Threat Intelligence Directory

Danbot is a backdoor malware that is originally written in C#. Recent versions of Danbot are written in C++. Danbot is capable of giving a remote attacker remote access features such as running a cmd command, upload and download files, move and copy files. The backdoor commands are transmitted by either using HTTP or DNS protocols. The commands are encapsulated in an XML file that gets stored in disk. Danbot's backdoor component picks up the XML file where it decodes and decrypts the commands.

Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social engineering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on “quality over quantity” in email-based threats. DanaBot’s modular nature enables it to download additional components, increasing the flexibility and robust stealing and remote monitoring capabilities of this banker.

Malware family identifying win.dairy. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.dadstache. Origin and technical characteristics tracked via Malpedia.

DADJOKE was discovered as being distributed via email, targeting a South-East Asian Ministry of Defense. It is delivered as an embedded EXE file in a Word document using remote templates and a unique macro using multiple GET requests. The payload is deployed using load-order hijacking with a benign Windows Defender executable. Stage 1 has only beacon+download functionality, made to look like a PNG file. Additional analysis by Kaspersky found 8 campaigns over 2019 and no activity prior to January 2019, DADJOKE is attributed with medium confidence to APT40.

According to PCrisk, Dacls is the name of a remote access Trojan (RAT), a malicious program that allows cyber criminals to control infected computers remotely. Research shows that this malware is tied to Lazarus Group (a group of cyber criminals) and targets Linux and the Windows Operating System. Typically, cyber criminals use RATs to steal sensitive, confidential information, infect systems with other malware, and so on. In any case, no RAT is harmless and should be uninstalled immediately.

Malware family identifying win.cysxl. Origin and technical characteristics tracked via Malpedia.

According to gdatasoftware, Cyrat ransomware uses Fernet to encrypt files. This is a symmetric encryption method meant for small data files that fit into RAM. While Fernet is not unusual itself, it is not common for ransomware and in this case even problematic.

According to HarfangLabs, Cyclops is a malware platform written in Go which dates back to December 2023, and that they believe has been deployed against targets in the Middle-East in 2024. Cyclops allows operators to execute arbitrary commands on the target’s file system, as well as pivot inside the infected network. Notably, Cyclops is controlled through a HTTP REST API which is exposed to operators within an SSH tunnel.

Malware family identifying win.cycbot. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.cyber_splitter. Origin and technical characteristics tracked via Malpedia.

According to Subex Secure, CyberGate is a Remote Access Trojan (RAT) that allows an attacker to gain unauthorized access to the victim’s system. Attackers can remotely connect to the compromised system from anywhere around the world. The Malware author generally uses this program to steal private information like passwords, files, etc. It might also be used to install malicious software on the compromised systems.

Malware family identifying win.cutwail. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.cutlet. Origin and technical characteristics tracked via Malpedia.

CustomerLoader is a .Net-based loader that drops more than 40 different malware families. It appeared in June 2023 and is being distributed via phishing, YouTube videos and malicious websites.

Ransomware.

Malware family identifying win.curlback. Origin and technical characteristics tracked via Malpedia.

Profero describes this as a ransomware family using CryptoPP as library to enable file encryption with the Salsa20 algorithm and protecting the encryption keys with RSA2048.

Potential Lazarus sample.

Malware family identifying win.cueisfry. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.cuegoe. Origin and technical characteristics tracked via Malpedia.

Ransomware.

Malware family identifying win.ctb_locker. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.csharpstreamer. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.csext. Origin and technical characteristics tracked via Malpedia.

Ransomware.

Malware family identifying win.crystal_ransom. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.cryptxxxx. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.crypto_ransomeware. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.crypto_fortress. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.cryptowire. Origin and technical characteristics tracked via Malpedia.

CryptoWall is a ransomware, is usually spread by spam and phishing emails, malicious ads, hacked websites, or other malware and uses a Trojan horse to deliver the malicious payload.

Malware family identifying win.cryptoslay. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.cryptoshuffler. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.cryptoshield. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.cryptorium. Origin and technical characteristics tracked via Malpedia.

CryptoPatronum is a ransomware that encrypts user data through AES-256 (CBC) and it asks for BTC / ETH in order to get back the original files. In the ransom note there is not a title but only a reference to crsss.exe: its original file name. Once the files are encrypted, CryptoPatronum adds a .enc extension.

A variant of CryptoMix is win.clop.

Malware family identifying win.cryptoluck. Origin and technical characteristics tracked via Malpedia.

CryptoLocker is a new sophisticated malware that was launched in the late 2013. It is designed to attack Windows operating system by encrypting all the files from the system using a RSA-2048 public key. To decrypt the mentioned files, the user has to pay a ransom (usually 300 USD/EUR) or 2 BitCoins.