Security Affairs

MAY 19, 2024

If the user is in a targeted country (Mexico, Chile, Spain, Costa Rica, Peru, or Argentina), they are redirected to an image of a PDF icon, while a ZIP file is downloaded in the background. Finally the loader downloads, decrypts and executes the Grandoreiro banking trojan.

Banking 100

Banking Malware Antivirus Accountability 100

Security Affairs

NOVEMBER 19, 2022

The DEV-0569 group carries out malvertising campaigns to spread links to a signed malware downloader posing as software installers or fake updates embedded in spam messages, fake forum pages, and blog comments. The downloader, tracked as BATLOADER , shares similarities with another malware called ZLoader. anydeskos[.]com

Ransomware 126

Ransomware Malware Antivirus Phishing 126

Security Affairs

MARCH 7, 2022

SharkBot banking malware was able to evade Google Play Store security checks masqueraded as an antivirus app. The malware was spotted at the end of October by researchers from cyber security firms Cleafy and ThreatFabric, the name comes after one of the domains used for its command and control servers. .”

Banking 78

Banking Antivirus Mobile Malware 78

Security Affairs

MARCH 11, 2020

Antivirus maker Avast has disabled a core component of its antivirus to address a severe vulnerability that would have allowed attackers to control users’ PC. Ormandy pointed out that the main Avast antivirus process, AvastSvc.exe, which, runs as SYSTEM.

Engineering 111

Engineering Antivirus Advertising Hacking 111

Security Affairs

JUNE 27, 2021

“While the Windows system is in safe mode antivirus software doesn’t work. The researchers started investigating the threat after they became aware that the malware was disabling and uninstalling its antivirus from infected devices. “It also uses WQL to query all antivirus software installed SELECT * FROM AntiVirusProduct.”

Antivirus 106

Antivirus Cryptocurrency Malware Software 106

Security Affairs

NOVEMBER 26, 2021

Babadeda is able to bypass antivirus solutions. According to the researchers, this crypto-malware was recently employed in several campaigns to deliver information stealers, RATs, and ransomware like LockBit. The messages urge the recipients to download an application. ” reads the report published by Morphisec.

Cryptocurrency 118

Cryptocurrency Malware Antivirus Phishing 118

Security Affairs

FEBRUARY 28, 2023

Antivirus company Bitdefender has released a free decryptor for the recently discovered ransomware family MortalKombat. Good news for the victims of the recently discovered MortalKombat ransomware , the antivirus firm Bitdefender has released a free decryptor that will allow them to recover their file without paying the ransom.

Ransomware 88

Ransomware Antivirus Backups Malware 88

Security Affairs

DECEMBER 26, 2022

Cybersecurity researchers exposed new evasion techniques adopted by an advanced malware downloader called GuLoader. CrowdStrike researchers d a detailed multiple evasion techniques implemented by an advanced malware downloader called GuLoader (aka CloudEyE ). an ieinstal.exe) and injects the same shellcode into the new process.

Malware 94

Malware Antivirus Hacking Cybersecurity 94

Security Affairs

DECEMBER 9, 2021

“Luckily, these packages were removed before they could rack up a large number of downloads (based on npm records) so we managed to avoid a scenario similar to our last PyPI disclosure, where the malicious packages were downloaded tens of thousands of times before they were detected and removed.”

Antivirus 85

Antivirus Malware Accountability Firewall 85

Security Affairs

APRIL 9, 2022

Experts discovered malicious Android apps on the Google Play Store masqueraded as antivirus solutions spreading the SharkBot Trojan. Sharkbot is an information stealer steals used by crooks to siphon credentials and banking information. Most of the victims are located in Italy and the UK.

Banking 86

Banking Antivirus Malware Accountability 86

Security Affairs

JANUARY 6, 2023

Antivirus firm Bitdefender released a decryptor for the MegaCortex ransomware allowing its victims to restore their data for free. Antivirus firm Bitdefender released a decryptor for the MegaCortex ransomware , which can allow victims of the group to restore their data for free.

Ransomware 94

Ransomware Antivirus Encryption Backups 94

Security Affairs

MARCH 29, 2023

The attackers take advantage of the fact that the official Tor Project has been banned in Russia since the end of 2021, so users in Russia search for third-party repositories to download the Tor browser. The victims download the Tor Browser from a third-party server and execute it as torbrowser.exe. ” concludes the report.

Malware 84

Malware Passwords Cryptocurrency Antivirus 84

Security Affairs

APRIL 7, 2021

The CVE-2018-13379 is a path traversal vulnerability in the FortiOS SSL VPN web portal that could be exploited by an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests. The #CRING #ransomware is then downloaded via certutill. ” reads the post published by Kaspersky.

VPN 93

VPN Ransomware Antivirus Firmware 93

Security Affairs

AUGUST 21, 2022

” The infection chain begins with a spear-phishing message written in Spanish that includes a link that points to a website that further downloads a malicious ZIP archive on the victim’s machine. .” ” reads the post published by Zscaler. That’s not all. ” concludes the report.

Banking 88

Banking Malware Antivirus Phishing 88

Security Affairs

MARCH 9, 2021

If you are already mid-update to a later CU, you should continue with that update.” You might be prompted by the installer to restart.). Microsoft has also updated its Microsoft Safety Scanner (MSERT) tool to detect web shells employed in the recent Exchange Server attacks.

Antivirus 128

Antivirus Accountability Software Hacking 128

Security Affairs

APRIL 11, 2021

More than 500,000 Huawei users have been infected with the Joker malware after downloading apps from the company’s official Android store. More than 500,000 Huawei users were infected with the Joker malware after they have downloaded tainted apps from the company’s official Android store. ltd, the remaining 2 by the developer ??.

Malware 138

Malware Spyware Mobile Antivirus 138

Security Affairs

AUGUST 23, 2022

This backdoor allows operators to download and install additional malicious modules. “To download modules, Android.Backdoor.854.origin In response, the server sends a list of plugins that the trojan will download, decrypt and run.” ” reads the analysis. 3104 starts a local server. . ” concludes Dr.Web.

Mobile 91

Mobile Firmware Malware Wireless 91

Security Affairs

AUGUST 31, 2022

The phishing emails contain a Microsoft Office attachment that includes an external reference in its metadata which downloads a malicious template file. Upon opening the document, a malicious template file is downloaded and saved on the system. jpg” that appears as an image of the First Deep Field captured by JWST is downloaded.

Malware 80

Malware DNS Antivirus Encryption 80

Security Affairs

AUGUST 21, 2022

Recently security experts from Sucuri, spotted JavaScript injections targeting WordPress sites to display fake DDoS Protection pages which lead victims to download remote access trojan malware. “Unfortunately, attackers have begun leveraging these familiar security assets in their own malware campaigns.

DDOS 90

DDOS Malware Antivirus Firewall 90

Security Affairs

JUNE 14, 2021

Microsoft 365 Defender data shows that the SEO poisoning technique is effective, given that Microsoft Defender Antivirus has detected and blocked thousands of these PDF documents in numerous environments. — Microsoft Security Intelligence (@MsftSecIntel) June 11, 2021.

Antivirus 67

Antivirus Security Intelligence Malware Insurance 67

Security Affairs

MAY 16, 2020

and is delivered through a Java downloader embedded in the.jar file, Trend Micro warns. . “Running this file led to the download of a new, undetected malware sample written in Node.js; this trojan is dubbed as “QNodeService”.” However, the use of an uncommon platform may have helped evade detection by antivirus software.”

Malware 106

Malware Phishing Advertising Antivirus 106

Security Affairs

FEBRUARY 22, 2021

Excel documents created with the APOMacroSploit builder are capable of bypassing antivirus software, Windows Antimalware Scan Interface (AMSI), and even Gmail and other email-based phishing detection. The macro is triggered automatically when the victim opens the document, and downloads a BAT file from cutt.ly.”

Malware 108

Malware Antivirus Phishing Cryptocurrency 108

Security Affairs

MARCH 14, 2022

An HTML file downloads a.lnk file mascaraed of an MSI file that takes advantage of the LoL bins to execute an MSI file (segunda.msi). segunda.msi” downloads and executes an EXE file that will drop the final stage. The URL available on the email templates downloads an HTML file called “ Dividas 2021.html Playing with LOL bins .

Banking 85

Banking Encryption Malware Phishing 85

Security Affairs

DECEMBER 10, 2020

. “In observations collected since October 2020, Unit 42 researchers have found that malware authors have been leveraging njRAT (also known as Bladabindi), a Remote Access Trojan, to download and deliver second-stage payloads from Pastebin, a popular website that is well-known to be used to store data anonymously.”

Malware 77

Malware Antivirus Encryption Hacking 77

Security Affairs

OCTOBER 13, 2022

Having infected the victim, attackers download and run malicious payloads on their device, as well as get hold of the keys to their account on the official WhatsApp app.” The experts also discovered the adv for software development kit (SDK) that included the downloader for the malicious payload. ” reported Kaspersky.

Mobile 103

Mobile Accountability Advertising Antivirus 103

Security Affairs

APRIL 29, 2023

One of the key steps performed by the malware before downloading a first-stage PowerShell loader is a series of anti-virtual machine, anti-monitoring, and anti-malware checks. ViperSoftX also checks for active antivirus products running on the machine. ” continues the report.

Encryption 85

Encryption Malware Cryptocurrency Software 85

Security Affairs

DECEMBER 26, 2022

Cybersecurity researchers exposed new evasion techniques adopted by an advanced malware downloader called GuLoader. CrowdStrike researchers d a detailed multiple evasion techniques implemented by an advanced malware downloader called GuLoader (aka CloudEyE ). an ieinstal.exe) and injects the same shellcode into the new process.

Malware 52

Malware Antivirus Hacking Cybersecurity 52

Security Affairs

MARCH 9, 2023

Upon successful exploitation of vulnerable Oracle WebLogic servers, it will download a PowerShell script, named “bypass.ps1,” which contains the ScrubCrypt crypter. The PowerShell script is encoded to avoid detection by AntiVirus solutions. This URI belongs to an Oracle Weblogic server.

Antivirus 87

Antivirus Encryption Hacking Cybercrime 87

Security Affairs

FEBRUARY 20, 2021

“The novelty of this downloader arises primarily from the way it uses JavaScript for execution—something we hadn’t previously encountered in other macOS malware—and the emergence of a related binary compiled for Apple’s new M1 ARM64 architecture.” ” reads the analysis published by RedCanary. ” concludes the report.

Malware 142

Malware Adware Antivirus DDOS 142

Security Affairs

OCTOBER 19, 2023

Then attackers used PowerShell to download two payloads from legitimate infrastructure they had previously compromised. Use Microsoft Defender Antivirus to protect from this threat. Microsoft attributes the recent attacks to two North Korean APT groups Diamond Sleet and Onyx Sleet, which operate under the Lazarus Group umbrella.

Artificial Intelligence 103

Artificial Intelligence Accountability Antivirus Authentication 103

Security Affairs

JUNE 17, 2021

. “Mandiant Consulting observed the Trojanized installer downloaded on a Windows workstation after the user visited a legitimate site that the victim organization had used before.” “Mandiant confirmed the user intended to download, install, and use the SmartPSS software. ” continues the analysis.

Cybercrime 104

Cybercrime Ransomware Antivirus Software 104

Security Affairs

NOVEMBER 3, 2022

In order to weaken the security defenses installed on the target machine, Black Basta targets installed security solutions with specific batch scripts downloaded into the Windows directory. The DisableAntiSpyware parameter allows disabling the Windows Defender Antivirus in order to deploy another security solution.

Cybercrime 93

Cybercrime Ransomware Antivirus Malware 93

Security Affairs

MARCH 4, 2021

.” “Mandiant Threat Intelligence discovered a sample of the SUNSHUTTLE backdoor uploaded to an online multi-Antivirus scan service.” ” reads the analysis published by Fireeye. ” The SUNSHUTTLE backdoor was likely developed to conduct network reconnaissance alongside other SUNBURST -related tools.

Malware 113

Malware Hacking Antivirus Information Security 113

Security Affairs

AUGUST 23, 2020

Experts pointed out that Google Chrome appears to implicitly trust any file downloaded from Google Drive, even if they are flagged and “malicious” by antivirus software as malicious. ” reads the post published by THN.

Malware 129

Malware Phishing Advertising Antivirus 129

Security Affairs

MARCH 20, 2023

Upon providing the CAPTCHA, the victim will be asked to download a ZIP archive containing the Redline Trojan variant. This is not noticeable by the victim during the download, as the file is compressed and most of that artificial size has just been filled with zeros.” ” reads the anaysis published by Avast.

Antivirus 72

Antivirus Malware Engineering Hacking 72

Security Affairs

JULY 1, 2019

On June 26, 2019, experts at eSentire Threat Intelligence discovered a C2 infrastructure pointing to a similar Dridex variant that was undetected by most of the antivirus listed in VirusTotal service. At the time of discovery, using data from VirusTotal, only six antivirus solutions of about 60 detected suspicious behavior [ 2 ].

Banking 74

Banking Antivirus Advertising Encryption 74

Security Affairs

JULY 9, 2019

The malware abused living-off-the-land binaries (LOLbins) such as the command line interface of the Windows Management Instrumentation Console ( WMIC ) to download and install malicious payloads in the background. According to the experts, LOLbins are very effecting in evading antivirus software. .

Antivirus 71

Antivirus Malware Advertising Security Intelligence 71