "47a8fedb-fd60-493a-9b7d-082bdb85621e", "value": "Wirenet (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.wolfsbane", "https://www.welivesecurity.com/en/eset-research/unveiling-wolfsbane-gelsemiums-linux-counterpart-to-gelsevirine/" ], "synonyms": [], "type": [] }, "uuid": "88af7974-f89a-438b-8cd2-059a9136069c", "value": "WolfsBane" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.xagent", "https://unit42.paloaltonetworks.com/a-look-into-fysbis-sofacys-linux-backdoor/", "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf", "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/", "https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf", "https://contagiodump.blogspot.de/2017/02/russian-apt-apt28-collection-of-samples.html", "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/", "https://www.secureworks.com/research/threat-profiles/iron-twilight", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/" ], "synonyms": [ "chopstick", "fysbis", "splm" ], "type": [] }, "uuid": "a8404a31-968a-47e8-8434-533ceaf84c1f", "value": "X-Agent (ELF)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.xanthe", "https://www.cadosecurity.com/abcbot-an-evolution-of-xanthe/", "https://blog.talosintelligence.com/2020/12/xanthe-docker-aware-miner.html", "https://www.ibm.com/downloads/cas/WMDZOWK6?social_post=5483919673&linkId=131648775" ], "synonyms": [], "type": [] }, "uuid": "55b4d75f-adcc-47df-81cf-6c93ccb54a56", "value": "Xanthe" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.xaynnalc", "https://twitter.com/michalmalik/status/846368624147353601" ], "synonyms": [], "type": [] }, "uuid": "32b95dc7-03a6-45ab-a991-466208dd92d2", "value": "Xaynnalc" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.xbash", "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/", "https://unit42.paloaltonetworks.com/atoms/agedlibra/" ], "synonyms": [], "type": [] }, "uuid": "ee54fc1e-c574-4836-8cdb-992ac38cef32", "value": "Xbash" }, { "description": "According to 360 netlab, this backdoor was derived from the leaked CIA Hive project. It propagates via a vulnerability in F5 and communicates using SSL with a forged Kaspersky certificate.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.xdr33", "https://blog.netlab.360.com/headsup_xdr33_variant_of_ciahive_emeerges/" ], "synonyms": [], "type": [] }, "uuid": "c7b1cc91-7464-436e-ac40-3b06c98400a5", "value": "xdr33" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.xmrig", "https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-processes/", "https://www.aquasec.com/blog/container-security-tnt-container-attack/" ], "synonyms": [], "type": [] }, "uuid": "4e67dedd-ee72-4fe4-aaba-c4dea26ea9ef", "value": "XMRIG" }, { "description": "Linux DDoS C&C Malware", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.xorddos", "https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf", "https://www.lacework.com/groundhog-botnet-rapidly-infecting-cloud/", "https://bartblaze.blogspot.com/2015/09/notes-on-linuxxorddos.html", "https://www.virusbulletin.com/uploads/pdf/conference/vb2015/KalnaiHorejsi-VB2015.pdf", "https://blog.trendmicro.com/trendlabs-security-intelligence/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers/", "https://www.botconf.eu/wp-content/uploads/2015/12/OK-P13-Liu-Ya-Automatically-Classify-Unknown-Bots-by-The-Register-Messages.pdf", "https://blog.avast.com/2015/01/06/linux-ddos-trojan-hiding-itself-with-an-embedded-rootkit/", "https://www.ibm.com/downloads/cas/WMDZOWK6?social_post=5483919673&linkId=131648775", "https://www.crowdstrike.com/blog/linux-targeted-malware-increased-by-35-percent-in-2021/", "https://www.intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/", "http://blog.malwaremustdie.org/2014/09/mmd-0028-2014-fuzzy-reversing-new-china.html", "https://blog.talosintelligence.com/unmasking-the-new-xorddos-controller-and-infrastructure/", "https://blog.nsfocusglobal.com/threats/vulnerability-analysis/analysis-report-of-the-xorddos-malware-family/", "https://www.fireeye.com/blog/threat-research/2015/02/anatomy_of_a_brutef.html", "https://www.microsoft.com/security/blog/2022/05/19/rise-in-xorddos-a-deeper-look-at-the-stealthy-ddos-malware-targeting-linux-devices/", "https://blog.checkpoint.com/wp-content/uploads/2015/10/sb-report-threat-intelligence-groundhog.pdf", "https://maxkersten.nl/binary-analysis-course/analysis-scripts/ghidra-script-to-decrypt-a-string-array-in-xor-ddos/", "https://en.wikipedia.org/wiki/Xor_DDoS" ], "synonyms": [ "XORDDOS" ], "type": [] }, "uuid": "7f9df618-4bd1-44a1-ad88-e5930373aac4", "value": "XOR DDoS" }, { "description": "Zergeca is a DDoS-botnet and backdoor written in Golang. It uses modified UPX for packing, with the magic number 0x30219101 instead of \"UPX!\". It is being distributed via weak telnet passwords and known vulnerabilities.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.zergeca", "https://blog.xlab.qianxin.com/a-deep-dive-into-the-zergeca-botnet" ], "synonyms": [], "type": [] }, "uuid": "a660eeda-910a-4df5-86ba-f17d8ac93c31", "value": "Zergeca" }, { "description": "ZeroBot is a Go-based botnet that spreads primarily through IoT and web application vulnerabilities. It is offered as malware as a service (MaaS) and infrastructure overlaps with DDoS-for-hire services seized by the FBI in December 2022.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.zerobot", "https://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/" ], "synonyms": [ "ZeroStresser" ], "type": [] }, "uuid": "458c583b-4353-4104-bee8-9e68cb77f151", "value": "ZeroBot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.zhtrap", "https://blog.netlab.360.com/new_threat_zhtrap_botnet_en/" ], "synonyms": [], "type": [] }, "uuid": "d070ff73-ad14-4f6b-951f-1645009bdf80", "value": "ZHtrap" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.zollard", "https://blogs.cisco.com/security/the-internet-of-everything-including-malware" ], "synonyms": [ "darlloz" ], "type": [] }, "uuid": "9218630d-0425-4b18-802c-447a9322990d", "value": "Zollard" }, { "description": "According to Black Lotus Labs, ZuoRAT is a MIPS file compiled for SOHO routers that can enumerate a host and internal LAN, capture packets being transmitted over the infected device and perform person-in-the-middle attacks (DNS and HTTPS hijacking based on predefined rules).", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.zuo_rat", "https://blog.lumen.com/zuorat-hijacks-soho-routers-to-silently-stalk-networks/", "https://www.mandiant.com/resources/blog/chinese-espionage-tactics" ], "synonyms": [], "type": [] }, "uuid": "c4b0a7cd-b349-44a1-94ca-3d5a4ac288b2", "value": "ZuoRAT" }, { "description": "Small downloader composed as a Fast-AutoLoad LISP (FAS) module for AutoCAD.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/fas.acad", "https://github.com/Hopfengetraenk/Fas-Disasm", "https://www.forcepoint.com/blog/security-labs/autocad-malware-computer-aided-theft" ], "synonyms": [ "Acad.Bursted", "Duxfas" ], "type": [] }, "uuid": "fb22d876-c6b5-4634-a468-5857088d605c", "value": "AutoCAD Downloader" }, { "description": "According to Google, this is a cookie stealer", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ios.cookiesnatch", "https://blog.google/threat-analysis-group/state-backed-attackers-and-commercial-surveillance-vendors-repeatedly-use-the-same-exploits/" ], "synonyms": [], "type": [] }, "uuid": "1b2d02d7-aa83-4101-ab10-2767b59c9c75", "value": "COOKIESNATCH" }, { "description": "According to Google, this is a new and powerful exploit kit targeting Apple iPhone models running iOS version 13.0 (released in September 2019) up to version 17.2.1 (released in December 2023). The exploit kit, named \"Coruna\" by its developers, contained five full iOS exploit chains and a total of 23 exploits. The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits, with the most advanced ones using non-public exploitation techniques and mitigation bypasses. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ios.coruna", "https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit", "https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit?linkId=59478481", "https://www.nadsec.online/blog/coruna-technical-analysis" ], "synonyms": [], "type": [] }, "uuid": "7b2f1afb-f9bd-4fd4-8b58-885de878de7a", "value": "Coruna" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ios.dualtoy", "http://researchcenter.paloaltonetworks.com/2016/09/dualtoy-new-windows-trojan-sideloads-risky-apps-to-android-and-ios-devices/" ], "synonyms": [], "type": [] }, "uuid": "f7c1675f-b38a-4511-9ac4-6e475b3815e6", "value": "DualToy (iOS)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ios.guiinject", "https://sentinelone.com/blogs/analysis-ios-guiinject-adware-library/" ], "synonyms": [], "type": [] }, "uuid": "d9215579-eee0-4e50-9157-dba7c3214769", "value": "GuiInject" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ios.lightspy", "https://www.volexity.com/blog/2024/11/15/brazenbamboo-weaponizes-forticlient-vulnerability-to-steal-vpn-credentials-via-deepdata/", "https://hunt.io/blog/lightspy-malware-targets-facebook-instagram", "https://blog.trendmicro.com/trendlabs-security-intelligence/operation-poisoned-news-hong-kong-users-targeted-with-mobile-malware-via-local-news-links/", "https://documents.trendmicro.com/assets/Tech-Brief-Operation-Poisoned-News-Hong-Kong-Users-Targeted-with-Mobile-Malware-via-Local-News-Links.pdf", "https://hunt.io/blog/tracking-lightspy-certificates-as-windows-into-adversary-behavior", "https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack", "https://securelist.com/ios-exploit-chain-deploys-lightspy-malware/96407/" ], "synonyms": [], "type": [] }, "uuid": "8a1b524b-8fc9-4b1d-805d-c0407aff00d7", "value": "lightSpy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ios.phenakite", "https://malware4all.blogspot.com/2021/05/grab-your-own-copy-phenakite-ios.html" ], "synonyms": [ "Dakkatoni" ], "type": [] }, "uuid": "7ba7488c-b153-4949-8391-bcf6c4b057bd", "value": "Phenakite" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ios.poisoncarp", "https://citizenlab.ca/2019/09/poison-carp-tibetan-groups-targeted-with-1-click-mobile-exploits/", "https://blog.trendmicro.com/trendlabs-security-intelligence/new-android-spyware-actionspy-revealed-via-phishing-attacks-from-earth-empusa/", "https://googleprojectzero.blogspot.com/2019/08/implant-teardown.html" ], "synonyms": [ "INSOMNIA" ], "type": [] }, "uuid": "7982cc15-f884-40ca-8a82-a452b9c340c7", "value": "PoisonCarp" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ios.postlo", "https://twitter.com/opa334dev/status/1374754519268098051" ], "synonyms": [], "type": [] }, "uuid": "25bff9ad-20dc-4746-a174-e54fcdd8f0c1", "value": "Postlo" }, { "description": "Commercial spyware by Intellexa.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ios.predator", "https://www.jamf.com/blog/predator-spyware-anti-analysis-techniques-ios-error-codes-detection/" ], "synonyms": [ "PREYHUNTER" ], "type": [] }, "uuid": "cac07d4e-4bf0-4b2e-94bf-54190c03c7a6", "value": "Predator" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ios.triangledb", "https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/", "https://medium.com/@billmarczak/an-angry-spark-or-a-triangle-in-disguise-ac32852a1be3", "https://securelist.com/triangulation-validators-modules/110847/", "https://securelist.com/operation-triangulation-catching-wild-triangle/110916/", "https://securelist.com/triangledb-triangulation-implant/110050/", "https://media.ccc.de/v/37c3-11859-operation_triangulation_what_you_get_when_attack_iphones_of_researchers" ], "synonyms": [], "type": [] }, "uuid": "25754894-018b-4bed-aab6-c676fac23a77", "value": "TriangleDB" }, { "description": "According to Google, this reconnaissance payload uses a profiling framework drawing canvas to identify the target\u2019s exact iPhone model, a technique used by many other actors. The iPhone model is sent back to the C2 along with screen size, whether or not a touch screen is present, and a unique identifier per initial GET request (e.g., 1lwuzddaxoom5ylli37v90kj).\r\nThe server replies with either an AES encrypted next stage or 0, indicating that no payload is available for this device. The payload makes another request to the exploit server with gcr=1 as a parameter to get the AES decryption key from the C2.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ios.validvictor", "https://blog.google/threat-analysis-group/state-backed-attackers-and-commercial-surveillance-vendors-repeatedly-use-the-same-exploits/" ], "synonyms": [], "type": [] }, "uuid": "16c0e484-7d03-46f4-870a-297d5397d693", "value": "VALIDVICTOR" }, { "description": "The iOS malware that is installed over USB by osx.wirelurker", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ios.wirelurker", "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf" ], "synonyms": [], "type": [] }, "uuid": "bb340271-023c-4283-9d22-123317824a11", "value": "WireLurker (iOS)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ios.xagent", "https://www.secureworks.com/research/threat-profiles/iron-twilight", "https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-update-ios-espionage-app-found/" ], "synonyms": [], "type": [] }, "uuid": "430b9f30-5e37-49c8-b4e7-21589f120d89", "value": "X-Agent (iOS)" }, { "description": "Part of Malware-as-service platform\r\nUsed as a generic name for Java-based RAT\r\nFunctionality\r\n- collect general system and user information \r\n- terminate process\r\n-log keystroke\r\n-take screenshot and access webcam\r\n- steal cache password from local or web forms\r\n- download and execute Malware\r\n- modify registry\r\n- download components\r\n- Denial of Service attacks\r\n- Acquire VPN certificates\r\n\r\nInitial infection vector\r\n1. Email to JAR files attached\r\n2. Malspam URL to downlaod the malware\r\n\r\nPersistence\r\n- Runkey - HKCU\\Software\\Microsoft\\Windows\\current version\\run\r\n\r\nHiding\r\nUses attrib.exe \r\n\r\nNotes on Adwind\r\nThe malware is not known to be proxy aware", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.adwind", "https://blog.talosintelligence.com/2018/09/adwind-dodgesav-dde.html", "https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf", "https://marcoramilli.com/2018/08/20/interesting-hidden-threat-since-years/", "https://dissectingmalware.blogspot.com/2018/08/export-jratadwind-config-with-x32dbg.html", "https://threatresearch.ext.hp.com/javascript-malware-dispensing-rats-into-the-wild/", "https://blogs.seqrite.com/evolution-of-jrat-java-malware/", "https://gist.github.com/herrcore/8336975475e88f9bc539d94000412885", "https://www.fortinet.com/blog/threat-research/new-jrat-adwind-variant-being-spread-with-package-delivery-scam.html", "https://www.zscaler.com/blogs/research/compromised-wordpress-sites-used-distribute-adwind-rat", "http://malware-traffic-analysis.net/2017/07/04/index.html", "https://research.checkpoint.com/malware-against-the-c-monoculture/", "https://citizenlab.ca/2015/12/packrat-report/", "http://blog.trendmicro.com/trendlabs-security-intelligence/spam-remote-access-trojan-adwind-jrat", "https://www.securityinbits.com/malware-analysis/interesting-tactic-by-ratty-adwind-distribution-of-jar-appended-to-signed-msi/" ], "synonyms": [ "AlienSpy", "Frutas", "JBifrost", "JSocket", "Sockrat", "UNRECOM" ], "type": [] }, "uuid": "8eb9d4aa-257a-45eb-8c65-95c18500171c", "value": "AdWind" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.adzok", "https://citizenlab.ca/2015/12/packrat-report/" ], "synonyms": [], "type": [] }, "uuid": "90cb8ee6-52e6-4d8d-8f45-f04b9aec1f6c", "value": "Adzok" }, { "description": "According to VMRay, this malware family uses in interesting obfuscation technique: a trailing slash in its archive to confuse analysis tools. It abuses #GitHub as a #C2 and exfiltrates stolen data, such as browser cookies, via Discord webhooks. The GitHub repositories are quite active and exist since mid to late 2024. The malware also monitors keyboard and mouse input, takes screenshots.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.akemi", "https://x.com/vmray/status/1925095356871725065" ], "synonyms": [], "type": [] }, "uuid": "89cb5bac-d6eb-4e3e-9fb4-ca001d138224", "value": "Akemi" }, { "description": "F-Secure observed Banload variants silently downloading malicious files from a remote server, then installing and executing the files.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.banload", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanDownloader%3AWin32%2FBanload", "https://colin.guru/index.php?title=Advanced_Banload_Analysis", "https://www.welivesecurity.com/wp-content/uploads/2015/05/CPL-Malware-in-Brasil-zx02m.pdf", "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf" ], "synonyms": [], "type": [] }, "uuid": "30a61fa9-4bd1-427d-9382-ff7c33bd7043", "value": "Banload" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.bluebanana", "https://www.virustotal.com/gui/file/60faab36491e07f10bf6a3ebe66ed9238459b2af7e36118fccd50583728141a4/community" ], "synonyms": [], "type": [] }, "uuid": "c51bbc9b-0906-4ac5-8026-d6b8b7b23e71", "value": "Blue Banana RAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.crossrat", "https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf", "https://objective-see.com/blog/blog_0x28.html" ], "synonyms": [ "Trupto" ], "type": [] }, "uuid": "bae3a6c7-9e58-47f2-8749-a194675e1c84", "value": "CrossRAT" }, { "description": "DynamicRAT is a malware that is spread via email attachments and compromises the security of computer systems. Once running on a device, DynamicRAT establishes a persistent presence and gives attackers complete remote control. Its features include sensitive data exfiltration, hardware control, remote action, and the ability to perform DDoS attacks. In addition, DynamicRAT uses evasion and persistence techniques to evade detection and analysis by security solutions.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.dynamicrat", "https://gi7w0rm.medium.com/dynamicrat-a-full-fledged-java-rat-1a2dabb11694" ], "synonyms": [ "DYNARAT" ], "type": [] }, "uuid": "28539c3d-89a4-4dd6-85f5-f4c95808c0b7", "value": "DynamicRAT" }, { "description": "EpicSplit RAT is a multiplatform Java RAT that is capable of running shell commands, downloading, uploading, and executing files, manipulating the file system, establishing persistence, taking screenshots, and manipulating keyboard and mouse events. EpicSplit is typically obfuscated with the commercial Allatori Obfuscator software. One unique feature of the malware is that TCP messages sent by EpicSplit RAT to its C2 are terminated with the string \"_packet_\" as a packet delimiter.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.epicsplit", "https://www.zscaler.com/blogs/security-research/targeted-attacks-indian-government-and-financial-institutions-using-jsoutprox-rat" ], "synonyms": [], "type": [] }, "uuid": "90b304a2-452a-4c74-ae8d-80d9ace881a4", "value": "EpicSplit RAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.feimea_rat", "https://dfir.it/blog/2019/02/26/the-supreme-backdoor-factory/" ], "synonyms": [], "type": [] }, "uuid": "3724d5d0-860d-4d1e-92a1-0a7089ca2bb3", "value": "FEimea RAT" }, { "description": "According to Karsten Hahn, this malware is actually written in JPHP, but can be treated similar to .class files produced by Java. IceRat has been observed to carry out information stealing and mining.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.icerat", "https://www.gdatasoftware.com/blog/icerat-evades-antivirus-by-using-jphp" ], "synonyms": [], "type": [] }, "uuid": "ac83a481-2ab4-42c2-a8b6-a4aec96e1c4b", "value": "IceRat" }, { "description": "According to Cisco Talos, JARLEASH is a JAVA-based backdoor deployed on attacker infrastructure and compromised systems with JAVA available, providing a web-based file management interface, FTP and SFTP servers, and a netcat server, with configuration comments written in Simplified Chinese.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.jarleash", "https://blog.talosintelligence.com/uat-7810/" ], "synonyms": [], "type": [] }, "uuid": "df773974-5575-4c50-a4be-129fce1be535", "value": "JARLEASH" }, { "description": "JavaDispCash is a piece of malware designed for ATMs. The compromise happens by using the JVM attach-API on the ATM's local application and the goal is to remotely control its operation. The malware's primary feature is the ability to dispense cash. The malware also spawns a local port (65413) listening for commands from the attacker which needs to be located in the same internal network.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.javadispcash", "https://twitter.com/r3c0nst/status/1111254169623674882", "https://github.com/fboldewin/Libertad-y-gloria---A-Mexican-cyber-heist-story---CyberCrimeCon19-Singapore" ], "synonyms": [], "type": [] }, "uuid": "71286008-9794-4dcc-a571-164195390c39", "value": "JavaDispCash" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.javalocker", "https://dissectingmalwa.re/why-would-you-even-bother-javalocker.html", "https://id-ransomware.blogspot.com/2020/03/javalocker-ransomware.html" ], "synonyms": [ "JavaEncrypt Ransomware" ], "type": [] }, "uuid": "4bdddf41-8d5e-468d-905d-8c6667a5d47f", "value": "JavaLocker" }, { "description": "jRAT, also known as Jacksbot, is a RAT with history, written in Java. It has support for macOS, Linux, Windows and various BSD. It also has functionality to participate in DDoS-attacks as well as to perform click fraud. Note that the Adwind family often is mistakenly labeled as jRAT, because of of a red hering reference to jrat.io.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.jrat", "https://www.intego.com/mac-security-blog/new-multiplatform-backdoor-jacksbot-discovered", "https://www.eff.org/files/2018/01/29/operation-manul.pdf", "https://research.checkpoint.com/malware-against-the-c-monoculture/", "https://blog.trendmicro.com/trendlabs-security-intelligence/jacksbot-has-some-dirty-tricks-up-its-sleeves/", "https://maskop9.wordpress.com/2019/02/06/analysis-of-jacksbot-backdoor/" ], "synonyms": [ "Jacksbot" ], "type": [] }, "uuid": "f2a9f583-b4dd-4669-8808-49c8bbacc376", "value": "jRAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.jspy", "https://how-to-hack.net/hacking-guides/review-of-jspy-rat-jspy-net/" ], "synonyms": [], "type": [] }, "uuid": "ff24997d-1f17-4f00-b9b8-b3392146540f", "value": "jSpy" }, { "description": "According to ANY.RUN, MicroStealer is a rapidly spreading infostealer with low current AV detection that uses a multi stage NSIS, Electron, Node.js, and Java (JAR) delivery chain plus heavy obfuscation and VM checks to evade analysis. It is distributed via compromised or impersonated accounts and malicious download sites, with notable activity in the US and Germany and increased targeting of education and telecom sectors. Once executed, it deploys a bundled JRE, persists via a high privilege ONLOGON scheduled task, and may abuse UAC and LSASS token impersonation. Its core capabilities include stealing browser passwords and session cookies, capturing screenshots, exfiltrating crypto wallets, hijacking and profiling Discord accounts, profiling Steam accounts, and sending archived data over HTTPS to Discord webhooks and attacker controlled servers.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.microstealer", "https://any.run/cybersecurity-blog/microstealer-technical-analysis/" ], "synonyms": [], "type": [] }, "uuid": "8d64f838-4210-4024-a45e-710ac3fbe3d2", "value": "MicroStealer" }, { "description": "DDoS for Minecraft servers.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.mineping", "https://github.com/foxkera/mineping", "https://www.aquasec.com/blog/panamorfi-a-new-discord-ddos-campaign/" ], "synonyms": [], "type": [] }, "uuid": "f3f38528-a8bf-496a-af46-7eb60a9ec6c3", "value": "Mineping" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.octopus_scanner", "http://blog.nsfocus.net/github-ocs-0605/", "https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain" ], "synonyms": [], "type": [] }, "uuid": "8ae996fe-50bb-479b-925c-e6b1e51a9b40", "value": "Octopus Scanner" }, { "description": "According to TrustWave, this is a loader leveraging JPHP, which was observed fetching Latrodectus and Lumma.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.pronsis_loader", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pronsis-loader-a-jphp-driven-malware-diverging-from-d3fck-loader/", "https://cloud.google.com/blog/topics/threat-intelligence/russian-espionage-influence-ukrainian-military-recruits-anti-mobilization-narratives?hl=en", "https://cloud.google.com/blog/topics/threat-intelligence/russian-espionage-influence-ukrainian-military-recruits-anti-mobilization-narratives" ], "synonyms": [], "type": [] }, "uuid": "80005653-bfbb-4a37-a8bf-87f8dc9e4047", "value": "Pronsis Loader" }, { "description": "According to SpiderLabs, in May 2015 the \"company\" Quaverse offered a RAT known as Quaverse RAT or QRAT. At around May 2016, this QRAT evolved into another RAT which became known as Qarallax RAT, because its C2 is at qarallax.com. Quaverse also offers a service to encrypt Java payloads (Qrypter), and thus qrypted payloads are sometimes confused with Quaverse RATs (QRAT / Qarallax RAT).", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.qarallax_rat", "http://www.certego.net/en/news/nearly-undetectable-qarallax-rat-spreading-via-spam/" ], "synonyms": [], "type": [] }, "uuid": "e7852eb9-9de9-43d3-9f7e-3821f3b2bf41", "value": "Qarallax RAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.qealler", "https://www.securityinbits.com/malware-analysis/pyrogenic-infostealer-static-analysis-part-0x1/", "https://www.securityinbits.com/malware-analysis/unpacking/unpacking-pyrogenic-qealler-using-java-agent-part-0x2/", "https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer", "https://www.cyberark.com/threat-research-blog/qealler-the-silent-java-credential-thief/", "https://www.securityinbits.com/malware-analysis/similarity-between-qealler-pyrogenic-variants-part-0x3/", "https://www.herbiez.com/?p=1352", "https://github.com/jeFF0Falltrades/Malware-Writeups/blob/master/Qealler/Qealler-Unloaded.pdf" ], "synonyms": [ "Pyrogenic Infostealer" ], "type": [] }, "uuid": "d16a3a1f-e244-4715-a67f-61ba30901efb", "value": "Qealler" }, { "description": "QRat, also known as Quaverse RAT, was introduced in May 2015 as undetectable (because of multiple layers of obfuscation). It offers the usual functionality (password dumper, file browser, keylogger, screen shots/streaming, ...), and it comes as a SaaS. For additional historical context, please see jar.qarallax.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.qrat", "https://www.digitrustgroup.com/java-rat-qrat/", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/updated-qnode-rat-downloader-distributed-as-trump-video-scandal/", "https://www.trustwave.com/Resources/SpiderLabs-Blog/Quaverse-RAT--Remote-Access-as-a-Service/", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/rats-and-spam-the-nodejs-qrat/" ], "synonyms": [ "Quaverse RAT" ], "type": [] }, "uuid": "ef385825-bfa1-4e8c-b368-522db78cf1bd", "value": "QRat" }, { "description": "Ratty is an open source Java RAT, made available on GitHub and promoted heavily on HackForums. At some point in 2016 / 2017 the original author deleted his repository, but several clones exist.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.ratty", "https://www.fortinet.com/blog/threat-research/multilayered-email-attack-how-a-pdf-invoice-and-geofencing-led-to-rat-malware", "https://threatresearch.ext.hp.com/javascript-malware-dispensing-rats-into-the-wild/", "https://www.securityinbits.com/malware-analysis/interesting-tactic-by-ratty-adwind-distribution-of-jar-appended-to-signed-msi/" ], "synonyms": [], "type": [] }, "uuid": "da032a95-b02a-4af2-b563-69f686653af4", "value": "Ratty" }, { "description": "According to Mandiant, SLAYSTYLE is a webshell written in Java.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.slaystyle", "https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day" ], "synonyms": [], "type": [] }, "uuid": "add16187-fe06-4696-9393-63ceddc42576", "value": "SLAYSTYLE" }, { "description": "Sorillus is a Java-based multifunctional remote access trojan (RAT) that targets Linux, macOS, and Windows operating systems. First created in 2019, the tool gained significant attention in 2022 when various obfuscated client versions began appearing on VirusTotal starting January 18, 2022. The RAT's features were detailed on its now-defunct website (hxxps://sorillus[.]com), where it was marketed for lifetime access at 59.99\u20ac, with a discounted price of 19.99\u20ac at the time. Payments were conveniently accepted via various cryptocurrencies.\r\n\r\nThe creator and distributor of Sorillus, a YouTube user known as \"Tapt,\" claimed the tool could collect sensitive information from infected systems, including:\r\n\r\n HardwareID\r\n\r\n Username\r\n\r\n Country\r\n\r\n Language\r\n\r\n Webcam footage\r\n\r\n Headless status\r\n\r\n Operating system details\r\n\r\n Client version\r\n\r\nHowever, Sorillus was shut down in 2025 following the FBI's Operation \"Talent,\" which targeted alot of the Cracking infrastucture which included Sellix, the payment portal used by Sorillus for transactions. This operation disrupted the financial infrastructure supporting the RAT, leading to its cessation of operations 5 days later.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.sorillus", "https://www.orangecyberdefense.com/global/blog/cert-news/from-sambaspy-to-sorillus-dancing-through-a-multi-language-phishing-campaign-in-europe", "https://abnormalsecurity.com/blog/tax-customers-sorillus-rat" ], "synonyms": [], "type": [] }, "uuid": "80694785-aeb6-4e05-a3e8-cb972993d769", "value": "Sorillus RAT" }, { "description": "STRRAT is a Java-based RAT, which makes extensive use of plugins to provide full remote access to an attacker, as well as credential stealing, key logging and additional plugins. The RAT has a focus on stealing credentials of browsers and email clients, and passwords via keylogging. It supports the following browsers and email clients: Firefox, Internet Explorer, Chrome, Foxmail, Outlook, Thunderbird.\r\n\r\nSince Version 1.2 and above, STRRAT was infamous for its ransomware-like behavior of appending the file name extension .crimson to files. Version 1.5 is notably more obfuscated and modular than previous versions, but the backdoor functions mostly remain the same: collect browser passwords, run remote commands and PowerShell, log keystrokes, among others. Version 1.5 of STRRAT Malware includes a proper encryption routine, though currently pretty simple to revert.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.strrat", "https://www.gdatasoftware.com/blog/strrat-crimson", "https://forensicitguy.github.io/strrat-attached-to-msi/", "https://www.fortinet.com/blog/threat-research/vcurms-a-simple-and-functional-weapon", "https://any.run/cybersecurity-blog/strrat-malware-analysis-of-a-jar-archive/", "https://threatresearch.ext.hp.com/javascript-malware-dispensing-rats-into-the-wild/", "https://www.jaiminton.com/reverse-engineering/strrat#", "https://resources.securityscorecard.com/cybersecurity/analyze-java-malware-strrat#page=1", "https://isc.sans.edu/diary/rss/27798", "https://twitter.com/MsftSecIntel/status/1395138347601854465", "https://umbrella.cisco.com/blog/cybersecurity-threat-spotlight-strrat-zloader-honeygain", "https://threatresearch.ext.hp.com/wp-content/uploads/2021/10/HP-Wolf-Security-Threat-Insights-Report-Q3-2021.pdf", "https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries", "https://www.fortinet.com/blog/threat-research/new-strrat-rat-phishing-campaign", "https://securityscorecard.com/wp-content/uploads/2024/01/How-to-Analyze-Java-Malware-%E2%80%93-A-Case-Study-of-STRRAT.pdf", "https://www.deepinstinct.com/blog/understanding-the-windows-javascript-threat-landscape", "https://www.jaiminton.com/reverse-engineering/strrat" ], "synonyms": [], "type": [] }, "uuid": "6d1335d5-8351-4725-ad8a-07cabca4119e", "value": "STRRAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.supremebot", "https://dfir.it/blog/2019/02/26/the-supreme-backdoor-factory/" ], "synonyms": [ "BlazeBot" ], "type": [] }, "uuid": "651e37e0-1bf8-4024-ac1e-e7bda42470b0", "value": "SupremeBot" }, { "description": "This malware seems to be used for attacks installing cryptocurrency miners on infected machines. Other indicators leads to the assumption that attackers may also use this malware for other purposes (e.g. stealing access tokens for Discord chat app). Symantec describes this malware as complex and powerful: The malware is loaded as a server-side polymorphic JAR file.\r\n\r\n", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.verblecon", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/verblecon-sophisticated-malware-cryptocurrency-mining-discord" ], "synonyms": [], "type": [] }, "uuid": "793565b4-666b-47a4-b15b-de9c80c75a51", "value": "Verblecon" }, { "description": "According to Lumen, a web shell used by Volt Typhoon.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jar.versamem", "https://blog.lumen.com/taking-the-crossroads-the-versa-director-zero-day-exploitation/" ], "synonyms": [], "type": [] }, "uuid": "eb15c0ec-108e-4082-a0c1-ea41345b7db7", "value": "VersaMem" }, { "description": "AIRBREAK, a JavaScript-based backdoor which retrieves commands from hidden strings in compromised webpages.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.airbreak", "http://www.kahusecurity.com/posts/reflow_javascript_backdoor.html", "https://www.fireeye.com/blog/threat-research/2018/07/chinese-espionage-group-targets-cambodia-ahead-of-elections.html", "https://www.secureworks.com/research/threat-profiles/bronze-mohawk" ], "synonyms": [ "Orz" ], "type": [] }, "uuid": "fd419da6-5c0d-461e-96ee-64397efac63b", "value": "AIRBREAK" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.bateleur", "https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf", "https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf", "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor", "https://www.secureworks.com/research/threat-profiles/gold-niagara", "https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/" ], "synonyms": [], "type": [] }, "uuid": "fb75a753-24ba-4b58-b7ed-2e39b0c68c65", "value": "Bateleur" }, { "description": "BeaverTail is a JavaScript malware primarily distributed through NPM packages. It is designed for information theft and to load further stages of malware, specifically a multi-stage Python-based backdoor known as InvisibleFerret. BeaverTail targets cryptocurrency wallets and credit card information stored in the victim's web browsers. Its code is heavily obfuscated to evade detection. Threat actors can either upload malicious NPM packages containing BeaverTail to GitHub or inject BeaverTail code into legitimate NPM projects. Researchers have identified additional Windows and macOS variants, indicating that the BeaverTail malware family is likely still under development. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.beavertail", "https://stacklok.com/blog/dependency-hijacking-dissecting-north-koreas-new-wave-of-defi-themed-open-source-attacks-targeting-developers", "https://blog.talosintelligence.com/beavertail-and-ottercookie/", "https://blog.nviso.eu/2025/11/13/contagious-interview-actors-now-utilize-json-storage-services-for-malware-delivery/", "https://medium.com/deriv-tech/how-a-fake-ai-recruiter-delivers-five-staged-malware-disguised-as-a-dream-job-64cc68fec263", "https://www.trendmicro.com/en_us/research/26/d/void-dokkaebi-uses-fake-job-interview-lure-to-spread-malware-via-code-repositories.html", "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/", "https://radar.securityalliance.org/vs-code-tasks-abuse-by-contagious-interview-dprk/", "https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket", "https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/", "https://www.abstract.security/blog/contagious-interview-evolution-of-vscode-and-cursor-tasks-infection-chains", "https://quetzal.bitso.com/p/interview-with-the-chollima", "https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages", "https://jp.security.ntt/tech_blog/en-waterplum-ottercookie", "https://any.run/cybersecurity-blog/ottercookie-malware-analysis/", "https://redasgard.com/blog/hunting-lazarus-part7-server-not-just-ftp", "https://www.group-ib.com/blog/apt-lazarus-python-scripts/", "https://www.silentpush.com/blog/contagious-interview-front-companies/", "https://github.com/ssrdio/PublicIoC/tree/main/CestLaVie", "https://www.bitdefender.com/en-us/blog/labs/lazarus-group-targets-organizations-with-sophisticated-linkedin-recruiting-scam", "https://web.archive.org/web/20250206220041/https://stacklok.com/blog/dependency-hijacking-dissecting-north-koreas-new-wave-of-defi-themed-open-source-attacks-targeting-developers", "https://doi.org/10.48550/arXiv.2505.21725", "https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/", "https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf", "https://securityscorecard.com/blog/the-job-offer-that-wasnt-how-we-stopped-an-espionage-plot", "https://www.nimanthadeshappriya.com/post/from-colombo-to-pyongyang", "https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat", "https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west", "https://www.trendmicro.com/en_us/research/26/e/analyzing-void-dokkaebi-invisibleferret-malware.html", "https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages", "https://security.macnica.co.jp/blog/2024/10/-contagious-interview.html", "https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q4-2024-q1-2025.pdf", "https://www.cert.si/tz016/", "https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2", "https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/", "https://gitlab-com.gitlab.io/gl-security/security-tech-notes/threat-intelligence-tech-notes/north-korean-malware-sept-2025/", "https://www.gov.il/BlobFolder/reports/beavertail/he/Analyzing%20the%20BeaverTail%20Infostealer.pdf", "https://opensourcemalware.com/blog/dprk-git-hooks-malware", "https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages", "https://securityscorecard.com/blog/operation-phantom-circuit-north-koreas-global-data-exfiltration-campaign/", "https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/", "https://www.recordedfuture.com/research/purplebravos-targeting-it-software-supply-chain", "https://redasgard.com/blog/hunting-lazarus-contagious-interview-c2-infrastructure", "https://opensourcemalware.com/blog/contagious-interview-vscode", "https://www.abstract.security/blog/contagious-interview-tracking-the-vs-code-tasks-infection-vector", "https://www.aikido.dev/blog/malware-hiding-in-plain-sight-spying-on-north-korean-hackers", "https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/", "https://mp.weixin.qq.com/s/84lUaNSGo4lhQlpnCVUHfQ", "https://objective-see.org/blog/blog_0x7A.html", "https://unit42.paloaltonetworks.com/fake-north-korean-it-worker-activity-cluster/", "https://securitylabs.datadoghq.com/articles/tenacious-pungsan-dprk-threat-actor-contagious-interview/", "https://www.trendmicro.com/en_us/research/25/d/russian-infrastructure-north-korean-cybercrime.html", "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-from-primitive-crypto-theft-to-sophisticated-ai-based-deception/", "https://www.virusbulletin.com/uploads/pdf/conference/vb2025/papers/DeceptiveDevelopment-and-North-Korean-IT-workers-from-primitive-crypto-theft-to-sophisticated-AI-based-deception.pdf", "https://asec.ahnlab.com/en/87299/", "https://socket.dev/blog/north-korean-apt-lazarus-targets-developers-with-malicious-npm-package", "https://jp.security.ntt/tech_blog/contagious-interview-ottercookie", "https://www.securonix.com/blog/research-update-threat-actors-behind-the-devpopper-campaign-have-retooled-and-are-continuing-to-target-software-developers-via-social-engineering/" ], "synonyms": [], "type": [] }, "uuid": "da0fb7ce-d730-4ee8-bcc8-3da7eba8ad79", "value": "BeaverTail (Javascript)" }, { "description": "\u2022 BELLHOP is\ta JavaScript backdoor interpreted using the native Windows Scripting Host(WSH).\r\nAfter performing some basic host information gathering, the BELLHOP dropper\tdownloads a base64-encoded blob of JavaScript to disk and\tsets\tup persistence in three ways:\r\n\u2022 Creating a Run key in the Registry\r\n\u2022 Creating a RunOnce key in the Registry\r\n\u2022 Creating a persistent named scheduled task\r\n\u2022 BELLHOP communicates using HTTP\tand HTTPS with primarily benign sites such as Google\tDocs and PasteBin.\r\n", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.bellhop", "https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf", "https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf", "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html" ], "synonyms": [], "type": [] }, "uuid": "7ebeb691-b979-4a88-94e1-dade780c6a7f", "value": "BELLHOP" }, { "description": "According to the GitHub repo, CACTUSTORCH is a JavaScript and VBScript shellcode launcher. It will spawn a 32 bit version of the binary specified and inject shellcode into it.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.cactustorch", "https://github.com/mdsecactivebreach/CACTUSTORCH", "https://www.codercto.com/a/46729.html", "https://www.seqrite.com/documents/en/white-papers/Seqrite-WhitePaper-Operation-SideCopy.pdf", "https://forensicitguy.github.io/analyzing-cactustorch-hta-cobaltstrike/", "https://www.microsoft.com/security/blog/2020/09/24/gadolinium-detecting-empires-cloud/", "https://www.macnica.net/file/mpression_automobile.pdf" ], "synonyms": [], "type": [] }, "uuid": "efbb5a7c-8c01-4aca-ac21-8dd614b256f7", "value": "CACTUSTORCH" }, { "description": "GoSecure describes ChromeBack as a browser hijacker, redirecting traffic and serving advertisements to users.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.chromeback", "https://unit42.paloaltonetworks.com/chromeloader-malware/", "https://www.gosecure.net/blog/2022/02/10/malicious-chrome-browser-extension-exposed-chromeback-leverages-silent-extension-loading/" ], "synonyms": [], "type": [] }, "uuid": "ec055670-4d25-4918-90c7-281fddf3a771", "value": "ChromeBack" }, { "description": "ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver further malware using the drive-by download technique. The malware leverages social engineering to trick the user into running a fake web browser update.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.clearfake", "https://blog.sekoia.io/clearfake-a-newcomer-to-the-fake-updates-threats-landscape/", "https://www.kroll.com/en/insights/publications/cyber/clearfake-update-tricks-victim-executing-malicious-powershell-code", "https://blog.morphisec.com/coinlurker-the-stealer-powering-the-next-generation-of-fake-updates", "https://rmceoin.github.io/malware-analysis/clearfake/" ], "synonyms": [], "type": [] }, "uuid": "8899bc6f-62e1-4732-988a-d5d64a5cf9bd", "value": "ClearFake" }, { "description": "According to SentinelOne, these applications, typically implemented in app.js files, are deployed on ClickFix malware distribution servers. These applications run servers that listen on configured ports to handle incoming HTTP GET and POST requests, executing different functions based on the specific request path.\r\nThe ContagiousDrop applications deliver malware disguised as software updates or essential utilities. They distribute a tailored payload based on the victim\u2019s operating system (Windows, macOS, or Linux), system architecture, and method of interaction with the server, such as the use of the curl command.\r\nIn addition to delivering malware, the ContagiousDrop applications feature an integrated email notification system. These notifications, sent from a configured email address, provide the Contagious Interview threat actors with insights into victim engagement and interaction patterns and are delivered to their configured recipient addresses. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.contagious_drop", "https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/" ], "synonyms": [], "type": [] }, "uuid": "22800020-7ec6-4f22-a597-84f122d35dae", "value": "ContagiousDrop" }, { "description": "WebAssembly-based crpyto miner.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.cryptonight", "https://gist.github.com/JohnLaTwC/112483eb9aed27dd2184966711c722ec", "https://twitter.com/JohnLaTwC/status/983011262731714565" ], "synonyms": [], "type": [] }, "uuid": "faa19699-a884-4cd3-a307-36492c8ee77a", "value": "CryptoNight" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.cukiegrab_crx", "http://blog.trendmicro.com/trendlabs-security-intelligence/malicous-chrome-extensions-stealing-roblox-game-currency-sending-cookies-via-discord/" ], "synonyms": [ "Roblox Trade Assist" ], "type": [] }, "uuid": "d47ca107-3e03-4c25-88f9-8156426b7f60", "value": "CukieGrab" }, { "description": "Prevailion found this RAT written in JavaScript, which dynamically compiles an accompanying keylogger written in C# and uses a DGA for C&C.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.darkwatchman", "https://cyble.com/blog/sophisticated-darkwatchman-rat-spreads-through-phishing-sites/", "https://securityintelligence.com/x-force/new-hive0117-phishing-campaign-imitates-conscription-summons-deliver-darkwatchman-malware/", "https://www.intrinsec.com/wp-content/uploads/2025/11/INTRINSEC-2025-Threat-Report-Trouble_in_the_air.pdf", "https://www.prevailion.com/darkwatchman-new-fileness-techniques/", "https://securityintelligence.com/posts/hive00117-fileless-malware-delivery-eastern-europe/" ], "synonyms": [], "type": [] }, "uuid": "4baf5a22-7eec-4ad8-8780-23a351d9b5f5", "value": "DarkWatchman" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.dnsrat", "https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf", "https://www.flashpoint-intel.com/blog/fin7-revisited:-inside-astra-panel-and-sqlrat-malware/" ], "synonyms": [ "DNSbot" ], "type": [] }, "uuid": "a4b40d48-e40b-47f2-8e30-72342231503e", "value": "DNSRat" }, { "description": "Open sourced javascript info stealer, with the capabilities of stealing crypto wallets, password, cookies and modify discord clients https://github.com/doener2323/doenerium", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.doenerium", "https://twitter.com/0xToxin/status/1572612089901993985", "https://perception-point.io/doenerium-malware/" ], "synonyms": [], "type": [] }, "uuid": "dc446dbc-6f8a-48ee-9e90-10e679a003e1", "value": "doenerium" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.enrume", "https://blog.emsisoft.com/de/21077/meet-ransom32-the-first-javascript-ransomware/" ], "synonyms": [ "Ransom32" ], "type": [] }, "uuid": "d6e5f6b7-cafb-476d-958c-72debdabe013", "value": "Enrume" }, { "description": "According to sysdig, EtherRAT uses Ethereum smart contracts for C2 URL resolution. It establishes persistence through five independent mechanisms, ensuring survival across reboots and system maintenance (systemd, xdg, cron, bashrc, profile). ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.ether_rat", "https://www.sysdig.com/blog/etherrat-dissected-how-a-react2shell-implant-delivers-5-payloads-through-blockchain-c2", "https://www.huntress.com/blog/potemkin-loader-rmmproject-clickfix-attack", "https://www.sysdig.com/blog/etherrat-dprk-uses-novel-ethereum-implant-in-react2shell-attacks" ], "synonyms": [], "type": [] }, "uuid": "eb429cbc-bb38-4256-9dbf-7c0380485336", "value": "EtherRAT" }, { "description": "According proofpoint, EvilNum is a backdoor that can be used for data theft or to load additional payloads. The malware includes multiple interesting components to evade detection and modify infection paths based on identified antivirus software.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.evilnum", "https://securelist.com/apt-trends-report-q3-2020/99204/", "https://github.com/eset/malware-ioc/tree/master/evilnum", "https://blog.prevailion.com/2020/05/phantom-in-command-shell5.html", "http://blog.nsfocus.net/agentvxapt-evilnum/", "http://www.pwncode.io/2018/05/javascript-based-bot-using-github-c.html", "https://securelist.com/deathstalker-mercenary-triumvirate/98177/", "https://www.zscaler.com/blogs/security-research/return-evilnum-apt-updated-ttps-and-new-targets", "https://unit42.paloaltonetworks.com/cardinal-rat-sins-again-targets-israeli-fin-tech-firms/", "https://mp.weixin.qq.com/s/REXBtbnI2zXj4H3u6ofMMw", "https://www.clearskysec.com/wp-content/uploads/2019/08/ClearSky-2019-H1-Cyber-Events-Summary-Report.pdf", "https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/" ], "synonyms": [], "type": [] }, "uuid": "b7deec7e-24f7-4f78-9d58-9b3c1e182ab3", "value": "EVILNUM (Javascript)" }, { "description": "FakeUpdateRU is a malicious JavaScript code injected into compromised websites to deliver further malware using the drive-by download technique. The malicious code displays a copy of the Google Chrome web browser download page and redirects the user to the download of a next-stage payload.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.fakeupdateru", "https://blog.sucuri.net/2023/10/fakeupdateru-chrome-update-infection-spreads-trojan-malware.html" ], "synonyms": [], "type": [] }, "uuid": "9106e280-febe-45a3-9cd1-cbffafc0c85b", "value": "FakeUpdateRU" }, { "description": "FAKEUPDATES is a downloader written in JavaScript that communicates via HTTP. Supported payload types include executables and JavaScript. It writes the payloads to disk prior to launching them. FAKEUPDATES has led to further compromise via additional malware families that include CHTHONIC, DRIDEX, EMPIRE, KOADIC, DOPPELPAYMER, and AZORULT.\r\n\r\nFAKEUPDATES has been heavily used by UNC1543, a financially motivated group.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.fakeupdates", "https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/", "https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/", "https://www.proofpoint.com/us/blog/threat-insight/ta569-socgholish-and-beyond", "https://www.cybereason.com/blog/threat-analysis-report-socgholish-and-zloader-from-fake-updates-and-installers-to-owning-your-systems", "https://www.trendmicro.com/en_us/research/22/d/Thwarting-Loaders-From-SocGholish-to-BLISTERs-LockBit-Payload.html", "https://decoded.avast.io/janrubin/parrot-tds-takes-over-web-servers-and-threatens-millions/", "https://twitter.com/MsftSecIntel/status/1522690116979855360", "https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://blog.sucuri.net/2022/08/socgholish-5-years-of-massive-website-infections.html", "https://www.trendmicro.com/en_us/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html", "https://x.com/GenThreatLabs/status/1840762181668741130", "https://www.mandiant.com/resources/they-come-in-the-night-ransomware-deployment-trends", "https://expel.io/blog/incident-report-spotting-socgholish-wordpress-injection/", "https://services.google.com/fh/files/misc/threat_horizons_report_h1_2025.pdf", "https://www.intrinsec.com/prospero-proton66-tracing-uncovering-the-links-between-bulletproof-networks/", "https://killingthebear.jorgetesta.tech/actors/evil-corp", "https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack", "https://arcticwolf.com/resources/blog/romcom-utilizing-socgholish-to-deliver-mythic-agent-to-usa-companies-supporting-ukraine/", "https://www.silentpush.com/blog/socgholish/", "https://experience.mandiant.com/trending-evil/p/1", "https://www.sentinelone.com/labs/socgholish-diversifies-and-expands-its-malware-staging-infrastructure-to-counter-defenders/", "https://info.spamhaus.com/hubfs/Botnet%20Reports/Jul-Dec%202024%20Botnet%20Threat%20Update.pdf", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/d/thwarting-loaders-from-socgholish-to-blisters-lockbit-payload/iocs-thwarting-loaders-socgholish-blister.txt", "https://blog.malwarebytes.com/threat-intelligence/2022/06/makemoney-malvertising-campaign-adds-fake-update-template/", "https://www.digitalinformationworld.com/2022/04/threatening-redirect-web-service.html", "https://www.intrinsec.com/wp-content/uploads/2024/11/TLP-CLEAR-PROSPERO-Proton66-Uncovering-the-links-between-bulletproof-networks.pdf", "https://resource.redcanary.com/rs/003-YRU-314/images/2022_ThreatDetectionReport_RedCanary.pdf", "https://www.menlosecurity.com/blog/increase-in-attack-socgholish", "https://www.lac.co.jp/lacwatch/report/20220407_002923.html", "https://www.recordedfuture.com/research/uncovering-mintsloader-with-recorded-future-malware-intelligence-hunting", "https://www.politie.nl/en/news/2026/juni/18/11-international-law-enforcement-initiate-hunt-on-malware-group-socgholish.html", "https://thehackernews.com/2022/07/microsoft-links-raspberry-robin-usb.html?_m=3n%2e009a%2e2800%2ejp0ao0cjb8%2e1shm", "https://krebsonsecurity.com/2025/02/notorious-malware-spam-host-prospero-moves-to-kaspersky-lab/", "https://info.spamhaus.com/hubfs/Botnet%20Reports/Jan-Jun%202024%20Botnet%20Threat%20Update.pdf", "https://www.intrinsec.com/wp-content/uploads/2024/04/TLP-CLEAR-Matanbuchus-Co-Code-Emulation-and-Cybercrime-Infrastructure-Discovery-1.pdf", "https://info.spamhaus.com/hubfs/Botnet%20Reports/Q4%202023%20Botnet%20Threat%20Update.pdf", "https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software", "https://blog.morphisec.com/coinlurker-the-stealer-powering-the-next-generation-of-fake-updates", "https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/", "https://www.proofpoint.com/us/blog/threat-insight/update-fake-updates-two-new-actors-and-new-mac-malware", "https://intel471.com/blog/threat-hunting-case-study-socgholish", "https://trac-labs.com/dont-ghost-the-socgholish-ghostweaver-backdoor-574154dd9983", "https://blog.malwarebytes.com/threat-analysis/2018/04/fakeupdates-campaign-leverages-multiple-website-platforms/", "https://www.linkedin.com/pulse/ransomhub-ransomware-deploys-malware-breach-corporate-hb44c/", "https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks", "https://medium.com/walmartglobaltech/socgholish-campaigns-and-initial-access-kit-4c4283fea8ee", "https://www.malwarebytes.com/blog/news/2024/12/malicious-ad-distributes-socgholish-malware-to-kaiser-permanente-employees", "http://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/" ], "synonyms": [ "FakeUpdate", "GhoLoader", "SocGholish" ], "type": [] }, "uuid": "cff35ce3-8d6f-417b-ae6c-a9e6a60ee26c", "value": "FAKEUPDATES" }, { "description": "According to Google, GHOSTBLADE is delivered via the DarkSword exploit chain. GHOSTBLADE is a dataminer written in JavaScript that collects and exfiltrates a wide variety of data from a compromised device. Data collected by GHOSTBLADE is exfiltrated to an attacker-controlled server over HTTP(S). Unlike GHOSTKNIFE and GHOSTSABER, GHOSTBLADE is less capable and does not support any additional modules or backdoor-like functionality; it also does not operate continuously. However, similar to GHOSTKNIFE, GHOSTBLADE also contains code to delete crash reports, but targets a different directory where they may be stored.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.ghostblade", "https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain", "https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/" ], "synonyms": [], "type": [] }, "uuid": "624c14bf-1e08-4c66-86bc-fa3041149c9f", "value": "GHOSTBLADE" }, { "description": "According to Koi Security, this malware harvests NPM, GitHub, and Git credentials for supply chain propagation. It targets 49 different cryptocurrency wallet extensions to drain funds. It uses stolen credentials to compromise additional packages and extensions, spreading the worm further. Furthermore, it deploys SOCKS proxy servers, turning developer machines into criminal infrastructure and installs hidden VNC servers for complete remote access.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.glassworm", "https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace" ], "synonyms": [], "type": [] }, "uuid": "14a725a9-d610-4c3e-bce1-188fc1035749", "value": "GlassWorm" }, { "description": "According to PCrisk, they discovered GootLoader malware while examining legitimate but compromised websites (mainly websites managed using WordPress). It was found that GootLoader is used to infect computers with additional malware. Cybercriminals using GootLoader seek to trick users into unknowingly downloading and executing the malware by disguising it as a document or other file.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.gootloader", "https://thedfirreport.com/2024/02/26/seo-poisoning-to-domain-control-the-gootloader-saga-continues/", "https://www.esentire.com/web-native-pages/gootloader-unloaded", "https://x.com/MsftSecIntel/status/1836456406276342215", "https://blogs.blackberry.com/en/2022/07/gootloader-from-seo-poisoning-to-multi-stage-downloader", "https://gootloader.wordpress.com/2024/06/24/gootloaders-new-hideout-revealed-the-malware-hunt-in-wordpress-shadows/", "https://www.googlecloudcommunity.com/gc/Community-Blog/Finding-Malware-Detecting-GOOTLOADER-with-Google-Security/ba-p/823766", "https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation", "https://services.google.com/fh/files/misc/m-trends-2025-en.pdf", "https://www.intrinsec.com/prospero-proton66-tracing-uncovering-the-links-between-bulletproof-networks/", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gootloader-why-your-legal-document-search-may-end-in-misery/", "https://gootloader.wordpress.com/2025/03/31/gootloader-returns-malware-hidden-in-google-ads-for-legal-documents/", "https://expel.com/blog/gootloaders-malformed-zip/", "https://dinohacks.blogspot.com/2022/06/loading-gootloader.html", "https://redcanary.com/wp-content/uploads/2022/05/Gootloader.pdf", "https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/", "https://gootloader.wordpress.com/2023/01/05/gootloader-command-control/", "https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/", "https://experience.mandiant.com/trending-evil/p/1", "https://github.com/struppigel/hedgehog-tools/tree/main/gootloader", "https://www.esentire.com/blog/gootloader-leads-to-cobalt-strike-and-hand-on-keyboard-activity", "https://gootloader.wordpress.com/2023/01/05/what-is-gootloader/", "https://intel471.com/blog/threat-hunting-case-study-tracking-down-gootloader", "https://www.kroll.com/en/insights/publications/cyber/deep-dive-gootloader-malware-infection-chain", "https://news.sophos.com/en-us/2021/08/12/gootloaders-mothership-controls-malicious-content/", "https://www.intrinsec.com/wp-content/uploads/2024/11/TLP-CLEAR-PROSPERO-Proton66-Uncovering-the-links-between-bulletproof-networks.pdf", "https://blog.nviso.eu/2022/07/20/analysis-of-a-trojanized-jquery-script-gootloader-unleashed/", "https://threatresearch.ext.hp.com/tips-for-automating-ioc-extraction-from-gootloader-a-changing-javascript-malware/", "https://malasada.tech/gootloader-isnt-broken/", "https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations", "https://krebsonsecurity.com/2025/02/notorious-malware-spam-host-prospero-moves-to-kaspersky-lab/", "https://www.esentire.com/blog/gootloader-striking-with-a-new-infection-technique", "https://www.reliaquest.com/blog/gootloader-infection-credential-access/", "https://labs.sentinelone.com/gootloader-initial-access-as-a-service-platform-expands-its-search-for-high-value-targets/", "https://community.riskiq.com/article/f5d5ed38", "https://securityintelligence.com/x-force/gootbot-gootloaders-new-approach-to-post-exploitation/", "https://redcanary.com/blog/gootloader", "https://gootloader.wordpress.com/2024/02/14/my-game-retired-latest-changes-to-gootloader/", "https://socradar.io/new-gootloader-variant-gootbot-changes-the-game-in-malware-tactics/", "https://www.trendmicro.com/en_us/research/23/a/gootkit-loader-actively-targets-the-australian-healthcare-indust.html", "https://web.archive.org/web/20230209123148/https://www.cybereason.com/hubfs/THREAT%20ALERT%20GootLoader%20-%20Large%20payload%20leading%20to%20compromise%20(BLOG).pdf" ], "synonyms": [ "SLOWPOUR" ], "type": [] }, "uuid": "5b2569e5-aeb2-4708-889f-c6d598bd5e14", "value": "GootLoader" }, { "description": "grelos is a skimmer used for magecart-style attacks.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.grelos", "https://gist.github.com/krautface/2c017f220f2a24141bdeb70f76e7e745", "https://community.riskiq.com/article/8c4b4a7a", "https://www.riskiq.com/blog/labs/magecart-medialand/" ], "synonyms": [], "type": [] }, "uuid": "79580c0b-c390-4421-976a-629a5c11af95", "value": "grelos" }, { "description": "GRIFFON is a lightweight JavaScript validator-style implant without any persistence mechanism. The malware is designed for receiving modules to be executed in-memory and sending the results to C2s. The first module downloaded by the GRIFFON malware to the victim\u2019s computer is an information-gathering JavaScript, which allows the cybercriminals to understand the context of the infected workstation.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.griffon", "https://twitter.com/ItsReallyNick/status/1059898708286939136", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/", "https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/would-you-exchange-your-security-for-a-gift-card/", "https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf", "https://www.mandiant.com/resources/evolution-of-fin7", "https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-2/", "https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout", "https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/", "https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/", "https://www.deepinstinct.com/blog/understanding-the-windows-javascript-threat-landscape", "https://www.secureworks.com/research/threat-profiles/gold-niagara" ], "synonyms": [ "Harpy" ], "type": [] }, "uuid": "85c25380-69d7-4d7e-b279-6b6791fd40bd", "value": "Griffon" }, { "description": "According to Proofpoint, IceCube is a JavaScript-based stealer likely developed with the assistance of a large language model, targeting Roundcube webmail instances. It escapes the webmail's iFrame context via DOM traversal to access the full document and the authentication session, then exfiltrates usernames, passwords, two-factor authentication material, cookies, and browser reconnaissance data (such as language, screen size, and form field values) via HTTP POST to its command-and-control server. The malware is heavily commented with well-marked execution phases, and incorporates self-cleanup routines, \"fallbacks\" for failed exploitation steps, and \"deferred triggers\" that hook browser events such as tab changes, mouse leaving the window, and the logout button to re-attempt exploitation. After successful server-side exploitation, it destroys both user and malware-initiated sessions to remove forensic evidence from the Roundcube server.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.icecube", "https://www.proofpoint.com/us/blog/threat-insight/one-email-closer-edge-unkmasstraction-physics-exploitation" ], "synonyms": [], "type": [] }, "uuid": "f73a9924-af44-4495-868b-2f55af7deadc", "value": "IceCube" }, { "description": "IClickFix is a malicious JavaScript framework deployed on compromised WordPress sites to deliver further malware using the ClickFix social engineering tactic and fake Cloudflare Turnstile CAPTCHA challenge.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.iclickfix", "https://www.levelblue.com/blogs/spiderlabs-blog/how-clickfix-opens-the-door-to-stealthy-stealc-information-stealer", "https://blog.sekoia.io/meet-iclickfix-a-widespread-wordpress-targeting-framework-using-the-clickfix-tactic/" ], "synonyms": [], "type": [] }, "uuid": "66c9c741-9259-4668-a767-2edd5bdbf523", "value": "IClickFix" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.inter", "https://www.fortinet.com/blog/threat-research/inter-skimmer-for-all.html" ], "synonyms": [], "type": [] }, "uuid": "36b0f1a0-29a4-4ec5-bca2-18a241881d49", "value": "inter" }, { "description": "JADESNOW is a JavaScript-based downloader malware family associated with the threat cluster UNC5342. JADESNOW utilizes EtherHiding to fetch, decrypt, and execute malicious payloads from smart contracts on the BNB Smart Chain and Ethereum. The input data stored in the smart contract may be Base64-encoded and XOR-encrypted. The final payload in the JADESNOW infection chain is usually a more persistent backdoor like INVISIBLEFERRET.JAVASCRIPT.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.jadesnow", "https://www.trendmicro.com/en_us/research/26/d/void-dokkaebi-uses-fake-job-interview-lure-to-spread-malware-via-code-repositories.html", "https://www.esentire.com/blog/north-korean-apt-malware-analysis-dev-popper-rat-and-omnistealer-everyday-im-shufflin", "https://ransom-isac.org/blog/cross-chain-txdatahiding-crypto-heist-part-4/", "https://checkmarx.com/zero-post/chainveil-a-malicious-npm-supply-chain-attack-by-successkey/", "https://www.aikido.dev/blog/catching-a-rat-remote-access-trojian-rand-user-agent-supply-chain-compromise", "https://ransom-isac.org/blog/cross-chain-txdatahiding-crypto-heist/", "https://casco.com/blog/the-blueprint-of-a-north-korean-attack-on-open-source", "https://medium.com/@0xOZ/how-to-get-scammed-by-dprk-hackers-b2f7588aea76", "https://checkmarx.com/zero-post/sequel-to-chainveil-npm-malware-targets-vite-ecosystem/", "https://ransom-isac.org/blog/cross-chain-txdatahiding-crypto-heist-part-3/", "https://opensourcemalware.com/blog/polinrider-attack", "https://www.aikido.dev/blog/react-native-aria-attack", "https://research.jfrog.com/post/hijacked-npm-vscode-tasks-blockchain/", "https://opensourcemalware.com/blog/chainveil-and-vitevenom-dprk-polinrider-campaign", "https://safedep.io/astro-config-blockchain-c2-supply-chain/", "https://socket.dev/blog/joyfill-npm-beta-releases-compromised", "https://www.stepsecurity.io/blog/joyfill-npm-supply-chain-compromise", "https://ransom-isac.org/blog/cross-chain-txdatahiding-crypto-heist-part-2/", "https://crystalintelligence.com/investigations/how-we-proved-north-koreas-blockchain-malware-campaign/", "https://meltedinhex.com/posts/polinrider-blockchain-dead-drop-npm/", "https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding", "https://www.sonatype.com/blog/six-npm-packages-use-ethereum-transactions-to-retrieve-malicious-payloads", "https://socket.dev/blog/polinrider-north-korea-linked-supply-chain-campaign-expands", "https://opensourcemalware.com/blog/polinrider-blast-radius-grows", "https://kuxhagra.com/posts/that-one-time-i-got-hacked/", "https://safedep.io/joyfill-npm-blockchain-c2-supply-chain/", "https://socket.dev/blog/famous-chollima-targets-php-developers-through-compromised-packagist-package" ], "synonyms": [ "ChainedDown" ], "type": [] }, "uuid": "76d1e9ce-1d02-4b63-9ce8-8f079c852244", "value": "JADESNOW" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.jeniva", "https://imp0rtp3.wordpress.com/2021/08/12/tetris/" ], "synonyms": [], "type": [] }, "uuid": "b0631a44-3264-429d-b8bc-3a27e27be305", "value": "Jeniva" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.jetriz", "https://imp0rtp3.wordpress.com/2021/08/12/tetris/" ], "synonyms": [], "type": [] }, "uuid": "9e6a0a54-8b55-4e78-a3aa-15d1946882e1", "value": "Jetriz" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.jsprat", "https://www.mandiant.com/resources/fin13-cybercriminal-mexico", "https://www.secureworks.com/research/analysis-of-dhs-nccic-indicators" ], "synonyms": [], "type": [] }, "uuid": "71903afc-7129-4821-90e5-c490e4902de3", "value": "jspRAT" }, { "description": "Kongtuke is a sophisticated TDS system that was initially discovered around May 2024. Making use of compromised CMS Websites, Kongtuke redirects website visitors through a multi-stage infection process ultimately leading to device infection. Initially using fake Update lures, it started to use FakeCaptcha lures at the beginning of 2025. It is likely an initial access service, selling infections to both Ransomware affiliates and other IA vendors like SocGholish.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.kongtuke", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/yet-another-nodejs-backdoor-yanb-a-modern-challenge/", "https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke", "https://malasada.tech/the-landupdate808-fake-update-variant/", "https://go.recordedfuture.com/hubfs/reports/cta-2025-0130.pdf" ], "synonyms": [ "TAG-124", "js.LandUpdate808" ], "type": [] }, "uuid": "399a788c-0487-403d-903e-715afe56b9f0", "value": "KongTuke" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.kopiluwak", "https://blog.angelalonso.es/2017/10/analysis-of-malicious-doc-used-by-turla.html", "https://www.mandiant.com/resources/blog/turla-galaxy-opportunity", "https://securelist.com/shedding-skin-turlas-fresh-faces/88069/", "https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf", "https://securelist.com/tomiris-called-they-want-their-turla-malware-back/109552/", "https://www.proofpoint.com/us/threat-insight/post/turla-apt-actor-refreshes-kopiluwak-javascript-backdoor-use-g20-themed-attack", "https://pdfhost.io/v/F0@QElMu2_MacProStorage_2017FinalBitdefenderWhitepaperNetrepserA4en_ENBitdefenderWhitepaperNetrepserA4en_ENindd.pdf", "https://securelist.com/blog/research/77429/kopiluwak-a-new-javascript-payload-from-turla/" ], "synonyms": [], "type": [] }, "uuid": "2269d37b-87e9-460d-b878-b74a2f4c3537", "value": "KopiLuwak" }, { "description": "The LNKR trojan is a malicious browser extension that will monitor the websites visited by the user, looking for pages with administrative privileges such as blog sites or web-based virtual learning environments. When the administrative user posts to the page, the infected extension will execute stored cross-site scripting attack and injects malicious JavaScript into the legitimate HTML of the page. This is used to redirect the second-party visitors of the site to both benign and malicious domains. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.lnkr", "https://krebsonsecurity.com/2020/03/the-case-for-limiting-your-browser-extensions/", "https://github.com/Zenexer/lnkr/blob/master/recon/extensions/fanagokoaogopceablgmpndejhedkjjb/README.md", "https://www.riskiq.com/blog/labs/lnkr-browser-extension/", "https://github.com/Zenexer/lnkr" ], "synonyms": [], "type": [] }, "uuid": "1a85acf3-4bda-49b4-9e50-1231f0b7340a", "value": "LNKR" }, { "description": "Magecart is a malware framework intended to steal credit card information from compromised eCommerce websites. Used in criminal activities, it's a sophisticated implant built on top of relays, command and controls and anonymizers used to steal eCommerce customers' credit card information. The first stage is typically implemented in Javascript included into a compromised checkout page. It copies data from \"input fields\" and send them to a relay which collects credit cards coming from a subset of compromised eCommerces and forwards them to Command and Control servers.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.magecart", "https://blog.malwarebytes.com/threat-analysis/2019/06/magecart-skimmers-found-on-amazon-cloudfront-cdn/", "https://www.zscaler.com/blogs/security-research/black-friday-scams-4-emerging-skimming-attacks-watch-holiday-season", "https://scotthelme.co.uk/introducing-script-watch-detect-magecart-style-attacks-fast/?utm_source=dlvr.it&utm_medium=twitter", "https://blog.trendmicro.com/trendlabs-security-intelligence/magecart-skimming-attack-targets-mobile-users-of-hotel-chain-booking-websites/", "https://blog.malwarebytes.com/cybercrime/2019/04/github-hosted-magecart-skimmer-used-against-hundreds-of-e-commerce-sites/", "https://gallery.mailchimp.com/c35aef82661dad887b8162a4f/files/e24e8206-a157-4796-a8cb-2b7262cc76e8/CSIS_Threat_Matrix_H1_2019.pdf", "https://any.run/cybersecurity-blog/banks-magecart-campaign/", "https://www.riskiq.com/blog/labs/misconfigured-s3-buckets/", "https://medium.com/reflectiz/csp-the-right-solution-for-the-web-skimming-pandemic-acb7a4414218", "https://maxkersten.nl/2020/02/17/following-the-tracks-of-magecart-12/", "https://twitter.com/AffableKraut/status/1415425132080816133?s=20", "https://sansec.io/research/magento-2-persistent-parasite", "https://community.riskiq.com/article/2efc2782", "https://sansec.io/research/magecart-corona-lockdown", "https://maxkersten.nl/2020/02/24/closing-in-on-magecart-12/", "https://blog.sucuri.net/2025/02/google-tag-manager-skimmer-steals-credit-card-info-from-magento-site.html", "https://blog.malwarebytes.com/cybercrime/2021/06/lil-skimmer-the-magecart-impersonator/", "https://geminiadvisory.io/keeper-magecart-group-infects-570-sites/", "https://twitter.com/MBThreatIntel/status/1416101496022724609", "https://blog.malwarebytes.com/threat-analysis/2020/06/web-skimmer-hides-within-exif-metadata-exfiltrates-credit-cards-via-image-files/", "https://www.reflectiz.com/the-gocgle-web-skimming-campaign/", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/injecting-magecart-into-magento-global-config/", "https://sansec.io/labs/2020/01/25/magecart-hackers-arrested/", "https://blog.malwarebytes.com/cybercrime/2021/05/newly-observed-php-based-skimmer-shows-ongoing-magecart-group-12-activity/", "https://www.riskiq.com/blog/labs/magecart-group-12-olympics/", "https://www.riskiq.com/blog/labs/magecart-group-4-always-advancing/", "https://www.riskiq.com/blog/labs/magecart-medialand/", "https://sansec.io/research/north-korea-magecart", "https://blog.sucuri.net/2021/07/magecart-swiper-uses-unorthodox-concatenation.html", "https://blog.sucuri.net/2020/06/evasion-tactics-in-hybrid-credit-card-skimmers.html", "https://community.riskiq.com/article/5bea32aa", "https://blog.malwarebytes.com/threat-intelligence/2021/10/q-logger-skimmer-keeps-magecart-attacks-going/", "https://community.riskiq.com/article/017cf2e6", "https://www.reflectiz.com/ico-fines-ticketmaster-uk-1-25-million-for-security-failures-a-lesson-to-be-learned/", "https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf", "https://community.riskiq.com/article/30f22a00", "https://twitter.com/AffableKraut/status/1385030485676544001", "https://blog.trendmicro.com/trendlabs-security-intelligence/us-local-government-services-targeted-by-new-magecart-credit-card-skimming-attack/", "https://www.goggleheadedhacker.com/blog/post/14", "https://blog.malwarebytes.com/threat-intelligence/2021/11/credit-card-skimmer-evades-virtual-machines/", "https://geminiadvisory.io/magecart-google-tag-manager/", "https://securelist.com/apt-trends-report-q2-2019/91897/", "https://blog.sucuri.net/2020/04/web-skimmer-with-a-domain-name-generator-follow-up.html", "https://maxkersten.nl/2020/01/20/ticket-resellers-infected-with-a-credit-card-skimmer/", "https://community.riskiq.com/article/743ea75b/description", "https://www.zdnet.com/article/web-skimmers-found-on-the-websites-of-intersport-claires-and-icing/", "https://blog.malwarebytes.com/threat-intelligence/2021/09/the-many-tentacles-of-magecart-group-8/", "https://geminiadvisory.io/wp-content/uploads/2020/07/Appendix-C-1.pdf", "https://community.riskiq.com/article/fda1f967", "https://medium.com/@0x_b0mb3r/technical-analysis-magecart-skimmer-da099d897e38", "https://www.riskiq.com/blog/labs/magecart-nutribullet/", "https://blog.trendmicro.com/trendlabs-security-intelligence/fin6-compromised-e-commerce-platform-via-magecart-to-inject-credit-card-skimmers-into-thousands-of-online-shops/", "https://marcoramilli.com/2020/02/19/uncovering-new-magecart-implant-attacking-ecommerce/", "https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145", "https://blog.trendmicro.com/trendlabs-security-intelligence/mirrorthief-group-uses-magecart-skimming-attack-to-hit-hundreds-of-campus-online-stores-in-us-and-canada/", "https://blog.sucuri.net/2020/11/css-js-steganography-in-fake-flash-player-update-malware.html", "https://blog.sucuri.net/2023/12/40-new-domains-of-magecart-veteran-atmzow-found-in-google-tag-manager.html", "https://go.recordedfuture.com/hubfs/reports/cta-2022-0719.pdf", "https://www.perimeterx.com/blog/analyzing_magecart_malware_from_zero_to_hero/", "https://www.riskiq.com/blog/labs/magecart-ticketmaster-breach/", "https://resources.malwarebytes.com/files/2020/02/2020_State-of-Malware-Report.pdf", "https://community.riskiq.com/article/14924d61", "https://medium.com/@louis.o.schuermann/technical-analysis-magecart-skimmer-da099d897e38", "https://www.crowdstrike.com/blog/threat-actor-magecart-coming-to-an-ecommerce-store-near-you/", "https://blog.sucuri.net/2020/07/skimmers-in-images-github-repos.html", "https://blog.sucuri.net/2020/04/web-skimmer-with-a-domain-name-generator.html" ], "synonyms": [], "type": [] }, "uuid": "f53e404b-0dcd-4116-91dd-cad94fc41936", "value": "magecart" }, { "description": "MegaMedusa is NodeJS DDoS Machine Layer-7 provided by RipperSec Team.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.mega_medusa", "https://www.radware.com/blog/security/2024/08/megamedusa-rippersec-public-web-ddos-attack-tool/" ], "synonyms": [], "type": [] }, "uuid": "8a51e636-13be-4bdc-a32f-2d832263ba5b", "value": "megaMedusa" }, { "description": "MiniJS is a very simple JavaScript-based first-stage backdoor. \r\nThe backdoor is probably distributed via spearphishing email. \r\nDue to infrastructure overlap, the malware can be attributed to the actor Turla. Comparable JavaScript-based backdoor families of the actor are KopiLuwak and IcedCoffee.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.minijs", "https://www.virustotal.com/gui/file/0ce9aadf6a3ffd85d6189590ece148b2f9d69e0ce1c2b8eb61361eb8d0f98571/details" ], "synonyms": [], "type": [] }, "uuid": "5fd2f4f0-0591-45bb-a843-c194d5e294cd", "value": "MiniJS" }, { "description": "According to Orange Cyberdefense, MintsLoader is a little-known, multi-stage malware loader that has been used since at least February 2023. It has been observed in widespread distribution campaigns between July and October 2024. The name comes from a very characteristic use of an URL parameter \u201c1.php?s=mintsXX\" (with XX being numbers).\r\n\r\nMintsLoader primarily delivers malicious RAT or infostealing payloads such as AsyncRAT and Vidar through phishing emails, targeting organizations in Europe (Spain, Italy, Poland, etc.). Written in JavaScript and PowerShell, MintsLoader operates through a multi-step infection process involving several URLs and domains, most of which use a domain generation algorithm (DGA) with .top TLD.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.mints_loader", "https://blackpointcyber.com/blog/mintsloader-finger-protocol-hashtable-obfuscation/", "https://go.recordedfuture.com/hubfs/reports/cta-2025-0130.pdf", "https://nikhilh-20.github.io/blog/deob_js_ast/", "https://www.spamhaus.org/resource-hub/cybercrime/pec-invoice-scam/", "https://www.youtube.com/watch?v=yqM9ekIRlMA", "https://www.youtube.com/watch?v=Ep8STRLKS6I", "https://www.esentire.com/blog/mintsloader-stealc-and-boinc-delivery", "https://www.recordedfuture.com/research/uncovering-mintsloader-with-recorded-future-malware-intelligence-hunting", "https://github.com/cert-orangecyberdefense/mintsloader", "https://www.silentpush.com/blog/socgholish/", "https://x.com/CERTCyberdef/status/1849392561024065779", "https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software", "https://cybersecurity.att.com/blogs/labs-research/asyncrat-loader-obfuscation-dgas-decoys-and-govno" ], "synonyms": [], "type": [] }, "uuid": "0cd219f4-1f3b-4958-b678-173257abd67e", "value": "MintsLoader" }, { "description": "More_eggs is a JavaScript backdoor used by the Cobalt group. It attempts to connect to its C&C server and retrieve tasks to carry out, some of which are:\r\n- d&exec = download and execute PE file\r\n- gtfo = delete files/startup entries and terminate\r\n- more_eggs = download additional/new scripts\r\n- more_onion = run new script and terminate current script\r\n- more_power = run command shell commands", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.more_eggs", "https://blog.morphisec.com/cobalt-gang-2.0", "https://sec0wn.blogspot.com/2023/03/how-do-you-like-dem-eggs-i-like-mine.html?m=1", "https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta4557-targets-recruiters-directly-email", "https://arcticwolf.com/resources/blog/venom-spider-uses-server-side-polymorphism-to-weave-a-web-around-victims/", "https://www.bitdefender.com/files/News/CaseStudies/study/262/Bitdefender-WhitePaper-An-APT-Blueprint-Gaining-New-Visibility-into-Financial-Threats-interactive.pdf", "https://thehackernews.com/2024/06/moreeggs-malware-disguised-as-resumes.html", "https://quointelligence.eu/2020/07/golden-chickens-evolution-of-the-maas/", "https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish", "https://twitter.com/Arkbird_SOLG/status/1301536930069278727", "https://www.esentire.com/security-advisories/hackers-spearphish-professionals-on-linkedin-with-fake-job-offers-infecting-them-with-malware-warns-esentire", "https://asert.arbornetworks.com/double-the-infection-double-the-fun/", "https://securityintelligence.com/posts/itg08-aka-fin6-partners-with-trickbot-gang-uses-anchor-framework/", "https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/", "https://mp.weixin.qq.com/s/REXBtbnI2zXj4H3u6ofMMw", "https://expel.com/blog/more-eggs-and-some-linkedin-resume-spearphishing", "https://www.proofpoint.com/us/threat-insight/post/fake-jobs-campaigns-delivering-moreeggs-backdoor-fake-job-offers", "https://www.secureworks.com/research/threat-profiles/gold-kingswood", "https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/", "https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/", "https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html", "https://blog.trendmicro.com/trendlabs-security-intelligence/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses/", "https://github.com/eset/malware-ioc/tree/master/evilnum", "https://denwp.com/more-eggs-venom-spider-phishing-campaign/", "https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf", "https://www.esentire.com/blog/hackers-spearphish-corporate-hiring-managers-with-poisoned-resumes-infecting-them-with-the-more-eggs-malware", "https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite/", "https://www.esentire.com/web-native-pages/unmasking-venom-spider", "https://reaqta.com/2018/03/spear-phishing-campaign-leveraging-msxsl/", "https://attack.mitre.org/software/S0284/", "https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/", "http://www.secureworks.com/research/threat-profiles/gold-kingswood", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf" ], "synonyms": [ "SKID", "SpicyOmelette" ], "type": [] }, "uuid": "1c3009ff-b9a5-4ac1-859c-9b3b4a66a63f", "value": "More_eggs" }, { "description": "NanHaiShu is a remote access tool and JScript backdoor used by Leviathan. NanHaiShu has been used to target government and private-sector organizations that have relations to the South China Sea dispute.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.nanhaishu", "https://www.f-secure.com/documents/996508/1030745/nanhaishu_whitepaper.pdf", "https://community.spiceworks.com/topic/1028936-stealthy-cyberespionage-campaign-attacks-with-social-engineering", "https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets", "https://attack.mitre.org/software/S0228/" ], "synonyms": [], "type": [] }, "uuid": "3e46af39-52e8-442f-aff1-38eeb90336fc", "value": "NanHaiShu" }, { "description": "NodeCordRAT is a cross-platform Remote Access Trojan and information stealer written in Node.js that targets Windows, macOS, and Linux systems through malicious NPM packages in software supply chain attacks. The malware executes automatically when developers unknowingly install compromised dependencies, providing attackers with comprehensive system access and data\r\nexfiltration capabilities. Its core functions include remote code execution through shell access, credential theft from Google Chrome and MetaMask wallets, extraction of developer secrets from .env files, live screen capture, complete file system navigation and exfiltration, and system information gathering for victim profiling. NodeCordRAT achieves persistence through process managers like\r\npm2 that maintain the malware as a background service, while its command-and-control communications leverage the Discord API over HTTPS with hardcoded bot tokens, allowing malicious traffic to masquerade as legitimate web activity and enabling attackers to receive stolen data and issue commands through private Discord channels.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.nodecordrat", "https://www.zscaler.com/blogs/security-research/malicious-npm-packages-deliver-nodecordrat" ], "synonyms": [], "type": [] }, "uuid": "ccb4e42e-5443-4fc6-b958-9c0dc2e2cb75", "value": "NodeCordRAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.node_rat", "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_0_JPCERT_en.pdf", "https://www.virusbulletin.com/virusbulletin/2020/05/vb2019-paper-apt-cases-exploiting-vulnerabilities-regionspecific-software/", "https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html" ], "synonyms": [], "type": [] }, "uuid": "e3b0ed5c-4e6a-4f50-bef2-1f7112aa31ed", "value": "NodeRAT" }, { "description": "According to the author, this is a project that will give understanding of bypassing Multi Factor Authentication (MFA) of an outlook account. It is build in node.js and uses playwright for the automation in the backend.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.offode", "https://github.com/Jhangju/offode" ], "synonyms": [], "type": [] }, "uuid": "0be6d248-382a-48b8-9a52-dba08aaa891e", "value": "OFFODE" }, { "description": "Ostap is a commodity JScript downloader first seen in campaigns in 2016. It has been observed being delivered in ACE archives and VBA macro-enabled Microsoft Office documents. Recent versions of Ostap query WMI to check for a blacklist of running processes:\r\n\r\nAgentSimulator.exe\r\nanti-virus.EXE\r\nBehaviorDumper\r\nBennyDB.exe\r\nctfmon.exe\r\nfakepos_bin\r\nFrzState2k\r\ngemu-ga.exe (Possible misspelling of Qemu hypervisor\u2019s guest agent, qemu-ga.exe)\r\nImmunityDebugger.exe\r\nKMS Server Service.exe\r\nProcessHacker\r\nprocexp\r\nProxifier.exe\r\npython\r\ntcpdump\r\nVBoxService\r\nVBoxTray.exe\r\nVmRemoteGuest\r\nvmtoolsd\r\nVMware2B.exe\r\nVzService.exe\r\nwinace\r\nWireshark\r\n\r\nIf a blacklisted process is found, the malware terminates.\r\n\r\nOstap has been observed delivering other malware families, including Nymaim, Backswap and TrickBot.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.ostap", "https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/", "https://github.com/cryptogramfan/Malware-Analysis-Scripts/blob/master/deobfuscate_ostap.py", "https://malfind.com/index.php/2021/11/24/from-the-archive-1-ostap-dropper-deobfuscation-and-analysis/", "https://www.cert.pl/en/news/single/ostap-malware-analysis-backswap-dropper/", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf", "https://www.bromium.com/deobfuscating-ostap-trickbots-javascript-downloader/", "https://blog.trendmicro.com/trendlabs-security-intelligence/latest-trickbot-campaign-delivered-via-highly-obfuscated-js-file/", "https://labs.bitdefender.com/2020/03/5-times-more-coronavirus-themed-malware-reports-during-march/?utm_campaign=twitter&utm_medium=twitter&utm_source=twitter", "https://www.intrinsec.com/deobfuscating-hunting-ostap/" ], "synonyms": [], "type": [] }, "uuid": "a3b93781-c51c-4ccb-a856-804331470a9d", "value": "ostap" }, { "description": "OtterCandy is a cross-platform JavaScript backdoor targeting Windows, macOS, and Linux that uses the Socket.IO library with WebSocket and HTTP long-polling transports for command and control, connecting to a hardcoded C2 server with unlimited reconnection attempts. It exfiltrates data via HTTP multipart POST and JSON-body requests to the same C2 infrastructure. It focuses on credential theft from Chromium-based browsers (Chrome, Edge, Brave, Opera, Yandex) by decrypting SQLite login and cookie databases using Windows DPAPI on Windows and Keychain-derived PBKDF2+AES-128-CBC on macOS. It targets cryptocurrency wallets through both browser extension LevelDB scanning (MetaMask, Phantom, Coinbase Wallet, Exodus Web3, Keplr, Enkrypt, OKX) and desktop wallet directory collection (Exodus, Guarda, Electrum, Atomic). The malware conducts recursive filesystem searches to gather .env files and files matching sensitive keywords (metamask, phantom, hardhat.config.ts, seed), and separately collects shell history (.bash_history), Google Cloud (~/.config/gcloud), and Azure (~/.azure) credentials. It fingerprints victims by combining hostname with the first six characters of a hardware machine ID to generate a unique victim identifier used on all uploads. The implant forks a secondary Node.js process from a co-located express.js file on startup, indicating a multi-component architecture within the same delivery package.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.ottercandy", "https://jp.security.ntt/insights_resources/tech_blog/ottercandy_malware_e/", "https://opensourcemalware.com/blog/contagious-interview-comprehensive", "https://www.ox.security/blog/malware-slop-crypto-stealer-impersonating-polymarket-exposes-its-own-credentials/" ], "synonyms": [ "HardHatRAT", "UNSEENMINK" ], "type": [] }, "uuid": "5488cddb-15e1-489e-b8a7-c030dc459162", "value": "OtterCandy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.otter_cookie", "https://blog.talosintelligence.com/beavertail-and-ottercookie/", "https://any.run/cybersecurity-blog/lazarus-group-attacks-2025/", "https://blog.nviso.eu/2025/11/13/contagious-interview-actors-now-utilize-json-storage-services-for-malware-delivery/", "https://cyberandramen.net/2026/04/04/ottercookie-expands-targeting-to-ai-coding-tools-analysis-of-a-trojanized-npm-campaign/", "https://gbhackers.com/lazarus-group-malware-with-ottercookie/", "https://medium.com/deriv-tech/how-a-fake-ai-recruiter-delivers-five-staged-malware-disguised-as-a-dream-job-64cc68fec263", "https://www.trendmicro.com/en_us/research/26/d/void-dokkaebi-uses-fake-job-interview-lure-to-spread-malware-via-code-repositories.html", "https://quetzal.bitso.com/p/interview-with-the-chollima", "https://jp.security.ntt/tech_blog/en-waterplum-ottercookie", "https://any.run/cybersecurity-blog/ottercookie-malware-analysis/", "https://blog.daviddodda.com/how-i-almost-got-hacked-by-a-job-interview", "https://redasgard.com/blog/hunting-lazarus-part7-server-not-just-ftp", "https://jp.security.ntt/insights_resources/tech_blog/en-contagious-interview-ottercookie/", "https://www.silentpush.com/blog/contagious-interview-front-companies/", "https://www.elastic.co/security-labs/contagious-interview-malware-svg-steganography", "https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/", "https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf", "https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat", "https://jp.security.ntt/insights_resources/tech_blog/en-waterplum-ottercookie/", "https://blackpointcyber.com/blog/malicious-node-package-deploys-ottercookie/", "https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai/", "https://gitlab-com.gitlab.io/gl-security/security-tech-notes/threat-intelligence-tech-notes/north-korean-malware-sept-2025/", "https://research.jfrog.com/post/rollup-polyfill-masquerading/", "https://panther.com/blog/jsonspack-multi-tenant-node.js-rat-%E2%80%94-dprk-supply-chain-campaign", "https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/", "https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/", "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-from-primitive-crypto-theft-to-sophisticated-ai-based-deception/", "https://www.virusbulletin.com/uploads/pdf/conference/vb2025/papers/DeceptiveDevelopment-and-North-Korean-IT-workers-from-primitive-crypto-theft-to-sophisticated-AI-based-deception.pdf", "https://jp.security.ntt/tech_blog/contagious-interview-ottercookie" ], "synonyms": [], "type": [] }, "uuid": "71fac887-6d86-4f95-99f1-300e2e6caaf6", "value": "OtterCookie" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.parasitesnatcher", "https://www.trendmicro.com/en_us/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html" ], "synonyms": [], "type": [] }, "uuid": "9af9557c-04fc-4231-85c4-d1fb30c53cb6", "value": "ParaSiteSnatcher" }, { "description": "This malicious code written in JavaScript is used as Traffic Direction System (TDS). This TDS showes similarities to the Prometheus TDS. According to DECODED Avast.io this TDS has been active since October 2021.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.parrot_tds", "https://unit42.paloaltonetworks.com/parrot-tds-javascript-evolution-analysis/", "https://www.silentpush.com/blog/socgholish/", "https://decoded.avast.io/janrubin/parrot-tds-takes-over-web-servers-and-threatens-millions/" ], "synonyms": [], "type": [] }, "uuid": "dbefad0a-29d3-49d3-b925-116598182dee", "value": "Parrot TDS" }, { "description": "PeaceNotWar was integrated into the nodejs module node-ipc as a piece of malware/protestware with wiper characteristics. It targets machines with a public IP address located in Russia and Belarus (using geolocation) and overwrites files recursively using a heart emoji.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.peacenotwar", "https://www.vice.com/en/article/dypeek/open-source-sabotage-node-ipc-wipe-russia-belraus-computers", "https://gist.github.com/MidSpike/f7ae3457420af78a54b38a31cc0c809c", "https://www.bleepingcomputer.com/news/security/big-sabotage-famous-npm-package-deletes-files-to-protest-ukraine-war/" ], "synonyms": [], "type": [] }, "uuid": "6c304481-024e-4f34-af06-6235edacfdcc", "value": "PeaceNotWar" }, { "description": "According to Trend Micro, PeckBirdy is a script-based framework which, while possessing advanced capabilities, is implemented using JScript, an old script language. This is to ensure that the framework could be launched across different execution environments via LOLBins (Living off the land binaries). This flexibility allowed to use PeckBirdy in various kill chain stages, including being used as a watering-hole control server during the initial attack phase, as a reverse shell server during the lateral movement phase, and as a C&C server during the backdoor phase.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.peckbirdy", "https://www.trendmicro.com/en_us/research/26/a/peckbirdy-script-framework.html" ], "synonyms": [], "type": [] }, "uuid": "28d32cbc-841e-436f-b071-98796b2208e3", "value": "PeckBirdy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.pindos", "https://www.deepinstinct.com/blog/pindos-new-javascript-dropper-delivering-bumblebee-and-icedid" ], "synonyms": [], "type": [] }, "uuid": "6af1eb7a-bc54-43af-9e15-7187a5f250c4", "value": "PindOS" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.powmet", "http://blog.trendmicro.com/trendlabs-security-intelligence/look-js_powmet-completely-fileless-malware/" ], "synonyms": [], "type": [] }, "uuid": "9521ceb0-039d-412c-a38b-7bd9ddfc772e", "value": "Powmet" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.proslikefan", "https://bin.re/blog/a-javascript-based-dga/" ], "synonyms": [], "type": [] }, "uuid": "d814d689-aad0-4636-8ff1-c8a4dc5d44af", "value": "Proslikefan" }, { "description": "According to Trend Micro, this is a Node.js based malware, that can download/upload/execute files, steal credentials from Chrome/Firefox browsers, and perform file management, among other things. It targets Windows and has components for both 32 and 64bit.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.qnodeservice", "https://blog.trendmicro.com/trendlabs-security-intelligence/qnodeservice-node-js-trojan-spread-via-covid-19-lure/", "https://www.telsy.com/wp-content/uploads/MAR_93433_WHITE.pdf" ], "synonyms": [], "type": [] }, "uuid": "52d9260f-f090-4e79-b0b3-0c89f5db6bc6", "value": "QNodeService" }, { "description": "QUICKCAFE is an encrypted JavaScript downloader for QUICKRIDE.POWER that exploits the ActiveX M2Soft vulnerabilities. QUICKCAFE is obfuscated using JavaScript Obfuscator.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.quickcafe", "https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug.pdf" ], "synonyms": [], "type": [] }, "uuid": "475766d2-1e99-4d81-89e4-0d0df4a562d0", "value": "QUICKCAFE" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.recjs", "https://www.crowdstrike.com/en-us/blog/blurring-of-commodity-and-targeted-attack-malware/" ], "synonyms": [], "type": [] }, "uuid": "5640744b-1ace-46d1-9d4d-a55fb6fb03f9", "value": "RecJS" }, { "description": "Active around 2012-2013, this family deployed small JavaScript snippets on infected websites to load exploit kit scripts from DGA-generated domains.\r\nIt commonly used the Blackhole exploit kit and the Sutra Traffic Distribution System (TDS), which caused it to sometimes be misnamed as Blackhole or Sutra.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.runforestrun", "https://malware.dontneedcoffee.com/2012/12/eyeglanceru.html", "https://stopmalvertising.com/malware-reports/the-c3284d-malware-network-stats.php/pseudo-random-domains.html", "https://www.shadowserver.org/news/beware-the-trolls-secure-your-trackers/", "https://securelist.com/runforestrun-gootkit-and-random-domain-name-generation/57865/", "https://github.com/unixfreaxjp/malwaremustdie/blob/6f69c8e4a55335b6b60a23785e98087b605ddceb/wiki/old/DGA_Research_Tips.md", "https://blog.malwaremustdie.org/2012/10/fuzzy-in-manual-cracking-of.html", "https://web.archive.org/web/20150613014503/https://blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/", "https://blog.malwaremustdie.org/2013/11/runforrestrun-dga-is-alive-at.html" ], "synonyms": [ "Blackhole", "Sutra" ], "type": [] }, "uuid": "1a88e348-e92e-4e88-b32a-38c5dbc3f70a", "value": "RunForestRun" }, { "description": "According to StepSecurity, this is a stealer deployed through a compromised Nx package, targeting system environment properties, cryptocurrency wallets, and development credentials. Data is exfiltrated to Github using stolen tokens.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.s1ngularity", "https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware" ], "synonyms": [], "type": [] }, "uuid": "3f4f13e1-6c9e-4b5f-9481-28d6d423ee24", "value": "s1ngularity Stealer" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.scanbox", "https://www.proofpoint.com/us/blog/threat-insight/ta413-leverages-new-friarfox-browser-extension-target-gmail-accounts-global", "https://nattothoughts.substack.com/p/reconnaissance-scanning-tools-used", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/attacker-tracking-users-seeking-pakistani-passport/", "https://www.volexity.com/blog/2019/09/02/digital-crackdown-large-scale-surveillance-and-exploitation-of-uyghurs/", "https://www.secureworks.com/research/threat-profiles/bronze-mohawk", "http://resources.infosecinstitute.com/scanbox-framework/", "https://www.proofpoint.com/us/blog/threat-insight/chasing-currents-espionage-south-china-sea", "https://www.alienvault.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks" ], "synonyms": [], "type": [] }, "uuid": "0a13a546-91a2-4de0-9bbb-71c9233ce6fa", "value": "scanbox" }, { "description": "A Javascript-based worm propagating through GitHub repositories and exfiltrating tokens and other credentials.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.shai_hulud", "https://x.com/CharlieEriksen/status/2005356174275760277", "https://www.stepsecurity.io/blog/the-hades-campaign-pypi-packages", "https://www.reversinglabs.com/blog/shai-hulud-worm-npm", "https://www.ic3.gov/CSA/2026/260702.pdf", "https://www.zscaler.com/blogs/security-research/shai-hulud-v2-poses-risk-npm-supply-chain", "https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack", "https://socket.dev/blog/shai-hulud-descends-to-hades-miasma-pypi-wave", "https://www.zscaler.com/blogs/security-research/mitigating-risks-shai-hulud-npm-worm" ], "synonyms": [], "type": [] }, "uuid": "7ca06f21-399b-4b99-b0ac-787643c21ec0", "value": "Shai-Hulud" }, { "description": "According to Proofpoint, this is a cluster of fake update campaigns delivering payloads like NetSupportManager RAT and Lumma Stealer.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.smartapesg", "https://www.recordedfuture.com/research/graycharlie-hijacks-law-firm-sites-suspected-supply-chain-attack", "https://www.team-cymru.com/post/tracing-the-path-from-smartapesg-to-netsupport-rat", "https://www.esentire.com/blog/smartapesg-delivering-netsupport-rat", "https://isc.sans.edu/diary/32474", "https://medium.com/walmartglobaltech/smartapesg-4605157a5b80", "https://www.proofpoint.com/us/blog/threat-insight/are-you-sure-your-browser-date-current-landscape-fake-browser-updates", "https://www.threatdown.com/blog/smartapesg-06-11-2024/" ], "synonyms": [ "HANEYMANEY", "ZPHP" ], "type": [] }, "uuid": "3f0b6d2e-1297-4c84-bd91-0628bfa3f7ef", "value": "SmartApeSG" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.smokest", "https://malwaresourcecode.com/home/my-projects/write-ups/smokest-stealer-a-new-malware-family-maybe" ], "synonyms": [], "type": [] }, "uuid": "ac15dd72-2a36-4068-9c36-33c183281ee0", "value": "Smokest Stealer" }, { "description": "According to ESET, SpyPress is a set of Javascript payloads targeting different webmail frameworks (HORDE, MDAEMON, ROUNDCUBE, ZIMBRA). The observed payloads have common characteristics. All are similarly obfuscated, with variable and function names replaced with random-looking strings. Furthermore, strings used by the code, such as webmail and C&C server URLs, are also obfuscated and contained in an encrypted list. Each of those strings is only decrypted when it is used. Note that the variable and function names are randomized for each sample, so the final SpyPress payloads will have different hashes. Another common characteristic is that there are no persistence or update mechanisms. The payload is fully contained in the email and only executed when the email message is viewed from a vulnerable webmail instance.\r\n\r\nFinally, all payloads communicate with their hardcoded C&C servers via HTTP POST requests. There is a small number of C&C servers that are shared by all payloads (there is no separation by victim or payload type).", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.spypress", "https://www.proofpoint.com/us/blog/threat-insight/ta458-roundpress-exploits", "https://www.welivesecurity.com/en/eset-research/operation-roundpress/" ], "synonyms": [], "type": [] }, "uuid": "6a74d86a-af26-4dd3-96fa-71e248288d54", "value": "SpyPress" }, { "description": "SQLRat campaigns typically involve a lure document that includes an image overlayed by a VB Form trigger. Once a user has double-clicked the embedded image, the form executes a VB setup script. The script writes files to the path %appdata%\\Roaming\\Microsoft\\Templates\\, then creates two task entries triggered to run daily. The scripts are responsible for deobfuscating and executing the main JavaScript file mspromo.dot. The file uses a character insertion obfuscation technique, making it appear to contain Chinese characters. After deobfuscating the file, the main JavaScript is easily recognizable. It contains a number of functions designed to drop files and execute scripts on a host system. The SQLRat script is designed to make a direct SQL connection to a Microsoft database controlled by the attackers and execute the contents of various tables.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.sqlrat", "https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf", "https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf", "https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/" ], "synonyms": [], "type": [] }, "uuid": "d51cb8f8-cca3-46ce-a05d-052df44aef40", "value": "SQLRat" }, { "description": "According to the author, this is a JavaScript based Empire launcher that runs with its own embedded powershell host to not be dependent on local powershell availability.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.starfighter", "https://github.com/Cn33liz/StarFighters" ], "synonyms": [], "type": [] }, "uuid": "f6c80748-1cce-4f6b-92e9-f8a04ff3464a", "value": "Starfighter (Javascript)" }, { "description": "According to IBM X-Force, this is a simple reverse shell. Upon execution, the script generates a unique victim ID by combining the machine's product ID and computer name. It queries a hardcoded server and executes optional commands directly via cmd.exe. Command output is send back using a POST request after completion or a timeout.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.starfish", "https://www.ibm.com/think/x-force/hive0145-back-in-german-inboxes-with-strela-stealer" ], "synonyms": [], "type": [] }, "uuid": "d150ed7e-a2a0-4a63-9c71-6b01c6974e53", "value": "StarFish" }, { "description": "StoatWaffle Malware is a lightweight JavaScript-based backdoor trojan active since at least October 2025 that enables persistent, stealthy remote control over infected systems by continuously beaconing to a command-and-control server approximately every 5 seconds. The First-Stage Module performs host fingerprinting \u2014 collecting hostname, MAC address, operating system details, and the complete Node.js process environment (process.env), which frequently contains cloud credentials, API keys, and CI/CD secrets \u2014 and executes attacker-supplied payloads via eval(). The Second-Stage Module additionally collects the victim's public IP address, spawns attacker-supplied payloads as isolated detached child processes using the local Node.js runtime, and supports process ID tracking, remote agent UUID and session token updates, and an operator-controlled kill-switch that terminates all tracked child processes and self-exits on command. Both modules suppress SIGHUP signals and hide spawned process windows to reduce visibility, report errors to the C2 server via a dedicated telemetry endpoint, and together allow attackers to steal secrets, deliver additional payloads, execute arbitrary commands, and maintain ongoing process-level control with the privileges of the compromised user.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.stoatwaffle", "https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/", "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/", "https://quetzal.bitso.com/p/north-koreas-crypt-hunting-ghosts", "https://redasgard.com/blog/hunting-lazarus-part2-blockchain-dead-drop", "https://jp.security.ntt/insights_resources/tech_blog/stoatwaffle_malware_en/", "https://www.jamf.com/blog/threat-actors-expand-abuse-of-visual-studio-code/", "https://www.ransom-isac.org/blog/contagious-interview-vscode-to-rat/" ], "synonyms": [], "type": [] }, "uuid": "de0ef061-9159-4903-bb6c-63edcdd2e223", "value": "StoatWaffle" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.swid", "https://imp0rtp3.wordpress.com/2021/08/12/tetris/" ], "synonyms": [], "type": [] }, "uuid": "d4be22cf-497d-46a0-8d57-30d10d9486e3", "value": "Swid" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.tonrat", "https://www.microsoft.com/en-us/security/blog/2026/06/25/photo-zip-campaign-targeting-hospitality-industry-delivers-node-js-implant-persistent-access/", "https://blog.itochuci.co.jp/entry/2026/06/11/110000", "https://blog.itochuci.co.jp/entry/2026/06/11/111500", "https://www.trendmicro.com/de_de/research/26/f/tonresolver.html" ], "synonyms": [ "TONResolver" ], "type": [] }, "uuid": "c84b0207-3855-4330-9c87-073f7876f4bd", "value": "TonRAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.tsundere", "https://ctrlaltintel.com/threat%20research/MuddyWater/#python-server", "https://www.security.com/threat-intelligence/iran-cyber-threat-activity-us", "https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/", "https://blog.talosintelligence.com/talos-developing-situation-in-the-middle-east/", "https://research.checkpoint.com/2026/iranian-mois-actors-the-cyber-crime-connection/" ], "synonyms": [ "DinDoor" ], "type": [] }, "uuid": "868608d6-8cda-49d6-b724-4dc7661fb5a3", "value": "Tsundere" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.turla_ff_ext", "https://kindredsec.wordpress.com/2019/08/12/an-overview-of-public-platform-c2s/", "https://www.welivesecurity.com/2017/06/06/turlas-watering-hole-campaign-updated-firefox-extension-abusing-instagram/", "https://kindredsec.com/2019/08/12/an-overview-of-public-platform-c2s/" ], "synonyms": [], "type": [] }, "uuid": "c7ab9e5a-0ec9-481e-95ec-ad08f06cf985", "value": "HTML5 Encoding" }, { "description": "Expects a parameter to run: needs to be started as 'maintools.js EzZETcSXyKAdF_e5I2i1'.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.turla_maintools", "https://twitter.com/JohnLaTwC/status/915590893155098629" ], "synonyms": [], "type": [] }, "uuid": "218f8ca8-1124-4e44-8fbd-4b05b46bde4b", "value": "Maintools.js" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.unidentified_001", "https://community.riskiq.com/projects/53b4bd1e-dad0-306b-7712-d2a608400c8f", "https://gist.github.com/9b/141a5c7ab8b4280901722e2cd931b7ef" ], "synonyms": [], "type": [] }, "uuid": "f2b0ffdc-7d4e-4786-8935-e7036faa174d", "value": "Unidentified JS 001 (APT32 Profiler)" }, { "description": "According to Max Kersten, Emotet is dropped by a procedure spanned over multiple stages. The first stage is an office file that contains a macro. This macro then loads the second stage, which is either a PowerShell script or a piece of JavaScript, which is this family entry.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.unidentified_003", "https://maxkersten.nl/binary-analysis-course/malware-analysis/emotet-javascript-downloader/" ], "synonyms": [], "type": [] }, "uuid": "7bf28be0-3153-474d-8df7-e12fec511d7e", "value": "Unidentified JS 003 (Emotet Downloader)" }, { "description": "A simple loader written in JavaScript found by Marco Ramilli.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.unidentified_004", "https://marcoramilli.com/2020/11/27/threat-actor-unkown/" ], "synonyms": [], "type": [] }, "uuid": "a15e7c49-4eb6-46f0-8f79-0b765d7d4e46", "value": "Unidentified JS 004" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.unidentified_005", "https://blogs.jpcert.or.jp/en/2021/07/water_pamola.html" ], "synonyms": [], "type": [] }, "uuid": "a797e9b9-cb3f-484a-9273-ac73e9ea1e06", "value": "Unidentified JS 005 (Stealer)" }, { "description": "A script able to list folders and emails in the current Roundcube account, and to exfiltrate email messages to the C&C server by making HTTP requests.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.unidentified_006", "https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/", "https://go.recordedfuture.com/hubfs/reports/cta-2024-0217.pdf" ], "synonyms": [], "type": [] }, "uuid": "547fed09-38d0-4813-b9b0-870a1d4136df", "value": "Unidentified JS 006 (Winter Wyvern)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.unidentified_js_002" ], "synonyms": [], "type": [] }, "uuid": "7144063f-966b-4277-b316-00eb970ccd52", "value": "Unidentified JS 002" }, { "description": "According to PCrisk, Valak is malicious software that downloads JScript files and executes them. What happens next depends on the actions performed by the executed JScript files. It is very likely that cyber criminals behind Valak attempt to use this malware to cause chain infections (i.e., using Valak to distribute other malware).\r\n\r\nResearch shows that Valak is distributed through spam campaigns, however, in some cases, it infiltrates systems when they are already infected with malicious program such as Ursnif (also known as Gozi).", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.valak", "https://unit42.paloaltonetworks.com/valak-evolution/", "https://medium.com/@prsecurity_/casual-analysis-of-valak-c2-3497fdb79bf7", "https://blog.talosintelligence.com/2020/07/valak-emerges.html", "https://cocomelonc.github.io/malware/2023/07/26/malware-tricks-35.html", "https://labs.sentinelone.com/valak-malware-and-the-connection-to-gozi-loader-confcrew/", "https://twitter.com/malware_traffic/status/1207824548021886977", "https://unit42.paloaltonetworks.com/atoms/monsterlibra/", "https://threatresearch.ext.hp.com/detecting-ta551-domains/", "https://security-soup.net/analysis-of-valak-maldoc/", "https://securityintelligence.com/posts/sodinokibi-ransomware-incident-response-intelligence-together/", "https://www.cybereason.com/blog/valak-more-than-meets-the-eye" ], "synonyms": [ "Valek" ], "type": [] }, "uuid": "b37b4d91-0ac7-48f5-8fd1-5237b9615cf7", "value": "Valak" }, { "description": "The threat actor of this family compromised Chrome extension developer accounts and attached malicious code to the extensions. Web Developer 0.4.9, Chrometana 1.1.3, Infinity New Tab 3.12.3, CopyFish 2.8.5, Web Paint 1.2.1, and Social Fixer 20.1.1 were affected by this. TouchVPN and BetterVPN were assumed to be targets as well.\r\n\r\nThis lead to the execution of another Javascript that substitutes ad banners for their own, effectively hijacking ad traffic. It is also reported that fake pop-up alerts were used to lure victims to download possibly other malware. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.wd", "https://www.proofpoint.com/us/threat-insight/post/threat-actor-goes-chrome-extension-hijacking-spree" ], "synonyms": [], "type": [] }, "uuid": "62888aea-30b0-47f6-a7bf-1aa758f342fc", "value": "js.wd" }, { "description": "WEEVILPROXY is a sophisticated and featureful stealer which has a payload primarily written in NodeJS. The developer has put in concerted effort to develop the malware\u2019s breadth of capabilities, including novel techniques not observed in any prior malware campaigns - to our knowledge. These new TTPs include methods to modify Windows Setup and Windows Recovery to enable long-term persistence, as well as methods to patch browser extensions \u2018on the fly\u2019.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.weevilproxy", "https://labs.withsecure.com/publications/weevilproxy" ], "synonyms": [ "JSCEAL" ], "type": [] }, "uuid": "e715f9ad-58e7-4f5b-820e-dcb6937b6781", "value": "WEEVILPROXY" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.witchcoven", "https://www2.fireeye.com/rs/848-DID-242/images/rpt-witchcoven.pdf" ], "synonyms": [], "type": [] }, "uuid": "dcc0fad2-29a9-4b69-9d75-d288ca458bc7", "value": "witchcoven" }, { "description": "According to Proofpoint, ZimReaper is a JavaScript-based malware family delivered via a half-click cross-site scripting exploit (CVE-2025-66376) targeting Zimbra Collaboration Suite webmail servers, requiring only that the victim open or preview a malicious email in the webmail client. The exploit uses a tag-splitting technique where CSS \"@import\" directives fragment HTML tags to bypass Zimbra's client-side HTML sanitizer, allowing arbitrary JavaScript execution in the context of the authenticated webmail session. Once executed, ZimReaper steals the CSRF token, auto-filled credentials, and two-factor authentication codes from the browser, creates an app-specific password named \"ZimbraWeb\" for persistent IMAP/POP3/SMTP access, and exfiltrates stolen data via DNS queries and HTTP POST. The malware also enumerates the Global Address List and exfiltrates the last 90 days of the victim's emails in a TGZ archive, using obfuscation layers including XOR-encrypted payloads that evolved over the course of the campaign.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/js.zimreaper", "https://www.proofpoint.com/us/blog/threat-insight/ta488-targets-zimbra-mailservers-half-click-exploits", "https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/", "https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4553352/nsa-and-partners-alert-zimbra-collaboration-suite-users-of-a-russian-state-supp/" ], "synonyms": [], "type": [] }, "uuid": "a5679fd9-ea71-4efd-98d3-b27cd6a980b7", "value": "ZimReaper" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jsp.godzilla_webshell", "https://unit42.paloaltonetworks.com/cl-unk-1068-targets-critical-sectors/", "https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/", "https://www.trendmicro.com/en_us/research/25/c/the-espionage-toolkit-of-earth-alux.html", "https://www.elastic.co/security-labs/ref2924-howto-maintain-persistence-as-an-advanced-threat", "https://asec.ahnlab.com/en/47455/", "https://blog.gigamon.com/2022/09/28/investigating-web-shells/", "https://unit42.paloaltonetworks.com/tiltedtemple-manageengine-servicedesk-plus/", "https://harfanglab.io/insidethelab/insights-ivanti-csa-exploitation/", "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/" ], "synonyms": [], "type": [] }, "uuid": "07e88ccf-6027-412b-99bf-0fa1d3cfb174", "value": "Godzilla Webshell" }, { "description": "webshell", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/jsp.icesword", "https://www.welivesecurity.com/en/eset-research/unveiling-wolfsbane-gelsemiums-linux-counterpart-to-gelsevirine/" ], "synonyms": [], "type": [] }, "uuid": "f7b724e9-2584-4da8-b0c1-a6d9f4a8018e", "value": "Icesword" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.3cx_backdoor", "https://objective-see.org/blog/blog_0x74.html", "https://objective-see.org/blog/blog_0x73.html" ], "synonyms": [], "type": [] }, "uuid": "d5e10bf9-9de8-46be-96d0-aa502b14ffe8", "value": "3CX Backdoor (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.amodaltea", "https://moonlock.com/fake-vcs-target-crypto-talent-clickfix-campaign" ], "synonyms": [], "type": [] }, "uuid": "208b586f-6428-4182-bb04-c43200548ebc", "value": "AmodalTea" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.amos", "https://labs.k7computing.com/index.php/mentalpositives-new-macos-stealer-amos-repackaged-or-a-new-cyber-threat/", "https://hunt.io/blog/macos-odyssey-amos-malware-campaign", "https://www.bitdefender.com/blog/labs/when-stealers-converge-new-variant-of-atomic-stealer-in-the-wild/", "https://blog.cyble.com/2023/04/26/threat-actor-selling-new-atomic-macos-amos-stealer-on-telegram/", "https://www.intrinsec.com/wp-content/uploads/2025/10/TLP-CLEAR-31072025-ShadowSyndicate-infrastructure-illumination-EN.pdf", "https://denwp.com/amos-stealer-fud/", "https://spycloud.com/blog/reverse-engineering-atomic-macos-stealer/", "https://russianpanda.com/2024/01/15/Atomic-Stealer-AMOS/", "https://www.sentinelone.com/blog/atomic-stealer-threat-actor-spawns-second-variant-of-macos-malware-sold-on-telegram/", "https://medium.com/@ireneusz.tarnowski/multi-stage-malware-delivery-campaign-using-seo-poisoning-and-serverless-infrastructure-34e05e551fa3", "https://www.malwarebytes.com/blog/news/2025/09/fake-malwarebytes-lastpass-and-others-on-github-serve-malware", "https://securelist.com/crimeware-report-fakesg-akira-amos/111483/", "https://www.recordedfuture.com/the-travels-of-markopolo-self-proclaimed-meeting-software-vortax-spreads-infostealers", "https://www.malwarebytes.com/blog/threat-intelligence/2023/09/atomic-macos-stealer-delivered-via-malvertising", "https://redcanary.com/blog/threat-detection/atomic-stealer/", "https://denshiyurei.medium.com/silent-echoes-the-hidden-dialogue-among-malware-entities-spotlight-on-amos-infostealer-6d7cd70e3219", "https://www.malwarebytes.com/blog/threat-intelligence/2024/01/atomic-stealer-rings-in-the-new-year-with-updated-version", "https://cyble.com/blog/cyble-chronicles-february-1-latest-findings-recommendations-for-the-cybersecurity-community/", "https://redcanary.com/blog/threat-intelligence/atomic-odyssey-poseidon-stealers/", "https://www.huntress.com/blog/amos-stealer-chatgpt-grok-ai-trust", "https://www.kroll.com/en/publications/cyber/new-amos-infection-vector-highlights-risks-around-ai-adoption" ], "synonyms": [ "Atomic macOS Stealer" ], "type": [] }, "uuid": "2fa2be52-e44f-4998-bde7-c66cfb6f4521", "value": "AMOS" }, { "description": "According to PcRisk AppleJeus is the name of backdoor malware that was distributed by the Lazarus group. They spread this malicious software through a fake app disguised as a cryptocurrency trading application called Celas Trade Pro.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.applejeus", "https://brandefense.io/blog/apt-groups/lazarus-apt-group-apt38/", "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048d", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-north-korea-indictment", "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048e", "https://posts.specterops.io/introducing-venator-a-macos-tool-for-proactive-detection-34055a017e56", "https://blog.sekoia.io/the-dprk-delicate-sound-of-cyber/", "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048f", "https://objective-see.com/blog/blog_0x54.html", "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048g", "https://securelist.com/apt-trends-report-q2-2020/97937/", "https://objective-see.com/blog/blog_0x5F.html", "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048b", "https://vblocalhost.com/uploads/VB2021-Park.pdf", "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048c", "https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/", "https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf", "https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf", "https://objective-see.com/blog/blog_0x49.html", "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf", "https://securelist.com/operation-applejeus/87553/", "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048a", "https://www.youtube.com/watch?v=rjA0Vf75cYk", "https://securelist.com/operation-applejeus-sequel/95596/", "https://us-cert.cisa.gov/ncas/alerts/aa21-048a", "https://www.youtube.com/watch?v=1NkzTKkEM2k" ], "synonyms": [], "type": [] }, "uuid": "ca466f15-8e0a-4030-82cb-5382e3c56ee5", "value": "AppleJeus (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.banshee", "https://securityaffairs.com/171423/malware/the-source-code-of-banshee-stealer-leaked-online.html", "https://www.elastic.co/security-labs/beyond-the-wail?ultron=esl:_threat_research%2Besl_blog_post&blade=twitter&hulk=social&utm_content=14389248623&linkId=549532028" ], "synonyms": [], "type": [] }, "uuid": "5d7b9bcf-a0b6-47eb-8350-a80fac356567", "value": "BANSHEE" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.beavertail", "https://gitlab-com.gitlab.io/gl-security/security-tech-notes/threat-intelligence-tech-notes/north-korean-malware-sept-2025/", "https://objective-see.org/blog/blog_0x7A.html", "https://www.nimanthadeshappriya.com/post/from-colombo-to-pyongyang", "https://www.group-ib.com/blog/apt-lazarus-python-scripts/", "https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/" ], "synonyms": [], "type": [] }, "uuid": "61ec34d7-6c40-4900-9a79-f16b2eec213e", "value": "BeaverTail (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.bella", "https://blog.malwarebytes.com/threat-analysis/2017/05/another-osx-dok-dropper-found-installing-new-backdoor/", "https://github.com/kai5263499/Bella", "https://threatintel.blog/OPBlueRaven-Part2/" ], "synonyms": [], "type": [] }, "uuid": "3c5036ad-2afc-4bc1-a5a3-b31797f46248", "value": "Bella" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.bundlore", "https://labs.sentinelone.com/resourceful-macos-malware-hides-in-named-fork/", "https://www.trendmicro.com/en_hk/research/21/f/nukesped-copies-fileless-code-from-bundlore--leaves-it-unused.html", "https://twitter.com/ConfiantIntel/status/1393215825931288580?s=20", "https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf", "https://blog.confiant.com/new-macos-bundlore-loader-analysis-ca16d19c058c" ], "synonyms": [ "SurfBuyer" ], "type": [] }, "uuid": "5f5f5496-d9f8-4984-aa66-8702741646fe", "value": "Bundlore" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.careto", "https://techcrunch.com/2025/05/23/mysterious-hacking-group-careto-was-run-by-the-spanish-government-sources-say/", "https://www.alienvault.com/blogs/labs-research/os-x-malware-samples-analyzed" ], "synonyms": [ "Appetite", "Mask" ], "type": [] }, "uuid": "dcabea75-a433-4157-bb7a-be76de3026ac", "value": "Careto (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.casso", "https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/" ], "synonyms": [], "type": [] }, "uuid": "387e1a19-458d-4961-a8e4-3f82463085e5", "value": "Casso" }, { "description": "Google TAG has observed this malware being delivered via watering hole attacks using 0-day exploits, targeting visitors to Hong Kong websites for a media outlet and a prominent pro-democracy labor and political group.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.cdds", "https://www.volexity.com/blog/2024/08/02/stormbamboo-compromises-isp-to-abuse-insecure-software-update-mechanisms/", "https://blog.google/threat-analysis-group/analyzing-watering-hole-campaign-using-macos-exploits/", "https://www.sentinelone.com/labs/infect-if-needed-a-deeper-dive-into-targeted-backdoor-macos-macma/", "https://objective-see.com/blog/blog_0x69.html" ], "synonyms": [ "Macma" ], "type": [] }, "uuid": "5e4bdac7-b6c8-4c59-996f-babfc3bb3a3c", "value": "CDDS" }, { "description": "A loader delivering malicious Chrome and Safari extensions.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.choziosi", "https://redcanary.com/blog/chromeloader/", "https://blogs.blackberry.com/en/2022/11/chromeloader-infects-the-browser-by-loading-malicious-extension", "https://github.com/xephora/Threat-Remediation-Scripts/tree/main/Threat-Track/CS_INSTALLER", "https://www.crowdstrike.com/blog/how-crowdstrike-uncovered-a-new-macos-browser-hijacking-campaign/", "https://www.th3protocol.com/2022/Choziosi-Loader" ], "synonyms": [ "ChromeLoader", "Chropex" ], "type": [] }, "uuid": "57f75f24-b77b-46b3-a06a-57d49374fb82", "value": "Choziosi (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.cloud_mensis", "https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/", "https://twitter.com/ESETresearch/status/1575103839115804672" ], "synonyms": [ "BadRAT" ], "type": [] }, "uuid": "557fc183-f51a-4740-b2dd-5e81e6f6690a", "value": "CloudMensis" }, { "description": "CoinThief was a malware package designed to steal Bitcoins from the victim, consisting of a binary patcher, browser extensions, and a backdoor component. \r\n\r\nIt was spreading in early 2014 from several different sources: \r\n- on Github (where the trojanized compiled binary didn\u2019t match the displayed source code), o\r\n- on popular and trusted download sites line CNET's Download.com or MacUpdate.com, and \r\n- as cracked applications via torrents camouflaged as Bitcoin Ticker TTM, BitVanity, StealthBit, Litecoin Ticker, BBEdit, Pixelmator, Angry Birds and Delicious Library.\r\n\r\nThe patcher\u2018s role was to locate and modify legitimate versions of the Bitcoin-Qt wallet application. The analyzed malware samples targeted versions of Bitcoin-Qt 0.8.1, 0.8.0 and 0.8.5. The earlier patch modified Bitcoin-Qt adding malicious code that would send nearly all the victim\u2019s Bitcoins to one of the hard-coded addresses belonging to the attacker. \r\n\r\nThe browser extensions targeted Chrome and Firefox and are disguised as a \u201cPop-up blocker\u201d. The extensions monitored visited websites, download malicious JavaScripts and injected them into various Bitcoin-related websites (mostly Bitcoin exchanges and online wallet sites). The injected JS scripts were able to modify transactions to redirect Bitcoin transfers to an attacker\u2019s address or simply harvest login credentials to the targeted online service.\r\n\r\nThe backdoor enabled the attacker to take full control over the victim\u2019s computer:\r\n- collect information about the infected computer\r\n- execute arbitrary shell scripts on the target computer\r\n- upload an arbitrary file from the victim\u2019s hard drive to a remote server\r\n- update itself to a newer version", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.cointhief", "https://www.alienvault.com/blogs/labs-research/os-x-malware-samples-analyzed", "https://reverse.put.as/2014/02/16/analysis-of-cointhiefa-dropper/" ], "synonyms": [], "type": [] }, "uuid": "70e73da7-21d3-4bd6-9a0e-0c904e6457e8", "value": "CoinThief" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.coldroot_rat", "https://objective-see.com/blog/blog_0x2A.html", "https://objectivebythesea.com/v2/talks/OBTS_v2_Seele.pdf" ], "synonyms": [], "type": [] }, "uuid": "076a7ae0-f4b8-45c7-9de4-dc9cc7e54bcf", "value": "Coldroot RAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.convuster", "https://securelist.com/convuster-macos-adware-in-rust/101258/" ], "synonyms": [], "type": [] }, "uuid": "3819ded3-27ac-4e2f-9cd6-c6ef1642599b", "value": "Convuster" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.cpumeaner", "https://www.sentinelone.com/blog/osx-cpumeaner-miner-trojan-software-pirates/" ], "synonyms": [], "type": [] }, "uuid": "74360d1e-8f85-44d1-8ce7-e76afb652142", "value": "CpuMeaner" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.creative_updater", "https://blog.malwarebytes.com/threat-analysis/2018/02/new-mac-cryptominer-distributed-via-a-macupdate-hack/", "https://digitasecurity.com/blog/2018/02/05/creativeupdater/", "https://objective-see.com/blog/blog_0x29.html" ], "synonyms": [], "type": [] }, "uuid": "40fc6f71-75ac-43ac-abd9-c90b0e847999", "value": "CreativeUpdater" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.crisis", "https://www.symantec.com/connect/blogs/crisis-windows-sneaks-virtual-machines", "http://contagiodump.blogspot.com/2012/12/aug-2012-w32crisis-and-osxcrisis-jar.html", "https://www.intego.com/mac-security-blog/new-apple-mac-trojan-called-osxcrisis-discovered-by-intego-virus-team/?" ], "synonyms": [], "type": [] }, "uuid": "2bb6c494-8057-4d83-9202-fda3284deee4", "value": "Crisis" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.crossrider", "https://blog.malwarebytes.com/threat-analysis/2018/04/new-crossrider-variant-installs-configuration-profiles-on-macs/?utm_source=twitter&utm_medium=social" ], "synonyms": [], "type": [] }, "uuid": "05ddb459-5a2f-44d5-a135-ed3f1e772302", "value": "Crossrider" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.cthulhu_stealer", "https://www.cadosecurity.com/blog/from-the-depths-analyzing-the-cthulhu-stealer-malware-for-macos" ], "synonyms": [], "type": [] }, "uuid": "549f4c7c-55e3-478e-a84e-e27c5e195c97", "value": "Cthulhu Stealer" }, { "description": "According to PCrisk, Dacls is the name of a remote access Trojan (RAT), a malicious program that allows cyber criminals to control infected computers remotely.\r\n\r\nResearch shows that this malware is tied to Lazarus Group (a group of cyber criminals) and targets Linux and the Windows Operating System. Typically, cyber criminals use RATs to steal sensitive, confidential information, infect systems with other malware, and so on. In any case, no RAT is harmless and should be uninstalled immediately.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.dacls", "https://objective-see.com/blog/blog_0x57.html", "https://www.sygnia.co/mata-framework", "https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/", "https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/", "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/", "https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/", "https://securelist.com/apt-trends-report-q2-2020/97937/", "https://objective-see.com/blog/blog_0x5F.html", "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf", "https://blog.malwarebytes.com/threat-analysis/2020/05/new-mac-variant-of-lazarus-dacls-rat-distributed-via-trojanized-2fa-app/", "https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability" ], "synonyms": [], "type": [] }, "uuid": "81def650-f52e-49a3-a3fe-cb53ffa75d67", "value": "Dacls (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.darthminer", "https://blog.malwarebytes.com/threat-analysis/2018/12/mac-malware-combines-empyre-backdoor-and-xmrig-miner/" ], "synonyms": [], "type": [] }, "uuid": "a8e71805-014d-4998-b21e-3125da800124", "value": "DarthMiner" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.dazzle_spy", "https://objective-see.com/blog/blog_0x6D.html", "https://www.sentinelone.com/blog/sneaky-spies-and-backdoor-rats-sysjoker-and-dazzlespy-malware-target-macos/" ], "synonyms": [], "type": [] }, "uuid": "ba2c7d3c-7f7a-42f7-854c-a6cc0b5eb850", "value": "DazzleSpy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.dockster", "https://www.f-secure.com/weblog/archives/00002466.html", "http://contagiodump.blogspot.com/2012/12/osxdockstera-and-win32trojanagentaxmo.html" ], "synonyms": [], "type": [] }, "uuid": "713d8ec4-4983-4fbb-827c-2ef5bc0e6930", "value": "Dockster" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.dummy", "https://objective-see.com/blog/blog_0x32.html" ], "synonyms": [], "type": [] }, "uuid": "cbf9ff89-d35b-4954-8873-32f59f5e4d7d", "value": "Dummy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.eggshell_rat", "https://www.sentinelone.com/blog/session-cookies-keychains-ssh-keys-and-more-7-kinds-of-data-malware-steals-from-macos-users/" ], "synonyms": [], "type": [] }, "uuid": "ab733576-67ad-4cf9-8d11-afecac3f9a6e", "value": "EggShell RAT" }, { "description": "Eleanor comes as a drag-and-drop file utility called EasyDoc Converter. This application bundle wraps a shell script that uses Dropbox name as a disguise and installs three components: a hidden Tor service, a Pastebin agent and a web service with a PHP-based graphical interface.\r\n\r\nThe Tor service transforms the victim\u2019s computer into a server that provides attackers with full anonymous access to the infected machine via Tor-generated address. \r\n\r\nThe Pastebin agent uploads the address in encrypted form to the Pastebin website where the attackers can obtain it.\r\n\r\nThe web service is the main malicious component that provides the attackers with the control over the infected machine. After successful authentication, the interface offers several control panels to the attackers, allowing them to do the following actions:\r\n\r\n- Managing files\r\n- Listing processes\r\n- Connecting to various database management systems such as MySQL or SQLite\r\n- Connecting via bind/reverse shell\r\n- Executing shell command\r\n- Capturing and browsing images and videos from the victim\u2019s webcam\r\n- Sending emails with an attachment", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.eleanor", "https://labs.bitdefender.com/2016/07/new-mac-backdoor-nukes-os-x-systems/" ], "synonyms": [], "type": [] }, "uuid": "c221e519-fe3e-416e-bc63-a2246b860958", "value": "Eleanor" }, { "description": "According to PCrisk, ElectroRAT is a Remote Access Trojan (RAT) written in the Go programming language and designed to target Windows, MacOS, and Linux users. Cyber criminals behind ElectroRAT target mainly cryptocurrency users. This RAT is distributed via the trojanized Jamm, eTrader, and DaoPoker applications.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.electro_rat", "https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/", "https://objective-see.com/blog/blog_0x61.html", "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-old-dogs-new-tricks.pdf" ], "synonyms": [], "type": [] }, "uuid": "f8ccf928-7d4f-4999-91a5-9222f148152d", "value": "ElectroRAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.evilosx", "https://github.com/Marten4n6/EvilOSX", "https://twitter.com/JohnLaTwC/status/966139336436498432" ], "synonyms": [], "type": [] }, "uuid": "24f3d8e1-3936-4664-b813-74c797b87d9d", "value": "EvilOSX" }, { "description": "According to PcRisk, EvilQuest (also known as ThiefQuest) is like many other malicious programs of this type - it encrypts files and creates a ransom message. In most cases, this type of malware modifies the names of encrypted files by appending certain extensions, however, this ransomware leaves them unchanged.\r\n\r\nIt drops the \"READ_ME_NOW.txt\" in each folder that contains encrypted data and displays another ransom message in a pop-up window. Additionally, this malware is capable of detecting if certain files are stored on the computer, operates as a keylogger, and receives commands from a Command & Control server.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.evilquest", "https://twitter.com/dineshdina04/status/1277668001538433025", "https://www.sentinelone.com/blog/evilquest-a-new-macos-malware-rolls-ransomware-spyware-and-data-theft-into-one/", "https://www.crowdstrike.com/blog/how-crowdstrike-analyzes-macos-malware-to-optimize-automated-detection-capabilities", "https://labs.sentinelone.com/breaking-evilquest-reversing-a-custom-macos-ransomware-file-encryption-routine/", "https://objective-see.com/blog/blog_0x59.html", "https://github.com/gdbinit/evilquest_deobfuscator", "https://www.sentinelone.com/labs/defeating-macos-malware-anti-analysis-tricks-with-radare2/", "https://objective-see.com/blog/blog_0x5F.html", "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf", "https://www.bleepingcomputer.com/news/security/evilquest-wiper-uses-ransomware-cover-to-steal-files-from-macs/" ], "synonyms": [ "ThiefQuest" ], "type": [] }, "uuid": "d5b39223-a8cc-4d47-8030-1d7d6312d351", "value": "EvilQuest" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.failytale", "https://www.sentinelone.com/blog/trail-osx-fairytale-adware-playing-malware/" ], "synonyms": [], "type": [] }, "uuid": "5dfd704c-a69d-4e93-bd70-68f89fbbb32c", "value": "FailyTale" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.finfisher", "https://securelist.com/finspy-unseen-findings/104322/", "https://reverse.put.as/2020/09/26/the-finfisher-tales-chapter-1/", "https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/", "https://objective-see.com/blog/blog_0x4F.html", "https://objective-see.com/blog/blog_0x5F.html", "https://netzpolitik.org/2020/our-criminal-complaint-german-state-malware-company-finfisher-raided/" ], "synonyms": [], "type": [] }, "uuid": "89ce536c-03b9-4f69-83ce-723f26b36494", "value": "FinFisher (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.flashback", "https://www.crowdstrike.com/blog/how-crowdstrike-analyzes-macos-malware-to-optimize-automated-detection-capabilities", "http://contagiodump.blogspot.com/2012/04/osxflashbacko-sample-some-domains.html", "http://contagiodump.blogspot.com/2012/04/osxflashbackk-sample-mac-os-malware.html", "https://www.alienvault.com/blogs/labs-research/os-x-malware-samples-analyzed", "https://web-assets.esetstatic.com/wls/200x/white-papers/osx_flashback.pdf", "https://en.wikipedia.org/wiki/Flashback_(Trojan)", "https://news.drweb.com/show/?c=5&i=2386&lng=en" ], "synonyms": [ "FakeFlash" ], "type": [] }, "uuid": "f92b5355-f398-4f09-8bcc-e06df6fe51a0", "value": "FlashBack" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.flexibleferret", "https://www.sentinelone.com/blog/macos-flexibleferret-further-variants-of-dprk-malware-family-unearthed/" ], "synonyms": [], "type": [] }, "uuid": "b4461d8d-f41b-4195-a36c-45cd24409f6a", "value": "FlexibleFerret" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.friendlyferret", "https://www.sentinelone.com/blog/macos-flexibleferret-further-variants-of-dprk-malware-family-unearthed/" ], "synonyms": [], "type": [] }, "uuid": "55d9ec38-aba4-4049-a98e-0f3289b17477", "value": "FriendlyFerret" }, { "description": "According to Proofpoint, FrigidStealer FrigidStealer uses Apple script files and osascript to prompt the user to enter their password, and then to gather data including browser cookies, files with extensions relevant to password material or cryptocurrency from the victim\u2019s Desktop and Documents folders, and any Apple Notes the user has created.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.frigid_stealer", "https://www.proofpoint.com/us/blog/threat-insight/update-fake-updates-two-new-actors-and-new-mac-malware" ], "synonyms": [], "type": [] }, "uuid": "0656f9e1-9606-42b4-9198-114d55e05a17", "value": "FrigidStealer" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.frostyferret", "https://www.silentpush.com/blog/contagious-interview-front-companies/", "https://www.trendmicro.com/en_us/research/25/d/russian-infrastructure-north-korean-cybercrime.html", "https://www.sentinelone.com/blog/macos-flexibleferret-further-variants-of-dprk-malware-family-unearthed/", "https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/" ], "synonyms": [], "type": [] }, "uuid": "3f8caa3d-63ed-4140-b8b1-d290936730da", "value": "FrostyFerret" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.fruitfly", "https://www.virusbulletin.com/virusbulletin/2017/11/vb2017-paper-offensive-malware-analysis-dissecting-osxfruitflyb-custom-cc-server/", "https://arstechnica.com/security/2017/01/newly-discovered-mac-malware-may-have-circulated-in-the-wild-for-2-years/", "https://objectivebythesea.com/v3/talks/OBTS_v3_tReed.pdf", "https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/", "https://arstechnica.com/security/2017/07/perverse-malware-infecting-hundreds-of-macs-remained-undetected-for-years/", "https://www.documentcloud.org/documents/4346338-Phillip-Durachinsky-Indictment.html" ], "synonyms": [ "Quimitchin" ], "type": [] }, "uuid": "a517cdd1-6c82-4b29-bdd2-87e281227597", "value": "FruitFly" }, { "description": "Fullhouse (AKA FULLHOUSE.DOORED) is a custom backdoor used by subsets of the North Korean Lazarus Group. Fullhouse is written in C/C++ and includes the capabilities of a tunneler and backdoor commands support such as shell command execution, file transfer, file managment, and process injection. C2 communications occur via HTTP and require configuration through the command line or a configuration file.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.fullhouse", "https://www.mandiant.com/resources/blog/north-korea-supply-chain" ], "synonyms": [], "type": [] }, "uuid": "2ab781d8-214d-41e2-acc9-23ded4f77663", "value": "FULLHOUSE" }, { "description": "According to SentinelLabs, Gaslight is a DPRK-aligned macOS backdoor and infostealer written in Rust that communicates over the Telegram Bot API, using AES-GCM encryption layered on certificate-pinned TLS. The implant provides an interactive remote shell with generic capabilities for command execution, file exfiltration, process management, and configuration-driven persistence, and it can stage a Python-based stealer via a bundled installer that fetches a standalone CPython runtime at execution time. It collects browser data, system and process information, and keychain contents, packaging and uploading them through the same hardened command-and-control channel. A distinctive characteristic is its embedded multi-message prompt-injection payload designed to manipulate LLM-assisted analysis pipelines, along with runtime self-redaction of its bot token to prevent credential leakage in logs or crash artifacts.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.gaslight", "https://www.sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/" ], "synonyms": [], "type": [] }, "uuid": "27ac0280-472e-437d-ba37-8b4ac1333572", "value": "Gaslight" }, { "description": "This multi-platform malware is a ObjectiveC written macOS variant dubbed GIMMICK by Volexity. This malware is a file-based C2 implant used by Storm Cloud.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.gimmick", "https://www.volexity.com/blog/2022/03/22/storm-cloud-on-the-horizon-gimmick-malware-strikes-at-macos/", "https://cybersecuritynews.com/gimmick-malware-attacks/" ], "synonyms": [], "type": [] }, "uuid": "0e259d0f-717a-4ced-ac58-6fe9d72e2c96", "value": "GIMMICK (OS X)" }, { "description": "According to PCrisk, GMERA (also known as Kassi trojan) is malicious software that disguises itself as Stockfolio, a legitimate trading app created for Mac users.\r\n\r\nResearch shows that there are two variants of this malware, one detected as Trojan.MacOS.GMERA.A and the other as Trojan.MacOS.GMERA.B. Cyber criminals proliferate GMERA to steal various information and upload it to a website under their control. To avoid damage caused by this malware, remove GMERA immediately.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.gmera", "https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/", "https://objective-see.com/blog/blog_0x53.html", "https://blog.trendmicro.com/trendlabs-security-intelligence/mac-malware-that-spoofs-trading-app-steals-user-information-uploads-it-to-website/" ], "synonyms": [ "Kassi", "StockSteal" ], "type": [] }, "uuid": "1c65cf4e-5df4-4d56-a414-7b05f00814ba", "value": "Gmera" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.golangghost", "https://www.abstract.security/blog/contagious-interview-evolution-of-vs-code-and-cursor-tasks-infection-chains-part-2", "https://blog.talosintelligence.com/python-version-of-golangghost-rat/", "https://blog.polyswarm.io/famous-chollimas-pylangghost", "https://www.wiz.io/blog/north-korean-tradertraitor-crypto-heist", "https://www.trendmicro.com/en_us/research/25/d/russian-infrastructure-north-korean-cybercrime.html", "https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf", "https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/", "https://hackernoon.com/cybercrooks-are-using-fake-job-listings-to-steal-crypto", "https://www.silentpush.com/blog/contagious-interview-front-companies/" ], "synonyms": [], "type": [] }, "uuid": "1f8b4aac-fc57-4f66-8b03-bbf279f417e9", "value": "GolangGhost (OS X)" }, { "description": "According to Malwarebytes, The HiddenLotus \"dropper\" is an application named L\u00ea Thu H\u00e0 (HAEDC).pdf, using an old trick of disguising itself as a document - in this case, an Adobe Acrobat file.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.hiddenlotus", "https://blog.malwarebytes.com/threat-analysis/2017/12/interesting-disguise-employed-by-new-mac-malware/" ], "synonyms": [], "type": [] }, "uuid": "fc17e41f-e9f7-4442-a05c-7a19b9174c39", "value": "HiddenLotus" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.hloader", "https://www.virusbulletin.com/uploads/pdf/conference/vb2024/papers/Sugarcoating-KANDYKORN-a-sweet-dive-into-a-sophisticated-MacOS-backdoor.pdf", "https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn", "https://www.sentinelone.com/blog/dprk-crypto-theft-macos-rustbucket-droppers-pivot-to-deliver-kandykorn-payloads/" ], "synonyms": [], "type": [] }, "uuid": "28304d68-689e-4488-80cb-d5b7b50a8d57", "value": "HLOADER" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.hz_rat", "https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/" ], "synonyms": [], "type": [] }, "uuid": "37f37678-c8c3-44d7-82bd-ecb452fba012", "value": "HZ RAT (OS X)" }, { "description": "The threat was a multi-stage malware displaying a decoy that appeared to the victim as a Chinese language article on the long-running dispute over the Diaoyu Islands; an array of erotic pictures; or images of Tibetan organisations. It consisted of two stages: Revir was the dropper/downloader and Imuler was the backdoor capable of the following operations:\r\n\r\n- capture screenshots\r\n- exfiltrate files to a remote computer\r\n- send various information about the infected computer\r\n- extract ZIP archive\r\n- download files from a remote computer and/or the Internet\r\n- run executable files", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.imuler", "https://www.welivesecurity.com/2012/03/16/osximuler-updated-still-a-threat-on-mac-os-x/", "http://contagiodump.blogspot.com/2012/11/group-photoszip-osxrevir-osximuler.html", "https://nakedsecurity.sophos.com/2012/11/13/new-mac-trojan/" ], "synonyms": [ "Revir" ], "type": [] }, "uuid": "261fd543-60e4-470f-af28-7a9b17ba4759", "value": "iMuler" }, { "description": "RAT. Functionality like ExecShell, GetFileList/SendFile/DownloadFile, Socks5, PortmapManager/GetConn/SendConn. Transport also supports Quic.\r\n\r\nVariants in GO.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.insidiousgh0st", "https://blogapp.bitdefender.com/labs/content/files/2024/05/Bitdefender-Report-DeepDive-creat7721-en_EN.pdf" ], "synonyms": [], "type": [] }, "uuid": "b31b2420-57ea-41c1-b2fe-3319fa1e63fc", "value": "InsidiousGh0st (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.interception", "https://twitter.com/ESETresearch/status/1559553324998955010", "https://labs.k7computing.com/index.php/lazarus-apts-operation-interception-uses-signed-binary/", "https://www.sentinelone.com/blog/lazarus-operation-interception-targets-macos-users-dreaming-of-jobs-in-crypto" ], "synonyms": [], "type": [] }, "uuid": "d4f7ea92-04e7-405c-9faf-7993ffd5c473", "value": "Interception (OS X)" }, { "description": "According to Patrick Wardle, this malware persists a python script as a cron job. \r\nSteps: \r\n1. Python installer first saves any existing cron jobs into a temporary file named '/tmp/dump'. \r\n2. Appends its new job to this file.\r\n3. Once the new cron job has been added 'python (~/.t/runner.pyc)' runs every minute.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.janicab", "https://securelist.com/apt-trends-report-q3-2020/99204/", "https://www.malwarology.com/posts/5-janicab-part_1/", "https://www.malwarology.com/2022/05/janicab-series-the-core-artifact/", "https://blog.avast.com/2013/07/22/multisystem-trojan-janicab-attacks-windows-and-macosx-via-scripts/", "https://securelist.com/deathstalker-mercenary-triumvirate/98177/", "https://www.malwarology.com/2022/05/janicab-series-further-steps-in-the-infection-chain/", "https://archive.f-secure.com/weblog/archives/00002576.html", "https://securelist.com/deathstalker-targets-legal-entities-with-new-janicab-variant/108131/", "https://sec0wn.blogspot.com/2018/12/powersing-from-lnk-files-to-janicab.html", "https://www.malwarology.com/2022/05/janicab-series-attibution-and-iocs/", "https://www.malwarology.com/2022/05/janicab-series-first-steps-in-the-infection-chain/", "https://www.macmark.de/blog/osx_blog_2013-08-a.php" ], "synonyms": [], "type": [] }, "uuid": "01325d85-297f-40d5-b829-df9bd996af5a", "value": "Janicab (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.jokerspy", "https://www.elastic.co/security-labs/inital-research-of-jokerspy" ], "synonyms": [], "type": [] }, "uuid": "171b0695-8cea-4ca6-a3f0-c9a8455ef9de", "value": "JokerSpy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.kandykorn", "https://www.virusbulletin.com/uploads/pdf/conference/vb2024/papers/Sugarcoating-KANDYKORN-a-sweet-dive-into-a-sophisticated-MacOS-backdoor.pdf", "https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn", "https://www.sentinelone.com/blog/dprk-crypto-theft-macos-rustbucket-droppers-pivot-to-deliver-kandykorn-payloads/" ], "synonyms": [], "type": [] }, "uuid": "d314856b-1c07-4f4a-ab3e-eeae38536857", "value": "KANDYKORN" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.keranger", "http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/", "https://objective-see.com/blog/blog_0x16.html", "https://www.macworld.com/article/3234650/macs/keranger-the-first-in-the-wild-ransomware-for-macs-but-certainly-not-the-last.html" ], "synonyms": [], "type": [] }, "uuid": "01643bc9-bd61-42e8-b9f1-5fbf83dcd786", "value": "KeRanger" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.keydnap", "http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/", "https://github.com/eset/malware-ioc/tree/master/keydnap", "https://www.welivesecurity.com/2016/08/30/osxkeydnap-spreads-via-signed-transmission-application/", "https://objective-see.com/blog/blog_0x16.html" ], "synonyms": [], "type": [] }, "uuid": "2173605b-bf44-4c76-b75a-09c53bb322d6", "value": "Keydnap" }, { "description": "According to SentinelOne, KeySteal targets files with the .keychain and keychain-db file extensions in the following locations.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.keysteal", "https://www.sentinelone.com/blog/session-cookies-keychains-ssh-keys-and-more-7-kinds-of-data-malware-steals-from-macos-users/" ], "synonyms": [], "type": [] }, "uuid": "53f359ed-6178-4d9e-958f-e79d5d4b3655", "value": "KeySteal" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.kitmos", "https://www.f-secure.com/weblog/archives/00002558.html" ], "synonyms": [ "KitM" ], "type": [] }, "uuid": "8a1b1c99-c149-4339-9058-db3b4084cdcd", "value": "Kitmos" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.komplex", "http://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/", "https://contagiodump.blogspot.de/2017/02/russian-apt-apt28-collection-of-samples.html", "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf", "https://blog.malwarebytes.com/threat-analysis/2016/09/komplex-mac-backdoor-answers-old-questions/", "https://objective-see.com/blog/blog_0x16.html" ], "synonyms": [ "JHUHUGIT", "JKEYSKW", "SedUploader" ], "type": [] }, "uuid": "d26b5518-8d7f-41a6-b539-231e4962853e", "value": "Komplex" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.kuiper", "https://www.trellix.com/about/newsroom/stories/research/the-evolution-of-the-kuiper-ransomware/" ], "synonyms": [], "type": [] }, "uuid": "c39087ca-05b7-4374-aff1-116a73f2ba74", "value": "Kuiper (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.lador", "https://www.crowdstrike.com/blog/how-crowdstrike-analyzes-macos-malware-to-optimize-automated-detection-capabilities/" ], "synonyms": [], "type": [] }, "uuid": "9c6b54ce-44a0-4d0c-89cb-6532c8f89d8d", "value": "Lador" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.lambert", "https://objective-see.com/blog/blog_0x68.html" ], "synonyms": [ "GreenLambert" ], "type": [] }, "uuid": "7433f3a8-f53c-4ba0-beff-e312fae9ad39", "value": "Lambert (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.laoshu", "https://objective-see.com/blog/blog_0x16.html", "https://nakedsecurity.sophos.com/2014/01/21/data-stealing-malware-targets-mac-users-in-undelivered-courier-item-attack/" ], "synonyms": [], "type": [] }, "uuid": "a13a2cb8-b0e6-483a-9916-f44969a2c42b", "value": "Laoshu" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.leverage", "https://www.alienvault.com/blogs/labs-research/osx-leveragea-analysis", "https://www.volexity.com/blog/2017/07/24/real-news-fake-flash-mac-os-x-users-targeted/" ], "synonyms": [], "type": [] }, "uuid": "15daa766-f721-4fd5-95fb-153f5361fb87", "value": "Leverage" }, { "description": "According to Volexity, LIGHTSPY is a multi-platform malware family with documented variants for Android, iOS, and macOS.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.lightspy", "https://www.volexity.com/blog/2024/11/15/brazenbamboo-weaponizes-forticlient-vulnerability-to-steal-vpn-credentials-via-deepdata/" ], "synonyms": [], "type": [] }, "uuid": "bbf9a81c-7bd0-4ee0-9166-251a447fff5e", "value": "LIGHTSPY" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.lockbit", "https://www.washingtonpost.com/business/2024/02/20/lockbit-ransomware-cronos-nca-fbi/", "https://medium.com/@lcam/lighting-the-exfiltration-infrastructure-of-a-lockbit-affiliate-and-more-f57fbb7a4e79", "https://krebsonsecurity.com/2023/05/russian-hacker-wazawaka-indicted-for-ransomware/", "https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/", "https://analyst1.com/lockbit-takedown-operation-cronos-a-long-awaited-psyops-against-ransomware/", "https://twitter.com/malwrhunterteam/status/1647384505550876675", "https://nationalcrimeagency.gov.uk/news/nca-leads-international-investigation-targeting-worlds-most-harmful-ransomware-group", "https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf", "https://www.europol.europa.eu/media-press/newsroom/news/law-enforcement-disrupt-worlds-biggest-ransomware-operation", "https://www.linkedin.com/pulse/intrusion-insights-straight-from-leaked-operator-chats-ahmad-abdillah-p1ejc?utm_source=share&utm_medium=member_ios&utm_campaign=share_via", "https://services.google.com/fh/files/misc/m-trends-2025-en.pdf" ], "synonyms": [], "type": [] }, "uuid": "0821b5c8-db48-4d0e-a969-384dbd74a6c9", "value": "LockBit (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.macdownloader", "https://www.secureworks.com/research/threat-profiles/cobalt-gypsy", "https://iranthreats.github.io/resources/macdownloader-macos-malware/" ], "synonyms": [], "type": [] }, "uuid": "910d3c78-1a9e-4600-a3ea-4aa5563f0f13", "value": "MacDownloader" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.macinstaller", "https://objective-see.com/blog/blog_0x16.html" ], "synonyms": [], "type": [] }, "uuid": "d1f8af3c-719b-4f64-961b-8d89a2defa02", "value": "MacInstaller" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.macransom", "https://objective-see.com/blog/blog_0x1E.html", "https://blog.fortinet.com/2017/06/09/macransom-offered-as-ransomware-as-a-service" ], "synonyms": [], "type": [] }, "uuid": "66862f1a-5823-4a9a-bd80-439aaafc1d8b", "value": "MacRansom" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.macspy", "https://www.alienvault.com/blogs/labs-research/macspy-os-x-rat-as-a-service" ], "synonyms": [], "type": [] }, "uuid": "c9915d41-d1fb-45bc-997e-5cd9c573d8e7", "value": "MacSpy" }, { "description": "According to Zscaler, MacSync (also tracked as MacSync Stealer) is a macOS information stealer likely developed by a Russian-speaking threat actor, as evidenced by Russian-language comments found in its third-stage AppleScript payload. It is distributed through a multi-stage ClickFix campaign that abuses shared Claude chats, ultimately delivering the core stealer via osascript, which leaves no file trace on disk. Its capabilities include stealing keychain data, browser credentials, cookies, and autofill information from Chromium- and Gecko-based browsers, harvesting cryptocurrency wallet data (both browser extensions and desktop applications), and collecting sensitive files such as cloud keys, shell history, and high-value documents, all of which are compressed and exfiltrated in 10MB HTTP PUT chunks. The malware also implements persistence by appending a curl command to ~/.zshrc, prompts the user for full disk access, and may drop additional trojanized payloads targeting hardware-wallet users.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.macsync", "https://www.zscaler.com/blogs/security-research/claudefix-shared-claude-chats-meet-clickfix" ], "synonyms": [], "type": [] }, "uuid": "865ba078-38c0-4012-9bd4-299c363e36fe", "value": "MacSync" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.macvx", "https://objective-see.com/blog/blog_0x16.html" ], "synonyms": [], "type": [] }, "uuid": "4db9012b-d3a1-4f19-935c-4dbc7fdd93fe", "value": "MacVX" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.mami", "https://objective-see.com/blog/blog_0x26.html" ], "synonyms": [], "type": [] }, "uuid": "7759534c-3298-42e9-adab-896d7e507f4f", "value": "MaMi" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.manuscrypt", "https://twitter.com/BitsOfBinary/status/1337330286787518464", "https://www.wiz.io/blog/north-korean-tradertraitor-crypto-heist", "https://www.anquanke.com/post/id/223817", "https://twitter.com/BitsOfBinary/status/1321488299932983296", "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf" ], "synonyms": [], "type": [] }, "uuid": "f85c3ec9-81f0-4dee-87e6-b3f6b235bfe7", "value": "Manuscrypt" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.mokes", "https://securelist.com/blog/research/75990/the-missing-piece-sophisticated-os-x-backdoor-discovered/", "https://objective-see.com/blog/blog_0x53.html", "https://objective-see.com/blog/blog_0x16.html" ], "synonyms": [], "type": [] }, "uuid": "bfbb6e5a-32dc-4842-936c-5d8497570c74", "value": "Mokes (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.mughthesec", "https://objective-see.com/blog/blog_0x20.html" ], "synonyms": [], "type": [] }, "uuid": "aa1bf4e5-9c44-42a2-84e5-7526e4349405", "value": "Mughthesec" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.netwire", "https://www.intego.com/mac-security-blog/fbi-shuts-down-11-year-old-netwire-rat-malware/" ], "synonyms": [], "type": [] }, "uuid": "f0d52afd-e7c9-4bd1-be8a-9ab09b14ea24", "value": "NetWire" }, { "description": "According to PcRisk, Research shows that the OceanLotus 'backdoor' targets MacOS computers. Cyber criminals behind this backdoor have already used this malware to attack human rights and media organizations, some research institutes, and maritime construction companies.\r\n\r\nThe OceanLotus backdoor is distributed via a fake Adobe Flash Player installer and a malicious Word document (it is likely that threat authors distribute the document via malspam emails).", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.oceanlotus", "https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/", "https://cocomelonc.github.io/malware/2025/01/19/malware-tricks-44.html", "https://researchcenter.paloaltonetworks.com/2017/06/unit42-new-improved-macos-backdoor-oceanlotus/", "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html", "https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update", "https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/", "https://brandefense.io/blog/apt-groups/ocean-lotus-apt-group/", "https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/", "https://cocomelonc.github.io/malware/2025/02/24/malware-tricks-45.html", "https://labs.sentinelone.com/apt32-multi-stage-macos-trojan-innovates-on-crimeware-scripting-technique/", "https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html", "https://github.com/AmnestyTech/investigations/tree/master/2021-02-24_vietnam", "https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries", "https://tradahacking.vn/%C4%91%E1%BB%A3t-r%E1%BB%93i-t%C3%B4i-c%C3%B3-%C4%91%C4%83ng-m%E1%BB%99t-status-xin-d%E1%BA%A1o-tr%C3%AAn-fb-may-qu%C3%A1-c%C5%A9ng-c%C3%B3-v%C3%A0i-b%E1%BA%A1n-nhi%E1%BB%87t-t%C3%ACnh-g%E1%BB%ADi-cho-537b19ee3468", "https://bluecyber.hashnode.dev/apt32-malware-an-in-depth-analysis" ], "synonyms": [], "type": [] }, "uuid": "65b7eff4-741c-445e-b4e0-8a4e4f673a65", "value": "OceanLotus" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.odyssey_stealer", "https://redcanary.com/blog/threat-intelligence/atomic-odyssey-poseidon-stealers/", "https://www.cyfirma.com/research/odyssey-stealer-the-rebrand-of-poseidon-stealer/" ], "synonyms": [], "type": [] }, "uuid": "361fe0b4-30b2-4b4f-a2d4-a7ad1a052056", "value": "Odyssey Stealer" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.olyx", "http://contagiodump.blogspot.com/2011/07/jul-25-mac-olyx-gh0st-backdoor-in-rar.html", "https://news.drweb.com/show/?i=1750&lng=en&c=14" ], "synonyms": [], "type": [] }, "uuid": "cd397973-8f42-4c49-8322-414ea77ec773", "value": "Olyx" }, { "description": "SentinelOne describes this as a malware written in Go, mixing own custom code with code from public repositories.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.orat", "https://documents.trendmicro.com/assets/txt/earth-berberoka-macos-iocs-2.txt", "https://documents.trendmicro.com/assets/white_papers/wp-operation-earth-berberoka.pdf", "https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-40-LunghiHorejsi.pdf", "https://www.sentinelone.com/blog/from-the-front-lines-unsigned-macos-orat-malware-gambles-for-the-win/" ], "synonyms": [], "type": [] }, "uuid": "699dac0f-092c-4c8e-85e9-6e3c86129190", "value": "oRAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.osaminer", "https://cocomelonc.github.io/macos/2026/04/27/mac-malware-persistence-11.html", "https://labs.sentinelone.com/fade-dead-adventures-in-reversing-malicious-run-only-applescripts/" ], "synonyms": [], "type": [] }, "uuid": "89d0c423-c4ff-46e8-8c79-ea5e974e53e7", "value": "OSAMiner" }, { "description": "This crypto-ransomware for macOS was caught spreading via BitTorrent distribution sites in February 2017, masquerading as 'Patcher', an application used for pirating popular software like Adobe Premiere Pro or Microsoft Office for Mac.\r\n\r\nThe downloaded torrent contained an application bundle in the form of a single zip file. After launching the fake application, the main window of the fake cracking tool was displayed.\r\n\r\nThe file encryption process was launched after the misguided victim clicked 'Start'. Once executed, the ransomware generated a random 25-character string and set it as the key for RC4 encryption of all of the user's files. It then demanded ransom in Bitcoin, as instructed in the 'README!' .txt file copied all over the user's directories.\r\n\r\nDespite the instructions being quite thorough, Patcher lacked the functionality to communicate with any C&C server, and therefore made it impossible for its operators to decrypt affected files. The randomly generated encryption key was also too long to be guessed via a brute-force attack, leaving the encrypted data unrecoverable in a reasonable amount of time.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.patcher", "http://www.welivesecurity.com/2017/02/22/new-crypto-ransomware-hits-macos/" ], "synonyms": [ "FileCoder", "Findzip" ], "type": [] }, "uuid": "bad1057c-4f92-4747-a0ec-31bcc062dab8", "value": "Patcher" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.pearl_stealer", "https://rmceoin.github.io/malware-analysis/2025/07/20/pearl-stealer.html" ], "synonyms": [], "type": [] }, "uuid": "d255cff1-5a66-45fe-8cd7-49218b50a572", "value": "Pearl Stealer" }, { "description": "Backdoor as a fork of OpenSSH_6.0 with no logging, and \u201c-P\u201d and \u201c-z\u201d hidden command arguments. \u201cPuffySSH_5.8p1\u201d string.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.pintsized", "https://eromang.zataz.com/2013/03/24/osx-pintsized-backdoor-additional-details/" ], "synonyms": [], "type": [] }, "uuid": "de13bec0-f443-4c5a-91fe-2223dad43be5", "value": "PintSized" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.pirrit", "http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf", "http://www.zdnet.com/article/maker-of-sneaky-mac-adware-sends-security-researcher-cease-and-desist-letter/", "https://forensicitguy.github.io/analyzing-pirrit-adware-installer/", "https://www.cybereason.com/hubfs/Content%20PDFs/OSX.Pirrit%20Part%20III%20The%20DaVinci%20Code.pdf", "https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf" ], "synonyms": [], "type": [] }, "uuid": "b749ff3a-df68-4b38-91f1-649864eae52c", "value": "Pirrit" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.poolrat", "https://www.3cx.com/blog/news/mandiant-security-update2/", "https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack", "https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Lazarus-campaigns-and-backdoors-in-2022-2023.pdf", "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise", "https://www.acronis.com/en/tru/posts/acronis-tru-alliance-huntio-hunting-dprk-threats-new-global-lazarus-and-kimsuky-campaigns/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-north-korea-indictment", "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048e", "https://blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-for-your-cheese/#7ad29534-c69c-41ce-ae8e-99c32f0d11b3" ], "synonyms": [ "SIMPLESEA", "SIMPLETEA" ], "type": [] }, "uuid": "bfd9e30e-ddc7-426f-8f77-4d2e1a846541", "value": "POOLRAT" }, { "description": "Part of Mythic C2, written in Golang.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.poseidon", "https://github.com/MythicAgents/poseidon" ], "synonyms": [], "type": [] }, "uuid": "e4ac9105-c3ad-41e2-846b-048e2bbedc6a", "value": "Poseidon (OS X)" }, { "description": "macOS infostealer sold by an individual named Rodrigo4, currently consisting of a disk image containing a Mach-O without app bundle, which when executed spawns osascript executing an AppleScript with the actual infostealer payload. The AppleScript payload will steal files by packing them in a ZIP archive and uploading them to a hardcoded C2 via HTTP.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.poseidonstealer", "https://redcanary.com/blog/threat-intelligence/atomic-odyssey-poseidon-stealers/", "https://www.ncsc.admin.ch/ncsc/en/home/aktuell/im-fokus/2024/poseidon_bericht.html", "https://www.malwarebytes.com/blog/news/2024/06/poseidon-mac-stealer-distributed-via-google-ads", "https://github.com/govcert-ch/CTI/tree/main/20240627_macOS_PoseidonStealer" ], "synonyms": [ "Rodrigo Stealer" ], "type": [] }, "uuid": "9eb9f899-acfb-4452-981f-5937aa1f47cc", "value": "Poseidon Stealer" }, { "description": "Proton RAT is a Remote Access Trojan (RAT) specifically designed for macOS systems. It is known for providing attackers with complete remote control over the infected system, allowing the execution of commands, keystroke capturing, access to the camera and microphone, and the ability to steal credentials stored in browsers and other password managers. This malware typically spreads through malicious or modified applications, which, when downloaded and installed by unsuspecting users, trigger its payload. Proton RAT is notorious for its sophistication and evasion capabilities, including techniques to bypass detection by installed security solutions.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.proton_rat", "https://www.hackread.com/hackers-selling-undetectable-proton-mac-malware/", "https://objective-see.com/blog/blog_0x1F.html", "https://www.cybersixgill.com/wp-content/uploads/2017/02/02072017%20-%20Proton%20-%20A%20New%20MAC%20OS%20RAT%20-%20Sixgill%20Threat%20Report.pdf", "https://securelist.com/calisto-trojan-for-macos/86543/", "https://threatpost.com/handbrake-for-mac-compromised-with-proton-spyware/125518/", "https://blog.malwarebytes.com/threat-analysis/mac-threat-analysis/2017/11/osx-proton-spreading-through-fake-symantec-blog/", "https://objective-see.com/blog/blog_0x1D.html", "https://www.cybereason.com/labs-blog/labs-proton-b-what-this-mac-malware-actually-does", "https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/" ], "synonyms": [ "Calisto" ], "type": [] }, "uuid": "d7e31f19-8bf2-4def-8761-6c5bf7feaa44", "value": "Proton RAT" }, { "description": "According to SentinelOne, this is an infostealer, targeting among other things the encrypted database of Zoom.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.pureland", "https://www.sentinelone.com/blog/session-cookies-keychains-ssh-keys-and-more-7-kinds-of-data-malware-steals-from-macos-users/" ], "synonyms": [], "type": [] }, "uuid": "ffacfa02-47f5-4287-a700-243e3d4f8d6d", "value": "Pureland" }, { "description": "Cryptocurrency miner that was distributed masquerading as a Counter-Strike: Global Offensive hack.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.pwnet", "https://sentinelone.com/blog/osx-pwnet-a-csgo-hack-and-sneaky-miner/" ], "synonyms": [], "type": [] }, "uuid": "70059ec2-9315-4af7-b65b-2ec35676a7bb", "value": "Pwnet" }, { "description": "Dok a.k.a. Retefe is the macOS version of the banking trojan Retefe. It consists of a codesigned Mach-O dropper usually malspammed in an app bundle within a DMG disk image, posing as a document. The primary purpose of the dropper is to install a Tor client as well as a malicious CA certificate and proxy pac URL, in order to redirect traffic to targeted sites through their Tor node, effectively carrying out a MITM attack against selected web traffic. It also installs a custom hosts file to prevent access to Apple and VirusTotal. The macOS version shares its MO, many TTPs and infrastructure with the Windows counterpart.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.retefe", "https://www.proofpoint.com/us/threat-insight/post/2019-return-retefe", "https://blog.checkpoint.com/2017/07/13/osxdok-refuses-go-away-money/", "https://www.govcert.admin.ch/blog/33/the-retefe-saga", "http://blog.checkpoint.com/2017/04/27/osx-malware-catching-wants-read-https-traffic/" ], "synonyms": [ "Retefe" ], "type": [] }, "uuid": "80acc956-d418-42e3-bddf-078695a01289", "value": "Dok" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.rustbucket", "https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/", "https://securelist.com/bluenoroff-new-macos-malware/111290/", "https://www.sentinelone.com/blog/dprk-crypto-theft-macos-rustbucket-droppers-pivot-to-deliver-kandykorn-payloads/", "https://blogs.jpcert.or.jp/ja/2023/05/dangerouspassword.html", "https://www.sentinelone.com/blog/bluenoroff-how-dprks-macos-rustbucket-seeks-to-evade-analysis-and-detection/", "https://sansorg.egnyte.com/dl/3P3HxFiNgL", "https://www.elastic.co/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket" ], "synonyms": [], "type": [] }, "uuid": "03f356e6-296f-4195-bed0-9719a84887db", "value": "RustBucket (OS X)" }, { "description": "According to PCrisk, Shlayer is a trojan-type virus designed to proliferate various adware and other unwanted applications, and promote fake search engines. It is typically disguised as a Adobe Flash Player installer and various software cracking tools.\r\n\r\nIn most cases, users encounter this virus when visiting dubious Torrent websites that are full of intrusive advertisements and deceptive downloads.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.shlayer", "https://us-cert.cisa.gov/ncas/alerts/aa20-345a", "https://www.crowdstrike.com/blog/how-crowdstrike-analyzes-macos-malware-to-optimize-automated-detection-capabilities", "https://cedowens.medium.com/macos-gatekeeper-bypass-2021-edition-5256a2955508", "https://www.crowdstrike.com/blog/shlayer-malvertising-campaigns-still-using-flash-update-disguise/", "https://www.jamf.com/blog/shlayer-malware-abusing-gatekeeper-bypass-on-macos/", "https://securelist.com/shlayer-for-macos/95724/", "https://objective-see.com/blog/blog_0x64.html", "https://threatpost.com/shlayer-mac-youtube-wikipedia/152146/", "https://www.cisecurity.org/insights/blog/top-10-malware-march-2022", "https://resource.redcanary.com/rs/003-YRU-314/images/2021-Threat-Detection-Report.pdf" ], "synonyms": [], "type": [] }, "uuid": "c3ee82df-a004-4c68-89bd-eb4bb2dfc803", "value": "Shlayer" }, { "description": "According to Red Canary, Silver Sparrow is an activity cluster that includes a binary compiled to run on Apple\u2019s new M1 chips but has been distributed without payload so far.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.silver_sparrow", "https://resource.redcanary.com/rs/003-YRU-314/images/2022_ThreatDetectionReport_RedCanary.pdf", "https://redcanary.com/blog/clipping-silver-sparrows-wings/#technical-analysis" ], "synonyms": [], "type": [] }, "uuid": "f6a7aeeb-fcc5-4d26-9eab-c0b6e2819a6c", "value": "Silver Sparrow" }, { "description": "SimpleTea is a RAT for macOS that is based on the same object-oriented project as SimpleTea for Linux (SimplexTea).\r\n\r\nIt also shares similarities with POOLRAT (also known as SIMPLESEA), like the supported commands or a single-byte XOR encryption of its configuration. However, the indices of commands are different.\r\n\r\nSimpleTea for macOS was uploaded to VirusTotal from Hong Kong and China in September 2023.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.simpletea", "https://mp.weixin.qq.com/s?__biz=MzUyMjk4NzExMA%3D%3D&mid=2247499462&idx=1&sn=7cc55f3cc2740e8818648efbec21615f", "https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q2-2023-q3-2023.pdf" ], "synonyms": [], "type": [] }, "uuid": "ce384804-8580-4d57-97b3-bde0d903f703", "value": "SimpleTea (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.spectral_blur", "https://twitter.com/greglesnewich/status/1742575613834084684" ], "synonyms": [], "type": [] }, "uuid": "c7c32006-a2d1-4bc2-8a25-84c07286464a", "value": "SpectralBlur (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.sugarloader", "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering", "https://www.virusbulletin.com/uploads/pdf/conference/vb2024/papers/Sugarcoating-KANDYKORN-a-sweet-dive-into-a-sophisticated-MacOS-backdoor.pdf", "https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn", "https://www.sentinelone.com/blog/dprk-crypto-theft-macos-rustbucket-droppers-pivot-to-deliver-kandykorn-payloads/" ], "synonyms": [], "type": [] }, "uuid": "171501fd-d504-4257-9c3d-fbc066d6eeba", "value": "SUGARLOADER" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.sysjoker", "https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/", "https://www.sentinelone.com/blog/sneaky-spies-and-backdoor-rats-sysjoker-and-dazzlespy-malware-target-macos/", "https://www.bleepingcomputer.com/news/security/new-sysjoker-backdoor-targets-windows-macos-and-linux/", "https://blogs.vmware.com/security/2022/03/%e2%80%afsysjoker-an-analysis-of-a-multi-os-rat.html" ], "synonyms": [], "type": [] }, "uuid": "5bffe0fe-22f6-4d18-9372-f8c5d262d852", "value": "SysJoker (OS X)" }, { "description": "General purpose backdoor", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.systemd", "https://securelist.com/windealer-dealing-on-the-side/105946/", "https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_301_shui-leon_en.pdf", "https://vms.drweb.com/virus/?_is=1&i=15299312&lng=en" ], "synonyms": [ "Demsty", "ReverseWindow" ], "type": [] }, "uuid": "a8e7687b-9db7-4606-ba81-320d36099e3a", "value": "systemd" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.tsunami", "https://www.intego.com/mac-security-blog/tsunami-backdoor-can-be-used-for-denial-of-service-attacks" ], "synonyms": [], "type": [] }, "uuid": "59d4a2f3-c66e-4576-80ab-e04a4b0a4317", "value": "Tsunami (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.unidentified_001", "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048c", "https://securelist.com/operation-applejeus-sequel/95596/", "https://objective-see.com/blog/blog_0x51.html", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-north-korea-indictment" ], "synonyms": [], "type": [] }, "uuid": "1c96f6b9-6b78-4137-9d5f-aa5575f80daa", "value": "Unidentified macOS 001 (UnionCryptoTrader)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.update_agent", "https://www.esentire.com/blog/updateagent-macos-malware", "https://www.jamf.com/blog/updateagent-adapts-again/", "https://twitter.com/sysopfb/status/1532442456343691273", "https://www.microsoft.com/security/blog/2022/02/02/the-evolution-of-a-mac-trojan-updateagents-progression/" ], "synonyms": [], "type": [] }, "uuid": "1f1bc885-5987-41fa-bb04-8775eeb45d88", "value": "UpdateAgent" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.uroburos", "https://blog.malwarebytes.com/threat-analysis/2017/05/snake-malware-ported-windows-mac/", "https://blog.fox-it.com/2017/05/03/snake-coming-soon-in-mac-os-x-flavour/" ], "synonyms": [], "type": [] }, "uuid": "13173d75-45f0-4183-8e18-554a5781405c", "value": "Uroburos (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.vigram", "https://www.sentinelone.com/labs/the-art-and-science-of-macos-malware-hunting-with-radare2-leveraging-xrefs-yara-and-zignatures/", "https://twitter.com/MsftSecIntel/status/1451279679059488773", "https://twitter.com/ConfiantIntel/status/1351559054565535745" ], "synonyms": [ "WizardUpdate" ], "type": [] }, "uuid": "021e2fb4-1744-4fde-8d59-b247f1b34062", "value": "Vigram" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.watchcat", "https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/", "https://objective-see.com/blog/blog_0x5F.html" ], "synonyms": [], "type": [] }, "uuid": "a73468d5-2dee-4828-8bbb-c37ea9295584", "value": "WatchCat" }, { "description": "According to Mandiant, WAVESHAPER is a backdoor written in C++ and packed by an unknown packer that targets macOS. The backdoor supports downloading and executing arbitrary payloads retrieved from its command-and-control (C2 or C&C) server, which is provided via the command-line parameters. To communicate with the adversary infrastructure, WAVESHAPER leverages the curl library for either HTTP or HTTPS, depending on the command-line argument provided.\r\nWAVESHAPER also runs as a daemon by forking itself into a child process that runs in the background detached from the parent session and collects system information, which is sent to the C&C server in a HTTP POST request.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.waveshaper", "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering", "https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q4-2025-q1-2026.pdf", "https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package" ], "synonyms": [ "osx.curlyveiltea" ], "type": [] }, "uuid": "b2d8cd83-4bd4-4d79-80fb-bdb43875aa84", "value": "WAVESHAPER" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.windtail", "https://objective-see.com/blog/blog_0x3B.html", "https://www.virusbulletin.com/virusbulletin/2020/04/vb2019-paper-cyber-espionage-middle-east-unravelling-osxwindtail/", "https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1554718868.pdf", "https://objective-see.com/blog/blog_0x3D.html", "https://posts.specterops.io/introducing-venator-a-macos-tool-for-proactive-detection-34055a017e56", "https://www.forbes.com/sites/thomasbrewster/2018/08/30/apple-mac-loophole-breached-in-middle-east-hacks/", "https://gsec.hitb.org/materials/sg2018/D1%20COMMSEC%20-%20In%20the%20Trails%20of%20WINDSHIFT%20APT%20-%20Taha%20Karim.pdf" ], "synonyms": [], "type": [] }, "uuid": "48751182-0b17-4326-8a72-41e4c4be35e7", "value": "WindTail" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.winnti", "https://401trg.pw/winnti-evolution-going-open-source/" ], "synonyms": [], "type": [] }, "uuid": "5aede44b-1a30-4062-bb97-ac9f4985ddb6", "value": "Winnti (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.wirelurker", "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf", "https://objective-see.com/blog/blog_0x16.html" ], "synonyms": [], "type": [] }, "uuid": "bc32df24-8e80-44bc-80b0-6a4d55661aa5", "value": "WireLurker (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.wirenet", "https://news.drweb.com/show/?i=2679&lng=en&c=14", "https://objective-see.com/blog/blog_0x43.html", "http://contagiodump.blogspot.com/2012/12/aug-2012-backdoorwirenet-osx-and-linux.html" ], "synonyms": [], "type": [] }, "uuid": "f99ef0dc-9e96-42e0-bbfe-3616b3786629", "value": "Wirenet (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.xagent", "https://twitter.com/PhysicalDrive0/status/845009226388918273", "https://www.secureworks.com/research/threat-profiles/iron-twilight", "http://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/", "https://download.bitdefender.com/resources/files/News/CaseStudies/study/143/Bitdefender-Whitepaper-APT-Mac-A4-en-EN-web.pdf" ], "synonyms": [], "type": [] }, "uuid": "858f4396-8bc9-4df8-9370-490bbb3b4535", "value": "X-Agent (OS X)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset", "https://www.crowdstrike.com/blog/how-crowdstrike-analyzes-macos-malware-to-optimize-automated-detection-capabilities", "https://www.trendmicro.com/en_us/research/21/g/updated-xcsset-malware-targets-telegram--other-apps.html", "https://blog.trendmicro.com/trendlabs-security-intelligence/xcsset-mac-malware-infects-xcode-projects-performs-uxss-attack-on-safari-other-browsers-leverages-zero-day-exploits/", "https://www.trendmicro.com/en_us/research/21/d/xcsset-quickly-adapts-to-macos-11-and-m1-based-macs.html", "https://securelist.com/malware-for-the-new-apple-silicon-platform/101137/", "https://www.jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware/", "https://objective-see.com/blog/blog_0x5F.html", "https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf" ], "synonyms": [], "type": [] }, "uuid": "041aee7f-cb7a-4199-9fe5-494801a18273", "value": "XCSSET" }, { "description": "Xloader is a Rebranding of Formbook malware (mainly a stealer), available for macOS as well.\r\n\r\nFormbook has a \"magic\"-value FBNG (FormBook-NG), while Xloader has a \"magic\"-value XLNG (XLoader-NG). This \"magic\"-value XLNG is platform-independent.\r\n\r\n\r\nNot to be confused with apk.xloader or ios.xloader.\r\n", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.xloader", "https://twitter.com/krabsonsecurity/status/1319463908952969216", "https://malwarebookreports.com/cross-platform-java-dropper-snake-and-xloader-mac-version/", "https://www.zscaler.com/blogs/security-research/technical-analysis-xloader-versions-6-and-7-part-1", "https://research.checkpoint.com/2022/xloader-botnet-find-me-if-you-can/", "https://cip.gov.ua/en/news/khto-stoyit-za-kiberatakami-na-ukrayinsku-kritichnu-informaciinu-infrastrukturu-statistika-15-22-bereznya", "https://medium.com/@mk7912/from-xloader-to-phantom-stealer-a-dhl-themed-multi-stage-infection-chain-5d552eee828d", "https://blogs.blackberry.com/en/2021/09/threat-thursday-xloader-infostealer", "https://research.checkpoint.com/2021/top-prevalent-malware-with-a-thousand-campaigns-migrates-to-macos/", "https://www.sentinelone.com/blog/xloaders-latest-trick-new-macos-variant-disguised-as-signed-officenote-app/", "https://www.zynap.com/blog/defensive-rootkits-engineering-kernel-level-malware-analysis-ring-0/", "https://www.zscaler.com/blogs/security-research/analysis-xloaders-c2-network-encryption", "https://sublime.security/blog/xloader-deep-dive-link-based-malware-delivery-via-sharepoint-impersonation/", "https://www.vmray.com/cyber-security-blog/malware-analysis-spotlight-xbinder-xloader/", "https://research.checkpoint.com/2021/time-proven-tricks-in-a-new-environment-the-macos-evolution-of-formbook/", "https://medium.com/@shaddy43/layers-of-deception-analyzing-the-complex-stages-of-xloader-4-3-malware-evolution-2dcb550b98d9", "https://www.youtube.com/watch?v=C_ykTv50M1U", "https://blog.malwarebytes.com/mac/2021/07/osx-xloader-hides-little-except-its-main-purpose-what-we-learned-in-the-installation-process/", "https://www.zscaler.com/blogs/security-research/technical-analysis-xloader-versions-6-and-7-part-2", "https://www.lac.co.jp/lacwatch/report/20220307_002893.html", "https://www.sentinelone.com/blog/detecting-xloader-a-macos-malware-as-a-service-info-stealer-and-keylogger/" ], "synonyms": [ "Formbook" ], "type": [] }, "uuid": "d5f2f6ad-2ed0-42d4-9116-f95eea2ab543", "value": "Xloader" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.xslcmd", "https://www.fireeye.com/blog/threat-research/2014/09/forced-to-adapt-xslcmd-backdoor-now-on-os-x.html", "https://objective-see.com/blog/blog_0x16.html" ], "synonyms": [], "type": [] }, "uuid": "120a5890-dc3e-42e8-950e-b5ff9a849d2a", "value": "XSLCmd" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.yort", "https://securelist.com/cryptocurrency-businesses-still-being-targeted-by-lazarus/90019/", "https://objective-see.com/blog/blog_0x53.html" ], "synonyms": [], "type": [] }, "uuid": "725cd3eb-1025-4da3-bcb1-a7b6591c632b", "value": "Yort" }, { "description": "A malware that was observed being embedded alongside legitimate applications (such as iTerm2) offered for download on suspicious websites pushed in search engines. It uses a Python script to perform reconnaissance on the compromised system an pulls additional payload(s).", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.zuru", "https://www.trendmicro.com/en_us/research/21/i/mac-users-targeted-by-trojanized-iterm2-app.html", "https://objective-see.com/blog/blog_0x66.html" ], "synonyms": [], "type": [] }, "uuid": "bd293592-d2dd-4fdd-88e7-6098e0bbb043", "value": "ZuRu" }, { "description": "Ani-Shell is a simple PHP shell with some unique features like Mass Mailer, a simple Web-Server Fuzzer, Dosser, Back Connect, Bind Shell, Back Connect, Auto Rooter etc.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/php.anishell", "https://github.com/tennc/webshell/tree/master/php/Ani-Shell", "http://ani-shell.sourceforge.net/" ], "synonyms": [ "anishell" ], "type": [] }, "uuid": "7ef3c0fd-8736-47b1-8ced-ca7bf6d27471", "value": "Ani-Shell" }, { "description": "Antak is a webshell written in ASP.Net which utilizes PowerShell.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/php.antak", "http://www.labofapenetrationtester.com/2014/06/introducing-antak.html", "https://github.com/samratashok/nishang/blob/master/Antak-WebShell/antak.aspx", "https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf" ], "synonyms": [], "type": [] }, "uuid": "88a71ca8-d99f-416a-ad29-5af12212008c", "value": "ANTAK" }, { "description": "ASPXSpy is an open-source web shell written in C# that allows a threat actor to accomplish various post-exploitation tasks, including file access and command execution.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/php.aspxspy", "https://attack.mitre.org/groups/G0096", "https://go.recordedfuture.com/hubfs/reports/mtp-2021-1214.pdf", "https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/", "https://www.recordedfuture.com/full-spectrum-detections-five-popular-web-shells", "https://asec.ahnlab.com/en/47455/" ], "synonyms": [], "type": [] }, "uuid": "4d1c01be-76ad-42dd-b094-7a8dbaf02159", "value": "ASPXSpy" }, { "description": "A webshell for multiple web languages (asp/aspx, jsp/jspx, php), openly distributed through Github.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/php.behinder", "https://www.elastic.co/security-labs/ref2924-howto-maintain-persistence-as-an-advanced-threat", "https://blog.gigamon.com/2022/09/28/investigating-web-shells/", "https://github.com/hktalent/MyDocs/blob/main/BehinderShell.md", "https://cyberandramen.net/2022/02/18/a-tale-of-two-shells/", "https://harfanglab.io/insidethelab/insights-ivanti-csa-exploitation/" ], "synonyms": [], "type": [] }, "uuid": "5e5cd3a6-0348-4c6b-94b1-13ca0d845547", "value": "Behinder" }, { "description": "C99shell is a PHP backdoor that provides a lot of functionality, for example:\r\n\r\n\r\n* run shell commands;\r\n* download/upload files from and to the server (FTP functionality);\r\n* full access to all files on the hard disk;\r\n* self-delete functionality.\r\n\r\n", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/php.c99", "https://bartblaze.blogspot.com/2015/03/c99shell-not-dead.html" ], "synonyms": [ "c99" ], "type": [] }, "uuid": "cd1b8ec2-dbbd-4e73-b9a7-1bd1287a68f2", "value": "c99shell" }, { "description": "FireEye discovered the DEWMODE webshell starting mid-December 2020 after exploitation of zero-day vulnerabilities in Accellion's File Transfer Appliance. It is a PHP webshell that allows threat actors to view and download files in the victim machine. It also contains cleanup function to remove itself and clean the Apache log.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/php.dewmode", "https://go.recordedfuture.com/hubfs/reports/mtp-2021-0312.pdf", "https://www.accellion.com/sites/default/files/trust-center/accellion-fta-attack-mandiant-report-full.pdf", "https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html", "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-055a" ], "synonyms": [], "type": [] }, "uuid": "a782aac8-168d-4691-a182-237d7d473e21", "value": "DEWMODE" }, { "description": "PHP/JavaScript malware for WordPress that injects multi-stage scripts, turning compromised sites into distributed TDS/C2 nodes. Delivers signed payloads, maintains persistence via helper files, and redirects traffic to monetized scam networks.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/php.dollyway", "https://www.godaddy.com/resources/news/dollyway-malware-c2-tds", "https://blogs.infoblox.com/threat-intelligence/vexing-and-vicious-the-eerie-relationship-between-wordpress-hackers-and-an-adtech-cabal/", "https://www.godaddy.com/resources/news/dollyway-world-domination" ], "synonyms": [], "type": [] }, "uuid": "13674aff-3746-4c5b-827f-ea2779874942", "value": "DollyWay" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/php.ensikology", "https://blog.trendmicro.com/trendlabs-security-intelligence/ensiko-a-webshell-with-ransomware-capabilities/" ], "synonyms": [ "Ensiko" ], "type": [] }, "uuid": "dfd8deac-ce86-4a22-b462-041c19d62506", "value": "Ensikology" }, { "description": "According to Xlab, Glutton is a modular PHP fileless attack framework, capable of data exfiltration and running backdoors.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/php.glutton", "https://blog.xlab.qianxin.com/glutton_stealthily_targets_mainstream_php_frameworks-en/" ], "synonyms": [], "type": [] }, "uuid": "2e55f9ec-2fce-401b-81fe-e98692a97eb6", "value": "Glutton" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/php.p0wnyshell", "https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/" ], "synonyms": [ "Ponyshell", "Pownyshell" ], "type": [] }, "uuid": "a6d13ffe-1b1a-46fe-afd9-989e8dec3773", "value": "p0wnyshell" }, { "description": "In combination with Parrot TDS the usage of a classical web shell was observed by DECODED Avast.io.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/php.parrot_tds_shell", "https://unit42.paloaltonetworks.com/parrot-tds-javascript-evolution-analysis/", "https://www.silentpush.com/blog/socgholish/", "https://decoded.avast.io/janrubin/parrot-tds-takes-over-web-servers-and-threatens-millions/" ], "synonyms": [], "type": [] }, "uuid": "c9e7c5a6-9082-47ec-89eb-477980e73dcb", "value": "Parrot TDS WebShell" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/php.pas", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf", "https://securelist.com/apt-trends-report-q1-2021/101967/", "https://blog.erratasec.com/2016/12/some-notes-on-iocs.html", "https://www.domaintools.com/resources/blog/centreon-to-exim-and-back-on-the-trail-of-sandworm", "https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity" ], "synonyms": [], "type": [] }, "uuid": "e6a40fa2-f79f-40e9-89d3-a56984bc51f7", "value": "PAS" }, { "description": "Backdoor written in php", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/php.prometheus_backdoor", "https://blog.group-ib.com/prometheus-tds", "https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus" ], "synonyms": [], "type": [] }, "uuid": "b4007b02-106d-420f-af1c-76c035843fd2", "value": "Prometheus Backdoor" }, { "description": "According to Cisco Talos, this is multi-stage malware framework, implemented in PowerShell and C#, that possesses robust functionality, including the ability to deliver follow-on modules including an information stealer, keylogger, screen capture collector and more. It also establishes persistence to continue operations following system reboots. The design of this malware framework appears to attempt to minimize artifacts left on infected systems by facilitating the delivery and execution of modules in-memory, without requiring them to be written to disk. Due to similarities in the design and implementation with the malware family AHK Bot, we are referring to this PowerShell-based malware as \u201cPS1Bot.\u201d", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/php.ps1bot", "https://blog.talosintelligence.com/ps1bot-malvertising-campaign/" ], "synonyms": [ "Bossnet" ], "type": [] }, "uuid": "188c4fae-bd59-4470-81b9-63dba44c7986", "value": "PS1Bot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/php.redhat_hacker", "https://github.com/xl7dev/WebShell/blob/master/Asp/RedHat%20Hacker.asp" ], "synonyms": [], "type": [] }, "uuid": "e94a5b44-f2c2-41dc-8abb-6de69eb38241", "value": "RedHat Hacker WebShell" }, { "description": "A PHP webshell that allows file system management, data exfiltration and command execution.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/php.shin_webshell", "https://github.com/Jenderal92/KC5" ], "synonyms": [], "type": [] }, "uuid": "cbf8e4b6-2555-447d-a37e-ff407668b311", "value": "php.shin_webshell" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/php.wso", "https://www.mandiant.com/resources/cloud-metadata-abuse-unc2903", "https://www.aquasec.com/blog/loony-tunables-vulnerability-exploited-by-kinsing/", "https://securelist.com/energetic-bear-crouching-yeti/85345/" ], "synonyms": [ "Webshell by Orb" ], "type": [] }, "uuid": "7f3794fc-662e-4dde-b793-49bcaccc96f7", "value": "WSO" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/pl.silence_ddos", "https://www.group-ib.com/resources/threat-research/silence.html" ], "synonyms": [], "type": [] }, "uuid": "b5cc7a39-305b-487e-b15a-02dcebefce90", "value": "Silence DDoS" }, { "description": "According to Trend Micro, Banana RAT is a Brazilian banking trojan linked to SHADOW-WATER-063. It employs a fileless, PowerShell-based client that runs in memory, with a polymorphic, AES-wrapped payload delivery pipeline and multiple obfuscation layers to evade detection. Once active, it provides remote fraud capabilities, including screen capture, remote input control, keylogging, overlays that mimic banking interfaces, and a Pix QR interception subsystem to manipulate payments. The operation targets Brazilian financial institutions, uses Brazilian Portuguese artifacts, and appears to operate as a malware-as-a-service style platform with per-victim builds to complicate detection.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.banana_rat", "https://www.trendmicro.com/en_us/research/26/e/banana-rat.html" ], "synonyms": [], "type": [] }, "uuid": "009f83f6-b3fe-4093-a698-f6bce130dff5", "value": "Banana RAT" }, { "description": "Ransomware.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.blacksun", "https://blogs.vmware.com/security/2022/01/blacksun-ransomware-the-dark-side-of-powershell.html" ], "synonyms": [], "type": [] }, "uuid": "1fcc4425-6e14-47e6-8434-745cf1bc9982", "value": "BlackSun" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.bondupdater", "https://blog.0day.rocks/hacking-back-and-influence-operations-85cd52c1e933", "https://www.secureworks.com/research/threat-profiles/cobalt-gypsy", "https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/", "https://nsfocusglobal.com/apt34-event-analysis-report/", "https://www.netscout.com/blog/asert/tunneling-under-sands", "https://marcoramilli.com/2019/05/02/apt34-glimpse-project/", "https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf", "https://unit42.paloaltonetworks.com/behind-the-scenes-with-oilrig/", "https://ironnet.com/blog/chirp-of-the-poisonfrog/", "https://www.boozallen.com/s/insight/blog/dark-labs-discovers-apt34-malware-variants.html?cid=spo-csatb-2", "https://cyware.com/blog/apt34-the-helix-kitten-cybercriminal-group-loves-to-meow-middle-eastern-and-international-organizations-48ae", "https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/", "https://www.zdnet.com/article/source-code-of-iranian-cyber-espionage-tools-leaked-on-telegram/" ], "synonyms": [ "Glimpse", "Poison Frog" ], "type": [] }, "uuid": "99600ba5-30a0-4ac8-8583-6288760b77c3", "value": "BONDUPDATER" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.cashy200", "https://unit42.paloaltonetworks.com/atoms/hunter-serpens/", "https://unit42.paloaltonetworks.com/more-xhunt-new-powershell-backdoor-blocked-through-dns-tunnel-detection/" ], "synonyms": [], "type": [] }, "uuid": "7373c789-2dc2-4867-9c60-fa68f8d971a2", "value": "CASHY200" }, { "description": "According to Microsoft Threat Intelligence, ChocoShell is a PowerShell-based information stealer delivered and executed entirely in memory, with the primary objective of harvesting browser session cookies, saved passwords, Microsoft 365 SSO tokens, and Wi-Fi credentials from compromised systems. It was authored with developer comments suggesting AI-assisted code generation and performs defense evasion by disabling AMSI via .NET reflection and exiting silently when virtual machine or sandbox conditions are detected. To enable its most impactful capabilities it implements several ordered silent UAC bypass techniques with fallback to a visible prompt, and impersonates a SYSTEM process token to access browser encryption keys, while also using the Chrome DevTools Protocol to extract plaintext cookies and collecting cloud tokens and Wi-Fi profiles. Collected data is aggregated into a JSON structure, GZip-compressed and Base64-encoded, then exfiltrated over an encrypted HTTPS channel to the actor's C2 server before the script cleans up artifacts and removes its temporary elevation registry keys.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.choco_shell", "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" ], "synonyms": [], "type": [] }, "uuid": "51d02d55-4c67-42e8-b1cc-3c1ed88a0591", "value": "ChocoShell" }, { "description": "According to CERT-UA, COOKBOX is a PowerShell script that implements the functionality of downloading and executing PowerShell cmdlets. For each affected computer, a unique identifier is calculated using cryptographic transformations (SHA256/MD5 hash functions) based on a combination of computer name and disk serial number, which is transmitted in the \u201cX-Cookie\u201d header of HTTP requests when interacting with the management server. The persistence of the backdoor is ensured by the corresponding key in the Run branch of the operating system (OS) registry, which is created at the stage of the initial infection by a third-party PowerShell script (including the COOKBOX deployer). As a rule, obfuscation elements are used in the program code: chr-character encoding, character replacement (replace()), base64 conversion, GZIP compression.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.cookbox", "https://cert.gov.ua/article/6278620", "https://cert.gov.ua/article/6277849", "https://socprime.com/blog/uac-0149-attack-detection-hackers-launch-a-targeted-attack-against-the-armed-forces-of-ukraine-as-cert-ua-reports/", "https://www.cloudflare.com/threat-intelligence/research/report/disrupting-flyingyetis-campaign-targeting-ukrainev/" ], "synonyms": [], "type": [] }, "uuid": "63d51443-e4db-40b7-ba51-efc330c7a6ee", "value": "COOKBOX" }, { "description": "According to Trend Micro, DarkWisp is a PowerShell-based backdoor and reconnaissance utility designed for unauthorized system access and intelligence gathering. It enables attackers to exfiltrate sensitive data while maintaining persistent control over the compromised system. The malware collects extensive information about the compromised system to create a detailed profile. It determines whether the user has administrative privileges, checks for membership in a corporate domain, and identifies the presence of cryptocurrency wallets or VPN software by scanning specified directories and applications. It also gathers data about the system's operating environment, including public IP address, geographic location, installed antivirus products, firewall status, and system uptime. This information is compiled into a structured format and transmitted to the C&C server.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.dark_wisp", "https://www.trendmicro.com/en_us/research/25/c/deep-dive-into-water-gamayun.html" ], "synonyms": [], "type": [] }, "uuid": "66f938aa-68b2-4ba4-b44b-a9dde74aca93", "value": "DarkWisp" }, { "description": "A loader written in Powershell, usually delivered packaged in MSI/MSIX files.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.eugenloader", "https://www.googlecloudcommunity.com/gc/Community-Blog/Finding-Malware-Unveiling-NUMOZYLOD-with-Google-Security/ba-p/789551", "https://esentire-dot-com-assets.s3.amazonaws.com/assets/resourcefiles/eSentire-Unraveling_BatLoader_and_FakeBat.pdf", "https://www.recordedfuture.com/research/grayalpha-uses-diverse-infection-vectors-deploy-powernet-loader-netsupport-rat", "https://www.intrinsec.com/wp-content/uploads/2024/11/TLP-CLEAR-PROSPERO-Proton66-Uncovering-the-links-between-bulletproof-networks.pdf", "https://intel471.com/blog/malvertising-surges-to-distribute-malware", "https://www.rewterz.com/rewterz-news/rewterz-threat-alert-widely-abused-msix-app-installer-disabled-by-microsoft-active-iocs", "https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/", "https://www.intrinsec.com/prospero-proton66-tracing-uncovering-the-links-between-bulletproof-networks/" ], "synonyms": [ "FakeBat", "NUMOZYLOD", "PaykLoader" ], "type": [] }, "uuid": "cf9c14cf-6246-4858-8bcc-5a943c8df715", "value": "EugenLoader" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.flowerpower", "https://vb2020.vblocalhost.com/uploads/VB2020-46.pdf", "https://www.genians.co.kr/en/blog/threat_intelligence/triple-combo", "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf", "https://www.youtube.com/watch?v=rfzmHjZX70s", "https://i.blackhat.com/asia-21/Friday-Handouts/as-21-Kuo-We-Are-About-To-Land-How-CloudDragon-Turns-A-Nightmare-Into-Reality.pdf", "https://vblocalhost.com/uploads/VB2020-46.pdf" ], "synonyms": [ "BoBoStealer" ], "type": [] }, "uuid": "6f0f034a-13f1-432d-bc70-f78d7f27f46f", "value": "FlowerPower" }, { "description": "Loader used to deliver FRat (see family windows.frat)", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.frat_loader", "https://github.com/jeFF0Falltrades/IoCs/blob/master/Broadbased/frat.md" ], "synonyms": [], "type": [] }, "uuid": "385a3dca-263d-46be-b84d-5dc09ee466d9", "value": "FRat Loader" }, { "description": "The malware ftcode is a ransomware which encrypts files and changes their extension into .FTCODE. It later asks for a ransom in order to release the decryption key, mandatory to recover your files. It is infamous for attacking Italy pretending to be a notorious telecom provider asking for due payments.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.ftcode", "https://www.certego.net/en/news/malware-tales-ftcode/", "https://www.zscaler.com/blogs/research/ftcode-ransomware--new-version-includes-stealing-capabilities", "https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Additional%20Analysis/Unknown/2020-06-22/Analysis.md", "https://blog.rootshell.be/2020/07/14/simple-dga-spotted-in-a-malicious-powershell/", "https://isc.sans.edu/diary/Powershell+Backdoor+with+DGA+Capability/29122", "https://nakedsecurity.sophos.com/2013/03/05/russian-ransomware-windows-powershell/", "https://dissectingmalwa.re/nicht-so-goot-breaking-down-gootkit-and-jasper-ftcode.html", "https://www.certego.net/en/news/ftdecryptor-a-simple-password-based-ftcode-decryptor/", "https://www.kpn.com/security-blogs/FTCODE-taking-over-a-portion-of-the-botnet.htm" ], "synonyms": [], "type": [] }, "uuid": "f727a05e-c1cd-4e95-b0bf-2a4bb64aa850", "value": "FTCODE" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.ghostminer", "https://blog.minerva-labs.com/ghostminer-cryptomining-malware-goes-fileless", "https://research.checkpoint.com/malware-against-the-c-monoculture/", "https://blog.trendmicro.com/trendlabs-security-intelligence/fileless-cryptocurrency-miner-ghostminer-weaponizes-wmi-objects-kills-other-cryptocurrency-mining-payloads/" ], "synonyms": [], "type": [] }, "uuid": "0db05333-2214-49c3-b469-927788932aaa", "value": "GhostMiner" }, { "description": "According to TRAC Labs, the GhostWeaver backdoor not only maintains continuous, authenticated communication with its command-and-control server but also includes functionalities to generate DGA domains (using a fixed-seed algorithm based on the week number and year), deliver additional payloads via remote commands and bypass certificate validation by leveraging a RemoteCertificateValidationCallback that always returns true. Multiple delivered plugins are designed to target sensitive information - including credentials from popular browsers (Brave, Chrome, Firefox, Edge), Outlook data, and cryptocurrency wallets. The Formgrabber plugin includes web injection methods by dynamically manipulating HTML content, modifying JA3 fingerprints via cipher suite reordering, and employing a man-in-the-middle proxy setup to intercept the traffic. GhostWeaver\u2019s and plugins\u2019 delivery on systems that are not part of an Active Directory domain suggests that attackers are extending their reach beyond typical corporate targets, aligning with a financially motivated agenda that exploits environments with weaker security controls.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.ghostweaver", "https://trac-labs.com/dont-ghost-the-socgholish-ghostweaver-backdoor-574154dd9983", "https://www.recordedfuture.com/research/uncovering-mintsloader-with-recorded-future-malware-intelligence-hunting" ], "synonyms": [], "type": [] }, "uuid": "8a3af7b5-6039-42ac-bd14-6d6b21e0e2ae", "value": "GhostWeaver" }, { "description": "The author describes this open source shell as follows. \r\nHTTP-Shell is Multiplatform Reverse Shell. This tool helps you to obtain a shell-like interface on a reverse connection over HTTP. Unlike other reverse shells, the main goal of the tool is to use it in conjunction with Microsoft Dev Tunnels, in order to get a connection as close as possible to a legitimate one.\r\n\r\nThis shell is not fully interactive, but displays any errors on screen (both Windows and Linux), is capable of uploading and downloading files, has command history, terminal cleanup (even with CTRL+L), automatic reconnection, movement between directories and supports sudo (or sudo su) on Linux-based OS.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.http_shell", "https://blog.cluster25.duskrise.com/2024/01/30/russian-apt-opposition", "https://github.com/JoelGMSec/HTTP-Shell" ], "synonyms": [], "type": [] }, "uuid": "50b94b67-dc2a-4953-a354-edf2cc4e17d3", "value": "HTTP-Shell" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.jasperloader", "https://dissectingmalwa.re/nicht-so-goot-breaking-down-gootkit-and-jasper-ftcode.html", "https://blog.talosintelligence.com/2019/04/jasperloader-targets-italy.html", "https://blog.threatstop.com/upgraded-jasperloader-infecting-machines", "https://blog.talosintelligence.com/2019/05/sorpresa-jasperloader.html" ], "synonyms": [], "type": [] }, "uuid": "286a14a1-7113-4bed-97ce-8db41b312a51", "value": "JasperLoader" }, { "description": "According to EclecticIQ, Kalambur is designed to gather local system information, then download a repackaged TOR binary inside a ZIP file and retrieve additional tools from what is likely an attacker-controlled TOR onion site.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.kalambur", "https://blog.eclecticiq.com/sandworm-apt-targets-ukrainian-users-with-trojanized-microsoft-kms-activation-tools-in-cyber-espionage-campaigns" ], "synonyms": [], "type": [] }, "uuid": "5823aa92-75d1-4fdc-adcb-ff6a4918b226", "value": "Kalambur" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.lazyscripter", "https://github.com/SrujanKumar-K/Blogpost/tree/main/LazyScripter" ], "synonyms": [], "type": [] }, "uuid": "74e5711e-b777-4f09-a4bc-db58d5e23e29", "value": "Lazyscripter" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.lazywiper", "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf" ], "synonyms": [], "type": [] }, "uuid": "bbb9c774-487d-4fb4-acac-92582f3e9acb", "value": "LazyWiper" }, { "description": "According to WithSecure, LegionRelay is a lightweight PowerShell-based RAT that talks to its C2 via REST API. The client executes operator-issued PowerShell commands and relies on post-compromise scripts to extend capabilities, including file enumeration, exfiltration, screenshots, browser data theft, and remote access like RDP setup. The tooling is part of GREYVIBE\u2019s broader loader/obfuscator ecosystem, with obfuscation and loader variants used to evolve the malware. Operators are Russian-speaking and Moscow-time aligned, indicating a Russia-nexus influence that coexists with wider cybercrime activity.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.legion_relay", "https://www.withsecure.com/en/resources-hub/w-labs/greyvibe/" ], "synonyms": [], "type": [] }, "uuid": "2164332a-2c76-4aea-bbf1-d46917a25353", "value": "LegionRelay" }, { "description": "According to Bleeping Computer and Vitali Kremez, LightBot is a compact reconnaissance tool suspected to be used to identify high-value targets for potential follow-up ransomware attacks.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.lightbot", "https://twitter.com/VK_Intel/status/1329511151202349057", "https://www.bleepingcomputer.com/news/security/lightbot-trickbot-s-new-reconnaissance-malware-for-high-value-targets/" ], "synonyms": [], "type": [] }, "uuid": "319c4b4f-2901-412c-8fa5-70be75ba51cb", "value": "LightBot" }, { "description": "According to ESET Research, this malware is used by LongNosedGoblin and executes a chain of obfuscated commands passed to a spawned PowerShell process as one long command line argument, meaning that the script is not stored on disk. Every subsequent stage is encoded with base64, where the last one is additionally deflated with gzip. The second stage bypasses AMSI. In this case, NosyDownloader uses Matt Graeber\u2019s reflection method and disabling script logging techniques made available on GitHub to bypass AMSI.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.nosy_downloader", "https://www.welivesecurity.com/en/eset-research/longnosedgoblin-tries-sniff-out-governmental-affairs-southeast-asia-japan/", "https://botcrawl.com/chinese-apt-longnosedgoblin-targets-government-networks-in-southeast-asia-and-japan/" ], "synonyms": [], "type": [] }, "uuid": "956aa23f-fa9d-4ec0-b57d-3268a609c470", "value": "NosyDownloader" }, { "description": "The author describes Octopus as an \"open source, pre-operation C2 server based on python which can control an Octopus powershell agent through HTTP/S.\"\r\n\r\nIt is different from the malware win.octopus written in Delphi and attributed to DustSquad by Kaspersky Labs.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.octopus", "https://isc.sans.edu/diary/rss/28628", "https://github.com/mhaskar/Octopus", "https://go.recordedfuture.com/hubfs/reports/cta-2021-0107.pdf", "https://resources.malwarebytes.com/files/2021/02/LazyScripter.pdf", "https://isc.sans.edu/diary/26918" ], "synonyms": [], "type": [] }, "uuid": "c3ca7a89-a885-444a-8642-31019b34b027", "value": "Octopus (Powershell)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.oilrig", "https://twitter.com/MJDutch/status/1074820959784321026?s=19", "https://www.vkremez.com/2018/03/investigating-iranian-threat-group.html", "https://threatpost.com/oilrig-apt-unique-backdoor/157646/" ], "synonyms": [], "type": [] }, "uuid": "4a3b9669-8f91-47df-a8bf-a9876ab8edf3", "value": "OilRig" }, { "description": "According to WithSecure, PhantomRelay is a PowerShell-based RAT developed under the GREYVIBE activity cluster. It uses a two-stage execution chain (fingerprinting first, then the main RAT loaded in memory) with C2 communications over WebSockets, and its design is modular to enable additional post-compromise payloads. The family includes several variants, such as PhantomRelayLite and PhantomRelayV1/V2, which feature progressive obfuscation and persistence enhancements. The operators are Russian-speaking and Moscow-time aligned, with the tooling observed across GREYVIBE-related campaigns and related cybercrime activity.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.phantom_relay", "https://www.withsecure.com/en/resources-hub/w-labs/greyvibe/" ], "synonyms": [], "type": [] }, "uuid": "b688bf50-0aae-4082-ae33-29029993b442", "value": "PhantomRelay" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.phonyc2", "https://circleid.com/posts/20230824-signs-of-muddywater-developments-found-in-the-dns", "https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater", "https://www.deepinstinct.com/blog/muddywater-en-able-spear-phishing-with-new-ttps", "https://www.deepinstinct.com/blog/muddyc2go-latest-c2-framework-used-by-iranian-apt-muddywater-spotted-in-israel" ], "synonyms": [], "type": [] }, "uuid": "c630e510-a0ad-405a-9aeb-9d8057b6a868", "value": "PhonyC2" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.poshspy", "https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html", "https://github.com/matthewdunwoody/POSHSPY" ], "synonyms": [], "type": [] }, "uuid": "4df1b257-c242-46b0-b120-591430066b6f", "value": "POSHSPY" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerbrace", "https://norfolkinfosec.com/osint-reporting-on-dprk-and-ta505-overlap/", "https://technical.nttsecurity.com/post/102fnog/targeted-trickbot-activity-drops-powerbrace-backdoor" ], "synonyms": [], "type": [] }, "uuid": "7b334343-0045-4d65-b28a-ebf912c7aafc", "value": "PowerBrace" }, { "description": "PowerHarbor is a modular PowerShell-based malware that consists of various modules. The primary module maintains constant communication with the C2 server, executing and deleting additional modules received from it. Currently, the communication with the C2 server is encrypted using RSA encryption and hardcoded key data. Moreover, the main module incorporates virtual machine (VM) detection capabilities. The StealData module employs the Invoke-Stealer function as its core, enabling the theft of system information, browser-stored credentials, cryptocurrency wallet details, and credentials for various applications like Telegram, FileZilla, and WinSCP.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerharbor", "https://insight-jp.nttsecurity.com/post/102ignh/steelcloverpowerharbor" ], "synonyms": [], "type": [] }, "uuid": "73b40a4c-9163-4a07-bf1b-e4a4344ac63a", "value": "PowerHarbor" }, { "description": "According to Insikt Group, PowerNet is a custom Powershell loader that decompresses and executes NetSupport RAT.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powernet", "https://go.recordedfuture.com/hubfs/reports/cta-2025-0613.pdf" ], "synonyms": [], "type": [] }, "uuid": "f43dee27-8484-4d4e-a981-2fa9c8a31010", "value": "PowerNet" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerpepper", "https://securelist.com/what-did-deathstalker-hide-between-two-ferns/99616/", "https://twitter.com/InQuest/status/1285295975347650562" ], "synonyms": [], "type": [] }, "uuid": "6544c75b-809f-4d31-a235-8906d4004828", "value": "PowerPepper" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerpipe", "https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf", "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html" ], "synonyms": [], "type": [] }, "uuid": "60d7f668-66b6-401b-976f-918470a23c3d", "value": "POWERPIPE" }, { "description": "This powershell code is a PowerShell written backdoor used by FIN7. Regarding to Mandiant that is was revealed to be a \"vast backdoor framework with a breadth of capabilities, depending on which modules are delivered from the C2 server.\"", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerplant", "https://www.mandiant.com/resources/evolution-of-fin7" ], "synonyms": [], "type": [] }, "uuid": "697626d3-04a1-4426-aeae-d7054c6e78fb", "value": "POWERPLANT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powershell_web_backdoor", "https://github.com/chrisjd20/powershell_web_backdoor" ], "synonyms": [], "type": [] }, "uuid": "4310dcab-0820-4bc1-8a0b-9691c20f5b49", "value": "powershell_web_backdoor" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powershortshell", "https://www.safebreach.com/blog/2021/new-powershortshell-stealer-exploits-recent-microsoft-mshtml-vulnerability-to-spy-on-farsi-speakers/" ], "synonyms": [], "type": [] }, "uuid": "f2198153-2d8b-49ed-b8a8-0952c289b8c0", "value": "PowerShortShell" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powershower", "https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability", "https://attack.mitre.org/groups/G0100/", "https://securelist.com/recent-cloud-atlas-activity/92016/", "https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/", "https://attack.mitre.org/groups/G0100", "https://unit42.paloaltonetworks.com/atoms/clean-ursa/", "https://securelist.com/recent-cloud-atlas-activity/92016", "https://unit42.paloaltonetworks.com/atoms/clean-ursa" ], "synonyms": [], "type": [] }, "uuid": "0959a02e-6eba-43dc-bbbf-b2c7488e9371", "value": "PowerShower" }, { "description": "POWERSOURCE is a heavily obfuscated and modified version of the publicly available tool DNS_TXT_Pwnage. The backdoor uses DNS TXT requests for command and control and is installed in the registry or Alternate Data Streams.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powersource", "https://cocomelonc.github.io/malware/2023/07/26/malware-tricks-35.html", "https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf", "https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html" ], "synonyms": [], "type": [] }, "uuid": "a4584181-f739-43d1-ade9-8a7aa21278a0", "value": "POWERSOURCE" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerspritz", "https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug.pdf" ], "synonyms": [], "type": [] }, "uuid": "c07f6484-0669-44b7-90e6-f642e316d277", "value": "PowerSpritz" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerstar", "https://www.volexity.com/blog/2023/06/28/charming-kitten-updates-powerstar-with-an-interplanetary-twist/" ], "synonyms": [], "type": [] }, "uuid": "60e11a7b-8452-4177-b709-99ef0976c296", "value": "POWERSTAR" }, { "description": "POWERSTATS is a backdoor written in powershell.\r\nIt has the ability to disable Microsoft Office Protected View, fingerprint the victim and receive commands.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerstats", "https://web.archive.org/web/20180807105755/https://www.sekoia.fr/blog/falling-on-muddywater/", "https://www.clearskysec.com/muddywater-operations-in-lebanon-and-oman/", "https://research.checkpoint.com/2019/the-muddy-waters-of-apt-attacks/", "https://mp.weixin.qq.com/s/NN_iRvwA6yOHFS9Z3A0RBA", "https://www.inforisktoday.com/muddywater-targets-critical-infrastructure-in-asia-europe-a-18611", "https://shells.systems/reviving-leaked-muddyc3-used-by-muddywater-apt/", "https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater", "https://www.clearskysec.com/muddywater-targets-kurdish-groups-turkish-orgs/", "https://www.secureworks.com/research/threat-profiles/cobalt-ulster", "https://blog.malwarebytes.com/threat-analysis/2017/09/elaborate-scripting-fu-used-in-espionage-attack-against-saudi-arabia-government_entity/", "https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/", "https://unit42.paloaltonetworks.com/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/", "https://sec0wn.blogspot.com/2018/03/a-quick-dip-into-muddywaters-recent.html", "https://www.cisa.gov/uscert/sites/default/files/publications/AA22-055A_Iranian_Government-Sponsored_Actors_Conduct_Cyber_Operations.pdf", "https://blog.prevailion.com/2020/01/summer-mirage.html", "https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf", "https://thehackernews.com/2022/02/irans-muddywater-hacker-group-using-new.html", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a", "https://securelist.com/apt-trends-report-q2-2019/91897/", "https://unit42.paloaltonetworks.com/atoms/boggyserpens/", "https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html", "https://marcoramilli.com/2020/01/15/iranian-threat-actors-preliminary-analysis/", "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a", "https://blog.trendmicro.com/trendlabs-security-intelligence/campaign-possibly-connected-muddywater-surfaces-middle-east-central-asia/", "https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/", "https://sec0wn.blogspot.com/2018/02/burping-on-muddywater.html", "http://www.secureworks.com/research/threat-profiles/cobalt-ulster", "https://sec0wn.blogspot.com/2018/05/clearing-muddywater-analysis-of-new.html", "https://sec0wn.blogspot.com/2017/10/continued-activity-targeting-middle-east.html", "https://www.group-ib.com/blog/muddywater/" ], "synonyms": [ "Valyria" ], "type": [] }, "uuid": "b81d91b5-23a4-4f86-aea9-3f212169fce9", "value": "POWERSTATS" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerton", "https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html", "https://blog.telsy.com/meeting-powerband-the-apt33-net-powerton-variant/", "https://www.symantec.com/security-center/writeup/2019-062513-4935-99", "https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/", "https://www.secureworks.com/research/threat-profiles/cobalt-trinity", "https://norfolkinfosec.com/apt33-powershell-malware/", "https://www.fireeye.com/blog/threat-research/2020/07/scandalous-external-detection-using-network-scan-data-and-automation.html" ], "synonyms": [], "type": [] }, "uuid": "08d5b8a4-e752-48f3-ac6d-944807146ce7", "value": "POWERTON" }, { "description": "This PowerShell written malware is an in-memory dropper used by FIN7 to execute the included/embedded payload. According to Mandiant's blog article: \"POWERTRASH is a uniquely obfuscated iteration of a shellcode invoker included in the PowerSploit framework available on GitHub.\"", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powertrash", "https://www.mandiant.com/resources/evolution-of-fin7", "https://www.recordedfuture.com/research/grayalpha-uses-diverse-infection-vectors-deploy-powernet-loader-netsupport-rat", "https://www.rewterz.com/rewterz-news/rewterz-threat-alert-widely-abused-msix-app-installer-disabled-by-microsoft-active-iocs", "https://www.mandiant.com/resources/blog/evolution-of-fin7" ], "synonyms": [], "type": [] }, "uuid": "ff20d720-285e-4168-ac8c-86a7f9ac18d4", "value": "POWERTRASH" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerware", "https://blog.cylance.com/ransomware-update-todays-bountiful-cornucopia-of-extortive-threats" ], "synonyms": [], "type": [] }, "uuid": "5c5beab9-614c-4c86-b369-086234ddb43c", "value": "PowerWare" }, { "description": "PowerZure is a PowerShell project created to assess and exploit resources within Microsoft\u2019s cloud platform, Azure. PowerZure was created out of the need for a framework that can both perform reconnaissance and exploitation of Azure, AzureAD, and the associated resources.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powerzure", "https://github.com/hausec/PowerZure" ], "synonyms": [], "type": [] }, "uuid": "f5fa77e9-9851-48a6-864d-e0448de062d4", "value": "PowerZure" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.power_magic", "https://securelist.com/bad-magic-apt/109087/?s=31", "https://www.malwarebytes.com/blog/threat-intelligence/2023/05/redstinger", "https://securelist.com/bad-magic-apt/109087/", "https://securelist.com/cloudwizard-apt/109722/" ], "synonyms": [], "type": [] }, "uuid": "7ee51054-1d3b-45ec-a7fd-1e212c891b99", "value": "PowerMagic" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.power_rat", "https://blog.talosintelligence.com/gophish-powerrat-dcrat/" ], "synonyms": [], "type": [] }, "uuid": "970bdeaf-bc34-458a-ae67-8c3578e8663d", "value": "PowerRAT" }, { "description": "DLL loader that decrypts and runs a powershell-based downloader.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powgoop", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/seedworm-apt-iran-middle-east", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a", "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf", "https://www.clearskysec.com/wp-content/uploads/2020/10/Operation-Quicksand.pdf", "https://www.inforisktoday.com/muddywater-targets-critical-infrastructure-in-asia-europe-a-18611", "https://www.security.ntt/blog/analysis-of-an-iranian-apts-e400-powgoop-variant", "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a", "https://unit42.paloaltonetworks.com/thanos-ransomware/", "https://www.cisa.gov/uscert/sites/default/files/publications/AA22-055A_Iranian_Government-Sponsored_Actors_Conduct_Cyber_Operations.pdf", "https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/", "https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/", "https://www.cyberscoop.com/muddywater-iran-symantec-middle-east/", "https://thehackernews.com/2022/02/irans-muddywater-hacker-group-using-new.html" ], "synonyms": [], "type": [] }, "uuid": "d8429f6d-dc4b-4aae-930d-234156dbf354", "value": "PowGoop" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.powruner", "https://cyware.com/blog/apt34-the-helix-kitten-cybercriminal-group-loves-to-meow-middle-eastern-and-international-organizations-48ae", "https://www.boozallen.com/s/insight/blog/dark-labs-discovers-apt34-malware-variants.html?cid=spo-csatb-2" ], "synonyms": [], "type": [] }, "uuid": "63f6df51-4de3-495a-864f-0a7e30c3b419", "value": "POWRUNER" }, { "description": "The family is adding a fake root certificate authority, sets a proxy.pac-url for local browsers and redirects infected users to fake banking applications (currently targeting Poland). Based on information shared, it seems the PowerShell script is dropped by an exploit kit.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.presfox", "https://twitter.com/kafeine/status/1092000556598677504" ], "synonyms": [], "type": [] }, "uuid": "c8c5ca3c-7cf0-453e-9fe9-d5637b1ab1f8", "value": "PresFox" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.ptero_graphin", "https://blog.synapticsystems.de/inside-gamaredon-2025-zero-click-espionage-at-scale/", "https://www.welivesecurity.com/en/eset-research/gamaredon-x-turla-collab/" ], "synonyms": [], "type": [] }, "uuid": "83625464-dcb9-481d-8ced-d46c41b6d098", "value": "PteroGraphin" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.quadagent", "https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/", "https://youtu.be/pBDu8EGWRC4?t=2492", "https://cyware.com/blog/apt34-the-helix-kitten-cybercriminal-group-loves-to-meow-middle-eastern-and-international-organizations-48ae", "https://www.fireeye.com/blog/threat-research/2020/07/scandalous-external-detection-using-network-scan-data-and-automation.html", "https://docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc/edit#heading=h.ez428aw98bca" ], "synonyms": [], "type": [] }, "uuid": "e27bfd65-4a58-416a-b03a-1ab1703edb24", "value": "QUADAGENT" }, { "description": "A set of powershell scripts, using services like Google Docs and Dropbox as C2.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.randomquery", "https://www.securonix.com/blog/securonix-threat-research-security-advisory-new-deepgosu-attack-campaign/", "https://s2w.inc/en/resource/detail/920", "https://intel.breakglass.tech/post/kimsuky-chm-nidlog-c2-dump-full-payload-recovery", "https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/" ], "synonyms": [], "type": [] }, "uuid": "b0a67107-dff2-4fb9-a47e-10f83779bdbb", "value": "RandomQuery (Powershell)" }, { "description": "According to Trellix, this is a first-stage, powershell-based malware dropped via Excel/VBS. It is able to establish a foothold and exfiltrate data. Targets identified include hotels in Macao.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.rmot", "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/suspected-darkhotel-apt-activity-update.html" ], "synonyms": [], "type": [] }, "uuid": "7e79444b-95d9-422d-92f0-aeb833a7cbcd", "value": "RMOT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.roguerobin", "https://ironnet.com/blog/dns-tunneling-series-part-3-the-siren-song-of-roguerobin/", "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/", "https://docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc/edit#heading=h.ez428aw98bca" ], "synonyms": [], "type": [] }, "uuid": "1e27a569-1899-4f6f-8c42-aa91bf0a539d", "value": "RogueRobin" }, { "description": "Toolkit downloader used by Royal Ransomware group, involving GnuPG for decryption.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.royal_ransom", "https://redsense.com/publications/royal-blacksuit-how-ransomware-rebrand-reshaped-them/", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a" ], "synonyms": [], "type": [] }, "uuid": "1c75ffff-59f9-4fdc-958d-51f822f76c35", "value": "Royal Ransom (Powershell)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.schtasks", "https://github.com/re4lity/Schtasks-Backdoor/blob/master/Schtasks-Backdoor.ps1" ], "synonyms": [], "type": [] }, "uuid": "3c627182-e4ee-4db0-9263-9d657a5d7c98", "value": "Schtasks" }, { "description": "According to CERT-UA, SILENTLOOP is a PowerShell-based component that coordinates command execution, automatic configuration updates, and discovery of the C2 address, with the main C2 address obtained from a Telegram channel. It supports fallback mechanisms for locating the C2 to maintain control if the primary channel changes. This tool operates as part of a broader attack toolset, enabling persistent management of compromised hosts and facilitating reconnaissance and lateral movement through the network.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.silentloop", "https://cert.gov.ua/article/6288271" ], "synonyms": [], "type": [] }, "uuid": "6cf2eefc-f607-4fdb-915f-ab57564341e9", "value": "SILENTLOOP" }, { "description": "According to Trend Micro, SilentPrism is a backdoor malware designed to achieve persistence, dynamically execute shell commands, and maintain unauthorized remote control of compromised systems. It implements persistence mechanisms differently based on user privileges: for non-administrative users, it leverages the Windows registry to create auto-run entries using mshta.exe combined with VBScript to download and execute remote payloads; for administrative users, it deploys scheduled tasks with similar execution methods. SilentPrism retrieves additional payloads and instructions from a C&C server, ensuring modular functionality. The malware communicates with its C&C server using encrypted channels, employing AES encryption and Base64 encoding to obfuscate data. Commands received are decrypted and executed in various ways, including direct PowerShell script execution, dynamic script block creation, or job-based execution. Each task is tracked using unique identifiers, allowing the malware to monitor execution states and return results to the server. SilentPrism incorporates anti-analysis techniques such as virtual machine detection and randomized sleep intervals (ranging from 300 to 700 milliseconds) between operations, making its behavior less predictable. Additionally, it continuously polls the C&C server for commands, enabling operators to dynamically control infected systems. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.silent_prism", "https://www.trendmicro.com/en_us/research/25/c/deep-dive-into-water-gamayun.html", "https://catalyst.prodaft.com/public/report/larva-208s-new-campaign-targets-web3-developers/overview#heading-1000" ], "synonyms": [], "type": [] }, "uuid": "a4742e21-b4ad-4dc3-8207-5e6990cd33a5", "value": "SilentPrism" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.skyrat", "https://github.com/YSCHGroup/SkyRAT" ], "synonyms": [], "type": [] }, "uuid": "8e5d7d24-9cdd-4376-a6c7-967273dfeeab", "value": "skyrat" }, { "description": "sLoad is a PowerShell downloader that most frequently delivers Ramnit banker and includes noteworthy reconnaissance features. The malware gathers information about the infected system including a list of running processes, the presence of Outlook, and the presence of Citrix-related files. sLoad can also take screenshots and check the DNS cache for specific domains (e.g., targeted banks), as well as load external binaries.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.sload", "https://www.cert-pa.it/notizie/campagna-sload-star-wars-edition-veicolata-via-pec/", "https://www.proofpoint.com/us/threat-insight/post/sload-and-ramnit-pairing-sustained-campaigns-against-uk-and-italy", "https://www.vkremez.com/2018/08/lets-learn-in-depth-into-latest-ramnit.html", "https://blog.minerva-labs.com/sload-targeting-europe-again", "https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf", "https://www.cybereason.com/blog/banking-trojan-delivered-by-lolbins-ramnit-trojan", "https://threatpost.com/sload-spying-payload-delivery-bits/151120/", "https://cyware.com/news/new-sload-malware-downloader-being-leveraged-by-apt-group-ta554-to-spread-ramnit-7d03f2d9", "https://cert-agid.gov.it/news/campagna-sload-v-2-9-3-veicolata-via-pec/", "https://www.intrinsec.com/wp-content/uploads/2025/03/TLP-CLEAR-From-espionage-to-PsyOps-Tracking-operations-and-infrastructure-of-UACs-in-2025-EN-1.pdf", "https://www.microsoft.com/security/blog/2020/01/21/sload-launches-version-2-0-starslord/", "https://blog.yoroi.company/research/the-sload-powershell-threat-is-expanding-to-italy/", "https://isc.sans.edu/forums/diary/Malicious+Powershell+Targeting+UK+Bank+Customers/23675/", "https://www.certego.net/en/news/sload-hits-italy-unveil-the-power-of-powershell-as-a-downloader/" ], "synonyms": [ "Starslord" ], "type": [] }, "uuid": "e78c0259-9299-4e55-b934-17c6a3ac4bc2", "value": "sLoad" }, { "description": "According to IBM X-Force, Slopoly is a likely LLM-generated PowerShell-based command-and-control framework that functions as a fully functional backdoor, collecting system information and sending it as JSON data to a C2 server via HTTP POST heartbeats while polling for commands to execute through the system shell. The malware includes extensive comments, logging, error handling, and accurately named variables, which are characteristic indicators of AI-generated software, though it lacks advanced techniques and cannot actually modify its own code despite being labeled as polymorphic. It establishes persistence by creating a scheduled task and maintains a rotating log file, allowing the threat actor to retain access to the infected server for an extended period. The malware's quality suggests it was generated by a less advanced large language model, and it was deployed by the Hive0163 threat actor during the later stages of a ransomware attack.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.slopoly", "https://www.ibm.com/think/x-force/slopoly-start-ai-enhanced-ransomware-attacks" ], "synonyms": [], "type": [] }, "uuid": "347bea82-7347-43b5-b2e7-b77ff7f037e1", "value": "Slopoly" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.snugy", "https://unit42.paloaltonetworks.com/atoms/hunter-serpens/", "https://unit42.paloaltonetworks.com/xhunt-campaign-backdoors/" ], "synonyms": [], "type": [] }, "uuid": "773a6520-d164-4727-8351-c4201b04f10b", "value": "Snugy" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.steelhook", "https://github.com/blackorbird/APT_REPORT/blob/master/APT28/APT28%20the%20long%20hand%20of%20Russian%20interests.pdf", "https://media.defense.gov/2025/May/21/2003719846/-1/-1/0/CSA_RUSSIAN_GRU_TARGET_LOGISTICS.PDF", "https://cert.gov.ua/article/6276894", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2025-CTI-007.pdf" ], "synonyms": [], "type": [] }, "uuid": "f963e3df-13d1-4fd0-abdd-792c0d05e41c", "value": "STEELHOOK" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.subtle_paws", "https://www.securonix.com/blog/security-advisory-steadyursa-attack-campaign-targets-ukraine-military/" ], "synonyms": [], "type": [] }, "uuid": "399258d3-6919-45f9-a557-10c3cbef9bd4", "value": "SUBTLE-PAWS" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.swrort", "https://github.com/itsKindred/malware-analysis-writeups/blob/master/swrort-dropper/swrort-stager-analysis.pdf" ], "synonyms": [], "type": [] }, "uuid": "3347a1bc-6b4d-459c-98a5-746bab12d011", "value": "Swrort Stager" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.tater", "https://github.com/Kevin-Robertson/Tater" ], "synonyms": [], "type": [] }, "uuid": "808445e6-f51c-4b5d-a812-78102bf60d24", "value": "Tater PrivEsc" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.thundershell", "https://github.com/Mr-Un1k0d3r/ThunderShell" ], "synonyms": [], "type": [] }, "uuid": "fd9904a6-6e06-4b50-8bfd-64ffb793d4a4", "value": "ThunderShell" }, { "description": "Recon and exfiltration script, dropped from a LNK file. Attributed to APT-C-12.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.unidentified_001", "https://bitofhex.com/2020/02/10/sapphire-mushroom-lnk-files/" ], "synonyms": [], "type": [] }, "uuid": "77231587-0dbe-4064-97b5-d7f4a2e3dc67", "value": "Unidentified PS 001" }, { "description": "A Powershell-based RAT capable of pulling further payloads, delivered through Russia-themed phishing mails.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.unidentified_002", "https://blog.malwarebytes.com/threat-intelligence/2022/03/new-spear-phishing-campaign-targets-russian-dissidents/", "https://www.bleepingcomputer.com/news/security/phishing-campaign-targets-russian-govt-dissidents-with-cobalt-strike/" ], "synonyms": [], "type": [] }, "uuid": "73578ff6-b218-4271-9bda-2a567ba3e259", "value": "Unidentified PS 002 (RAT)" }, { "description": "This malware is a RAT written in PowerShell. It has the following capabilities: Downloading and Uploading files, loading and execution of a PowerShell script, execution of a specific command. It was observed by Malwarebytes LABS Threat Intelligence Team in a newly discovered campaign: this campaigns tries to lure Germans with a promise of updates on the current threat situation in Ukraine according to Malwarebyte LABS.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.unidentified_003", "https://blog.malwarebytes.com/threat-intelligence/2022/05/custom-powershell-rat-targets-germans-seeking-information-about-the-ukraine-crisis/" ], "synonyms": [], "type": [] }, "uuid": "709ba4ad-9ec5-4e0b-b642-96db3b7f6898", "value": "Unidentified PS 003 (RAT)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.unidentified_004", "https://somedieyoungzz.github.io/posts/kimsucky-2/" ], "synonyms": [], "type": [] }, "uuid": "a8f69576-676f-4536-b301-246ddd87ceeb", "value": "Unidentified PS 004 (RAT)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.unidentified_005", "https://www.seqrite.com/blog/silent-lynx-apt-targeting-central-asian-entities/" ], "synonyms": [], "type": [] }, "uuid": "43e09f73-5095-40dd-a10f-5bea20d9210e", "value": "Unidentified PS 005 (Telegram Bot)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.vipersoftx", "https://www.linkedin.com/pulse/dissecting-multi-stage-malware-campaign-how-cracked-softwares-ali-rrm9f", "https://labs.k7computing.com/index.php/in-depth-analysis-of-a-2025-vipersoftx-variant", "https://decoded.avast.io/janrubin/vipersoftx-hiding-in-system-logs-and-spreading-venomsoftx/", "https://www.trendmicro.com/en_us/research/23/d/vipersoftx-updates-encryption-steals-data.html", "https://chris.partridge.tech/2022/evolution-of-vipersoftx-dga" ], "synonyms": [], "type": [] }, "uuid": "15b551ea-b59a-40f9-a10f-6144415d2d5c", "value": "ViperSoftX" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.wannamine", "https://www.cybereason.com/blog/wannamine-cryptominer-eternalblue-wannacry", "https://news.sophos.com/fr-fr/2020/01/22/wannamine-meme-cybercriminels-veulent-avoir-mot-a-dire-sur-brexit/", "https://www.crowdstrike.com/blog/cryptomining-harmless-nuisance-disruptive-threat/", "https://www.accenture.com/_acnmedia/PDF-46/Accenture-Threat-Analysis-Monero-Wannamine.pdf", "https://www.crowdstrike.com/blog/weeding-out-wannamine-v4-0-analyzing-and-remediating-this-mineware-nightmare/", "https://nakedsecurity.sophos.com/2018/01/31/what-are-wannamine-attacks-and-how-do-i-avoid-them/" ], "synonyms": [], "type": [] }, "uuid": "beb4f2b3-85d1-491d-8ae1-f7933f00f820", "value": "WannaMine" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.wannaren_loader", "https://twitter.com/blackorbird/status/1247834024711577601" ], "synonyms": [], "type": [] }, "uuid": "c9ef106e-def9-4229-8373-616a298ed645", "value": "WannaRen Downloader" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.wmimplant", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html" ], "synonyms": [], "type": [] }, "uuid": "d1150a1a-a2f4-4954-b22a-a85b7876408e", "value": "WMImplant" }, { "description": "According to CERT-UA, this is a stealer targeting a range of file extensions and creating screenshots of the compromised machine to be then uploaded via cURL.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.wrecksteel", "https://cip.gov.ua/services/cm/api/attachment/download?id=71278", "https://socprime.com/blog/detect-uac-0219-attacks-against-ukrainian-state-bodies", "https://cip.gov.ua/ua/news/novi-kiberzagrozi-kogo-i-yak-atakuyut-vorozhi-ugrupovannya", "https://cert.gov.ua/article/6282902", "https://securityaffairs.com/183222/apt/ukraine-sees-surge-in-ai-powered-cyberattacks-by-russia-linked-threat-actors.html", "https://socprime.com/blog/detect-uac-0219-attacks-against-ukrainian-state-bodies/" ], "synonyms": [], "type": [] }, "uuid": "3adf4cb9-d85a-48b3-80dc-9935947676e4", "value": "WRECKSTEEL" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.akira_stealer", "https://www.glueckkanja.com/en/posts/2025-06-16-quiet-breach" ], "synonyms": [], "type": [] }, "uuid": "53561b34-6062-4f8b-aa47-787198ba9bff", "value": "Akira Stealer" }, { "description": "According to Fortinet, Amnesia RAT is written in Python and designed for broad, multi-category data theft combined with real-time surveillance and system control. Its capabilities include: Browser credentials and session data, Telegram Desktop session hijacking, Seed phrase discovery and clipboard monitoring, Discord and Steam data theft, Cryptocurrency wallets and financial assets, System and hardware intelligence, Screen, audio, and activity surveillance, Process and system control, Persistence, multiple exfiltration channels.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.amnesia_rat", "https://www.fortinet.com/blog/threat-research/inside-a-multi-stage-windows-malware-campaign" ], "synonyms": [], "type": [] }, "uuid": "70d06f44-d3f2-4463-ad5d-3421453a3962", "value": "Amnesia RAT" }, { "description": "According to Laceworks, this is a SMTP cracker, which is primarily intended to scan for and parse Laravel application secrets from exposed .env files. Note: Laravel is an open source PHP framework and the Laravel .env file is often targeted for its various configuration data including AWS, SendGrid and Twilio. AndroxGh0st has multiple features to enable SMTP abuse including scanning, exploitation of exposed creds and APIs, and even deployment of webshells. For AWS specifically, the malware scans for and parses AWS keys but also has the ability to generate keys for brute force attacks. However, the brute force capability is likely a novelty and is a statistically unlikely attack vector.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.androxgh0st", "https://web.archive.org/web/20240715165609/https://www.lacework.com/blog/androxghost-the-python-malware-exploiting-your-aws-keys", "https://www.lacework.com/blog/androxghost-the-python-malware-exploiting-your-aws-keys/" ], "synonyms": [ "Androx", "AndroxGhost" ], "type": [] }, "uuid": "e8f24c9c-c03c-4740-a121-d73789931c8e", "value": "AndroxGh0st" }, { "description": "According to Prodaft, this is a Python-based backdoor used by the Savage Ladybug (FIN7) group is developed to provide remote access, execute commands, and steal data. It is obfuscated to avoid detection.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.anubisbackdoor", "https://github.com/TheRavenFile/Daily-Hunt/blob/main/Anubis%20Backdoor", "https://github.com/prodaft/malware-ioc/blob/master/SavageLadybug/AnubisBackdoor.md" ], "synonyms": [], "type": [] }, "uuid": "6bb40ba1-71a9-4f02-9bc7-94ce542ec8e5", "value": "Anubis Backdoor" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.archivist", "https://github.com/NullArray/Archivist" ], "synonyms": [], "type": [] }, "uuid": "2095a09c-3fdd-4164-b82e-2e9a41affd8e", "value": "Archivist" }, { "description": "Ares is a Python RAT.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.ares", "https://github.com/sweetsoftware/Ares", "https://www.seqrite.com/blog/operation-rusticweb-targets-indian-govt-from-rust-based-malware-to-web-service-exfiltration/" ], "synonyms": [], "type": [] }, "uuid": "c4a578de-bebe-49bf-8af1-407857acca95", "value": "Ares (Python)" }, { "description": "Stealer written in Python 3, typically distributed bundled via PyInstaller.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.blankgrabber", "https://github.com/Blank-c/Blank-Grabber", "https://c-b.io/blog/dissecting_blankgrabber/", "https://c-b.io/2025-02-15+-+Dissecting+a+fresh+BlankGrabber+sample", "https://www.linkedin.com/feed/update/urn:li:activity:7247179869443264512/", "https://labs.k7computing.com/index.php/open-source-stealers-oss-python/" ], "synonyms": [], "type": [] }, "uuid": "c41d4749-b713-4f4c-b718-4076c0479ebc", "value": "BlankGrabber" }, { "description": "According to K7 Security Labs, Braodo Stealer is written in Python and collects all cookies and saved credentials from the browsers and all services and process information of that particular system as a zip file, which is then exfiltrated to a Telegram Channel.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.braodo", "https://labs.k7computing.com/index.php/echoes-of-braodo-tales-from-the-cyber-underworld/" ], "synonyms": [], "type": [] }, "uuid": "d39eaab7-773d-41b4-9113-cfd67971ba65", "value": "Braodo" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.brickerbot", "http://seclists.org/fulldisclosure/2017/Mar/7", "https://www.bleepingcomputer.com/news/security/brickerbot-author-retires-claiming-to-have-bricked-over-10-million-iot-devices/", "https://www.trustwave.com/Resources/SpiderLabs-Blog/BrickerBot-mod_plaintext-Analysis/", "http://depastedihrn3jtw.onion/show.php?md5=2c822a990ff22d56f3b9eb89ed722c3f", "https://ics-cert.us-cert.gov/alerts/ICS-ALERT-17-102-01A", "https://security.radware.com/ddos-threats-attacks/brickerbot-pdos-permanent-denial-of-service/", "https://www.bleepingcomputer.com/news/security/brickerbot-author-claims-he-bricked-two-million-devices/" ], "synonyms": [], "type": [] }, "uuid": "f0ff8751-c182-4e9c-a275-81bb03e0cdf5", "value": "BrickerBot" }, { "description": "According to CERT-UA, this is a PyArmor-protected backdoor capable of execution dynamically downloaded Python code.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.cherryspy", "https://cert.gov.ua/article/4697016", "https://www.recordedfuture.com/research/russia-aligned-tag-110-targets-tajikistan-with-macro-enabled", "https://go.recordedfuture.com/hubfs/reports/cta-2025-0522.pdf" ], "synonyms": [], "type": [] }, "uuid": "e219bf34-3326-4ff5-91e7-ee9008d5dee7", "value": "CHERRYSPY" }, { "description": "Creal is an open-source grabber/credential stealer that was originally made by a GitHub user named Ayhuuu, who even advertised a \"premium\" version on his now-deleted Telegram channel @Crealstealer. To the day of release, it was already not FUD, but its open-source nature made it attractive for threat actors to modify the base malware and even obfuscate it for less detection ratios. The base project came with a compiler, and the general source code the compiler used was PyInstaller for compilation into native formats like exe. For C2, Discord webhooks were utilized, which in later versions got protected with a service called https://stealer.to to make deletion not possible.\r\n\r\nIt Compromised following Data on Execution:\r\n\r\n* Discord Information\r\n* Browser Data\r\n* Crypto Related Data\r\n* Steam\r\n* Riot Games\r\n* Telegram\r\n* System Information\r\n* Tokens/Secrets", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.creal_stealer", "https://cyble.com/blog/creal-new-stealer-targeting-cryptocurrency-users-via-phishing-sites/" ], "synonyms": [], "type": [] }, "uuid": "8a7becae-fc06-4ff1-b364-b26dd3d2edd9", "value": "Creal Stealer" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.dropboxc2c", "https://github.com/0x09AL/DropboxC2C" ], "synonyms": [], "type": [] }, "uuid": "53dd4a8b-374e-48b6-a7c8-58af0e31f435", "value": "DropboxC2C" }, { "description": "Discord Stealer written in Python with Javascript-based inject files.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.empyrean", "https://www.cyberark.com/resources/threat-research-blog/the-not-so-secret-war-on-discord" ], "synonyms": [], "type": [] }, "uuid": "b1aa0be3-b725-4135-b0b9-3a895d4ef047", "value": "Empyrean" }, { "description": "Ransomware written in Python.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.evil_ant", "https://labs.k7computing.com/index.php/python-ciphering-delving-into-evil-ants-ransomwares-tactics/" ], "synonyms": [], "type": [] }, "uuid": "24d570c6-3ed4-4346-a8b1-9fed2ed67a95", "value": "Evil Ant" }, { "description": "According to Kaspersky Labs, Guard is a malware developed by threat actor WildPressure. It is written in Python and packaged using PyInstaller, both for Windows and macOS operating systems. Its intrinsics resemble parts of how win.milum operates.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.guard", "https://securelist.com/wildpressure-targets-macos/103072/" ], "synonyms": [], "type": [] }, "uuid": "ac3382b3-3c18-4b16-8f1b-b371794916ac", "value": "Guard" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.invisibleferret", "https://stacklok.com/blog/dependency-hijacking-dissecting-north-koreas-new-wave-of-defi-themed-open-source-attacks-targeting-developers", "https://blog.talosintelligence.com/beavertail-and-ottercookie/", "https://any.run/cybersecurity-blog/lazarus-group-attacks-2025/", "https://blog.nviso.eu/2025/11/13/contagious-interview-actors-now-utilize-json-storage-services-for-malware-delivery/", "https://medium.com/deriv-tech/how-a-fake-ai-recruiter-delivers-five-staged-malware-disguised-as-a-dream-job-64cc68fec263", "https://www.trendmicro.com/en_us/research/26/d/void-dokkaebi-uses-fake-job-interview-lure-to-spread-malware-via-code-repositories.html", "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/", "https://radar.securityalliance.org/vs-code-tasks-abuse-by-contagious-interview-dprk/", "https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket", "https://quetzal.bitso.com/p/interview-with-the-chollima", "https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages", "https://jp.security.ntt/tech_blog/en-waterplum-ottercookie", "https://any.run/cybersecurity-blog/ottercookie-malware-analysis/", "https://www.group-ib.com/blog/apt-lazarus-python-scripts/", "https://www.silentpush.com/blog/contagious-interview-front-companies/", "https://github.com/ssrdio/PublicIoC/tree/main/CestLaVie", "https://www.bitdefender.com/en-us/blog/labs/lazarus-group-targets-organizations-with-sophisticated-linkedin-recruiting-scam", "https://web.archive.org/web/20250206220041/https://stacklok.com/blog/dependency-hijacking-dissecting-north-koreas-new-wave-of-defi-themed-open-source-attacks-targeting-developers", "https://doi.org/10.48550/arXiv.2505.21725", "https://research.hisolutions.com/2025/04/rolling-in-the-deepweb-lazarus-tsunami/", "https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf", "https://securityscorecard.com/blog/the-job-offer-that-wasnt-how-we-stopped-an-espionage-plot", "https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat", "https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west", "https://www.trendmicro.com/en_us/research/26/e/analyzing-void-dokkaebi-invisibleferret-malware.html", "https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages", "https://security.macnica.co.jp/blog/2024/10/-contagious-interview.html", "https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q4-2024-q1-2025.pdf", "https://www.cert.si/tz016/", "https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2", "https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/", "https://gitlab-com.gitlab.io/gl-security/security-tech-notes/threat-intelligence-tech-notes/north-korean-malware-sept-2025/", "https://opensourcemalware.com/blog/dprk-git-hooks-malware", "https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages", "https://securityscorecard.com/blog/operation-phantom-circuit-north-koreas-global-data-exfiltration-campaign/", "https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/", "https://www.recordedfuture.com/research/purplebravos-targeting-it-software-supply-chain", "https://redasgard.com/blog/hunting-lazarus-contagious-interview-c2-infrastructure", "https://opensourcemalware.com/blog/contagious-interview-vscode", "https://www.abstract.security/blog/contagious-interview-tracking-the-vs-code-tasks-infection-vector", "https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/", "https://objective-see.org/blog/blog_0x7A.html", "https://unit42.paloaltonetworks.com/fake-north-korean-it-worker-activity-cluster/", "https://securitylabs.datadoghq.com/articles/tenacious-pungsan-dprk-threat-actor-contagious-interview/", "https://www.trendmicro.com/en_us/research/25/d/russian-infrastructure-north-korean-cybercrime.html", "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-from-primitive-crypto-theft-to-sophisticated-ai-based-deception/", "https://www.virusbulletin.com/uploads/pdf/conference/vb2025/papers/DeceptiveDevelopment-and-North-Korean-IT-workers-from-primitive-crypto-theft-to-sophisticated-AI-based-deception.pdf", "https://socket.dev/blog/north-korean-apt-lazarus-targets-developers-with-malicious-npm-package", "https://jp.security.ntt/tech_blog/contagious-interview-ottercookie" ], "synonyms": [], "type": [] }, "uuid": "332478a1-146f-406e-9af0-b329e478efff", "value": "InvisibleFerret" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.keyplexer", "https://github.com/nairuzabulhul/KeyPlexer" ], "synonyms": [], "type": [] }, "uuid": "cadf8c9d-7bb0-40ad-8c8c-043b1d4b2e93", "value": "KeyPlexer" }, { "description": "According to CERT-UA, LAMEHUG uses an LLM (Qwen) to dynamically generate commands to gather basic information about a computer and recursively exfiltrate Office documents from a set of folders, to be uploaded either by SFTP or HTTP POST requests.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.lamehug", "https://cert.gov.ua/article/6284730", "https://www.catonetworks.com/blog/cato-ctrl-threat-research-analyzing-lamehug/" ], "synonyms": [], "type": [] }, "uuid": "033d549c-2429-4837-9b3d-53871a2d8520", "value": "LAMEHUG" }, { "description": "The author described LaZagne as an open source project used to retrieve lots of passwords stored on a local computer. It has been developed for the purpose of finding these passwords for the most commonly-used software. It is written in Python and provided as compiled standalone binaries for Linux, Mac, and Windows.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.lazagne", "https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/", "https://www.trendmicro.com/en_us/research/20/k/weaponizing-open-source-software-for-targeted-attacks.html", "https://attack.mitre.org/groups/G0100/", "https://fourcore.io/blogs/threat-hunting-browser-credential-stealing", "https://yoroi.company/research/shadows-from-the-past-threaten-italian-enterprises/", "https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/", "https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/?utm_source=rss&utm_medium=rss&utm_campaign=apt-group-targeting-governmental-agencies-in-east-asia", "https://github.com/AlessandroZ/LaZagne", "https://www.mandiant.com/resources/blog/alphv-ransomware-backup", "https://attack.mitre.org/groups/G0100", "https://blog.talosintelligence.com/uat-5918-targets-critical-infra-in-taiwan/", "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-ransomexx", "https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/", "https://edu.anarcho-copy.org/Against%20Security%20&%20%20Self%20Security/Group-IB%20RedCurl.pdf", "https://www.infinitumit.com.tr/apt-35/" ], "synonyms": [], "type": [] }, "uuid": "c752f295-7f08-4cb0-92d5-a0c562abd08c", "value": "LaZagne" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.lofy", "https://securelist.com/lofylife-malicious-npm-packages/107014/" ], "synonyms": [ "LofyLife" ], "type": [] }, "uuid": "10882613-ac61-42da-82c8-c0f4bb2673f8", "value": "Lofy" }, { "description": "This RAT written in Python is an open-source fork of the Ares RAT. This malware integrates additional modules, like recording, lockscreen, and locate options. It was used in a customized form version by El Machete APT in an ongoing champaign since 2020. The original code can be found at: https://github.com/TheGeekHT/Loki.Rat/", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.lokirat", "https://www.youtube.com/watch?v=6Ljl1Rnl1jM", "https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/", "https://www.first.org/resources/papers/conf2023/FIRSTCON23-TLPCLEAR-Sood-Compromising-the-Keys-to-the-Kingdom.pdf" ], "synonyms": [], "type": [] }, "uuid": "5e7bb9d4-6633-49f8-8770-9ac1163e6531", "value": "Loki RAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.lunagrabber", "https://www.darkreading.com/vulnerabilities-threats/luna-grabber-malware-targets-roblox-gaming-devs" ], "synonyms": [], "type": [] }, "uuid": "e55b4cc8-3680-4586-82b9-4acf8cd3dc3a", "value": "Luna Grabber" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.masepie", "https://media.defense.gov/2025/May/21/2003719846/-1/-1/0/CSA_RUSSIAN_GRU_TARGET_LOGISTICS.PDF", "https://harfanglab.io/en/insidethelab/compromised-routers-infrastructure-target-europe-caucasus/", "https://github.com/blackorbird/APT_REPORT/blob/master/APT28/APT28%20the%20long%20hand%20of%20Russian%20interests.pdf", "https://cert.gov.ua/article/6276894", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2025-CTI-007.pdf", "https://thehackernews.com/2024/03/apt28-hacker-group-targeting-europe.html?m=1" ], "synonyms": [], "type": [] }, "uuid": "9233f6e6-9dd7-4b30-adaa-5baf5359d22a", "value": "MASEPIE" }, { "description": "According to Rapid7, ModeloRAT is a Python-based remote access trojan framework previously tied to the KongTuke group's browser extension campaigns, which in this incident was delivered through Microsoft Teams social engineering using a portable WinPython environment to bypass traditional detections. Its capabilities center on a long-running HTTP C2 beacon that can load DLLs via rundll32, launch additional Python modules, execute PowerShell commands, install MSI packages, handle persistence, and self-update or remove, while supporting supplementary modules for reverse shells, SOCKS proxying, and HTTP tunneling. The Python modules are obfuscated and run through pythonw.exe to avoid visible console windows, with all communication blended into normal-looking web traffic over port 80. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.modelorat", "https://www.rapid7.com/blog/post/tr-it-support-dissecting-modelorat-campaign-microsoft-teams-compromise/", "https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke" ], "synonyms": [], "type": [] }, "uuid": "4cc65c77-1877-4886-8744-52fbe0e00d61", "value": "ModeloRAT" }, { "description": "An IRC bot written in (obfuscated) Python code. Distributed in attack campaign FreakOut, written by author Freak/Fl0urite and development potentially dating back as far as 2015.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.n3cr0m0rph", "https://twitter.com/xuy1202/status/1392089568384454657", "https://blogs.juniper.net/en-us/threat-research/necro-python-botnet-goes-after-vulnerable-visualtools-dvr", "https://www.lacework.com/blog/spytech-necro-keksecs-latest-python-malware/", "https://www.lacework.com/keksec-tsunami-ryuk/", "https://blog.talosintelligence.com/2021/06/necro-python-bot-adds-new-tricks.html", "https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/", "https://www.lacework.com/blog/the-kek-security-network/", "https://twitter.com/xuy1202/status/1393384128456794116", "https://blog.netlab.360.com/necro/", "https://github.com/lacework/lacework-labs/tree/master/keksec", "https://www.bleepingcomputer.com/news/security/freakout-malware-worms-its-way-into-vulnerable-vmware-servers/", "https://www.lacework.com/the-kek-security-network/", "https://blog.netlab.360.com/necro-upgrades-again-using-tor-dynamic-domain-dga-and-aiming-at-both-windows-linux/", "https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/", "https://blog.netlab.360.com/not-really-new-pyhton-ddos-bot-n3cr0m0rph-necromorph/" ], "synonyms": [ "FreakOut", "Necro" ], "type": [] }, "uuid": "2351539a-165a-4886-b5fe-f56fdf6b167a", "value": "N3Cr0m0rPh" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.networm", "https://github.com/pylyf/NetWorm" ], "synonyms": [], "type": [] }, "uuid": "6c6acd00-cdc2-460d-8edf-003b84875b5d", "value": "NetWorm" }, { "description": "According to eSentire, NightshadeC2 demonstrates an extensive capability set, including: Reverse shell via Command Prompt/PowerShell; Download and execute DLL or EXE; Self-deletion; Remote control; Screen capture; Hidden web browsers; Keylogging; clipboard content capturing. Certain variants have been found with stealing capabilities that enable the extraction of browser passwords and cookies from victim systems for both Gecko and Chromium based browsers.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.nightshade_c2", "https://www.esentire.com/blog/new-botnet-emerges-from-the-shadows-nightshadec2" ], "synonyms": [], "type": [] }, "uuid": "10a8da24-d40d-4f1e-b173-f78e574e86aa", "value": "NightshadeC2 (Python)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.pirat", "https://vk.com/m228228?w=wall306895781_177" ], "synonyms": [], "type": [] }, "uuid": "bca94d33-e5a1-4bcc-981e-f35fd74a79d1", "value": "PIRAT" }, { "description": "According to CERT-UA, this malware establishes a connection to the management server using web sockets and/or MQTT, data is transmitted in JSON format. Based on basic information about the computer (MAC address, BIOS serial number, disk and processor ID), it generates a unique device identifier using the SHA-256 algorithm (the first 16 bytes are used). It ensures the execution of the program code received from the server. Persistence is achieved by creating an entry in the Run branch of the operating system registry.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.pluggyape", "https://cert.gov.ua/article/6286942" ], "synonyms": [], "type": [] }, "uuid": "90839909-43e1-4901-bfab-804ceaf6914c", "value": "PLUGGYAPE" }, { "description": "Cisco Talos has discovered a Python-based RAT they call Poet RAT. It is dropped from a Word document and delivered including a Python interpreter and required libraries. The name originates from references to Shakespeare. Exfiltration happens through FTP.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.poet_rat", "https://blog.talosintelligence.com/yorotrooper-espionage-campaign-cis-turkey-europe/", "https://securelist.com/apt-trends-report-q3-2020/99204/", "https://blog.talosintelligence.com/2020/10/poetrat-update.html", "https://www.cyborgsecurity.com/cyborg_labs/python-malware-on-the-rise/", "https://www.dragos.com/blog/industry-news/new-ics-threat-activity-group-stibnite/", "https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html", "https://www.ptsecurity.com/ww-en/analytics/antisandbox-techniques/", "https://ics-cert.kaspersky.com/media/KASPERSKY_H1_2020_ICS_REPORT_EN.pdf", "https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html" ], "synonyms": [], "type": [] }, "uuid": "b07819a9-a2f7-454d-a520-c6424cbf1ed4", "value": "Poet RAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.powerat", "https://blog.phylum.io/a-deep-dive-into-powerat-a-newly-discovered-stealer/rat-combo-polluting-pypi" ], "synonyms": [], "type": [] }, "uuid": "b5cb3d2b-0205-4883-aaff-0d0b7a7f032d", "value": "poweRAT" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.pupy", "https://go.recordedfuture.com/hubfs/reports/cta-2021-0107.pdf", "https://github.com/n1nj4sec/pupy", "https://www.secureworks.com/research/threat-profiles/cobalt-trinity", "https://go.recordedfuture.com/hubfs/reports/cta-2020-0123.pdf", "https://www.secureworks.com/research/threat-profiles/cobalt-gypsy" ], "synonyms": [], "type": [] }, "uuid": "afcc9bfc-1227-4bb0-a88a-5accdbfd58fa", "value": "pupy (Python)" }, { "description": "PXA Stealer is an information-stealing malware written in Python, identified by Cisco Talos in an active campaign attributed to a Vietnamese-speaking threat actor (2024, Phan Xu\u00e2n Anh). The stealer targets sensitive data such as credentials for online accounts, VPN and FTP clients, financial information, browser cookies, and gaming-related data. Notably, PXA Stealer is capable of decrypting browser master passwords to exfiltrate stored credentials. The campaign leverages heavily obfuscated batch scripts for delivery and execution. The actor behind this operation is linked to the Telegram channel \u201cMua B\u00e1n Scan MINI,\u201d known to host credential trade and cybercrime activity. While there are connections to the CoralRaider adversary, attribution to this group remains unconfirmed. In q2 2025 PXA stealer was observed to target Italy.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.pxa_stealer", "https://www.darkrym.com/posts/python_malware_part3/", "https://www.sentinelone.com/labs/ghost-in-the-zip-new-pxa-stealer-and-its-telegram-powered-ecosystem/", "https://x.com/luc4m/status/1934864757619900789", "https://nld.com.vn/mot-hoc-sinh-lop-12-o-thanh-hoa-dung-ma-doc-danh-cap-du-lieu-may-tinh-nguoi-dung-toan-cau-196260324215720573.htm", "https://labs.beazley.security/articles/ghost-in-the-zip-or-new-pxa-stealer-and-its-telegram-powered-ecosystem", "https://blog.talosintelligence.com/new-pxa-stealer/", "https://www.darkrym.com/posts/2025/08/pxa-stealers-evolution-to-purerat-part-3-weaponised-python-stage-stage-5/" ], "synonyms": [ "PXA", "PXAStealer" ], "type": [] }, "uuid": "69aae68f-9831-4568-b3a7-0f492fea8c70", "value": "PXA Stealer" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.pyaesloader", "https://malpedia.caad.fkie.fraunhofer.de/details/py.pyaesloader" ], "synonyms": [], "type": [] }, "uuid": "b9ba4f66-78dc-491f-8fd4-0143816ce80e", "value": "PyAesLoader" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.pyark", "https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/" ], "synonyms": [], "type": [] }, "uuid": "01f15f4e-dd40-4246-9b99-c0d81306e37f", "value": "PyArk" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.pyback", "https://malpedia.caad.fkie.fraunhofer.de/details/py.unidentified_001", "https://github.com/7h3w4lk3r/pyback" ], "synonyms": [], "type": [] }, "uuid": "6d96cd1e-98f4-4784-9982-397c5df19bd9", "value": "pyback" }, { "description": "Python-version of GolangGhost RAT", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.pylangghost", "https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/", "https://any.run/cybersecurity-blog/lazarus-group-attacks-2025/", "https://any.run/cybersecurity-blog/pylangghost-malware-analysis/", "https://kmsec.uk/blog/pylangghost-npm/", "https://research.jfrog.com/post/from-postcss-typosquat-to-windows-rat/", "https://blog.talosintelligence.com/python-version-of-golangghost-rat/", "https://blog.polyswarm.io/famous-chollimas-pylangghost", "https://www.abstract.security/blog/contagious-interview-evolution-of-vs-code-and-cursor-tasks-infection-chains-part-2", "https://kmsec.uk/blog/dprk-pages-dev-abuse/", "https://www.abstract.security/blog/contagious-interview-evolution-of-vscode-and-cursor-tasks-infection-chains", "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-from-primitive-crypto-theft-to-sophisticated-ai-based-deception/", "https://www.virusbulletin.com/uploads/pdf/conference/vb2025/papers/DeceptiveDevelopment-and-North-Korean-IT-workers-from-primitive-crypto-theft-to-sophisticated-AI-based-deception.pdf", "https://www.recordedfuture.com/research/purplebravos-targeting-it-software-supply-chain", "https://www.sophos.com/en-us/blog/nickel-alley-strategy-fake-it-til-you-make-it" ], "synonyms": [ "ICEBITE.PYTHON", "WeaselStore" ], "type": [] }, "uuid": "94ef1dd3-dc31-4dfa-8b09-5e0aefb8d29e", "value": "PylangGhost" }, { "description": "According to its author, Pyramid is a post exploitation framework written in Python, capable of executing offensive tooling from a signed binary (e.g. python.exe) by importing their dependencies in memory. It was created to demonstrate a bypass strategy against EDRs based on some blind-spots assumptions. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.pyramid", "https://hunt.io/blog/russian-actor-cloudflare-phishing-telegram-c2", "https://github.com/naksyn/Pyramid", "https://hunt.io/blog/tracking-pyramid-c2-identifying-post-exploitation-servers", "https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/", "https://hunt.io/blog/russian-speaking-actors-impersonate-etf-distribute-stealc-pyramid-c2" ], "synonyms": [], "type": [] }, "uuid": "d0c73fba-7dd5-49f9-a439-be0d960ebadb", "value": "Pyramid" }, { "description": "According to Securonix, this malware exhibits remote access trojan (RAT) behavior, allowing for control of and persistence on the affected host. As with other RATs, PY#RATION possesses a whole host of features and capabilities, including data exfiltration and keylogging. What makes this malware particularly unique is its utilization of websockets for both command and control (C2) communication and exfiltration as well as how it evades detection from antivirus and network security measures.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.pyration", "https://www.securonix.com/blog/security-advisory-python-based-pyration-attack-campaign/" ], "synonyms": [], "type": [] }, "uuid": "1dc471d3-6303-48a1-a17a-b4f29e5ba6a9", "value": "PY#RATION" }, { "description": "PyVil RAT", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.pyvil", "https://www.cybereason.com/blog/no-rest-for-the-wicked-evilnum-unleashes-pyvil-rat", "https://twitter.com/ESETresearch/status/1360178593968623617" ], "synonyms": [], "type": [] }, "uuid": "2cf75f3c-116f-4faf-bd32-ba3a5e2327cf", "value": "PyVil" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.quietboard", "https://www.mandiant.com/resources/blog/unc4990-evolution-usb-malware" ], "synonyms": [], "type": [] }, "uuid": "6ebeed34-4a7d-44d8-ae44-83ae37cf5f2f", "value": "QUIETBOARD" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.redtiger", "https://c-b.io/blog/redtiger_stealer/" ], "synonyms": [ "RedTiger Ste4ler", "redtiger", "redtiger-tools" ], "type": [] }, "uuid": "045c0d7d-4840-4052-ad26-528e89a285b4", "value": "RedTiger Stealer" }, { "description": "Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication. ", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.responder", "https://yoroi.company/research/shadows-from-the-past-threaten-italian-enterprises/", "https://github.com/lgandx/Responder" ], "synonyms": [ "SpiderLabs Responder" ], "type": [] }, "uuid": "3271b5ca-c044-4ab8-bbfc-0d6e1a6601fc", "value": "Responder" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.rn_stealer", "https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/", "https://www.wiz.io/blog/north-korean-tradertraitor-crypto-heist" ], "synonyms": [], "type": [] }, "uuid": "e0b1891f-c1a4-43c3-9944-a84dc32dd371", "value": "RN Stealer" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.saphyra", "https://www.youtube.com/watch?v=Bk-utzAlYFI", "https://securityintelligence.com/dissecting-hacktivists-ddos-tool-saphyra-revealed/" ], "synonyms": [], "type": [] }, "uuid": "30a22cdb-9393-460b-86ae-08d97c626155", "value": "Saphyra" }, { "description": "According to Proofpoint, this is a backdoor written in Python, used in attacks against French entities in the construction, real estate, and government industries.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.serpent", "https://labs.k7computing.com/index.php/uncovering-the-serpent/", "https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain", "https://www.bleepingcomputer.com/news/security/serpent-malware-campaign-abuses-chocolatey-windows-package-manager/", "https://blogs.vmware.com/security/2022/04/serpent-the-backdoor-that-hides-in-plain-sight.html" ], "synonyms": [], "type": [] }, "uuid": "8052319b-f6da-4f53-a630-59245ff65eaf", "value": "Serpent" }, { "description": "According to Mandiant, this malware acts as a persistent backdoor that operates as a local HTTP server (typically listening on port 8000). It enables remote command execution via cmd.exe or powershell.exe, screenshot capture, and data staging for exfiltration. This component is where active reconnaissance and mission completion occur. Attacker commands (such as whoami or net user) are sent through the SNOWGLAZE tunnel, intercepted by the SNOWBELT extension, and then proxied to the SNOWBASIN local server via HTTP POST requests. SNOWBASIN executes these commands and relays the results back through the same pipeline to the attacker.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.snowbasin", "https://cloud.google.com/blog/topics/threat-intelligence/unc6692-social-engineering-custom-malware/" ], "synonyms": [], "type": [] }, "uuid": "292bb64e-70e4-4151-91c8-e48d6fcff690", "value": "SNOWBASIN" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.spacecow", "https://github.com/TheSph1nx/SpaceCow" ], "synonyms": [], "type": [] }, "uuid": "ff5c0845-6740-45d5-bd34-1cf69c635356", "value": "SpaceCow" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.stealler", "https://habr.com/en/sandbox/135410/" ], "synonyms": [], "type": [] }, "uuid": "689247a2-4e75-4802-ab94-484fc3d6a18e", "value": "stealler" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.stitch", "https://github.com/nathanlopez/Stitch", "https://www.volexity.com/blog/2020/03/31/storm-cloud-unleashed-tibetan-community-focus-of-highly-targeted-fake-flash-campaign/" ], "synonyms": [], "type": [] }, "uuid": "6239201b-a0bd-4f01-8bbe-79c6fc5fa861", "value": "Stitch" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.stormous", "https://twitter.com/H4ckManac/status/1765707886246723617" ], "synonyms": [], "type": [] }, "uuid": "e2580f5e-417b-4f21-88ba-8d3e43514363", "value": "Stormous" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.unidentified_002", "https://malpedia.caad.fkie.fraunhofer.de/details/py.unidentified_002" ], "synonyms": [], "type": [] }, "uuid": "7e5fe6ca-3323-409a-a5bb-d34f60197b99", "value": "unidentified_002" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.unidentified_003", "https://malpedia.caad.fkie.fraunhofer.de/details/py.unidentified_003" ], "synonyms": [], "type": [] }, "uuid": "43282411-4999-4066-9b99-2e94a17acbd4", "value": "unidentified_003" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.upstyle", "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/", "https://unit42.paloaltonetworks.com/cve-2024-3400/" ], "synonyms": [], "type": [] }, "uuid": "1824c463-77df-43af-a055-d94567918f6b", "value": "UPSTYLE" }, { "description": "Ransomware written in Python and delivered as compiled executable created using PyInstaller.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.venomous", "https://blog.cyble.com/2021/08/04/a-deep-dive-analysis-of-venomous-ransomware/" ], "synonyms": [], "type": [] }, "uuid": "0bd5aed2-9c74-41a5-9fcf-9379f2cb0e2c", "value": "Venomous" }, { "description": "Venus Stealer is a python based Infostealer observed early 2023.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.venus_stealer", "https://twitter.com/0xToxin/status/1625435116771180546", "https://geekypandatales.wordpress.com/2023/02/19/the-infostealer-pie-python-malware-analysis/" ], "synonyms": [], "type": [] }, "uuid": "20f72d3c-87b7-4349-ad1b-59d7909c1df4", "value": "Venus Stealer" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.vilerat", "https://stairwell.com/resources/technical-analysis-the-silent-torrent-of-vilerat/" ], "synonyms": [], "type": [] }, "uuid": "aba54ca9-ef0d-4061-93d1-65251e90afad", "value": "VileRAT" }, { "description": "A basic info stealer w/ some capability to inject code into legit applications.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.w4sp_stealer", "https://github.com/Im4wasp/W4SP-Stealer-V2/tree/main", "https://securelist.com/two-more-malicious-python-packages-in-the-pypi/107218/" ], "synonyms": [], "type": [] }, "uuid": "c4d46e47-3af8-4117-84ad-1e5699956f2b", "value": "W4SP Stealer" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/py.wirefire", "https://services.google.com/fh/files/misc/m-trends-2025-en.pdf", "https://medium.com/mitre-engenuity/technical-deep-dive-understanding-the-anatomy-of-a-cyber-intrusion-080bddc679f3" ], "synonyms": [ "GIFTEDVISITOR" ], "type": [] }, "uuid": "54f3e853-5f0e-4940-9e27-79e6991886f9", "value": "WIREFIRE" }, { "description": "Spambot written in perl.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/sh.calfbot", "https://web-assets.esetstatic.com/wls/2014/03/operation_windigo.pdf" ], "synonyms": [], "type": [] }, "uuid": "8a596812-c0b7-4640-a360-e02fdd383836", "value": "Calfbot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/sh.kv", "https://blog.lumen.com/routers-roasting-on-an-open-firewall-the-kv-botnet-investigation/", "https://www.securityweek.com/wp-content/uploads/2024/01/Volt-Typhoon.pdf", "https://censys.com/will-the-real-volt-typhoon-please-stand-up/", "https://blog.lumen.com/kv-botnet-dont-call-it-a-comeback/", "https://pylos.co/2025/07/23/will-the-real-salt-typhoon-please-stand-up/", "https://www.justice.gov/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical" ], "synonyms": [], "type": [] }, "uuid": "37784130-81fd-40d7-87d4-38e5085513bd", "value": "KV" }, { "description": "According to its author, PANIX is a powerful, modular, and highly customizable Linux persistence framework designed for security researchers, detection engineers, penetration testers, CTF enthusiasts, and more. Built with versatility in mind, PANIX emphasizes functionality, making it an essential tool for understanding and implementing a wide range of persistence techniques.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/sh.panix", "https://www.elastic.co/security-labs/the-grand-finale-on-linux-persistence", "https://github.com/Aegrah/PANIX" ], "synonyms": [], "type": [] }, "uuid": "6f2badd8-1b67-4a93-be1e-0585f5359a08", "value": "PANIX" }, { "description": "A backdoor brought into version 5.6.0 and 5.6.1 of compression library/tool xz/liblzma, which was intended to enable access via (Open)SSH on affected servers.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/sh.xzbot", "https://github.com/karcherm/xz-malware", "https://www.sentinelone.com/blog/xz-utils-backdoor-threat-actor-planned-to-inject-further-vulnerabilities/", "https://gist.github.com/smx-smx/a6112d54777845d389bd7126d6e9f504", "https://boehs.org/node/everything-i-know-about-the-xz-backdoor", "https://www.linkedin.com/posts/threatmon_xz-utils-backdoor-cve-2024-3094-activity-7181228442791641088-rw2a?utm_source=share&utm_medium=member_desktop", "https://www.openwall.com/lists/oss-security/2024/03/29/4", "https://twitter.com/fr0gger_/status/1774342248437813525", "https://www.wired.com/story/jia-tan-xz-backdoor/", "https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27", "https://medium.com/@DCSO_CyTec/xz-backdoor-how-to-check-if-your-systems-are-affected-fb169b638271", "https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094", "https://gynvael.coldwind.pl/?lang=en&id=782", "https://github.com/amlweems/xzbot" ], "synonyms": [ "xzorcist" ], "type": [] }, "uuid": "293b9d76-8e58-48bc-936b-e8dfb00f6f6c", "value": "xzbot" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/symbian.flexispy", "https://www.randhome.io/blog/2017/04/23/lets-talk-about-flexispy/" ], "synonyms": [], "type": [] }, "uuid": "9f85f4fc-1cce-4557-b3d8-b9ef522fafb2", "value": "FlexiSpy (symbian)" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/vbs.basicstar", "https://www.volexity.com/blog/2024/02/13/charmingcypress-innovating-persistence/" ], "synonyms": [], "type": [] }, "uuid": "ca86807d-5466-496a-b41f-4bde905f9064", "value": "BASICSTAR" }, { "description": "CageyChameleon Malware is a VBS-based backdoor which has the capability to enumerate the list of running processes and check for the presence of several antivirus products. CageyChameleon will collect user host information, system current process information, etc. The collected information is sent back to the C2 server, and continue to initiate requests to perform subsequent operations.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/vbs.cageychameleon", "https://www.proofpoint.com/us/blog/threat-insight/ta444-apt-startup-aimed-at-your-funds", "https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwjCk7uOzMP-AhXOYMAKHYtLCKkQFnoECBIQAQ&url=https%3A%2F%2Fi.blackhat.com%2FUSA-22%2FThursday%2FUS-22-Wikoff-Talent-Need-Not-Apply.pdf&usg=AOvVaw0deqd7ozZyRTfSBOBmlbiG", "https://threatbook.cn/ppt/The%2520Nightmare%2520of%2520Global%2520Cryptocurrency%2520Companies%2520-%2520Demystifying%2520the%2520%25E2%2580%259CDangerousPassword%25E2%2580%259D%2520of%2520the%2520APT%2520Organization.pdf", "https://blogs.jpcert.or.jp/ja/2023/05/dangerouspassword.html", "https://www.clearskysec.com/cryptocore-group/", "https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/offshore%20APT%20organization/DangerousPassword/2020-04-02/Analysis.md", "https://mp.weixin.qq.com/s/nnLqUBPX8xZ3hCr5u-iSjQ", "https://atlas-cybersecurity.com/cyber-threats/cryptocore-cryptocurrency-exchanges-under-attack/", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/", "https://www.proofpoint.com/us/daily-ruleset-update-summary-20190314", "https://www.clearskysec.com/wp-content/uploads/2020/06/CryptoCore_Group.pdf", "https://blogs.jpcert.or.jp/en/2019/07/spear-phishing-against-cryptocurrency-businesses.html", "https://sansorg.egnyte.com/dl/3P3HxFiNgL", "https://vb2020.vblocalhost.com/conference/presentations/unveiling-the-cryptomimic/", "https://www.clearskysec.com/wp-content/uploads/2021/05/CryptoCore-Lazarus-Clearsky.pdf", "https://cyberstruggle.org/delta/LeeryTurtleThreatReport_05_20.pdf" ], "synonyms": [ "Cabbage RAT" ], "type": [] }, "uuid": "ea71b7c1-79eb-4e9c-a670-ea75d80132f4", "value": "CageyChameleon" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/vbs.forbiks", "https://persianov.net/windows-worms-forbix-worm-analysis", "https://www.symantec.com/security_response/earthlink_writeup.jsp?docid=2017-090807-0934-99" ], "synonyms": [ "Forbix" ], "type": [] }, "uuid": "2ad12163-3a8e-4ece-969e-ac616303ebe1", "value": "forbiks" }, { "description": "According to ClearSky, this is a VBS-based wiper, deployed via exploitation of a vulnerable WinRAR version (CVE-2025-80880). They assess with medium confidence a link to Gamaredon.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/vbs.gamawiper", "https://x.com/clearskysec/status/1995061537183011084" ], "synonyms": [], "type": [] }, "uuid": "343e4c9d-8645-42a0-b2de-eca9f79734ff", "value": "GamaWiper" }, { "description": "According to HarfangLab, GammaDrop is a VBScript-based downloader that forms the first stage of a two-stage infection chain. It uses obfuscated VBScript stored in a stealthy data stream to fetch a second-stage HTA payload (GammaLoad) and execute it, achieving persistence via the Startup folder.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/vbs.gammadrop", "https://harfanglab.io/insidethelab/gamaredon-gammadrop-gammaload/" ], "synonyms": [], "type": [] }, "uuid": "6ded9a03-07c3-44a7-a89a-b9d73b400b88", "value": "GammDrop" }, { "description": "According to HarfangLab, GammaLoad is a second-stage VBScript/HTA payload that serves as a persistent beacon and downloader for the next payload. It runs in a two-layer VBScript framework, with an outer installer enabling RunOnce-style persistence and the inner layer using MSXML2.XMLHTTP to beacon to its C2 over Cloudflare-proxied infrastructure.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/vbs.gammaload", "https://harfanglab.io/insidethelab/gamaredon-gammadrop-gammaload/" ], "synonyms": [], "type": [] }, "uuid": "fcf754ed-b616-4da3-b603-fbc21f67b764", "value": "GammaLoad" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/vbs.ggldr", "https://www.forcepoint.com/blog/x-labs/carbanak-group-uses-google-malware-command-and-control" ], "synonyms": [], "type": [] }, "uuid": "8ca31b9b-6e78-4dcc-9d14-dfd97d44994e", "value": "GGLdr" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/vbs.glowspark", "https://inquest.net/blog/2022/02/10/380-glowspark" ], "synonyms": [], "type": [] }, "uuid": "ab6f8b6d-f0a0-4d2c-a81b-2dcb146914ea", "value": "GlowSpark" }, { "description": "", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/vbs.grinju", "https://medium.com/@vishal_thakur/grinju-downloader-anti-analysis-on-steroids-part-2-8d76f427c0ce", "https://medium.com/@vishal_thakur/grinju-malware-anti-analysis-on-steroids-part-1-535e72e650b8" ], "synonyms": [], "type": [] }, "uuid": "f0a64323-62a6-4c5a-bb3d-44bd3b11507f", "value": "Grinju Downloader" }, { "description": "The HALFBAKED malware family consists of multiple components designed to establish and maintain a foothold in victim networks, with the ultimate goal of gaining access to sensitive financial information.\r\nHALFBAKED listens for the following commands from the C2 server:\r\n\r\n info: Sends victim machine information (OS, Processor, BIOS and running processes) using WMI \r\n queries\r\n processList: Send list of process running\r\n screenshot: Takes screen shot of victim machine (using 58d2a83f777688.78384945.ps1)\r\n runvbs: Executes a VB script\r\n runexe: Executes EXE file\r\n runps1: Executes PowerShell script\r\n delete: Delete the specified file\r\n update: Update the specified file", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/vbs.halfbaked", "https://attack.mitre.org/software/S0151/", "https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf", "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html" ], "synonyms": [], "type": [] }, "uuid": "095c995c-c916-488e-944d-a3f4b9842926", "value": "HALFBAKED" }, { "description": "According to Sekoia, the aim of this backdoor is to receive VBS modules for execution from a remote C2 server. Once received, HATVIBE uses a simple XOR algorithm to decrypt each module, contact it between two