Threat type: Backdoor

Aliases: Backdoor:MSIL/Bladabindi.SBR!MSR (Microsoft), MSIL:Bladabindi-JK [Trj](AVAST)

Platforms: Windows

Overall Risk Rating: Low

Damage Potential: Medium

Distribution Potential: Low

Reported Infection: Low

Information Exposure: High

Overview:

Cybercriminals used this malware bundled with legitimate installation copies of the VPN software known as Windscribe. Note that these copies are hosted from fraudulent sources.

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It gathers certain information on the affected computer. It logs a user's keystrokes to steal information.

Threat type: Backdoor

Aliases: Trojan:MSIL/Solorigate.B!dha (Microsoft); Trj/Solorigate.A (Panda)

Platforms: Windows

Overall Risk Rating: Low

Damage Potential: High

Distribution Potential: Low

Reported Infection: Low

Information Exposure: Medium

Overview:

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Threat type: Trojan

Aliases: MSIL/Agent.5676!tr (FORTINET)

Platforms: Windows

Overall Risk Rating: Low

Damage Potential: High

Distribution Potential: Low

Reported Infection: Low

Information Exposure: Low

Overview:

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be hosted on a website and run when a user accesses the said website.

It executes commands from a remote malicious user, effectively compromising the affected system.

Threat type: Ransomware

Aliases: Trojan-Ransom.FileCrypter (IKARUS), W32/Encoder.AFA!tr (FORTINET)

Platforms: Windows

Overall Risk Rating: Low

Damage Potential: High

Distribution Potential: Low

Reported Infection: Low

Information Exposure: Low

Overview:

This Ransomware may be dropped by other malware.

Threat type: Ransomware

Aliases: Trojan-Ransom.Thanos (Ikarus), HEUR:Trojan-Ransom.MSIL.Encoder.gen (Kaspersky)

Platforms: Windows

Overall Risk Rating: Low

Damage Potential: High

Distribution Potential: Low

Reported Infection: Low

Information Exposure: Low

Overview:

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It creates certain registry entries to disable applications related to security.

It encrypts files with specific file extensions. It drops files as ransom note.

Threat type: Ransomware

Aliases: Ransom:MSIL/Filecoder.EY!MTB (MICROSOFT), Trojan-Ransom.FileCrypter (IKARUS)

Platforms: Windows

Overall Risk Rating: Low

Damage Potential: Medium

Distribution Potential: Low

Reported Infection: Low

Information Exposure: Low

Overview:

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Threat type: Trojan Spy

Aliases: MSIL/Kryptik.AAHQ!tr(FORTINET); Trj/GdSda.A(PANDA)

Platforms: Windows

Overall Risk Rating: Low

Damage Potential: Medium

Distribution Potential: Low

Reported Infection: Low

Information Exposure: High

Overview:

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Threat type: Trojan Spy

Aliases: a variant of MSIL/Kryptik.AAHN trojan(NOD32); PWS-FCXD!F291EAD13EAD(NAI)

Platforms: Windows

Overall Risk Rating: Low

Damage Potential: Medium

Distribution Potential: Low

Reported Infection: Low

Information Exposure: High

Overview:

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Threat type: Ransomware

Aliases: HEUR:Trojan.MSIL.Fsysna.gen (Kaspersky);

Platforms: Windows

Overall Risk Rating: Low

Damage Potential: High

Distribution Potential: Low

Reported Infection: Low

Information Exposure: Low

Overview:

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files found in specific folders.

Threat type: Trojan

Aliases: DoS:Win32/WhisperGate.I!dha (MICROSOFT)

Platforms: Windows

Overall Risk Rating: Low

Damage Potential: Medium

Distribution Potential: Low

Reported Infection: Low

Information Exposure: Low

Overview:

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Threat type: Ransomware

Aliases: Trojan:MSIL/XWormRAT.A!MTB (MICROSOFT)

Platforms: Windows

Overall Risk Rating: Low

Damage Potential: Medium

Distribution Potential: Low

Reported Infection: Low

Information Exposure: High

Overview:

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It adds certain registry entries to disable the Task Manager. This action prevents users from terminating the malware process, which can usually be done via the Task Manager.

It terminates itself if it detects it is being run in a virtual environment.

It encrypts files with specific file extensions. It drops files as ransom note. It avoids encrypting files with the following file extensions.

Whitepaper from Phrack called .NET Instrumentation via MSIL bytecode injection.

Over All Risk Rating : Low


This ransomware is one of the few ransomware families that is loaded and executed under the legitimate PowerShell executable. It also is one of the few that uses restart session manager to terminate processes that have associated files it tries to encrypt.

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Read More

Over All Risk Rating : Low


This malware was seen delivered via malicious spam spoofing the brand DHL as the sender. It came as an .ISO attachment. It possibly is used for spearphishing activities.

This Backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Read More

Over All Risk Rating : Low


This ransomware is one of the few ransomware families that is loaded and executed under the legitimate PowerShell executable. It also is one of the few that uses restart session manager to terminate processes that have associated files it tries to encrypt.

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Read More

Over All Risk Rating : Low


This malware was seen delivered via malicious spam spoofing the brand DHL as the sender. It came as an .ISO attachment. It possibly is used for spearphishing activities.

This Backdoor arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Read More

The television personality, 39, turned head as she stepped out in leather flares with sister Kourtney during Paris Fashion Week on Monday.