Threat Intelligence Directory

Malware family identifying win.rctrl. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.rcs. Origin and technical characteristics tracked via Malpedia.

A family identified by ESET Research in the InvisiMole campaign.

Razy is a malware family which uses a malicious browser extension in order to steal cryptocurrency.

Malware family identifying win.razr. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.rawpos. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.rawdoor. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.ravenstealer. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.ratsnif. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.raton_rat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.ratel. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.ratankbapos. Origin and technical characteristics tracked via Malpedia.

This is a backdoor that establishes persistence using the Startup folder. It communicates to its C&C server using HTTPS and a static HTTP User-Agent string. QUICKRIDE is capable of gathering information about the system, downloading and loading executables, and uninstalling itself. It was leveraged against banks in Poland.

Worm spread by external drives that leverages Windows Installer to reach out to QNAP-associated domains and download a malicious DLL.

This ransomware encrypts all user’s data on the PC (photos, documents, excel tables, music, videos, etc), adds its specific extension to every file, and creates the HOW_TO_DECYPHER_FILES.txt files in every folder which contains encrypted files.

Malware family identifying win.rarog. Origin and technical characteristics tracked via Malpedia.

A spy trojan is a type of malware that has the capability to gather information from the infected system without consent from the user. This information is then sent to a remote attacker.

InfinityGroup notes that Rapid Ransomware, unlike regular Ransomware, stays active on the computer after initially encrypting the systems and also encrypts any new files that are created. It does this by creating auto-runs that are designed to launch the ransomware and display the ransom note every time the infected system is started.

Ransomware SNC is a ransomware who encrypts files and asks for a variable amount of Bitcoin before releasing the decryption key to your files. The threat actor asks to be contacted for negotiating the right ransom fee.

Malware family identifying win.ransomlock. Origin and technical characteristics tracked via Malpedia.

Ransomware written in Golang and obfuscated with Gobfuscate, with significant code overlap to Knight ransomware.

RansomExx is a ransomware family that targeted multiple companies starting in mid-2020. It shares commonalities with Defray777.

Malware family identifying win.ransoc. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.ranscam. Origin and technical characteristics tracked via Malpedia.

Ransomware.

Malware family identifying win.ranbyus. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.ramsay. Origin and technical characteristics tracked via Malpedia.

According to Check Point, Ramnit is primarily a banking trojan, meaning that its purpose is to steal login credentials for online banking, which cybercriminals can sell or use in future attacks. For this reason, Ramnit primarily targets individuals rather than focusing on particular industries. Ramnit campaigns have been observed to target organizations in particular industries. For example, a 2019 campaign targeted financial organizations in the United Kingdom, Italy, and Canada.

Malware family identifying win.ramdo. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.rambo. Origin and technical characteristics tracked via Malpedia.

A ransomware written in Rust.

Malware family identifying win.rakhni. Origin and technical characteristics tracked via Malpedia.

Raindrop is a loader for Cobalt Strike that was observed in the SolarWinds attack.

According to Trend Micro, RAILSETTER is a persistence installer component designed to work with RAILLOAD. Its main functions include: Copying and renaming RAILLOAD’s intended host from System32 to the intended target directory; Timestomping RAILLOAD and its host’s create, access, and modify time; Creating a scheduled task for persistence.

According to Bleeping Computer, the ransomware is used in targeted attacks against unpatched Citrix servers. It excludes Russian and Chinese targets using the system's Language ID for filtering. It also tries to disable Windows Defender and has a number of UNIX filepath references in its strings. Encryption method is AES using a dynamically generated key, then bundling this key up via RSA.

Malware family identifying win.ragnarlocker. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.radrat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.radamant. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.rad. Origin and technical characteristics tracked via Malpedia.

Racket Downloader is an HTTP(S) downloader. It uses a custom substitution cipher for decryption of its character strings, and RC5 with a 256-bit key for encryption and decryption of network traffic. It sends an HTTP POST request containing a particular value that inspired its name, like "?product_field=racket" or "prd_fld=racket". Racket Downloader was deployed against South Korean targets running the Initech INISAFE CrossWeb EX software in Q2 2021 and Q1 2022.