MALWARE FAMILY DESCRIPTIONS

AgentTesla

AgentTesla AgentTesla is an advanced RAT functioning as a keylogger and information stealer that is capable of monitoring and collecting the victim’s keyboard input, taking screenshots, and exfiltrating credentials to a variety of software installed on a victim’s machine (including Google Chrome, Mozilla Firefox and the Microsoft Outlook email client).

Akira

Akira Ransomware, first reported in the beginning of 2023, targets both Windows and Linux systems. It uses symmetric encryption with CryptGenRandom() and Chacha 2008 for file encryption and is similar to the leaked Conti v2 ransomware. Akira is distributed through various means, including infected email attachments and exploits in VPN endpoints. Upon infection, it encrypts data and appends a “.akira” extension to file names, then presents a ransom note demanding payment for decryption.

ALPHV

BlackCat (aka ALPHV) operates in a ransomware-as-a-service (RaaS) business model. BlackCat ransomware is highly customizable and allows for attacks on a wide range of corporate environments. It targets both Linux and Windows systems, and is coded in Rust.

AZORult

AZORult is a Trojan that gathers and exfiltrates data from the infected system. Once the malware is installed on a system it can send saved passwords, local files, crypto-wallet data, and computer profile information to a remote C&C server.

BiBi Wiper

BiBi Wiper is a data-wiping malware targeting both Windows and Linux systems. Initially identified in attacks against Israeli targets, it’s known for its destructive capabilities, and is designed to overwrite data in targeted directories with junk data and append a “.BiBi” extension to filenames.

CACTUS

CACTUS Ransomware is a destructive malware that encrypts files on a victim’s computer and adds a unique “.CTS1” extension to each encrypted file. The ransomware is known for exploiting vulnerabilities in network systems, particularly VPN appliances, to gain access and spread within targeted networks. It employs OpenSSL for encryption using AES and RSA.

CLOP

CL0P is a ransomware that was first discovered in early 2019 and mostly targets large firms and corporations. Cl0P is operated by a Russian-language cybercriminal gang and employs a “steal, encrypt, and leak” strategy. It gained recent notoriety for exploiting vulnerabilities in public-facing infrastructure like Accellion FTA and MOVEit Transfer, enabling it to exfiltrate and encrypt sensitive data from victim organizations. Cl0P has been involved in significant “big game hunter” ransomware attacks, targeting a variety of industries without specific regional focus and avoiding organizations within the Commonwealth of Independent States (CIS).

CloudEyE

CloudEye is a downloader that targets the Windows platform and is used to download and install malicious programs on victims’ computers.

DarkGate

DarkGate, active since December 2017, is a sophisticated Malware-as-a-Service (MaaS) known for its wide-ranging capabilities, including credential theft, keylogging, screen capturing, and remote access. DarkGate emerged as a prominent threat within cybercriminal circles (mainly underground forums). The malware has adapted to circumvent security defenses and is used in diverse attack strategies, including phishing emails and exploiting communication platforms like Microsoft Teams.

DoppelPaymer

DoppelPaymer, first noticed in 2019, is a sophisticated ransomware strain, evolving from the earlier BitPaymer. It targets a wide range of sectors, with no specific industry preference, and uses the Dridex Trojan for initial infiltration through spear-phishing emails. DoppelPaymer is known for its double extortion tactic and was involved in several notable attacks on major organizations worldwide.

Emotet

Emotet is an advanced and modular multipurpose malware. Emotet was once employed as a banking Trojan, and now is used as a distributer for other malware or malicious campaigns. It uses multiple methods for maintaining persistence and evasion techniques to avoid detection. In addition, Emotet can also be spread through phishing spam emails containing malicious attachments or links.

FakeUpdates

Fakeupdates (AKA SocGholish) is a downloader written in JavaScript. It writes the payloads to disk prior to launching them. Fakeupdates led to further system compromise via many additional malware, including GootLoader, Dridex, NetSupport, DoppelPaymer, and AZORult.

FormBook

FormBook is an Infostealer targeting the Windows OS and was first detected in 2016. It is marketed as Malware-as-a-Service (MaaS) in underground hacking forums for its strong evasion techniques and relatively low price. FormBook harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes, and can download and execute files according to orders from its C&C.

Glupteba

Known since 2011, Glupteba is a Windows backdoor that gradually matured into a botnet. By 2019 it included a C&C address update mechanism through public BitCoin lists, an integral browser stealer capability, and a router exploiter.

GootLoader

GootLoader is a stealthy malware, primarily used as a first-stage downloader attacking Windows-based systems. Initially serving as a downloader for the GootKit banking Trojan, it has evolved into a multi-payload malware platform capable of delivering sophisticated second-stage payloads like Cobalt Strike beacon and REvil ransomware. GootLoader uses SEO poisoning to redirect victims to compromised websites for drive-by download campaigns, impacting various industries across multiple countries. It employs advanced techniques like reflective loading and PowerShell commands for persistence and evasion.

Horse Shell

Horse Shell is a custom malware utilized by the Chinese state-sponsored hacking group “Camaro Dragon” for targeting European foreign affairs organizations. Discovered in January 2023, this malware infects residential TP-Link routers, enabling attackers to gain complete control over these devices. Horse Shell operates as a backdoor, executing shell commands, transferring files, and using the router as a SOCKS proxy for communications.

Impala Stealer

Impala Stealer is a crypto-stealing malware targeting .NET developers through malicious NuGet packages. It operates by installing a persistent backdoor to access and steal cryptocurrency account details, utilizing typosquatting to disguise itself as legitimate software packages

JaguarTooth

JaguarTooth is a Cisco IOS malware that targets and modifies routers’ authentication mechanisms to allow unauthenticated backdoor access. It collects and exfiltrates device and network information, including firmware versions and network configurations, via the Trivial File Transfer Protocol (TFTP). JaguarTooth was deployed through the exploitation of a known Simple Network Management Protocol (SNMP) vulnerability, CVE-2017-6742.

KV-botnet

The KV-Botnet, linked to the China-linked threat actor Volt Typhoon, is a sophisticated botnet that primarily targets small office/home office (SOHO) router devices. Active since at least February 2022, it consists of two complementary activity clusters named KV and JDY.

LemonDuck

LemonDuck is a cryptocurrency-mining botnet which targets victims’ computer resources to mine the Monero virtual currency. It employs various methods to spread across the network, such as sending infected RTF files using email, psexec, WMI, and SMB exploits, including the infamous Eternal Blue and SMBGhost threats that affect Windows 10 machines.

LEMURLOOT

LEMURLOOT is a web shell malware associated with the CL0P ransomware group, designed to exploit a critical SQL injection vulnerability (CVE-2023-34362) in the MOVEit Transfer managed file transfer (MFT) application. LEMURLOOT is written in C# and requires a hard-coded password for authentication. This malware was instrumental in significant data theft and extortion attempts by the CL0P group.

LockBit

LockBit is a ransomware, operating on a RaaS model, first reported in September 2019. LockBit targets large enterprises and government entities from various countries and does not target individuals in Russia or the Commonwealth of Independent States.

Lokibot

LokiBot is a commodity infostealer for Windows. It harvests credentials from a variety of applications, web browsers, email clients, IT administration tools such as PuTTY, and more. LokiBot was sold on hacking forums and its source code is believd to have leaked, thus allowing for a range of variants to appear. It was first identified in February 2016.

Lucifer

Lucifer is a hybrid malware known for its capabilities in both cryptojacking and launching Distributed Denial-of-Service (DDoS) attacks. Leveraging multiple high and critical severity exploits, Lucifer originally targeted the Windows system. However, it recently evolved into a multi-platform and multi-architecture malware targeting Linux, and IoT devices, and has separate ARM and MIPS versions.

Medusa

Medusa ransomware, active since June 2021, is a Ransomware-as-a-Service (RaaS) model employing a double-extortion tactic (encrypts and exfiltrates data, threatening to leak or sell it if the ransom isn’t paid.)

Mirai

Mirai is an infamous Internet-of-Things (IoT) malware that tracks vulnerable IoT devices, such as web cameras, modems and routers, and turns them into bots. The botnet is used by its operators to conduct massive Distributed Denial of Service (DDoS) attacks. The Mirai botnet first surfaced in September 2016 and quickly made headlines due to some large-scale attacks including a massive DDoS attack used to knock the entire country of Liberia offline, and a DDoS attack against the Internet infrastructure firm Dyn, which provides a significant portion of the United States internet’s infrastructure.

Nanocore

NanoCore is a Remote Access Trojan (RAT) that targets Windows operating system users and was first observed in the wild in 2013. All versions of the RAT contain basic plugins and functionalities such as screen capture, cryptocurrency mining, remote control of the desktop and webcam session theft.

NetSupport

NetSupport malware, identified as a Remote Access Trojan (RAT), targets sectors like education, government, and business services. Originally a legitimate remote administration tool, NetSupport was repurposed by threat actors for malicious activities such as monitoring behavior, file transfer, and infiltrating networks.

njRAT

njRAT, aka Bladabindi, is a RAT developed by the M38dHhM hacking group. First reported in 2012, it has been used primarily against targets in the Middle East.

Nokoyawa

Nokoyawa is a Windows-based ransomware family first identified in February 2022 and is known for double extortion attacks. This ransomware, initially written in C and later rewritten in Rust, demonstrates coding similarities with the Nemty and Karma ransomware families. The ransomware is known to exploit vulnerabilities like CVE-2023-28252 in attacks.

Phorpiex

Phorpiex is a botnet (a.k.a Trik) that has been active since 2010 and at its peak controlled more than a million infected hosts. It is known for distributing other malware families via spam campaigns as well as fueling large-scale spam and sextortion campaigns.

Qbot

Qbot AKA Qakbot is a banking Trojan that first appeared in 2008. It was designed to steal a user’s banking credentials and keystrokes. Often distributed via spam email, Qbot employs several anti-VM, anti-debugging, and anti-sandbox techniques to hinder analysis and evade detection.

Raccoon

Raccoon infostealer was first observed in April 2019. This infostealer targets Windows systems and is sold as a MaaS (Malware-as-a-Service) in underground forums. It is a simple infostealer capable of collecting browser cookies, history, login credentials, crypto currency wallets and credit card information.

Ramnit

Ramnit is a modular banking Trojan first discovered in 2010. Ramnit steals web session information, giving its operators the ability to steal victim credentials for all services, including bank accounts and corporate and social network accounts. The Trojan uses both hardcoded domains as well as domains generated by a DGA (Domain Generation Algorithm) to contact the C&C server and download additional modules.

Raspberry Robin

Raspberry Robin is a multipurpose malware initially distributed through infected USB devices with worm capabilities.

RedRelay

RedRelay is a shared proxy network utilized by various threat actors including the Chinese cyber espionage actor Red Vulture. RedRelay employs features like multi-hop proxying and encrypted communication, making analysis and attribution challenging. The network is constructed from a combination of threat actor-operated virtual private servers (VPS) and compromised devices.

Remcos

Remcos is a RAT that first appeared in the wild in 2016. Remcos distributes itself through malicious Microsoft Office documents that are attached to SPAM emails and is designed to bypass Microsoft Windows UAC security and execute malware with high-level privileges.

RubyMiner

RubyMiner was first seen in the wild in January 2018 and targets both Windows and Linux servers. RubyMiner seeks out vulnerable web servers (such as PHP, Microsoft IIS, and Ruby on Rails) and uses them for cryptomining activity using the open source Monero miner XMRig.

StripedFly

StripedFly, originally misclassified as a cryptocurrency miner, is a complex and versatile wormable malware framework. Its impact is worldwide, infecting more than a million victims since at least 2017.

Ursine

Ursnif is a variant of the Gozi banking Trojan for Windows, whose source code was leaked online. It has Man-in-the-Browser capabilities to steal banking information and credentials for popular online services. In addition, it can steal information from local email clients, browsers and cryptocurrency wallets. Finally, it can download and execute additional files on the infected system.

WannaMine

WannaMine is a sophisticated Monero crypto-mining worm that spreads the EternalBlue exploit. WannaMine leverages Windows Management Instrumentation (WMI) permanent event subscriptions to spread and maintain persistence.

XMRig

XMRig is open-source CPU mining software used to mine the Monero cryptocurrency. Threat actors often abuse this open-source software by integrating it into their malware to conduct illegal mining on victims’ devices.

ZuoRAT

ZuoRAT is a Remote Access Trojan (RAT) with a focus on small office/home office (SOHO) routers. Derived from the Mirai botnet, it has been operating since at least 2020. ZuoRAT employs extensive network reconnaissance, data collection, and the hijacking of network communications.