Threat Intelligence Directory

Downloader used in suspected APT attack against Vietnam.

Ransomware written in Nim.

Symantec describes this family as an unidentified tool set used to target a range of organizations in South East Asia. The campaign was first noticed in September 2020.

A RAT written in .NET, potentially used by Transparent Tribe.

Malware family identifying win.unidentified_083. Origin and technical characteristics tracked via Malpedia.

This Trojan is a full-featured RAT capable of executing common tasks such as command execution and downloading/uploading files. This is implemented through a couple dozen C++ classes such as CMFile, CMFile, CMProcess, TFileDownload, TDrive, TProcessInfo, TSock, etc. The first stage custom installer utilizes the same classes. The Trojan uses HTTP Server API to filter HTTPS packets at port 443 and parse commands. It is also used by attackers to gather a target’s data, make lateral movements and create SOCKS tunnels to their C2 using the Earthworm tunneler.Given that the Trojan is an HTTPS server itself, the SOCKS tunnel is used for targets without an external IP, so the C2 is able to send commands.

Suspected Zebrocy loader written in Nim.

Malware family identifying win.unidentified_077. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.unidentified_076. Origin and technical characteristics tracked via Malpedia.

Unpacked http_dll.dat from the blog post.

Malware family identifying win.unidentified_074. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.unidentified_073. Origin and technical characteristics tracked via Malpedia.

MSI-based loader that has been observed as a stager for win.metamorfo.

Malware family identifying win.unidentified_071. Origin and technical characteristics tracked via Malpedia.

Unidentified downloader, possibly related to KONNI.

Zeus derivate, no known public references.

Malware family identifying win.unidentified_068. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.unidentified_067. Origin and technical characteristics tracked via Malpedia.

This .net executable can receive commands from c2 sever, upload and download files according to the returned content, perform an uninstall, or modify the registry to achieve persistence across reboots. At the end, it downloads a Python-based RAT, called PeppyRAT.

Malware family identifying win.unidentified_063. Origin and technical characteristics tracked via Malpedia.

Was previously wrongly tagged as PoweliksDropper, now looking for additional context.

Malware family identifying win.unidentified_059. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.unidentified_058. Origin and technical characteristics tracked via Malpedia.

Unnamed portscanner as used in the Australian Parliament Hack (Feb 2019).

Malware family identifying win.unidentified_053. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.unidentified_052. Origin and technical characteristics tracked via Malpedia.

RAT written in Delphi used by Patchwork APT.

Malware family identifying win.unidentified_045. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.unidentified_044. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.unidentified_042. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.unidentified_041. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.unidentified_039. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.unidentified_038. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.unidentified_037. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.unidentified_031. Origin and technical characteristics tracked via Malpedia.

Unnamed ransomware that camouflages as a program performing system cleanup called "System Analyzer Pro".

Malware family identifying win.unidentified_029. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.unidentified_028. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.unidentified_025_clickfraud. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.unidentified_024_ransom. Origin and technical characteristics tracked via Malpedia.