Threat Intelligence Directory

Malware family tracked by Malpedia. ID: win.csext

Ransomware.

Malware family tracked by Malpedia. ID: win.crystal_ransom

Malware family tracked by Malpedia. ID: win.cryptxxxx

Malware family tracked by Malpedia. ID: win.cryptowire

CryptoWall is a ransomware, is usually spread by spam and phishing emails, malicious ads, hacked websites, or other malware and uses a Trojan horse to deliver the malicious payload.

Malware family tracked by Malpedia. ID: win.cryptoslay

Malware family tracked by Malpedia. ID: win.cryptoshuffler

Malware family tracked by Malpedia. ID: win.cryptoshield

Malware family tracked by Malpedia. ID: win.cryptorium

Malware family tracked by Malpedia. ID: win.cryptoluck

Malware family tracked by Malpedia. ID: win.cryptodarkrubix

Malware family tracked by Malpedia. ID: win.cryptoclippy

CrypticConvo is a dropper trojan which appears to be embedded in an automatic generator framework to deliver the FakeM trojan. According to PaloaltoNetworks CrypticConvo and several additional trojans are believed to be included in a meta framework used by the "Scarlet Mimic" threat actor in order to quickly evade AV systems.

A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.

Malware family tracked by Malpedia. ID: win.crypt0l0cker

Malware family tracked by Malpedia. ID: win.crypmic

Malware family tracked by Malpedia. ID: win.crutch

Malware family tracked by Malpedia. ID: win.cruloader

According to Trend Micro, this is a custom loader for win.cobalt_strike, used by Earth Longzhi (a subgroup of APT41).

According to FireEye, CROSSWALK is a skeletal, modular backdoor capable of system survey and adding modules in response to C&C replies.

Ransomware.

According to ThreatConnect, CrimsonIAS is a Delphi-written backdoor dating back to at least 2017. It enables operators to run command line tools, exfiltrate files, and upload files to the infected machine. CrimsonIAS is notable as it listens for incoming connections only; making it different from typical Windows backdoors that beacons out.

It was first discovered in 2017 and has since been used to attack organizations around the world. The malware is often distributed through phishing emails or by exploiting vulnerabilities in outdated security software. Once Crimson RAT is installed on a computer, it can be used to steal data, spy on users, and even take control of the infected computers. Some of the features of Crimson RAT include: Remote control of infected computers Data theft, such as passwords, files, and emails User spying Takeover of infected computers Locking of infected computers Extortion of payments

Malware family tracked by Malpedia. ID: win.crenufs

Malware family tracked by Malpedia. ID: win.creep_exfil

Malware family tracked by Malpedia. ID: win.creepysnail

Malware family tracked by Malpedia. ID: win.credraptor

Malware family tracked by Malpedia. ID: win.credomap

A tool that implements the creation of a hidden account on Windows through cloning accounts via the Registry.

Malware family tracked by Malpedia. ID: win.creamsicle

According to Cisco Talos, CRAT is a remote access trojan with plugin capabilites, used by Lazarus since at least May 2020.

Malware family tracked by Malpedia. ID: win.cradlecore

CRACKSHOT is a downloader that can download files, including binaries, and run them from the hard disk or execute them directly in memory. It is also capable of placing itself into a dormant state.

According to ANY.RUN, this is a dropper for win.privateloader and its execution will lead to a cascade of downloads with a large variety of additional malware. The families include more loaders, information stealers, cryptominers, a proxy bot, and ultimately also ransomware. The execution order is orchestrated, e.g. as in data is stolen and exfiltrated before encryption. It is distributed through advertized cracked software, e.g. IDA Pro.

CozyDuke is not simply a malware toolset; rather, it is a modular malware platform formed around a core backdoor component. This component can be instructed by the C&C server to download and execute arbitrary modules, and it is these modules that provide CozyDuke with its vast array of functionality. Known CozyDuke modules include: • Command execution module for executing arbitrary Windows Command Prompt commands • Password stealer module • NT LAN Manager (NTLM) hash stealer module • System information gathering module • Screenshot module

PCRisk notes that CoViper is yet another Coronavirus/COVID-19-themed malware infection, most likely proliferated as a file related to the pandemic. It operates by rewriting the system Master Boot Record (MBR). It does not delete the original, but rather creates a backup and replaces it with a custom MBR. Typically, malicious software that modifies MBRs do so to prevent the Operating System (OS) from being booted (i.e., started). It also displays a screen-encompassing message, often containing a ransom message - this disables user access to the device.

Destructive "joke" malware that ultimately deploys a wiper for the MBR.

Covicli is a modified SSLeay32 dynamic library designated as a backdoor. The dynamic library allows the attacker to communicate with the C2 over openSSL.

Malware family tracked by Malpedia. ID: win.cova