Threat Intelligence Directory

Malware family identifying win.sorano. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.somnia. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.sombrat. Origin and technical characteristics tracked via Malpedia.

Ransomware, written in .NET.

Unit 42 notes that they identified a new version of SolarMarker, a malware family known for its infostealing and backdoor capabilities, mainly delivered through search engine optimization (SEO) manipulation to convince users to download malicious documents. Some of SolarMarker’s capabilities include the exfiltration of auto-fill data, saved passwords and saved credit card information from victims’ web browsers. Besides capabilities typical for infostealers, SolarMarker has additional capabilities such as file transfer and execution of commands received from a C2 server. The malware invests significant effort into defense evasion, which consists of techniques like signed files, huge files, impersonation of legitimate software installations and obfuscated PowerShell scripts.

Malware family identifying win.solarbot. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.solar. Origin and technical characteristics tracked via Malpedia.

This is a RAT that is usually loaded with one or more shellcode and/or reflective DLL injection techniques. The RAT uses RC4 or a hardcoded RSA key for traffic encryption/decryption. Its communication can either happen via a raw TCP socket or a HTTP POST request. Depending on the version, the RAT may remotely execute DLLs or shellcode.

Malware family identifying win.socksbot. Origin and technical characteristics tracked via Malpedia.

The Socks5 Systemz malware is a proxy botnet distributed via the PrivateLoader and Amadey loaders. Active since at least 2016, this botnet infects devices to use them as proxies for malicious activities, offering access for prices ranging from $1 to $140 per day in cryptocurrency. It employs a domain generation algorithm (DGA) to evade detection and enhance its resilience. Persistence is maintained through a Windows service named ContentDWSvc, with the malware injected into memory via a file called previewer.exe. To date, it has compromised approximately 10,000 devices globally, excluding Russia.

Sockbot is a customized and in Go written fork of the Ligolo reverse tunneling open-source tool. Several modification were performed by the threat actors who rewrote that code, e.g. execution checks, hardcoded values. Ligolo: https://github.com/sysdream/ligolo

Socelars is an infostealer with main focus on: * Facebook Stealer (ads/manager) * Cookie Stealer | AdsCreditCard {Amazon}

Malware family identifying win.sobig. Origin and technical characteristics tracked via Malpedia.

According to ESET, this RAT was derived from (the open-source) Quasar RAT.

Malware family identifying win.snslocker. Origin and technical characteristics tracked via Malpedia.

Information stealer, written in Rust.

Malware family identifying win.snojan. Origin and technical characteristics tracked via Malpedia.

SnipVex is a virus that infects files with .exe extension via prepending itself to the host. It is written in .NET. It has a clipbanker as payload.

Malware family identifying win.snifula. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.sneepy. Origin and technical characteristics tracked via Malpedia.

A downloader trojan with some infostealer capabilities focused on the browser. Previously observed as part of RigEK campaigns.

Malware observed in the SnatchCrypto campaign, attributed by Kaspersky Labs to BlueNoroff with high confidence.

Snatch is a ransomware which infects victims by rebooting the PC into Safe Mode. Most of the existing security protections do not run in Safe Mode so that it the malware can act without expected countermeasures and it can encrypt as many files as it finds. It uses common packers such as UPX to hide its payload.

Malware family identifying win.snappybee. Origin and technical characteristics tracked via Malpedia.

According to X-Force, SnakeDisk is a USB worm, dropping further payloads

Snake Ransomware is a Golang ransomware reportedly containing obfuscation not typically seen in Golang ransomware. This malware will remove shadow copies and kill processes related to SCADA/ICS devices, virtual machines, remote management tools, network management software, and others. After this, encryption of files on the device commences, while skipping Windows system folders and various system files. A random 5 character string is appended to encrypted files. According to Bleeping Computer, this ransomware takes an especially long time to encrypt files on a targeted machine. This ransomware is reported to target an entire network, rather than individual workstations.

Malware family identifying win.sn0wslogger. Origin and technical characteristics tracked via Malpedia.

Ransomware.

Malware family identifying win.smominru. Origin and technical characteristics tracked via Malpedia.

The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.

According to Mandiant, SMOKEDHAM is dropped through a powershell script that contains the (C#) source code for this backdoor, which is stored in an encrypted variable. The dropper dynamically defines a cmdlet and .NET class for the backdoor, meaning the compiled code is only found in memory.

According to PCrisk, Smaug ransomware is available for download on the dark web: it is for sale as Ransomware as a Service (RaaS). Therefore, cyber criminals who purchase it can perform ransomware attacks without having to develop malware of this type. Smaug is designed to encrypt files, rename them and create a ransom message.

Malware family identifying win.smartloader. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.smarteyes. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.smanager. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.smackdown. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.smac. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.slub. Origin and technical characteristics tracked via Malpedia.

According to ESET, SlowStepper is a feature-rich backdoor with a toolkit of more than 30 components, programmed in C++, Python, and Go.

According to MITRE, SLOTHFULMEDIA is a remote access Trojan written in C++ that has been used by an unidentified "sophisticated cyber actor" since at least January 2017. It has been used to target government organizations, defense contractors, universities, and energy companies in Russia, India, Kazakhstan, Kyrgyzstan, Malaysia, Ukraine, and Eastern Europe.