Threat Intelligence Directory

Malware family identifying win.opcjacker. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.opachki. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.oopsie. Origin and technical characteristics tracked via Malpedia.

A spambot that has been observed being used for spreading Ursnif, Zeus Panda, Andromeda or Netflix phishing against Italy and Canada.

OnionDuke is a new sophisticated piece of malware distributed by threat actors through a malicious exit node on the Tor anonymity network appears to be related to the notorious MiniDuke, researchers at F-Secure discovered. According to experts, since at least February 2014, the threat actors have also distributed the threat through malicious versions of pirated software hosted on torrent websites.

Ransomware.

Malware family identifying win.onhat. Origin and technical characteristics tracked via Malpedia.

According to Symantec, this malware has been deployed against IT services companies in the U.S. and Europe. A multi-stage backdoor, the first stage is a downloader that authenticates to Microsoft Graph API and downloads the second stage payload from OneDrive and executes it. The main payload will download a publicly available file from GitHub. It will then create a folder in OneDrive named deviceId_n_<ip address> for each infected machine and upload a file to OneDrive to signal the attackers the status of a new infection.

Malware which seems to have no function other than to disrupt computer systems related to the 2018 Winter Olympic event.

According to FireEye, OLDBAIT is a credential stealer that has been observed to be used by APT28. It targets Internet Explorer, Mozilla Firefox, Eudora, The Bat! (an email client by a Moldovan company), and Becky! (an email client made by a Japanese company). It can use both HTTP or SMTP to exfiltrate data. In some places it is mistakenly named "Sasfis", which however seems to be a completely different and unrelated malware family.

a new, previously unknown backdoor that we named Okrum. The malicious actors behind the Okrum malware were focused on the same targets in Slovakia that were previously targeted by Ketrican 2015 backdoors.

Malware family identifying win.odinaff. Origin and technical characteristics tracked via Malpedia.

Spam bot that was active around 2007 and after, one of the first malware families to use a domain generation algorithm.

Malware family identifying win.oddjob. Origin and technical characteristics tracked via Malpedia.

Octowave Loader is a malware loader used to run other families of malware. This is often made up of an MSI or Inno Setup installer for a legitimate piece of software that has been trojanised to include a number of malicious DLLs which inevitably load and run malicious code often stored within a WAV file that is also delivered to an endpoint. In the wild this has been seen delivered through fake software installers and ClickFix / Fake Captcha campaigns. Families of malware deployed often include information stealers, NetSupport RAT, and potentially bots like Danabot.

Malware family identifying win.octorat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.octopus. Origin and technical characteristics tracked via Malpedia.

Emanuele De Lucia summarizes that this wiper was sent to potential targets in phishing mails that impersonated ESET as a follow up to a breach of its Israeli distributor Comsecure.

Malware family identifying win.oceansalt. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.oceanmap. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.observer_stealer. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.obscene. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.oblique_rat. Origin and technical characteristics tracked via Malpedia.

OATBOAT is a loader that loads and executes shellcode payloads.

Malware family identifying win.nyxem. Origin and technical characteristics tracked via Malpedia.

According to bin.re, in April 2018 a new version of Nymaim appeared, that has dropped previous obfuscation, and uses a new wordlist based DGA (Domain Generation Algorithm).

Nymaim is a trojan downloader. It downloads (and runs) other malware on affected systems and was one of the primary malware families hosted on Avalanche. Nymaim is different in that it displays a localized lockscreen while it downloads additional malware. Nymaim is usually delivered by exploit kits and malvertising.

Malware family identifying win.nworm. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.nvisospit. Origin and technical characteristics tracked via Malpedia.

According to PCrisk, Numando is a banking trojan written in the Delphi programming language. As the malicious program's classification implies, it is designed to steal banking information. Numando primarily targets Brazil, with seldom campaigns occurring in Mexico and Spain.

Nullmixer is a dropper/loader for additional malware. It is known to drop a vast amount of different malware, such as info stealers, rats and additional loaders. Samples observed contained up to 8 additional payloads.

NSFOCUS describes PhantomNugget as a modularized malware toolkit, that was spread using EternalBlue. Payloads included a RAT and a XMRig miner.

Ntospy is a credential stealer leveraging a well-established technique of abusing the Windows Network Provider interface, a method documented as early as 2004 and exemplified by tools like NPPSpy. Posing as a legitimate Network Provider DLL, Ntospy injects itself into the Windows authentication process, hijacking login attempts to harvest user credentials. It achieves this by registering a malicious Network Provider, typically named "credman," which intercepts authentication requests and redirects them to it malicious DLL. Instead of immediately exfiltrating the stolen data, Ntospy employs a form of local storage, writing the captured credentials in cleartext to files disguised as harmless Microsoft Update packages using the .msu file extension. These files are often planted in system directories with believable names like "c:/programdata/package cache/windows10.0-kb5009543-x64.msu," further masking their malicious purpose. Adding to its stealth, Ntospy incorporates obfuscation techniques to evade detection. This includes using seemingly innocuous filenames for its DLL, often mimicking critical system files like "ntoskrnl.dll" to blend in. Some variants even go a step further by encrypting the credential storage file path within the DLL, requiring analysis and decryption to uncover its full functionality.

Malware family identifying win.nspx30. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.nransom. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.no_justice. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.nozelesn_decryptor. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.noxplayer. Origin and technical characteristics tracked via Malpedia.

Nova Stealer is a new information stealer that is offered as Malware-as-a-Service by a new French-speaking actor called "Nova Sentinel". Its capabilities include password stealing, browser injections, crypto wallet stealing, discord injections, and screen recordings. Parts of its source code have been made available on GitHub, with certain "Premium" features missing.

According to PCrisk, Nosu is the name of a malicious program classified as a stealer. This malware is designed to steal information from infected machines. The Nosu stealer can extract a wide variety of data from devices and installed applications. The most active campaigns associated with Nosu were noted in North and South America, as well as Southeast Asia.