Threat Intelligence Directory

Helper malware associated with AridGopher, which will provide an alternative persistence mechanism in case "360 total security" is found on a target system.

This malware is a Go written variant of Micropsia and according to DeepInstinct it is still in development.

Malware family tracked by Malpedia. ID: win.ariabody

During a campaign against a Ukrainian energy provider, a new loader of a new version of CaddyWiper called "ArguePatch" was observed by ESET researchers. ArguePatch is a modified version of Hex-Ray's Remote Debugger Server (win32_remote.exe). ArguePatch expects a decryption key and the file of the CaddyWiper shellcode as command line parameters.

AresLoader is a new malware "downloader" that has been advertised on some Russian language Dark Web forums “RAMP and "XSS" by a threat actor called "DarkBLUP". Researchers assess this loader is likely a legitimate penetration testing tool that is now being abused by threat actors. This is because of a similar project, dubbed “Project Ares,” was previously uploaded to GitHub as a proof-of-concept (PoC) by the well-regarded user and red teamer “CerberSec.” The loader mimics legitimate software to trick victims into executing malware with administrator rights on their machines. Additional features of the loader include: 1. Written in C/C++ 2. Supports 64-bit payloads 3. Makes it look like malware spawned by another process 4. Prevents non-Microsoft signed binaries from being injected into malware 5. Hides suspicious imported Windows APIs 6. Leverages anti-analysis techniques to avoid reverse engineering Furthermore, It was observed that SystemBC, Amadey, and several Raccoon Stealers were directly installing AresLoader. To date, the AresLoader downloader has been seen delivering payloads like SystemBC, Lumma Stealer, StealC, Aurora Stealer, and Laplas Clipper.

Ares is a Python RAT.

Malware family tracked by Malpedia. ID: win.arefty

According to f-secure, Ardamax is a commercial keylogger program that can be installed onto the system from the product's website.& When run, the program can capture a range of user activities, such as keystrokes typed, instant messenger chat logs, web browser activity and even screenshots of the active desktop. This program can be configured to a complete stealth mode, with password protection, to avoid user detection. The information gathered is stored in an encrypted log file, which is only viewable using the built-in Log Viewer. The log file can be sent to an external party through e-mail, via a local area network (LAN) or by upload to an FTP server (in either HTML or encrypted format).

Malware family tracked by Malpedia. ID: win.archer_rat

Malware family tracked by Malpedia. ID: win.arcane_stealer

Malware family tracked by Malpedia. ID: win.appleseed

Malware used by suspected Iranian threat actor Agrius, turned from wiper into ransomware.

According to Microsoft, ApolloShadow has the capability to install a trusted root certificate to trick devices into trusting malicious actor-controlled sites, enabling Secret Blizzard to maintain persistence on diplomatic devices, likely for intelligence collection. It has been used in a campaign where Secret Blizzard has been targeting embassies located in Moscow using an adversary-in-the-middle (AiTM) position.

This is an implant usable with the Mythic C2 framework. Apollo is a Windows agent written in C# using the 4.0 .NET Framework designed to be used in SpecterOps training offerings.

Malware family tracked by Malpedia. ID: win.apocalipto

Malware family tracked by Malpedia. ID: win.aperetif

A loader written in Go, tracked since at least October 2021 by ZeroFox. Originally named Kraken and rebranded to Anubis in February 2022.

BleepingComputer found that Anubis will display fake phishing login forms when users open up apps for targeted platforms to steal credentials. This overlay screen will be shown over the real app's login screen to make victims think it's a legitimate login form when in reality, inputted credentials are sent to the attackers. In the new version spotted by Lookout, Anubis now targets 394 apps and has the following capabilities: Recording screen activity and sound from the microphone Implementing a SOCKS5 proxy for covert communication and package delivery Capturing screenshots Sending mass SMS messages from the device to specified recipients Retrieving contacts stored on the device Sending, reading, deleting, and blocking notifications for SMS messages received by the device Scanning the device for files of interest to exfiltrate Locking the device screen and displaying a persistent ransom note Submitting USSD code requests to query bank balances Capturing GPS data and pedometer statistics Implementing a keylogger to steal credentials Monitoring active apps to mimic and perform overlay attacks Stopping malicious functionality and removing the malware from the device

Malware family tracked by Malpedia. ID: win.antilam

Malware family tracked by Malpedia. ID: win.anel

According to Proofpoint, AndroMut is a new downloader malware written in C++ that Proofpoint researchers began observing in the wild in June 2019. The “Andro” part of the name comes from some of the pieces which bear resemblance to another downloader malware known as Andromeda [1] and “Mut” is based off a mutex that the analyzed sample creates: “mutshellmy777”.

Malware family tracked by Malpedia. ID: win.andromeda

Malware family tracked by Malpedia. ID: win.andardoor

Recon/Loader malware attributed to Lazarus, disguised as Notepad++ shell extension.

Malware family tracked by Malpedia. ID: win.anchormail

Anchor is a sophisticated backdoor served as a module to a subset of TrickBot installations. Operating since August 2018 it is not delivered to everybody, but contrary is delivered only to high-profile targets. Since its C2 communication scheme is very similar to the one implemented in the early TrickBot, multiple experts believe it could be attributed to the same authors.

Anatova is a ransomware family with the goal of ciphering all the files that it can and then requesting payment from the victim. It will also check if network shares are connected and will encrypt the files on these shares too. The code is also prepared to support modular extensions.

Malware family tracked by Malpedia. ID: win.amtsol

Amatera is a stealer written in C++. It conducts anti-sandbox analysis before enumerating browsers, exfiltrating found cryptocurrency files/wallets and possibly credentials.

Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.

Malware family tracked by Malpedia. ID: win.alureon

Alreay is a remote access trojan that uses HTTP(S) or TCP for communication with its C&C server. It uses either RC4 or DES for encryption of its configuration, which is stored in the registry. It sends detailed information about the victim's environment, like computer name, Windows version, system locale, and network configuration. It supports almost 25 commands that include operations on the victim’s filesystem, basic process management, file exfiltration, command line execution, and process injection of an executable downloaded from the attacker’s C&C server. As in many RATs from Lazarus arsenal, the commands are indexed by 32-bit integers, starting with values like 0x21A8B293, 0x23FAE29C or 0x91B93485. It comes either as an EXE or as a DLL with the internal DLL name t_client_dll.dll. It may contain statically linked code from open-source libraries like Mbed TLS or zLib (version 1.0.1). Alreay RAT was observed in 2016-2017, running on networks of banks operating SWIFT Alliance software.

Malware family tracked by Malpedia. ID: win.alphaseed

Malware family tracked by Malpedia. ID: win.alphanc

Malware family tracked by Malpedia. ID: win.alpc_lpe

According to Threatray, AlmondRAT is a .NET Remote Access Trojan deployed by the Bitter APT group. It is capable of collecting system information, modifying and exfiltrating data and allows for remote command execution and shares similar functionality with BDarkRAT.

Malware family tracked by Malpedia. ID: win.alma_locker

Malware family tracked by Malpedia. ID: win.alma_communicator

Malware family tracked by Malpedia. ID: win.almanahe

Allcome is classified as a clipper malware. Clippers are threats designed to access information saved in the clipboard (the temporary buffer space where copied data is stored) and substitute it with another. This attack is targeted at users who are active in the cryptocurrency sector mainly.