Threat Intelligence Directory

According to HarfangLab, SloppyMIO is written in C#. It retrieves its configuration steganographically from images whose URLs are obtained via a Dead Drop Resolver (DDR) backed by GitHub. From these images, it extracts a XOR key, Telegram bot token and chat ID, and module URLs from an LSB-hidden payload. The malware can fetch and cache multiple modules from remote storage, run arbitrary commands, collect and exfiltrate files and deploy further malware with persistence via scheduled tasks. SloppyMIO beacons status messages, polls for commands and sends exfiltrated files over to a specified operator leveraging the Telegram Bot API for command-and-control.

Malware family identifying win.slnrat. Origin and technical characteristics tracked via Malpedia.

According to VK9 Seecurity, Sliver is a Command and Control (C2) system made for penetration testers, red teams, and advanced persistent threats. It generates implants (slivers) that can run on virtually every architecture out there, and securely manage these connections through a central server. Sliver supports multiple callback protocols including DNS, TCP, and HTTP(S) to make egress simple, even when those pesky blue teams block your domains. You can even have multiple operators (players) simultaneously commanding your sliver army.

According to Proofpoint, SlipScreen is a first stage loader and has variants written in Rust and in C++. Its crypter is updated for each campaign, making static detection difficult.

- 2012 first sighted - Attack vector via compromised Mikrotik routers where victims get infection when they connect to Mikrotik router admin software - Winbox - 2018 when discovered by Kaspersky Team Infection Vector - Infected Mikrotik Router > Malicious DLL (IP4.dll) in Router > User connect via winbox > Malicious DLL downloaded on computer

According to CERT-UA, this is a malware developed using the C++ programming language. The main functional purpose is the production of screenshots.

Malware family identifying win.slickshoes. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.slave. Origin and technical characteristics tracked via Malpedia.

Ransomware.

Malware family identifying win.skyplex. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.skynet. Origin and technical characteristics tracked via Malpedia.

Skuld, also known as TMPN Stealer, is an information-stealing malware written in Golang (Go) that emerged in May 2023.

Malware family identifying win.skipper. Origin and technical characteristics tracked via Malpedia.

A Microsoft SQL Server backdoor

Malware family identifying win.skinnyboy. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.skimer. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.sisfader. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.sinowal. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.simplefilemover. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.simda. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.siluhdur. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.silon. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.silent_sweeper. Origin and technical characteristics tracked via Malpedia.

According to Mandiant, SILENTUPLOADER is an uploader written in MSIL that is dropped by DOSTEALER and is designed to work specifically in tandem with it. It checks for files in a specified folder every 30 seconds and uploads them to a remote server.

Malware family identifying win.silentgh0st. Origin and technical characteristics tracked via Malpedia.

According to PCrisk, Truebot, also known as Silence.Downloader, is a malicious program that has botnet and loader/injector capabilities. This malware can add victims' devices to a botnet and cause chain system infections (i.e., download/install additional malicious programs/components). There is significant variation in Truebot's infection chains and distribution. It is likely that the attackers using this malicious software will continue to make such changes.

Malware family identifying win.sihost. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.sigloader. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.siggen6. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.siesta_graph. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.sierras. Origin and technical characteristics tracked via Malpedia.

Ransomware used by threat actor group DEV-0530, attributed by MSTIC to North Korean origin.

Ransomware used by threat actor group DEV-0530, attributed by MSTIC to North Korean origin.

Malware family identifying win.sidewinder. Origin and technical characteristics tracked via Malpedia.

Shellcode-based malware family that according to ESET Research was likely written by the same authors as win.crosswalk.

Malware family identifying win.sidetwist. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.shylock. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.shurl0ckr. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.shurk. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.shujin. Origin and technical characteristics tracked via Malpedia.