Malpedia Library

2018-01-23 ⋅ Threatpost ⋅ Tom Spring
Satori Author Linked to New Mirai Variant Masuta
Masuta

2018-01-23 ⋅ Möbius Strip Reverse Engineering ⋅ Rolf Rolles
A Walk-Through Tutorial, with Code, on Statically Unpacking the FinSpy VM: Part One, x86 Deobfuscation
FinFisher RAT

2018-01-23 ⋅ NewSky Security ⋅ NewSky Security
Masuta: Satori Creators' Second Botnet Weaponizes A New Router Exploit
Masuta Nexus Zeta

2018-01-23 ⋅ Confiant ⋅ Jerome Dangu
Uncovering 2017’s Largest Malvertising Operation
HURRICANE PANDA

2018-01-23 ⋅ RiskIQ ⋅ Yonathan Klijnsma
Espionage Campaign Leverages Spear Phishing, RATs Against Turkish Defense Contractors
Remcos

2018-01-22 ⋅ Yoroi ⋅ Antonio Farina, Antonio Pirozzi, Luigi Martire
Operation EvilTraffic
EvilTraffic

2018-01-22 ⋅ ZDNet ⋅ Danny Palmer
This hacking gang just updated the malware it uses against UK targets
Turla

2018-01-18 ⋅ Lookout ⋅ Andrew Blaich, Apurva Kumar, Cooper Quintin, Eva Galperin, Jeremy Richards, Michael Flossman
Dark Caracal: Cyber-espionage at a Global Scal
CrossRAT Bandook Dark Caracal

2018-01-18 ⋅ NetScout ⋅ Kirk Soluk, Matt Bing, Pete Arzamendi
The ARC of Satori
Satori

2018-01-17 ⋅ Bleeping Computer ⋅ Catalin Cimpanu
Exobot Author Calls It Quits and Sells Off Banking Trojan Source Code
ExoBot

2018-01-17 ⋅ Malwarebytes ⋅ hasherezade
A coin miner with a “Heaven’s Gate”
Coinminer

2018-01-17 ⋅ FireEye ⋅ Swapnil Patil, Yogesh Londhe
Microsoft Office Vulnerabilities Used to Distribute Zyklon Malware in Recent Campaign
Zyklon

2018-01-17 ⋅ 360 netlab ⋅ RootKiter
Art of Steal: Satori Variant is Robbing ETH BitCoin by Replacing Wallet Address
Satori

2018-01-16 ⋅ Opcode Security research ⋅ ntopcode
Anatomy of the thread suspension mechanism in Windows (Windows Internals)

2018-01-16 ⋅ RiskIQ ⋅ Yonathan Klijnsma
First Activities of Cobalt Group in 2018: Spear Phishing Russian Banks
Cobalt

2018-01-16 ⋅ Cylance ⋅ Cylance Threat Research Team
Threat Spotlight: LockPOS Point of Sale Malware
LockPOS

2018-01-15 ⋅ Trend Micro ⋅ Alfredo Oliveira, Gilbert Sison, Jay Yaneza, Rheniel Ramos
New KillDisk Variant Hits Financial Organizations in Latin America
KillDisk (Lazarus) Lazarus Group

2018-01-13 ⋅ The Washington Post ⋅ Ellen Nakashima
Russian military was behind ‘NotPetya’ cyberattack in Ukraine, CIA concludes
EternalPetya

2018-01-12 ⋅ Malwarebytes ⋅ Jérôme Segura
Fake Spectre and Meltdown patch pushes Smoke Loader malware
SmokeLoader

2018-01-12 ⋅ Stormshield ⋅ Rémi Jullian
Analyzing an Agent Tesla campaign: from a word document to the attacker credentials
Agent Tesla