Finished Songs: Bands/Groups N-Z Cover Girl (New Kids On The Block); Games (New Kids On The Block); Hangin’ Tough (New Kids On The Block); I’ll Be Loving You (Forever) (New Kids On The Block); Please Don’t Go Girl (New Kids On The Block); Step by Step (New Kids On The Block)

Removed From Troubles (Not open for application) Dave (Ant-Man series); Kurt (Ant-Man series); Luis (Ant-Man series); Lang, Scott ‘Ant-Man’ (Avengers series, The); van Dyne, Hope ‘The Wasp’ (Avengers series, The); Wilson, Wade Winston ‘Deadpool’ (Deadpool); Salander, Lisbeth (Millennium series, The) Removed From Troubles – Closed (Open for application) Kili (Lord of the Rings series, The […]

Finished Objects Daggers

What kind of malware is SteelFox?

SteelFox is a trojan – specifically, a malware bundle with its primary components including a data stealer and cryptocurrency miner. SteelFox infiltrates systems through a sophisticated infection chain.

This trojan has been around since at least 2023, and it was noted being proliferated under the guise of illegal software activation tools ("cracks"). The SteelFox campaign is active worldwide, with the most infections registered in Brazil, China, Russia, Mexico, United Arab Emirates, Egypt, Algeria, Vietnam, India, and Sri Lanka.

What kind of website is predatorwallpaper.com?

Predatorwallpaper.com is the address of a fake search engine that we discovered while investigating the Predator Search browser hijacker. It modifies browser settings to cause redirects to this search engine, which cannot provide search results.

It is pertinent to mention that predatorwallpaper.com could be endorsed by other browser hijackers, and the same is true of Predator Search (i.e., redirect to different sites).

What kind of software is Ultra Button?

Upon examination, we determined that the Ultra Button browser extension is adware. Software within this classification is designed to generate revenue for its developers/publishers through advertising. Additionally, Ultra Button collects a variety of sensitive information.

What kind of malware is RunningRAT?

RunningRAT is a Remote Access Trojan (RAT) that was known for stealing sensitive information from victims. Now, cybercriminals are using it to distribute cryptocurrency miners. RunningRAT is likely to lead to higher electricity costs and hardware damage for victims. Thus, it should be removed from infected systems as soon as possible.

What is fake "$testME Token Claim" website?

Our examination of the site (testme.mefoundaiton[.]xyz) has shown that it is a deceptive platform offering individuals to claim $testME tokens. The true purpose of this web page is to steal cryptocurrency from victims. Therefore, this and similar sites should be avoided.

What is "Email Password Time Running Out"?

We have analysed this email and found that it is a scam email designed to appear like a notification from an email service provider. This email contains a link to a phishing website designed to steal personal information. Recipients should ignore such emails and know how to recognize them.

What kind of extension is SpeedyLook?

Our examination of SpeedyLook has revealed that it is an unreliable browser extension designed to hijack a web browser by changing its settings. This extension forces users to visit guardflares.com. Additionally, SpeedyLook enables the "Managed by your organization" setting (in Chrome browsers).

What kind of malware is Ymir?

Ymir is a ransomware-type program. It operates by encrypting files (using ChaCha20 cryptographic algorithm) and demanding ransoms for the decryption.

The filenames of files locked by Ymir are altered by being appended with an extension comprising a random character string. For example, a file initially titled "1.jpg" has appeared as "1.jpg.6C5oy2dVr6".

After the encryption is concluded, Ymir drops ransom notes – "INCIDENT_REPORT.pdf" – into each affected folder. This ransomware also displays another message in a full-screen that precedes the log-in screen.

What is guardflares.com?

We have inspected guardflares.com and discovered that it is a fake search engine. We also found that guardflares.com is promoted through a browser hijacker, an extension known as SpeedyLook. Search engines promoted through such extensions should not be trusted. If guardflares.com and (or) SpeedyLook are present within a browser, they should be removed.

What kind of malware is UnicornSpy?

UnicornSpy is malware used to steal sensitive information. Cybercriminals have been observed using UnicornSpy to target energy companies, factories, and suppliers (and developers) of electronic components. The channel used for the distribution of this malware is email. However, threat actors may also deliver UnicornSpy using other methods.

What is the fake "Aethir ($ATH) Allocation" website?

"Aethir ($ATH) Allocation" is a scam imitating the Aethir platform (aethir.com). This scheme entices users to inadvertently expose their digital wallets to a crypto drainer by promoting an allocation increase of ATH cryptocurrency. Victims of this scam experience financial loss.

What is "Payroll Report Status"?

We have inspected this email and learned that its purpose is to extract personal information from recipients. Emails of this type are classified as phishing emails. This particular email is disguised as a letter regarding a change in the payroll report status to appear legitimate and lure recipients into opening a deceptive website.

What is the fake "Claim SatoshiDEX (SATX)" website?

"Claim SatoshiDEX (SATX)" is a scam that is almost a perfect visual copy of SatoshiDEX (satoshidex.ai). Upon inspection, we determined that this fake page (satoshidex-ai[.]org and potentially others) is a cryptocurrency drainer. The scheme lures users into exposing their digital wallets to steal the assets stored therein.

What is the fake "Seedify Regstration" website?

While browsing suspicious websites, our researchers discovered the "Seedify Regstration" scam. It imitates the Seedify website (seedify.fund). The scheme operates as a cryptocurrency drainer and steals funds from exposed digital wallets. It must be emphasized that this scam is not associated with Seedify.

What kind of page is traversol.co[.]in?

While investigating suspect sites, our researchers discovered the traversol.co[.]in rogue page. After inspecting this webpage, we learned that it endorses browser notification spam and redirects users to different (likely untrustworthy/hazardous) websites.

The majority of visitors enter traversol.co[.]in and pages of this kind via redirects caused by sites that utilize rogue advertising networks.